diff --git a/.gitignore b/.gitignore
index 4922ef6df..7b7bc57f2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,6 +35,7 @@ output/
 !tests/fixtures/npm/cases/workspace-copied/node_modules/*/dist/
 !tests/fixtures/provenance/node_modules/*/dist/
 !tests/fixtures/npm-static/node_modules/*/dist/
+!tests/corpus/*/node_modules/*/dist/
 .scriptc/
 *.log
 .DS_Store
diff --git a/AGENTS.md b/AGENTS.md
index a5d0a30be..ba32fe688 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -196,6 +196,7 @@ The docs site is a standalone pnpm workspace under `docs/`. It uses Next.js App
 - A labeled bullet (`- **Crypto:** ...`) is `docs/content/limitations/<section>/<label>.mdx`, for example `builtin-apis/crypto.mdx`. Edit that file to change the bullet.
 - The other text of a section (paragraphs, code blocks, unlabeled lists) is `docs/content/limitations/<section>.mdx`; text before the first heading is `introduction.mdx`.
 - `<section>` and `<label>` are the heading and label text in lowercase with each run of other characters replaced by `-`.
+- Write one sentence per line; a bullet's continuation lines are indented two spaces. Markdown joins the lines, and edits to different sentences don't conflict.
 - To add a bullet, add its file and an include line at its position in `limitations.mdx`, with a blank line on each side. Consecutive bullet includes render as one list.
 - To add a section, add the heading to `limitations.mdx` and include the section's partial below it.
 
diff --git a/docs/content/docs/coverage.mdx b/docs/content/docs/coverage.mdx
index 805d7f612..b27327b91 100644
--- a/docs/content/docs/coverage.mdx
+++ b/docs/content/docs/coverage.mdx
@@ -76,7 +76,7 @@ Coverage and `scriptc build` report the same diagnostic codes. Common ones inclu
 Some code compiles but can behave differently than under Node.js. Coverage reports the cases it can detect as `SC6xxx` warnings, and `scriptc build` prints the same warnings after a successful build. They never fail a build, but `--fail-on=divergences` can fail a CI job on them.
 
 - `SC6001`: a record passed to, stored as, asserted as, or stored as an array element of a record type with different properties is copied, and the program then writes through the copy or compares it by identity.
-- `SC6002`: an object literal's key order differs from its type's declaration order, and the program observes the order through `JSON.stringify`, `Object.keys`, `Object.values`, `Object.entries`, `for...in`, or console output.
+- `SC6002`: values of one record type are built in different key orders, so the type keeps its declaration order, an object literal's key order differs from it, and the program observes the order through `JSON.stringify`, `Object.keys`, `Object.values`, `Object.entries`, `for...in`, or console output.
 - `SC6003`: `localeCompare` compares a string literal outside the built-in Latin-script collation.
 - `SC6004`: a call passes a class instance to a function that casts it to an unrelated class.
 - `SC6005`: a `Date` string literal uses a form the native parser does not accept.
diff --git a/docs/content/limitations/array-bounds-and-runtime-errors.mdx b/docs/content/limitations/array-bounds-and-runtime-errors.mdx
index 8eb664a24..7490a1e15 100644
--- a/docs/content/limitations/array-bounds-and-runtime-errors.mdx
+++ b/docs/content/limitations/array-bounds-and-runtime-errors.mdx
@@ -1,9 +1,16 @@
-Typed-array reads at an index that is not an integer in the array's range return `undefined`, as in Node.js, and invalid numeric indexed writes are ignored, while the assignment expression retains its original value. A non-null assertion on such a read (`bytes[i]!`) yields `NaN` instead of `undefined`.
+Typed-array reads at an index that is not an integer in the array's range return `undefined`, as in Node.js, and invalid numeric indexed writes are ignored, while the assignment expression retains its original value.
+A non-null assertion on such a read (`bytes[i]!`) yields `NaN` instead of `undefined`.
 
-Ordinary arrays track holes separately from present `undefined` values. Missing reads and empty `pop()`/`shift()` return `undefined`, indexed writes can grow the array, and length growth creates holes.
+Ordinary arrays track holes separately from present `undefined` values.
+Missing reads and empty `pop()`/`shift()` return `undefined`, indexed writes can grow the array, and length growth creates holes.
 
-Keyed reads of a `Record` or an index signature return `undefined` for a missing key, as in Node.js, with or without `noUncheckedIndexedAccess`. A missing array element or key that reaches storage that cannot hold `undefined`, such as a class field typed `number`, throws a `TypeError`.
+Keyed reads of a `Record` or an index signature return `undefined` for a missing key, as in Node.js, with or without `noUncheckedIndexedAccess`.
+A missing array element or key that reaches storage that cannot hold `undefined`, such as a class field typed `number`, throws a `TypeError`.
 
-Runtime traps cannot be caught. User-thrown values and supported exceptions, including JSON parse, checked-cast, filesystem, regex, and `String.prototype.repeat` count errors, can be caught; hard traps such as out-of-range reads of statically typed ordinary arrays terminate the process.
+Runtime traps cannot be caught.
+User-thrown values and supported exceptions, including JSON parse, checked-cast, filesystem, regex, and `String.prototype.repeat` count errors, can be caught; hard traps such as out-of-range reads of statically typed ordinary arrays terminate the process.
 
-Deep recursion in Linux and macOS executables throws Node's catchable `RangeError: Maximum call stack size exceeded`, on the main thread, in worker threads, and inside async functions and generators. The depth at which it is thrown differs from Node: the main thread uses the process stack limit (usually 8 MiB), worker threads get an 8 MiB stack, and async functions and generators run on 512 KiB stacks, so native code usually recurses deeper than Node on threads and somewhat less deeply inside async bodies. Recursion inside runtime library operations, such as serializing deeply nested data, is not checked. Windows executables, WASI builds and library builds do not check the stack, and exhausting it there terminates the process.
+Deep recursion in Linux and macOS executables throws Node's catchable `RangeError: Maximum call stack size exceeded`, on the main thread, in worker threads, and inside async functions and generators.
+The depth at which it is thrown differs from Node: the main thread uses the process stack limit (usually 8 MiB), worker threads get an 8 MiB stack, and async functions and generators run on 512 KiB stacks, so native code usually recurses deeper than Node on threads and somewhat less deeply inside async bodies.
+Recursion inside runtime library operations, such as serializing deeply nested data, is not checked.
+Windows executables, WASI builds and library builds do not check the stack, and exhausting it there terminates the process.
diff --git a/docs/content/limitations/browser-embedding.mdx b/docs/content/limitations/browser-embedding.mdx
index dd3b6cb0d..b1bc83b21 100644
--- a/docs/content/limitations/browser-embedding.mdx
+++ b/docs/content/limitations/browser-embedding.mdx
@@ -1,3 +1,6 @@
-Wasm reactors require a host-provided WASI Preview 1 adapter. A reactor can run supported three.js CPU operations and send animated geometry, material state, and resource lifecycle notifications to an external web application through declared imports. The application supplies DOM, graphics, media, audio, and decoder bindings, including the renderer.
+Wasm reactors require a host-provided WASI Preview 1 adapter.
+A reactor can run supported three.js CPU operations and send animated geometry, material state, and resource lifecycle notifications to an external web application through declared imports.
+The application supplies DOM, graphics, media, audio, and decoder bindings, including the renderer.
 
-Library mode excludes promises, async functions, timers. See [WebAssembly Modules](/docs/wasm) for the embedding contract.
+Library mode excludes promises, async functions, timers.
+See [WebAssembly Modules](/docs/wasm) for the embedding contract.
diff --git a/docs/content/limitations/buffer-construction.mdx b/docs/content/limitations/buffer-construction.mdx
index e92792cfc..aca0c74ca 100644
--- a/docs/content/limitations/buffer-construction.mdx
+++ b/docs/content/limitations/buffer-construction.mdx
@@ -1 +1,3 @@
-`Buffer.from` accepts untyped strings, byte arrays, arrays, and plain array-like or Buffer JSON objects. Encoding arguments must be supported literals. Custom input `valueOf` hooks and opaque class or native-handle inputs throw an unsupported-operation error.
+`Buffer.from` accepts untyped strings, byte arrays, arrays, and plain array-like or Buffer JSON objects.
+Encoding arguments must be supported literals.
+Custom input `valueOf` hooks and opaque class or native-handle inputs throw an unsupported-operation error.
diff --git a/docs/content/limitations/builtin-apis.mdx b/docs/content/limitations/builtin-apis.mdx
index 26c298f03..b587133ed 100644
--- a/docs/content/limitations/builtin-apis.mdx
+++ b/docs/content/limitations/builtin-apis.mdx
@@ -1 +1,3 @@
-A declaration in the standard library does not guarantee that an API compiles. Unsupported declared APIs produce `SC2020`, with alternatives where available. Check the [Node.js compatibility reference](/compatibility) for API-level support.
+A declaration in the standard library does not guarantee that an API compiles.
+Unsupported declared APIs produce `SC2020`, with alternatives where available.
+Check the [Node.js compatibility reference](/compatibility) for API-level support.
diff --git a/docs/content/limitations/builtin-apis/arraybuffers-and-typed-arrays.mdx b/docs/content/limitations/builtin-apis/arraybuffers-and-typed-arrays.mdx
index 59a61518d..012f443eb 100644
--- a/docs/content/limitations/builtin-apis/arraybuffers-and-typed-arrays.mdx
+++ b/docs/content/limitations/builtin-apis/arraybuffers-and-typed-arrays.mdx
@@ -1 +1,9 @@
-- **ArrayBuffers and typed arrays:** Fixed-length ArrayBuffers support shared typed-array and DataView storage. Resizing, transferring, and BigInt arrays are unsupported. `Float16Array` stores IEEE 754 half-precision values, rounding each stored number to nearest-even as Node does; `Math.f16round`, `DataView.prototype.getFloat16` and `setFloat16`, and `util.types.isFloat16Array` compile. Numeric typed arrays and Buffers preserve their kind and shared storage through `unknown`, including when nested in records and arrays. Numeric typed-array constructors can be stored and used with `new`, including constructors read from an array's `constructor` property. JavaScript numeric-array parameters and returns preserve typed-array storage. `Buffer.from`, `Buffer.allocUnsafe`, and `Buffer.concat` return views into a per-thread pool of `Buffer.poolSize` bytes (64 KiB by default) when the size is below `Buffer.poolSize >>> 1`, as in Node; a pool slab stays in memory while any of its Buffers does. Node's own startup code allocates from the first slab, so the `byteOffset` of Buffers in that slab differs from Node's. Buffers returned by other Node APIs, such as `fs.readFileSync` and `zlib`, own their `ArrayBuffer`, where Node allocates small ones from the pool.
+- **ArrayBuffers and typed arrays:** Fixed-length ArrayBuffers support shared typed-array and DataView storage.
+  Resizing, transferring, and BigInt arrays are unsupported.
+  `Float16Array` stores IEEE 754 half-precision values, rounding each stored number to nearest-even as Node does; `Math.f16round`, `DataView.prototype.getFloat16` and `setFloat16`, and `util.types.isFloat16Array` compile.
+  Numeric typed arrays and Buffers preserve their kind and shared storage through `unknown`, including when nested in records and arrays.
+  Numeric typed-array constructors can be stored and used with `new`, including constructors read from an array's `constructor` property.
+  JavaScript numeric-array parameters and returns preserve typed-array storage.
+  `Buffer.from`, `Buffer.allocUnsafe`, and `Buffer.concat` return views into a per-thread pool of `Buffer.poolSize` bytes (64 KiB by default) when the size is below `Buffer.poolSize >>> 1`, as in Node; a pool slab stays in memory while any of its Buffers does.
+  Node's own startup code allocates from the first slab, so the `byteOffset` of Buffers in that slab differs from Node's.
+  Buffers returned by other Node APIs, such as `fs.readFileSync` and `zlib`, own their `ArrayBuffer`, where Node allocates small ones from the pool.
diff --git a/docs/content/limitations/builtin-apis/assertions.mdx b/docs/content/limitations/builtin-apis/assertions.mdx
index 828bed60a..f7f5c9354 100644
--- a/docs/content/limitations/builtin-apis/assertions.mdx
+++ b/docs/content/limitations/builtin-apis/assertions.mdx
@@ -1 +1,12 @@
-- **Assertions:** Assertion failures throw `assert.AssertionError` with Node's `message`, `generatedMessage`, `code`, `actual`, `expected`, `operator`, and `diff` properties. `new AssertionError(options)`, `instanceof`, and `assert.throws(fn, AssertionError)` compile. When `strictEqual` compares function values, `actual` and `expected` read as `undefined`; when `assert.throws` or `assert.rejects` reports an error that is not an instance of the expected class, or that does not match an expected object, `expected` reads as `undefined`. Values whose type can be cyclic, such as recursive records, also read as `undefined`. `assert.AssertionError` used as a value outside `instanceof` throws `SC2020`. `assert.deepEqual` and `assert.notDeepEqual` follow Node's loose comparison, including Maps, Sets, Dates, regular expressions, typed arrays, and errors; operands whose type can be cyclic or holds functions inside a structure are refused. `assert.partialDeepStrictEqual` follows Node's partial comparison over the same values, with the same refusals. Checked-dynamic values compared deeply have no cycle detection. Errors in failure messages print as `[Name: message]`, where Node prints the stack when only one side is an error. `new Assert(options)` compiles when it initializes a `const` with literal `diff`, `strict` and `skipPrototype` options, or none, and the binding is only used to call assertion methods. Other instances, such as ones passed as values, destructured, bound with `let`, or built from options that are not a literal, throw `SC2020`. With `skipPrototype`, `deepStrictEqual` and `notDeepStrictEqual` compare class instances, and operands of different static types, as checked-dynamic values.
+- **Assertions:** Assertion failures throw `assert.AssertionError` with Node's `message`, `generatedMessage`, `code`, `actual`, `expected`, `operator`, and `diff` properties.
+  `new AssertionError(options)`, `instanceof`, and `assert.throws(fn, AssertionError)` compile.
+  When `strictEqual` compares function values, `actual` and `expected` read as `undefined`; when `assert.throws` or `assert.rejects` reports an error that is not an instance of the expected class, or that does not match an expected object, `expected` reads as `undefined`.
+  Values whose type can be cyclic, such as recursive records, also read as `undefined`.
+  `assert.AssertionError` used as a value outside `instanceof` throws `SC2020`.
+  `assert.deepEqual` and `assert.notDeepEqual` follow Node's loose comparison, including Maps, Sets, Dates, regular expressions, typed arrays, and errors; operands whose type can be cyclic or holds functions inside a structure are refused.
+  `assert.partialDeepStrictEqual` follows Node's partial comparison over the same values, with the same refusals.
+  Checked-dynamic values compared deeply have no cycle detection.
+  Errors in failure messages print as `[Name: message]`, where Node prints the stack when only one side is an error.
+  `new Assert(options)` compiles when it initializes a `const` with literal `diff`, `strict` and `skipPrototype` options, or none, and the binding is only used to call assertion methods.
+  Other instances, such as ones passed as values, destructured, bound with `let`, or built from options that are not a literal, throw `SC2020`.
+  With `skipPrototype`, `deepStrictEqual` and `notDeepStrictEqual` compare class instances, and operands of different static types, as checked-dynamic values.
diff --git a/docs/content/limitations/builtin-apis/asynclocalstorage.mdx b/docs/content/limitations/builtin-apis/asynclocalstorage.mdx
index 020382915..341994faa 100644
--- a/docs/content/limitations/builtin-apis/asynclocalstorage.mdx
+++ b/docs/content/limitations/builtin-apis/asynclocalstorage.mdx
@@ -1 +1,2 @@
-- **AsyncLocalStorage:** timer, interval, `setImmediate`, `process.nextTick` and `queueMicrotask` callbacks run with the stores that were active when they were scheduled, as in Node. Completion callbacks of callback-style I/O APIs, such as `fs.readFile` and `crypto.randomBytes`, run with no store, where Node runs them with the stores that were active when the operation started.
+- **AsyncLocalStorage:** timer, interval, `setImmediate`, `process.nextTick` and `queueMicrotask` callbacks run with the stores that were active when they were scheduled, as in Node.
+  Completion callbacks of callback-style I/O APIs, such as `fs.readFile` and `crypto.randomBytes`, run with no store, where Node runs them with the stores that were active when the operation started.
diff --git a/docs/content/limitations/builtin-apis/blob-and-file.mdx b/docs/content/limitations/builtin-apis/blob-and-file.mdx
index 6fe726eda..05aed1ec4 100644
--- a/docs/content/limitations/builtin-apis/blob-and-file.mdx
+++ b/docs/content/limitations/builtin-apis/blob-and-file.mdx
@@ -1 +1,4 @@
-- **Blob and File:** `new Blob()` and `new File()` accept arrays, typed arrays, `Set`, and `Map` as sources. Other iterables throw `SC2020`. `blob.stream()`, `blob.textStream()`, `URL.createObjectURL()`, `stream/consumers` `blob()`, and Blob or File fetch bodies are unsupported. Blobs cannot be sent to workers.
+- **Blob and File:** `new Blob()` and `new File()` accept arrays, typed arrays, `Set`, and `Map` as sources.
+  Other iterables throw `SC2020`.
+  `blob.stream()`, `blob.textStream()`, `URL.createObjectURL()`, `stream/consumers` `blob()`, and Blob or File fetch bodies are unsupported.
+  Blobs cannot be sent to workers.
diff --git a/docs/content/limitations/builtin-apis/builtin-module-lookup.mdx b/docs/content/limitations/builtin-apis/builtin-module-lookup.mdx
index cf47ec723..fd587b029 100644
--- a/docs/content/limitations/builtin-apis/builtin-module-lookup.mdx
+++ b/docs/content/limitations/builtin-apis/builtin-module-lookup.mdx
@@ -1 +1,5 @@
-- **Builtin module lookup:** `process.getBuiltinModule()` exposes native subsets of `path`, `path/posix`, `path/win32`, `os`, and current-thread `worker_threads` metadata. Stored module references and functions retain identity. Other modules and exports, including stored `Worker` constructors, throw `SC2020`. Direct `Worker` imports use the native worker support described below. `process.versions` is a shared dictionary containing `node` and `openssl`; other component versions are absent unless defined by the program.
+- **Builtin module lookup:** `process.getBuiltinModule()` exposes native subsets of `path`, `path/posix`, `path/win32`, `os`, and current-thread `worker_threads` metadata.
+  Stored module references and functions retain identity.
+  Other modules and exports, including stored `Worker` constructors, throw `SC2020`.
+  Direct `Worker` imports use the native worker support described below.
+  `process.versions` is a shared dictionary containing `node` and `openssl`; other component versions are absent unless defined by the program.
diff --git a/docs/content/limitations/builtin-apis/commonjs-metadata.mdx b/docs/content/limitations/builtin-apis/commonjs-metadata.mdx
index c4c4e2738..24668f005 100644
--- a/docs/content/limitations/builtin-apis/commonjs-metadata.mdx
+++ b/docs/content/limitations/builtin-apis/commonjs-metadata.mdx
@@ -1 +1,3 @@
-- **CommonJS metadata:** The module graph is fixed at build time. Cache deletion or reloading, metadata writes, `module.paths` mutation, and `require.extensions` are unsupported. Read-only access to `module.id`, `filename`, `path`, `paths`, `loaded`, `isPreloading`, `parent`, `children`, `require.main`, and `require.cache` lookup/enumeration compiles.
+- **CommonJS metadata:** The module graph is fixed at build time.
+  Cache deletion or reloading, metadata writes, `module.paths` mutation, and `require.extensions` are unsupported.
+  Read-only access to `module.id`, `filename`, `path`, `paths`, `loaded`, `isPreloading`, `parent`, `children`, `require.main`, and `require.cache` lookup/enumeration compiles.
diff --git a/docs/content/limitations/builtin-apis/compression.mdx b/docs/content/limitations/builtin-apis/compression.mdx
index e71fc8479..36cec0bc4 100644
--- a/docs/content/limitations/builtin-apis/compression.mdx
+++ b/docs/content/limitations/builtin-apis/compression.mdx
@@ -1 +1,7 @@
-- **Compression:** The one-shot `deflate`, `inflate`, `deflateRaw`, `inflateRaw`, `gzip`, `gunzip`, and `unzip` functions and their `Sync` forms accept Node's options, validated at run time, including `dictionary`, `maxOutputLength`, and `rejectGarbageAfterEnd`. Typed inputs are strings, Buffers, and Uint8Arrays; untyped JavaScript values may also be other TypedArrays, DataViews, and ArrayBuffers. The `info` option is unsupported. The `Deflate`, `Inflate`, `Gzip`, `Gunzip`, `DeflateRaw`, `InflateRaw`, and `Unzip` streams, from `createGzip()` and the other factories or `new zlib.Gzip()`, accept Node's options and support writes, piping, `pipeline`, async iteration, `flush`, `params`, `close`, `reset`, and `bytesWritten`. Each output chunk is its own Buffer rather than a slice of a shared chunk-size buffer. `zlib.constants` members and their module-level copies read as Node's values. `util.inspect`, `instanceof zlib.Gzip`, and Brotli and Zstd compression are unsupported.
+- **Compression:** The one-shot `deflate`, `inflate`, `deflateRaw`, `inflateRaw`, `gzip`, `gunzip`, and `unzip` functions and their `Sync` forms accept Node's options, validated at run time, including `dictionary`, `maxOutputLength`, and `rejectGarbageAfterEnd`.
+  Typed inputs are strings, Buffers, and Uint8Arrays; untyped JavaScript values may also be other TypedArrays, DataViews, and ArrayBuffers.
+  The `info` option is unsupported.
+  The `Deflate`, `Inflate`, `Gzip`, `Gunzip`, `DeflateRaw`, `InflateRaw`, and `Unzip` streams, from `createGzip()` and the other factories or `new zlib.Gzip()`, accept Node's options and support writes, piping, `pipeline`, async iteration, `flush`, `params`, `close`, `reset`, and `bytesWritten`.
+  Each output chunk is its own Buffer rather than a slice of a shared chunk-size buffer.
+  `zlib.constants` members and their module-level copies read as Node's values.
+  `util.inspect`, `instanceof zlib.Gzip`, and Brotli and Zstd compression are unsupported.
diff --git a/docs/content/limitations/builtin-apis/copy.mdx b/docs/content/limitations/builtin-apis/copy.mdx
index 94bc6c696..bf0930978 100644
--- a/docs/content/limitations/builtin-apis/copy.mdx
+++ b/docs/content/limitations/builtin-apis/copy.mdx
@@ -1 +1,5 @@
-- **Copy:** `fs.cpSync`, `fs.cp`, and `fs/promises` `cp` support every option and follow Node's two implementations: `cpSync` reports the native binding's errors, and the callback and promise forms report `SystemError`s. Files, directories, and symbolic links are copied in directory order, as in Node. The callback and promise forms complete the copy before the callback runs or the promise settles. An async `filter` must return a promise that is already settled; a pending one throws `SC2020`. On Windows, the three functions throw `SC2020`.
+- **Copy:** `fs.cpSync`, `fs.cp`, and `fs/promises` `cp` support every option and follow Node's two implementations: `cpSync` reports the native binding's errors, and the callback and promise forms report `SystemError`s.
+  Files, directories, and symbolic links are copied in directory order, as in Node.
+  The callback and promise forms complete the copy before the callback runs or the promise settles.
+  An async `filter` must return a promise that is already settled; a pending one throws `SC2020`.
+  On Windows, the three functions throw `SC2020`.
diff --git a/docs/content/limitations/builtin-apis/crypto.mdx b/docs/content/limitations/builtin-apis/crypto.mdx
index 988228aff..e78926b28 100644
--- a/docs/content/limitations/builtin-apis/crypto.mdx
+++ b/docs/content/limitations/builtin-apis/crypto.mdx
@@ -1 +1,16 @@
-- **Crypto:** Hashing, HMAC, PBKDF2, and HKDF support every digest `crypto.getHashes()` lists in Node 24, with OpenSSL's aliases and object identifiers. Hash and Hmac accept every Buffer encoding and any TypedArray or DataView, `createHash` and `hash.copy` take `outputLength`, and `crypto.hash` takes its options object; HMAC, PBKDF2, and HKDF reject the SHAKE and KMAC digests with Node's errors. Hash and Hmac values are also Transforms: they can be written, piped into, used as `pipeline()` stages, read, and listened to, and they report Node's errors after the stream flushes. `copy()` of a Hash whose stream flushed, and stream use of a value after its stream closed, throw a coded SC2020 error. Through `unknown` and `any` slots and untyped JavaScript, Hash and Hmac values keep their identity and support `update()`, `digest()`, and Hash's `copy()`, called or read as values; their stream and event members there throw a coded SC2020 error. `timingSafeEqual` compares any view or ArrayBuffer. Secret KeyObjects (`createSecretKey`, `generateKey` and `generateKeySync` for `hmac` and `aes`) support `type`, `symmetricKeySize`, `export()`, `equals()`, and `instanceof KeyObject`, and createHmac, hkdf, createCipheriv, and createDecipheriv accept them; asymmetric keys, `KeyObject.from()`, and `toCryptoKey()` are not available. `randomFill`, `randomFillSync` (every view kind and ArrayBuffer), `randomInt`, `randomUUID`, and `randomUUIDv7` follow Node 24.22, including callback timing; a `randomInt` callback whose error parameter is typed `Error | null` receives `null` where Node passes `undefined`. Scrypt supports its default parameters, numeric options, aliases, and memory limit. Both KDFs accept strings, Buffers, numeric typed arrays, DataViews, and fixed-length ArrayBuffers. `createCipheriv` and `createDecipheriv` support aes-128, aes-192, and aes-256 in CBC, CTR, and GCM modes and chacha20-poly1305, on native targets, through `update()`, `final()`, `setAAD()`, `setAutoPadding()`, `getAuthTag()`, and `setAuthTag()`; other ciphers, cipher streams, and wasm32-wasi builds are refused. Decrypting chacha20-poly1305 without an authentication tag fails in `final()`; Node 24.22 returns unverified plaintext. After `update()` fails, for example past the AES-GCM limit of 2^36 - 32 bytes per message, every later call on that cipher throws; Node still lets `final()` run. An output encoding that is a function or an instance of a class defining `toString` throws a coded SC2020 error. Public-key operations remain unsupported. Native derivations finish before their deferred callbacks, so computation blocks the caller.
+- **Crypto:** Hashing, HMAC, PBKDF2, and HKDF support every digest `crypto.getHashes()` lists in Node 24, with OpenSSL's aliases and object identifiers.
+  Hash and Hmac accept every Buffer encoding and any TypedArray or DataView, `createHash` and `hash.copy` take `outputLength`, and `crypto.hash` takes its options object; HMAC, PBKDF2, and HKDF reject the SHAKE and KMAC digests with Node's errors.
+  Hash and Hmac values are also Transforms: they can be written, piped into, used as `pipeline()` stages, read, and listened to, and they report Node's errors after the stream flushes.
+  `copy()` of a Hash whose stream flushed, and stream use of a value after its stream closed, throw a coded SC2020 error.
+  Through `unknown` and `any` slots and untyped JavaScript, Hash and Hmac values keep their identity and support `update()`, `digest()`, and Hash's `copy()`, called or read as values; their stream and event members there throw a coded SC2020 error.
+  `timingSafeEqual` compares any view or ArrayBuffer.
+  Secret KeyObjects (`createSecretKey`, `generateKey` and `generateKeySync` for `hmac` and `aes`) support `type`, `symmetricKeySize`, `export()`, `equals()`, and `instanceof KeyObject`, and createHmac, hkdf, createCipheriv, and createDecipheriv accept them; asymmetric keys, `KeyObject.from()`, and `toCryptoKey()` are not available.
+  `randomFill`, `randomFillSync` (every view kind and ArrayBuffer), `randomInt`, `randomUUID`, and `randomUUIDv7` follow Node 24.22, including callback timing; a `randomInt` callback whose error parameter is typed `Error | null` receives `null` where Node passes `undefined`.
+  Scrypt supports its default parameters, numeric options, aliases, and memory limit.
+  Both KDFs accept strings, Buffers, numeric typed arrays, DataViews, and fixed-length ArrayBuffers.
+  `createCipheriv` and `createDecipheriv` support aes-128, aes-192, and aes-256 in CBC, CTR, and GCM modes and chacha20-poly1305, on native targets, through `update()`, `final()`, `setAAD()`, `setAutoPadding()`, `getAuthTag()`, and `setAuthTag()`; other ciphers, cipher streams, and wasm32-wasi builds are refused.
+  Decrypting chacha20-poly1305 without an authentication tag fails in `final()`; Node 24.22 returns unverified plaintext.
+  After `update()` fails, for example past the AES-GCM limit of 2^36 - 32 bytes per message, every later call on that cipher throws; Node still lets `final()` run.
+  An output encoding that is a function or an instance of a class defining `toString` throws a coded SC2020 error.
+  Public-key operations remain unsupported.
+  Native derivations finish before their deferred callbacks, so computation blocks the caller.
diff --git a/docs/content/limitations/builtin-apis/date.mdx b/docs/content/limitations/builtin-apis/date.mdx
index a2c324bc3..4c1c7e034 100644
--- a/docs/content/limitations/builtin-apis/date.mdx
+++ b/docs/content/limitations/builtin-apis/date.mdx
@@ -1 +1,5 @@
-- **Date:** Date unions, year/month constructors, setters, statically typed TypeScript identity comparisons, thrown Date values, and locale formatters are unsupported. Zero-argument and single number/string constructors, storage and passing, `getTime`, `valueOf`, `toISOString`, `toUTCString`, `toJSON` (a `string | null`: null for an invalid date, as in Node), `toString`, `toDateString`, `toTimeString`, `String(date)` and template literal conversion, calendar getters, `getTimezoneOffset`, and single-string `Date.parse` compile. JavaScript Dates retain identity through checked storage and support Date-copy construction and JSON serialization. A TypeScript Date converted to `unknown` becomes a Date with the same time value; each conversion creates a new Date, so two `unknown` values converted from one TypeScript Date are not `===`. See [Dates and timezones](#dates-and-timezones) for parsing restrictions.
+- **Date:** Date unions, year/month constructors, setters, statically typed TypeScript identity comparisons, thrown Date values, and locale formatters are unsupported.
+  Zero-argument and single number/string constructors, storage and passing, `getTime`, `valueOf`, `toISOString`, `toUTCString`, `toJSON` (a `string | null`: null for an invalid date, as in Node), `toString`, `toDateString`, `toTimeString`, `String(date)` and template literal conversion, calendar getters, `getTimezoneOffset`, and single-string `Date.parse` compile.
+  JavaScript Dates retain identity through checked storage and support Date-copy construction and JSON serialization.
+  A TypeScript Date converted to `unknown` becomes a Date with the same time value; each conversion creates a new Date, so two `unknown` values converted from one TypeScript Date are not `===`.
+  See [Dates and timezones](#dates-and-timezones) for parsing restrictions.
diff --git a/docs/content/limitations/builtin-apis/deprecated-modules.mdx b/docs/content/limitations/builtin-apis/deprecated-modules.mdx
index bb630b8c3..50a181bb8 100644
--- a/docs/content/limitations/builtin-apis/deprecated-modules.mdx
+++ b/docs/content/limitations/builtin-apis/deprecated-modules.mdx
@@ -1 +1,4 @@
-- **Deprecated `punycode` and `constants` modules:** `punycode.encode()`, `decode()`, `toASCII()`, `toUnicode()`, `ucs2.decode()`, `ucs2.encode()`, and `version` compile, with the `DEP0040` warning Node.js reports when the module loads. A `require("punycode")` made from inside `node_modules` doesn't warn; a `require()` used inside a larger expression, such as `require("punycode").toASCII(name)`, doesn't warn either. The `punycode.ucs2` object itself is unsupported as a value. The `constants` module is the frozen object Node.js builds from `os.constants` and `fs.constants`, plus the `crypto.constants` of Node.js 24.22.0.
+- **Deprecated `punycode` and `constants` modules:** `punycode.encode()`, `decode()`, `toASCII()`, `toUnicode()`, `ucs2.decode()`, `ucs2.encode()`, and `version` compile, with the `DEP0040` warning Node.js reports when the module loads.
+  A `require("punycode")` made from inside `node_modules` doesn't warn; a `require()` used inside a larger expression, such as `require("punycode").toASCII(name)`, doesn't warn either.
+  The `punycode.ucs2` object itself is unsupported as a value.
+  The `constants` module is the frozen object Node.js builds from `os.constants` and `fs.constants`, plus the `crypto.constants` of Node.js 24.22.0.
diff --git a/docs/content/limitations/builtin-apis/esm-metadata.mdx b/docs/content/limitations/builtin-apis/esm-metadata.mdx
index e62c32bca..341e20ffe 100644
--- a/docs/content/limitations/builtin-apis/esm-metadata.mdx
+++ b/docs/content/limitations/builtin-apis/esm-metadata.mdx
@@ -1 +1,4 @@
-- **ESM metadata:** Native `import.meta.url`, `filename`, `dirname`, and `main` support dot access, statically known keys, and destructuring selected fields. Storing or mutating the metadata object, rest bindings, runtime keys, and stored `resolve` callbacks are unsupported. Native `import.meta.resolve()` requires a literal specifier. Module instances distinguished by URL query strings or fragments are unsupported.
+- **ESM metadata:** Native `import.meta.url`, `filename`, `dirname`, and `main` support dot access, statically known keys, and destructuring selected fields.
+  Storing or mutating the metadata object, rest bindings, runtime keys, and stored `resolve` callbacks are unsupported.
+  Native `import.meta.resolve()` requires a literal specifier.
+  Module instances distinguished by URL query strings or fragments are unsupported.
diff --git a/docs/content/limitations/builtin-apis/eventemitter.mdx b/docs/content/limitations/builtin-apis/eventemitter.mdx
index c4435f4c7..4f7142094 100644
--- a/docs/content/limitations/builtin-apis/eventemitter.mdx
+++ b/docs/content/limitations/builtin-apis/eventemitter.mdx
@@ -1 +1,4 @@
-- **EventEmitter:** Literal event names use fixed argument tuples. Computed string names require a constant prefix or suffix that excludes `error`, meta events, and stream-internal events; their arguments must match the exact arity and support checked conversion. Unrestricted names, symbols, names that may reach internal events, and typed `listeners()`/`rawListeners()` results for names with possible computed registrations are unsupported. Reading `defaultMaxListeners` through a CommonJS destructured or member binding (`const { defaultMaxListeners } = require("events")`) is unsupported.
+- **EventEmitter:** Literal event names use fixed argument tuples.
+  Computed string names require a constant prefix or suffix that excludes `error`, meta events, and stream-internal events; their arguments must match the exact arity and support checked conversion.
+  Unrestricted names, symbols, names that may reach internal events, and typed `listeners()`/`rawListeners()` results for names with possible computed registrations are unsupported.
+  Reading `defaultMaxListeners` through a CommonJS destructured or member binding (`const { defaultMaxListeners } = require("events")`) is unsupported.
diff --git a/docs/content/limitations/builtin-apis/exit-status.mdx b/docs/content/limitations/builtin-apis/exit-status.mdx
index f13782ff2..d9bb779db 100644
--- a/docs/content/limitations/builtin-apis/exit-status.mdx
+++ b/docs/content/limitations/builtin-apis/exit-status.mdx
@@ -1 +1,3 @@
-- **Exit status:** Numeric `process.exitCode = value` writes in statement position set the implicit exit status, which `process.exit()` uses when called without an argument. `process.exit(code)` and `process.exitCode` throw a `RangeError` (`ERR_OUT_OF_RANGE`) for a code that is not a safe integer, and convert other codes to int32, as Node does. Reads, resets, and assignments used as values are unsupported.
+- **Exit status:** Numeric `process.exitCode = value` writes in statement position set the implicit exit status, which `process.exit()` uses when called without an argument.
+  `process.exit(code)` and `process.exitCode` throw a `RangeError` (`ERR_OUT_OF_RANGE`) for a code that is not a safe integer, and convert other codes to int32, as Node does.
+  Reads, resets, and assignments used as values are unsupported.
diff --git a/docs/content/limitations/builtin-apis/file-streams.mdx b/docs/content/limitations/builtin-apis/file-streams.mdx
index feb8b0341..f3b6843f4 100644
--- a/docs/content/limitations/builtin-apis/file-streams.mdx
+++ b/docs/content/limitations/builtin-apis/file-streams.mdx
@@ -1 +1,4 @@
-- **File streams:** `fs.createReadStream`, `fs.createWriteStream`, `new fs.ReadStream` and `new fs.WriteStream` (in JavaScript sources), and FileHandle `createReadStream`, `createWriteStream` and `readLines` return Readable and Writable streams. Options are checked when the stream is created, with Node's errors and order; `flags` and `mode` are checked when the file opens, so their errors arrive as `'error'` events. `bytesRead`, `bytesWritten`, `path`, `pending`, `close()`, `close(callback)` with a `() => void` callback, and the `'open'` and `'ready'` events compile. Numeric `flags`, the `fs`, `signal` and `windowsHandle` options, write streams with an encoding other than UTF-8, and `instanceof fs.ReadStream` or `fs.WriteStream` are unsupported.
+- **File streams:** `fs.createReadStream`, `fs.createWriteStream`, `new fs.ReadStream` and `new fs.WriteStream` (in JavaScript sources), and FileHandle `createReadStream`, `createWriteStream` and `readLines` return Readable and Writable streams.
+  Options are checked when the stream is created, with Node's errors and order; `flags` and `mode` are checked when the file opens, so their errors arrive as `'error'` events.
+  `bytesRead`, `bytesWritten`, `path`, `pending`, `close()`, `close(callback)` with a `() => void` callback, and the `'open'` and `'ready'` events compile.
+  Numeric `flags`, the `fs`, `signal` and `windowsHandle` options, write streams with an encoding other than UTF-8, and `instanceof fs.ReadStream` or `fs.WriteStream` are unsupported.
diff --git a/docs/content/limitations/builtin-apis/filehandle-and-descriptor-i-o.mdx b/docs/content/limitations/builtin-apis/filehandle-and-descriptor-i-o.mdx
index e9f111bfe..491bb4586 100644
--- a/docs/content/limitations/builtin-apis/filehandle-and-descriptor-i-o.mdx
+++ b/docs/content/limitations/builtin-apis/filehandle-and-descriptor-i-o.mdx
@@ -1 +1,7 @@
-- **FileHandle and descriptor I/O:** Static reads and writes accept Buffer and Uint8Array windows, numeric positions, and UTF-8 strings. FileHandle reads also accept options records and allocate a buffer when omitted. Vector I/O, truncation, syncing, and permission changes compile. Ownership changes, timestamps, and bigint Stats remain unsupported; FileHandle streams and `readLines` are covered under File streams. Dynamic descriptor I/O accepts other ArrayBuffer views and Buffer encodings; read positions outside the safe integer range are refused. File operations complete synchronously before their callbacks or promise continuations. Descriptor permission changes on Windows throw `ENOSYS`.
+- **FileHandle and descriptor I/O:** Static reads and writes accept Buffer and Uint8Array windows, numeric positions, and UTF-8 strings.
+  FileHandle reads also accept options records and allocate a buffer when omitted.
+  Vector I/O, truncation, syncing, and permission changes compile.
+  Ownership changes, timestamps, and bigint Stats remain unsupported; FileHandle streams and `readLines` are covered under File streams.
+  Dynamic descriptor I/O accepts other ArrayBuffer views and Buffer encodings; read positions outside the safe integer range are refused.
+  File operations complete synchronously before their callbacks or promise continuations.
+  Descriptor permission changes on Windows throw `ENOSYS`.
diff --git a/docs/content/limitations/builtin-apis/filesystem-flags.mdx b/docs/content/limitations/builtin-apis/filesystem-flags.mdx
index 4124b6dfa..f86780082 100644
--- a/docs/content/limitations/builtin-apis/filesystem-flags.mdx
+++ b/docs/content/limitations/builtin-apis/filesystem-flags.mdx
@@ -1 +1,4 @@
-- **Filesystem flags:** `fs.openSync` supports inline bitwise OR expressions of `O_RDONLY`, `O_WRONLY`, `O_RDWR`, `O_CREAT`, `O_EXCL`, `O_NOFOLLOW`, `O_NONBLOCK`, `O_TRUNC`, and `O_APPEND`, with an optional creation mode. Computed numeric flags are unsupported because bit values vary by target. `fstatSync`, `fchmodSync`, `fsyncSync`, and `linkSync` support direct calls. On Windows, numeric opens with `O_NOFOLLOW` and calls to `fchmodSync` throw `ENOSYS`; use a POSIX target if you require these operations.
+- **Filesystem flags:** `fs.openSync` supports inline bitwise OR expressions of `O_RDONLY`, `O_WRONLY`, `O_RDWR`, `O_CREAT`, `O_EXCL`, `O_NOFOLLOW`, `O_NONBLOCK`, `O_TRUNC`, and `O_APPEND`, with an optional creation mode.
+  Computed numeric flags are unsupported because bit values vary by target.
+  `fstatSync`, `fchmodSync`, `fsyncSync`, and `linkSync` support direct calls.
+  On Windows, numeric opens with `O_NOFOLLOW` and calls to `fchmodSync` throw `ENOSYS`; use a POSIX target if you require these operations.
diff --git a/docs/content/limitations/builtin-apis/glob.mdx b/docs/content/limitations/builtin-apis/glob.mdx
index 5df4d6688..913dbb085 100644
--- a/docs/content/limitations/builtin-apis/glob.mdx
+++ b/docs/content/limitations/builtin-apis/glob.mdx
@@ -1 +1,4 @@
-- **Glob:** `fs.globSync`, `fs.glob` and `fs/promises` `glob` support every option. `withFileTypes` must be a literal `true` or `false`, and `exclude` functions cannot be combined with `withFileTypes`. The `fs/promises` iterator is supported only as the source of a `for await` loop, and its walk completes when the loop starts. `fs.glob` callbacks receive file names, not Dirents.
+- **Glob:** `fs.globSync`, `fs.glob` and `fs/promises` `glob` support every option.
+  `withFileTypes` must be a literal `true` or `false`, and `exclude` functions cannot be combined with `withFileTypes`.
+  The `fs/promises` iterator is supported only as the source of a `for await` loop, and its walk completes when the loop starts.
+  `fs.glob` callbacks receive file names, not Dirents.
diff --git a/docs/content/limitations/builtin-apis/globals.mdx b/docs/content/limitations/builtin-apis/globals.mdx
index db6691f20..5d8f70969 100644
--- a/docs/content/limitations/builtin-apis/globals.mdx
+++ b/docs/content/limitations/builtin-apis/globals.mdx
@@ -1 +1,2 @@
-- **Globals:** Stored `globalThis` references support identity and probes for absent capabilities. Most builtin members require direct global access; access through a stored global object can raise `SC2020`.
+- **Globals:** Stored `globalThis` references support identity and probes for absent capabilities.
+  Most builtin members require direct global access; access through a stored global object can raise `SC2020`.
diff --git a/docs/content/limitations/builtin-apis/intl-segmenter.mdx b/docs/content/limitations/builtin-apis/intl-segmenter.mdx
index 97984895a..41a61711c 100644
--- a/docs/content/limitations/builtin-apis/intl-segmenter.mdx
+++ b/docs/content/limitations/builtin-apis/intl-segmenter.mdx
@@ -1 +1,2 @@
-- **Intl.Segmenter:** Default Unicode grapheme segmentation, iteration, and `containing()` compile. Locale negotiation, word and sentence segmentation, `resolvedOptions()`, and detached methods are unsupported.
+- **Intl.Segmenter:** Default Unicode grapheme segmentation, iteration, and `containing()` compile.
+  Locale negotiation, word and sentence segmentation, `resolvedOptions()`, and detached methods are unsupported.
diff --git a/docs/content/limitations/builtin-apis/iterator-helpers.mdx b/docs/content/limitations/builtin-apis/iterator-helpers.mdx
index b4c4d8200..39031bf8e 100644
--- a/docs/content/limitations/builtin-apis/iterator-helpers.mdx
+++ b/docs/content/limitations/builtin-apis/iterator-helpers.mdx
@@ -1 +1,9 @@
-- **Iterator helpers:** `map`, `filter`, `take`, `drop`, `flatMap`, `toArray`, `forEach`, `reduce`, `some`, `every` and `find` compile on generators, on array, typed array, string, Map and Set iterators, and on the objects the helpers return. Helper objects support `.next()`, `.return()`, `for...of`, spreads, `Array.from` and `yield*`, pull their source lazily, and close it (run its `return()`) at the same points as Node: when `take` reaches its count, when a short-circuiting method finds its answer, when a callback throws, and when the loop consuming the helper exits early. In TypeScript, `h.return!()` and `h.return?.()` compile when `h` is a helper call or a `const` initialized with one. `flatMap` callbacks return arrays, generators, Sets or Maps; a string result throws Node's TypeError. `Iterator.from` accepts arrays, strings, typed arrays, Sets, Maps and iterator objects such as generators. In JavaScript, untyped array, string, Map and Set iterators answer the same methods. `console.log`, `util.inspect` and `Object.prototype.toString` print iterator objects as Node does: `Object [Iterator Helper] {}`, `Object [Generator] {}`, `Object [Array Iterator] {}`, and Map and Set iterators with the entries they have left. `Iterator.from` over an object with its own `next` method or over an untyped value, the `Iterator` global as a value, and `String()` and template literals of typed iterator objects are unsupported.
+- **Iterator helpers:** `map`, `filter`, `take`, `drop`, `flatMap`, `toArray`, `forEach`, `reduce`, `some`, `every` and `find` compile on generators, on array, typed array, string, Map and Set iterators, and on the objects the helpers return.
+  Helper objects support `.next()`, `.return()`, `for...of`, spreads, `Array.from` and `yield*`, pull their source lazily, and close it (run its `return()`) at the same points as Node: when `take` reaches its count, when a short-circuiting method finds its answer, when a callback throws, and when the loop consuming the helper exits early.
+  In TypeScript, `h.return!()` and `h.return?.()` compile when `h` is a helper call or a `const` initialized with one.
+  `flatMap` callbacks return arrays, generators, Sets or Maps; a string result throws Node's TypeError.
+  `Iterator.from` accepts arrays, strings, typed arrays, Sets, Maps and iterator objects such as generators.
+  In JavaScript, untyped generators and array, string, Map and Set iterators answer the same methods, and array destructuring of untyped values steps generators, iterators, Maps and Sets the way Node does.
+  Helper methods on untyped async generators are unsupported.
+  `console.log`, `util.inspect` and `Object.prototype.toString` print iterator objects as Node does: `Object [Iterator Helper] {}`, `Object [Generator] {}`, `Object [Array Iterator] {}`, and Map and Set iterators with the entries they have left.
+  `Iterator.from` over an object with its own `next` method or over an untyped value, the `Iterator` global as a value, and `String()` and template literals of typed iterator objects are unsupported.
diff --git a/docs/content/limitations/builtin-apis/legacy-url-api.mdx b/docs/content/limitations/builtin-apis/legacy-url-api.mdx
index 5bbead2a9..116233df3 100644
--- a/docs/content/limitations/builtin-apis/legacy-url-api.mdx
+++ b/docs/content/limitations/builtin-apis/legacy-url-api.mdx
@@ -1 +1,3 @@
-- **Legacy URL API:** `url.parse()`, `url.format()`, `url.resolve()`, `url.domainToASCII()`, and `url.domainToUnicode()` compile, including Punycode hostnames and the `DEP0169`/`DEP0170` warnings. A parsed `Url` object supports reads, writes, and its `format()` method; its `parse()`, `resolve()`, `resolveObject()`, and `parseHost()` methods throw `SC2020`, and `url.Url` and `url.resolveObject()` are unsupported. `ERR_INVALID_URL` errors have no `input` property.
+- **Legacy URL API:** `url.parse()`, `url.format()`, `url.resolve()`, `url.domainToASCII()`, and `url.domainToUnicode()` compile, including Punycode hostnames and the `DEP0169`/`DEP0170` warnings.
+  A parsed `Url` object supports reads, writes, and its `format()` method; its `parse()`, `resolve()`, `resolveObject()`, and `parseHost()` methods throw `SC2020`, and `url.Url` and `url.resolveObject()` are unsupported.
+  `ERR_INVALID_URL` errors have no `input` property.
diff --git a/docs/content/limitations/builtin-apis/map-and-set.mdx b/docs/content/limitations/builtin-apis/map-and-set.mdx
index 4ff02758c..bf77001ee 100644
--- a/docs/content/limitations/builtin-apis/map-and-set.mdx
+++ b/docs/content/limitations/builtin-apis/map-and-set.mdx
@@ -1 +1,10 @@
-- **Map and Set:** Keys and elements support numbers and strings by value, and records, classes, arrays, functions, symbols, server handles, and unions of these reference types by identity. Map values may also be functions. `unknown` slots use native checked values, comparing supported primitives by value and retaining supported object references. Typed nested collections other than `Map<unknown, unknown>` and `Set<unknown>`, and promises requiring payload adapters, cannot pass into these slots. `Promise<unknown>` retains its native representation. Stored `keys()`, `values()`, and `entries()` iterators compile, retain element identity, and observe live collection mutations until exhausted. They support `.next()`, `for...of`, array spreads, and mapper-less `Array.from`. They also support the iterator helper methods, such as `.map()` and `.take()`. Detached collection methods are unsupported. The Set composition methods (`union`, `intersection`, `difference`, `symmetricDifference`, `isSubsetOf`, `isSupersetOf`, `isDisjointFrom`) accept a Set of the same element type or a Map keyed by it; other set-like arguments are unsupported.
+- **Map and Set:** Keys and elements support numbers and strings by value, and records, classes, arrays, functions, symbols, server handles, and unions of these reference types by identity.
+  Map values may also be functions.
+  `unknown` slots use native checked values, comparing supported primitives by value and retaining supported object references.
+  Typed nested collections other than `Map<unknown, unknown>` and `Set<unknown>`, and promises requiring payload adapters, cannot pass into these slots.
+  `Promise<unknown>` retains its native representation.
+  Stored `keys()`, `values()`, and `entries()` iterators compile, retain element identity, and observe live collection mutations until exhausted.
+  They support `.next()`, `for...of`, array spreads, and mapper-less `Array.from`.
+  They also support the iterator helper methods, such as `.map()` and `.take()`.
+  Detached collection methods are unsupported.
+  The Set composition methods (`union`, `intersection`, `difference`, `symmetricDifference`, `isSubsetOf`, `isSupersetOf`, `isDisjointFrom`) accept a Set of the same element type or a Map keyed by it; other set-like arguments are unsupported.
diff --git a/docs/content/limitations/builtin-apis/object-freezing.mdx b/docs/content/limitations/builtin-apis/object-freezing.mdx
index d4939c788..9784cd715 100644
--- a/docs/content/limitations/builtin-apis/object-freezing.mdx
+++ b/docs/content/limitations/builtin-apis/object-freezing.mdx
@@ -1 +1,3 @@
-- **Object freezing:** `Object.freeze` and `Object.isFrozen` support plain checked dictionaries and primitives. Freezing is shallow and preserves accessors. Aliased typed records, arrays, proxies, and other native objects cannot be frozen.
+- **Object freezing:** `Object.freeze` and `Object.isFrozen` support plain checked dictionaries and primitives.
+  Freezing is shallow and preserves accessors.
+  Aliased typed records, arrays, proxies, and other native objects cannot be frozen.
diff --git a/docs/content/limitations/builtin-apis/performance-entries.mdx b/docs/content/limitations/builtin-apis/performance-entries.mdx
index 957781b06..92af98cb7 100644
--- a/docs/content/limitations/builtin-apis/performance-entries.mdx
+++ b/docs/content/limitations/builtin-apis/performance-entries.mdx
@@ -1 +1,2 @@
-- **Performance entries:** `performance.mark()`, `measure()`, and the `getEntries` methods return entries with Node's fields, `toJSON()`, inspection, and identity. `Object.keys`, `for...in`, object spread, and `hasOwnProperty` on an entry are unsupported, and an entry stored in an `unknown` slot prints as a plain object.
+- **Performance entries:** `performance.mark()`, `measure()`, and the `getEntries` methods return entries with Node's fields, `toJSON()`, inspection, and identity.
+  `Object.keys`, `for...in`, object spread, and `hasOwnProperty` on an entry are unsupported, and an entry stored in an `unknown` slot prints as a plain object.
diff --git a/docs/content/limitations/builtin-apis/process-memory.mdx b/docs/content/limitations/builtin-apis/process-memory.mdx
index e9c0735aa..6a3121e2f 100644
--- a/docs/content/limitations/builtin-apis/process-memory.mdx
+++ b/docs/content/limitations/builtin-apis/process-memory.mdx
@@ -1 +1,2 @@
-- **Process memory:** `process.memoryUsage()` reads `rss` from the operating system and `heapTotal` and `heapUsed` from the runtime's allocator, so the heap figures start near zero and grow as the program allocates. `external` and `arrayBuffers` are `0`, because Buffer and typed-array storage is part of the same heap.
+- **Process memory:** `process.memoryUsage()` reads `rss` from the operating system and `heapTotal` and `heapUsed` from the runtime's allocator, so the heap figures start near zero and grow as the program allocates.
+  `external` and `arrayBuffers` are `0`, because Buffer and typed-array storage is part of the same heap.
diff --git a/docs/content/limitations/builtin-apis/prototypes.mdx b/docs/content/limitations/builtin-apis/prototypes.mdx
index 9cfc041ed..4ac2ee438 100644
--- a/docs/content/limitations/builtin-apis/prototypes.mdx
+++ b/docs/content/limitations/builtin-apis/prototypes.mdx
@@ -1 +1,2 @@
-- **Prototypes:** Named properties and methods on program class prototypes support replacement, inheritance, and deletion. Bare prototype reflection, accessor replacement, and prototype storage on local, generic, mixin, or runtime-provided classes are unsupported.
+- **Prototypes:** Named properties and methods on program class prototypes support replacement, inheritance, and deletion.
+  Bare prototype reflection, accessor replacement, and prototype storage on local, generic, mixin, or runtime-provided classes are unsupported.
diff --git a/docs/content/limitations/builtin-apis/regular-expressions.mdx b/docs/content/limitations/builtin-apis/regular-expressions.mdx
index d4287396d..aaa02f7a5 100644
--- a/docs/content/limitations/builtin-apis/regular-expressions.mdx
+++ b/docs/content/limitations/builtin-apis/regular-expressions.mdx
@@ -1 +1,9 @@
-- **Regular expressions:** Native checked storage preserves identity, `source`, `flags`, flag properties, and stateful `test`, and the flag getters (`global`, `unicodeSets`, and the rest) compile on statically typed regexes. Static `exec`, global `match`, and numeric `lastIndex` access use the native matcher. Runtime constructors accept checked strings and native regex copies; `replace` and `replaceAll` accept native regex values with string templates or callbacks, including captures, named groups, and UTF-16 offsets. Named groups (`groups`) read on matches of a statically known regex: from `exec` and `match`, through optional chains (`m?.groups?.name`), in a `for...of` over `matchAll`, and on the element parameter of an array-method callback over `matchAll` rows. The groups object has a null prototype, as in Node. Non-numeric `lastIndex`, detached methods, and `exec` through an untyped receiver are unsupported. The `v` (unicode sets) flag supports class set operations (`--`, `&&`), nested classes, `\q{...}` string literals, and properties of strings such as `\p{RGI_Emoji}`. `new RegExp` with an invalid pattern throws a `SyntaxError` whose message comes from the native engine and can differ from Node's. The `d` (match indices) flag is unsupported: regex literals and `new RegExp` calls with a literal flag string containing it fail to compile with SC1120, and `new RegExp` with a computed flag string containing it throws an error naming the flag.
+- **Regular expressions:** Native checked storage preserves identity, `source`, `flags`, flag properties, and stateful `test`, and the flag getters (`global`, `unicodeSets`, and the rest) compile on statically typed regexes.
+  Static `exec`, global `match`, and numeric `lastIndex` access use the native matcher.
+  Runtime constructors accept checked strings and native regex copies; `replace` and `replaceAll` accept native regex values with string templates or callbacks, including captures, named groups, and UTF-16 offsets.
+  Named groups (`groups`) read on matches of a statically known regex: from `exec` and `match`, through optional chains (`m?.groups?.name`), in a `for...of` over `matchAll`, and on the element parameter of an array-method callback over `matchAll` rows.
+  The groups object has a null prototype, as in Node.
+  Non-numeric `lastIndex`, detached methods, and `exec` through an untyped receiver are unsupported.
+  The `v` (unicode sets) flag supports class set operations (`--`, `&&`), nested classes, `\q{...}` string literals, and properties of strings such as `\p{RGI_Emoji}`.
+  `new RegExp` with an invalid pattern throws a `SyntaxError` whose message comes from the native engine and can differ from Node's.
+  The `d` (match indices) flag is unsupported: regex literals and `new RegExp` calls with a literal flag string containing it fail to compile with SC1120, and `new RegExp` with a computed flag string containing it throws an error naming the flag.
diff --git a/docs/content/limitations/builtin-apis/streams-and-readline.mdx b/docs/content/limitations/builtin-apis/streams-and-readline.mdx
index 14735a9a1..0ac0ca3a6 100644
--- a/docs/content/limitations/builtin-apis/streams-and-readline.mdx
+++ b/docs/content/limitations/builtin-apis/streams-and-readline.mdx
@@ -1 +1,28 @@
-- **Streams and readline:** Stream chunks are Buffers or strings. `Readable.from` accepts arrays, Sets, Map and Set iterators, generators, async generators, and class iterables and async iterables whose values are strings or Buffers, and in JavaScript any iterable or async iterable of them; a stream that mixes strings and Buffers is unsupported. In JavaScript, a sync iterator value with a `then` method that is not a promise, and an object whose `[Symbol.asyncIterator]` or `[Symbol.iterator]` method is a generator method, are unsupported. Object-mode streams of other values (including `Readable.from` over a `Map`, whose values are entry arrays) are unsupported. `pipeline` accepts one run of function stages: async generator functions between streams (`async function* (source)`, iterating `source` with `for await`), an async generator source function (`async function* ({ signal })`), and an async function destination whose value resolves the promise form and reaches the callback's second argument. Stages may take the `{ signal }` argument. An async generator function as the destination, using the PassThrough that `pipeline()` returns for a function destination, several runs of function stages, and function stages together with pipeline options are unsupported. `Readable.from` accepts `objectMode` and `highWaterMark` options. The `Readable` operators (`map`, `filter`, `forEach`, `toArray`, `some`, `find`, `every`, `flatMap`, `drop`, `take`, and `reduce`) accept `concurrency`, `highWaterMark`, and `signal` options; their callbacks take only the chunk, `map` returns strings or Buffers, and `flatMap` returns strings or arrays of them. `readable.compose` is unsupported. `stream.compose` accepts two or more streams, or one `Duplex`; functions, iterables, and web streams as stages are unsupported, and the `ERR_INVALID_ARG_VALUE` message for a stream that is no longer readable or writable names the stream's class instead of printing the stream. `pipeline` from `node:stream/promises` accepts a trailing `{ signal, end }` object, and `finished` accepts `readable`, `writable`, `error`, `cleanup`, and `signal` options, with boolean literals for the flags. Stream constructors accept a `signal` option in an options object literal, and `stream.addAbortSignal` accepts any stream. `node:readline` and `node:readline/promises` (also reached as `readline.promises`) interfaces, from `createInterface(options)` or `createInterface(input, output, completer, terminal)`, read `process.stdin` or a readable stream: `question`, `prompt`, `write` (with a key object literal of `name`, `ctrl`, `meta`, and `shift`), `pause`, `resume`, `'line'`/`'close'`/`'pause'`/`'resume'`/`'error'`/`'history'`/`'SIGINT'`/`'SIGTSTP'`/`'SIGCONT'` listeners, and `for await` compile. The `history`, `historySize`, `removeHistoryDuplicates`, `completer`, `tabSize`, and `escapeCodeTimeout` options are validated as in Node. With `terminal: true`, or with no `terminal` option and `process.stdout` as the output when it is a TTY, the interface runs Node's terminal mode: the editing keys, the kill ring, undo and redo, history recording and recall, Tab completion through the completer, Ctrl+C, Ctrl+D, and Ctrl+Z, `TERM=dumb`, and the same escape sequences written to the output. The output's `'resize'` event does not redraw the line. The cursor never stops between the two UTF-16 units of a supplementary character: where Node's Up or Down movement through a multiline line would, the cursor moves to the character's start or end. In JavaScript, a `'history'` listener receives a copy of the history; its changes are written back when the listener returns, but the copy is not `rl.history` itself. `rl.history`, `historySize`, `historyIndex`, `crlfDelay`, `tabSize`, `escapeCodeTimeout`, `line`, `cursor`, and `terminal` read as in Node, except that `rl.cursor` of an interface that is not a terminal throws instead of answering `undefined`. `rl[Symbol.dispose]()` closes the interface, and `instanceof` with `readline.Interface` or `readlinePromises.Interface` answers whether the interface came from that module, as in Node. In JavaScript, the input and output can be any expression that evaluates to a stream, such as a function's result or an object's member; a value that is not a stream is unsupported. In JavaScript, `question()` and `setPrompt()` accept a value that is not a string: when such a prompt is written, an interface that is not a terminal throws `ERR_INVALID_ARG_TYPE` as Node does (the `readline/promises` question rejects with it) and the question stays pending, and a terminal interface writes `String(value)`. A terminal interface's prompt that is an object or a symbol, `getPrompt()` while the prompt is not a string, and `getCursorPos()` with an object or symbol prompt are unsupported. `readline.cursorTo`, `moveCursor`, `clearLine`, and `clearScreenDown` write to `process.stdout`, `process.stderr`, a writable stream, or nothing for `null` and `undefined`; their callbacks take no parameters. The `readline/promises` `Readline` class writes to the same outputs. `readline.emitKeypressEvents` emits `'keypress'` events on `process.stdin` or a readable stream, shared with terminal interfaces on that stream as in Node; a listener's first parameter must admit `undefined`, which it receives for escape sequences. Chained listener registration is unsupported.
+- **Streams and readline:** Stream chunks are Buffers or strings.
+  `Readable.from` accepts arrays, Sets, Map and Set iterators, generators, async generators, and class iterables and async iterables whose values are strings or Buffers, and in JavaScript any iterable or async iterable of them; a stream that mixes strings and Buffers is unsupported.
+  In JavaScript, a sync iterator value with a `then` method that is not a promise, and an object whose `[Symbol.asyncIterator]` or `[Symbol.iterator]` method is a generator method, are unsupported.
+  Object-mode streams of other values (including `Readable.from` over a `Map`, whose values are entry arrays) are unsupported.
+  `pipeline` accepts one run of function stages: async generator functions between streams (`async function* (source)`, iterating `source` with `for await`), an async generator source function (`async function* ({ signal })`), and an async function destination whose value resolves the promise form and reaches the callback's second argument.
+  Stages may take the `{ signal }` argument.
+  An async generator function as the destination, using the PassThrough that `pipeline()` returns for a function destination, several runs of function stages, and function stages together with pipeline options are unsupported.
+  `Readable.from` accepts `objectMode` and `highWaterMark` options.
+  The `Readable` operators (`map`, `filter`, `forEach`, `toArray`, `some`, `find`, `every`, `flatMap`, `drop`, `take`, and `reduce`) accept `concurrency`, `highWaterMark`, and `signal` options; their callbacks take only the chunk, `map` returns strings or Buffers, and `flatMap` returns strings or arrays of them.
+  `readable.compose` is unsupported.
+  `stream.compose` accepts two or more streams, or one `Duplex`; functions, iterables, and web streams as stages are unsupported, and the `ERR_INVALID_ARG_VALUE` message for a stream that is no longer readable or writable names the stream's class instead of printing the stream.
+  `pipeline` from `node:stream/promises` accepts a trailing `{ signal, end }` object, and `finished` accepts `readable`, `writable`, `error`, `cleanup`, and `signal` options, with boolean literals for the flags.
+  Stream constructors accept a `signal` option in an options object literal, and `stream.addAbortSignal` accepts any stream.
+  `node:readline` and `node:readline/promises` (also reached as `readline.promises`) interfaces, from `createInterface(options)` or `createInterface(input, output, completer, terminal)`, read `process.stdin` or a readable stream: `question`, `prompt`, `write` (with a key object literal of `name`, `ctrl`, `meta`, and `shift`), `pause`, `resume`, `'line'`/`'close'`/`'pause'`/`'resume'`/`'error'`/`'history'`/`'SIGINT'`/`'SIGTSTP'`/`'SIGCONT'` listeners, and `for await` compile.
+  The `history`, `historySize`, `removeHistoryDuplicates`, `completer`, `tabSize`, and `escapeCodeTimeout` options are validated as in Node.
+  With `terminal: true`, or with no `terminal` option and `process.stdout` as the output when it is a TTY, the interface runs Node's terminal mode: the editing keys, the kill ring, undo and redo, history recording and recall, Tab completion through the completer, Ctrl+C, Ctrl+D, and Ctrl+Z, `TERM=dumb`, and the same escape sequences written to the output.
+  The output's `'resize'` event does not redraw the line.
+  The cursor never stops between the two UTF-16 units of a supplementary character: where Node's Up or Down movement through a multiline line would, the cursor moves to the character's start or end.
+  In JavaScript, a `'history'` listener receives a copy of the history; its changes are written back when the listener returns, but the copy is not `rl.history` itself.
+  `rl.history`, `historySize`, `historyIndex`, `crlfDelay`, `tabSize`, `escapeCodeTimeout`, `line`, `cursor`, and `terminal` read as in Node, except that `rl.cursor` of an interface that is not a terminal throws instead of answering `undefined`.
+  `rl[Symbol.dispose]()` closes the interface, and `instanceof` with `readline.Interface` or `readlinePromises.Interface` answers whether the interface came from that module, as in Node.
+  In JavaScript, the input and output can be any expression that evaluates to a stream, such as a function's result or an object's member; a value that is not a stream is unsupported.
+  In JavaScript, `question()` and `setPrompt()` accept a value that is not a string: when such a prompt is written, an interface that is not a terminal throws `ERR_INVALID_ARG_TYPE` as Node does (the `readline/promises` question rejects with it) and the question stays pending, and a terminal interface writes `String(value)`.
+  A terminal interface's prompt that is an object or a symbol, `getPrompt()` while the prompt is not a string, and `getCursorPos()` with an object or symbol prompt are unsupported.
+  `readline.cursorTo`, `moveCursor`, `clearLine`, and `clearScreenDown` write to `process.stdout`, `process.stderr`, a writable stream, or nothing for `null` and `undefined`; their callbacks take no parameters.
+  The `readline/promises` `Readline` class writes to the same outputs.
+  `readline.emitKeypressEvents` emits `'keypress'` events on `process.stdin` or a readable stream, shared with terminal interfaces on that stream as in Node; a listener's first parameter must admit `undefined`, which it receives for escape sequences.
+  Chained listener registration is unsupported.
diff --git a/docs/content/limitations/builtin-apis/synchronous-iteration.mdx b/docs/content/limitations/builtin-apis/synchronous-iteration.mdx
index 1ddde1989..564f9af45 100644
--- a/docs/content/limitations/builtin-apis/synchronous-iteration.mdx
+++ b/docs/content/limitations/builtin-apis/synchronous-iteration.mdx
@@ -1 +1,4 @@
-- **Synchronous iteration:** Checked `for...of` follows live iterator methods, including compiled class methods and abrupt-completion cleanup. Mapper-less checked `Array.from` accepts those iterators and plain array-like objects. Sparse checked arrays and general borrowed iterator factories are unsupported. Direct statically typed class loops also restrict iterator `return` and `throw` methods.
+- **Synchronous iteration:** Checked `for...of` follows live iterator methods, including compiled class methods and abrupt-completion cleanup.
+  Mapper-less checked `Array.from` accepts those iterators and plain array-like objects.
+  Sparse checked arrays and general borrowed iterator factories are unsupported.
+  Direct statically typed class loops also restrict iterator `return` and `throw` methods.
diff --git a/docs/content/limitations/builtin-apis/test-mocks.mdx b/docs/content/limitations/builtin-apis/test-mocks.mdx
index a0c63cd98..abfdb3657 100644
--- a/docs/content/limitations/builtin-apis/test-mocks.mdx
+++ b/docs/content/limitations/builtin-apis/test-mocks.mdx
@@ -1,2 +1,14 @@
-- **Test mocks:** `mock.fn`, `mock.method`, `mock.restoreAll` and `mock.reset` compile, on the module's `mock` and on `t.mock`. `mock.method` mocks a function-valued field of a record, such as an object literal or an interface-typed object. Class instances, builtin objects, and object literals whose methods use `this` throw `SC2020`. Calls through the object record it as `this`, including calls of a method read off the object and called on its own, where Node records `undefined`. `object.method === mock` is `false`, because the field holds a wrapper of the mock. `mock.fn()` without an original, `mock.getter`, `mock.setter`, `mock.property`, `mock.module` and mock options throw `SC2020`.
-- **Mock timers:** `mock.timers.enable`, `tick`, `runAll`, `reset`, `setTime` and `[Symbol.dispose]()` compile, on the module's `mock` and on `t.mock`, for the `setTimeout`, `setInterval`, `setImmediate`, `Date`, `scheduler.wait` and `AbortSignal.timeout` APIs. `enable()` takes no options or an object literal whose `apis`, when given, is an array literal. Options and `apis` lists that are not literals, and the `MockTimers` object used as a value, throw `SC2020`. As in Node, the global timer functions, `Date.now()`, `new Date()` and `scheduler.wait` are mocked, and other calls through named and namespace imports of `node:timers` and `node:timers/promises` use real timers. As in Node, once a reset gives `scheduler.wait` back, calling it throws `ERR_INVALID_THIS`. While `scheduler.wait` is mocked, calling it with a `signal` option throws an `SC2020` error. A mock timer's handle converts to a negative number, where Node's mock `Timeout` converts to `NaN`. When two trackers have timers enabled, clearing a timer through the tracker that did not create it leaves the timer queued, where Node removes the entry at the same queue position in the clearing tracker.
+- **Test mocks:** `mock.fn`, `mock.method`, `mock.restoreAll` and `mock.reset` compile, on the module's `mock` and on `t.mock`.
+  `mock.method` mocks a function-valued field of a record, such as an object literal or an interface-typed object.
+  Class instances, builtin objects, and object literals whose methods use `this` throw `SC2020`.
+  Calls through the object record it as `this`, including calls of a method read off the object and called on its own, where Node records `undefined`.
+  `object.method === mock` is `false`, because the field holds a wrapper of the mock.
+  `mock.fn()` without an original, `mock.getter`, `mock.setter`, `mock.property`, `mock.module` and mock options throw `SC2020`.
+- **Mock timers:** `mock.timers.enable`, `tick`, `runAll`, `reset`, `setTime` and `[Symbol.dispose]()` compile, on the module's `mock` and on `t.mock`, for the `setTimeout`, `setInterval`, `setImmediate`, `Date`, `scheduler.wait` and `AbortSignal.timeout` APIs.
+  `enable()` takes no options or an object literal whose `apis`, when given, is an array literal.
+  Options and `apis` lists that are not literals, and the `MockTimers` object used as a value, throw `SC2020`.
+  As in Node, the global timer functions, `Date.now()`, `new Date()` and `scheduler.wait` are mocked, and other calls through named and namespace imports of `node:timers` and `node:timers/promises` use real timers.
+  As in Node, once a reset gives `scheduler.wait` back, calling it throws `ERR_INVALID_THIS`.
+  While `scheduler.wait` is mocked, calling it with a `signal` option throws an `SC2020` error.
+  A mock timer's handle converts to a negative number, where Node's mock `Timeout` converts to `NaN`.
+  When two trackers have timers enabled, clearing a timer through the tracker that did not create it leaves the timer queued, where Node removes the entry at the same queue position in the clearing tracker.
diff --git a/docs/content/limitations/builtin-apis/test-runner.mdx b/docs/content/limitations/builtin-apis/test-runner.mdx
index 25eaebfab..4afd4f11b 100644
--- a/docs/content/limitations/builtin-apis/test-runner.mdx
+++ b/docs/content/limitations/builtin-apis/test-runner.mdx
@@ -1,9 +1,31 @@
-- **Concurrent tests:** with `{ concurrency }` above 1, subtests run on their own fibers, and results are reported in declaration order, as in Node. Concurrent bodies resume in Node's order around `beforeEach` hooks and nested suites. Other runner steps, such as `afterEach` and `after` hooks, take no microtask turns between bodies, so code that observes the interleaving of concurrent bodies across those steps can see a different order than Node.
-- **Snapshots:** `t.assert.snapshot` and `t.assert.fileSnapshot` compile, with Node's default serializer, `JSON.stringify(value, null, 2)`, or an `options.serializers` array literal. A compiled test reads the snapshot file Node writes beside the entry file, `<entry file>.snapshot`, at the entry file's path when the program was compiled. Running the binary with Node's flag `--test-update-snapshots` as its first argument writes the snapshot files instead; as in Node, the flag is kept out of `process.argv` and appears in `process.execArgv`. Snapshot files are read in the form Node writes them, `` exports[`key`] = `value`; `` statements. The `snapshot.setDefaultSnapshotSerializers` and `snapshot.setResolveSnapshotPath` module functions throw `SC2020`.
-- **TestContext values:** `t.filePath` is the entry file's path when the program was compiled. `t.attempt` is `0`, since a test runs once. `t.passed` is `false` while the body runs and the test's outcome in its `afterEach` and `t.after` hooks. `t.workerId` is `Number(process.env.NODE_TEST_WORKER_ID) || undefined`, as in Node. `t.tags` is `[]`, since the `tags` test option throws `SC2020`; the array is not frozen as Node's is.
-- **Suite and hook contexts:** a `describe` body may take its `SuiteContext`, which has `name`, `fullName`, `filePath`, `attempt`, `passed` and `diagnostic`. Hooks may take their context, as in Node: the suite's for `before` and `after`, the test's for `beforeEach`, `afterEach`, `t.before` and `t.after`. The `SuiteContext` `signal` and `log` members, and hook `done` callbacks, throw `SC2020`.
-- **Module-level hooks:** `before` hooks outside any suite run at their `before()` call, and the first top-level test waits for the async ones; `after` hooks outside any suite run after the last top-level test. Both get the root's context, named `<root>`. As in Node, a throwing root `before` fails each top-level test with its error, without running its body, and cancels the tests and suites inside each top-level suite. A throwing root `after` reports the entry file as a failed result, and the exit code is unchanged.
-- **Timeouts:** when a test's `{ timeout }` elapses, its running subtests are cancelled, as in Node. Subtests do not take their parent's `timeout` as their own, where Node's do, and the subtests of a timed-out test with `{ concurrency }` above 1 run to completion before the test reports. A body that keeps running after its timeout and calls `t.test` again runs that subtest, where Node reports it as not started.
-- **Thrown values:** a test that throws an object or array that is not an `Error`, such as `throw { code: 42 }`, reports `[object Object]` in the failing section, where Node prints the value as `util.inspect` renders it.
-- **Test names:** a test without a name, or with an empty one, takes its function's name or `<anonymous>`, as in Node, when the function's name is known at compile time: a function expression, a function declaration, or a `const` bound to an arrow or anonymous function. A name computed at run time, with a function the program received as a parameter, is used as given, so an empty one stays empty where Node uses the function's name. `test(fn)` and `test("", fn)` with such a function throw `SC2020`.
-- **Current context:** `getTestContext()` returns the context of the test, suite or hook whose code is running, as in Node: `undefined` at module top level, the root's context in module-level hooks, the suite's in a suite body and in the suite's hooks, and the test's in its body, in the code it awaits, and in the timers, immediates, `process.nextTick` and `queueMicrotask` callbacks it schedules. Node returns, for a suite, a `TestContext` that is a different object from the `SuiteContext` passed to the suite body and its `before` and `after` hooks; in a compiled program they are the same object, so comparing them with `===` gives `true`. Completion callbacks of callback-style I/O APIs, such as `fs.readFile`, get `undefined`, as AsyncLocalStorage stores do.
+- **Concurrent tests:** with `{ concurrency }` above 1, subtests run on their own fibers, and results are reported in declaration order, as in Node.
+  Concurrent bodies resume in Node's order around `beforeEach` hooks and nested suites.
+  Other runner steps, such as `afterEach` and `after` hooks, take no microtask turns between bodies, so code that observes the interleaving of concurrent bodies across those steps can see a different order than Node.
+- **Snapshots:** `t.assert.snapshot` and `t.assert.fileSnapshot` compile, with Node's default serializer, `JSON.stringify(value, null, 2)`, or an `options.serializers` array literal.
+  A compiled test reads the snapshot file Node writes beside the entry file, `<entry file>.snapshot`, at the entry file's path when the program was compiled.
+  Running the binary with Node's flag `--test-update-snapshots` as its first argument writes the snapshot files instead; as in Node, the flag is kept out of `process.argv` and appears in `process.execArgv`.
+  Snapshot files are read in the form Node writes them, `` exports[`key`] = `value`; `` statements.
+  The `snapshot.setDefaultSnapshotSerializers` and `snapshot.setResolveSnapshotPath` module functions throw `SC2020`.
+- **TestContext values:** `t.filePath` is the entry file's path when the program was compiled.
+  `t.attempt` is `0`, since a test runs once.
+  `t.passed` is `false` while the body runs and the test's outcome in its `afterEach` and `t.after` hooks.
+  `t.workerId` is `Number(process.env.NODE_TEST_WORKER_ID) || undefined`, as in Node.
+  `t.tags` is `[]`, since the `tags` test option throws `SC2020`; the array is not frozen as Node's is.
+- **Suite and hook contexts:** a `describe` body may take its `SuiteContext`, which has `name`, `fullName`, `filePath`, `attempt`, `passed` and `diagnostic`.
+  Hooks may take their context, as in Node: the suite's for `before` and `after`, the test's for `beforeEach`, `afterEach`, `t.before` and `t.after`.
+  The `SuiteContext` `signal` and `log` members, and hook `done` callbacks, throw `SC2020`.
+- **Module-level hooks:** `before` hooks outside any suite run at their `before()` call, and the first top-level test waits for the async ones; `after` hooks outside any suite run after the last top-level test.
+  Both get the root's context, named `<root>`.
+  As in Node, a throwing root `before` fails each top-level test with its error, without running its body, and cancels the tests and suites inside each top-level suite.
+  A throwing root `after` reports the entry file as a failed result, and the exit code is unchanged.
+- **Timeouts:** when a test's `{ timeout }` elapses, its running subtests are cancelled, as in Node.
+  Subtests do not take their parent's `timeout` as their own, where Node's do, and the subtests of a timed-out test with `{ concurrency }` above 1 run to completion before the test reports.
+  A body that keeps running after its timeout and calls `t.test` again runs that subtest, where Node reports it as not started.
+- **Thrown values:** a test that throws a value that is not an `Error` reports it in the failing section as `util.inspect` renders it, as Node does, for strings, numbers, booleans, objects, arrays, `null` and `undefined`.
+  A thrown class instance that is not an `Error`, such as `throw new Point(1, 2)`, reports `[object Object]`, where Node prints `Point { x: 1, y: 2 }`.
+- **Test names:** a test without a name, or with an empty one, takes its function's name or `<anonymous>`, as in Node, when the function's name is known at compile time: a function expression, a function declaration, or a `const` bound to an arrow or anonymous function.
+  A name computed at run time, with a function the program received as a parameter, is used as given, so an empty one stays empty where Node uses the function's name.
+  `test(fn)` and `test("", fn)` with such a function throw `SC2020`.
+- **Current context:** `getTestContext()` returns the context of the test, suite or hook whose code is running, as in Node: `undefined` at module top level, the root's context in module-level hooks, the suite's in a suite body and in the suite's hooks, and the test's in its body, in the code it awaits, and in the timers, immediates, `process.nextTick` and `queueMicrotask` callbacks it schedules.
+  Node returns, for a suite, a `TestContext` that is a different object from the `SuiteContext` passed to the suite body and its `before` and `after` hooks; in a compiled program they are the same object, so comparing them with `===` gives `true`.
+  Completion callbacks of callback-style I/O APIs, such as `fs.readFile`, get `undefined`, as AsyncLocalStorage stores do.
diff --git a/docs/content/limitations/builtin-apis/text-encoding.mdx b/docs/content/limitations/builtin-apis/text-encoding.mdx
index 02cf7cd10..bffd24424 100644
--- a/docs/content/limitations/builtin-apis/text-encoding.mdx
+++ b/docs/content/limitations/builtin-apis/text-encoding.mdx
@@ -1 +1,7 @@
-- **Text encoding:** `TextEncoder` and `TextDecoder` can be stored in fields, arguments, return values, arrays, and closures. Encoding supports UTF-8, including `encodeInto` into a Uint8Array or Buffer view. Codec properties expose the canonical encoding and decoder flags. Decoding accepts recognized WHATWG labels, including runtime labels and omitted or undefined encodings. Literal constructor options support `fatal` and `ignoreBOM`; literal decode options support streaming UTF-8, UTF-16, and single-byte encodings. Other legacy streaming encodings, runtime options objects, inspection, JSON conversion, and module-scope declarations using `var` or lacking an initializer are unsupported. Use initialized `let` or `const` bindings for stored codecs.
+- **Text encoding:** `TextEncoder` and `TextDecoder` can be stored in fields, arguments, return values, arrays, and closures.
+  Encoding supports UTF-8, including `encodeInto` into a Uint8Array or Buffer view.
+  Codec properties expose the canonical encoding and decoder flags.
+  Decoding accepts recognized WHATWG labels, including runtime labels and omitted or undefined encodings.
+  Literal constructor options support `fatal` and `ignoreBOM`; literal decode options support streaming UTF-8, UTF-16, and single-byte encodings.
+  Other legacy streaming encodings, runtime options objects, inspection, JSON conversion, and module-scope declarations using `var` or lacking an initializer are unsupported.
+  Use initialized `let` or `const` bindings for stored codecs.
diff --git a/docs/content/limitations/builtin-apis/url.mdx b/docs/content/limitations/builtin-apis/url.mdx
index ebd87a79d..6345e2616 100644
--- a/docs/content/limitations/builtin-apis/url.mdx
+++ b/docs/content/limitations/builtin-apis/url.mdx
@@ -1 +1,9 @@
-- **URL:** Non-ASCII or percent-escaped hosts are unsupported. Absolute inputs and relative inputs with runtime string or URL bases, including optional bases, compile. `URL.canParse`, `URL.parse`, `toString()`, and `toJSON()` compile; the factories use the same parser as construction, returning `false` or `null` for rejected inputs while preserving conversion errors. `href`, `protocol`, `username`, `password`, `host`, `hostname`, `port`, `pathname`, `search`, and `hash` support assignment in native code. Invalid component writes are ignored except for invalid `href` values, which throw; credentials are percent-encoded and ports accept valid leading digits. Native URL assignments require statically known property keys; `+=` accepts primitive operands, while other assignment operators and object operands for `+=` are refused. `origin` is read-only. `searchParams` is a live view whose identity survives query and URL replacement. Opaque paths retain their input bytes without WHATWG C0 encoding.
+- **URL:** Non-ASCII or percent-escaped hosts are unsupported.
+  Absolute inputs and relative inputs with runtime string or URL bases, including optional bases, compile.
+  `URL.canParse`, `URL.parse`, `toString()`, and `toJSON()` compile; the factories use the same parser as construction, returning `false` or `null` for rejected inputs while preserving conversion errors.
+  `href`, `protocol`, `username`, `password`, `host`, `hostname`, `port`, `pathname`, `search`, and `hash` support assignment in native code.
+  Invalid component writes are ignored except for invalid `href` values, which throw; credentials are percent-encoded and ports accept valid leading digits.
+  Native URL assignments require statically known property keys; `+=` accepts primitive operands, while other assignment operators and object operands for `+=` are refused.
+  `origin` is read-only.
+  `searchParams` is a live view whose identity survives query and URL replacement.
+  Opaque paths retain their input bytes without WHATWG C0 encoding.
diff --git a/docs/content/limitations/builtin-function-values.mdx b/docs/content/limitations/builtin-function-values.mdx
index 4fd093e47..c08540c1a 100644
--- a/docs/content/limitations/builtin-function-values.mdx
+++ b/docs/content/limitations/builtin-function-values.mdx
@@ -5,14 +5,30 @@ Some builtins can be stored and passed as functions:
 - `util.isDeepStrictEqual`, `styleText`, `stripVTControlCharacters`, `toUSVString`, `inherits`, `deprecate`, `callbackify`, `debuglog`, and `debug`.
 - `fs.existsSync`, `unlinkSync`, `chmodSync`, `chownSync`, `renameSync`, and `closeSync`, and `fs/promises.unlink`, `chmod`, and `rename`.
 
-Other immutable aliases of table-backed Node builtins support direct calls, but cannot be passed elsewhere. `util.promisify` supports compile-time conversions of `child_process.execFile`, `child_process.exec`, `setTimeout` and `setImmediate` (to the `timers/promises` functions, as in Node), `stream.finished` and `stream.pipeline` (to the `stream/promises` functions, as in Node), the `zlib` callback one-shots `deflate`, `inflate`, `deflateRaw`, `inflateRaw`, `gzip`, `gunzip` and `unzip` (with or without options), the `crypto` callback functions `randomBytes`, `pbkdf2`, `scrypt`, `hkdf`, `randomFill`, `randomInt` and `generateKey`, `dns.lookup` (settling with `{ address, family }`, or the address array with `all: true`) and `dns.lookupService` (settling with `{ hostname, service }`), and the `fs` callback functions that have an `fs/promises` counterpart (`access`, `appendFile`, `chmod`, `chown`, `copyFile`, `lchown`, `link`, `lstat`, `lutimes`, `mkdir`, `mkdtemp`, `readFile`, `readdir`, `readlink`, `realpath`, `rename`, `rm`, `rmdir`, `stat`, `statfs`, `symlink`, `truncate`, `unlink`, `utimes`, and `writeFile`); calls through the converted function lower as the `fs/promises` call.
+Other immutable aliases of table-backed Node builtins support direct calls, but cannot be passed elsewhere.
+`util.promisify` supports compile-time conversions of `child_process.execFile`, `child_process.exec`, `setTimeout` and `setImmediate` (to the `timers/promises` functions, as in Node), `stream.finished` and `stream.pipeline` (to the `stream/promises` functions, as in Node), the `zlib` callback one-shots `deflate`, `inflate`, `deflateRaw`, `inflateRaw`, `gzip`, `gunzip` and `unzip` (with or without options), the `crypto` callback functions `randomBytes`, `pbkdf2`, `scrypt`, `hkdf`, `randomFill`, `randomInt` and `generateKey`, `dns.lookup` (settling with `{ address, family }`, or the address array with `all: true`) and `dns.lookupService` (settling with `{ hostname, service }`), and the `fs` callback functions that have an `fs/promises` counterpart (`access`, `appendFile`, `chmod`, `chown`, `copyFile`, `lchown`, `link`, `lstat`, `lutimes`, `mkdir`, `mkdtemp`, `readFile`, `readdir`, `readlink`, `realpath`, `rename`, `rm`, `rmdir`, `stat`, `statfs`, `symlink`, `truncate`, `unlink`, `utimes`, and `writeFile`); calls through the converted function lower as the `fs/promises` call.
 
-`util.styleText` supports standard formats and aliases, `#RGB` and `#RRGGBB` hex colors, arrays of formats, nested ANSI resets, and explicit color enabling with `{ validateStream: false }`. Native calls accept standard process streams; custom native streams and mutations to `util.inspect.colors` remain unsupported.
+`util.styleText` supports standard formats and aliases, `#RGB` and `#RRGGBB` hex colors, arrays of formats, nested ANSI resets, and explicit color enabling with `{ validateStream: false }`.
+Native calls accept standard process streams; custom native streams and mutations to `util.inspect.colors` remain unsupported.
 
-`util.inherits` links the prototypes of constructor functions, and `util.deprecate`, `util.callbackify`, and `util.debuglog` return native function values that forward receivers and arguments. Class constructors passed to `util.inherits` or `util.deprecate` are refused. Deprecation warnings are emitted on the next tick and follow assignments to `process.noDeprecation` and `process.throwDeprecation`; compiled binaries take no Node command-line flags such as `--no-deprecation` or `--trace-deprecation`, and `process.traceDeprecation` is unsupported. A stored `util.deprecate` reports a `length` of 4, where Node reports 3. In TypeScript, a `util.callbackify` result must reach a callback whose error parameter accepts `null`; the @types/node overloads that type it as non-null are refused. `util.debuglog` reads `NODE_DEBUG` as the process started. Its `%s` refuses functions and objects with symbol-keyed members, `%o` refuses objects, and object arguments are refused on a color terminal.
+`util.inherits` links the prototypes of constructor functions, and `util.deprecate`, `util.callbackify`, and `util.debuglog` return native function values that forward receivers and arguments.
+Class constructors passed to `util.inherits` or `util.deprecate` are refused.
+Deprecation warnings are emitted on the next tick and follow assignments to `process.noDeprecation` and `process.throwDeprecation`; compiled binaries take no Node command-line flags such as `--no-deprecation` or `--trace-deprecation`, and `process.traceDeprecation` is unsupported.
+A stored `util.deprecate` reports a `length` of 4, where Node reports 3.
+In TypeScript, a `util.callbackify` result must reach a callback whose error parameter accepts `null`; the @types/node overloads that type it as non-null are refused.
+`util.debuglog` reads `NODE_DEBUG` as the process started.
+Its `%s` refuses functions and objects with symbol-keyed members, `%o` refuses objects, and object arguments are refused on a color terminal.
 
-`util.isDeepStrictEqual` supports primitives, ordinary records and arrays, cycles, enumerable string and symbol properties, and byte views. Its optional third argument skips prototype and constructor comparisons. Structural comparisons of native Maps, Sets, class instances, Errors, proxies, accessor properties, and function-valued own `constructor` properties remain refused.
+`util.isDeepStrictEqual` supports primitives, ordinary records and arrays, cycles, enumerable string and symbol properties, and byte views.
+Its optional third argument skips prototype and constructor comparisons.
+Structural comparisons of native Maps, Sets, class instances, Errors, proxies, accessor properties, and function-valued own `constructor` properties remain refused.
 
-Synchronous and promise filesystem APIs with trailing arguments that affect behavior remain call-only. This includes writers, open, directory creation/removal, metadata readers, and directory readers. Passing them as values could discard modes, flags, encodings, or options during function-signature adaptation.
+Synchronous and promise filesystem APIs with trailing arguments that affect behavior remain call-only.
+This includes writers, open, directory creation/removal, metadata readers, and directory readers.
+Passing them as values could discard modes, flags, encodings, or options during function-signature adaptation.
 
-Native error-first filesystem callbacks can be stored and passed to platform adapters. Reads support Buffer and UTF-8 results; writes preserve string flags and modes; copy follows `fs.cp`. Reads and writes reject already-aborted signals, but native file operations complete synchronously before the deferred callback, so cancellation cannot interrupt I/O in progress. Recursive directory reads and Dirent results report a native limitation. `fs.glob` compiles only as a direct call; a stored `fs.glob` value throws `SC2020`.
+Native error-first filesystem callbacks can be stored and passed to platform adapters.
+Reads support Buffer and UTF-8 results; writes preserve string flags and modes; copy follows `fs.cp`.
+Reads and writes reject already-aborted signals, but native file operations complete synchronously before the deferred callback, so cancellation cannot interrupt I/O in progress.
+Recursive directory reads and Dirent results report a native limitation.
+`fs.glob` compiles only as a direct call; a stored `fs.glob` value throws `SC2020`.
diff --git a/docs/content/limitations/child-process-workers.mdx b/docs/content/limitations/child-process-workers.mdx
index 0d28e237c..5b41c5e53 100644
--- a/docs/content/limitations/child-process-workers.mdx
+++ b/docs/content/limitations/child-process-workers.mdx
@@ -1,5 +1,14 @@
-`child_process.fork()` requires a worker path resolved at build time from `new URL("./worker.ts", import.meta.url)` or `fileURLToPath(new URL("./worker.ts", import.meta.url))`. Never-reassigned `const` aliases and statically resolvable template parts are accepted. The worker and its imports are embedded in the executable, which re-executes itself to start that module. Worker arguments begin at `process.argv[2]`.
+`child_process.fork()` requires a worker path resolved at build time from `new URL("./worker.ts", import.meta.url)` or `fileURLToPath(new URL("./worker.ts", import.meta.url))`.
+Never-reassigned `const` aliases and statically resolvable template parts are accepted.
+The worker and its imports are embedded in the executable, which re-executes itself to start that module.
+Worker arguments begin at `process.argv[2]`.
 
-Supported options are default inherited stdio or an inline object with `cwd`, `env`, `silent`, `windowsHide`, or `[stdin, stdout, stderr, "ipc"]`. `execArgv` is accepted but has no native effect. Runtime worker paths, custom `execPath`, advanced serialization, transferred sockets or servers, uid/gid, timeout/signal options, and other stdio arrays are unsupported.
+Supported options are default inherited stdio or an inline object with `cwd`, `env`, `silent`, `windowsHide`, or `[stdin, stdout, stderr, "ipc"]`.
+`execArgv` is accepted but has no native effect.
+Runtime worker paths, custom `execPath`, advanced serialization, transferred sockets or servers, uid/gid, timeout/signal options, and other stdio arrays are unsupported.
 
-Parent and child channels support `send(message, callback?)`, `connected`, `disconnect()`, and `on`/`once` for `message` and `disconnect`. Message listeners may return `void` or `Promise<void>`. Messages use newline-delimited JSON, so their static types must be JSON-stringifiable or `unknown` backed by a checked JSON tree. `send()` returns the channel's backpressure state and invokes its callback later with `null` or an `Error`. `disconnect()` changes `connected` synchronously, before the later disconnect events.
+Parent and child channels support `send(message, callback?)`, `connected`, `disconnect()`, and `on`/`once` for `message` and `disconnect`.
+Message listeners may return `void` or `Promise<void>`.
+Messages use newline-delimited JSON, so their static types must be JSON-stringifiable or `unknown` backed by a checked JSON tree.
+`send()` returns the channel's backpressure state and invokes its callback later with `null` or an `Error`.
+`disconnect()` changes `connected` synchronously, before the later disconnect events.
diff --git a/docs/content/limitations/console-and-process-streams.mdx b/docs/content/limitations/console-and-process-streams.mdx
index 9a7788cc1..0d7cd8f30 100644
--- a/docs/content/limitations/console-and-process-streams.mdx
+++ b/docs/content/limitations/console-and-process-streams.mdx
@@ -1,3 +1,12 @@
-`console.log`, `info`, and `debug` write to stdout; `error` and `warn` write to stderr. They accept `unknown`, printing strings verbatim and other values through native `util.inspect`. Direct calls support global `console` and `node:console` imports. Stored global console values and detached output methods retain identity and accept ordinary arguments. Stored methods do not support format specifiers with substitution arguments. Other stored console APIs, custom `Console` instances, and console mutation are unsupported.
+`console.log`, `info`, and `debug` write to stdout; `error` and `warn` write to stderr.
+They accept `unknown`, printing strings verbatim and other values through native `util.inspect`.
+Direct calls support global `console` and `node:console` imports.
+Stored global console values and detached output methods retain identity and accept ordinary arguments.
+Stored methods do not support format specifiers with substitution arguments.
+Other stored console APIs, custom `Console` instances, and console mutation are unsupported.
 
-JavaScript can store `process.stdin`, `stdout`, and `stderr`, replace output `write` methods, and call saved methods with their stream receiver. Input supports data/end/error listeners, pause/resume, buffered reads, and TTY raw mode. Output writes are synchronous, with successful callbacks on the next-tick queue; queued backpressure is not modeled. Stored streams do not support piping, encoding changes, arbitrary properties, or other events. TypeScript output parameters support `write(string)`.
+JavaScript can store `process.stdin`, `stdout`, and `stderr`, replace output `write` methods, and call saved methods with their stream receiver.
+Input supports data/end/error listeners, pause/resume, buffered reads, and TTY raw mode.
+Output writes are synchronous, with successful callbacks on the next-tick queue; queued backpressure is not modeled.
+Stored streams do not support piping, encoding changes, arbitrary properties, or other events.
+TypeScript output parameters support `write(string)`.
diff --git a/docs/content/limitations/contract-types.mdx b/docs/content/limitations/contract-types.mdx
index 977150259..35d7a95c0 100644
--- a/docs/content/limitations/contract-types.mdx
+++ b/docs/content/limitations/contract-types.mdx
@@ -1 +1,7 @@
-[Contract types](/docs/contracts) are checked only where they are written as the annotation of a parameter, variable, class instance field or function result, `Acyclic` only on classes, interfaces and object type aliases, and `ProgramLifetime` only in the `implements` clause of a class declaration; other aliases, interface members and nested type positions are reported. In programs that use worker threads, a surrounding `try`/`catch` does not discharge `NoThrow`. `Int32` refuses parameters of functions used as values and fields of classes whose instances are stored in `any` or `unknown` values. `Int32[]` refuses arrays that can come from or escape to code scriptc cannot see, does not follow callback results (such as `map` results), and checks a copy made by `slice` or a spread as if it were its source array. Element reads that find a value are int32s, but a scalar `Int32` slot still needs `a[i] | 0`, because a read can miss and produce `undefined`. `Immutable` refuses values stored in `any` or `unknown` or that another reference can still change. `ProgramLifetime` applies to root classes of executables only; instances the program drops are never reclaimed unless they belong to a released [lifetime region](/docs/experimental#lifetimeregion).
+[Contract types](/docs/contracts) are checked only where they are written as the annotation of a parameter, variable, class instance field or function result, `Acyclic` only on classes, interfaces and object type aliases, and `ProgramLifetime` only in the `implements` clause of a class declaration; other aliases, interface members and nested type positions are reported.
+In programs that use worker threads, a surrounding `try`/`catch` does not discharge `NoThrow`.
+`Int32` refuses parameters of functions used as values and fields of classes whose instances are stored in `any` or `unknown` values.
+`Int32[]` refuses arrays that can come from or escape to code scriptc cannot see, does not follow callback results (such as `map` results), and checks a copy made by `slice` or a spread as if it were its source array.
+Element reads that find a value are int32s, but a scalar `Int32` slot still needs `a[i] | 0`, because a read can miss and produce `undefined`.
+`Immutable` refuses values stored in `any` or `unknown` or that another reference can still change.
+`ProgramLifetime` applies to root classes of executables only; instances the program drops are never reclaimed unless they belong to a released [lifetime region](/docs/experimental#lifetimeregion).
diff --git a/docs/content/limitations/dates-and-timezones.mdx b/docs/content/limitations/dates-and-timezones.mdx
index e88cfb462..e5655eb85 100644
--- a/docs/content/limitations/dates-and-timezones.mdx
+++ b/docs/content/limitations/dates-and-timezones.mdx
@@ -1,5 +1,13 @@
-String constructors and `Date.parse` accept ECMAScript date-only forms, date-times with an explicit `Z` or numeric offset, and GMT certificate-validity strings from the supported X509 APIs. Other V8-specific forms and offset-less local date-times produce an Invalid Date or `NaN`; `SC6005` reports string literals in those forms.
+String constructors and `Date.parse` accept ECMAScript date-only forms, date-times with an explicit `Z` or numeric offset, and GMT certificate-validity strings from the supported X509 APIs.
+Other V8-specific forms and offset-less local date-times produce an Invalid Date or `NaN`; `SC6005` reports string literals in those forms.
 
-Local calendar getters use the operating system's timezone database. Historical results can differ from Node.js when timezone data differs. For valid extreme years outside a platform calendar API's range, scriptc uses a calendar-equivalent year in the 400-year Gregorian cycle to obtain the timezone rule.
+Local calendar getters use the operating system's timezone database.
+Historical results can differ from Node.js when timezone data differs.
+For valid extreme years outside a platform calendar API's range, scriptc uses a calendar-equivalent year in the 400-year Gregorian cycle to obtain the timezone rule.
 
-`toString`, `toTimeString`, `String(date)` and template literals print the zone's long name after the GMT offset, as Node does (`GMT-0500 (Central Daylight Time)`). scriptc identifies the zone the way Node does, from `TZ` when it names a zone, else from `/etc/localtime`. Outside Windows, a write to `process.env.TZ` changes the zone for later conversions and getters. The names are the en-US names for the IANA zones; Node prints them in the language of the locale that `LC_ALL`, `LC_MESSAGES` or `LANG` selects, so with a non-English locale the name differs from Node's. A `TZ` value that is a file path or a POSIX rule string (such as `EST5EDT,M3.2.0,M11.1.0`) gives offsets and names that differ from Node's, which ignores those forms. On Windows, the name is the `GMT+hh:mm` form unless `TZ` names a zone. On `wasm32-wasi`, local time is UTC and the name is `Coordinated Universal Time`.
+`toString`, `toTimeString`, `String(date)` and template literals print the zone's long name after the GMT offset, as Node does (`GMT-0500 (Central Daylight Time)`). scriptc identifies the zone the way Node does, from `TZ` when it names a zone, else from `/etc/localtime`.
+Outside Windows, a write to `process.env.TZ` changes the zone for later conversions and getters.
+The names are the en-US names for the IANA zones; Node prints them in the language of the locale that `LC_ALL`, `LC_MESSAGES` or `LANG` selects, so with a non-English locale the name differs from Node's.
+A `TZ` value that is a file path or a POSIX rule string (such as `EST5EDT,M3.2.0,M11.1.0`) gives offsets and names that differ from Node's, which ignores those forms.
+On Windows, the name is the `GMT+hh:mm` form unless `TZ` names a zone.
+On `wasm32-wasi`, local time is UTC and the name is `Coordinated Universal Time`.
diff --git a/docs/content/limitations/dns-lookup-errors.mdx b/docs/content/limitations/dns-lookup-errors.mdx
index e686ad47a..9ed2c854c 100644
--- a/docs/content/limitations/dns-lookup-errors.mdx
+++ b/docs/content/limitations/dns-lookup-errors.mdx
@@ -1 +1,3 @@
-After a failed `dns.lookup` or `dns.lookupService`, Node calls the callback with the error alone, so the address and family parameters are `undefined`. A callback whose address parameter is typed `string` (as Node's own type declarations type it) receives `""` and `NaN` there, or an empty array for `all: true`, because a typed string or number cannot hold `undefined`. An untyped callback receives the error alone, as in Node.
+After a failed `dns.lookup` or `dns.lookupService`, Node calls the callback with the error alone, so the address and family parameters are `undefined`.
+A callback whose address parameter is typed `string` (as Node's own type declarations type it) receives `""` and `NaN` there, or an empty array for `all: true`, because a typed string or number cannot hold `undefined`.
+An untyped callback receives the error alone, as in Node.
diff --git a/docs/content/limitations/foreign-thread-callbacks.mdx b/docs/content/limitations/foreign-thread-callbacks.mdx
index 5c8409c61..c29158a37 100644
--- a/docs/content/limitations/foreign-thread-callbacks.mdx
+++ b/docs/content/limitations/foreign-thread-callbacks.mdx
@@ -1,3 +1,6 @@
-FFI format 5 accepts retained, context-bearing `void` callbacks invoked by library-owned threads. The native callback copies arguments and queues work; the script closure runs on the event loop at least one turn later. These callbacks are not suitable for real-time execution.
+FFI format 5 accepts retained, context-bearing `void` callbacks invoked by library-owned threads.
+The native callback copies arguments and queues work; the script closure runs on the event loop at least one turn later.
+These callbacks are not suitable for real-time execution.
 
-Value-returning callbacks and direct script execution on foreign threads are unsupported. Reference counting and exception state belong to the script thread, and waiting for the event loop can deadlock.
+Value-returning callbacks and direct script execution on foreign threads are unsupported.
+Reference counting and exception state belong to the script thread, and waiting for the event loop can deadlock.
diff --git a/docs/content/limitations/http-headers.mdx b/docs/content/limitations/http-headers.mdx
index 785c304db..e84b15ed2 100644
--- a/docs/content/limitations/http-headers.mdx
+++ b/docs/content/limitations/http-headers.mdx
@@ -1 +1,3 @@
-Without `@types/node`, the bundled declarations type every `req.headers` value as a string. Reading `headers["set-cookie"]` is then refused, and a `{ ...req.headers }` copy holds `set-cookie` as one string joined with `", "`, where Node holds an array. Read `headersDistinct["set-cookie"]`, or install `@types/node`, whose `headers["set-cookie"]` is `string[]`.
+Without `@types/node`, the bundled declarations type every `req.headers` value as a string.
+Reading `headers["set-cookie"]` is then refused, and a `{ ...req.headers }` copy holds `set-cookie` as one string joined with `", "`, where Node holds an array.
+Read `headersDistinct["set-cookie"]`, or install `@types/node`, whose `headers["set-cookie"]` is `string[]`.
diff --git a/docs/content/limitations/introduction.mdx b/docs/content/limitations/introduction.mdx
index b4bab3ebb..5fc46af2b 100644
--- a/docs/content/limitations/introduction.mdx
+++ b/docs/content/limitations/introduction.mdx
@@ -1,3 +1,8 @@
-scriptc supports a subset of JavaScript, TypeScript, and the Node.js APIs. This page is a reference for the remaining restrictions and for runtime behavior that differs from Node.js. You don't need to read it front to back: run [`scriptc coverage`](/docs/coverage) on your program, and come here when a diagnostic or a behavior difference needs more context. The [Node.js compatibility reference](/compatibility) lists support API by API.
+scriptc supports a subset of JavaScript, TypeScript, and the Node.js APIs.
+This page is a reference for the remaining restrictions and for runtime behavior that differs from Node.js.
+You don't need to read it front to back: run [`scriptc coverage`](/docs/coverage) on your program, and come here when a diagnostic or a behavior difference needs more context.
+The [Node.js compatibility reference](/compatibility) lists support API by API.
 
-Some entries mention **checked values**. When the type of a value is only known at runtime, such as `unknown`, `any`, the result of `JSON.parse`, or a value passed through untyped JavaScript, scriptc stores it together with its runtime type and checks it when the program converts it back to a specific type. Entries that say a value "retains identity through checked storage" mean the same object comes back out, rather than a copy.
+Some entries mention **checked values**.
+When the type of a value is only known at runtime, such as `unknown`, `any`, the result of `JSON.parse`, or a value passed through untyped JavaScript, scriptc stores it together with its runtime type and checks it when the program converts it back to a specific type.
+Entries that say a value "retains identity through checked storage" mean the same object comes back out, rather than a copy.
diff --git a/docs/content/limitations/json-callbacks.mdx b/docs/content/limitations/json-callbacks.mdx
index 2edb9302e..12d8be85a 100644
--- a/docs/content/limitations/json-callbacks.mdx
+++ b/docs/content/limitations/json-callbacks.mdx
@@ -1,5 +1,12 @@
-Function replacers and two-argument revivers support nested replacements, object-property deletion, and thrown exceptions. Omitting the root through a replacer returns `undefined`. Array replacers list the object keys to serialize, as in Node.js. Stored `JSON.stringify` functions accept numeric and string indentation; direct calls require literal indentation.
+Function replacers and two-argument revivers support nested replacements, object-property deletion, and thrown exceptions.
+Omitting the root through a replacer returns `undefined`.
+Array replacers list the object keys to serialize, as in Node.js.
+Stored `JSON.stringify` functions accept numeric and string indentation; direct calls require literal indentation.
 
-Reviver source contexts are unsupported. A reviver that deletes an array element throws, because checked arrays cannot represent holes.
+Reviver source contexts are unsupported.
+A reviver that deletes an array element throws, because checked arrays cannot represent holes.
 
-Callback values use checked storage. Typed records and arrays retain identity and mutations; record fields use declaration order; typed-array views retain backing storage and brands. `Buffer.isBuffer` preserves the Buffer brand through `unknown`. JavaScript callbacks receive the holder as `this`; TypeScript callbacks that access dynamic `this` are unsupported.
+Callback values use checked storage.
+Typed records and arrays retain identity and mutations; record fields use declaration order; typed-array views retain backing storage and brands.
+`Buffer.isBuffer` preserves the Buffer brand through `unknown`.
+JavaScript callbacks receive the holder as `this`; TypeScript callbacks that access dynamic `this` are unsupported.
diff --git a/docs/content/limitations/language-and-api-restrictions.mdx b/docs/content/limitations/language-and-api-restrictions.mdx
index 982101f5a..24735a171 100644
--- a/docs/content/limitations/language-and-api-restrictions.mdx
+++ b/docs/content/limitations/language-and-api-restrictions.mdx
@@ -1 +1,2 @@
-The following sections describe what compiles and what doesn't, area by area. They are not exhaustive; the compiler's diagnostics are the authority for a specific program.
+The following sections describe what compiles and what doesn't, area by area.
+They are not exhaustive; the compiler's diagnostics are the authority for a specific program.
diff --git a/docs/content/limitations/language-features/argument-spreads.mdx b/docs/content/limitations/language-features/argument-spreads.mdx
index 1f1fa770b..43e3919be 100644
--- a/docs/content/limitations/language-features/argument-spreads.mdx
+++ b/docs/content/limitations/language-features/argument-spreads.mdx
@@ -1 +1,5 @@
-- **Argument spreads:** Non-empty fixed tuples can spread into fixed signatures; arrays, Sets, and compiled class iterables can spread into typed rest parameters. Runtime-length spreads into fixed or rest parameters require types that support checked `unknown` conversion. Other JavaScript calls use the checked-value path; unsupported static forms produce a diagnostic. Calls with no native parameter slot are unsupported for runtime-length spreads. Arguments evaluate once, in source order, before defaults run, including surplus arguments.
+- **Argument spreads:** Non-empty fixed tuples can spread into fixed signatures; arrays, Sets, and compiled class iterables can spread into typed rest parameters.
+  Runtime-length spreads into fixed or rest parameters require types that support checked `unknown` conversion.
+  Other JavaScript calls use the checked-value path; unsupported static forms produce a diagnostic.
+  Calls with no native parameter slot are unsupported for runtime-length spreads.
+  Arguments evaluate once, in source order, before defaults run, including surplus arguments.
diff --git a/docs/content/limitations/language-features/async-iteration.mdx b/docs/content/limitations/language-features/async-iteration.mdx
index f18377299..863c9be90 100644
--- a/docs/content/limitations/language-features/async-iteration.mdx
+++ b/docs/content/limitations/language-features/async-iteration.mdx
@@ -1 +1,6 @@
-- **Async iteration:** Async `yield*` delegation, stored Web or Node iterator handles, and general structural async-iterator objects are unsupported. Typed async generators support lazy execution, `await`, direct `yield`, queued `.next()`/`.return()`/`.throw()` requests, and `for await`. `for await` also accepts Node `Readable` streams, Web `ReadableStream` values, and compiled class iterators whose zero-parameter `next()` returns a promise of a `{ value, done? }` record. Abrupt completion runs cleanup, including literal `destroyOnReturn` and `preventCancel` options. The `node:timers/promises` `setInterval(delay, value)` iterator compiles without AbortSignal options. `Array.fromAsync` accepts arrays of values or of promises and typed async generators, with an optional mapping function; a `thisArg` and arrays that mix values and promises are unsupported.
+- **Async iteration:** Async `yield*` delegation, stored Web or Node iterator handles, and general structural async-iterator objects are unsupported.
+  Typed async generators support lazy execution, `await`, direct `yield`, queued `.next()`/`.return()`/`.throw()` requests, and `for await`.
+  `for await` also accepts Node `Readable` streams, Web `ReadableStream` values, and compiled class iterators whose zero-parameter `next()` returns a promise of a `{ value, done? }` record.
+  Abrupt completion runs cleanup, including literal `destroyOnReturn` and `preventCancel` options.
+  The `node:timers/promises` `setInterval(delay, value)` iterator compiles without AbortSignal options.
+  `Array.fromAsync` accepts arrays of values or of promises and typed async generators, with an optional mapping function; a `thisArg` and arrays that mix values and promises are unsupported.
diff --git a/docs/content/limitations/language-features/class-reflection.mdx b/docs/content/limitations/language-features/class-reflection.mdx
index f2b6dc2c8..f424b72b0 100644
--- a/docs/content/limitations/language-features/class-reflection.mdx
+++ b/docs/content/limitations/language-features/class-reflection.mdx
@@ -1 +1,4 @@
-- **Class reflection:** `JSON.stringify` and `Object.keys` require every declared field to have a representation that can pass through runtime-checked storage. `JSON.stringify` writes Date fields as their ISO text and Map and Set fields as `{}`, as Node.js does, and refuses classes with RegExp or Promise fields with `SC1090`. `Object.keys` raises an error for classes with opaque fields such as native Maps. Class fields, inherited accessors, and added properties retain identity through untyped values.
+- **Class reflection:** `JSON.stringify` and `Object.keys` require every declared field to have a representation that can pass through runtime-checked storage.
+  `JSON.stringify` writes Date fields as their ISO text and Map and Set fields as `{}`, as Node.js does, and refuses classes with RegExp or Promise fields with `SC1090`.
+  `Object.keys` raises an error for classes with opaque fields such as native Maps.
+  Class fields, inherited accessors, and added properties retain identity through untyped values.
diff --git a/docs/content/limitations/language-features/commonjs-require.mdx b/docs/content/limitations/language-features/commonjs-require.mdx
index 578499410..f0bf67c4e 100644
--- a/docs/content/limitations/language-features/commonjs-require.mdx
+++ b/docs/content/limitations/language-features/commonjs-require.mdx
@@ -1 +1,9 @@
-- **CommonJS `require`:** Literal `require()` calls of compiled modules, supported builtins, and JSON documents compile. Reading a top-level `const` or `let` require binding before its `require` runs throws the same `ReferenceError` as Node.js. A `var` binding that code above its `require` can reach is unsupported, and so is a read that compiles to no checkable expression, such as exporting the binding before the `require`. JSON documents are parsed at build time, and every `require()` of a document returns the same object. Destructuring the exports of a module supports plain and renamed properties, plus nested patterns for builtin sub-modules such as `util.types`. Any pattern works on a JSON document. Defaults, rest elements, and nested patterns over other modules are unsupported. A require cycle compiles when each of its modules assigns all of its exports before its first `require` and uses the other modules of the cycle only inside functions that its top-level code can't call. Other require cycles are rejected with `SC1016`.
+- **CommonJS `require`:** Literal `require()` calls of compiled modules, supported builtins, and JSON documents compile.
+  Reading a top-level `const` or `let` require binding before its `require` runs throws the same `ReferenceError` as Node.js.
+  A `var` binding that code above its `require` can reach is unsupported, and so is a read that compiles to no checkable expression, such as exporting the binding before the `require`.
+  JSON documents are parsed at build time, and every `require()` of a document returns the same object.
+  Destructuring the exports of a module supports plain and renamed properties, plus nested patterns for builtin sub-modules such as `util.types`.
+  Any pattern works on a JSON document.
+  Defaults, rest elements, and nested patterns over other modules are unsupported.
+  A require cycle compiles when each of its modules assigns all of its exports before its first `require` and uses the other modules of the cycle only inside functions that its top-level code can't call.
+  Other require cycles are rejected with `SC1016`.
diff --git a/docs/content/limitations/language-features/dynamic-imports.mdx b/docs/content/limitations/language-features/dynamic-imports.mdx
index 8b43cb7e7..84dad745c 100644
--- a/docs/content/limitations/language-features/dynamic-imports.mdx
+++ b/docs/content/limitations/language-features/dynamic-imports.mdx
@@ -1 +1,3 @@
-- **Dynamic imports:** Computed specifiers, import attributes, CommonJS namespace synthesis, and imports of shipped JavaScript packages are unsupported unless the target is a compiled ESM module. Literal `import()` of compiled ESM and TypeScript modules and of supported Node builtins compiles. Evaluation is lazy and microtask-delayed, top-level `await` is honored, repeated imports share namespace identity, exported mutable bindings stay live, and namespace keys use Node's sorted order.
+- **Dynamic imports:** Computed specifiers, import attributes, CommonJS namespace synthesis, and imports of shipped JavaScript packages are unsupported unless the target is a compiled ESM module.
+  Literal `import()` of compiled ESM and TypeScript modules and of supported Node builtins compiles.
+  Evaluation is lazy and microtask-delayed, top-level `await` is honored, repeated imports share namespace identity, exported mutable bindings stay live, and namespace keys use Node's sorted order.
diff --git a/docs/content/limitations/language-features/error-causes.mdx b/docs/content/limitations/language-features/error-causes.mdx
index c4691a3d2..63bf151b1 100644
--- a/docs/content/limitations/language-features/error-causes.mdx
+++ b/docs/content/limitations/language-features/error-causes.mdx
@@ -1 +1,6 @@
-- **Error causes:** Accessor constructor options are unsupported. Subclasses may redeclare `cause` as `unknown` or `object` (for example `cause?: unknown`), which defines the own property after `super()` returns as Node does; redeclarations with other types, parameter properties, and accessors named `cause` are unsupported. `Error`, `TypeError`, `RangeError`, and `SyntaxError` otherwise accept `{ cause }`, including through inherited constructors. Reads, writes, deletion, and `"cause" in error` distinguish an absent cause from an explicitly undefined cause. Constructor causes are non-enumerable; assignment to an absent cause creates an enumerable property. Property descriptors and checked-value aliases share the cause, including getters and setters installed after construction.
+- **Error causes:** Accessor constructor options are unsupported.
+  Subclasses may redeclare `cause` as `unknown` or `object` (for example `cause?: unknown`), which defines the own property after `super()` returns as Node does; redeclarations with other types, parameter properties, and accessors named `cause` are unsupported.
+  `Error`, `TypeError`, `RangeError`, and `SyntaxError` otherwise accept `{ cause }`, including through inherited constructors.
+  Reads, writes, deletion, and `"cause" in error` distinguish an absent cause from an explicitly undefined cause.
+  Constructor causes are non-enumerable; assignment to an absent cause creates an enumerable property.
+  Property descriptors and checked-value aliases share the cause, including getters and setters installed after construction.
diff --git a/docs/content/limitations/language-features/function-values.mdx b/docs/content/limitations/language-features/function-values.mdx
index 5819c74a4..88422c406 100644
--- a/docs/content/limitations/language-features/function-values.mdx
+++ b/docs/content/limitations/language-features/function-values.mdx
@@ -1 +1,4 @@
-- **Function values:** Immutable aliases of overloaded program functions retain per-call overload resolution and identity. A function stored in a slot with a different signature remains the same function for equality, array searches, `length`, and own properties. Typed rest-parameter functions can be stored and called indirectly. Builtin function values have API-specific restrictions; see [Builtin function values](#builtin-function-values).
+- **Function values:** Immutable aliases of overloaded program functions retain per-call overload resolution and identity.
+  A function stored in a slot with a different signature remains the same function for equality, array searches, `length`, and own properties.
+  Typed rest-parameter functions can be stored and called indirectly.
+  Builtin function values have API-specific restrictions; see [Builtin function values](#builtin-function-values).
diff --git a/docs/content/limitations/language-features/generics.mdx b/docs/content/limitations/language-features/generics.mdx
index 7668e0d47..6e203506f 100644
--- a/docs/content/limitations/language-features/generics.mdx
+++ b/docs/content/limitations/language-features/generics.mdx
@@ -1 +1,5 @@
-- **Generics:** Generic functions declared inside other functions, generic class expressions, and generic methods requiring dynamic dispatch are unsupported. Generic classes can extend generic bases when each specialization has a concrete layout. Independent concrete uses have no specialization-count limit; recursively expanding demands and type layouts produce diagnostics. Other generic calls compile when the target resolves statically. Generic function values require a concrete signature at use and a binding that is never reassigned.
+- **Generics:** Generic functions declared inside other functions, generic class expressions, and generic methods requiring dynamic dispatch are unsupported.
+  Generic classes can extend generic bases when each specialization has a concrete layout.
+  Independent concrete uses have no specialization-count limit; recursively expanding demands and type layouts produce diagnostics.
+  Other generic calls compile when the target resolves statically.
+  Generic function values require a concrete signature at use and a binding that is never reassigned.
diff --git a/docs/content/limitations/language-features/loose-equality.mdx b/docs/content/limitations/language-features/loose-equality.mdx
index 92dec596e..c5f48a323 100644
--- a/docs/content/limitations/language-features/loose-equality.mdx
+++ b/docs/content/limitations/language-features/loose-equality.mdx
@@ -1 +1,3 @@
-- **Loose equality:** Object-to-primitive `==` and `!=` comparisons are unsupported because `valueOf` and `toString` can execute user code. Convert the object explicitly before comparing. Comparisons between represented primitives and primitive unions support number, string, boolean, and BigInt coercions, including `x == null` and `x != null`.
+- **Loose equality:** Object-to-primitive `==` and `!=` comparisons are unsupported because `valueOf` and `toString` can execute user code.
+  Convert the object explicitly before comparing.
+  Comparisons between represented primitives and primitive unions support number, string, boolean, and BigInt coercions, including `x == null` and `x != null`.
diff --git a/docs/content/limitations/language-features/method-values.mdx b/docs/content/limitations/language-features/method-values.mdx
index 493a7ade5..37cb33fa1 100644
--- a/docs/content/limitations/language-features/method-values.mdx
+++ b/docs/content/limitations/language-features/method-values.mdx
@@ -1 +1,5 @@
-- **Method values:** Borrowing a class method onto an unrelated object is unsupported. Detached methods that use `this`, builtin method values, abstract declarations, unspecialized generic methods, and incompatible override signatures produce runtime errors or compilation diagnostics. Supported class methods can be stored and passed as unbound functions. A field call supplies its containing instance as `this`; `call`, `apply`, and `bind` work when the signature supports runtime-checked conversion. Extracted overrides retain the selected method, and receiver validation accepts the declaring class and its subclasses.
+- **Method values:** Borrowing a class method onto an unrelated object is unsupported.
+  Detached methods that use `this`, builtin method values, abstract declarations, unspecialized generic methods, and incompatible override signatures produce runtime errors or compilation diagnostics.
+  Supported class methods can be stored and passed as unbound functions.
+  A field call supplies its containing instance as `this`; `call`, `apply`, and `bind` work when the signature supports runtime-checked conversion.
+  Extracted overrides retain the selected method, and receiver validation accepts the declaring class and its subclasses.
diff --git a/docs/content/limitations/language-features/resource-disposal.mdx b/docs/content/limitations/language-features/resource-disposal.mdx
index d3df4138e..217073482 100644
--- a/docs/content/limitations/language-features/resource-disposal.mdx
+++ b/docs/content/limitations/language-features/resource-disposal.mdx
@@ -1 +1,7 @@
-- **Resource disposal:** Top-level and switch-clause `using` declarations, and `AsyncDisposableStack`, are unsupported. Block- and function-scoped `using` and `await using` support compiled classes with zero-parameter disposal methods, object literals and other `Disposable`- or `AsyncDisposable`-typed values, and supported FileHandle, timer, immediate, child-process, and readline handles. A class instance reached through a `Disposable`- or `unknown`-typed value throws an SC2020 error when its declaration runs; declare the variable with the class type. Array `for (using ... of ...)` loops also compile. `SuppressedError` values expose `error` and `suppressed`; `extends SuppressedError` and casting `unknown` to `SuppressedError` are unsupported (narrow with `instanceof`). `DisposableStack` supports `use`, `adopt`, `defer`, `move`, `dispose`, `disposed` and `[Symbol.dispose]`, and works with `using`; `use` accepts class instances, object literals and other `Disposable`-typed values, and refuses unions that include class instances (narrow the value first). Disposal runs in reverse order and raises Node's `SuppressedError` chain when more than one callback throws.
+- **Resource disposal:** Top-level and switch-clause `using` declarations, and `AsyncDisposableStack`, are unsupported.
+  Block- and function-scoped `using` and `await using` support compiled classes with zero-parameter disposal methods, object literals and other `Disposable`- or `AsyncDisposable`-typed values, and supported FileHandle, timer, immediate, child-process, and readline handles.
+  A class instance reached through a `Disposable`- or `unknown`-typed value throws an SC2020 error when its declaration runs; declare the variable with the class type.
+  Array `for (using ... of ...)` loops also compile.
+  `SuppressedError` values expose `error` and `suppressed`; `extends SuppressedError` and casting `unknown` to `SuppressedError` are unsupported (narrow with `instanceof`).
+  `DisposableStack` supports `use`, `adopt`, `defer`, `move`, `dispose`, `disposed` and `[Symbol.dispose]`, and works with `using`; `use` accepts class instances, object literals and other `Disposable`-typed values, and refuses unions that include class instances (narrow the value first).
+  Disposal runs in reverse order and raises Node's `SuppressedError` chain when more than one callback throws.
diff --git a/docs/content/limitations/native-addons.mdx b/docs/content/limitations/native-addons.mdx
index 40c7bd0bd..469d1cdd2 100644
--- a/docs/content/limitations/native-addons.mdx
+++ b/docs/content/limitations/native-addons.mdx
@@ -1,3 +1,6 @@
-Node-API (N-API) and V8 `.node` addons depend on Node.js itself, so compiled programs can't load them. Direct `createRequire` calls to local addons are rejected at compile time. A package that requires an addon needs a JavaScript implementation that compiles, or a replacement through native FFI.
+Node-API (N-API) and V8 `.node` addons depend on Node.js itself, so compiled programs can't load them.
+Direct `createRequire` calls to local addons are rejected at compile time.
+A package that requires an addon needs a JavaScript implementation that compiles, or a replacement through native FFI.
 
-Use [Native FFI](/docs/ffi#replacing-a-node-api-addon) to call a plain C ABI function linked from an object or static archive. The guide includes a replacement for a small Node-API helper.
+Use [Native FFI](/docs/ffi#replacing-a-node-api-addon) to call a plain C ABI function linked from an object or static archive.
+The guide includes a replacement for a small Node-API helper.
diff --git a/docs/content/limitations/native-debugging.mdx b/docs/content/limitations/native-debugging.mdx
index f4d4071cd..2b2298b5c 100644
--- a/docs/content/limitations/native-debugging.mdx
+++ b/docs/content/limitations/native-debugging.mdx
@@ -1,5 +1,11 @@
-Executable builds with `--optimization=dev` support source breakpoints and native stack frames for compiled TypeScript and JavaScript. LLVM builds include source names and lexical scopes for locals, parameters, captured bindings, and module globals. Release builds and builds with `--strip` omit these source mappings. On macOS, executable builds produce an adjacent `.dSYM` bundle using the Command Line Tools' `dsymutil`.
+Executable builds with `--optimization=dev` support source breakpoints and native stack frames for compiled TypeScript and JavaScript.
+LLVM builds include source names and lexical scopes for locals, parameters, captured bindings, and module globals.
+Release builds and builds with `--strip` omit these source mappings.
+On macOS, executable builds produce an adjacent `.dSYM` bundle using the Command Line Tools' `dsymutil`.
 
-Debugger values use native representations. Numbers and booleans display directly. Strings expose their `ScrStr` layout, including UTF-8 `data` and byte `len`; tagged unions expose their `tag` and `slot` fields. Other heap values and scalar bindings captured before initialization can appear as opaque pointers.
+Debugger values use native representations.
+Numbers and booleans display directly.
+Strings expose their `ScrStr` layout, including UTF-8 `data` and byte `len`; tagged unions expose their `tag` and `slot` fields.
+Other heap values and scalar bindings captured before initialization can appear as opaque pointers.
 
 Debuggers can't evaluate TypeScript expressions or format values as JavaScript objects.
diff --git a/docs/content/limitations/native-worker-threads.mdx b/docs/content/limitations/native-worker-threads.mdx
index 0510936d6..e45d12ad3 100644
--- a/docs/content/limitations/native-worker-threads.mdx
+++ b/docs/content/limitations/native-worker-threads.mdx
@@ -1,7 +1,47 @@
-`node:worker_threads` runs workers as native threads. Worker entry points must resolve at build time: use a source-relative `new URL("./worker.ts", import.meta.url)`, the current module URL, an absolute path, or CommonJS `__filename`. Each worker initializes its own module state, event loop, environment snapshot, and reference-counted heap. Nested workers inherit their parent's environment snapshot. Supported constructor options are `workerData`, `argv`, a `transferList` of MessagePorts, `name` (reported by `threadName` and `worker.threadName`), `stdout`, `stderr` and `stdin`, and `resourceLimits.stackSizeMb`, which sets the worker thread's stack size (at least 192 KiB; without it a worker's stack is 8 MiB, where Node's is 4 MiB). The `resourceLimits` heap limits (`maxOldGenerationSizeMb`, `maxYoungGenerationSizeMb`, and `codeRangeSizeMb`), `worker.resourceLimits` while the worker runs, and `resourceLimits` read inside a worker are refused; in the main thread `resourceLimits` is `{}`, and after a worker exits `worker.resourceLimits` is `{}`, as in Node. With the `stdout` or `stderr` option, the worker's writes to that stream reach `worker.stdout` or `worker.stderr`, a Readable that ends after the worker's `'exit'` event; its chunks arrive in order with the worker's other events. Without the option a worker writes to the process's own output, and reading `worker.stdout` or `worker.stderr` is refused. With the `stdin` option, `worker.stdin` is a Writable whose chunks the worker reads from `process.stdin`, in order with the worker's other events, and `process.stdin` ends when `worker.stdin` ends; without it `worker.stdin` is `null` and the worker's `process.stdin` ends without data, as in Node. Runtime paths, `eval`, loaders, and shared environments are unsupported. `setEnvironmentData` and `getEnvironmentData` keep a map per thread with SameValueZero keys; each new Worker starts from a clone of its parent's entries taken by the constructor, which throws `DataCloneError` when an entry cannot be cloned. Worker argument strings containing null bytes are also unsupported.
+`node:worker_threads` runs workers as native threads.
+Worker entry points must resolve at build time: use a source-relative `new URL("./worker.ts", import.meta.url)`, the current module URL, an absolute path, or CommonJS `__filename`.
+Each worker initializes its own module state, event loop, environment snapshot, and reference-counted heap.
+Nested workers inherit their parent's environment snapshot.
+Supported constructor options are `workerData`, `argv`, a `transferList` of MessagePorts, `name` (reported by `threadName` and `worker.threadName`), `stdout`, `stderr` and `stdin`, and `resourceLimits.stackSizeMb`, which sets the worker thread's stack size (at least 192 KiB; without it a worker's stack is 8 MiB, where Node's is 4 MiB).
+The `resourceLimits` heap limits (`maxOldGenerationSizeMb`, `maxYoungGenerationSizeMb`, and `codeRangeSizeMb`), `worker.resourceLimits` while the worker runs, and `resourceLimits` read inside a worker are refused; in the main thread `resourceLimits` is `{}`, and after a worker exits `worker.resourceLimits` is `{}`, as in Node.
+With the `stdout` or `stderr` option, the worker's writes to that stream reach `worker.stdout` or `worker.stderr`, a Readable that ends after the worker's `'exit'` event; its chunks arrive in order with the worker's other events.
+Without the option a worker writes to the process's own output, and reading `worker.stdout` or `worker.stderr` is refused.
+With the `stdin` option, `worker.stdin` is a Writable whose chunks the worker reads from `process.stdin`, in order with the worker's other events, and `process.stdin` ends when `worker.stdin` ends; without it `worker.stdin` is `null` and the worker's `process.stdin` ends without data, as in Node.
+Runtime paths, `eval`, loaders, and shared environments are unsupported.
+`setEnvironmentData` and `getEnvironmentData` keep a map per thread with SameValueZero keys; each new Worker starts from a clone of its parent's entries taken by the constructor, which throws `DataCloneError` when an entry cannot be cloned.
+Worker argument strings containing null bytes are also unsupported.
 
-Workers support `online`, `message`, `error`, and `exit` events, `postMessage`, `terminate`, `ref`, and `unref`. `worker[Symbol.asyncDispose]()` terminates the worker and resolves with `undefined` after its `exit` event, so `await using` disposes a Worker at the end of its block. A worker's uncaught exception reaches its `error` listeners as Node's error serializer sends it: an Error keeps the nearest of `Error` and its six native subclasses (an `AggregateError` arrives as an `Error` named `AggregateError`) along with its name, message, cause, and other data properties and their enumerability, and other thrown values clone as messages do. An unhandled rejection whose reason is not error-like arrives as an `UnhandledPromiseRejection` Error with code `ERR_UNHANDLED_REJECTION` quoting the reason. A thrown value that does not clone, such as a function, arrives as an `ERR_WORKER_UNSERIALIZABLE_ERROR` Error, where Node sends its `util.inspect` string. `new MessageChannel()` from `node:worker_threads` makes two entangled MessagePorts, in one thread or across threads once a port is transferred, with `receiveMessageOnPort`. Port messages arrive in Node's order: each port's queued messages as one batch before `setImmediate` callbacks, a port's own `'close'` after the poll phase, and the other port's `'close'` after its queued messages while the loop keeps running. `receiveMessageOnPort(parentPort)` in a worker takes the parent's next message. A port's `onmessage` property and `addEventListener` are unsupported. `BroadcastChannel` delivers each message to every other open channel with the same name, in any thread, as a `'message'` `MessageEvent` through `onmessage` and `addEventListener`; an open channel keeps the process alive until `close()` or `unref()`. A `messageerror` event is never dispatched. The parent port supports message listeners, `postMessage`, `close`, `start`, `ref`, `unref`, and `hasRef`. Messages clone primitives, plain object graphs, arrays, errors, ArrayBuffers, typed arrays, and DataViews, preserving cycles and aliases. Program class instances arrive as plain objects with their own data properties, without their prototype, methods, accessors, or private fields, as in Node. `markAsUntransferable` marks objects for the current thread, and a marked ArrayBuffer or MessagePort in a transfer list throws `DataCloneError`, as does the ArrayBuffer of a pooled Buffer; marked objects other than ArrayBuffers stay alive until their thread exits. `markAsUncloneable` marks a plain object, an error, or a class instance, and `structuredClone` and `postMessage` then throw `DataCloneError` for it, also where it is nested; as in Node, the mark has no effect on primitives, arrays, typed arrays, and ArrayBuffers. A plain object that the compiler copies into a container with a fixed element type, such as an array literal whose elements all have one shape, is a separate object in the copy, which is not marked. Marked objects stay alive until their thread exits. A MessagePort travels with a message when the message's transfer list (an array or `{ transfer }`) names it, and the sending port is unusable afterwards; a port in a message without that listing throws `DataCloneError`. Other transferable values, functions, proxies, and other native handles are refused. SharedArrayBuffers share their backing storage while retaining separate wrappers in each thread. Graphs made immutable with `@scriptc/threads` are passed by reference instead of cloned; see [Sharing Data Between Workers](/docs/threads).
+Workers support `online`, `message`, `error`, and `exit` events, `postMessage`, `terminate`, `ref`, and `unref`.
+`worker[Symbol.asyncDispose]()` terminates the worker and resolves with `undefined` after its `exit` event, so `await using` disposes a Worker at the end of its block.
+A worker's uncaught exception reaches its `error` listeners as Node's error serializer sends it: an Error keeps the nearest of `Error` and its six native subclasses (an `AggregateError` arrives as an `Error` named `AggregateError`) along with its name, message, cause, and other data properties and their enumerability, and other thrown values clone as messages do.
+An unhandled rejection whose reason is not error-like arrives as an `UnhandledPromiseRejection` Error with code `ERR_UNHANDLED_REJECTION` quoting the reason.
+A thrown value that does not clone, such as a function, arrives as an `ERR_WORKER_UNSERIALIZABLE_ERROR` Error, where Node sends its `util.inspect` string.
+`new MessageChannel()` from `node:worker_threads` makes two entangled MessagePorts, in one thread or across threads once a port is transferred, with `receiveMessageOnPort`.
+Port messages arrive in Node's order: each port's queued messages as one batch before `setImmediate` callbacks, a port's own `'close'` after the poll phase, and the other port's `'close'` after its queued messages while the loop keeps running.
+`receiveMessageOnPort(parentPort)` in a worker takes the parent's next message.
+A port's `onmessage` property and `addEventListener` are unsupported.
+`BroadcastChannel` delivers each message to every other open channel with the same name, in any thread, as a `'message'` `MessageEvent` through `onmessage` and `addEventListener`; an open channel keeps the process alive until `close()` or `unref()`.
+A `messageerror` event is never dispatched.
+The parent port supports message listeners, `postMessage`, `close`, `start`, `ref`, `unref`, and `hasRef`.
+Messages clone primitives, plain object graphs, arrays, errors, ArrayBuffers, typed arrays, and DataViews, preserving cycles and aliases.
+Program class instances arrive as plain objects with their own data properties, without their prototype, methods, accessors, or private fields, as in Node.
+`markAsUntransferable` marks objects for the current thread, and a marked ArrayBuffer or MessagePort in a transfer list throws `DataCloneError`, as does the ArrayBuffer of a pooled Buffer; marked objects other than ArrayBuffers stay alive until their thread exits.
+`markAsUncloneable` marks a plain object, an error, or a class instance, and `structuredClone` and `postMessage` then throw `DataCloneError` for it, also where it is nested; as in Node, the mark has no effect on primitives, arrays, typed arrays, and ArrayBuffers.
+A plain object that the compiler copies into a container with a fixed element type, such as an array literal whose elements all have one shape, is a separate object in the copy, which is not marked.
+Marked objects stay alive until their thread exits.
+A MessagePort travels with a message when the message's transfer list (an array or `{ transfer }`) names it, and the sending port is unusable afterwards; a port in a message without that listing throws `DataCloneError`.
+Other transferable values, functions, proxies, and other native handles are refused.
+SharedArrayBuffers share their backing storage while retaining separate wrappers in each thread.
+Graphs made immutable with `@scriptc/threads` are passed by reference instead of cloned; see [Sharing Data Between Workers](/docs/threads).
 
-SharedArrayBuffer storage is fixed-length. Atomics supports integer `load`, `store`, `exchange`, `compareExchange`, `add`, `sub`, `and`, `or`, and `xor` over 8-, 16-, and 32-bit integer arrays. `wait` and `notify` use Int32Array views; BigInt atomics, `waitAsync`, and growable buffers are unsupported. Atomics operations run as sequentially consistent atomic instructions and take no lock. Other reads and writes of shared storage access each element atomically; a copy, fill, or conversion that runs while another thread writes the same storage can observe some of those writes, as in Node. `terminate` unwinds at runtime checkpoints, including loops and parked atomic waits, without running JavaScript catch or finally blocks. Blocking native calls finish before the next checkpoint.
+SharedArrayBuffer storage is fixed-length.
+Atomics supports integer `load`, `store`, `exchange`, `compareExchange`, `add`, `sub`, `and`, `or`, and `xor` over 8-, 16-, and 32-bit integer arrays.
+`wait` and `notify` use Int32Array views; BigInt atomics, `waitAsync`, and growable buffers are unsupported.
+Atomics operations run as sequentially consistent atomic instructions and take no lock.
+Other reads and writes of shared storage access each element atomically; a copy, fill, or conversion that runs while another thread writes the same storage can observe some of those writes, as in Node.
+`terminate` unwinds at runtime checkpoints, including loops and parked atomic waits, without running JavaScript catch or finally blocks.
+Blocking native calls finish before the next checkpoint.
 
-Workers are unsupported in WASI, compiled libraries, and executables that use foreign-thread native callbacks. Ordinary callbacks that run on their owning script thread remain supported. Shared byte storage cannot expose unmanaged FFI pointers; copy it into an ordinary Buffer before passing it to native code.
+Workers are unsupported in WASI, compiled libraries, and executables that use foreign-thread native callbacks.
+Ordinary callbacks that run on their owning script thread remain supported.
+Shared byte storage cannot expose unmanaged FFI pointers; copy it into an ordinary Buffer before passing it to native code.
diff --git a/docs/content/limitations/process-arguments-and-errors.mdx b/docs/content/limitations/process-arguments-and-errors.mdx
index 69d7d9dc1..9cdcdb3b8 100644
--- a/docs/content/limitations/process-arguments-and-errors.mdx
+++ b/docs/content/limitations/process-arguments-and-errors.mdx
@@ -1,5 +1,11 @@
-`process.argv[0]` is `"scriptc"`, `process.argv[1]` is the binary's path, and program arguments begin at index 2. In programs that use `node:test`, a leading `--test-update-snapshots` argument is Node's snapshot update flag: it is kept out of `process.argv` and appears in `process.execArgv`, which is otherwise `[]`. `process.version` and `process.versions.node` report the Node.js release the runtime is verified against.
+`process.argv[0]` is `"scriptc"`, `process.argv[1]` is the binary's path, and program arguments begin at index 2.
+In programs that use `node:test`, a leading `--test-update-snapshots` argument is Node's snapshot update flag: it is kept out of `process.argv` and appears in `process.execArgv`, which is otherwise `[]`.
+`process.version` and `process.versions.node` report the Node.js release the runtime is verified against.
 
-Uncaught exceptions print `Uncaught <value>` to stderr instead of Node.js's source excerpt and stack-trace block; thrown strings and numbers print their value. Exit codes and output written before the exception are preserved. Runtime errors expose `message` and Node's `code` as typed members. The other own properties Node gives them, such as a system error's `errno`, `syscall`, and `path`, a child process error's `status`, `stdout`, and `stderr`, or an assertion error's `actual` and `expected`, are readable through an untyped view of the error (for example a cast of a caught value) and appear in `util.inspect` output.
+Uncaught exceptions print `Uncaught <value>` to stderr instead of Node.js's source excerpt and stack-trace block; thrown strings and numbers print their value.
+Exit codes and output written before the exception are preserved.
+Runtime errors expose `message` and Node's `code` as typed members.
+The other own properties Node gives them, such as a system error's `errno`, `syscall`, and `path`, a child process error's `status`, `stdout`, and `stderr`, or an assertion error's `actual` and `expected`, are readable through an untyped view of the error (for example a cast of a caught value) and appear in `util.inspect` output.
 
-Errors carry no stack frames. `console.log` and `util.inspect` print an Error in Node's stackless form, `[TypeError: message]`, where Node prints `TypeError: message` followed by stack frames; the two agree when `Error.stackTraceLimit` is `0`.
+Errors carry no stack frames.
+`console.log` and `util.inspect` print an Error in Node's stackless form, `[TypeError: message]`, where Node prints `TypeError: message` followed by stack frames; the two agree when `Error.stackTraceLimit` is `0`.
diff --git a/docs/content/limitations/process-events.mdx b/docs/content/limitations/process-events.mdx
index 9791005e1..df2f62ce8 100644
--- a/docs/content/limitations/process-events.mdx
+++ b/docs/content/limitations/process-events.mdx
@@ -1,3 +1,9 @@
-Static signal listeners resolve names on the target platform, including `SIGWINCH` on POSIX. `on`, `once`, `off`, and `removeListener` accept computed signal names and deliver the signal name and number. Computed names for other event families and chained registrations are unsupported. Windows registration is limited to CRT signals; WASI has no OS signals.
+Static signal listeners resolve names on the target platform, including `SIGWINCH` on POSIX.
+`on`, `once`, `off`, and `removeListener` accept computed signal names and deliver the signal name and number.
+Computed names for other event families and chained registrations are unsupported.
+Windows registration is limited to CRT signals; WASI has no OS signals.
 
-Literal `uncaughtException` and `uncaughtExceptionMonitor` registrations compile. Handled exceptions resume queued native work; monitors alone do not suppress failure. Error objects and primitive exceptions can reach listeners, while arbitrary native objects remain subject to exception-value restrictions. Exception capture callbacks are unsupported.
+Literal `uncaughtException` and `uncaughtExceptionMonitor` registrations compile.
+Handled exceptions resume queued native work; monitors alone do not suppress failure.
+Error objects and primitive exceptions can reach listeners, while arbitrary native objects remain subject to exception-value restrictions.
+Exception capture callbacks are unsupported.
diff --git a/docs/content/limitations/published-graphs.mdx b/docs/content/limitations/published-graphs.mdx
index b6fb998d6..82b4a04ba 100644
--- a/docs/content/limitations/published-graphs.mdx
+++ b/docs/content/limitations/published-graphs.mdx
@@ -1,5 +1,9 @@
-Graphs published with [`@scriptc/threads`](/docs/threads) are immortal: scriptc never frees them, even after every thread has stopped using them. Publish long-lived data, not per-request messages.
+Graphs published with [`@scriptc/threads`](/docs/threads) are immortal: scriptc never frees them, even after every thread has stopped using them.
+Publish long-lived data, not per-request messages.
 
-A receiving thread reads the sender's objects, so they keep their classes, methods, and identity across threads and across messages. Node.js delivers clones without prototypes, a new clone for every message.
+A receiving thread reads the sender's objects, so they keep their classes, methods, and identity across threads and across messages.
+Node.js delivers clones without prototypes, a new clone for every message.
 
-Writes into published objects throw Node's frozen-object `TypeError`s. In Node.js, `o.x = f()` evaluates `f()` before the write fails, and scriptc does the same, except for writes to union-typed class fields and for `Map`, `Set`, and array mutator methods, where the write check runs before the arguments are evaluated. Private fields (`#x`) of published objects cannot be written either, although Node.js allows writing private fields of frozen objects.
+Writes into published objects throw Node's frozen-object `TypeError`s.
+In Node.js, `o.x = f()` evaluates `f()` before the write fails, and scriptc does the same, except for writes to union-typed class fields and for `Map`, `Set`, and array mutator methods, where the write check runs before the arguments are evaluated.
+Private fields (`#x`) of published objects cannot be written either, although Node.js allows writing private fields of frozen objects.
diff --git a/docs/content/limitations/record-identity-and-property-order.mdx b/docs/content/limitations/record-identity-and-property-order.mdx
index 76ff0ae74..0381803f6 100644
--- a/docs/content/limitations/record-identity-and-property-order.mdx
+++ b/docs/content/limitations/record-identity-and-property-order.mdx
@@ -1,9 +1,24 @@
-A record converted to a record type with a different set of properties, such as a narrower shape or one that adds optional properties, is copied. Mutations through the converted reference do not affect the original, and the copy is not `===` to it. Empty record layouts are also snapshots because they have no property storage. `scriptc coverage` and `scriptc build` report `SC6001` where a copied value is then written or compared, whether the record was passed as an argument, stored in a typed binding, asserted with `as`, assigned to a typed binding later, or stored as an element of a typed array literal.
+A record converted to a record type with a different set of properties, such as a narrower shape or one that adds optional properties, is copied.
+Mutations through the converted reference do not affect the original, and the copy is not `===` to it.
+Empty record layouts are also snapshots because they have no property storage.
+`scriptc coverage` and `scriptc build` report `SC6001` where a copied value is then written or compared, whether the record was passed as an argument, stored in a typed binding, asserted with `as`, assigned to a typed binding later, or stored as an element of a typed array literal.
 
-Typed records with declared fields, indexed records, and arrays retain identity and mutations through native checked storage. Class instances retain identity at their exact type or a base class, and at any interface or object type that a class instance is passed, stored, returned, or asserted as when the program could tell a copy from the instance: values of such a type are checked views of the original object, so writes, identity comparisons, Set and Map keys, `util.inspect`, and `JSON.stringify` through them reach the instance, as in Node.js. These types use checked dynamic storage, which is slower than native record fields, for all of their values, including plain objects. A type whose values are only read field by field, from fields the class does not write after construction and does not implement as accessors, stays a native record and holds a copy. Object spread of a class instance is refused. Dense array literals created directly in checked storage preserve identity, and supported native handles pass by reference.
+Typed records with declared fields, indexed records, and arrays retain identity and mutations through native checked storage.
+Class instances retain identity at their exact type or a base class, and at any interface or object type that a class instance is passed, stored, returned, or asserted as when the program could tell a copy from the instance: values of such a type are checked views of the original object, so writes, identity comparisons, Set and Map keys, `util.inspect`, and `JSON.stringify` through them reach the instance, as in Node.js.
+These types use checked dynamic storage, which is slower than native record fields, for all of their values, including plain objects.
+A type whose values are only read field by field, from fields the class does not write after construction and does not implement as accessors, stays a native record and holds a copy.
+Object spread of a class instance is refused.
+Dense array literals created directly in checked storage preserve identity, and supported native handles pass by reference.
 
-`Object.keys`, `Object.values`, `Object.entries`, and `JSON.stringify` use a record's declaration order rather than per-object insertion order. Their order matches Node.js when objects are built in declaration order. `SC6002` reports object literals whose order differs where the program observes it.
+`Object.keys`, `Object.values`, `Object.entries`, `for...in`, `JSON.stringify`, and `util.inspect` enumerate a record's keys in one order per record type rather than per object. scriptc chooses that order from the order in which the program's object literals create the keys, follows object spread, rest destructuring, and record conversions back to the values they copy, and places an optional key that the program assigns after construction after the keys the object was built with.
+The order matches Node.js when every value of the type is created in the same order.
+When values of one record type are created in different orders, including values of two types with the same properties and property types, or when a key is deleted and assigned again, the type keeps the declaration order of its first type instead, and `SC6002` reports object literals whose order differs where the program observes it.
 
-A record converted from a checked value, such as `const rows: { score: number }[] = JSON.parse(text)`, keeps the properties its type does not declare. `JSON.stringify`, `Object.keys`, `Object.values`, `Object.entries`, `util.inspect`, and untyped views of the record see them, together with the declared fields, in the source object's key order. `Object.values` and `Object.entries` check those values against their static result type and throw a `TypeError` if one does not fit. Copies of such a record made by object spread, `Object.assign`, rest destructuring, or conversion to another record type contain only the declared fields. Index-signature records list declared fields before the other keys.
+A record converted from a checked value, such as `const rows: { score: number }[] = JSON.parse(text)`, keeps the properties its type does not declare.
+`JSON.stringify`, `Object.keys`, `Object.values`, `Object.entries`, `util.inspect`, and untyped views of the record see them, together with the declared fields, in the source object's key order.
+`Object.values` and `Object.entries` check those values against their static result type and throw a `TypeError` if one does not fit.
+Copies of such a record made by object spread, `Object.assign`, rest destructuring, or conversion to another record type contain only the declared fields.
+Index-signature records list declared fields before the other keys.
 
-Optional fields and properties added through a record's `unknown` view can be deleted. A required field has no absent state, so deleting it through the view throws `TypeError: Cannot delete property 'x' of #<Object>` and leaves the record unchanged, where Node.js removes the property.
+Optional fields and properties added through a record's `unknown` view can be deleted.
+A required field has no absent state, so deleting it through the view throws `TypeError: Cannot delete property 'x' of #<Object>` and leaves the record unchanged, where Node.js removes the property.
diff --git a/docs/content/limitations/runtime-code-evaluation.mdx b/docs/content/limitations/runtime-code-evaluation.mdx
index a00e0727d..c85e4dcd4 100644
--- a/docs/content/limitations/runtime-code-evaluation.mdx
+++ b/docs/content/limitations/runtime-code-evaluation.mdx
@@ -1 +1,4 @@
-`eval`, `new Function`, and other ways of running JavaScript source at runtime are unsupported, in application code and in packages. Rewrite code that depends on them, or replace the package. To compute a value from code at build time instead, use `comptime`. See [npm Dependencies](/docs/dependencies#which-packages-compile) for which packages compile.
+`eval`, `new Function`, and other ways of running JavaScript source at runtime are unsupported, in application code and in packages.
+Rewrite code that depends on them, or replace the package.
+To compute a value from code at build time instead, use `comptime`.
+See [npm Dependencies](/docs/dependencies#which-packages-compile) for which packages compile.
diff --git a/docs/content/limitations/runtime-differences-from-node-js.mdx b/docs/content/limitations/runtime-differences-from-node-js.mdx
index 0ff0675ec..90698c117 100644
--- a/docs/content/limitations/runtime-differences-from-node-js.mdx
+++ b/docs/content/limitations/runtime-differences-from-node-js.mdx
@@ -1 +1,2 @@
-Compiled code has runtime behavior that can differ from Node.js. Account for the following differences when porting a program.
+Compiled code has runtime behavior that can differ from Node.js.
+Account for the following differences when porting a program.
diff --git a/docs/content/limitations/runtime-type-checks.mdx b/docs/content/limitations/runtime-type-checks.mdx
index ee7b953ce..f6ead482b 100644
--- a/docs/content/limitations/runtime-type-checks.mdx
+++ b/docs/content/limitations/runtime-type-checks.mdx
@@ -1,7 +1,13 @@
-Casts from values whose type is only known at runtime validate the value. For example, `JSON.parse(s) as Config` throws a catchable error if the data does not match `Config`, identifying the offending path, such as `expected number at $.port, got string`. A TypeScript assertion alone does not perform this validation when run under Node.js.
+Casts from values whose type is only known at runtime validate the value.
+For example, `JSON.parse(s) as Config` throws a catchable error if the data does not match `Config`, identifying the offending path, such as `expected number at $.port, got string`.
+A TypeScript assertion alone does not perform this validation when run under Node.js.
 
-Casts between program classes are checked too: casting an instance to a class it does not extend throws a `TypeError`, where Node.js reads the members structurally. `SC6004` reports calls that pass such an instance to a function that casts it.
+Casts between program classes are checked too: casting an instance to a class it does not extend throws a `TypeError`, where Node.js reads the members structurally.
+`SC6004` reports calls that pass such an instance to a function that casts it.
 
-A Promise converted from `unknown` to a typed result validates its fulfilled value. A mismatch rejects with a `TypeError`. Rejection reasons and reference equality are preserved across conversions.
+A Promise converted from `unknown` to a typed result validates its fulfilled value.
+A mismatch rejects with a `TypeError`.
+Rejection reasons and reference equality are preserved across conversions.
 
-A non-null assertion (`value!`) checks the value when it extracts an object, array or other non-nullable member from a union. If the value holds `null` or `undefined`, the assertion throws a `TypeError`, even when the result is never used; Node.js continues until a property of the value is read.
+A non-null assertion (`value!`) checks the value when it extracts an object, array or other non-nullable member from a union.
+If the value holds `null` or `undefined`, the assertion throws a `TypeError`, even when the result is never used; Node.js continues until a property of the value is read.
diff --git a/docs/content/limitations/socket-data-encoding.mdx b/docs/content/limitations/socket-data-encoding.mdx
index 8094f8143..4384dd97f 100644
--- a/docs/content/limitations/socket-data-encoding.mdx
+++ b/docs/content/limitations/socket-data-encoding.mdx
@@ -1 +1,3 @@
-After `socket.setEncoding("utf8")`, an inline `'data'` listener receives strings, as in Node, whatever type its chunk parameter declares. A listener passed by reference, such as a named function whose parameter is typed `Buffer`, keeps its `Buffer` parameter, so a string chunk throws `TypeError: expected Uint8Array at $[0], got string`. Declare that parameter as `string` or `string | Buffer`, or pass an inline function.
+After `socket.setEncoding("utf8")`, an inline `'data'` listener receives strings, as in Node, whatever type its chunk parameter declares.
+A listener passed by reference, such as a named function whose parameter is typed `Buffer`, keeps its `Buffer` parameter, so a string chunk throws `TypeError: expected Uint8Array at $[0], got string`.
+Declare that parameter as `string` or `string | Buffer`, or pass an inline function.
diff --git a/docs/content/limitations/strings-and-sorting.mdx b/docs/content/limitations/strings-and-sorting.mdx
index eacca198e..499a3f950 100644
--- a/docs/content/limitations/strings-and-sorting.mdx
+++ b/docs/content/limitations/strings-and-sorting.mdx
@@ -1,7 +1,17 @@
-Strings are stored as UTF-8, with lone surrogates kept as their own code units. Length and string methods use UTF-16 semantics, including for lone surrogates, but relational comparisons such as `<` and `>` use code-point order. `split` with a string separator and `replace` or `replaceAll` with a string pattern don't match a lone surrogate against half of a surrogate pair; regular-expression patterns do. Output, file contents, and other encoded text write each lone surrogate as U+FFFD, as Node does. File system paths and network host names that contain a lone surrogate reach the operating system unconverted.
+Strings are stored as UTF-8, with lone surrogates kept as their own code units.
+Length, string methods and relational comparisons such as `<` and `>` use UTF-16 semantics, including for lone surrogates.
+`split` with a string separator and `replace` or `replaceAll` with a string pattern don't match a lone surrogate against half of a surrogate pair; regular-expression patterns do.
+Output, file contents, and other encoded text write each lone surrogate as U+FFFD, as Node does.
+File system paths and network host names that contain a lone surrogate reach the operating system unconverted.
 
-One-argument `localeCompare` follows Node's default root-locale collation for Latin-script text (ASCII, Latin-1 Supplement, Latin Extended-A, combining diacritical marks, and U+2044 FRACTION SLASH): letters order before case and accents, so `"a".localeCompare("B")` is `-1`. Strings containing other characters compare by code point, which can differ from Node's ICU collation; `SC6003` reports such string literals. The locales and options arguments are unsupported.
+One-argument `localeCompare` follows Node's default root-locale collation for Latin-script text (ASCII, Latin-1 Supplement, Latin Extended-A, combining diacritical marks, and U+2044 FRACTION SLASH): letters order before case and accents, so `"a".localeCompare("B")` is `-1`.
+Strings containing other characters compare by code point, which can differ from Node's ICU collation; `SC6003` reports such string literals.
+The locales and options arguments are unsupported.
 
-`sort` and `toSorted` use stable natural merge sort. Default ordering supports string, number, and boolean arrays, comparing their string forms in UTF-16 order; for example, `[2, 10, 1].sort()` produces `[1, 10, 2]`. `sort` preserves holes at the end, while `toSorted` produces a fresh array with holes filled by `undefined`. With an explicit comparator, consistent comparators produce the same sorted results as Node, but callback order and count can differ.
+`sort` and `toSorted` use stable natural merge sort.
+Default ordering supports string, number, and boolean arrays, comparing their string forms in UTF-16 order; for example, `[2, 10, 1].sort()` produces `[1, 10, 2]`.
+`sort` preserves holes at the end, while `toSorted` produces a fresh array with holes filled by `undefined`.
+With an explicit comparator, consistent comparators produce the same sorted results as Node, but callback order and count can differ.
 
-Typed-array `sort` and `toSorted` order numbers by default, with `-0` before `0` and `NaN` last. With a comparator, they call it in the same order as Node and write the sorted values back after the last call.
+Typed-array `sort` and `toSorted` order numbers by default, with `-0` before `0` and `NaN` last.
+With a comparator, they call it in the same order as Node and write the sorted values back after the last call.
diff --git a/docs/content/limitations/three-js.mdx b/docs/content/limitations/three-js.mdx
index 5f44dc40c..90bdcd934 100644
--- a/docs/content/limitations/three-js.mdx
+++ b/docs/content/limitations/three-js.mdx
@@ -1,7 +1,13 @@
-With `--npm-static=three`, native and WASI builds support published package imports and tested CPU workflows for math, bounds, procedural geometry, curves, shapes, extrusion, text geometry, scene graphs, cameras, lights, materials, textures, and render-target data. Mesh workflows include instancing, batching, morph targets, skeletal deformation, LOD, and sprites. Raycasting includes mesh intersections, sorted results, recursive traversal, layers, distance limits, camera rays, lines, and points.
+With `--npm-static=three`, native and WASI builds support published package imports and tested CPU workflows for math, bounds, procedural geometry, curves, shapes, extrusion, text geometry, scene graphs, cameras, lights, materials, textures, and render-target data.
+Mesh workflows include instancing, batching, morph targets, skeletal deformation, LOD, and sprites.
+Raycasting includes mesh intersections, sorted results, recursive traversal, layers, distance limits, camera rays, lines, and points.
 
-Animation coverage includes tracks, clips, property binding, mixer playback, blending, and fading. In-memory loading covers scene, material, geometry, and animation JSON, OBJ, STL, PLY, and self-contained glTF/GLB scenes with buffers, PBR material data, and animation. This establishes the exercised workflows, not every loader extension or overload.
+Animation coverage includes tracks, clips, property binding, mixer playback, blending, and fading.
+In-memory loading covers scene, material, geometry, and animation JSON, OBJ, STL, PLY, and self-contained glTF/GLB scenes with buffers, PBR material data, and animation.
+This establishes the exercised workflows, not every loader extension or overload.
 
 Tested CPU graph construction from `three/webgpu` and `three/tsl` includes scalar/vector nodes, mutable uniforms, `Fn` layouts and calls, and `MeshBasicNodeMaterial` data.
 
-WebGL/WebGPU rendering, DOM controls, image and video resources, audio, and worker-based decoders require external host bindings. A browser or native application can render geometry and material state produced by a compiled library and receive its resource lifecycle notifications. Compressed model and texture decoding belongs to that host; shader execution and rendered output are outside the CPU coverage described here.
+WebGL/WebGPU rendering, DOM controls, image and video resources, audio, and worker-based decoders require external host bindings.
+A browser or native application can render geometry and material state produced by a compiled library and receive its resource lifecycle notifications.
+Compressed model and texture decoding belongs to that host; shader execution and rendered output are outside the CPU coverage described here.
diff --git a/docs/content/limitations/tls-ciphers.mdx b/docs/content/limitations/tls-ciphers.mdx
index 2c1092f58..a6e372308 100644
--- a/docs/content/limitations/tls-ciphers.mdx
+++ b/docs/content/limitations/tls-ciphers.mdx
@@ -1 +1,4 @@
-Before the handshake Node's `tlsSocket.getCipher()` returns `undefined`, and after close `null`. Its declared result is the `{ name, standardName, version }` record, so a typed read there throws a TypeError instead. After the handshake the record matches Node, with OpenSSL's suite name in `name`. The suite itself is the one the bundled mbedTLS negotiates, which can differ from OpenSSL's choice for the same peers.
+Before the handshake Node's `tlsSocket.getCipher()` returns `undefined`, and after close `null`.
+Its declared result is the `{ name, standardName, version }` record, so a typed read there throws a TypeError instead.
+After the handshake the record matches Node, with OpenSSL's suite name in `name`.
+The suite itself is the one the bundled mbedTLS negotiates, which can differ from OpenSSL's choice for the same peers.
diff --git a/docs/content/limitations/tooling-and-native-ffi.mdx b/docs/content/limitations/tooling-and-native-ffi.mdx
index 993bf6c76..e9c329734 100644
--- a/docs/content/limitations/tooling-and-native-ffi.mdx
+++ b/docs/content/limitations/tooling-and-native-ffi.mdx
@@ -1,5 +1,10 @@
-`scriptc run` does not forward extra CLI arguments to the program. Build an executable and invoke it directly to pass arguments.
+`scriptc run` does not forward extra CLI arguments to the program.
+Build an executable and invoke it directly to pass arguments.
 
-Native FFI links C functions declared in a manifest. Formats 2–5 support call-scoped callbacks, copied string/byte callback parameters, explicitly released retained callbacks, and asynchronous foreign-thread delivery. Format 6 adds single-precision floats, signed 8-bit and signed/unsigned 16-bit integers, and borrowed writable byte spans. Variadic calls, structs by value, owned pointer/string/byte returns, runtime dynamic-library loading, and library-mode builds are unsupported. See [Native FFI](/docs/ffi).
+Native FFI links C functions declared in a manifest.
+Formats 2–5 support call-scoped callbacks, copied string/byte callback parameters, explicitly released retained callbacks, and asynchronous foreign-thread delivery.
+Format 6 adds single-precision floats, signed 8-bit and signed/unsigned 16-bit integers, and borrowed writable byte spans.
+Variadic calls, structs by value, owned pointer/string/byte returns, runtime dynamic-library loading, and library-mode builds are unsupported.
+See [Native FFI](/docs/ffi).
 
 Numbers follow JavaScript's double-precision semantics.
diff --git a/docs/content/limitations/type-checking.mdx b/docs/content/limitations/type-checking.mdx
index 5af0361c6..e3dc54aef 100644
--- a/docs/content/limitations/type-checking.mdx
+++ b/docs/content/limitations/type-checking.mdx
@@ -1,3 +1,6 @@
-scriptc checks programs against the `es2025` standard library, the ESNext declarations for `Array.fromAsync`, explicit resource management and `Error.isError`, and its own ambient declarations. Some declarations differ from TypeScript's standard library or `@types/node`: `JSON.parse` returns `unknown`, and a Promise executor's reject reason is typed as `Error`.
+scriptc checks programs against the `es2025` standard library, the ESNext declarations for `Array.fromAsync`, explicit resource management and `Error.isError`, and its own ambient declarations.
+Some declarations differ from TypeScript's standard library or `@types/node`: `JSON.parse` returns `unknown`, and a Promise executor's reject reason is typed as `Error`.
 
-A program that passes its project's TypeScript check may still use unsupported operations. A second preflight using the project's declarations distinguishes those sites from ordinary type errors and reports scriptc diagnostics with rewrite hints. Declared APIs without a compiler implementation, such as unsupported console members, produce `SC2020`.
+A program that passes its project's TypeScript check may still use unsupported operations.
+A second preflight using the project's declarations distinguishes those sites from ordinary type errors and reports scriptc diagnostics with rewrite hints.
+Declared APIs without a compiler implementation, such as unsupported console members, produce `SC2020`.
diff --git a/docs/content/limitations/types-and-class-definitions.mdx b/docs/content/limitations/types-and-class-definitions.mdx
index d5b4ce873..4cbe518ad 100644
--- a/docs/content/limitations/types-and-class-definitions.mdx
+++ b/docs/content/limitations/types-and-class-definitions.mdx
@@ -1,4 +1,6 @@
-`Promise.all([work(1), work(2)])` infers a tuple. Some tuple operations, such as `.join()`, are unsupported. If you need array operations on the result, declare the input as an array:
+`Promise.all([work(1), work(2)])` infers a tuple.
+Some tuple operations, such as `.join()`, are unsupported.
+If you need array operations on the result, declare the input as an array:
 
 ```ts
 const jobs: Promise<number>[] = [work(1), work(2), work(3)];
diff --git a/docs/content/limitations/types-and-class-definitions/bigint.mdx b/docs/content/limitations/types-and-class-definitions/bigint.mdx
index e6dfc2caa..99954a8a4 100644
--- a/docs/content/limitations/types-and-class-definitions/bigint.mdx
+++ b/docs/content/limitations/types-and-class-definitions/bigint.mdx
@@ -1 +1,4 @@
-- **BigInt:** `BigInt64Array`, `BigUint64Array`, BigInt filesystem stats are unsupported. Arbitrary-precision BigInts otherwise support literals, operators, conversions, arrays, records, classes, closures, unions, promises, typed Map keys and Set elements, Buffer 64-bit reads/writes, and DataView 64-bit access. Native `unknown` and JavaScript `any` storage preserve BigInts, including checked Map keys and Set elements. JSON serialization throws a `TypeError` unless a replacer converts the value.
+- **BigInt:** `BigInt64Array`, `BigUint64Array`, BigInt filesystem stats are unsupported.
+  Arbitrary-precision BigInts otherwise support literals, operators, conversions, arrays, records, classes, closures, unions, promises, typed Map keys and Set elements, Buffer 64-bit reads/writes, and DataView 64-bit access.
+  Native `unknown` and JavaScript `any` storage preserve BigInts, including checked Map keys and Set elements.
+  JSON serialization throws a `TypeError` unless a replacer converts the value.
diff --git a/docs/content/limitations/types-and-class-definitions/constructor-function-inheritance.mdx b/docs/content/limitations/types-and-class-definitions/constructor-function-inheritance.mdx
index cf4a7a198..5c7eda3dc 100644
--- a/docs/content/limitations/types-and-class-definitions/constructor-function-inheritance.mdx
+++ b/docs/content/limitations/types-and-class-definitions/constructor-function-inheritance.mdx
@@ -1 +1,3 @@
-- **Constructor-function inheritance:** Module-level JavaScript classes can extend compiled ordinary constructor functions. Constructors that return replacement objects, spread `super` arguments, and reflective static inheritance are unsupported. Supported `super` calls preserve receiver and field initialization order and capture the base prototype at class evaluation.
+- **Constructor-function inheritance:** Module-level JavaScript classes can extend compiled ordinary constructor functions.
+  Constructors that return replacement objects, spread `super` arguments, and reflective static inheritance are unsupported.
+  Supported `super` calls preserve receiver and field initialization order and capture the base prototype at class evaluation.
diff --git a/docs/content/limitations/types-and-class-definitions/interfaces.mdx b/docs/content/limitations/types-and-class-definitions/interfaces.mdx
index fca0de146..fe966c67d 100644
--- a/docs/content/limitations/types-and-class-definitions/interfaces.mdx
+++ b/docs/content/limitations/types-and-class-definitions/interfaces.mdx
@@ -1 +1,7 @@
-- **Interfaces:** Interfaces explicitly implemented by compiled classes retain live object identity through checked native values. Method-signature interfaces and callable-property interfaces structurally implemented by class methods use the same representation. A call to a method signature of such an interface calls the class's method directly when the receiver is an instance of a compiled class, and a read of a property signature reads the class's field directly; object literals, accessors, and methods the program replaces on an instance or prototype use dynamic property lookup. Arrays of such interface values are native arrays whose elements keep their identity; methods without a native form for them run on the array's dynamic view, which shares its elements. Other data interfaces retain native record layouts and their copy-coercion rules. Generic methods require a statically resolved body; a `const` interface binding initialized directly with `new` can keep the concrete class for specialization. Unsupported member representations produce diagnostics.
+- **Interfaces:** Interfaces explicitly implemented by compiled classes retain live object identity through checked native values.
+  Method-signature interfaces and callable-property interfaces structurally implemented by class methods use the same representation.
+  A call to a method signature of such an interface calls the class's method directly when the receiver is an instance of a compiled class, and a read of a property signature reads the class's field directly; object literals, accessors, and methods the program replaces on an instance or prototype use dynamic property lookup.
+  Arrays of such interface values are native arrays whose elements keep their identity; methods without a native form for them run on the array's dynamic view, which shares its elements.
+  Other data interfaces retain native record layouts and their copy-coercion rules.
+  Generic methods require a statically resolved body; a `const` interface binding initialized directly with `new` can keep the concrete class for specialization.
+  Unsupported member representations produce diagnostics.
diff --git a/docs/content/limitations/types-and-class-definitions/local-class-expressions.mdx b/docs/content/limitations/types-and-class-definitions/local-class-expressions.mdx
index d18ecac60..8b653b25e 100644
--- a/docs/content/limitations/types-and-class-definitions/local-class-expressions.mdx
+++ b/docs/content/limitations/types-and-class-definitions/local-class-expressions.mdx
@@ -1 +1,5 @@
-- **Local class expressions:** Static members, decorators, private brands, generic members, and references through the class's internal name are unsupported. Supported expressions preserve fresh constructor identity and shared captures across constructors, methods, accessors, and arrow fields. Local inheritance requires a compiled base class. Constructors retain identity, `typeof`, `name`, and `length` through `unknown`; cast back to their exact type before construction. Construction and static-member access directly through `unknown` are unsupported.
+- **Local class expressions:** Static members, decorators, private brands, generic members, and references through the class's internal name are unsupported.
+  Supported expressions preserve fresh constructor identity and shared captures across constructors, methods, accessors, and arrow fields.
+  Local inheritance requires a compiled base class.
+  Constructors retain identity, `typeof`, `name`, and `length` through `unknown`; cast back to their exact type before construction.
+  Construction and static-member access directly through `unknown` are unsupported.
diff --git a/docs/content/limitations/types-and-class-definitions/null-and-optional-values.mdx b/docs/content/limitations/types-and-class-definitions/null-and-optional-values.mdx
index afb8ec9cf..e8b351679 100644
--- a/docs/content/limitations/types-and-class-definitions/null-and-optional-values.mdx
+++ b/docs/content/limitations/types-and-class-definitions/null-and-optional-values.mdx
@@ -1 +1,3 @@
-- **Null and optional values:** `undefined` and `null` compile as standalone values and union members. Optional record and class fields and optional, default, and rest parameters also compile, including rest parameters typed `unknown[]` or `any[]`, whose functions take any number of arguments. A function value with fixed parameters cannot be stored where such a variadic function type is expected.
+- **Null and optional values:** `undefined` and `null` compile as standalone values and union members.
+  Optional record and class fields and optional, default, and rest parameters also compile, including rest parameters typed `unknown[]` or `any[]`, whose functions take any number of arguments.
+  A function value with fixed parameters cannot be stored where such a variadic function type is expected.
diff --git a/docs/content/limitations/types-and-class-definitions/record-shapes.mdx b/docs/content/limitations/types-and-class-definitions/record-shapes.mdx
index 1adc978f9..14e7351b1 100644
--- a/docs/content/limitations/types-and-class-definitions/record-shapes.mdx
+++ b/docs/content/limitations/types-and-class-definitions/record-shapes.mdx
@@ -1 +1,3 @@
-- **Record shapes:** Records use exact native layouts. Passing `{ a, b }` where `{ a }` is expected can produce `SC2002`. Accepted flows into a strict field-subset shape copy the record; see [Record identity and property order](#record-identity-and-property-order).
+- **Record shapes:** Records use exact native layouts.
+  Passing `{ a, b }` where `{ a }` is expected can produce `SC2002`.
+  Accepted flows into a strict field-subset shape copy the record; see [Record identity and property order](#record-identity-and-property-order).
diff --git a/docs/content/limitations/types-and-class-definitions/static-field-updates.mdx b/docs/content/limitations/types-and-class-definitions/static-field-updates.mdx
index 0b7378e8e..ff89f98f7 100644
--- a/docs/content/limitations/types-and-class-definitions/static-field-updates.mdx
+++ b/docs/content/limitations/types-and-class-definitions/static-field-updates.mdx
@@ -1 +1,2 @@
-- **Static field updates:** Numeric static fields support `++` and `--` through the declaring class or an immutable alias. Updates through a subclass name are unsupported because JavaScript creates a separate property on the subclass.
+- **Static field updates:** Numeric static fields support `++` and `--` through the declaring class or an immutable alias.
+  Updates through a subclass name are unsupported because JavaScript creates a separate property on the subclass.
diff --git a/docs/content/limitations/types-and-class-definitions/symbol-fields.mdx b/docs/content/limitations/types-and-class-definitions/symbol-fields.mdx
index 7fe06a9ba..baff4d190 100644
--- a/docs/content/limitations/types-and-class-definitions/symbol-fields.mdx
+++ b/docs/content/limitations/types-and-class-definitions/symbol-fields.mdx
@@ -1 +1,6 @@
-- **Symbol fields:** Instance fields require a stable module-level `Symbol()` or `Symbol.for()` binding with a literal description or constant string binding. Reassigned keys, runtime-computed descriptions, distinct symbols with the same description in one class, and copying symbol fields with rest bindings or `Object.assign` are unsupported. JavaScript object spreads copy represented own symbol fields. Equal registry keys share a field across modules. Uninitialized JavaScript fields start as `undefined`; TypeScript fields require an initializer or unconditional constructor assignment. Represented symbol fields and methods, including inherited members, remain accessible through checked values.
+- **Symbol fields:** Instance fields require a stable module-level `Symbol()` or `Symbol.for()` binding with a literal description or constant string binding.
+  Reassigned keys, runtime-computed descriptions, distinct symbols with the same description in one class, and copying symbol fields with rest bindings or `Object.assign` are unsupported.
+  JavaScript object spreads copy represented own symbol fields.
+  Equal registry keys share a field across modules.
+  Uninitialized JavaScript fields start as `undefined`; TypeScript fields require an initializer or unconditional constructor assignment.
+  Represented symbol fields and methods, including inherited members, remain accessible through checked values.
diff --git a/docs/content/limitations/types-and-class-definitions/unions.mdx b/docs/content/limitations/types-and-class-definitions/unions.mdx
index 403c9be2e..cc6b06627 100644
--- a/docs/content/limitations/types-and-class-definitions/unions.mdx
+++ b/docs/content/limitations/types-and-class-definitions/unions.mdx
@@ -1 +1,6 @@
-- **Unions:** Narrow a union before an operation whose members require incompatible native representations, such as reading `u.length` on `string | string[]`. Some union-to-union widening and unions combining function and data members are unsupported. Same-representation methods on class unions, `map` and `forEach` on array unions, and shared or joinable field reads compile. `console.log(u)` supports printing a whole union. A union may hold one promise beside other members, such as `T | Promise<T>` or `Promise<R | void> | R | void`: `await`, an async function's `return`, `Promise.resolve`, and `instanceof Promise` act on the member it holds, with Node's microtask timing. A promise member beside a member that declares `then`, two promise members in one union, and `console.log` of a union holding a promise are unsupported.
+- **Unions:** Narrow a union before an operation whose members require incompatible native representations, such as reading `u.length` on `string | string[]`.
+  Some union-to-union widening and unions combining function and data members are unsupported.
+  Same-representation methods on class unions, `map` and `forEach` on array unions, and shared or joinable field reads compile.
+  `console.log(u)` supports printing a whole union.
+  A union may hold one promise beside other members, such as `T | Promise<T>` or `Promise<R | void> | R | void`: `await`, an async function's `return`, `Promise.resolve`, and `instanceof Promise` act on the member it holds, with Node's microtask timing.
+  A promise member beside a member that declares `then`, two promise members in one union, and `console.log` of a union holding a promise are unsupported.
diff --git a/docs/content/limitations/udp-socket-options.mdx b/docs/content/limitations/udp-socket-options.mdx
index e93e6d4c1..1b5a368a8 100644
--- a/docs/content/limitations/udp-socket-options.mdx
+++ b/docs/content/limitations/udp-socket-options.mdx
@@ -1 +1,2 @@
-`socket.addMembership()` and `socket.dropMembership()` on a `dgram` socket that is not bound yet throw `SC2020`; Node binds such a socket to an ephemeral port first, so bind the socket before joining a group. The `SystemError` that the buffer size methods throw (`ERR_SOCKET_BUFFER_SIZE`, for example from `getRecvBufferSize()` before `bind()`) has Node's `message`, `code`, `errno` and `syscall`, but no `info` object.
+`socket.addMembership()` and `socket.dropMembership()` on a `dgram` socket that is not bound yet throw `SC2020`; Node binds such a socket to an ephemeral port first, so bind the socket before joining a group.
+The `SystemError` that the buffer size methods throw (`ERR_SOCKET_BUFFER_SIZE`, for example from `getRecvBufferSize()` before `bind()`) has Node's `message`, `code`, `errno` and `syscall`, but no `info` object.
diff --git a/docs/content/limitations/untyped-values.mdx b/docs/content/limitations/untyped-values.mdx
index c0811a51e..6a881aec3 100644
--- a/docs/content/limitations/untyped-values.mdx
+++ b/docs/content/limitations/untyped-values.mdx
@@ -1,7 +1,17 @@
-Supported uses of `any` use native checked values. Operations without native lowering produce diagnostics such as `SC2011`. Use `unknown` with a checked cast where an operation needs a concrete type. Map and Set type arguments may use `any`, with the same checked storage as `unknown`.
+Supported uses of `any` use native checked values.
+Operations without native lowering produce diagnostics such as `SC2011`.
+Use `unknown` with a checked cast where an operation needs a concrete type.
+Map and Set type arguments may use `any`, with the same checked storage as `unknown`.
 
-Locals, parameters, and returns can carry untyped values; record and tuple fields can hold `unknown`. JavaScript instance fields and TypeScript class fields declared `unknown` or `object` (also with `null` or `undefined`, or as arrays of those) can also hold native checked values. Bare fields start as `undefined`, and redeclaring a field with the same checked-value type resets it in initialization order. Explicit TypeScript `any` class fields, other checked-value static fields, statically typed array elements, and union members are unsupported.
+Locals, parameters, and returns can carry untyped values; record and tuple fields can hold `unknown`.
+JavaScript instance fields and TypeScript class fields declared `unknown` or `object` (also with `null` or `undefined`, or as arrays of those) can also hold native checked values.
+Bare fields start as `undefined`, and redeclaring a field with the same checked-value type resets it in initialization order.
+Explicit TypeScript `any` class fields, other checked-value static fields, statically typed array elements, and union members are unsupported.
 
-Program class instances retain identity through `unknown` and casts back to their exact class or a base class, including classes with internal collections. Inspecting dynamic properties throws a catchable `TypeError` if the class's fields cannot pass through checked storage. Supported native handles also retain identity. JavaScript argument and return conversions preserve native array references; other JSON-shaped record and array conversions can copy values.
+Program class instances retain identity through `unknown` and casts back to their exact class or a base class, including classes with internal collections.
+Inspecting dynamic properties throws a catchable `TypeError` if the class's fields cannot pass through checked storage.
+Supported native handles also retain identity.
+JavaScript argument and return conversions preserve native array references; other JSON-shaped record and array conversions can copy values.
 
-Supported operations on `unknown` include truthiness, `typeof` narrowing, property access, `+`, `switch`, and `throw`. Cast before using other operations.
+Supported operations on `unknown` include truthiness, `typeof` narrowing, property access, `+`, `switch`, and `throw`.
+Cast before using other operations.
diff --git a/docs/content/limitations/wasi-target.mdx b/docs/content/limitations/wasi-target.mdx
index 72a7e8927..bdd0962ba 100644
--- a/docs/content/limitations/wasi-target.mdx
+++ b/docs/content/limitations/wasi-target.mdx
@@ -1,5 +1,11 @@
 The `wasm32-wasi` executable target supports async/await, promises, generators, timers, portable event-loop work, stdin/readline, filesystem callbacks and promises.
 
-WASI Preview 1 does not provide sockets, process spawning, OS signals, network interfaces, or filesystem notifications. Networking/fetch, child processes, signal APIs, `os.networkInterfaces()`, the `os` host facts without a WASI equivalent (`cpus()`, `hostname()`, `freemem()`, `loadavg()`, `uptime()`, `getPriority()`), and `fs.watch` are rejected before linking with `SC3002`. `--sanitize` and native FFI are unavailable.
+WASI Preview 1 does not provide sockets, process spawning, OS signals, network interfaces, or filesystem notifications.
+Networking/fetch, child processes, signal APIs, `os.networkInterfaces()`, the `os` host facts without a WASI equivalent (`cpus()`, `hostname()`, `freemem()`, `loadavg()`, `uptime()`, `getPriority()`), and `fs.watch` are rejected before linking with `SC3002`.
+`--sanitize` and native FFI are unavailable.
 
-Library mode emits an async-free Wasm reactor with named host imports. Native runtime localization and thread instances are unsupported. Each Wasm instance owns independent state. Filesystem access is limited to directories opened by the host; `scriptc run` exposes the current working directory and `/tmp`. See [Platform Support](/docs/platforms) for build and run details.
+Library mode emits an async-free Wasm reactor with named host imports.
+Native runtime localization and thread instances are unsupported.
+Each Wasm instance owns independent state.
+Filesystem access is limited to directories opened by the host; `scriptc run` exposes the current working directory and `/tmp`.
+See [Platform Support](/docs/platforms) for build and run details.
diff --git a/docs/content/limitations/weak-collections-and-memory.mdx b/docs/content/limitations/weak-collections-and-memory.mdx
index d8558e63a..97ee20d7b 100644
--- a/docs/content/limitations/weak-collections-and-memory.mdx
+++ b/docs/content/limitations/weak-collections-and-memory.mdx
@@ -1,3 +1,9 @@
-`WeakMap` and `WeakSet` accept checked native objects and arrays, functions, numeric typed arrays, ArrayBuffers, native weak collections, and typed records, arrays, tuples, and classes that preserve identity through checked storage. Copied values, other native handles, and symbol keys are unsupported. Constructor seeds support arrays; custom iterators and detached methods are unsupported. Weak collections do not retain their keys, but values that refer back to a key can keep it alive until deletion or collection release.
+`WeakMap` and `WeakSet` accept checked native objects and arrays, functions, numeric typed arrays, ArrayBuffers, native weak collections, and typed records, arrays, tuples, and classes that preserve identity through checked storage.
+Copied values, other native handles, and symbol keys are unsupported.
+Constructor seeds support arrays; custom iterators and detached methods are unsupported.
+Weak collections do not retain their keys, but values that refer back to a key can keep it alive until deletion or collection release.
 
-Memory uses reference counting. Acyclic values are freed deterministically, and cycles are collected at defined collection points. Native checked objects, arrays, Sets, and captured closures participate in cycle collection. Cycles through opaque native capsules can remain allocated.
+Memory uses reference counting.
+Acyclic values are freed deterministically, and cycles are collected at defined collection points.
+Native checked objects, arrays, Sets, and captured closures participate in cycle collection.
+Cycles through opaque native capsules can remain allocated.
diff --git a/docs/content/limitations/webassembly-modules.mdx b/docs/content/limitations/webassembly-modules.mdx
index 492b2fc1a..e3bf6e500 100644
--- a/docs/content/limitations/webassembly-modules.mdx
+++ b/docs/content/limitations/webassembly-modules.mdx
@@ -1,3 +1,7 @@
-Compiled programs can't load WebAssembly modules yet. Code that only mentions the `WebAssembly` types type-checks, including packages whose declarations name them, and `typeof WebAssembly` answers as it does in Node.js. Every use of the API itself is rejected: `WebAssembly.compile`, `instantiate` and `validate`, `new WebAssembly.Module` and the other constructors, `instanceof` checks, and reads of `globalThis.WebAssembly`. TypeScript sources fail to build with SC2020 at each use, and JavaScript sources throw that diagnostic when the statement runs.
+Compiled programs can't load WebAssembly modules yet.
+Code that only mentions the `WebAssembly` types type-checks, including packages whose declarations name them, and `typeof WebAssembly` answers as it does in Node.js.
+Every use of the API itself is rejected: `WebAssembly.compile`, `instantiate` and `validate`, `new WebAssembly.Module` and the other constructors, `instanceof` checks, and reads of `globalThis.WebAssembly`.
+TypeScript sources fail to build with SC2020 at each use, and JavaScript sources throw that diagnostic when the statement runs.
 
-`scriptc coverage` lists the modules a program would load, with their size, whether they validate, and the WebAssembly proposals they use. It finds modules at paths the compiler resolves, modules inlined as base64 literals, `.wasm` files shipped by packages that use WebAssembly, and files named with [`--wasm`](/docs/cli) or a `scriptc.wasm` array in `package.json`.
+`scriptc coverage` lists the modules a program would load, with their size, whether they validate, and the WebAssembly proposals they use.
+It finds modules at paths the compiler resolves, modules inlined as base64 literals, `.wasm` files shipped by packages that use WebAssembly, and files named with [`--wasm`](/docs/cli) or a `scriptc.wasm` array in `package.json`.
diff --git a/docs/scripts/limitations-partials.mjs b/docs/scripts/limitations-partials.mjs
index 34b8418d4..662930c13 100644
--- a/docs/scripts/limitations-partials.mjs
+++ b/docs/scripts/limitations-partials.mjs
@@ -6,7 +6,9 @@
  *   introduction.mdx                  prose before the first heading
  *   <section>.mdx                     a section's prose (paragraphs, code
  *                                     blocks, unlabeled lists)
- *   <section>/<label>.mdx             one labeled bullet (`- **Label:** ...`)
+ *   <section>/<label>.mdx             one labeled bullet (`- **Label:** ...`),
+ *                                     one sentence per line, continuation
+ *                                     lines indented two spaces
  *
  * <section> is the slug of the nearest heading and <label> the slug of the
  * bullet's bold label. The page includes each partial with
@@ -31,6 +33,7 @@ const defaultPage = join(docsRoot, "content/docs/limitations.mdx");
 const partialsDir = join(docsRoot, "content/limitations");
 const includeLine = /^<include>(\.\.\/limitations\/[\w/-]+\.mdx)<\/include>$/;
 const labeledBullet = /^- \*\*([^*]+?):\*\*/;
+const bulletContinuation = /^ {2}\S/;
 
 export function slug(text) {
   return text
@@ -51,7 +54,7 @@ export function joinPage(page = defaultPage) {
   let text = out.join("\n");
   for (let prev; prev !== text; ) {
     prev = text;
-    text = text.replace(/^(- \*\*[^\n]*)\n\n(?=- \*\*)/gm, "$1\n");
+    text = text.replace(/^(- \*\*[^\n]*(?:\n {2}\S[^\n]*)*)\n\n(?=- \*\*)/gm, "$1\n");
   }
   return text.replace(/\n*$/, "\n");
 }
@@ -81,15 +84,25 @@ export function splitPage(text) {
     page.push("", `<include>../limitations/${name}</include>`);
   };
   let inFence = false;
-  let afterBullet = false;
+  let bulletName = null;
+  let bulletLines = [];
+  const flushBullet = () => {
+    if (bulletName !== null) add(bulletName, bulletLines.join("\n"));
+    bulletName = null;
+    bulletLines = [];
+  };
   for (const line of lines.slice(fmEnd + 1)) {
-    if (afterBullet && line !== "" && !labeledBullet.test(line) && !/^#{2,6} /.test(line))
-      throw new Error(`a labeled bullet is followed by a line that is not a blank line, bullet or heading: ${line.slice(0, 60)}`);
+    if (bulletName !== null && bulletContinuation.test(line)) {
+      bulletLines.push(line);
+      continue;
+    }
+    if (bulletName !== null && line !== "" && !labeledBullet.test(line) && !/^#{2,6} /.test(line))
+      throw new Error(`a labeled bullet is followed by a line that is not a blank line, bullet, heading or indented continuation: ${line.slice(0, 60)}`);
+    flushBullet();
     if (/^(```|~~~)/.test(line)) inFence = !inFence;
     const heading = !inFence && line.match(/^#{2,6} (.*)$/);
     const anchor = !inFence && /^<span id="[\w-]+" \/>$/.test(line);
     const bullet = !inFence && line.match(labeledBullet);
-    afterBullet = Boolean(bullet);
     if (heading || anchor) {
       flushProse();
       page.push("", line);
@@ -99,11 +112,13 @@ export function splitPage(text) {
       }
     } else if (bullet) {
       flushProse();
-      add(`${section}/${slug(bullet[1])}.mdx`, line);
+      bulletName = `${section}/${slug(bullet[1])}.mdx`;
+      bulletLines = [line];
     } else {
       prose.push(line);
     }
   }
+  flushBullet();
   flushProse();
   // Collapse the blank-line runs the pushes above produce.
   const pageText = page.join("\n").replace(/\n{3,}/g, "\n\n") + "\n";
diff --git a/docs/src/generated/node-v24-compatibility-meta.json b/docs/src/generated/node-v24-compatibility-meta.json
new file mode 100644
index 000000000..167256bca
--- /dev/null
+++ b/docs/src/generated/node-v24-compatibility-meta.json
@@ -0,0 +1,7 @@
+{
+  "schemaVersion": 3,
+  "nodeVersion": "24.22.0",
+  "nodeCommit": "f14cd3aa7bf9ca8df2cc5b8bb14beb0f335b1d93",
+  "artifactVersion": "ee72820d45a79aa154f0",
+  "rowCount": 3880
+}
diff --git a/docs/src/generated/node-v24-compatibility.json b/docs/src/generated/node-v24-compatibility.json
index e2e4cdd19..be1a931cc 100644
--- a/docs/src/generated/node-v24-compatibility.json
+++ b/docs/src/generated/node-v24-compatibility.json
@@ -208,10 +208,10 @@
       "entries": 152,
       "apiEntries": 152,
       "static": {
-        "supported": 5,
+        "supported": 6,
         "partial": 39,
         "refused": 21,
-        "not-implemented": 87,
+        "not-implemented": 86,
         "by-design": 0,
         "unreviewed": 0,
         "not-applicable": 0
@@ -314,9 +314,9 @@
       "apiEntries": 280,
       "static": {
         "supported": 7,
-        "partial": 198,
+        "partial": 200,
         "refused": 0,
-        "not-implemented": 75,
+        "not-implemented": 73,
         "by-design": 0,
         "unreviewed": 0,
         "not-applicable": 0
@@ -328,10 +328,10 @@
       "entries": 92,
       "apiEntries": 92,
       "static": {
-        "supported": 0,
-        "partial": 12,
+        "supported": 1,
+        "partial": 15,
         "refused": 1,
-        "not-implemented": 79,
+        "not-implemented": 75,
         "by-design": 0,
         "unreviewed": 0,
         "not-applicable": 0
@@ -853,10 +853,10 @@
       "entries": 156,
       "apiEntries": 156,
       "static": {
-        "supported": 1,
-        "partial": 10,
+        "supported": 2,
+        "partial": 21,
         "refused": 0,
-        "not-implemented": 145,
+        "not-implemented": 133,
         "by-design": 0,
         "unreviewed": 0,
         "not-applicable": 0
@@ -12325,9 +12325,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "supported",
+        "detail": "Implemented by a dedicated static compiler/runtime path.",
+        "verification": "test-backed"
       }
     },
     {
@@ -30288,9 +30288,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the call shapes accepted by the compiler lowering.",
+        "verification": "test-backed"
       }
     },
     {
@@ -35256,9 +35256,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the call shapes accepted by the compiler lowering.",
+        "verification": "test-backed"
       }
     },
     {
@@ -35693,9 +35693,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -36360,9 +36360,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -37165,9 +37165,9 @@
         "inherited": false
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -37303,9 +37303,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "supported",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -80183,9 +80183,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "supported",
+        "detail": "Implemented by a dedicated static compiler/runtime path.",
+        "verification": "test-backed"
       }
     },
     {
@@ -80229,9 +80229,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -80252,9 +80252,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -80275,9 +80275,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -80298,9 +80298,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -80321,9 +80321,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -80344,9 +80344,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -80436,9 +80436,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -80574,9 +80574,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -80735,9 +80735,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -80758,9 +80758,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
@@ -80804,9 +80804,9 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "detail": "No static compiler lowering is registered for this API yet.",
-        "verification": "registry-gap"
+        "status": "partial",
+        "detail": "Implemented for the documented scriptc module-loader subset.",
+        "verification": "test-backed"
       }
     },
     {
diff --git a/internal/compatibility/generated/node-v24-backlog.json b/internal/compatibility/generated/node-v24-backlog.json
index b62a17cd9..817b723e3 100644
--- a/internal/compatibility/generated/node-v24-backlog.json
+++ b/internal/compatibility/generated/node-v24-backlog.json
@@ -3,21 +3,21 @@
   "nodeVersion": "24.22.0",
   "nodeCommit": "f14cd3aa7bf9ca8df2cc5b8bb14beb0f335b1d93",
   "summary": {
-    "taskCount": 3456,
-    "tierItemCount": 3456,
+    "taskCount": 3453,
+    "tierItemCount": 3453,
     "tiers": {
       "static": {
-        "audit-partial": 1163,
-        "verify-gap": 2165,
+        "audit-partial": 1179,
+        "verify-gap": 2146,
         "replace-refusal": 41,
         "classify": 2,
         "implement": 85
       }
     },
     "priorities": {
-      "high": 2289,
+      "high": 2287,
       "normal": 694,
-      "low": 473
+      "low": 472
     }
   },
   "tasks": [
@@ -7359,31 +7359,6 @@
         }
       }
     },
-    {
-      "id": "crypto:2ab8394e29a7",
-      "chapter": "crypto",
-      "label": "crypto.getRandomValues(typedArray)",
-      "signature": "`crypto.getRandomValues(typedArray)`",
-      "apiSymbol": "crypto.getRandomValues",
-      "docsUrl": "https://nodejs.org/docs/v24.22.0/api/crypto.html#cryptogetrandomvaluestypedarray",
-      "nodeStability": {
-        "index": "2",
-        "level": 2,
-        "text": "Stable",
-        "inherited": true
-      },
-      "priority": "high",
-      "tiers": {
-        "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:crypto",
-          "tests": []
-        }
-      }
-    },
     {
       "id": "crypto:21f22c71fb61",
       "chapter": "crypto",
@@ -27067,12 +27042,15 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:fs",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "surface-manifest:node-builtin.fs.constants",
+          "tests": [
+            "tests/corpus/6207-fs-constants-object.ts",
+            "tests/corpus/6208-fs-constants-require.cjs"
+          ]
         }
       }
     },
@@ -32764,12 +32742,15 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:fs",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "surface-manifest:node-builtin.fs.constants",
+          "tests": [
+            "tests/corpus/6207-fs-constants-object.ts",
+            "tests/corpus/6208-fs-constants-require.cjs"
+          ]
         }
       }
     },
@@ -33220,12 +33201,18 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:globals",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:globals.CryptoKey",
+          "tests": [
+            "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+            "tests/corpus/6292-webcrypto-hmac-errors.ts",
+            "tests/corpus/6293-webcrypto-digest.ts",
+            "tests/corpus/6294-webcrypto-js-values.mjs",
+            "tests/corpus/6295-jose-hs256/main.mjs"
+          ]
         }
       }
     },
@@ -33951,12 +33938,18 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:globals",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:globals.SubtleCrypto",
+          "tests": [
+            "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+            "tests/corpus/6292-webcrypto-hmac-errors.ts",
+            "tests/corpus/6293-webcrypto-digest.ts",
+            "tests/corpus/6294-webcrypto-js-values.mjs",
+            "tests/corpus/6295-jose-hs256/main.mjs"
+          ]
         }
       }
     },
@@ -34872,12 +34865,16 @@
       "priority": "low",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:globals",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:globals.navigator",
+          "tests": [
+            "tests/fixtures/node-types/navigator.ts",
+            "tests/harness/project-config.test.ts",
+            "tests/corpus/6331-jose-root-entry/main.ts"
+          ]
         }
       }
     },
@@ -35006,31 +35003,6 @@
         }
       }
     },
-    {
-      "id": "globals:fc0a32e8c26f",
-      "chapter": "globals",
-      "label": "userAgent",
-      "signature": "`userAgent` Type: {string}",
-      "apiSymbol": "userAgent",
-      "docsUrl": "https://nodejs.org/docs/v24.22.0/api/globals.html#navigator",
-      "nodeStability": {
-        "index": "1.1",
-        "level": 1,
-        "text": "Active development. Disable this API with the [`--no-experimental-global-navigator`][] CLI flag.",
-        "inherited": true
-      },
-      "priority": "low",
-      "tiers": {
-        "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:globals",
-          "tests": []
-        }
-      }
-    },
     {
       "id": "globals:b412bf9a456d",
       "chapter": "globals",
@@ -81065,31 +81037,6 @@
         }
       }
     },
-    {
-      "id": "webcrypto:dcc24f369f43",
-      "chapter": "webcrypto",
-      "label": "crypto.getRandomValues(typedArray)",
-      "signature": "`crypto.getRandomValues(typedArray)`",
-      "apiSymbol": "crypto.getRandomValues",
-      "docsUrl": "https://nodejs.org/docs/v24.22.0/api/webcrypto.html#cryptogetrandomvaluestypedarray",
-      "nodeStability": {
-        "index": "2",
-        "level": 2,
-        "text": "Stable",
-        "inherited": true
-      },
-      "priority": "high",
-      "tiers": {
-        "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:webcrypto",
-          "tests": []
-        }
-      }
-    },
     {
       "id": "webcrypto:8c570ec75666",
       "chapter": "webcrypto",
@@ -81106,12 +81053,18 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:webcrypto",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:webcrypto.subtle",
+          "tests": [
+            "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+            "tests/corpus/6292-webcrypto-hmac-errors.ts",
+            "tests/corpus/6293-webcrypto-digest.ts",
+            "tests/corpus/6294-webcrypto-js-values.mjs",
+            "tests/corpus/6295-jose-hs256/main.mjs"
+          ]
         }
       }
     },
@@ -81131,12 +81084,16 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:webcrypto",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:webcrypto.CryptoKey",
+          "tests": [
+            "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+            "tests/corpus/6294-webcrypto-js-values.mjs",
+            "tests/corpus/6295-jose-hs256/main.mjs"
+          ]
         }
       }
     },
@@ -81156,12 +81113,16 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:webcrypto",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:webcrypto.cryptoKey.algorithm",
+          "tests": [
+            "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+            "tests/corpus/6294-webcrypto-js-values.mjs",
+            "tests/corpus/6295-jose-hs256/main.mjs"
+          ]
         }
       }
     },
@@ -81181,12 +81142,16 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:webcrypto",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:webcrypto.extractable",
+          "tests": [
+            "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+            "tests/corpus/6294-webcrypto-js-values.mjs",
+            "tests/corpus/6295-jose-hs256/main.mjs"
+          ]
         }
       }
     },
@@ -81206,12 +81171,16 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:webcrypto",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:webcrypto.type",
+          "tests": [
+            "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+            "tests/corpus/6294-webcrypto-js-values.mjs",
+            "tests/corpus/6295-jose-hs256/main.mjs"
+          ]
         }
       }
     },
@@ -81231,12 +81200,16 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:webcrypto",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:webcrypto.usages",
+          "tests": [
+            "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+            "tests/corpus/6294-webcrypto-js-values.mjs",
+            "tests/corpus/6295-jose-hs256/main.mjs"
+          ]
         }
       }
     },
@@ -81331,12 +81304,18 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:webcrypto",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:webcrypto.SubtleCrypto",
+          "tests": [
+            "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+            "tests/corpus/6292-webcrypto-hmac-errors.ts",
+            "tests/corpus/6293-webcrypto-digest.ts",
+            "tests/corpus/6294-webcrypto-js-values.mjs",
+            "tests/corpus/6295-jose-hs256/main.mjs"
+          ]
         }
       }
     },
@@ -81481,12 +81460,19 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:webcrypto",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:webcrypto.subtle.digest",
+          "tests": [
+            "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+            "tests/corpus/6292-webcrypto-hmac-errors.ts",
+            "tests/corpus/6293-webcrypto-digest.ts",
+            "tests/corpus/6294-webcrypto-js-values.mjs",
+            "tests/corpus/6295-jose-hs256/main.mjs",
+            "tests/fixtures/node-types/webcrypto-hmac.ts"
+          ]
         }
       }
     },
@@ -81656,12 +81642,19 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:webcrypto",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:webcrypto.subtle.importKey",
+          "tests": [
+            "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+            "tests/corpus/6292-webcrypto-hmac-errors.ts",
+            "tests/corpus/6293-webcrypto-digest.ts",
+            "tests/corpus/6294-webcrypto-js-values.mjs",
+            "tests/corpus/6295-jose-hs256/main.mjs",
+            "tests/fixtures/node-types/webcrypto-hmac.ts"
+          ]
         }
       }
     },
@@ -81681,12 +81674,19 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:webcrypto",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:webcrypto.subtle.sign",
+          "tests": [
+            "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+            "tests/corpus/6292-webcrypto-hmac-errors.ts",
+            "tests/corpus/6293-webcrypto-digest.ts",
+            "tests/corpus/6294-webcrypto-js-values.mjs",
+            "tests/corpus/6295-jose-hs256/main.mjs",
+            "tests/fixtures/node-types/webcrypto-hmac.ts"
+          ]
         }
       }
     },
@@ -81731,12 +81731,19 @@
       "priority": "high",
       "tiers": {
         "static": {
-          "status": "not-implemented",
-          "action": "verify-gap",
-          "verification": "registry-gap",
-          "confidence": "low",
-          "source": "compiler-unmatched:webcrypto",
-          "tests": []
+          "status": "partial",
+          "action": "audit-partial",
+          "verification": "test-backed",
+          "confidence": "high",
+          "source": "compiler-feature:webcrypto.subtle.verify",
+          "tests": [
+            "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+            "tests/corpus/6292-webcrypto-hmac-errors.ts",
+            "tests/corpus/6293-webcrypto-digest.ts",
+            "tests/corpus/6294-webcrypto-js-values.mjs",
+            "tests/corpus/6295-jose-hs256/main.mjs",
+            "tests/fixtures/node-types/webcrypto-hmac.ts"
+          ]
         }
       }
     },
diff --git a/internal/compatibility/generated/node-v24-internal.json b/internal/compatibility/generated/node-v24-internal.json
index ee139efa0..3fc7b1a54 100644
--- a/internal/compatibility/generated/node-v24-internal.json
+++ b/internal/compatibility/generated/node-v24-internal.json
@@ -190,10 +190,10 @@
       "entries": 179,
       "apiEntries": 152,
       "static": {
-        "supported": 5,
+        "supported": 6,
         "partial": 39,
         "refused": 21,
-        "not-implemented": 87,
+        "not-implemented": 86,
         "by-design": 0,
         "unreviewed": 0,
         "not-applicable": 0
@@ -326,9 +326,9 @@
       "apiEntries": 280,
       "static": {
         "supported": 7,
-        "partial": 198,
+        "partial": 200,
         "refused": 0,
-        "not-implemented": 75,
+        "not-implemented": 73,
         "by-design": 0,
         "unreviewed": 0,
         "not-applicable": 0
@@ -340,10 +340,10 @@
       "entries": 94,
       "apiEntries": 92,
       "static": {
-        "supported": 0,
-        "partial": 12,
+        "supported": 1,
+        "partial": 15,
         "refused": 1,
-        "not-implemented": 79,
+        "not-implemented": 75,
         "by-design": 0,
         "unreviewed": 0,
         "not-applicable": 0
@@ -910,10 +910,10 @@
       "entries": 176,
       "apiEntries": 156,
       "static": {
-        "supported": 1,
-        "partial": 10,
+        "supported": 2,
+        "partial": 21,
         "refused": 0,
-        "not-implemented": 145,
+        "not-implemented": 133,
         "by-design": 0,
         "unreviewed": 0,
         "not-applicable": 0
@@ -19872,6 +19872,8 @@
           "tests/corpus/5762-crypto-hash-stream.cjs",
           "tests/corpus/5768-crypto-hash-unknown.ts",
           "tests/corpus/5769-crypto-hash-unknown.cjs",
+          "tests/corpus/6204-crypto-get-random-values.ts",
+          "tests/corpus/6205-crypto-get-random-values.js",
           "tests/corpus/node24-crypto-kdf-errors.ts",
           "tests/corpus/node24-crypto-kdf-options.ts",
           "tests/corpus/node24-crypto-kdf.ts",
@@ -21028,8 +21030,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:crypto"
+        "status": "supported",
+        "evidence": "compiler-dedicated:crypto.getRandomValues",
+        "tests": [
+          "tests/corpus/6204-crypto-get-random-values.ts",
+          "tests/corpus/6205-crypto-get-random-values.js"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -44138,6 +44144,8 @@
           "tests/corpus/5568-fs-cp-errors.js",
           "tests/corpus/5569-fs-cp-symlinks.ts",
           "tests/corpus/5570-fs-cp-async.ts",
+          "tests/corpus/6207-fs-constants-object.ts",
+          "tests/corpus/6208-fs-constants-require.cjs",
           "tests/corpus/fs-native-realpath.ts",
           "tests/corpus/node24-fs-links-callbacks.cjs",
           "tests/corpus/node24-fs-links-errors.cjs",
@@ -45925,8 +45933,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:fs"
+        "status": "partial",
+        "evidence": "surface-manifest:node-builtin.fs.constants",
+        "tests": [
+          "tests/corpus/6207-fs-constants-object.ts",
+          "tests/corpus/6208-fs-constants-require.cjs"
+        ]
       },
       "anchorSource": "ancestor"
     },
@@ -51797,8 +51809,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:fs"
+        "status": "partial",
+        "evidence": "surface-manifest:node-builtin.fs.constants",
+        "tests": [
+          "tests/corpus/6207-fs-constants-object.ts",
+          "tests/corpus/6208-fs-constants-require.cjs"
+        ]
       },
       "anchorSource": "ancestor"
     },
@@ -52226,8 +52242,16 @@
           "tests/corpus/5288-blob-validation.js",
           "tests/corpus/5290-blob-dynamic.js",
           "tests/corpus/5830-timers-promises-signal.ts",
+          "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+          "tests/corpus/6292-webcrypto-hmac-errors.ts",
+          "tests/corpus/6293-webcrypto-digest.ts",
+          "tests/corpus/6294-webcrypto-js-values.mjs",
+          "tests/corpus/6295-jose-hs256/main.mjs",
+          "tests/corpus/6331-jose-root-entry/main.ts",
           "tests/corpus/text-codec-values/main.ts",
-          "tests/harness/fetch-conformance.test.ts"
+          "tests/fixtures/node-types/navigator.ts",
+          "tests/harness/fetch-conformance.test.ts",
+          "tests/harness/project-config.test.ts"
         ]
       },
       "anchorSource": "chapter"
@@ -52648,8 +52672,15 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:globals"
+        "status": "partial",
+        "evidence": "compiler-feature:globals.CryptoKey",
+        "tests": [
+          "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+          "tests/corpus/6292-webcrypto-hmac-errors.ts",
+          "tests/corpus/6293-webcrypto-digest.ts",
+          "tests/corpus/6294-webcrypto-js-values.mjs",
+          "tests/corpus/6295-jose-hs256/main.mjs"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -53322,8 +53353,15 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:globals"
+        "status": "partial",
+        "evidence": "compiler-feature:globals.SubtleCrypto",
+        "tests": [
+          "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+          "tests/corpus/6292-webcrypto-hmac-errors.ts",
+          "tests/corpus/6293-webcrypto-digest.ts",
+          "tests/corpus/6294-webcrypto-js-values.mjs",
+          "tests/corpus/6295-jose-hs256/main.mjs"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -54228,8 +54266,13 @@
         "inherited": false
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:globals"
+        "status": "partial",
+        "evidence": "compiler-feature:globals.navigator",
+        "tests": [
+          "tests/fixtures/node-types/navigator.ts",
+          "tests/harness/project-config.test.ts",
+          "tests/corpus/6331-jose-root-entry/main.ts"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -54366,8 +54409,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:globals"
+        "status": "supported",
+        "evidence": "compiler-feature:globals.userAgent",
+        "tests": [
+          "tests/fixtures/node-types/navigator.ts",
+          "tests/harness/project-config.test.ts"
+        ]
       },
       "anchorSource": "ancestor"
     },
@@ -106895,10 +106942,18 @@
           "tests/corpus/2890-crypto-static-utility.ts",
           "tests/corpus/5442-crypto-random-values.ts",
           "tests/corpus/5443-crypto-random-arguments.js",
+          "tests/corpus/6204-crypto-get-random-values.ts",
+          "tests/corpus/6205-crypto-get-random-values.js",
+          "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+          "tests/corpus/6292-webcrypto-hmac-errors.ts",
+          "tests/corpus/6293-webcrypto-digest.ts",
+          "tests/corpus/6294-webcrypto-js-values.mjs",
+          "tests/corpus/6295-jose-hs256/main.mjs",
           "tests/corpus/node24-crypto-kdf-errors.ts",
           "tests/corpus/node24-crypto-kdf-options.ts",
           "tests/corpus/node24-crypto-kdf.ts",
           "tests/corpus/node24-crypto-sha2.ts",
+          "tests/fixtures/node-types/webcrypto-hmac.ts",
           "tests/harness/npm-static.test.ts"
         ]
       },
@@ -110379,8 +110434,12 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:webcrypto"
+        "status": "supported",
+        "evidence": "compiler-dedicated:crypto.getRandomValues",
+        "tests": [
+          "tests/corpus/6204-crypto-get-random-values.ts",
+          "tests/corpus/6205-crypto-get-random-values.js"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -110430,8 +110489,15 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:webcrypto"
+        "status": "partial",
+        "evidence": "compiler-feature:webcrypto.subtle",
+        "tests": [
+          "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+          "tests/corpus/6292-webcrypto-hmac-errors.ts",
+          "tests/corpus/6293-webcrypto-digest.ts",
+          "tests/corpus/6294-webcrypto-js-values.mjs",
+          "tests/corpus/6295-jose-hs256/main.mjs"
+        ]
       },
       "anchorSource": "ancestor"
     },
@@ -110453,8 +110519,13 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:webcrypto"
+        "status": "partial",
+        "evidence": "compiler-feature:webcrypto.CryptoKey",
+        "tests": [
+          "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+          "tests/corpus/6294-webcrypto-js-values.mjs",
+          "tests/corpus/6295-jose-hs256/main.mjs"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -110476,8 +110547,13 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:webcrypto"
+        "status": "partial",
+        "evidence": "compiler-feature:webcrypto.cryptoKey.algorithm",
+        "tests": [
+          "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+          "tests/corpus/6294-webcrypto-js-values.mjs",
+          "tests/corpus/6295-jose-hs256/main.mjs"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -110499,8 +110575,13 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:webcrypto"
+        "status": "partial",
+        "evidence": "compiler-feature:webcrypto.extractable",
+        "tests": [
+          "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+          "tests/corpus/6294-webcrypto-js-values.mjs",
+          "tests/corpus/6295-jose-hs256/main.mjs"
+        ]
       },
       "anchorSource": "ancestor"
     },
@@ -110522,8 +110603,13 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:webcrypto"
+        "status": "partial",
+        "evidence": "compiler-feature:webcrypto.type",
+        "tests": [
+          "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+          "tests/corpus/6294-webcrypto-js-values.mjs",
+          "tests/corpus/6295-jose-hs256/main.mjs"
+        ]
       },
       "anchorSource": "ancestor"
     },
@@ -110545,8 +110631,13 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:webcrypto"
+        "status": "partial",
+        "evidence": "compiler-feature:webcrypto.usages",
+        "tests": [
+          "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+          "tests/corpus/6294-webcrypto-js-values.mjs",
+          "tests/corpus/6295-jose-hs256/main.mjs"
+        ]
       },
       "anchorSource": "ancestor"
     },
@@ -110637,8 +110728,15 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:webcrypto"
+        "status": "partial",
+        "evidence": "compiler-feature:webcrypto.SubtleCrypto",
+        "tests": [
+          "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+          "tests/corpus/6292-webcrypto-hmac-errors.ts",
+          "tests/corpus/6293-webcrypto-digest.ts",
+          "tests/corpus/6294-webcrypto-js-values.mjs",
+          "tests/corpus/6295-jose-hs256/main.mjs"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -110775,8 +110873,16 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:webcrypto"
+        "status": "partial",
+        "evidence": "compiler-feature:webcrypto.subtle.digest",
+        "tests": [
+          "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+          "tests/corpus/6292-webcrypto-hmac-errors.ts",
+          "tests/corpus/6293-webcrypto-digest.ts",
+          "tests/corpus/6294-webcrypto-js-values.mjs",
+          "tests/corpus/6295-jose-hs256/main.mjs",
+          "tests/fixtures/node-types/webcrypto-hmac.ts"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -110936,8 +111042,16 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:webcrypto"
+        "status": "partial",
+        "evidence": "compiler-feature:webcrypto.subtle.importKey",
+        "tests": [
+          "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+          "tests/corpus/6292-webcrypto-hmac-errors.ts",
+          "tests/corpus/6293-webcrypto-digest.ts",
+          "tests/corpus/6294-webcrypto-js-values.mjs",
+          "tests/corpus/6295-jose-hs256/main.mjs",
+          "tests/fixtures/node-types/webcrypto-hmac.ts"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -110959,8 +111073,16 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:webcrypto"
+        "status": "partial",
+        "evidence": "compiler-feature:webcrypto.subtle.sign",
+        "tests": [
+          "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+          "tests/corpus/6292-webcrypto-hmac-errors.ts",
+          "tests/corpus/6293-webcrypto-digest.ts",
+          "tests/corpus/6294-webcrypto-js-values.mjs",
+          "tests/corpus/6295-jose-hs256/main.mjs",
+          "tests/fixtures/node-types/webcrypto-hmac.ts"
+        ]
       },
       "anchorSource": "exact"
     },
@@ -111005,8 +111127,16 @@
         "inherited": true
       },
       "static": {
-        "status": "not-implemented",
-        "evidence": "compiler-unmatched:webcrypto"
+        "status": "partial",
+        "evidence": "compiler-feature:webcrypto.subtle.verify",
+        "tests": [
+          "tests/corpus/6291-webcrypto-hmac-sign-verify.ts",
+          "tests/corpus/6292-webcrypto-hmac-errors.ts",
+          "tests/corpus/6293-webcrypto-digest.ts",
+          "tests/corpus/6294-webcrypto-js-values.mjs",
+          "tests/corpus/6295-jose-hs256/main.mjs",
+          "tests/fixtures/node-types/webcrypto-hmac.ts"
+        ]
       },
       "anchorSource": "exact"
     },
diff --git a/internal/compatibility/static-support.json b/internal/compatibility/static-support.json
index 87a51470e..668c3740c 100644
--- a/internal/compatibility/static-support.json
+++ b/internal/compatibility/static-support.json
@@ -111,6 +111,8 @@
     "node-builtin.os.uptime": ["tests/corpus/5140-os-host-facts.ts"],
     "node-builtin.os.version": ["tests/corpus/5140-os-host-facts.ts"],
     "node-builtin.os.constants": ["tests/corpus/5141-os-constants.ts"],
+    "node-builtin.fs.constants": ["tests/corpus/6207-fs-constants-object.ts", "tests/corpus/6208-fs-constants-require.cjs"],
+    "node-builtin.crypto.getRandomValues": ["tests/corpus/6204-crypto-get-random-values.ts", "tests/corpus/6205-crypto-get-random-values.js"],
     "node-builtin.url.parse": ["tests/corpus/5220-url-parse-warnings.ts", "tests/corpus/5221-url-parse-shapes.ts", "tests/corpus/5222-url-parse-hosts.ts", "tests/corpus/5223-url-parse-query.ts", "tests/corpus/5227-url-legacy-dependency/main.ts", "tests/corpus/5229-url-legacy-errors.cjs", "packages/runtime/test/url-legacy.test.ts", "tests/fixtures/node-types/url-legacy.ts"],
     "node-builtin.url.format": ["tests/corpus/5224-url-format-objects.ts", "tests/corpus/5225-url-format-whatwg.ts", "tests/corpus/5227-url-legacy-dependency/main.ts", "tests/corpus/5229-url-legacy-errors.cjs", "packages/runtime/test/url-legacy.test.ts", "tests/fixtures/node-types/url-legacy.ts"],
     "node-builtin.url.resolve": ["tests/corpus/5226-url-resolve.ts", "tests/corpus/5227-url-legacy-dependency/main.ts", "tests/corpus/5229-url-legacy-errors.cjs", "packages/runtime/test/url-legacy.test.ts", "tests/fixtures/node-types/url-legacy.ts"],
@@ -177,11 +179,19 @@
     "stdlib.set": ["tests/corpus/typed-collection-iterators.ts", "tests/corpus/typed-collection-iterator-references.ts", "tests/corpus/checked-collection-iterators.ts"],
     "stdlib.headers": ["tests/harness/fetch-conformance.test.ts"],
     "stdlib.request": ["tests/harness/fetch-conformance.test.ts"],
+    "stdlib.webcrypto.subtle": ["tests/corpus/6291-webcrypto-hmac-sign-verify.ts", "tests/corpus/6292-webcrypto-hmac-errors.ts", "tests/corpus/6293-webcrypto-digest.ts", "tests/corpus/6294-webcrypto-js-values.mjs", "tests/corpus/6295-jose-hs256/main.mjs"],
+    "stdlib.webcrypto.CryptoKey": ["tests/corpus/6291-webcrypto-hmac-sign-verify.ts", "tests/corpus/6294-webcrypto-js-values.mjs", "tests/corpus/6295-jose-hs256/main.mjs"],
     "stdlib.response": ["tests/harness/fetch-conformance.test.ts"],
     "stdlib.readable-stream": ["tests/harness/fetch-conformance.test.ts"],
     "stdlib.abort": ["tests/harness/fetch-conformance.test.ts"]
   },
   "features": [
+    { "chapter": "webcrypto", "symbols": ["subtle.importKey", "subtle.sign", "subtle.verify", "subtle.digest"], "status": "partial", "evidence": ["tests/corpus/6291-webcrypto-hmac-sign-verify.ts", "tests/corpus/6292-webcrypto-hmac-errors.ts", "tests/corpus/6293-webcrypto-digest.ts", "tests/corpus/6294-webcrypto-js-values.mjs", "tests/corpus/6295-jose-hs256/main.mjs", "tests/fixtures/node-types/webcrypto-hmac.ts"] },
+    { "chapter": "webcrypto", "signatures": ["Class: `SubtleCrypto`", "`subtle` Type: {SubtleCrypto}"], "status": "partial", "evidence": ["tests/corpus/6291-webcrypto-hmac-sign-verify.ts", "tests/corpus/6292-webcrypto-hmac-errors.ts", "tests/corpus/6293-webcrypto-digest.ts", "tests/corpus/6294-webcrypto-js-values.mjs", "tests/corpus/6295-jose-hs256/main.mjs"] },
+    { "chapter": "webcrypto", "signatures": ["Class: `CryptoKey`", "`cryptoKey.algorithm`", "`extractable` Type: {boolean}", "`type` Type: {string} One of `'secret'`, `'private'`, or `'public'`.", "`usages` Type: {string\\[]}"], "status": "partial", "evidence": ["tests/corpus/6291-webcrypto-hmac-sign-verify.ts", "tests/corpus/6294-webcrypto-js-values.mjs", "tests/corpus/6295-jose-hs256/main.mjs"] },
+    { "chapter": "globals", "signatures": ["`navigator`"], "status": "partial", "evidence": ["tests/fixtures/node-types/navigator.ts", "tests/harness/project-config.test.ts", "tests/corpus/6331-jose-root-entry/main.ts"] },
+    { "chapter": "globals", "signatures": ["`userAgent` Type: {string}"], "status": "supported", "evidence": ["tests/fixtures/node-types/navigator.ts", "tests/harness/project-config.test.ts"] },
+    { "chapter": "globals", "signatures": ["Class: `CryptoKey`", "Class: `SubtleCrypto`"], "status": "partial", "evidence": ["tests/corpus/6291-webcrypto-hmac-sign-verify.ts", "tests/corpus/6292-webcrypto-hmac-errors.ts", "tests/corpus/6293-webcrypto-digest.ts", "tests/corpus/6294-webcrypto-js-values.mjs", "tests/corpus/6295-jose-hs256/main.mjs"] },
     { "chapter": "errors", "parent": "Class: `SystemError`", "symbols": ["code", "errno", "syscall", "path", "dest"], "status": "partial", "evidence": ["tests/corpus/caught-system-error-fields.ts", "tests/fixtures/node-types/terminal-error-fields.ts", "tests/harness/project-config.test.ts"] },
     {"chapter": "events", "symbols": ["EventTarget", "eventTarget.addEventListener", "eventTarget.removeEventListener", "eventTarget.dispatchEvent"], "status": "partial", "evidence": ["tests/corpus/5130-event-target-dispatch.js", "tests/corpus/5131-event-target-listener-errors.js", "tests/corpus/5132-event-target-typed.ts", "tests/corpus/5133-abort-signal-event-target.ts", "tests/corpus/5135-event-target-warnings.js", "tests/corpus/5240-event-target-subclass.ts", "tests/corpus/5242-event-target-subclass-hierarchy.ts", "tests/corpus/5243-event-target-subclass-dynamic.ts", "tests/corpus/5244-event-target-subclass.js", "tests/corpus/5245-event-target-subclass-signals.ts", "tests/corpus/5248-event-target-subclass-warnings.ts"]},
     {"chapter": "events", "symbols": ["Event"], "status": "partial", "evidence": ["tests/corpus/5130-event-target-dispatch.js", "tests/corpus/5132-event-target-typed.ts", "tests/corpus/5241-event-subclass.ts", "tests/corpus/5242-event-target-subclass-hierarchy.ts", "tests/corpus/5244-event-target-subclass.js", "tests/corpus/5247-event-target-subclass-lifetimes.ts"]},
@@ -391,6 +401,7 @@
     { "symbols": ["crypto.createHash", "Hash", "hash.update", "hash.digest", "hash.copy", "crypto.createHmac", "Hmac", "hmac.update", "hmac.digest", "crypto.hash", "crypto.pbkdf2", "crypto.pbkdf2Sync"], "status": "partial", "evidence": ["tests/corpus/5760-crypto-hash-stream.ts", "tests/corpus/5768-crypto-hash-unknown.ts", "tests/corpus/5769-crypto-hash-unknown.cjs", "tests/corpus/5761-crypto-hash-stream-states.ts", "tests/corpus/5762-crypto-hash-stream.cjs", "tests/corpus/2890-crypto-static-utility.ts", "tests/corpus/node24-crypto-sha2.ts", "tests/corpus/5435-crypto-hash-algorithms.ts", "tests/corpus/5436-crypto-hash-names.js", "tests/corpus/5437-crypto-hmac-algorithms.ts", "tests/corpus/5438-crypto-kdf-digests.ts", "tests/corpus/5440-crypto-hash-encodings.js", "tests/corpus/5441-crypto-hash-output-length.ts", "tests/harness/npm-static.test.ts"] },
     { "symbols": ["crypto.randomFill", "crypto.randomFillSync", "crypto.randomUUID", "crypto.randomUUIDv7"], "status": "supported", "evidence": ["tests/corpus/5442-crypto-random-values.ts", "tests/corpus/5443-crypto-random-arguments.js", "tests/corpus/1358-crypto-random.ts"] },
     { "symbols": ["crypto.createSecretKey", "crypto.generateKey", "crypto.generateKeySync", "KeyObject", "keyObject.export", "keyObject.equals", "keyObject.symmetricKeySize", "keyObject.type"], "status": "partial", "evidence": ["tests/corpus/5445-crypto-secret-key-objects.ts", "tests/corpus/5446-crypto-secret-key-errors.js"] },
+    { "symbols": ["crypto.getRandomValues"], "status": "supported", "evidence": ["tests/corpus/6204-crypto-get-random-values.ts", "tests/corpus/6205-crypto-get-random-values.js"] },
     { "symbols": ["crypto.timingSafeEqual"], "status": "supported", "evidence": ["tests/corpus/5444-crypto-timing-safe-equal.js", "tests/corpus/2890-crypto-static-utility.ts"] },
     { "symbols": ["crypto.randomInt"], "status": "partial", "evidence": ["tests/corpus/5442-crypto-random-values.ts", "tests/corpus/2890-crypto-static-utility.ts"] },
     { "symbols": ["crypto.hkdf", "crypto.hkdfSync", "crypto.scrypt", "crypto.scryptSync"], "status": "partial", "evidence": ["tests/corpus/node24-crypto-kdf.ts", "tests/corpus/node24-crypto-kdf-errors.ts", "tests/corpus/node24-crypto-kdf-options.ts", "tests/corpus/5438-crypto-kdf-digests.ts"] },
diff --git a/packages/compiler/ambient/scriptc-node-fallback.d.ts b/packages/compiler/ambient/scriptc-node-fallback.d.ts
index f8fafe010..3bf97fe6a 100644
--- a/packages/compiler/ambient/scriptc-node-fallback.d.ts
+++ b/packages/compiler/ambient/scriptc-node-fallback.d.ts
@@ -511,14 +511,119 @@ declare var DOMException: {
   readonly prototype: DOMException;
 };
 
-/* Capability-gated globals harness code probes behind feature guards
- * (globalThis.crypto under a hasCrypto check, the SQLite-backed storage
- * pair): typed `unknown` — no lowering exists, the guard is expected to
- * be false in a compiled binary, and any reached use fences per site. */
-declare var crypto: unknown;
+/* WebCrypto's HMAC slice (scr_webcrypto.c): crypto.subtle's importKey for
+ * raw HMAC keys, HMAC sign/verify and the SHA-1/SHA-2 digests, typed as
+ * exactly that surface (the declarations mirror @types/node's webcrypto
+ * shapes). Every other SubtleCrypto method and crypto member is absent,
+ * so a use is an honest type error. CryptoKey values are native handles
+ * whose four members read through the handle. */
+declare var crypto: Crypto;
+/* The Crypto and SubtleCrypto constructors (feature probes only) stay
+ * `unknown`; the values keep this declaration order. */
 declare var Crypto: unknown;
-declare var CryptoKey: unknown;
+declare var CryptoKey: {
+  prototype: CryptoKey;
+  new (): CryptoKey;
+};
 declare var SubtleCrypto: unknown;
+type KeyUsage =
+  | "encrypt"
+  | "decrypt"
+  | "sign"
+  | "verify"
+  | "deriveKey"
+  | "deriveBits"
+  | "encapsulateBits"
+  | "decapsulateBits"
+  | "encapsulateKey"
+  | "decapsulateKey"
+  | "wrapKey"
+  | "unwrapKey";
+type KeyType = "private" | "public" | "secret";
+interface Algorithm {
+  name: string;
+}
+type AlgorithmIdentifier = Algorithm | string;
+type HashAlgorithmIdentifier = AlgorithmIdentifier;
+interface HmacImportParams extends Algorithm {
+  hash: HashAlgorithmIdentifier;
+  length?: number;
+}
+interface KeyAlgorithm {
+  name: string;
+}
+interface HmacKeyAlgorithm extends KeyAlgorithm {
+  hash: KeyAlgorithm;
+  length: number;
+}
+interface CryptoKey {
+  readonly algorithm: KeyAlgorithm;
+  readonly extractable: boolean;
+  readonly type: KeyType;
+  readonly usages: KeyUsage[];
+}
+type KeyFormat =
+  | "jwk"
+  | "pkcs8"
+  | "raw"
+  | "raw-private"
+  | "raw-public"
+  | "raw-secret"
+  | "raw-seed"
+  | "spki";
+interface JsonWebKey {
+  alg?: string;
+  crv?: string;
+  d?: string;
+  dp?: string;
+  dq?: string;
+  e?: string;
+  ext?: boolean;
+  k?: string;
+  key_ops?: string[];
+  kty?: string;
+  n?: string;
+  p?: string;
+  q?: string;
+  qi?: string;
+  use?: string;
+  x?: string;
+  y?: string;
+}
+/* The 'jwk' form type-checks like @types/node's; the compiler refuses it
+ * (the JsonWebKey import is not implemented). */
+interface SubtleCrypto {
+  digest(algorithm: AlgorithmIdentifier, data: BufferSource): Promise<ArrayBuffer>;
+  importKey(
+    format: "jwk",
+    keyData: JsonWebKey,
+    algorithm: AlgorithmIdentifier | HmacImportParams,
+    extractable: boolean,
+    keyUsages: readonly KeyUsage[],
+  ): Promise<CryptoKey>;
+  importKey(
+    format: Exclude<KeyFormat, "jwk">,
+    keyData: BufferSource,
+    algorithm: AlgorithmIdentifier | HmacImportParams,
+    extractable: boolean,
+    keyUsages: readonly KeyUsage[],
+  ): Promise<CryptoKey>;
+  sign(algorithm: AlgorithmIdentifier, key: CryptoKey, data: BufferSource): Promise<ArrayBuffer>;
+  verify(
+    algorithm: AlgorithmIdentifier,
+    key: CryptoKey,
+    signature: BufferSource,
+    data: BufferSource,
+  ): Promise<boolean>;
+}
+interface Crypto {
+  readonly subtle: SubtleCrypto;
+}
+
+/* Capability-gated globals harness code probes behind feature guards
+ * (the SQLite-backed storage pair): typed `unknown` — no lowering exists,
+ * the guard is expected to be false in a compiled binary, and any reached
+ * use fences per site. */
 declare var localStorage: unknown;
 declare var sessionStorage: unknown;
 
@@ -1493,6 +1598,51 @@ declare module "node:fs" {
     readonly COPYFILE_EXCL: number;
     readonly COPYFILE_FICLONE: number;
     readonly COPYFILE_FICLONE_FORCE: number;
+    readonly UV_FS_SYMLINK_DIR: number;
+    readonly UV_FS_SYMLINK_JUNCTION: number;
+    readonly UV_DIRENT_UNKNOWN: number;
+    readonly UV_DIRENT_FILE: number;
+    readonly UV_DIRENT_DIR: number;
+    readonly UV_DIRENT_LINK: number;
+    readonly UV_DIRENT_FIFO: number;
+    readonly UV_DIRENT_SOCKET: number;
+    readonly UV_DIRENT_CHAR: number;
+    readonly UV_DIRENT_BLOCK: number;
+    readonly UV_FS_O_FILEMAP: number;
+    readonly UV_FS_O_TEMPORARY: number;
+    readonly UV_FS_O_SHORT_LIVED: number;
+    readonly UV_FS_O_SEQUENTIAL: number;
+    readonly UV_FS_O_RANDOM: number;
+    readonly UV_FS_COPYFILE_EXCL: number;
+    readonly UV_FS_COPYFILE_FICLONE: number;
+    readonly UV_FS_COPYFILE_FICLONE_FORCE: number;
+    readonly S_IFMT: number;
+    readonly S_IFREG: number;
+    readonly S_IFDIR: number;
+    readonly S_IFCHR: number;
+    readonly S_IFBLK: number;
+    readonly S_IFIFO: number;
+    readonly S_IFLNK: number;
+    readonly S_IFSOCK: number;
+    readonly O_NOCTTY: number;
+    readonly O_DIRECTORY: number;
+    readonly O_NOATIME: number;
+    readonly O_SYNC: number;
+    readonly O_DSYNC: number;
+    readonly O_SYMLINK: number;
+    readonly O_DIRECT: number;
+    readonly S_IRWXU: number;
+    readonly S_IRUSR: number;
+    readonly S_IWUSR: number;
+    readonly S_IXUSR: number;
+    readonly S_IRWXG: number;
+    readonly S_IRGRP: number;
+    readonly S_IWGRP: number;
+    readonly S_IXGRP: number;
+    readonly S_IRWXO: number;
+    readonly S_IROTH: number;
+    readonly S_IWOTH: number;
+    readonly S_IXOTH: number;
   };
   /* A stat(2) snapshot (statSync follows symlinks, lstatSync does not —
    * Node's split) — immutable; the supported surface is exactly these
@@ -2557,6 +2707,23 @@ declare module "crypto" {
     a: ArrayBufferView | ArrayBufferLike,
     b: ArrayBufferView | ArrayBufferLike,
   ): boolean;
+  /* WebCrypto's getRandomValues (also the webcrypto object's): integer
+   * typed arrays, filled in place and returned. The crypto GLOBAL stays
+   * unknown in fallback builds. */
+  type RandomValuesArray =
+    | Int8Array
+    | Uint8Array
+    | Uint8ClampedArray
+    | Int16Array
+    | Uint16Array
+    | Int32Array
+    | Uint32Array
+    | BigInt64Array
+    | BigUint64Array;
+  export function getRandomValues<T extends RandomValuesArray>(typedArray: T): T;
+  export const webcrypto: {
+    getRandomValues<T extends RandomValuesArray>(typedArray: T): T;
+  };
   export function randomFillSync<T extends ArrayBufferView | ArrayBufferLike>(
     buffer: T,
     offset?: number,
@@ -5077,6 +5244,8 @@ declare module "tls" {
     getProtocol(): string | null;
     /* OpenSSL's suite name, the IANA name and the suite's version */
     getCipher(): CipherNameAndProtocol;
+    /* whether the handshake resumed a cached session */
+    isSessionReused(): boolean;
   }
   export interface CipherNameAndProtocol {
     name: string;
diff --git a/packages/compiler/src/backend/cycle-analysis.test.ts b/packages/compiler/src/backend/cycle-analysis.test.ts
index 8972b9e70..c78420f73 100644
--- a/packages/compiler/src/backend/cycle-analysis.test.ts
+++ b/packages/compiler/src/backend/cycle-analysis.test.ts
@@ -21,7 +21,7 @@ import { computeTraced as llvmTraced } from "./llvm/shapes.js";
 const loc = { file: "cycles.ts", start: 0, end: 1 };
 function module(): IrModule {
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [{ name: "main", locals: [], params: [], returnType: VOID, body: [], loc }],
diff --git a/packages/compiler/src/backend/cycle-analysis.ts b/packages/compiler/src/backend/cycle-analysis.ts
index 22eb4c658..c41b88067 100644
--- a/packages/compiler/src/backend/cycle-analysis.ts
+++ b/packages/compiler/src/backend/cycle-analysis.ts
@@ -40,7 +40,7 @@ export function computeTraced(mod: IrModule): { shapes: Set<string>; unions: Set
 }
 
 /** Values that can reference any object. */
-export type IntrinsicKind = "func" | "dyn" | "classval" | "promise" | "caught";
+export type IntrinsicKind = "func" | "dyn" | "jsval" | "classval" | "promise" | "caught";
 
 /** Why an edge of the cycle graph exists (explanations only). */
 export type CycleEdgeLabel =
@@ -218,6 +218,7 @@ function analyzeCycles(
     switch (t.kind) {
       case "func":
       case "dyn":
+      case "jsval":
       case "classval":
       case "promise":
       case "caught":
diff --git a/packages/compiler/src/backend/executable-features.ts b/packages/compiler/src/backend/executable-features.ts
index a565965f1..eeb6c6900 100644
--- a/packages/compiler/src/backend/executable-features.ts
+++ b/packages/compiler/src/backend/executable-features.ts
@@ -16,12 +16,15 @@ export function executableLinkFeatures(mod: IrModule): NativeLinkFeatures {
     fileHandle: features.fileHandle,
     fetch: features.fetch,
     ...(features.eventTarget ? { eventTarget: true } : {}),
+    ...(features.warningReplace ? { warningReplace: true } : {}),
+    ...(features.stdioExtended ? { stdioExtended: true } : {}),
     zlib: features.zlib,
     assert: features.assert,
     inspect: features.inspect,
     dynInvoke: features.dynInvoke,
     dc: features.dc,
     dynAsync: features.dynAsync,
+    ...(features.dynTier ? { dynTier: true } : {}),
     events: features.processEvents,
     emitter: features.emitter,
     symbol: features.symbol,
@@ -40,5 +43,6 @@ export function executableLinkFeatures(mod: IrModule): NativeLinkFeatures {
     tls: features.tls,
     tlsCa: features.tlsCa,
     cipher: features.cipher,
+    webcrypto: features.webcrypto,
   };
 }
diff --git a/packages/compiler/src/backend/immutability.test.ts b/packages/compiler/src/backend/immutability.test.ts
index 7f5e22fb5..a4e82cefe 100644
--- a/packages/compiler/src/backend/immutability.test.ts
+++ b/packages/compiler/src/backend/immutability.test.ts
@@ -48,7 +48,7 @@ function module(
   functions: IrModule["functions"],
 ): IrModule {
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     classes,
diff --git a/packages/compiler/src/backend/library-pack.ts b/packages/compiler/src/backend/library-pack.ts
index 833ef93e7..5070a47a8 100644
--- a/packages/compiler/src/backend/library-pack.ts
+++ b/packages/compiler/src/backend/library-pack.ts
@@ -33,6 +33,7 @@ export async function compilePackedLibrary(
     assert: options.assert ?? false,
     inspect: options.inspect ?? false,
     dynInvoke: options.dynInvoke ?? false,
+    ...(options.dynTier === true ? { dynTier: true } : {}),
     dc: false,
     dynAsync: false,
     events: false,
@@ -52,6 +53,7 @@ export async function compilePackedLibrary(
     nodeTest: false,
     tls: false,
     cipher: false,
+    webcrypto: false,
     tlsCa: false,
   };
   const selection = await loadRuntimePack({
diff --git a/packages/compiler/src/backend/llvm/appended-array-literals.test.ts b/packages/compiler/src/backend/llvm/appended-array-literals.test.ts
index ada57a831..c483b7848 100644
--- a/packages/compiler/src/backend/llvm/appended-array-literals.test.ts
+++ b/packages/compiler/src/backend/llvm/appended-array-literals.test.ts
@@ -22,7 +22,7 @@ const push = (receiver: IrExpr): IrStmt => ({
 
 function module(body: IrStmt[], locals: string[]): IrModule {
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "__main",
     functions: [
diff --git a/packages/compiler/src/backend/llvm/array-search.test.ts b/packages/compiler/src/backend/llvm/array-search.test.ts
index 8b644f708..e6d367710 100644
--- a/packages/compiler/src/backend/llvm/array-search.test.ts
+++ b/packages/compiler/src/backend/llvm/array-search.test.ts
@@ -26,7 +26,7 @@ function module(elem: IrType, method: "indexOf" | "includes"): IrModule {
     loc,
   };
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "__main",
     functions: [
diff --git a/packages/compiler/src/backend/llvm/checked-narrows.test.ts b/packages/compiler/src/backend/llvm/checked-narrows.test.ts
index 6034d578c..665b4cb44 100644
--- a/packages/compiler/src/backend/llvm/checked-narrows.test.ts
+++ b/packages/compiler/src/backend/llvm/checked-narrows.test.ts
@@ -150,7 +150,7 @@ function fixture(helper: IrFunction): IrModule {
     ],
   };
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     records: [{ id: "cell", fields: [{ name: "x", type: F64 }] }],
diff --git a/packages/compiler/src/backend/llvm/classes.test.ts b/packages/compiler/src/backend/llvm/classes.test.ts
index d1dec3f97..be1c58941 100644
--- a/packages/compiler/src/backend/llvm/classes.test.ts
+++ b/packages/compiler/src/backend/llvm/classes.test.ts
@@ -16,7 +16,7 @@ const loc = { file: "class-membership.ts", start: 0, end: 1 };
 test("leaf layouts keep direct teardown while recursive layouts share the depth budget", () => {
   const linked = { kind: "object" as const, className: "Linked" };
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [{ name: "main", params: [], returnType: VOID, locals: [], body: [], loc }],
@@ -63,7 +63,7 @@ test("releases split into an inlinable fast path and an out-of-line remainder",
   // An array of the class itself makes the hierarchy cycle-capable.
   const kids = { kind: "array" as const, elem: { kind: "object" as const, className: "Node" } };
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [{ name: "main", params: [], returnType: VOID, locals: [], body: [], loc }],
@@ -92,7 +92,7 @@ test("ProgramLifetime hierarchies are never freed and take no reference counts",
   const kids = { kind: "array" as const, elem: { kind: "object" as const, className: "Node" } };
   const owners = { kind: "array" as const, elem: { kind: "object" as const, className: "Owner" } };
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [{ name: "main", params: [], returnType: VOID, locals: [], body: [], loc }],
@@ -144,7 +144,7 @@ test("published ProgramLifetime instances use the published mark every other obj
   const leaf = { kind: "object" as const, className: "Leaf" };
   const root = { localId: "root", name: "root", type: node };
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [
@@ -236,7 +236,7 @@ function graph() {
     { name: "FlippedString", base: "PairString", genericOf: "Flipped" },
   ];
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [],
@@ -270,7 +270,7 @@ test.each(["i32", "i64"])(
     expect(helper).toContain("label %ordinary");
     expect(helper).toContain("or i1");
     const ordinary: IrModule = {
-      irVersion: 16,
+      irVersion: 17,
       sourceFile: loc.file,
       entry: "main",
       functions: [],
@@ -285,7 +285,7 @@ test.each(["i32", "i64"])(
 
 test("unconstructed narrowing layouts may omit abstract slots while live classes require implementations", () => {
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [{ name: "main", params: [], returnType: VOID, locals: [], body: [], loc }],
@@ -320,7 +320,7 @@ test("unconstructed narrowing layouts may omit abstract slots while live classes
 test("the young-in nursery flag adds the nursery entry to traced constructors only", () => {
   const linked = { kind: "object" as const, className: "Linked" };
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [{ name: "main", params: [], returnType: VOID, locals: [], body: [], loc }],
diff --git a/packages/compiler/src/backend/llvm/constant-callbacks.test.ts b/packages/compiler/src/backend/llvm/constant-callbacks.test.ts
index 071d8e1ff..aa491c711 100644
--- a/packages/compiler/src/backend/llvm/constant-callbacks.test.ts
+++ b/packages/compiler/src/backend/llvm/constant-callbacks.test.ts
@@ -71,7 +71,7 @@ function fixture(): IrModule {
     loc,
   };
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [predicate, consumer, entry],
diff --git a/packages/compiler/src/backend/llvm/dense-array-access.test.ts b/packages/compiler/src/backend/llvm/dense-array-access.test.ts
index 31680a518..6da427841 100644
--- a/packages/compiler/src/backend/llvm/dense-array-access.test.ts
+++ b/packages/compiler/src/backend/llvm/dense-array-access.test.ts
@@ -31,7 +31,7 @@ function module(
   unions: IrModule["unions"] = [],
 ): IrModule {
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "__main",
     unions,
diff --git a/packages/compiler/src/backend/llvm/dyn-handle-tags.test.ts b/packages/compiler/src/backend/llvm/dyn-handle-tags.test.ts
index 8aa69b386..c015b85d0 100644
--- a/packages/compiler/src/backend/llvm/dyn-handle-tags.test.ts
+++ b/packages/compiler/src/backend/llvm/dyn-handle-tags.test.ts
@@ -3,19 +3,21 @@ import { expect, test } from "vitest";
 import { DYN_HANDLE_KINDS } from "../../ir/ir.js";
 import { DYN_HANDLE_TAG_NUM } from "./dyn.js";
 
-// ScrDynHandleTag in scr_dyn.h lists its tags by name, each with an explicit
-// value, so changes that add tags edit different lines. These checks stand
-// in for what the enum's order used to guarantee.
+// SCR_DYNH_TAGS in scr_dyn.h lists the ScrDynHandleTag values by name, each
+// with an explicit value, so changes that add tags edit different lines. The
+// header itself fails to compile on a duplicate or out-of-range value; these
+// checks report the same problems by name and keep the backend's numbers in
+// step.
 const header = readFileSync(new URL("../../../../runtime/src/scr_dyn.h", import.meta.url), "utf8");
-const body = /typedef enum \{\n([\s\S]*?)\} ScrDynHandleTag;/.exec(header)![1]!;
-const tags = [...body.matchAll(/^\s*(SCR_DYNH_[A-Z0-9_]+) = (\d+),/gm)].map(([, name, value]) => ({
-  name: name!,
+const body = /#define SCR_DYNH_TAGS\(X\) \\\n([\s\S]*?)\n\n/.exec(header)![1]!;
+const tags = [...body.matchAll(/^\s*X\(([A-Z0-9_]+), (\d+)\)/gm)].map(([, name, value]) => ({
+  name: `SCR_DYNH_${name!}`,
   value: Number(value),
 }));
 const capacity = Number(/#define SCR_DYNH_CAPACITY (\d+)/.exec(header)![1]);
 
 test("every ScrDynHandleTag has an explicit value, in name order", () => {
-  const lines = body.split("\n").filter((line) => line.trim().startsWith("SCR_DYNH_"));
+  const lines = body.split("\n").filter((line) => line.trim().startsWith("X("));
   expect(tags.length).toBe(lines.length);
   expect(tags.map((tag) => tag.name)).toEqual(tags.map((tag) => tag.name).toSorted());
 });
diff --git a/packages/compiler/src/backend/llvm/dyn.ts b/packages/compiler/src/backend/llvm/dyn.ts
index 154b80c02..ae4f12fb8 100644
--- a/packages/compiler/src/backend/llvm/dyn.ts
+++ b/packages/compiler/src/backend/llvm/dyn.ts
@@ -762,7 +762,9 @@ export class LlDyn {
       B.terminate(`ret i1 true`);
       B.startBlock(lNext);
     }
-    if (t.kind !== "dyn") {
+    // A union matches a capsule of another type through its arms below: a
+    // class capsule in a `C | undefined` field matches the `C` arm.
+    if (t.kind !== "dyn" && t.kind !== "union") {
       const view = this.viewFn(wrapped);
       this.host.declare(`declare void @scr_dyn_release_v(ptr)`);
       const kind = this.kindOf(B, "%d");
@@ -4014,14 +4016,9 @@ export class LlDyn {
     const name = "sc_dyn_iter_n";
     this.dynBuilders.set(memoKey, name);
     const host = this.host;
-    host.declare(`declare void @scr_jb_init(ptr)`);
-    host.declare(`declare ptr @scr_jb_finish(ptr)`);
-    host.declare(`declare void @scr_jb_puts(ptr, ptr)`);
-    host.declare(`declare void @scr_throw_error(i32, ptr)`);
     host.declare(`declare ptr @scr_dyn_new_arr()`);
     host.declare(`declare void @scr_dyn_arr_push(ptr, ptr)`);
     host.declare(`declare ptr @scr_dyn_new_num(double)`);
-    host.declare(`declare ptr @scr_f64_to_scrstr(double)`);
     host.declare(`declare void @scr_str_release(ptr)`);
     const B = new BlockBuilder();
     const kd = this.kindOf(B, "%d");
@@ -4033,6 +4030,21 @@ export class LlDyn {
       const lNext = B.newLabel("din.nt");
       B.condBr(isTyped, lTyped, lNext);
       B.startBlock(lTyped);
+      // Compiled generators step through the iterator protocol.
+      host.declare(`declare i1 @scr_dyn_iterates_by_protocol(ptr)`);
+      host.declare(`declare ptr @scr_dyn_iter_take(ptr, ${host.sizeType}, ptr)`);
+      const protocol = B.tmp();
+      const lProtocol = B.newLabel("din.pr");
+      const lView = B.newLabel("din.vw");
+      B.line(`${protocol} = call i1 @scr_dyn_iterates_by_protocol(ptr %d)`);
+      B.condBr(protocol, lProtocol, lView);
+      B.startBlock(lProtocol);
+      const stepped = B.tmp();
+      B.line(
+        `${stepped} = call ptr @scr_dyn_iter_take(ptr %d, ${host.sizeType} %n, ptr %spelling)`,
+      );
+      B.terminate(`ret ptr ${stepped}`);
+      B.startBlock(lView);
       host.declare(`declare ptr @scr_dyn_typed_ref_materialize(ptr)`);
       host.declare(`declare void @scr_dyn_release_v(ptr)`);
       const materialized = B.tmp();
@@ -4057,71 +4069,13 @@ export class LlDyn {
     const lGo = B.newLabel("din.g");
     const lThrow = B.newLabel("din.t");
     B.condBr(ok, lGo, lThrow);
-    // V8's exact not-iterable TypeError.
+    // Other iterables step through the iterator protocol; non-iterables
+    // throw V8's exact not-iterable TypeError.
     B.startBlock(lThrow);
-    const buf = "%dib";
-    B.entryAllocas.push(`${buf} = alloca %ScrJsonBuf`);
-    B.line(`call void @scr_jb_init(ptr ${buf})`);
-    const hasSpelling = B.tmp();
-    B.line(`${hasSpelling} = icmp ne ptr %spelling, null`);
-    const named = B.newLabel("din.named"),
-      unnamed = B.newLabel("din.unnamed");
-    B.condBr(hasSpelling, named, unnamed);
-    B.startBlock(named);
-    B.line(`call void @scr_jb_puts(ptr ${buf}, ptr %spelling)`);
-    const namedMessage = B.tmp();
-    B.line(`${namedMessage} = call ptr @scr_jb_finish(ptr ${buf})`);
-    B.line(`call void @scr_throw_error(i32 1, ptr ${namedMessage})`);
-    B.terminate(`ret ptr null`);
-    B.startBlock(unnamed);
-    const lU = B.newLabel("din.u");
-    const lN = B.newLabel("din.n");
-    const lB2 = B.newLabel("din.b");
-    const lNum = B.newLabel("din.m");
-    const lF = B.newLabel("din.f");
-    const lDef = B.newLabel("din.d");
-    const lTail = B.newLabel("din.e");
-    B.terminate(
-      `switch i32 ${kd}, label %${lDef} [ i32 ${DYN_KIND.UNDEF}, label %${lU} i32 ${DYN_KIND.NULL}, label %${lN} i32 ${DYN_KIND.BOOL}, label %${lB2} i32 ${DYN_KIND.NUM}, label %${lNum} i32 ${DYN_KIND.FUNC}, label %${lF} ]`,
-    );
-    B.startBlock(lU);
-    this.puts(B, buf, "undefined");
-    B.br(lTail);
-    B.startBlock(lN);
-    this.puts(B, buf, "object null");
-    B.br(lTail);
-    B.startBlock(lB2);
-    {
-      const bv = this.boolOf(B, "%d");
-      const s = B.tmp();
-      B.line(
-        `${s} = select i1 ${bv}, ptr ${host.cstr("boolean true")}, ptr ${host.cstr("boolean false")}`,
-      );
-      B.line(`call void @scr_jb_puts(ptr ${buf}, ptr ${s})`);
-      B.br(lTail);
-    }
-    B.startBlock(lNum);
-    {
-      this.puts(B, buf, "number ");
-      const x = this.payloadOf(B, "%d", "double");
-      const s = B.tmp();
-      B.line(`${s} = call ptr @scr_f64_to_scrstr(double ${x})`);
-      this.putScrStr(B, buf, s);
-      B.line(`call void @scr_str_release(ptr ${s})`);
-      B.br(lTail);
-    }
-    B.startBlock(lF);
-    this.puts(B, buf, "function");
-    B.br(lTail);
-    B.startBlock(lDef);
-    this.puts(B, buf, "object");
-    B.br(lTail);
-    B.startBlock(lTail);
-    this.puts(B, buf, " is not iterable (cannot read property Symbol(Symbol.iterator))");
-    const msg = B.tmp();
-    B.line(`${msg} = call ptr @scr_jb_finish(ptr ${buf})`);
-    B.line(`call void @scr_throw_error(i32 1, ptr ${msg}) ; SCR_ERR_TYPE`);
-    B.terminate(`ret ptr null`);
+    host.declare(`declare ptr @scr_dyn_iter_take(ptr, ${host.sizeType}, ptr)`);
+    const taken = B.tmp();
+    B.line(`${taken} = call ptr @scr_dyn_iter_take(ptr %d, ${host.sizeType} %n, ptr %spelling)`);
+    B.terminate(`ret ptr ${taken}`);
     B.startBlock(lGo);
     const out = B.tmp();
     B.line(`${out} = call ptr @scr_dyn_new_arr()`);
diff --git a/packages/compiler/src/backend/llvm/emit-function.ts b/packages/compiler/src/backend/llvm/emit-function.ts
new file mode 100644
index 000000000..78f208ff1
--- /dev/null
+++ b/packages/compiler/src/backend/llvm/emit-function.ts
@@ -0,0 +1,1347 @@
+/* LlEmitter's function emission: function bodies, generator and async scaffolding, async awaits, WASI fulfillment and trampolines. */
+import {
+  type LlArgPackAndTrampolinePrologue,
+  type LlEmitter,
+  type LlScopeEntry,
+  SUSPENDS,
+  UNOPTIMIZED_BOX_SLOTS,
+  boxSlotCount,
+} from "./emitter.js";
+import { type IrFunction, type IrType, isRefCounted, typeKey } from "../../ir/ir.js";
+import { BlockBuilder } from "./blocks.js";
+import { findPrivateSplitLocals } from "./split-loops.js";
+import {
+  conditionalLoopWrites,
+  initializerLocalCandidates,
+  withInitializerBindings,
+  withInitializerLocals,
+} from "../../ir/initializer-bindings.js";
+import { findUnaliasedLocalArrays } from "../../ir/array-length-stability.js";
+import { constructorClass } from "../../ir/final-fields.js";
+import { findInitializedByteLoopBindings } from "./byte-windows.js";
+import { findLoopArrayBorrows } from "./loop-array-borrows.js";
+import { findCallArrayReads, findLocalArrayReads } from "./local-array-reads.js";
+import { findScalarStringSlices, findScratchStringSlices } from "./string-slices.js";
+import { findMapReadLifetimes, findReadNumberMapWrites } from "./map-read-lifetimes.js";
+import { findMapEntryFusions } from "./map-entry-fusion.js";
+import { findLocalStackUnions } from "./stack-unions.js";
+import { findLocalStackObjects, findReassignedStackObjects } from "./stack-objects.js";
+import { findLocalUnionStorage } from "./local-union-storage.js";
+import { INT32_RANGE, analyzeIntegerRanges } from "../../ir/integer-ranges.js";
+import { findBytesBounds } from "./bytes-bounds.js";
+import { findInt32Locals } from "./int32-locals.js";
+import { findIntegerViews } from "./integer-views.js";
+import {
+  mangleArgPack,
+  mangleAsyncAdoptCall,
+  mangleAsyncAwaitCall,
+  mangleAsyncSpawn,
+  mangleBorrowedFunction,
+  mangleClassStruct,
+  mangleFunction,
+  mangleGenDrop,
+  mangleGenSourceClose,
+  mangleGenSpawn,
+  mangleGlobal,
+  mangleLocal,
+  mangleTrampoline,
+} from "../mangle.js";
+import { InternalCompilerError } from "../../errors.js";
+import { classEnvironmentIndex } from "./classes.js";
+import { FN_ATTRS, boxNewCall, releaseSym, traceArg, vAdapters } from "./shapes.js";
+import type { LlValue } from "./expr-context.js";
+import { INT32_ABI_SUFFIX, SCALAR_UNION_RESULT } from "./int32-abi.js";
+import { f64Lit } from "./common.js";
+import { RESULT_ENTRY_PREFIX } from "./record-results.js";
+import { emitIntegerClone, emitIntegerDispatcher } from "./integer-clones.js";
+
+export function emitFunction(emitter: LlEmitter, fn: IrFunction): string {
+  const B = new BlockBuilder();
+  emitter.B = B;
+  emitter.currentFunctionName = fn.name;
+  // Fiber switches restore the active exception cell before control
+  // returns to a synchronous frame (emitPendingCheck).
+  B.excCellInvariant = fn.async !== true && fn.generator === undefined;
+  emitter.debugScope = emitter.debug?.function(fn) ?? null;
+  B.debugLocation = emitter.debug?.location(fn.loc, emitter.debugScope) ?? null;
+  emitter.frames = [];
+  emitter.scopes = [];
+  emitter.unwindCleanups.clear();
+  emitter.jumpTargets = [];
+  emitter.currentLocals = new Map(fn.locals.map((l) => [l.id, l]));
+  emitter.lazyCaptureBoxes.clear();
+  emitter.lazyStackBoxes.clear();
+  // An unchanged captured parameter keeps its value in a plain slot; the
+  // binding is boxed only for closures (captureBox).
+  const lazyParameters = emitter.lazyCaptures.parameters(fn);
+  for (const id of lazyParameters) {
+    const { boxed: _boxed, ...plain } = emitter.currentLocals.get(id)!;
+    emitter.currentLocals.set(id, plain);
+    emitter.lazyCaptureBoxes.set(id, "");
+  }
+  emitter.currentConstantCallbacks =
+    emitter.debug === null ? (emitter.constantCallbacks.get(fn.name) ?? new Map()) : new Map();
+  // Preserve concrete source bindings for debugger inspection. Suspended
+  // functions keep the established array lifetime across continuations.
+  emitter.streamingSplitsEnabled = emitter.debug === null && !fn.async && !fn.generator;
+  emitter.stackCallbacks.reset(emitter.streamingSplitsEnabled);
+  emitter.stackCaptures.reset(fn, emitter.streamingSplitsEnabled, lazyParameters);
+  emitter.privateSplitLocals = emitter.streamingSplitsEnabled
+    ? findPrivateSplitLocals(fn)
+    : new Map();
+  emitter.storedSplits.clear();
+  emitter.splitSpans.clear();
+  emitter.stringSlices.clear();
+  const initializerBindings = emitter.initializerBindings.get(fn.name) ?? [];
+  const numericFn = withInitializerBindings(fn, initializerBindings);
+  emitter.numericLocals = new Map(numericFn.locals.map((l) => [l.id, l]));
+  emitter.unaliasedArrays = findUnaliasedLocalArrays(fn);
+  emitter.borrowedParameters.clear();
+  emitter.referenceWrites?.enter(fn);
+  emitter.reboundOwnerSlots.clear();
+  emitter.projectedParameters.clear();
+  const projectedParameterIndexes = emitter.callLifetimes.parameters.get(fn.name);
+  if (projectedParameterIndexes)
+    for (const index of projectedParameterIndexes)
+      emitter.projectedParameters.add(fn.params[index]!.localId);
+  emitter.stableCallBindings = emitter.callLifetimes.bindings.get(fn.name) ?? new Set();
+  const borrowedParameterIndexes = emitter.callLifetimes.borrowed.get(fn.name);
+  if (borrowedParameterIndexes) {
+    // Rebound walk parameters borrow too, but only unchanged ones may
+    // serve as stable owners for call arguments and aliases.
+    for (const index of borrowedParameterIndexes)
+      if (
+        !emitter.walkBorrowsByFunction.get(fn.name)?.has(fn.params[index]!.localId) &&
+        !emitter.reboundByFunction.get(fn.name)?.has(fn.params[index]!.localId)
+      )
+        emitter.borrowedParameters.add(fn.params[index]!.localId);
+  }
+  // A generator frame owns its unchanged parameters across suspensions.
+  const generatorParameters = emitter.callLifetimes.generatorParameters.get(fn.name);
+  if (generatorParameters !== undefined)
+    for (const id of generatorParameters) emitter.borrowedParameters.add(id);
+  emitter.captureIds = new Set(
+    [...(fn.captures ?? []), ...(fn.classCaptures ?? [])].map((c) => c.localId),
+  );
+  emitter.stableCaptureIds =
+    fn.captures !== undefined ? emitter.lazyCaptures.stableCaptures(fn.name) : new Set();
+  emitter.integerLoopBindings.clear();
+  emitter.countedLoopsEnabled = emitter.debug === null && !fn.async && !fn.generator;
+  emitter.speculativeLoopsEnabled = emitter.countedLoopsEnabled;
+  emitter.speculativeFunction = fn.name;
+  emitter.speculation = null;
+  emitter.speculationResume = null;
+  emitter.finalFieldBorrows =
+    !fn.async &&
+    !fn.generator &&
+    constructorClass(fn.name) === null &&
+    emitter.finalFields.size > 0;
+  emitter.byteWindowsEnabled = emitter.countedLoopsEnabled;
+  emitter.denseLoopsEnabled = emitter.countedLoopsEnabled;
+  emitter.denseLoop = null;
+  emitter.denseLoopEntries =
+    emitter.denseLoopsEnabled && numericFn.locals.some((l) => l.type.kind === "array")
+      ? findInitializedByteLoopBindings(fn)
+      : new Map();
+  emitter.byteWindowEntries =
+    emitter.byteWindowsEnabled && numericFn.locals.some((l) => l.type.kind === "bytes")
+      ? findInitializedByteLoopBindings(fn)
+      : new Map();
+  emitter.integerViews.clear();
+  emitter.fieldPointerTags.clear();
+  emitter.integerArrayBindings.clear();
+  emitter.loopArrayBorrows =
+    emitter.debug === null
+      ? findLoopArrayBorrows(
+          fn,
+          emitter.callLifetimes,
+          emitter.referenceEffects,
+          emitter.optionalArrayReads,
+          emitter.referenceWrites,
+          emitter.fnByName,
+        )
+      : new Set();
+  emitter.localArrayReads = findLocalArrayReads(
+    fn,
+    emitter.fnByName,
+    emitter.unionsById,
+    emitter.referenceEffects.functions,
+    emitter.callLifetimes,
+    emitter.optionalArrayReads,
+    emitter.loopArrayBorrows,
+    emitter.debug === null ? emitter.referenceEffects : undefined,
+  );
+  emitter.callArrayReads = findCallArrayReads(
+    fn,
+    emitter.optionalArrayReads,
+    emitter.referenceEffects.functions,
+    emitter.callLifetimes,
+    emitter.debug === null ? emitter.referenceEffects : undefined,
+  );
+  emitter.scalarStringSlices =
+    emitter.debug === null ? findScalarStringSlices(fn, emitter.callLifetimes) : new Map();
+  emitter.scratchStringSlices =
+    emitter.debug === null
+      ? findScratchStringSlices(
+          fn,
+          emitter.callLifetimes,
+          emitter.scalarStringSlices,
+          emitter.lentStringParameters,
+        )
+      : new Set();
+  emitter.mapReadLifetimes = findMapReadLifetimes(
+    fn,
+    emitter.boxedUnionsById,
+    emitter.callLifetimes,
+  );
+  emitter.readNumberMapWrites = findReadNumberMapWrites(fn);
+  emitter.mapEntryFusion = emitter.debug === null ? findMapEntryFusions(fn) : null;
+  emitter.localStackUnions = findLocalStackUnions(
+    fn,
+    emitter.callLifetimes,
+    emitter.boxedUnionsById,
+  );
+  emitter.localStackObjects = emitter.stackObjects
+    ? findLocalStackObjects(emitter, fn, emitter.callLifetimes)
+    : new Map();
+  emitter.reassignedStackObjects = emitter.stackObjects
+    ? findReassignedStackObjects(emitter, fn, emitter.callLifetimes)
+    : new Set();
+  emitter.stackObjectSlots = new Map();
+  emitter.stackObjectFieldPtrs = new Map();
+  emitter.localUnionStorageProofs = findLocalUnionStorage(
+    fn,
+    emitter.callLifetimes,
+    emitter.unionSources,
+  );
+  emitter.localUnionStorage = new Map();
+  emitter.walkBorrows = emitter.walkBorrowsByFunction.get(fn.name) ?? new Set();
+  const slotFacts = emitter.int32Slots.facts(fn.name);
+  emitter.integerRanges = analyzeIntegerRanges(numericFn, slotFacts);
+  emitter.int32Elements = slotFacts.elements ?? null;
+  emitter.bytesBounds = findBytesBounds(numericFn, emitter.integerRanges);
+  // Debug builds keep every number local a double for the debugger's
+  // variable view. Lazily boxed captured parameters keep their double,
+  // which the box is created from, and so do plain copies of a capture or
+  // such a parameter (copyStableCaptures): the source already holds the
+  // double, which an i32 copy would convert and widen again on every call.
+  // Initializer bindings proven int32 move into an i32 local of their
+  // initializer: no other code observes the global, so the loop-carried
+  // value never round-trips through the double slot.
+  const initializerLocals = initializerLocalCandidates(initializerBindings);
+  const int32Locals =
+    emitter.debug === null
+      ? findInt32Locals(
+          withInitializerLocals(fn, initializerLocals),
+          emitter.integerRanges,
+          emitter.int32Slots.facts(fn.name),
+          new Set([...emitter.lazyCaptureBoxes.keys(), ...emitter.doubleCopies(fn)]),
+        )
+      : null;
+  emitter.int32Locals = int32Locals?.locals ?? new Map();
+  emitter.int32LocalWrites = int32Locals?.values ?? new Set();
+  const localizedGlobals = new Set<string>();
+  for (const global of initializerLocals) {
+    if (!emitter.int32Locals.has(global.id)) continue;
+    localizedGlobals.add(global.id);
+    emitter.currentLocals.set(global.id, {
+      id: global.id,
+      name: global.name,
+      type: global.type,
+      mutable: global.mutable,
+    });
+  }
+  emitter.chainSlots.clear();
+  emitter.finallyStack = [];
+  emitter.tryStack = [];
+  emitter.loopDepth = 0;
+  emitter.currentReturnType = fn.returnType;
+  const int32Abi = emitter.int32Abis.get(fn.name);
+  emitter.currentInt32Result = int32Abi?.result === true;
+  emitter.currentUnionResult = int32Abi?.union === true;
+  emitter.currentGenerator = fn.generator ?? null;
+  emitter.currentAsyncGenerator = fn.async === true && fn.generator !== undefined;
+  emitter.currentBorrowedReturn = emitter.borrowedReturns.has(fn.name);
+  emitter.lastUseMoves.clear();
+  emitter.varRefCounts = null;
+  emitter.currentFunctionBody = fn.body;
+  emitter.inConstructor = emitter.constructorFunctions.has(fn.name);
+  emitter.currentCoro = null;
+  emitter.logArgSlots = 0;
+
+  if (emitter.coroLowered(fn)) {
+    emitter.usesCoroutines = true;
+    emitter.declare(`declare token @llvm.coro.id(i32, ptr, ptr, ptr)`);
+    emitter.declare(`declare ${emitter.sizeType} @llvm.coro.size.${emitter.sizeType}()`);
+    emitter.declare(`declare ptr @llvm.coro.begin(token, ptr)`);
+    emitter.declare(`declare token @llvm.coro.save(ptr)`);
+    emitter.declare(`declare i8 @llvm.coro.suspend(token, i1)`);
+    emitter.declare(`declare ptr @llvm.coro.free(token, ptr)`);
+    emitter.declare(`declare void @llvm.coro.end(ptr, i1, token)`);
+    // Native frames come from the runtime's small-block allocator.
+    const frameAlloc = emitter.wasi ? "malloc" : "scr_rt_calloc";
+    emitter.declare(`declare ptr @${frameAlloc}(${emitter.sizeType})`);
+    emitter.declare(`declare void @${emitter.wasi ? "free" : "scr_rt_free"}(ptr)`);
+    const started = emitter.wasi ? "scr_wasi_coro_started" : "scr_coro_started";
+    emitter.declare(`declare void @${started}(ptr)`);
+    emitter.declare(`declare ptr @scr_fiber_self()`);
+    const id = B.tmp();
+    const size = B.tmp();
+    const mem = B.tmp();
+    const handle = B.tmp();
+    const self = B.tmp();
+    B.line(`${id} = call token @llvm.coro.id(i32 0, ptr null, ptr null, ptr null)`);
+    B.line(`${size} = call ${emitter.sizeType} @llvm.coro.size.${emitter.sizeType}()`);
+    B.line(`${mem} = call ptr @${frameAlloc}(${emitter.sizeType} ${size})`);
+    B.line(`${handle} = call ptr @llvm.coro.begin(token ${id}, ptr ${mem})`);
+    B.line(`call void @${started}(ptr ${handle})`);
+    B.line(`${self} = call ptr @scr_fiber_self()`);
+    // A native synchronous body owns its generator for the whole run (the
+    // ScrGen owns the frame), so its OUT slot address is fixed.
+    let out: string | null = null;
+    const yieldKind = fn.generator?.yieldT.kind;
+    if (
+      !emitter.wasi &&
+      fn.async !== true &&
+      (yieldKind === "f64" || yieldKind === "date" || yieldKind === "bool")
+    ) {
+      emitter.declare(`declare ptr @scr_gen_of_fiber(ptr)`);
+      const gen = B.tmp();
+      B.line(`${gen} = call ptr @scr_gen_of_fiber(ptr ${self})`);
+      out = emitter.genOutSlot(gen);
+    }
+    emitter.currentCoro = {
+      kind: fn.generator !== undefined ? "generator" : "async",
+      id,
+      handle,
+      self,
+      finalLabel: B.newLabel("coro.final"),
+      cleanupLabel: B.newLabel("coro.cleanup"),
+      suspendLabel: B.newLabel("coro.suspend"),
+      out,
+    };
+  }
+
+  const paramIds = new Set(fn.params.map((p) => p.localId));
+  if (emitter.debug === null) {
+    for (const id of findIntegerViews(numericFn)) {
+      // An i32 slot is its own view.
+      if (emitter.int32Locals.has(id)) continue;
+      const slot = B.slot();
+      B.entryAllocas.push(
+        `${slot} = alloca i32 ; integer view ${emitter.numericLocals.get(id)!.name}`,
+      );
+      emitter.integerViews.set(id, slot);
+    }
+  }
+  for (const global of initializerBindings) {
+    if (!emitter.integerViews.has(global.id)) continue;
+    const value = B.tmp();
+    B.line(`${value} = load double, ptr @${mangleGlobal(global.id)}`);
+    emitter.storeIntegerView(global.id, { name: value, type: global.type });
+  }
+  // A number global only its guarded, synchronous initializer reads or
+  // writes (findInitializerBindings) is invisible to every other function,
+  // and reentry returns before reaching it, so a local slot can stand in
+  // for it: LLVM keeps it in a register across calls and loops that would
+  // otherwise force a store and reload per iteration. The global's
+  // storage is never read again, so nothing writes the slot back. Bindings
+  // proven int32 already live in an i32 local (localizedGlobals above);
+  // this covers the remaining doubles.
+  emitter.privateGlobalSlots.clear();
+  if (emitter.debug === null && emitter.currentCoro === null && !fn.async && !fn.generator) {
+    const conditional = initializerLocals.length ? conditionalLoopWrites(fn.body) : null;
+    for (const global of initializerLocals) {
+      if (localizedGlobals.has(global.id)) continue;
+      // A conditional update in a loop stays a memory update (see
+      // conditionalLoopWrites).
+      if (conditional?.has(global.id)) continue;
+      const slot = B.slot();
+      const value = B.tmp();
+      B.entryAllocas.push(`${slot} = alloca double ; module binding ${global.name}`);
+      B.line(`${value} = load double, ptr @${mangleGlobal(global.id)}`);
+      B.line(`store double ${value}, ptr ${slot}`);
+      emitter.privateGlobalSlots.set(global.id, slot);
+    }
+  }
+  for (const local of emitter.currentLocals.values()) {
+    // Boxed locals' slots hold their capture BOX (a ptr); captured
+    // (env-borrowed) locals bind the incoming box below. A caught-typed
+    // local is a catch binding: its slot holds the ScrCaught snapshot
+    // box the catch prologue takes (scr_exc_take).
+    const slotTy =
+      local.boxed || emitter.captureIds.has(local.id) || local.type.kind === "caught"
+        ? "ptr"
+        : emitter.int32Locals.has(local.id)
+          ? "i32"
+          : emitter.llType(local.type);
+    B.entryAllocas.push(`%${mangleLocal(local.id)} = alloca ${slotTy} ; ${local.name}`);
+    emitter.emitDebugLocal(
+      local,
+      `%${mangleLocal(local.id)}`,
+      fn.params.findIndex((p) => p.localId === local.id) + 1,
+      emitter.captureIds.has(local.id),
+    );
+    // A localized initializer binding starts at its global's zero value.
+    if (localizedGlobals.has(local.id)) B.line(`store i32 0, ptr %${mangleLocal(local.id)}`);
+    // Refcounted/boxed locals start NULL (the C prologue's `= NULL`):
+    // scope-exit releases run whether or not an assign ever did.
+    if (paramIds.has(local.id) || emitter.captureIds.has(local.id)) continue;
+    if (local.boxed || isRefCounted(local.type)) {
+      B.line(`store ptr null, ptr %${mangleLocal(local.id)}`);
+    }
+  }
+  // A body holding thousands of capture boxes compiles unoptimized, its
+  // box pointers kept in their slots (see boxSlotCount).
+  const unoptimized = emitter.currentCoro === null && boxSlotCount(fn) >= UNOPTIMIZED_BOX_SLOTS;
+  if (unoptimized) {
+    const slots = new Set<string>();
+    for (const local of emitter.currentLocals.values())
+      if (local.boxed || emitter.captureIds.has(local.id)) slots.add(`%${mangleLocal(local.id)}`);
+    B.volatileSlots = slots;
+  }
+  // Captured bindings come in through the environment — borrowed for the
+  // whole call (the closure owns them): bound here, never released here.
+  (fn.captures ?? []).forEach((c, i) => {
+    const caps = B.tmp();
+    const p = B.tmp();
+    const box = B.tmp();
+    B.line(`${caps} = getelementptr inbounds %ScrClosure, ptr %sc_env, i64 1 ; caps`);
+    B.line(`${p} = getelementptr inbounds ptr, ptr ${caps}, ${emitter.sizeType} ${i} ; caps[${i}]`);
+    B.line(`${box} = load ptr, ptr ${p}`);
+    B.line(`store ptr ${box}, ptr %${mangleLocal(c.localId)} ; captured ${c.name}`);
+  });
+  (fn.classCaptures ?? []).forEach((c) => {
+    const self = fn.params[0]!;
+    if (self.type.kind !== "object")
+      throw new InternalCompilerError("class captures require an instance receiver");
+    const classSlot = B.tmp();
+    const classValue = B.tmp();
+    const caps = B.tmp();
+    const slot = B.tmp();
+    const box = B.tmp();
+    B.line(
+      `${classSlot} = getelementptr inbounds %${mangleClassStruct(self.type.className)}, ptr %p_${mangleLocal(self.localId)}, i64 0, i32 ${classEnvironmentIndex(emitter.classMeta.get(self.type.className)!)}`,
+    );
+    B.line(`${classValue} = load ptr, ptr ${classSlot}`);
+    B.line(`${caps} = getelementptr inbounds %ScrClassObj, ptr ${classValue}, i64 1`);
+    B.line(`${slot} = getelementptr inbounds ptr, ptr ${caps}, ${emitter.sizeType} ${c.slot}`);
+    B.line(`${box} = load ptr, ptr ${slot}`);
+    B.line(`store ptr ${box}, ptr %${mangleLocal(c.localId)} ; class capture ${c.name}`);
+  });
+  // Params spill into their slots; the function scope owns refcounted
+  // params (callees own their params — callers passed +1). Boxed params
+  // allocate the shared binding and move the raw value in.
+  const fnScope: LlScopeEntry[] = [];
+  for (const id of emitter.lazyCaptureBoxes.keys()) {
+    const cache = B.slot();
+    B.entryAllocas.push(`${cache} = alloca ptr ; lazy box ${emitter.currentLocals.get(id)!.name}`);
+    B.line(`store ptr null, ptr ${cache}`);
+    fnScope.push({
+      slot: cache,
+      type: emitter.currentLocals.get(id)!.type,
+      boxed: true,
+      lazy: true,
+    });
+    emitter.lazyCaptureBoxes.set(id, cache);
+    // Environments that finish during the call can share an immortal
+    // frame box. Its payload owner is released with the function scope.
+    const stack = emitter.stackCaptures.emit(emitter, id, emitter.currentLocals.get(id)!.type);
+    if (stack) {
+      emitter.lazyStackBoxes.set(id, stack.box);
+      if (stack.owner) fnScope.push(stack.owner);
+    }
+  }
+  const borrowed = emitter.callLifetimes.borrowed.get(fn.name);
+  for (const [index, p] of fn.params.entries()) {
+    const local = emitter.currentLocals.get(p.localId)!;
+    const slot = `%${mangleLocal(p.localId)}`;
+    if (local.boxed) {
+      const box = B.tmp();
+      B.line(`${box} = ${boxNewCall(emitter.shapeHost, p.type)} ; ${p.name} (boxed param)`);
+      emitter.boxSet(box, p.type, `%p_${mangleLocal(p.localId)}`);
+      B.line(`store ptr ${box}, ptr ${slot}`);
+      fnScope.push({ slot, type: p.type, boxed: true });
+      continue;
+    }
+    const incoming: LlValue = { name: `%p_${mangleLocal(p.localId)}`, type: p.type };
+    if (int32Abi?.params[index]) {
+      const bits = `%p_${mangleLocal(p.localId)}${INT32_ABI_SUFFIX}`;
+      incoming.uint32 = bits;
+      incoming.integer = { name: bits, type: "i32", signed: true, range: INT32_RANGE };
+    }
+    if (emitter.storeInt32Local(p.localId, incoming)) continue;
+    B.line(`store ${emitter.llType(p.type)} %p_${mangleLocal(p.localId)}, ptr ${slot}`);
+    emitter.storeIntegerView(p.localId, incoming);
+    if (isRefCounted(p.type) && !borrowed?.has(index)) {
+      fnScope.push({ slot, type: p.type });
+      emitter.noteParameterMove(fn, p.localId, slot);
+    }
+    if (emitter.reboundByFunction.get(fn.name)?.has(p.localId) && borrowed?.has(index)) {
+      // The caller's borrow stays in the parameter slot; values the body
+      // assigns are owned here until rebinding or exit releases them.
+      const owner = `${slot}.owner`;
+      B.entryAllocas.push(`${owner} = alloca ptr`);
+      B.line(`store ptr null, ptr ${owner}`);
+      fnScope.push({ slot: owner, type: p.type });
+      emitter.reboundOwnerSlots.set(p.localId, owner);
+    }
+  }
+  emitter.scopes.push(fnScope);
+  // Stackful native fibers and native coroutine frames retain these frames
+  // while suspended. The active exception context owns the chain, so
+  // concurrent fibers isolate it.
+  if (
+    emitter.stackTraces &&
+    !emitter.wasi &&
+    fn.sourceName !== undefined &&
+    !emitter.unframedFunctions.has(fn.name)
+  ) {
+    B.entryAllocas.push(`%source_frame = alloca { ptr, ptr }`);
+    const frame = emitter.cstr(`    at ${fn.sourceName} (${fn.loc.file})`);
+    if (
+      B.excCellInvariant &&
+      emitter.mod.lib === undefined &&
+      emitter.mod.workers !== true &&
+      emitter.sizeType === "i64"
+    ) {
+      // Executables link the active-cell pointer as a plain global, and a
+      // synchronous body sees one cell from entry to every return: push
+      // and pop the frame inline (ScrExcCell.stack is at byte 56 on
+      // 64-bit targets) instead of calling the runtime twice per call.
+      emitter.declare(`@scr_exc_active = external global ptr`);
+      B.line(`%source_frame.cell = load ptr, ptr @scr_exc_active`);
+      B.line(`%source_frame.chain = getelementptr inbounds i8, ptr %source_frame.cell, i64 56`);
+      B.line(`%source_frame.previous = load ptr, ptr %source_frame.chain`);
+      B.line(`store ptr %source_frame.previous, ptr %source_frame`);
+      B.line(`%source_frame.text = getelementptr inbounds i8, ptr %source_frame, i64 8`);
+      B.line(`store ptr ${frame}, ptr %source_frame.text`);
+      B.line(`store ptr %source_frame, ptr %source_frame.chain`);
+      B.returnEpilogue = `store ptr %source_frame.previous, ptr %source_frame.chain`;
+    } else {
+      emitter.declare(`declare void @scr_stack_enter(ptr, ptr)`);
+      emitter.declare(`declare void @scr_stack_leave(ptr)`);
+      B.line(`call void @scr_stack_enter(ptr %source_frame, ptr ${frame})`);
+      B.returnEpilogue = `call void @scr_stack_leave(ptr %source_frame)`;
+    }
+  }
+  if (emitter.stackChecks?.has(fn.name)) emitter.emitStackCheck();
+  if (emitter.workerEntryPolls?.has(fn.name)) emitter.emitPendingCheck(undefined, true);
+  emitter.emitStmts(fn.body, true);
+  // Implicit exit of a void function: release the function scope unless
+  // the body already terminated its final block (return, or a throw
+  // whose unwind released everything down to depth 0).
+  if (fn.returnType.kind === "void" && !B.isTerminated()) {
+    emitter.releaseScope(emitter.scopes[0]!);
+    // Completing by falling off the end has nothing to await.
+    if (emitter.currentAsyncGenerator) emitter.emitAsyncGenSettled();
+    if (emitter.currentCoro !== null) {
+      emitter.emitWasiFulfill(null);
+      B.terminate(`br label %${emitter.currentCoro.finalLabel}`);
+    } else {
+      B.terminate("ret void");
+    }
+  }
+  emitter.scopes.pop();
+
+  const coro = emitter.currentCoro;
+  if (coro !== null) {
+    B.startBlock(coro.finalLabel);
+    // Every exit of a coroutine body joins here: its source frame (part
+    // of the coroutine frame) leaves the generator's own chain.
+    const epilogue = B.returnEpilogue;
+    B.returnEpilogue = null;
+    if (epilogue !== null) B.line(epilogue);
+    if (fn.captures !== undefined) {
+      emitter.declare(`declare void @scr_closure_release(ptr)`);
+      B.line(`call void @scr_closure_release(ptr %sc_env)`);
+    }
+    if (coro.kind === "generator") {
+      const finish = emitter.wasi ? "scr_wasi_gen_finish" : "scr_gen_coro_finish";
+      emitter.declare(`declare void @${finish}(ptr)`);
+      B.line(`call void @${finish}(ptr ${coro.self})`);
+    } else {
+      const finish = emitter.wasi ? "scr_wasi_async_finish" : "scr_coro_async_finish";
+      emitter.declare(`declare void @${finish}(ptr)`);
+      B.line(`call void @${finish}(ptr ${coro.self})`);
+    }
+    const finalState = B.tmp();
+    B.line(`${finalState} = call i8 @llvm.coro.suspend(token none, i1 true)`);
+    B.terminate(
+      `switch i8 ${finalState}, label %${coro.suspendLabel} [ i8 1, label %${coro.cleanupLabel} ]`,
+    );
+    B.startBlock(coro.cleanupLabel);
+    const frame = B.tmp();
+    B.line(`${frame} = call ptr @llvm.coro.free(token ${coro.id}, ptr ${coro.handle})`);
+    B.line(`call void @${emitter.wasi ? "free" : "scr_rt_free"}(ptr ${frame})`);
+    B.br(coro.suspendLabel);
+    B.startBlock(coro.suspendLabel);
+    B.line(`call void @llvm.coro.end(ptr ${coro.handle}, i1 false, token none)`);
+    const ret = emitter.llType(fn.returnType);
+    if (ret === "void") B.terminate(`ret void`);
+    else if (ret === "double") B.terminate(`ret double ${f64Lit(0)}`);
+    else if (ret === "i1") B.terminate(`ret i1 false`);
+    else B.terminate(`ret ptr null`);
+  }
+
+  // Shared blocks have multiple source locations. Keep the location on
+  // each incoming exception check instead of assigning one to the cleanup.
+  B.debugLocation = null;
+  for (const cleanup of emitter.unwindCleanups.values()) {
+    B.startBlock(cleanup.label);
+    emitter.releaseScope(cleanup.entries);
+    B.terminate(cleanup.terminator);
+  }
+
+  if (emitter.logArgSlots > 0) {
+    B.entryAllocas.push(`%logargs = alloca [${emitter.logArgSlots} x %ScrLogArg]`);
+  }
+  const params = fn.params.map((p, index) =>
+    int32Abi?.params[index]
+      ? `i32 %p_${mangleLocal(p.localId)}${INT32_ABI_SUFFIX}`
+      : `${emitter.llType(p.type)} %p_${mangleLocal(p.localId)}`,
+  );
+  // The i32 entry widens its i32 parameters once; the proof makes the
+  // double exact, so readers of the incoming number see the same value.
+  if (int32Abi)
+    fn.params.forEach((p, index) => {
+      if (!int32Abi.params[index]) return;
+      const name = `%p_${mangleLocal(p.localId)}`;
+      B.entryAllocas.push(`${name} = sitofp i32 ${name}${INT32_ABI_SUFFIX} to double`);
+    });
+  // Lifted functions receive their closure first (the callValue ABI).
+  if (fn.captures !== undefined) params.unshift("ptr %sc_env");
+  const ret = int32Abi?.result
+    ? "i32"
+    : int32Abi?.union
+      ? SCALAR_UNION_RESULT
+      : emitter.llType(fn.returnType);
+  let attrs = coro !== null ? "#1" : FN_ATTRS;
+  // The shared indexed-read helper (lowerSafeIndexRead) is a dense bounds
+  // test, a state test and a load behind cold runtime fallbacks, called
+  // from every `a[i]` of one element type. Without the hint LLVM keeps the
+  // hot instances out of line once they have many callers: every read pays
+  // a call, and an integer index converts to a double and back across it.
+  if (fn.name.startsWith("%arr.idxOr.")) attrs = `inlinehint ${attrs}`;
+  // Interface dispatch is a few key tests and direct calls ahead of the
+  // checked dynamic call. Keeping that fallback out of line leaves the
+  // tests small enough to inline at each call site.
+  if (fn.name.startsWith("%dyn.class.protocol.fallback.")) attrs = `noinline ${attrs}`;
+  else if (fn.name.startsWith("%dyn.class.protocol.")) attrs = `inlinehint ${attrs}`;
+  if (fn.name.startsWith(RESULT_ENTRY_PREFIX)) attrs = `inlinehint ${attrs}`;
+  if (unoptimized && attrs === FN_ATTRS) attrs = `noinline optnone ${attrs}`;
+  const debug = emitter.debugScope === null ? "" : ` !dbg ${emitter.debugScope}`;
+  const symbol = borrowed ? mangleBorrowedFunction(fn.name) : mangleFunction(fn.name);
+  emitter.privateGlobalSlots.clear();
+  let body = `define internal ${ret} @${symbol}${int32Abi ? INT32_ABI_SUFFIX : ""}(${params.join(", ")}) ${attrs}${debug} { ; ${fn.name}\n${B.render()}\n}`;
+  if (int32Abi) body += "\n" + emitter.emitInt32AbiWrapper(fn, symbol, int32Abi);
+  if (emitter.integerClones.members.has(fn.name)) {
+    body += "\n" + emitIntegerClone(fn, emitter, emitter.stackChecks?.has(fn.name) === true);
+    if (emitter.integerClones.dispatched.has(fn.name))
+      body +=
+        "\n" +
+        emitIntegerDispatcher(
+          fn,
+          emitter,
+          `${symbol}${int32Abi ? INT32_ABI_SUFFIX : ""}`,
+          int32Abi?.params ?? [],
+          int32Abi?.result === true,
+        );
+  }
+  if (!borrowed) return body;
+  const slot = emitter.implSlotBorrowed(fn.name);
+  const virtual =
+    slot.size > 0 && slot.size !== borrowed.size
+      ? "\n" + emitter.emitOwnedCallAdapter(fn, borrowed, slot)
+      : "";
+  return body + "\n" + emitter.emitOwnedCallAdapter(fn, borrowed) + virtual;
+}
+
+/** Per-generator-function machinery — the async scaffolding's lazy
+ * sibling (async.ts's emitGenScaffolding): the same argument pack,
+ * a fiber trampoline whose epilogue stores the COMPLETION value (or
+ * consumes the GENRET sentinel, promoting the parked .return value), a
+ * spawn wrapper that only ALLOCATES the suspended fiber, and the
+ * never-started teardown that drops the packed (+1) arguments. */
+export function emitGenScaffolding(emitter: LlEmitter): string[] {
+  const out: string[] = [];
+  for (const fn of emitter.mod.functions) {
+    if (fn.generator === undefined) continue;
+    const { definitions, pack, lifted, fieldTys, ret, tr, spawnParams, argPackLines } =
+      emitter.emitArgPackAndTrampolinePrologue(fn);
+    for (const line of definitions) out.push(line);
+    emitter.declare(`declare zeroext i1 @scr_exc_genret_pending()`);
+    emitter.declare(`declare void @scr_exc_clear()`);
+    emitter.declare(`declare ptr @scr_gen_of_fiber(ptr)`);
+    emitter.declare(`declare void @scr_gen_ret_to_out(ptr)`);
+    emitter.declare(`declare ptr @scr_gen_new(ptr, ptr, ptr)`);
+    emitter.needOom();
+    const coroBody = emitter.coroLowered(fn);
+    if (lifted && !coroBody) {
+      emitter.declare(`declare void @scr_closure_release(ptr)`);
+    }
+    // Normal completion stores the (typed) return value; void completes
+    // with the NONE slot — JS's undefined done-value. A GENRET unwind
+    // consumes the sentinel and promotes the parked .return value; a
+    // real exception stays pending (the consumer-side resume moves it).
+    if (coroBody) {
+      tr.push(`  ret void`, `}`, ``);
+    } else {
+      tr.push(
+        `  %g = call ptr @scr_gen_of_fiber(ptr %self)`,
+        ...emitter.pendingTestLines("%pend"),
+        `  br i1 %pend, label %thrown, label %clean`,
+        `clean:`,
+      );
+      switch (ret.kind) {
+        case "void":
+          tr.push(`  br label %done ; void body: the done value is undefined (NONE)`);
+          break;
+        case "f64":
+        case "date":
+          emitter.declare(`declare void @scr_gen_out_f64(ptr, double)`);
+          tr.push(`  call void @scr_gen_out_f64(ptr %g, double %r)`, `  br label %done`);
+          break;
+        case "bool":
+          emitter.declare(`declare void @scr_gen_out_bool(ptr, i1 zeroext)`);
+          tr.push(`  call void @scr_gen_out_bool(ptr %g, i1 %r)`, `  br label %done`);
+          break;
+        default: {
+          const v = vAdapters(emitter.shapeHost, ret);
+          emitter.declare(`declare void @scr_gen_out_ref(ptr, ptr, ptr)`);
+          tr.push(
+            `  call void @scr_gen_out_ref(ptr %g, ptr %r, ptr ${v.release})`,
+            `  br label %done`,
+          );
+        }
+      }
+      tr.push(
+        `thrown:`,
+        `  %genret = call zeroext i1 @scr_exc_genret_pending()`,
+        `  br i1 %genret, label %promote, label %dropdummy`,
+        `promote:`,
+        `  call void @scr_exc_clear()`,
+        `  call void @scr_gen_ret_to_out(ptr %g)`,
+        `  br label %dropdummy`,
+        `dropdummy:`,
+      );
+      if (ret.kind !== "void" && isRefCounted(ret)) {
+        tr.push(
+          `  call void ${releaseSym(emitter.shapeHost, ret)}(ptr %r) ; unwound: the never-read dummy`,
+        );
+      }
+      tr.push(`  br label %done`, `done:`, `  ret void`, `}`, ``);
+    }
+    for (const line of tr) out.push(line);
+
+    let settleAsync: string | null = null;
+    if (fn.async) {
+      emitter.declare(`declare ptr @scr_async_gen_new(ptr, ptr, ptr, ptr)`);
+      const genT: IrType & { kind: "generator" } = {
+        kind: "generator",
+        async: true,
+        yieldT: fn.generator.yieldT,
+        retT: ret,
+        nextT: fn.generator.nextT,
+      };
+      const resultT = fn.generator.resultType;
+      const build = emitter.genResultThunkFor(genT, resultT);
+      settleAsync = `${build}_async`;
+      const settleKey = `ags:${typeKey(genT)}`;
+      if (!emitter.resolveThunks.has(settleKey)) {
+        emitter.resolveThunks.set(settleKey, settleAsync);
+        const adapters = vAdapters(emitter.shapeHost, resultT);
+        emitter.resolveThunkDefs.push(
+          `define internal void @${settleAsync}(ptr %g, ptr %p) ${FN_ATTRS} {`,
+          `entry:`,
+          `  %r = call ptr @${build}(ptr %g)`,
+          `  call void @scr_promise_fulfill_ref(ptr %p, ptr %r, ptr ${adapters.retain}, ptr ${adapters.release}, ptr ${traceArg(emitter.shapeHost, resultT)})`,
+          `  ret void`,
+          `}`,
+          ``,
+        );
+      }
+      emitter.declare(`declare void @scr_promise_fulfill_ref(ptr, ptr, ptr, ptr, ptr)`);
+    }
+
+    // The never-started teardown: drop the packed (+1) arguments.
+    const dr: string[] = [
+      `define internal void @${mangleGenDrop(fn.name)}(ptr %ap) ${FN_ATTRS} {`,
+      `entry:`,
+    ];
+    fieldTys.forEach((ty, i) => {
+      const pType = lifted && i === 0 ? null : fn.params[lifted ? i - 1 : i]!.type;
+      const refcounted = pType === null || isRefCounted(pType);
+      if (!refcounted) return;
+      dr.push(
+        `  %dp${i} = getelementptr inbounds %${pack}, ptr %ap, i64 0, i32 ${i}`,
+        `  %dv${i} = load ptr, ptr %dp${i}`,
+      );
+      if (pType === null) {
+        emitter.declare(`declare void @scr_closure_release(ptr)`);
+        dr.push(`  call void @scr_closure_release(ptr %dv${i})`);
+      } else {
+        dr.push(`  call void ${releaseSym(emitter.shapeHost, pType)}(ptr %dv${i})`);
+      }
+    });
+    dr.push(`  call void @free(ptr %ap)`, `  ret void`, `}`, ``);
+    for (const line of dr) out.push(line);
+
+    // An iterator helper's return() before its first next() closes the
+    // source generator in its first argument slot.
+    const closesSource = fn.generator.closesSource === true;
+    if (fn.generator.tag !== undefined) emitter.declare(`declare void @scr_gen_set_tag(ptr, ptr)`);
+    if (fn.generator.inheritsTag === true)
+      emitter.declare(`declare void @scr_gen_copy_tag(ptr, ptr)`);
+    if (closesSource) {
+      const field = lifted ? 1 : 0;
+      emitter.declare(`declare void @scr_gen_close(ptr)`);
+      emitter.declare(`declare void @scr_gen_set_unstarted_return(ptr, ptr)`);
+      out.push(
+        `define internal void @${mangleGenSourceClose(fn.name)}(ptr %ap) ${FN_ATTRS} {`,
+        `entry:`,
+        `  %sp = getelementptr inbounds %${pack}, ptr %ap, i64 0, i32 ${field}`,
+        `  %sv = load ptr, ptr %sp`,
+        `  call void @scr_gen_close(ptr %sv)`,
+        `  ret void`,
+        `}`,
+        ``,
+      );
+    }
+
+    // Spawn wrapper: pack the args (+1 moves in), allocate the
+    // SUSPENDED fiber — nothing runs until the first .next().
+    if (lifted) {
+      emitter.declare(`declare ptr @scr_closure_retain_v(ptr)`);
+    }
+    const sp: string[] = [
+      `define internal ptr @${mangleGenSpawn(fn.name)}(${spawnParams.join(", ")}) ${FN_ATTRS} { ; gen spawn ${fn.name}`,
+      `entry:`,
+      ...argPackLines,
+    ];
+    const genNew = coroBody && !emitter.wasi ? "scr_gen_new_stackless" : "scr_gen_new";
+    if (genNew !== "scr_gen_new") emitter.declare(`declare ptr @${genNew}(ptr, ptr, ptr)`);
+    sp.push(
+      settleAsync === null
+        ? `  %gg = call ptr @${genNew}(ptr @${mangleTrampoline(fn.name)}, ptr %ap, ptr @${mangleGenDrop(fn.name)})`
+        : `  %gg = call ptr @scr_async_gen_new(ptr @${mangleTrampoline(fn.name)}, ptr %ap, ptr @${mangleGenDrop(fn.name)}, ptr @${settleAsync})`,
+      ...(fn.generator.tag !== undefined
+        ? [`  call void @scr_gen_set_tag(ptr %gg, ptr ${emitter.cstr(fn.generator.tag)})`]
+        : []),
+      ...(fn.generator.inheritsTag === true
+        ? [`  call void @scr_gen_copy_tag(ptr %gg, ptr %a${lifted ? 1 : 0})`]
+        : []),
+      ...(closesSource
+        ? [
+            `  call void @scr_gen_set_unstarted_return(ptr %gg, ptr @${mangleGenSourceClose(fn.name)})`,
+          ]
+        : []),
+      `  ret ptr %gg`,
+      `}`,
+      ``,
+    );
+    for (const line of sp) out.push(line);
+  }
+  return out;
+}
+
+/** Per-async-function machinery — async.ts's scaffolding, .ll
+ * flavored: an argument-pack struct type, a fiber trampoline (unpacks,
+ * frees the pack, runs the ordinary compiled body, settles the
+ * promise — fulfilling on clean return, leaving a pending exception
+ * for the runtime to reject with), and a spawn wrapper call sites and
+ * closures enter through (packs the args +1, scr_async_spawn runs the
+ * fiber eagerly to its first suspension and returns the promise). */
+export function emitAsyncScaffolding(emitter: LlEmitter): string[] {
+  const out: string[] = [];
+  if (emitter.wasi) {
+    emitter.declare(`declare void @llvm.coro.resume(ptr)`);
+    emitter.declare(`declare void @llvm.coro.destroy(ptr)`);
+    out.push(
+      `define void @scr_wasi_coro_resume(ptr %handle) ${FN_ATTRS} {`,
+      `entry:`,
+      `  call void @llvm.coro.resume(ptr %handle)`,
+      `  ret void`,
+      `}`,
+      `define void @scr_wasi_coro_destroy(ptr %handle) ${FN_ATTRS} {`,
+      `entry:`,
+      `  call void @llvm.coro.destroy(ptr %handle)`,
+      `  ret void`,
+      `}`,
+      ``,
+    );
+  }
+  const fiberless = emitter.fiberlessAsyncFunctions();
+  for (const fn of emitter.mod.functions) {
+    if (fn.async !== true || fn.generator !== undefined) continue;
+    if (fiberless.has(fn.name) && emitter.awaitCallees.has(fn.name)) {
+      for (const line of emitter.emitAsyncAwaitCall(fn, null)) out.push(line);
+    }
+    if (fiberless.has(fn.name) && emitter.adoptCallees.has(fn.name)) {
+      for (const line of emitter.emitAsyncAwaitCall(fn, null, true)) out.push(line);
+    }
+    if (emitter.inlineAwaitCallees.has(fn.name)) {
+      for (const line of emitter.emitAsyncInlineAwaitCall(fn)) out.push(line);
+    }
+    if (fiberless.has(fn.name)) {
+      const fieldTys = [
+        ...(fn.captures !== undefined ? ["ptr"] : []),
+        ...fn.params.map((p) => emitter.llType(p.type)),
+      ];
+      const params = fieldTys.map((ty, i) => `${ty} %a${i}`);
+      for (const line of emitter.emitFiberlessAsyncSpawn(fn, params)) out.push(line);
+      continue;
+    }
+    const { definitions, ret, tr, spawnParams, argPackLines } =
+      emitter.emitArgPackAndTrampolinePrologue(fn);
+    for (const line of definitions) out.push(line);
+    if (emitter.awaitCallees.has(fn.name)) {
+      for (const line of emitter.emitAsyncAwaitCall(fn, argPackLines)) out.push(line);
+    }
+    if (emitter.adoptCallees.has(fn.name)) {
+      for (const line of emitter.emitAsyncAwaitCall(fn, argPackLines, true)) out.push(line);
+    }
+    const stackless = emitter.stacklessAsync.has(fn.name);
+    const spawn = stackless ? "scr_async_spawn_stackless" : "scr_async_spawn";
+    emitter.declare(`declare ptr @scr_fiber_promise(ptr)`);
+    emitter.declare(`declare ptr @${spawn}(ptr, ptr)`);
+    emitter.needOom();
+    if (emitter.wasi || stackless) {
+      // The coroutine body settles its own promise and owns the retained
+      // lifted environment until final suspension. Its initial call
+      // returns here at the first suspend (or final suspend).
+      tr.push(`  ret void`, `}`, ``);
+    } else {
+      if (fn.captures !== undefined) {
+        emitter.declare(`declare void @scr_closure_release(ptr)`);
+      }
+      tr.push(
+        ...emitter.pendingTestLines("%pend"),
+        `  br i1 %pend, label %thrown, label %clean`,
+        `clean:`,
+        `  %pr = call ptr @scr_fiber_promise(ptr %self)`,
+      );
+      for (const line of emitter.asyncFulfillLines(ret, "%pr")) tr.push(line);
+      tr.push(`  ret void`, `thrown:`);
+      if (ret.kind !== "void" && isRefCounted(ret)) {
+        // An escaping throw means %r is the never-read dummy (NULL).
+        tr.push(`  call void ${releaseSym(emitter.shapeHost, ret)}(ptr %r)`);
+      }
+      tr.push(`  ret void`, `}`, ``);
+    }
+    for (const line of tr) out.push(line);
+
+    // Spawn wrapper: pack the args (+1 moves in), spawn the fiber.
+    const cache = fn.asyncCacheGlobal !== undefined ? mangleGlobal(fn.asyncCacheGlobal) : null;
+    const cycleCache =
+      fn.asyncCycleCacheGlobal !== undefined ? mangleGlobal(fn.asyncCycleCacheGlobal) : null;
+    if (cache !== null || cycleCache !== null) {
+      emitter.declare(`declare ptr @scr_promise_retain_v(ptr)`);
+      emitter.declare(`declare void @scr_promise_release(ptr)`);
+    }
+    if (cache !== null) {
+      emitter.declare(`declare void @scr_promise_mark_handled(ptr)`);
+    }
+    if (fn.captures !== undefined) {
+      emitter.declare(`declare ptr @scr_closure_retain_v(ptr)`);
+    }
+    const sp: string[] = [
+      `define internal ptr @${mangleAsyncSpawn(fn.name)}(${spawnParams.join(", ")}) ${FN_ATTRS} { ; spawn ${fn.name}`,
+      `entry:`,
+      ...(cache !== null
+        ? [
+            `  %cached = load ptr, ptr @${cache}`,
+            `  %cache_hit = icmp ne ptr %cached, null`,
+            `  br i1 %cache_hit, label %cached_return, label %cache_miss`,
+            `cached_return:`,
+            `  %cached_owned = call ptr @scr_promise_retain_v(ptr %cached)`,
+            `  ret ptr %cached_owned`,
+            `cache_miss:`,
+          ]
+        : []),
+      ...argPackLines,
+    ];
+    sp.push(
+      `  %p = call ptr @${spawn}(ptr @${mangleTrampoline(fn.name)}, ptr %ap)`,
+      ...(cache !== null
+        ? [
+            // The module loader owns this evaluation promise
+            // immediately. A later sibling can throw before the
+            // aggregate dependency wait is built, but this rejection
+            // must never become an unrelated unhandled rejection.
+            `  call void @scr_promise_mark_handled(ptr %p)`,
+          ]
+        : []),
+      ...(cache !== null
+        ? [
+            `  %cache_owned = call ptr @scr_promise_retain_v(ptr %p)`,
+            // The eager spawn may have re-entered this guarded module
+            // through an admitted async cycle and installed a temporary
+            // cache entry. Drop that owned slot before replacing it
+            // with the outer evaluation promise.
+            `  %replaced_cache = load ptr, ptr @${cache}`,
+            `  call void @scr_promise_release(ptr %replaced_cache)`,
+            `  store ptr %cache_owned, ptr @${cache}`,
+          ]
+        : []),
+      ...(cycleCache !== null
+        ? [
+            // Eager recursive spawns publish from the inside out. The
+            // runtime-requested outermost member writes last and is the
+            // SCC's actual evaluation root.
+            `  %cycle_cache_owned = call ptr @scr_promise_retain_v(ptr %p)`,
+            `  %replaced_cycle_cache = load ptr, ptr @${cycleCache}`,
+            `  call void @scr_promise_release(ptr %replaced_cycle_cache)`,
+            `  store ptr %cycle_cache_owned, ptr @${cycleCache}`,
+          ]
+        : []),
+      `  ret ptr %p`,
+      `}`,
+      ``,
+    );
+    for (const line of sp) out.push(line);
+  }
+  for (const line of emitter.emitGenScaffolding()) out.push(line);
+  return out;
+}
+
+/** The await-call entry of an async function (`sc_aw_*`): one direct
+ * `await f(...)` as a call returning the awaited value, so the call site
+ * needs no promise of its own. A fiberless body runs on the caller's
+ * stack as in its spawn wrapper; a clean result then takes the await's
+ * one microtask turn (scr_await_hop) and is returned without ever
+ * materializing the promise, which nothing else could observe. A throw
+ * builds the rejected promise exactly as the spawn wrapper would and
+ * awaits it, so the rejection reaches the awaiter on the same turn. Other
+ * bodies pack their arguments as the spawn wrapper does and enter
+ * scr_async_spawn_await_*, which parks the caller on the promise as soon
+ * as the body first suspends. The adopting entry (`sc_ad_*`, for
+ * `return f(...)` in an async function) adds the turn of the then job
+ * that adopts the returned promise, before the await proper. */
+export function emitAsyncAwaitCall(
+  emitter: LlEmitter,
+  fn: IrFunction,
+  argPackLines: string[] | null,
+  adopt: boolean,
+): string[] {
+  const ret = fn.returnType;
+  const retTy = emitter.llType(ret);
+  const params = fn.params.map((p, i) => `${emitter.llType(p.type)} %a${i}`);
+  const awaitLine = (dest: string, promise: string): string => {
+    switch (ret.kind) {
+      case "void":
+        emitter.declare(`declare void @scr_await_void(ptr)`);
+        return `  call void @scr_await_void(ptr ${promise})`;
+      case "f64":
+      case "date":
+        emitter.declare(`declare double @scr_await_f64(ptr)`);
+        return `  ${dest} = call double @scr_await_f64(ptr ${promise})`;
+      case "bool":
+        emitter.declare(`declare zeroext i1 @scr_await_bool(ptr)`);
+        return `  ${dest} = call zeroext i1 @scr_await_bool(ptr ${promise})`;
+      case "string":
+        emitter.declare(`declare ptr @scr_await_str(ptr)`);
+        return `  ${dest} = call ptr @scr_await_str(ptr ${promise})`;
+      default:
+        emitter.declare(`declare ptr @scr_await_ref(ptr)`);
+        return `  ${dest} = call ptr @scr_await_ref(ptr ${promise})`;
+    }
+  };
+  const retLine = (v: string): string => (retTy === "void" ? `  ret void` : `  ret ${retTy} ${v}`);
+  const head = adopt
+    ? `define internal ${retTy} @${mangleAsyncAdoptCall(fn.name)}(${params.join(", ")}) ${FN_ATTRS} { ; adopt ${fn.name}`
+    : `define internal ${retTy} @${mangleAsyncAwaitCall(fn.name)}(${params.join(", ")}) ${FN_ATTRS} { ; await ${fn.name}`;
+  const args = params.join(", ");
+  if (adopt && argPackLines !== null) {
+    // A body that may suspend settles later than the adoption's then job
+    // runs: materialize its promise, take that turn, then await it.
+    emitter.declare(`declare void @scr_await_hop()`);
+    emitter.declare(`declare void @scr_promise_release(ptr)`);
+    return [
+      head,
+      `entry:`,
+      `  %p = call ptr @${mangleAsyncSpawn(fn.name)}(${args})`,
+      `  call void @scr_await_hop()`,
+      awaitLine("%v", "%p"),
+      `  call void @scr_promise_release(ptr %p)`,
+      retLine("%v"),
+      `}`,
+      ``,
+    ];
+  }
+  if (argPackLines !== null && emitter.stacklessAsync.has(fn.name)) {
+    // A stackless body's eager prefix already runs on the awaiter's
+    // stack, which then awaits the promise like the two separate steps.
+    emitter.declare(`declare void @scr_promise_release(ptr)`);
+    return [
+      head,
+      `entry:`,
+      `  %p = call ptr @${mangleAsyncSpawn(fn.name)}(${args})`,
+      awaitLine("%v", "%p"),
+      `  call void @scr_promise_release(ptr %p)`,
+      retLine("%v"),
+      `}`,
+      ``,
+    ];
+  }
+  if (argPackLines !== null) {
+    const kind =
+      ret.kind === "void"
+        ? "void"
+        : ret.kind === "f64" || ret.kind === "date"
+          ? "f64"
+          : ret.kind === "bool"
+            ? "bool"
+            : ret.kind === "string"
+              ? "str"
+              : "ref";
+    const cret = kind === "bool" ? "zeroext i1" : retTy;
+    emitter.declare(`declare ${cret} @scr_async_spawn_await_${kind}(ptr, ptr)`);
+    emitter.needOom();
+    const call = `call ${cret} @scr_async_spawn_await_${kind}(ptr @${mangleTrampoline(fn.name)}, ptr %ap)`;
+    return [
+      head,
+      `entry:`,
+      ...argPackLines,
+      kind === "void" ? `  ${call}` : `  %v = ${call}`,
+      retLine("%v"),
+      `}`,
+      ``,
+    ];
+  }
+  emitter.declare(`declare void @scr_async_inline_enter(ptr)`);
+  emitter.declare(`declare void @scr_async_inline_exit(ptr)`);
+  emitter.declare(`declare void @scr_await_hop()`);
+  emitter.declare(`declare ptr @scr_promise_new()`);
+  emitter.declare(`declare void @scr_promise_reject_pending(ptr)`);
+  emitter.declare(`declare void @scr_promise_release(ptr)`);
+  const bodyCall = `call ${retTy} @${mangleFunction(fn.name)}(${args})`;
+  const out = [
+    head,
+    `entry:`,
+    `  %frame = alloca { ptr, ptr }`,
+    `  call void @scr_async_inline_enter(ptr %frame)`,
+    retTy === "void" ? `  ${bodyCall}` : `  %r = ${bodyCall}`,
+    ...emitter.pendingTestLines("%pend"),
+    `  call void @scr_async_inline_exit(ptr %frame)`,
+    // Adopting: the then job's turn comes before the settled promise's
+    // own reaction, whichever way the body completed.
+    ...(adopt ? [`  call void @scr_await_hop()`] : []),
+    `  br i1 %pend, label %thrown, label %clean`,
+    `clean:`,
+    `  call void @scr_await_hop()`,
+    retLine("%r"),
+    `thrown:`,
+  ];
+  if (ret.kind !== "void" && isRefCounted(ret)) {
+    // An escaping throw means %r is the never-read dummy (NULL).
+    out.push(`  call void ${releaseSym(emitter.shapeHost, ret)}(ptr %r)`);
+  }
+  out.push(
+    `  %p = call ptr @scr_promise_new()`,
+    `  call void @scr_promise_reject_pending(ptr %p)`,
+    awaitLine("%v", "%p"),
+    `  call void @scr_promise_release(ptr %p)`,
+    retLine("%v"),
+    `}`,
+    ``,
+  );
+  return out;
+}
+
+/** Move a clean async return value into the current fiber's promise. */
+export function emitWasiFulfill(emitter: LlEmitter, v: LlValue | null): void {
+  const coro = emitter.currentCoro;
+  if (coro === null)
+    throw new InternalCompilerError("llvm emitter bug: wasm fulfillment outside async body");
+  const ret = emitter.currentReturnType;
+  if (coro.kind === "generator") {
+    emitter.declare(`declare ptr @scr_gen_of_fiber(ptr)`);
+    const gen = emitter.B.tmp();
+    emitter.B.line(`${gen} = call ptr @scr_gen_of_fiber(ptr ${coro.self})`);
+    switch (ret.kind) {
+      case "void":
+        return;
+      case "f64":
+      case "date":
+        emitter.declare(`declare void @scr_gen_out_f64(ptr, double)`);
+        emitter.B.line(`call void @scr_gen_out_f64(ptr ${gen}, double ${v!.name})`);
+        return;
+      case "bool":
+        emitter.declare(`declare void @scr_gen_out_bool(ptr, i1 zeroext)`);
+        emitter.B.line(`call void @scr_gen_out_bool(ptr ${gen}, i1 ${v!.name})`);
+        return;
+      default:
+        emitter.declare(`declare void @scr_gen_out_ref(ptr, ptr, ptr)`);
+        emitter.B.line(
+          `call void @scr_gen_out_ref(ptr ${gen}, ptr ${v!.name}, ptr ${vAdapters(emitter.shapeHost, ret).release})`,
+        );
+        return;
+    }
+  }
+  emitter.declare(`declare ptr @scr_fiber_promise(ptr)`);
+  const pr = emitter.B.tmp();
+  emitter.B.line(`${pr} = call ptr @scr_fiber_promise(ptr ${coro.self})`);
+  switch (ret.kind) {
+    case "void":
+      emitter.declare(`declare void @scr_promise_fulfill_void(ptr)`);
+      emitter.B.line(`call void @scr_promise_fulfill_void(ptr ${pr})`);
+      break;
+    case "f64":
+    case "date":
+      emitter.declare(`declare void @scr_promise_fulfill_f64(ptr, double)`);
+      emitter.B.line(`call void @scr_promise_fulfill_f64(ptr ${pr}, double ${v!.name})`);
+      break;
+    case "bool":
+      emitter.declare(`declare void @scr_promise_fulfill_bool(ptr, i1 zeroext)`);
+      emitter.B.line(`call void @scr_promise_fulfill_bool(ptr ${pr}, i1 ${v!.name})`);
+      break;
+    case "string":
+      emitter.declare(`declare void @scr_promise_fulfill_str(ptr, ptr)`);
+      emitter.B.line(`call void @scr_promise_fulfill_str(ptr ${pr}, ptr ${v!.name}) ; moves in`);
+      break;
+    case "dyn":
+      emitter.declare(`declare void @scr_promise_resolve_dyn(ptr, ptr)`);
+      emitter.B.line(`call void @scr_promise_resolve_dyn(ptr ${pr}, ptr ${v!.name}) ; moves in`);
+      break;
+    default: {
+      const rc = vAdapters(emitter.shapeHost, ret);
+      emitter.declare(`declare void @scr_promise_fulfill_ref(ptr, ptr, ptr, ptr, ptr)`);
+      emitter.B.line(
+        `call void @scr_promise_fulfill_ref(ptr ${pr}, ptr ${v!.name}, ptr ${rc.retain}, ptr ${rc.release}, ptr ${traceArg(emitter.shapeHost, ret)})`,
+      );
+    }
+  }
+}
+
+/** The argument-pack ABI and trampoline prefix shared by async functions
+ * and generators. Their promise/generator completion and spawn tails stay
+ * with the callers below. */
+export function emitArgPackAndTrampolinePrologue(
+  emitter: LlEmitter,
+  fn: IrFunction,
+): LlArgPackAndTrampolinePrologue {
+  const pack = mangleArgPack(fn.name);
+  const lifted = fn.captures !== undefined;
+  const fieldTys = [...(lifted ? ["ptr"] : []), ...fn.params.map((p) => emitter.llType(p.type))];
+  const definitions = [`%${pack} = type { ${fieldTys.join(", ") || "i8"} } ; ${fn.name} args`];
+  const sizeOf = `ptrtoint (ptr getelementptr (%${pack}, ptr null, i32 1) to ${emitter.sizeType})`;
+
+  // Async argument packs live from the spawn to the trampoline's first
+  // instructions, so they take the runtime's small-block allocator.
+  // Generator packs keep malloc: the runtime frees never-started ones.
+  const smallPack = fn.generator === undefined;
+  const packAlloc = smallPack ? "scr_rt_calloc" : "malloc";
+  const packFree = smallPack ? "scr_rt_free" : "free";
+  emitter.declare(`declare void @${packFree}(ptr)`);
+  emitter.declare(`declare ptr @${packAlloc}(${emitter.sizeType})`);
+
+  const tr: string[] = [
+    `define internal void @${mangleTrampoline(fn.name)}(ptr %self, ptr %ap) ${FN_ATTRS} {`,
+    `entry:`,
+  ];
+  const loads: string[] = [];
+  fieldTys.forEach((ty, i) => {
+    tr.push(
+      `  %fp${i} = getelementptr inbounds %${pack}, ptr %ap, i64 0, i32 ${i}`,
+      `  %a${i} = load ${ty}, ptr %fp${i}`,
+    );
+    loads.push(`${ty} %a${i}`);
+  });
+  tr.push(`  call void @${packFree}(ptr %ap)`);
+  const ret = fn.returnType;
+  const retTy = emitter.llType(ret);
+  const bodyCall = `call ${retTy} @${mangleFunction(fn.name)}(${loads.join(", ")})`;
+  tr.push(retTy === "void" ? `  ${bodyCall}` : `  %r = ${bodyCall}`);
+  if (lifted && !emitter.coroLowered(fn)) {
+    tr.push(`  call void @scr_closure_release(ptr %a0)`);
+  }
+
+  const spawnParams = fieldTys.map((ty, i) => `${ty} %a${i}`);
+  const argPackLines = [
+    `  %ap = call ptr @${packAlloc}(${emitter.sizeType} ${sizeOf})`,
+    `  %isnull = icmp eq ptr %ap, null`,
+    `  br i1 %isnull, label %oom, label %ok`,
+    `oom:`,
+    `  call void @sc_oom()`,
+    `  unreachable`,
+    `ok:`,
+  ];
+  if (lifted) {
+    // scr_closure_retain is a header static inline — the `_v` twin is
+    // the exported symbol.
+    argPackLines.push(`  %env = call ptr @scr_closure_retain_v(ptr %a0)`);
+  }
+  fieldTys.forEach((ty, i) => {
+    const src = lifted && i === 0 ? "%env" : `%a${i}`;
+    argPackLines.push(
+      `  %sp${i} = getelementptr inbounds %${pack}, ptr %ap, i64 0, i32 ${i}`,
+      `  store ${ty} ${src}, ptr %sp${i}`,
+    );
+  });
+  return { definitions, pack, lifted, fieldTys, ret, tr, spawnParams, argPackLines };
+}
+
+/** The module functions whose bodies may park their execution context:
+ * their emitted text mentions a suspension entry point (SUSPENDS), or
+ * they mention such a function (transitively). Null where async bodies
+ * must keep fibers regardless: wasm32 (its coroutine lowering owns async
+ * bodies), worker programs, and programs that use node:test subtests,
+ * whose `t.test()` awaits on the CURRENT fiber even from synchronous
+ * code. */
+export function parkingFunctions(emitter: LlEmitter): Set<string> | null {
+  if (emitter.wasi || emitter.mod.workers === true) return null;
+  for (const decl of emitter.decls) if (/@scr_test_sub\b/.test(decl)) return null;
+  for (const text of emitter.fnDefText.values()) if (/@scr_test_sub\b/.test(text)) return null;
+  // Reverse mention edges, then propagate "may park" to every mentioner.
+  const mentionedBy = new Map<string, Set<string>>();
+  const parks = new Set<string>();
+  const work: string[] = [];
+  for (const [name, text] of emitter.fnDefText) {
+    if (SUSPENDS.test(text)) {
+      parks.add(name);
+      work.push(name);
+    }
+    for (const callee of emitter.mentionedFunctions(text)) {
+      if (callee === name) continue;
+      let callers = mentionedBy.get(callee);
+      if (callers === undefined) mentionedBy.set(callee, (callers = new Set()));
+      callers.add(name);
+    }
+  }
+  while (work.length > 0) {
+    const callers = mentionedBy.get(work.pop()!);
+    if (callers === undefined) continue;
+    for (const caller of callers) {
+      if (parks.has(caller)) continue;
+      parks.add(caller);
+      work.push(caller);
+    }
+  }
+  return parks;
+}
+
+/** Async functions whose calls can skip the fiber (scr_async_inline_*).
+ * A body qualifies only when nothing it runs can park its execution
+ * context: its emitted text, and the text of every module function it
+ * mentions (transitively), contains no suspension entry point. Such a
+ * body always completes before the call returns, which is exactly the
+ * behavior of a fiber that never suspends. Excluded conservatively:
+ * wasm32 (its coroutine lowering owns async bodies), module-evaluation
+ * bodies (their promise caches),
+ * `dyn` results (resolution may adopt a thenable), and every program
+ * that uses node:test subtests — `t.test()` runs a subtest inline and
+ * awaits it on the CURRENT fiber even from synchronous code. Worker
+ * programs keep fibers too: their fiber epilogue owns context
+ * termination (a stopping worker rejects and observes the promise), which
+ * the fiberless wrapper does not reproduce. A missed suspension still
+ * cannot reorder execution undetected: the runtime traps when a context parks while a
+ * fiberless body is on its stack. */
+export function fiberlessAsyncFunctions(emitter: LlEmitter): Set<string> {
+  const parks = emitter.parkingFunctions();
+  const eligible = parks === null ? new Set<string>() : emitter.neverParkingAsync(parks);
+  for (const name of emitter.inlineAwaitCallees)
+    if (!eligible.has(name))
+      throw new InternalCompilerError(`llvm emitter bug: inline await of suspending ${name}`);
+  return eligible;
+}
diff --git a/packages/compiler/src/backend/llvm/emit-module.ts b/packages/compiler/src/backend/llvm/emit-module.ts
new file mode 100644
index 000000000..7d60205e5
--- /dev/null
+++ b/packages/compiler/src/backend/llvm/emit-module.ts
@@ -0,0 +1,2245 @@
+/* LlEmitter's module-level output: module parts, helper definitions, library declarations and FFI callback definitions. */
+import { type LlEmitter, ffiCallbackDummyLl, llStrBytes } from "./emitter.js";
+import {
+  mangleAsyncSpawn,
+  mangleClassObj,
+  mangleFnClosure,
+  mangleFunction,
+  mangleGlobal,
+  mangleVtInstance,
+} from "../mangle.js";
+import {
+  type IrGlobal,
+  type IrType,
+  RUNTIME_ERROR_CLASSES,
+  RUNTIME_EVENT_CLASS,
+  RUNTIME_EVENT_TARGET_CLASS,
+  ffiCallbackType,
+  isFfiContextParam,
+  isRefCounted,
+  typeKey,
+} from "../../ir/ir.js";
+import {
+  FN_ATTRS,
+  limitInlineDynReleases,
+  releaseSym,
+  typedRefConstructor,
+  vAdapters,
+} from "./shapes.js";
+import { emitLlvmLayouts } from "./layouts.js";
+import { moduleRuntimeFeatures } from "../../ir/runtime-features.js";
+import { emitArraySearchHelpers } from "./array-search.js";
+import { emitClassMembershipHelper } from "./classes.js";
+import { type RegexMatcherCode, compileRegexMatcher } from "./regex-matchers.js";
+import {
+  MAP_ITER_DECL,
+  NUMBER_MAP_ENTRY_DECL,
+  STRING_MAP_ENTRY_DECL,
+} from "./map-number-lookup.js";
+import { RUNTIME_ABI_MARKER } from "../runtime-abi.js";
+import { threadSlotsBlockDefinitions } from "./thread-slots.js";
+import {
+  ABSENT_FIELD_PAYLOAD,
+  exactIndexLines,
+  f64Lit,
+  ffiNativeParamLl,
+  ffiNativeReturnLl,
+  ffiNativeTypeLl,
+} from "./common.js";
+import { literalCapWord, literalCapWord32 } from "./string-key-hash.js";
+import { hasLoneSurrogate, wtf8Bytes } from "../literals.js";
+import { undefinedArmTag } from "../../ir/analysis.js";
+import { NULLABLE_ABSENT, NULLABLE_NULL } from "./nullable-unions.js";
+import { literalEqualityDefinition } from "./string-literal-equality.js";
+import { STRING_READ_HELPERS, stringScanDecl } from "./string-reads.js";
+import { emitLibraryIdentityLines } from "../library-identity-markers.js";
+import { InternalCompilerError } from "../../errors.js";
+
+export function emitModuleParts(emitter: LlEmitter): string[] {
+  // Function bodies first (the literal/unit/fn-value tables fill as they
+  // emit), then the file assembles around them — the runtime ABI’s order.
+  const fnDefs: string[] = [];
+  for (const fn of emitter.mod.functions) {
+    const def = emitter.emitFunction(fn);
+    fnDefs.push(def);
+    emitter.fnDefText.set(fn.name, def);
+  }
+  emitter.selectStacklessAsync(fnDefs);
+  const errorViews: string[] = [];
+  for (const property of ["name", "message"])
+    if (emitter.mod.functions.some((fn) => fn.name === `%error.${property}.read`)) {
+      emitter.declare(`declare void @scr_error_install_${property}_reader(ptr)`);
+      errorViews.push(
+        `  call void @scr_error_install_${property}_reader(ptr @${mangleFunction(`%error.${property}.read`)})`,
+      );
+    }
+  for (const meta of emitter.classMeta.values()) {
+    if (meta.def.runtime || meta.root.def.name !== "%Error") continue;
+    const type: IrType = { kind: "object", className: meta.def.name };
+    const adapter = emitter.liveDynRefAdapter(type);
+    const rc = vAdapters(emitter.shapeHost, type);
+    const key = typeKey(type);
+    const name = `sc_error_view_${errorViews.length}`;
+    emitter.resolveThunkDefs.push(
+      `define internal ptr @${name}(ptr %v) ${FN_ATTRS} {`,
+      `entry:`,
+      `  %d = call ptr ${typedRefConstructor(emitter.shapeHost, type)}(ptr %v, ptr ${rc.retain}, ptr ${rc.release}, ptr ${emitter.cstr(key)}, ${emitter.sizeType} ${Buffer.byteLength(key, "utf8")}, ptr @${adapter.snapshot}, ptr ${adapter.commit})`,
+      `  ret ptr %d`,
+      `}`,
+      ``,
+    );
+    emitter.declare(`declare void @scr_error_register_dyn(ptr, ptr)`);
+    errorViews.push(
+      `  call void @scr_error_register_dyn(ptr @${mangleVtInstance(meta.def.name)}, ptr @${name})`,
+    );
+  }
+  const layouts = emitLlvmLayouts(
+    emitter.shapeHost,
+    emitter.mod,
+    emitter.classMeta,
+    emitter.classObjs,
+    emitter.fnByName,
+    (t) => emitter.llType(t),
+    emitter.nullableFields,
+    emitter.int32Slots,
+  );
+  const shapes = layouts.records;
+  const classShapes = layouts.classes;
+  const classObjDefs = layouts.classObjects;
+  const wrappers = emitter.emitFnValueDefs();
+  const asyncDefs = emitter.emitAsyncScaffolding();
+  const ffiCallbacks = emitter.emitFfiCallbackDefs();
+  const hasNoInlineRecordClone = [...emitter.recordCloneShapes].some(
+    (shapeId) => (emitter.recordsById.get(shapeId)?.fields.length ?? 0) >= 16,
+  );
+
+  // Module globals, FIRST OCCURRENCE per id: a class-expression static
+  // instantiated through several mixin applications registers one global
+  // id several times (2041-mixin-values) — C's tentative definitions
+  // accept the duplicates without an error, LLVM rejects redefinition, so the
+  // storage AND the release emit once per id here.
+  const seenGlobalIds = new Set<string>();
+  const globals = (emitter.mod.globals ?? []).filter((g) => {
+    if (seenGlobalIds.has(g.id)) return false;
+    seenGlobalIds.add(g.id);
+    return true;
+  });
+  // Refcounted globals release before main returns — the runtime ABI’s
+  // sc_release_globals, keeping the RC audit's live count exact. Built
+  // before the declaration table flushes (it adds the release symbols).
+  // Two spellings with distinct temp names: the normal exit and the
+  // uncaught-exception exit are separate blocks of the same function.
+  // Interned function-value closures are IMMORTAL (rc == SIZE_MAX), so
+  // an own-property table Object.defineProperties hung on one would
+  // outlive the RC audit — release it with the globals (the runtime ABI’s
+  // sc_release_globals tail). Only when the dispatch unit is even
+  // linked (defineProps is the only writer).
+  const runtimeFeatures = moduleRuntimeFeatures(emitter.mod);
+  const fnValueProps = [...emitter.fnValues];
+  if (fnValueProps.length > 0) emitter.declare(`declare void @scr_box_release(ptr)`);
+  if (emitter.classObjs.size > 0)
+    emitter.declare(`declare void @scr_classobj_clear_properties(ptr)`);
+  const globalReleaseLines = (prefix: string): string[] => {
+    const lines: string[] = [];
+    globals.forEach((g, i) => {
+      if (!isRefCounted(g.type)) return;
+      lines.push(
+        `  %${prefix}${i} = load ptr, ptr @${mangleGlobal(g.id)}`,
+        `  call void ${releaseSym(emitter.shapeHost, g.type)}(ptr %${prefix}${i}) ; ${g.name}`,
+      );
+    });
+    fnValueProps.forEach((name, i) => {
+      // props sits at %ScrClosure field 3; release is NULL-tolerant —
+      // cleared so a second release path stays idempotent.
+      lines.push(
+        `  %${prefix}fp${i} = load ptr, ptr getelementptr inbounds (%ScrClosure, ptr @${mangleFnClosure(name)}, i64 0, i32 3)`,
+        `  call void @scr_box_release(ptr %${prefix}fp${i}) ; ${name}.props`,
+        `  store ptr null, ptr getelementptr inbounds (%ScrClosure, ptr @${mangleFnClosure(name)}, i64 0, i32 3)`,
+      );
+    });
+    for (const name of emitter.classObjs.keys())
+      lines.push(`  call void @scr_classobj_clear_properties(ptr @${mangleClassObj(name)})`);
+    return lines;
+  };
+  // Exit listeners can read MODULE GLOBALS directly, so they must run
+  // BEFORE the global releases (the runtime ABI’s runExitListeners
+  // ordering — the atexit half becomes an idempotent no-op).
+  const usesEvents = runtimeFeatures.processEvents;
+  const usesChildProcess = runtimeFeatures.childProcess;
+  const usesFsWatch = runtimeFeatures.fsWatch;
+  // Stream-surface programs fill the loop's stream hook (the deferred
+  // next-tick emissions) and the emitter's post-registration flow kick
+  // before %main — scr_stream.c links only when the line is emitted
+  // (native/executable.ts gates on the same predicate).
+  const usesStream = runtimeFeatures.stream;
+  // Net-surface programs fill the loop's net hooks (and the netSocket
+  // handle-dispatch ops for the checked-dynamic boundary); http-surface
+  // programs additionally stamp the httpReq/httpRes ops — the C main's
+  // install lines, gated on the same predicates native/executable.ts links by.
+  const usesNet = runtimeFeatures.net;
+  const usesDgram = runtimeFeatures.dgram;
+  const usesHttp2 = runtimeFeatures.http2;
+  const usesHttp = runtimeFeatures.http;
+  // Fetch-referencing programs register native fetch before main.
+  // Runtime selection compiles scr_fetch.c on the same predicate.
+  const usesFetch = runtimeFeatures.fetch;
+  const snapshotsTlsCa = runtimeFeatures.tls || runtimeFeatures.tlsCa;
+  // The process verdict has the same precedence as the C reference
+  // emitter: node:test owns the final status when present; otherwise an
+  // embedded process.exitCode owns it; ordinary programs return zero.
+  const usesNodeTest = runtimeFeatures.nodeTest;
+  // Declared NOW — the extern block flushes before main assembles.
+  if (usesEvents) emitter.declare(`declare void @scr_events_install()`);
+  if (usesChildProcess) emitter.declare(`declare void @scr_child_dyn_install()`);
+  const childStreamBoxes =
+    usesChildProcess &&
+    usesStream &&
+    emitter.classMeta.has("%Readable") &&
+    emitter.classMeta.has("%Writable")
+      ? [
+          emitter.dyn.toDynHelper({ kind: "object", className: "%Readable" }),
+          emitter.dyn.toDynHelper({ kind: "object", className: "%Writable" }),
+        ]
+      : null;
+  // worker.stdout and worker.stderr box the stream unit's Readable the
+  // same way, and worker.stdin its Writable when the program has one
+  // (scr_worker_stdio_install, scr_worker_events.c).
+  const workerStdioBox =
+    emitter.mod.workers === true && usesStream && emitter.classMeta.has("%Readable")
+      ? (childStreamBoxes?.[0] ??
+        emitter.dyn.toDynHelper({ kind: "object", className: "%Readable" }))
+      : null;
+  const workerStdinBox =
+    emitter.mod.workers === true && usesStream && emitter.classMeta.has("%Writable")
+      ? (childStreamBoxes?.[1] ??
+        emitter.dyn.toDynHelper({ kind: "object", className: "%Writable" }))
+      : null;
+  if (childStreamBoxes || workerStdioBox || workerStdinBox) {
+    emitter.declare(
+      `@scr_stream_child_ops = external constant { ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr }`,
+    );
+  }
+  if (childStreamBoxes)
+    emitter.declare(`declare void @scr_child_dyn_streams_install(ptr, ptr, ptr)`);
+  if (workerStdioBox || workerStdinBox)
+    emitter.declare(`declare void @scr_worker_stdio_install(ptr, ptr, ptr)`);
+  if (usesFsWatch) emitter.declare(`declare void @scr_watch_install()`);
+  if (emitter.ffiHasForeignCallback) emitter.declare(`declare void @scr_ffi_install()`);
+  if (usesStream) emitter.declare(`declare void @scr_stream_install()`);
+  if (usesNet) {
+    emitter.declare(`declare void @scr_net_install()`);
+    emitter.declare(`declare void @scr_net_dyn_install()`);
+  }
+  if (usesDgram) emitter.declare(`declare void @scr_dgram_install()`);
+  if (usesHttp2) emitter.declare(`declare void @scr_http2_dyn_install()`);
+  if (usesHttp) emitter.declare(`declare void @scr_http_dyn_install()`);
+  if (usesFetch) emitter.declare(`declare void @scr_fetch_install()`);
+
+  if (usesNodeTest) {
+    emitter.declare(`declare i32 @scr_test_exit_code()`);
+    emitter.declare(`declare void @scr_test_init()`);
+  }
+  if (snapshotsTlsCa) {
+    emitter.declare(`declare void @scr_tls_ca_install()`);
+  }
+  // Inline exit listeners run when something they must beat exists:
+  // the refcounted-global releases, or the retained-FFI atexit ledger
+  // sweep (a listener may legitimately release or pump a registration,
+  // and only the inline call orders ahead of every atexit handler —
+  // the runtime ABI’s runExitListeners stance). Plain event programs
+  // with neither keep the atexit path, so their listener timing is
+  // unchanged.
+  const hasRefGlobals = globals.some((g) => isRefCounted(g.type)) || fnValueProps.length > 0;
+  const inlineExitListeners =
+    usesEvents && (emitter.mod.workers || hasRefGlobals || emitter.ffiHasRetainedCallback);
+  emitter.declare(`declare i32 @scr_exit_code_hint_get()`);
+  if (inlineExitListeners) {
+    emitter.declare(`declare void @scr_run_exit_listeners(double)`);
+    emitter.declare(`declare i32 @scr_exit_code_hint_get()`);
+  }
+  const exitListenerLines = (prefix: string): string[] => {
+    if (!inlineExitListeners) return [];
+    return [
+      `  %${prefix}h = call i32 @scr_exit_code_hint_get()`,
+      `  %${prefix}hd = sitofp i32 %${prefix}h to double`,
+      `  call void @scr_run_exit_listeners(double %${prefix}hd)`,
+    ];
+  };
+  // The entry's exits release the module globals only where the thread
+  // frees its heap when its script ends (scr_exit_frees: workers, and
+  // builds that check for leaks); the main thread of other builds leaves
+  // it to the operating system.
+  const exitReleaseLines = (prefix: string): string[] => {
+    const releases = globalReleaseLines(prefix);
+    if (releases.length === 0) return releases;
+    emitter.declare(`declare zeroext i1 @scr_exit_frees()`);
+    return [
+      `  %${prefix}.frees = call zeroext i1 @scr_exit_frees()`,
+      `  br i1 %${prefix}.frees, label %${prefix}.release, label %${prefix}.kept`,
+      `${prefix}.release:`,
+      ...releases,
+      `  br label %${prefix}.kept`,
+      `${prefix}.kept:`,
+    ];
+  };
+  const globalReleases = exitReleaseLines("g");
+  const asyncEntry = emitter.fnByName.get(emitter.mod.entry)?.async === true;
+  const entryMayThrow = emitter.mayThrow.has(emitter.mod.entry);
+  // The event loop runs when timers appeared OR any async/generator
+  // function exists (the C main's hasAsync || hasGenerators ||
+  // usesTimers gate). Generator programs run
+  // the loop too: its exit accounting notes still-suspended generator
+  // fibers as abandoned, so the RC audit downgrades exactly like the
+  // async loop-exhaustion story.
+  const runsLoop =
+    emitter.usesTimers ||
+    emitter.ffiHasForeignCallback ||
+    emitter.mod.functions.some((f) => f.async === true || f.generator !== undefined);
+  const uncaughtReleases = entryMayThrow && !asyncEntry ? exitReleaseLines("gu") : [];
+  const loopReleasesU = runsLoop ? exitReleaseLines("gl") : [];
+  const loopReleasesR = runsLoop ? exitReleaseLines("gr") : [];
+  const topRejectReleases = asyncEntry ? exitReleaseLines("gt") : [];
+  const topPendingReleases = asyncEntry ? exitReleaseLines("gp") : [];
+  const loopReportedReleases = runsLoop ? exitReleaseLines("gq") : [];
+  // main's epilogues read the flag / the loop entry points — declared
+  // HERE, before the extern block flushes. They run once, so they keep
+  // the out-of-line scr_exc_pending call; per-call checks inline the
+  // test (pendingTestLines).
+  if (entryMayThrow || runsLoop) emitter.declare(`declare zeroext i1 @scr_exc_pending()`);
+  if (runsLoop) {
+    emitter.declare(`declare zeroext i1 @scr_loop_run(ptr)`);
+    if (emitter.mod.commonJsEntry === true)
+      emitter.declare(`declare void @scr_loop_commonjs_entry()`);
+    emitter.declare(`declare zeroext i1 @scr_report_unhandled_rejections()`);
+    emitter.declare(`declare void @scr_discard_unhandled_rejections()`);
+  }
+  if (asyncEntry) {
+    emitter.declare(`declare i32 @scr_promise_finish_top_level(ptr)`);
+    emitter.declare(`declare void @scr_promise_rethrow_top_level(ptr)`);
+    emitter.declare(`declare void @scr_promise_release(ptr)`);
+    emitter.declare(`declare void @scr_exit_code_note(i32)`);
+  }
+  const topPendingExitLines = (): string[] => {
+    if (!asyncEntry) return [];
+    const lines: string[] = [];
+    // finish_top_level noted 13 unless the program set process.exitCode.
+    // A failed node:test run outranks either before exit listeners run.
+    if (usesNodeTest) {
+      lines.push(
+        `  %tla_program_exit = call i32 @scr_test_exit_code()`,
+        `  %tla_program_exit_zero = icmp eq i32 %tla_program_exit, 0`,
+        `  %tla_hint = call i32 @scr_exit_code_hint_get()`,
+        `  %tla_exit_status = select i1 %tla_program_exit_zero, i32 %tla_hint, i32 %tla_program_exit`,
+        `  call void @scr_exit_code_note(i32 %tla_exit_status)`,
+      );
+    }
+    for (const line of exitListenerLines("xp")) lines.push(line);
+    for (const line of topPendingReleases) lines.push(line);
+    // An exit listener may set process.exitCode again, as in Node.
+    lines.push(`  %tla_exit_code = call i32 @scr_exit_code_hint_get()`, `  ret i32 %tla_exit_code`);
+    return lines;
+  };
+  // LIBRARY mode: the runtime entry points the generated library
+  // symbols delegate to — declared before the extern block flushes.
+  if (emitter.mod.lib !== undefined) {
+    if (emitter.wasi) {
+      emitter.declare(`declare ptr @malloc(${emitter.sizeType})`);
+      emitter.declare(`declare void @free(ptr)`);
+    }
+    emitter.declare(`declare void @scr_library_entry(i1 zeroext, ptr)`);
+    emitter.declare(`declare void @scr_library_reset()`);
+    emitter.declare(`declare void @scr_library_check_exc()`);
+    emitter.declare(`declare void @scr_library_set_sink(ptr, ptr)`);
+    emitter.declare(`declare void @scr_library_callback_entry_guard(ptr)`);
+    emitter.declare(`declare void @scr_library_arena_reset()`);
+    emitter.declare(`declare void @scr_library_collect()`);
+    if ((emitter.mod.lib.callbacks?.length ?? 0) > 0) {
+      // Host-callback channels: the registration define's dispatch
+      // (strcmp over the declared names + the runtime slot store).
+      // The call-site fetch pair (scr_library_cb_require/_ctx) is
+      // declared at ffiCall emission like every body-driven runtime
+      // symbol.
+      emitter.declare(`declare void @scr_library_cb_set(${emitter.sizeType}, ptr, ptr)`);
+      emitter.declare(`declare i32 @strcmp(ptr, ptr)`);
+    }
+    if (emitter.mod.lib.exports.some((e) => e.params.includes("string"))) {
+      emitter.declare(`declare ptr @scr_library_str_in(ptr, ${emitter.sizeType})`);
+    }
+    if (emitter.mod.lib.exports.some((e) => e.params.includes("bytes"))) {
+      emitter.declare(`declare ptr @scr_library_bytes_in(ptr, ${emitter.sizeType}, ptr)`);
+    }
+    if (emitter.mod.lib.exports.some((e) => e.params.includes("i64"))) {
+      emitter.declare(`declare double @scr_library_i64_in(i64, ptr)`);
+    }
+    if (emitter.mod.lib.exports.some((e) => e.params.includes("u64"))) {
+      emitter.declare(`declare double @scr_library_u64_in(i64, ptr)`);
+    }
+    if (emitter.mod.lib.exports.some((e) => e.returns === "string")) {
+      emitter.declare(`declare void @scr_library_str_out(ptr, ptr, ptr)`);
+    }
+    if (emitter.mod.lib.exports.some((e) => e.returns === "bytes")) {
+      emitter.declare(`declare void @scr_library_bytes_out(ptr, ptr, ptr)`);
+    }
+    if (emitter.mod.lib.exports.some((e) => e.params.includes("cstring"))) {
+      emitter.declare(`declare ptr @scr_library_cstr_in(ptr, ptr)`);
+    }
+    if (emitter.mod.lib.exports.some((e) => e.returns === "cstring")) {
+      emitter.declare(`declare ptr @scr_library_cstr_out(ptr)`);
+    }
+  }
+  // Helpers assemble BEFORE the declaration table flushes (they add
+  // write/abort declarations).
+  const helpers = [
+    ...emitter.helperDefs(),
+    ...emitArraySearchHelpers(emitter.arraySearchKinds, emitter.sizeType, (line) =>
+      emitter.declare(line),
+    ),
+    ...emitClassMembershipHelper(emitter.classMeta, emitter.sizeType),
+    ...(emitter.publishWalkersCache?.defs() ?? []),
+    ...emitter.publishedClassNamesDefs(),
+    ...(emitter.regions?.moduleDefs() ?? []),
+  ];
+  if (emitter.constantNumericTables.size > 0)
+    emitter.declare(`declare double @scr_arr_get_number(ptr, double)`);
+  // Native matchers of the regex literals inside the compiled subset.
+  const regexMatchers = new Map<string, RegexMatcherCode>();
+  for (const [key, re] of emitter.regexInstances) {
+    const code = compileRegexMatcher(
+      `${re.sym}_match`,
+      re.pattern,
+      re.flags,
+      emitter.sizeType,
+      !emitter.wasi,
+    );
+    if (code === null) continue;
+    regexMatchers.set(key, code);
+    for (const decl of code.decls) emitter.declare(decl);
+  }
+
+  const out: string[] = [
+    `; Generated by scriptc (LLVM backend) from ${emitter.mod.sourceFile}. Do not edit.`,
+    ``,
+    // Type shapes shared with the runtime's C ABI. ScrStr is the header
+    // prefix only (the flexible-array tail is concrete per literal);
+    // ScrLogArg is { i32 tag; 8-byte union } — i64 at offset 8 matches
+    // the C layout (4 bytes padding after the tag). ScrUnion/ScrClosure
+    // mirror scr_runtime.h field-for-field (tag reads, slot peeks, the
+    // fn pointer, and the caps[] tail all address through them).
+    `%ScrStr = type { ${emitter.sizeType}, ${emitter.sizeType}, ${emitter.sizeType} }`,
+    `%ScrLogArg = type { i32, i64 }`,
+    `%ScrVt = type { ${emitter.sizeType}, ${emitter.sizeType}, ptr }`,
+    `%ScrUnion = type { ${emitter.sizeType}, i32, ptr, ptr, ptr, i64 }`,
+    `%ScrClosure = type { ${emitter.sizeType}, ptr, ${emitter.sizeType}, ptr, i32, i32, ptr, ptr }`,
+    `%ScrFfiTable = type { ptr, ${emitter.sizeType}, ${emitter.sizeType}, ptr, i8, ptr, ptr, ${emitter.sizeType}, ${emitter.sizeType}, ${emitter.sizeType}, ptr, ptr }`,
+    `%ScrRegex = type { ${emitter.sizeType}, ptr, ptr, ptr, double, ptr, ptr, ptr }`,
+    // ScrArr mirrors scr_runtime.h field-for-field: { rc, len, cap, elem,
+    // cyc, spare, filled, ops, data, present, ext } (field numbers in
+    // SCR_ARR_FIELD), where filled bounds the hole-free prefix, ops points at the element type's constant RC descriptor
+    // (%ScrArrOps, SCR_ELEM_REF only) and ext at the out-of-line sparse,
+    // property and metadata storage (NULL until first used). Live dynamic
+    // stream commits swap its dense, presence and out-of-line storage while
+    // preserving the target object's identity.
+    `%ScrArr = type { ${emitter.sizeType}, ${emitter.sizeType}, ${emitter.sizeType}, i8, i8, i16, i32, ptr, ptr, ptr, ptr }`,
+    `%ScrArrOps = type { ptr, ptr, ptr }`,
+    // The ScrMap prefix { rc, key_kind, val_kind, traced } — the inline
+    // RC fast paths test the traced byte (shapes.ts).
+    ...(emitter.rcHelpers === null ? [] : [`%ScrMapRc = type { ${emitter.sizeType}, i8, i8, i8 }`]),
+    // The complete ScrMap and its { key, val, hash } entry, read by the
+    // inline number-key lookup (sc_map_entry_f64) and the inline
+    // iteration steps (sc_map_iter_entry): field 8 is the i32 entry
+    // count, field 10 the i64 absent-key filter, entries is field 11,
+    // nbuckets and buckets fields 13 and 14, the direct index and its i32
+    // length fields 15 and 16.
+    ...(emitter.decls.has(NUMBER_MAP_ENTRY_DECL) ||
+    emitter.decls.has(STRING_MAP_ENTRY_DECL) ||
+    emitter.decls.has(MAP_ITER_DECL)
+      ? [
+          `%ScrMapIx = type { ${emitter.sizeType}, i8, i8, i8, i8, i32, ptr, ptr, i32, i32, i64, ptr, i32, i32, ptr, ptr, i32, i32 }`,
+        ]
+      : []),
+    // String-keyed reference reads load the value slot of the entry
+    // scr_map_entry_str returns (map-number-lookup.ts).
+    ...(emitter.decls.has(NUMBER_MAP_ENTRY_DECL) ||
+    emitter.decls.has(STRING_MAP_ENTRY_DECL) ||
+    emitter.decls.has(MAP_ITER_DECL)
+      ? [`%ScrMapEntry = type { i64, i64, i64 }`]
+      : []),
+    // The runtime error prefix { rc, vt, name, message, code, cause } and the
+    // class-object shape { rc, pre, post, ctor, name } — field reads on
+    // builtin errors and classval loads GEP through these.
+    `%ScrError = type { ${emitter.sizeType}, ptr, ptr, ptr, ptr, ptr, i8, i8, i8, i8, i8, ptr, ptr }`,
+    `%ScrClassObj = type { ${emitter.sizeType}, ${emitter.sizeType}, ${emitter.sizeType}, ptr, ptr, ${emitter.sizeType}, ${emitter.sizeType}, ptr, ptr }`,
+    // The runtime emitter prefix { rc, vt, reg, cls } — user subclasses
+    // embed it (classes.ts), and bare-emitter GEPs address through it.
+    `%ScrEmitter = type { ${emitter.sizeType}, ptr, ptr, ptr }`,
+    // The runtime stream layout { rc, vt, reg, cls, st } — one struct
+    // for all five stream classes; stream subclasses embed it.
+    `%ScrStream = type { ${emitter.sizeType}, ptr, ptr, ptr, ptr }`,
+    // The EventTarget and Event subclass prefixes { rc, vt, state, cls }.
+    ...(emitter.classMeta.has(RUNTIME_EVENT_TARGET_CLASS)
+      ? [`%ScrEventTargetObj = type { ${emitter.sizeType}, ptr, ptr, ptr }`]
+      : []),
+    ...(emitter.classMeta.has(RUNTIME_EVENT_CLASS)
+      ? [`%ScrEventObj = type { ${emitter.sizeType}, ptr, ptr, ptr }`]
+      : []),
+    // The catch-binding snapshot box { rc, kind, f64, b, payload,
+    // retain_fn, release_fn, trace_fn } — caughtTest kind reads and
+    // caughtNarrow payload extraction GEP through it (offsets match
+    // scr_runtime.h's natural alignment: kind at 8, f64 at 16, b at 24,
+    // payload at 32).
+    `%ScrCaught = type { ${emitter.sizeType}, i32, double, i8, ptr, ptr, ptr, ptr }`,
+    // ScrBytes { rc, len, elem(i32+pad), data, backing, brands, shared }. Indexed
+    // typed-array access GEPs through this directly: the IR type already
+    // fixes elem, so the hot path needs neither a runtime kind load nor
+    // the generic scr_bytes_get/set call.
+    `%ScrBytes = type { ${emitter.sizeType}, ${emitter.sizeType}, i32, ptr, ptr, i8, i8, i8, i8, ptr }`,
+    // The capture box { rc, kind, obj_retain, obj_release, obj_trace,
+    // slot } — TDZ reads peek the payload slot (offset 40) directly.
+    `%ScrBox = type { ${emitter.sizeType}, i32, ptr, ptr, ptr, i64 }`,
+    // The stack buffer of the emitted JSON serializers { data, len, cap }.
+    `%ScrJsonBuf = type { ptr, ${emitter.sizeType}, ${emitter.sizeType}, ptr, ${emitter.sizeType}, ${emitter.sizeType} }`,
+    // The dynCheck error-path spine { parent, key, index } — the emitted
+    // builders stack-allocate one per recursion level (dyn.ts).
+    `%ScrDynPath = type { ptr, ptr, ${emitter.sizeType} }`,
+    `%ScrIslandModule = type { ptr, ptr, ${emitter.sizeType}, ${emitter.sizeType}, i32, ptr, ${emitter.sizeType}, ${emitter.sizeType} }`,
+    `%ScrIslandEdge = type { ptr, ptr, ptr, i32 }`,
+    // A generator's prefix { rc, receiver, fiber, state, out } and its
+    // value slot { kind, f64, b, payload, release_fn } (scr_async.c pins
+    // both): number and boolean yields and drives address OUT directly.
+    ...(emitter.usesGenSlots
+      ? [
+          `%ScrGenSlot = type { i32, double, i8, ptr, ptr }`,
+          `%ScrGenHead = type { ${emitter.sizeType}, ptr, ptr, i32, %ScrGenSlot }`,
+        ]
+      : []),
+  ];
+  for (const line of shapes.typeDefs) out.push(line);
+  for (const line of classShapes.typeDefs) out.push(line);
+  // Thread-instanced library state (abi.instance_per_thread): the
+  // program TU's mutable globals — module globals, run-once guards, the
+  // lazily-compiled regex literal caches — and the runtime globals its
+  // init stamps live in thread-local storage, matching the runtime
+  // objects compiled with -DSCR_THREAD_INSTANCES. Immutable interned
+  // data (string literals, unit arms, template arrays, vtables) stays
+  // shared.
+  const tl =
+    emitter.mod.workers === true || emitter.mod.lib?.threadInstances === true
+      ? "thread_local "
+      : "";
+  out.push(
+    ``,
+    `@scr_error_vts = external ${tl}global [${RUNTIME_ERROR_CLASSES.size} x %ScrVt]`,
+    `declare void @scr_init()`,
+    `declare void @scr_lib_init(i32, ptr)`,
+    ...(emitter.mod.workers ? [`declare void @scr_runtime_workers_v8()`] : []),
+    ...(emitter.stackChecks?.size ? [`declare void @scr_stack_guard_init()`] : []),
+    ...(emitter.runtimeAbiMarker && emitter.mod.lib === undefined
+      ? [`declare void @${RUNTIME_ABI_MARKER}()`]
+      : []),
+    // Overrides the runtime's weak default (scr_lib.c).
+    ...(emitter.detachedExit && emitter.mod.lib === undefined
+      ? [`@scr_detached_exit = constant i8 1`]
+      : []),
+  );
+  for (const d of emitter.decls) out.push(d);
+  out.push(``);
+  const flushedDecls = new Set(emitter.decls);
+  {
+    const tl =
+      emitter.mod.workers === true || emitter.mod.lib?.threadInstances === true
+        ? "thread_local "
+        : "";
+    out.push(...threadSlotsBlockDefinitions(emitter.threadSlotsBlocks, tl !== ""));
+    for (let site = 0; site < emitter.dynReadIcSites; site++)
+      out.push(
+        `@sc_dyn_read_ic_${site} = internal ${tl}global { ptr, ${emitter.sizeType}, ${emitter.sizeType}, ptr } zeroinitializer`,
+      );
+  }
+  for (const table of emitter.constantNumericTables.values()) {
+    const n = table.values.length;
+    let tableTmp = 0;
+    const tableIndex = exactIndexLines("%i", String(n), "i64", () => `%ix${tableTmp++}`);
+    out.push(
+      `@${table.symbol} = private constant [${n} x double] [${table.values.map((v) => `double ${f64Lit(v)}`).join(", ")}]`,
+      `define internal double @${table.symbol}_get(ptr %a, double %i) alwaysinline #0 {`,
+      `entry:`,
+      `  %initialized = icmp ne ptr %a, null`,
+      ...tableIndex.lines.map((line) => `  ${line}`),
+      `  %safe = and i1 %initialized, ${tableIndex.ok}`,
+      `  br i1 %safe, label %read, label %fallback`,
+      `read:`,
+      `  %slot = getelementptr inbounds [${n} x double], ptr @${table.symbol}, i64 0, i64 ${tableIndex.wide}`,
+      `  %value = load double, ptr %slot`,
+      `  ret double %value`,
+      `fallback:`,
+      `  %generic = call double @scr_arr_get_number(ptr %a, double %i)`,
+      `  ret double %generic`,
+      `}`,
+      ``,
+    );
+  }
+  for (const [text, lit] of emitter.literals) {
+    // Immortal interned ScrStr: { rc = SIZE_MAX, len, cap = len, bytes\0 } —
+    // the runtime ABI’s static table, retain/release skip rc == SIZE_MAX.
+    // 64-bit (little-endian) targets split the capacity word: the high
+    // half carries the precomputed Map key hash (SCR_STR_HASH_CACHE).
+    // Bit 31 marks all-ASCII literals (SCR_STR_ASCII_BIT) on every target.
+    const capWord =
+      emitter.sizeType === "i64"
+        ? literalCapWord(wtf8Bytes(text))
+        : literalCapWord32(wtf8Bytes(text));
+    out.push(
+      `@${lit.sym} = internal global { ${emitter.sizeType}, ${emitter.sizeType}, ${emitter.sizeType}, [${lit.len + 1} x i8] } ` +
+        `{ ${emitter.sizeType} -1, ${emitter.sizeType} ${lit.len}, ${emitter.sizeType} ${capWord}, [${lit.len + 1} x i8] c"${llStrBytes(text)}" }`,
+    );
+  }
+  if (emitter.literals.size > 0) out.push(``);
+  for (const lit of emitter.bigintLiterals.values()) {
+    // Immortal ScrBigInt: { rc = SIZE_MAX, len, sign, cap, limbs } with
+    // pointer-sized little-endian limbs (scr_bigint.c); zero keeps one
+    // zero limb so limb 0 is always readable.
+    const size = emitter.sizeType;
+    const limbBits = size === "i64" ? 64n : 32n;
+    const mask = (1n << limbBits) - 1n;
+    const limbs: string[] = [];
+    for (let m = lit.value < 0n ? -lit.value : lit.value; m > 0n; m = m >> limbBits) {
+      limbs.push(`${size} ${m & mask}`);
+    }
+    const len = limbs.length;
+    if (len === 0) limbs.push(`${size} 0`);
+    const sign = lit.value < 0n ? -1 : lit.value > 0n ? 1 : 0;
+    out.push(
+      `@${lit.sym} = internal global { ${size}, ${size}, i32, i32, [${limbs.length} x ${size}] } ` +
+        `{ ${size} -1, ${size} ${len}, i32 ${sign}, i32 ${limbs.length}, [${limbs.length} x ${size}] [${limbs.join(", ")}] }`,
+    );
+  }
+  if (emitter.bigintLiterals.size > 0) out.push(``);
+  for (const [key, sym] of emitter.unitInstances) {
+    // One immortal instance per unit-armed (union, tag): tag set, payload
+    // slot and RC entry points zero — retain/release/collector all skip
+    // rc == SIZE_MAX, so these never join the RC audit or a trace walk.
+    const [unionId, tag] = key.split(":");
+    out.push(
+      `@${sym} = internal global %ScrUnion { ${emitter.sizeType} -1, i32 ${tag}, ptr null, ptr null, ptr null, i64 0 } ; ${unionId} unit arm`,
+    );
+  }
+  if (emitter.unitInstances.size > 0) out.push(``);
+  for (const [unionId, sym] of emitter.retypeGuards) {
+    // Thread-local like module globals: a thread's cast caches hold only
+    // its own boxes. Never written, the flag folds to false.
+    out.push(`@${sym} = internal ${tl}global i8 0 ; ${unionId} boxes in a cast cache`);
+  }
+  if (emitter.retypeGuards.size > 0) out.push(``);
+  for (const [unionId, sym] of emitter.absentInstances) {
+    // One immortal ABSENT field-slot instance per undefined-armed union:
+    // the undefined arm's tag with payload 1 (ordinary unit instances
+    // carry 0). Every tag reader sees undefined; recordHas and the
+    // field reads compare tag and payload, never the address, so the
+    // per-object copies of separately compiled units agree.
+    const tag = undefinedArmTag({ kind: "union", unionId }, emitter.unionsById);
+    out.push(
+      `@${sym} = internal global %ScrUnion { ${emitter.sizeType} -1, i32 ${tag}, ptr null, ptr null, ptr null, i64 ${ABSENT_FIELD_PAYLOAD} } ; ${unionId} absent field`,
+    );
+  }
+  if (emitter.absentInstances.size > 0) out.push(``);
+  if (emitter.needsUnionNone)
+    out.push(
+      `@sc_union_none = internal constant %ScrUnion zeroinitializer ; NULL union dummy read by inline stores`,
+      ``,
+    );
+  if (emitter.nullableUnions.usesNullSentinel) {
+    // `null` in every `C | null | undefined` union (NULL is undefined):
+    // one module-scope immortal object like the ABSENT sentinel.
+    const S = emitter.sizeType;
+    out.push(
+      `${NULLABLE_NULL} = internal global { ${S}, ${S}, ${S}, ${S} } { ${S} -1, ${S} 0, ${S} 0, ${S} 0 } ; nullable null arm`,
+      ``,
+    );
+  }
+  if (emitter.needsNullableAbsent) {
+    // The ABSENT field-slot state of every nullable-pointer union: one
+    // module-scope immortal object (rc == SIZE_MAX), distinct from NULL
+    // (undefined) and from every instance. RC entry points and the
+    // collector skip it like any immortal; field reads compare its address.
+    const S = emitter.sizeType;
+    out.push(
+      `${NULLABLE_ABSENT} = internal global { ${S}, ${S}, ${S}, ${S} } { ${S} -1, ${S} 0, ${S} 0, ${S} 0 } ; nullable absent field`,
+      ``,
+    );
+  }
+  for (const [key, re] of emitter.regexInstances) {
+    // One immortal ScrRegex per (pattern, flags) literal, pointing at
+    // the interned source/flags strings. The bc and translated-program
+    // slots start null (lazy compile, cached by the runtime) — a mutable
+    // global, not constant. The last slot is the build-time matcher.
+    const matcher = regexMatchers.has(key) ? `@${re.sym}_match` : "null";
+    out.push(
+      `@${re.sym} = internal ${tl}global %ScrRegex { ${emitter.sizeType} -1, ptr ${re.src}, ptr ${re.fl}, ptr null, double 0.0, ptr null, ptr null, ptr ${matcher} } ; ${key.replace(/\n/g, "\\n")}`,
+    );
+  }
+  if (emitter.regexInstances.size > 0) out.push(``);
+  for (const code of regexMatchers.values()) out.push(...code.lines, ``);
+  for (const [, inst] of emitter.templateStringsInstances) {
+    // One immortal ScrArr per tagged-template site: a [N x ptr] data
+    // global of interned cooked-string literals, and the ScrArr header
+    // over it (rc == SIZE_MAX, len == cap == filled, SCR_ELEM_STR = 2,
+    // no REF entry points). Every dense slot is present; reads retain
+    // immortal strings — a no-op.
+    const n = inst.slots.length;
+    const present = n === 0 ? "zeroinitializer" : `[ ${inst.slots.map(() => "i8 1").join(", ")} ]`;
+    out.push(
+      `@${inst.sym}_data = internal constant [${n} x ptr] [ ${inst.slots.map((s) => `ptr ${s}`).join(", ")} ]`,
+      `@${inst.sym}_present = internal constant [${n} x i8] ${present}`,
+      `@${inst.sym} = internal global %ScrArr { ${emitter.sizeType} -1, ${emitter.sizeType} ${n}, ${emitter.sizeType} ${n}, i8 2, i8 0, i16 0, i32 ${n}, ptr null, ptr @${inst.sym}_data, ptr @${inst.sym}_present, ptr null }`,
+    );
+  }
+  if (emitter.templateStringsInstances.size > 0) out.push(``);
+  for (const [text, c] of emitter.cstrs) {
+    // NUL-terminated byte-array constants for scr_jb_puts and indentation.
+    out.push(`@${c.sym} = internal constant [${c.len + 1} x i8] c"${llStrBytes(text)}"`);
+  }
+  if (emitter.cstrs.size > 0) out.push(``);
+  for (const [body, sym] of emitter.mapOpsConsts) {
+    out.push(`@${sym} = internal constant { ptr, ptr, ptr, ptr, ptr, ptr, ptr } { ${body} }`);
+  }
+  if (emitter.mapOpsConsts.size > 0) out.push(``);
+
+  for (const line of ffiCallbacks.globals) out.push(line);
+  if (ffiCallbacks.globals.length > 0) out.push(``);
+  for (const g of globals) {
+    const ty = emitter.llType(g.type);
+    const zero = ty === "double" ? f64Lit(0) : ty === "ptr" ? "null" : "false";
+    const debug = emitter.debug?.global(g);
+    out.push(
+      `@${mangleGlobal(g.id)} = internal ${tl}global ${ty} ${zero}${debug ? `, !dbg ${debug}` : ""} ; ${g.name}`,
+    );
+  }
+  if (globals.length > 0) out.push(``);
+  for (const line of helpers) out.push(line);
+  for (const line of ffiCallbacks.defs) out.push(line);
+  for (const line of shapes.defs) out.push(line);
+  for (const line of classShapes.defs) out.push(line);
+  for (const line of classObjDefs) out.push(line);
+  for (const line of emitter.walkers.defs) out.push(line);
+  for (const line of emitter.dyn.defs) out.push(line);
+  for (const line of wrappers) out.push(line);
+  for (const line of asyncDefs) out.push(line);
+  for (const line of emitter.resolveThunkDefs) out.push(line);
+  out.push(fnDefs[0] ?? "");
+  for (let i = 1; i < fnDefs.length; i++) out.push("", fnDefs[i]!);
+  out.push("");
+
+  // main(): scr_init, the program-dependent error-vt interval stamps,
+  // scr_lib_init(argc, argv), then the entry function. An uncaught
+  // exception escaping top-level code prints and exits 1 (Node).
+  // The exception epilogue is emitted when the entry may throw.
+  const stamps: string[] = [...errorViews];
+  for (const iv of emitter.errorIntervals) {
+    const fields: [number, number][] = [
+      [0, iv.pre],
+      [1, iv.post],
+    ];
+    for (const [field, value] of fields) {
+      stamps.push(
+        `  store ${emitter.sizeType} ${value}, ptr getelementptr inbounds ([${RUNTIME_ERROR_CLASSES.size} x %ScrVt], ptr @scr_error_vts, i64 0, i64 ${iv.kind}, i32 ${field})${field === 1 ? ` ; ${iv.lib}` : ""}`,
+      );
+    }
+  }
+  if (emitter.emitterInterval !== null) {
+    // The runtime emitter vtable's interval (emitterVtStampLines): bare
+    // EventEmitter instances answer instanceof and dispatch dynamic
+    // teardown under THIS module's preorder numbering.
+    out.push(`@scr_emitter_vt = external ${tl}global %ScrVt`, ``);
+    stamps.push(
+      `  store ${emitter.sizeType} ${emitter.emitterInterval.pre}, ptr getelementptr inbounds (%ScrVt, ptr @scr_emitter_vt, i64 0, i32 0)`,
+      `  store ${emitter.sizeType} ${emitter.emitterInterval.post}, ptr getelementptr inbounds (%ScrVt, ptr @scr_emitter_vt, i64 0, i32 1) ; EventEmitter`,
+    );
+  }
+  for (const iv of emitter.streamIntervals) {
+    // The runtime stream vtables' intervals (streamVtStampLines) — the
+    // emitter story: instanceof and dynamic teardown dispatch through
+    // them.
+    out.push(`@${iv.vt} = external ${tl}global %ScrVt`);
+    stamps.push(
+      `  store ${emitter.sizeType} ${iv.pre}, ptr getelementptr inbounds (%ScrVt, ptr @${iv.vt}, i64 0, i32 0)`,
+      `  store ${emitter.sizeType} ${iv.post}, ptr getelementptr inbounds (%ScrVt, ptr @${iv.vt}, i64 0, i32 1) ; ${iv.lib}`,
+    );
+  }
+  if (emitter.streamIntervals.length > 0) out.push(``);
+  if ([...emitter.literals.keys(), ...emitter.cstrs.keys()].some(hasLoneSurrogate)) {
+    // The runtime skips surrogate work until a lone surrogate may exist
+    // (scr_wtf8_any); its own producers note one, and literals do here.
+    out.push(`declare void @scr_wtf8_note()`, ``);
+    stamps.push(`  call void @scr_wtf8_note()`);
+  }
+  if (emitter.errorIntervals.length > 0 && emitter.tracedShapes.has("object:%Error")) {
+    // The cycle fixpoint marked the Error hierarchy (a user subclass
+    // holds cycle-capable fields — capability is hierarchy-uniform), so
+    // the runtime's own error allocations need collector headers too.
+    // Declared inline: the extern block already flushed (LLVM is
+    // order-free, the helper-defs precedent).
+    out.push(`declare void @scr_error_set_traced()`, ``);
+    stamps.push(`  call void @scr_error_set_traced()`);
+  }
+  if ((entryMayThrow || runsLoop) && emitter.mod.lib === undefined) {
+    // Declared inline: the extern block already flushed (LLVM is
+    // order-free — the scr_error_set_traced precedent). Only the
+    // printer emits here (nothing else declares it); scr_exc_pending
+    // and the loop entry points rode the Set before the flush.
+    out.push(
+      `declare void @scr_exc_print_uncaught()`,
+      `declare zeroext i1 @scr_exc_handle_uncaught(i1 zeroext)`,
+      ``,
+    );
+  }
+  if (emitter.mod.lib !== undefined) {
+    // LIBRARY mode: no @main — the profile-declared external
+    // symbols specified by the library IR instead.
+    for (const line of emitter.emitLibDefs(globals, globalReleaseLines, stamps)) out.push(line);
+    out.push(...emitter.inlineRcTail(flushedDecls));
+    out.push(`attributes #0 = { sanitize_address }`);
+    if (emitter.usesCoroutines) out.push(`attributes #1 = { sanitize_address presplitcoroutine }`);
+    if (hasNoInlineRecordClone) out.push(`attributes #2 = { noinline sanitize_address }`);
+    out.push(``);
+    out.push(...emitter.fieldAliasMetadata());
+    if (emitter.debug !== null) out.push(emitter.debug.render());
+    return out;
+  }
+  out.push(
+    `define i32 @${emitter.mod.workers ? "sc_context_entry" : emitter.wasi ? "__main_argc_argv" : "main"}(i32 %argc, ptr %argv) ${FN_ATTRS} {`,
+    `entry:`,
+    ...(emitter.runtimeAbiMarker ? [`  call void @${RUNTIME_ABI_MARKER}()`] : []),
+    ...(emitter.mod.workers ? [`  call void @scr_runtime_workers_v8()`] : []),
+    `  call void @scr_init()`,
+    // Each context (the main thread, every worker) installs its stack
+    // guard before running compiled code that checks it.
+    ...(emitter.stackChecks?.size ? [`  call void @scr_stack_guard_init()`] : []),
+    ...stamps,
+    // Event-surface programs (signal/exit listeners) fill the loop's
+    // nullable event hooks before %main — scr_events.c links only when
+    // this line is emitted (native/executable.ts gates on the same predicate).
+    ...(usesEvents ? [`  call void @scr_events_install()`] : []),
+    ...(usesChildProcess ? [`  call void @scr_child_dyn_install()`] : []),
+    ...(childStreamBoxes
+      ? [
+          `  call void @scr_child_dyn_streams_install(ptr @scr_stream_child_ops, ptr @${childStreamBoxes[0]}, ptr @${childStreamBoxes[1]})`,
+        ]
+      : []),
+    ...(workerStdioBox || workerStdinBox
+      ? [
+          `  call void @scr_worker_stdio_install(ptr @scr_stream_child_ops, ptr ${workerStdioBox ? `@${workerStdioBox}` : "null"}, ptr ${workerStdinBox ? `@${workerStdinBox}` : "null"})`,
+        ]
+      : []),
+    // fs.watch programs fill the loop's watch hooks the same way —
+    // scr_watch.c links only when this line is emitted.
+    ...(usesFsWatch ? [`  call void @scr_watch_install()`] : []),
+    ...(emitter.ffiHasForeignCallback ? [`  call void @scr_ffi_install()`] : []),
+    ...(snapshotsTlsCa ? [`  call void @scr_tls_ca_install()`] : []),
+    ...(usesFetch ? [`  call void @scr_fetch_install()`] : []),
+    ...(usesNet ? [`  call void @scr_net_install()`, `  call void @scr_net_dyn_install()`] : []),
+    ...(usesHttp ? [`  call void @scr_http_dyn_install()`] : []),
+    ...(usesDgram ? [`  call void @scr_dgram_install()`] : []),
+    ...(usesHttp2 ? [`  call void @scr_http2_dyn_install()`] : []),
+    ...(usesStream ? [`  call void @scr_stream_install()`] : []),
+    `  call void @scr_lib_init(i32 %argc, ptr %argv)`,
+    // node:test takes Node's --test-update-snapshots out of argv first.
+    ...(usesNodeTest ? [`  call void @scr_test_init()`] : []),
+    ...(asyncEntry
+      ? [`  %top = call ptr @${mangleAsyncSpawn(emitter.mod.entry)}()`]
+      : [`  call void @${mangleFunction(emitter.mod.entry)}()`]),
+    // Uncaught exception from top-level code: Node exits 1.
+    ...(entryMayThrow && !asyncEntry
+      ? [
+          `  %exc = call zeroext i1 @scr_exc_pending()`,
+          `  br i1 %exc, label %uncaught, label %ok`,
+          `uncaught:`,
+          `  %handled = call zeroext i1 @scr_exc_handle_uncaught(i1 false)`,
+          `  br i1 %handled, label %ok, label %fatal`,
+          `fatal:`,
+          `  call void @scr_exc_print_uncaught()`,
+          ...exitListenerLines("xu"),
+          ...uncaughtReleases,
+          `  %failure_code_0 = call i32 @scr_exit_code_hint_get()`,
+          `  ret i32 %failure_code_0`,
+          `ok:`,
+        ]
+      : []),
+    // The event loop runs to exhaustion (microtasks before timers). A
+    // throw escaping a timer callback and unhandled promise rejections
+    // both exit 1, like Node — the C main's loop block exactly.
+    ...(runsLoop
+      ? [
+          ...(emitter.mod.commonJsEntry === true ? [`  call void @scr_loop_commonjs_entry()`] : []),
+          `  %loop_rejection = call zeroext i1 @scr_loop_run(ptr ${asyncEntry ? "%top" : "null"})`,
+          `  %lexc = call zeroext i1 @scr_exc_pending()`,
+          `  br i1 %lexc, label %luncaught, label %lok`,
+          `luncaught:`,
+          `  call void @scr_exc_print_uncaught()`,
+          ...(asyncEntry ? [`  call void @scr_promise_release(ptr %top)`] : []),
+          ...exitListenerLines("xl"),
+          ...loopReleasesU,
+          `  %failure_code_1 = call i32 @scr_exit_code_hint_get()`,
+          `  ret i32 %failure_code_1`,
+          `lok:`,
+          `  br i1 %loop_rejection, label %lreported, label %lclean`,
+          `lreported:`,
+          `  call void @scr_discard_unhandled_rejections()`,
+          ...(asyncEntry ? [`  call void @scr_promise_release(ptr %top)`] : []),
+          ...exitListenerLines("xq"),
+          ...loopReportedReleases,
+          `  %failure_code_2 = call i32 @scr_exit_code_hint_get()`,
+          `  ret i32 %failure_code_2`,
+          `lclean:`,
+          ...(asyncEntry
+            ? [
+                `  %tla_status = call i32 @scr_promise_finish_top_level(ptr %top)`,
+                `  %tla_rejected = icmp eq i32 %tla_status, 1`,
+                `  br i1 %tla_rejected, label %tla_fail, label %tla_not_rejected`,
+                `tla_fail:`,
+                // The loop already delivered every earlier-checkpoint
+                // rejection. Drop same-checkpoint competitors before
+                // surfacing the fatal module verdict.
+                `  call void @scr_discard_unhandled_rejections()`,
+                `  call void @scr_promise_rethrow_top_level(ptr %top)`,
+                `  call void @scr_promise_release(ptr %top)`,
+                `  call void @scr_exc_print_uncaught()`,
+                ...exitListenerLines("xt"),
+                ...topRejectReleases,
+                `  %failure_code_3 = call i32 @scr_exit_code_hint_get()`,
+                `  ret i32 %failure_code_3`,
+                `tla_not_rejected:`,
+                `  call void @scr_promise_release(ptr %top)`,
+              ]
+            : []),
+          `  %rej = call zeroext i1 @scr_report_unhandled_rejections()`,
+          `  br i1 %rej, label %lrej, label %lrok`,
+          `lrej:`,
+          ...exitListenerLines("xr"),
+          ...loopReleasesR,
+          `  %failure_code_4 = call i32 @scr_exit_code_hint_get()`,
+          `  ret i32 %failure_code_4`,
+          `lrok:`,
+          ...(asyncEntry
+            ? [
+                `  %tla_pending = icmp eq i32 %tla_status, 13`,
+                `  br i1 %tla_pending, label %tla_stuck, label %tla_ok`,
+                `tla_stuck:`,
+                ...topPendingExitLines(),
+                `tla_ok:`,
+              ]
+            : []),
+        ]
+      : []),
+    ...exitListenerLines("xn"),
+    ...globalReleases,
+    ...(usesNodeTest
+      ? [`  %test_exit = call i32 @scr_test_exit_code()`, `  ret i32 %test_exit`]
+      : [`  %native_exit = call i32 @scr_exit_code_hint_get()`, `  ret i32 %native_exit`]),
+    `}`,
+    ``,
+    ...emitter.inlineRcTail(flushedDecls),
+    // sanitize_address is inert under the plain pipeline; the sanitized
+    // lane's -fsanitize=address link activates instrumentation over the
+    // emitted functions too (the runtime TUs get theirs from clang).
+    `attributes #0 = { sanitize_address }`,
+    ...(emitter.usesCoroutines ? [`attributes #1 = { sanitize_address presplitcoroutine }`] : []),
+    ...(hasNoInlineRecordClone ? [`attributes #2 = { noinline sanitize_address }`] : []),
+    ``,
+  );
+  if (emitter.mod.workers) {
+    out.push(
+      `declare void @scr_context_cleanup()`,
+      `declare i32 @scr_worker_argc()`,
+      `declare ptr @scr_worker_argv()`,
+      `define i32 @sc_worker_entry(i32 %root) ${FN_ATTRS} {`,
+      `entry:`,
+      `  %argc = call i32 @scr_worker_argc()`,
+      `  %argv = call ptr @scr_worker_argv()`,
+      `  %result = call i32 @sc_context_entry(i32 %argc, ptr %argv)`,
+      `  ret i32 %result`,
+      `}`,
+      `define i32 @main(i32 %argc, ptr %argv) ${FN_ATTRS} {`,
+      `entry:`,
+      `  %result = call i32 @sc_context_entry(i32 %argc, ptr %argv)`,
+      `  call void @scr_context_cleanup()`,
+      `  ret i32 %result`,
+      `}`,
+    );
+  }
+  out.push(...emitter.fieldAliasMetadata());
+  if (emitter.debug !== null) out.push(emitter.debug.render());
+  return out;
+}
+
+/** The shared abort helpers (emitted only when referenced): the OOM
+ * abort of untraced shape allocation and the invalid-union-tag abort —
+ * both print the runtime ABI’s exact message on fd 2 and abort. */
+export function helperDefs(emitter: LlEmitter): string[] {
+  const defs: string[] = [];
+  const msgHelper = (fnName: string, msgSym: string, msg: string): void => {
+    // The message routes through the runtime's trap funnel: executable
+    // builds expand to the historical bytes-on-stderr + abort; library
+    // builds route to the registered panic sink (scr_runtime.h).
+    const bytes = Buffer.byteLength(msg, "utf8");
+    emitter.declare(`declare void @scr_trap(ptr)`);
+    defs.push(
+      `@${msgSym} = internal constant [${bytes + 1} x i8] c"${llStrBytes(msg)}"`,
+      `define internal void @${fnName}() ${FN_ATTRS} {`,
+      `entry:`,
+      `  call void @scr_trap(ptr @${msgSym})`,
+      `  unreachable`,
+      `}`,
+      ``,
+    );
+  };
+  if (emitter.needsOom) msgHelper("sc_oom", "sc_oom_msg", "scriptc: out of memory\n");
+  if (emitter.needsBadTag) {
+    msgHelper("sc_bad_tag", "sc_bad_tag_msg", "scriptc: internal error: invalid union tag\n");
+  }
+  if (emitter.needsBadKey) {
+    // The keyed-read miss on a result type that cannot say `undefined`:
+    // trap like an array OOB read instead of corrupting a typed slot
+    // (SEMANTICS.md; the C helper's message additionally interpolates
+    // the runtime key — a trap-path debugging nicety, never reachable
+    // by a program whose behavior matches Node).
+    msgHelper(
+      "sc_bad_key",
+      "sc_bad_key_msg",
+      "scriptc: TypeError: record has no key (typed slot — no undefined is representable)\n",
+    );
+  }
+  if (emitter.needsRetainBox) {
+    // scr_box_retain is a static inline (increment-unless-immortal);
+    // emitted once with internal linkage, like the record retains.
+    defs.push(
+      `define internal ptr @sc_retain_box(ptr %b) ${FN_ATTRS} {`,
+      `entry:`,
+      `  %rc = load ${emitter.sizeType}, ptr %b`,
+      `  %imm = icmp eq ${emitter.sizeType} %rc, -1`,
+      `  br i1 %imm, label %done, label %inc`,
+      `inc:`,
+      `  %n = add ${emitter.sizeType} %rc, 1`,
+      `  store ${emitter.sizeType} %n, ptr %b`,
+      `  br label %done`,
+      `done:`,
+      `  ret ptr %b`,
+      `}`,
+      ``,
+    );
+  }
+  // Number-key Map/Set lookups probe the runtime's direct index inline:
+  // while ndense is nonzero every live key is an integer below it, so an
+  // in-range integral key reads its slot (entry index + 1, 0 = absent) and
+  // any other key is absent. Maps without the index (ndense 0) hash the
+  // key in sc_map_entry_f64_hashed, which scans the entries of a small map
+  // or probes a compact bucket table as scr_map_find_f64 does, and calls
+  // the runtime lookup for a wide table. It stays out of line so that the
+  // direct-index path stays small at every call site. Both only read
+  // memory, so LLVM merges lookups of one key when nothing is stored in
+  // between (a has() followed by get(), for example).
+  if (emitter.decls.has(NUMBER_MAP_ENTRY_DECL)) {
+    const sz = emitter.sizeType;
+    let mapTmp = 0;
+    const mapIndex = exactIndexLines("%k", "%nd", sz, () => `%ix${mapTmp++}`);
+    defs.push(
+      `define internal ptr @sc_map_entry_f64(ptr %m, double %k) ${FN_ATTRS} {`,
+      `entry:`,
+      `  %ndp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 16`,
+      ...(sz === "i64"
+        ? [`  %nd32 = load i32, ptr %ndp`, `  %nd = zext i32 %nd32 to i64`]
+        : [`  %nd = load i32, ptr %ndp`]),
+      // A non-integral key inside the table is as absent as one outside it.
+      ...mapIndex.lines.map((line) => `  ${line}`),
+      `  br i1 ${mapIndex.ok}, label %slot, label %outside`,
+      `slot:`,
+      sz === "i64"
+        ? `  %i = add i64 ${mapIndex.wide}, 0`
+        : `  %i = trunc i64 ${mapIndex.wide} to ${sz}`,
+      `  %dp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 15`,
+      `  %dense = load ptr, ptr %dp`,
+      `  %sp = getelementptr inbounds i32, ptr %dense, ${sz} %i`,
+      `  %s = load i32, ptr %sp`,
+      `  %empty = icmp eq i32 %s, 0`,
+      `  br i1 %empty, label %miss, label %hit`,
+      `hit:`,
+      `  %e32 = sub i32 %s, 1`,
+      sz === "i32" ? `  %e = add i32 %e32, 0` : `  %e = zext i32 %e32 to ${sz}`,
+      `  %ep = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 11`,
+      `  %entries = load ptr, ptr %ep`,
+      `  %found = getelementptr inbounds %ScrMapEntry, ptr %entries, ${sz} %e`,
+      `  ret ptr %found`,
+      `miss:`,
+      `  ret ptr null`,
+      `outside:`,
+      `  %dense.any = icmp ne ${sz} %nd, 0`,
+      `  br i1 %dense.any, label %miss, label %slow`,
+      `slow:`,
+      `  %hashed = call ptr @sc_map_entry_f64_hashed(ptr %m, double %k)`,
+      `  ret ptr %hashed`,
+      `}`,
+      ``,
+      // Hashing (scr_map_find_f64): the SameValueZero key word, its
+      // scr_key_mix hash (zero remapped to one) and the absent-key filter.
+      `define internal ptr @sc_map_entry_f64_hashed(ptr %m, double %k) noinline ${FN_ATTRS} {`,
+      `entry:`,
+      `  %nan = fcmp uno double %k, %k`,
+      `  %zero = fcmp oeq double %k, 0.0`,
+      `  %kz = select i1 %zero, double 0.0, double %k`,
+      `  %kzb = bitcast double %kz to i64`,
+      `  %kb = select i1 %nan, i64 9221120237041090560, i64 %kzb`,
+      `  %x1s = lshr i64 %kb, 30`,
+      `  %x1 = xor i64 %kb, %x1s`,
+      `  %x2 = mul i64 %x1, -4658895280553007687`,
+      `  %x3s = lshr i64 %x2, 27`,
+      `  %x3 = xor i64 %x2, %x3s`,
+      `  %x4 = mul i64 %x3, -7723592293110705685`,
+      `  %x5s = lshr i64 %x4, 31`,
+      `  %x5 = xor i64 %x4, %x5s`,
+      `  %hz = icmp eq i64 %x5, 0`,
+      `  %h = select i1 %hz, i64 1, i64 %x5`,
+      `  %f1s = lshr i64 %h, 44`,
+      `  %f1a = and i64 %f1s, 63`,
+      `  %f1 = shl i64 1, %f1a`,
+      `  %f2s = lshr i64 %h, 50`,
+      `  %f2a = and i64 %f2s, 63`,
+      `  %f2 = shl i64 1, %f2a`,
+      `  %fb = or i64 %f1, %f2`,
+      `  %fp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 10`,
+      `  %filter = load i64, ptr %fp`,
+      `  %fm = and i64 %filter, %fb`,
+      `  %fin = icmp eq i64 %fm, %fb`,
+      `  br i1 %fin, label %table, label %miss`,
+      `table:`,
+      `  %nbp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 13`,
+      ...(sz === "i64"
+        ? [`  %nb32 = load i32, ptr %nbp`, `  %nb = zext i32 %nb32 to i64`]
+        : [`  %nb = load i32, ptr %nbp`]),
+      `  %eps = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 11`,
+      `  %ents = load ptr, ptr %eps`,
+      `  %linear = icmp eq ${sz} %nb, 0`,
+      `  br i1 %linear, label %scan, label %buckets`,
+      // Small maps keep no bucket table: scan the cached entry hashes.
+      `scan:`,
+      `  %nep = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 8`,
+      ...(sz === "i64"
+        ? [`  %ne32 = load i32, ptr %nep`, `  %ne = zext i32 %ne32 to i64`]
+        : [`  %ne = load i32, ptr %nep`]),
+      `  br label %scan.loop`,
+      `scan.loop:`,
+      `  %si = phi ${sz} [ 0, %scan ], [ %si.next, %scan.next ]`,
+      `  %sdone = icmp eq ${sz} %si, %ne`,
+      `  br i1 %sdone, label %miss, label %scan.entry`,
+      `scan.entry:`,
+      `  %se = getelementptr inbounds %ScrMapEntry, ptr %ents, ${sz} %si`,
+      `  %seh = getelementptr inbounds %ScrMapEntry, ptr %se, i32 0, i32 2`,
+      `  %sh = load i64, ptr %seh`,
+      `  %sk = load i64, ptr %se`,
+      `  %shq = icmp eq i64 %sh, %h`,
+      `  %skq = icmp eq i64 %sk, %kb`,
+      `  %sq = and i1 %shq, %skq`,
+      `  br i1 %sq, label %scan.found, label %scan.next`,
+      `scan.found:`,
+      `  ret ptr %se`,
+      `scan.next:`,
+      `  %si.next = add ${sz} %si, 1`,
+      `  br label %scan.loop`,
+      // Compact tables tag each 24-bit entry index (+1) with the hash's
+      // top byte; wider tables take the runtime lookup.
+      `buckets:`,
+      `  %wide = icmp ugt ${sz} %nb, 16777216`,
+      `  br i1 %wide, label %runtime, label %probe`,
+      `probe:`,
+      `  %bp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 14`,
+      `  %bk = load ptr, ptr %bp`,
+      `  %mask = sub ${sz} %nb, 1`,
+      `  %ht = lshr i64 %h, 32`,
+      `  %ht32 = trunc i64 %ht to i32`,
+      `  %tag = and i32 %ht32, -16777216`,
+      sz === "i64" ? `  %hi = add i64 %h, 0` : `  %hi = trunc i64 %h to ${sz}`,
+      `  %i0 = and ${sz} %hi, %mask`,
+      `  br label %probe.loop`,
+      `probe.loop:`,
+      `  %pi = phi ${sz} [ %i0, %probe ], [ %pi.next, %probe.next ]`,
+      `  %bep = getelementptr inbounds i32, ptr %bk, ${sz} %pi`,
+      `  %b = load i32, ptr %bep`,
+      `  %bempty = icmp eq i32 %b, 0`,
+      `  br i1 %bempty, label %miss, label %probe.tag`,
+      `probe.tag:`,
+      `  %bt = and i32 %b, -16777216`,
+      `  %btq = icmp eq i32 %bt, %tag`,
+      `  br i1 %btq, label %probe.entry, label %probe.next`,
+      `probe.entry:`,
+      `  %bix = and i32 %b, 16777215`,
+      `  %bix1 = sub i32 %bix, 1`,
+      sz === "i32" ? `  %bi = add i32 %bix1, 0` : `  %bi = zext i32 %bix1 to ${sz}`,
+      `  %pe = getelementptr inbounds %ScrMapEntry, ptr %ents, ${sz} %bi`,
+      `  %peh = getelementptr inbounds %ScrMapEntry, ptr %pe, i32 0, i32 2`,
+      `  %ph = load i64, ptr %peh`,
+      `  %pk = load i64, ptr %pe`,
+      `  %phq = icmp eq i64 %ph, %h`,
+      `  %pkq = icmp eq i64 %pk, %kb`,
+      `  %pq = and i1 %phq, %pkq`,
+      `  br i1 %pq, label %probe.found, label %probe.next`,
+      `probe.found:`,
+      `  ret ptr %pe`,
+      `probe.next:`,
+      `  %pi.inc = add ${sz} %pi, 1`,
+      `  %pi.next = and ${sz} %pi.inc, %mask`,
+      `  br label %probe.loop`,
+      `miss:`,
+      `  ret ptr null`,
+      `runtime:`,
+      `  %r = call ptr @scr_map_entry_f64(ptr %m, double %k) memory(read) nounwind willreturn`,
+      `  ret ptr %r`,
+      `}`,
+      ``,
+    );
+  }
+  // Map/Set iteration steps read the entries array inline: an index is
+  // live when it is below the entry count and its entry's cached hash is
+  // nonzero (a tombstone's is zero), as scr_map_iter_live decides. The
+  // entry count is read again at every step, so entries appended during
+  // the iteration are visited.
+  if (emitter.decls.has(MAP_ITER_DECL)) {
+    const sz = emitter.sizeType;
+    defs.push(
+      `define internal ptr @sc_map_iter_entry(ptr %m, double %i) ${FN_ATTRS} {`,
+      `entry:`,
+      `  %np = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 8`,
+      `  %n = load i32, ptr %np`,
+      `  %nf = uitofp i32 %n to double`,
+      `  %lo = fcmp oge double %i, 0.0`,
+      `  %hi = fcmp olt double %i, %nf`,
+      `  %in = and i1 %lo, %hi`,
+      `  br i1 %in, label %load, label %none`,
+      `load:`,
+      `  %ix = fptoui double %i to ${sz}`,
+      `  %ep = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 11`,
+      `  %entries = load ptr, ptr %ep`,
+      `  %e = getelementptr inbounds %ScrMapEntry, ptr %entries, ${sz} %ix`,
+      `  %hp = getelementptr inbounds %ScrMapEntry, ptr %e, i32 0, i32 2`,
+      `  %h = load i64, ptr %hp`,
+      `  %live = icmp ne i64 %h, 0`,
+      `  br i1 %live, label %yes, label %none`,
+      `yes:`,
+      `  ret ptr %e`,
+      `none:`,
+      `  ret ptr null`,
+      `}`,
+      ``,
+      `define internal double @sc_map_iter_count(ptr %m) ${FN_ATTRS} {`,
+      `entry:`,
+      `  %np = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 8`,
+      `  %n = load i32, ptr %np`,
+      `  %nf = uitofp i32 %n to double`,
+      `  ret double %nf`,
+      `}`,
+      ``,
+    );
+  }
+  // String-key Map/Set lookups test the map's absent-key filter inline
+  // (scr_map.c scr_map_filter_bits): a key whose two filter bits are not
+  // both set is absent, so most misses on small and medium maps return
+  // without a call. On 64-bit targets the key's cached hash h is the high
+  // half of its capacity word, the runtime's widened hash is (h << 32) | h,
+  // and the filter reads its bits 44..55, which are the capacity word's
+  // own. A key without a cached hash, and every possible hit, take the
+  // runtime lookup.
+  if (emitter.decls.has(STRING_MAP_ENTRY_DECL)) {
+    defs.push(
+      `define internal ptr @sc_map_entry_str(ptr %m, ptr %k) ${FN_ATTRS} {`,
+      `entry:`,
+      ...(emitter.sizeType === "i64"
+        ? [
+            `  %fp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 10`,
+            `  %filter = load i64, ptr %fp`,
+            `  %capp = getelementptr inbounds %ScrStr, ptr %k, i32 0, i32 2`,
+            `  %cap = load i64, ptr %capp`,
+            `  %cached = icmp uge i64 %cap, 4294967296`,
+            `  br i1 %cached, label %test, label %slow`,
+            `test:`,
+            `  %s1 = lshr i64 %cap, 44`,
+            `  %i1 = and i64 %s1, 63`,
+            `  %b1 = shl i64 1, %i1`,
+            `  %s2 = lshr i64 %cap, 50`,
+            `  %i2 = and i64 %s2, 63`,
+            `  %b2 = shl i64 1, %i2`,
+            `  %bits = or i64 %b1, %b2`,
+            `  %have = and i64 %filter, %bits`,
+            `  %maybe = icmp eq i64 %have, %bits`,
+            `  br i1 %maybe, label %slow, label %absent`,
+            `absent:`,
+            `  ret ptr null`,
+          ]
+        : [`  br label %slow`]),
+      `slow:`,
+      `  %r = call ptr @scr_map_entry_str(ptr %m, ptr %k)`,
+      `  ret ptr %r`,
+      `}`,
+      ``,
+    );
+  }
+  // String comparisons enter through small internal wrappers that LLVM
+  // inlines at each site: interned literals and shared values compare by
+  // identity, and equality rejects different byte lengths, before any
+  // runtime call (scr_str_eq/scr_str_cmp keep the complete semantics).
+  if (emitter.decls.has(`declare zeroext i1 @scr_str_eq(ptr, ptr)`)) {
+    defs.push(
+      `define internal zeroext i1 @sc_str_eq(ptr %a, ptr %b) ${FN_ATTRS} {`,
+      `entry:`,
+      `  %same = icmp eq ptr %a, %b`,
+      `  br i1 %same, label %yes, label %lengths`,
+      `lengths:`,
+      `  %alen.p = getelementptr inbounds %ScrStr, ptr %a, i32 0, i32 1`,
+      `  %blen.p = getelementptr inbounds %ScrStr, ptr %b, i32 0, i32 1`,
+      `  %alen = load ${emitter.sizeType}, ptr %alen.p`,
+      `  %blen = load ${emitter.sizeType}, ptr %blen.p`,
+      `  %samelen = icmp eq ${emitter.sizeType} %alen, %blen`,
+      `  br i1 %samelen, label %bytes, label %no`,
+      `bytes:`,
+      `  %eq = call zeroext i1 @scr_str_eq(ptr %a, ptr %b)`,
+      `  ret i1 %eq`,
+      `yes:`,
+      `  ret i1 true`,
+      `no:`,
+      `  ret i1 false`,
+      `}`,
+      ``,
+    );
+  }
+  for (const [text, name] of emitter.literalEqualities) {
+    defs.push(
+      ...literalEqualityDefinition(
+        name,
+        wtf8Bytes(text),
+        emitter.internLiteral(text),
+        emitter.sizeType,
+        FN_ATTRS,
+      ),
+      ``,
+    );
+  }
+  // String length and charCodeAt read proven-ASCII strings inline: bit 31
+  // of the capacity word (SCR_STR_ASCII_BIT, the low half's sign bit on
+  // little-endian targets) makes UTF-16 units bytes. Unproven strings and
+  // anything but an in-range index take the runtime's UTF-16 mapping.
+  // A scan's receiver reads inline too where runtime state is ordinary
+  // global storage (ScrStrScan; SCR_TL makes it thread-local otherwise).
+  const scanInline = emitter.mod.workers !== true && emitter.mod.lib?.threadInstances !== true;
+  let scanDeclared = false;
+  for (const helper of STRING_READ_HELPERS) {
+    if (!emitter.decls.has(helper.decl)) continue;
+    if (scanInline && !scanDeclared) {
+      defs.push(stringScanDecl(emitter.sizeType), ``);
+      scanDeclared = true;
+    }
+    defs.push(...helper.define(emitter.sizeType, FN_ATTRS, scanInline), ``);
+  }
+  // Ordering decides inline from the first differing bytes. The bytes
+  // before them are equal, so both strings are at the same position of a
+  // character: either both bytes continue characters with the same lead
+  // byte, or both start a character. Byte order is the UTF-16 order for
+  // two continuation bytes, and for two lead bytes when one starts a
+  // character below U+D000, whose UTF-16 unit is below every unit of a
+  // character with a lead byte of at least 0xED. Between lead bytes of at
+  // least 0xED, a supplementary character (0xF0..0xF4, a high surrogate
+  // unit) orders below U+E000..U+FFFF (0xEE, 0xEF), and a lead byte of
+  // 0xED (U+D000..U+D7FF or a lone surrogate) takes the runtime.
+  // Differing words without a byte of at least 0xED decide in byte
+  // order; other differing words decide by their first differing byte,
+  // and strings shorter than a word by their first byte. Otherwise a
+  // proven-ASCII string on either side orders by bytes (scr_str_cmp), and
+  // other pairs call scr_str_cmp_u16_bytes, which only reads the two
+  // strings, so LLVM can merge repeated comparisons of one pair. Callers
+  // only test the sign of the result.
+  if (emitter.decls.has(`declare i32 @scr_str_cmp_u16(ptr, ptr)`)) {
+    const fn = "scr_str_cmp_u16";
+    emitter.declare("declare i64 @llvm.bswap.i64(i64)");
+    emitter.declare("declare i64 @llvm.cttz.i64(i64, i1 immarg)");
+    emitter.declare("declare i8 @llvm.umin.i8(i8, i8)");
+    emitter.declare("declare i32 @scr_str_cmp(ptr, ptr)");
+    emitter.declare("declare i32 @scr_str_cmp_u16_bytes(ptr, ptr)");
+    defs.push(
+      `define internal i32 @${fn.replace(/^scr_/, "sc_")}(ptr %a, ptr %b) ${FN_ATTRS} {`,
+      `entry:`,
+      `  %same = icmp eq ptr %a, %b`,
+      `  br i1 %same, label %equal, label %lengths`,
+      `lengths:`,
+      `  %alen.p = getelementptr inbounds %ScrStr, ptr %a, i32 0, i32 1`,
+      `  %blen.p = getelementptr inbounds %ScrStr, ptr %b, i32 0, i32 1`,
+      `  %alen = load ${emitter.sizeType}, ptr %alen.p`,
+      `  %blen = load ${emitter.sizeType}, ptr %blen.p`,
+      `  %aempty = icmp eq ${emitter.sizeType} %alen, 0`,
+      `  %bempty = icmp eq ${emitter.sizeType} %blen, 0`,
+      `  %empty = or i1 %aempty, %bempty`,
+      `  br i1 %empty, label %order, label %words`,
+      // Both at least 8 bytes: the first word of each.
+      `words:`,
+      `  %along = icmp uge ${emitter.sizeType} %alen, 8`,
+      `  %blong = icmp uge ${emitter.sizeType} %blen, 8`,
+      `  %long = and i1 %along, %blong`,
+      `  br i1 %long, label %word, label %first`,
+      `word:`,
+      `  %awp = getelementptr inbounds %ScrStr, ptr %a, i32 1`,
+      `  %bwp = getelementptr inbounds %ScrStr, ptr %b, i32 1`,
+      `  %aw = load i64, ptr %awp, align 1`,
+      `  %bw = load i64, ptr %bwp, align 1`,
+      `  %wdiffer = icmp ne i64 %aw, %bw`,
+      `  br i1 %wdiffer, label %differ, label %wsame`,
+      // Equal first words and one length of at most 16 bytes: the word
+      // ending at that length covers the rest, and any difference lies
+      // past the equal first word.
+      `wsame:`,
+      `  %samelen = icmp eq ${emitter.sizeType} %alen, %blen`,
+      `  %short = icmp ule ${emitter.sizeType} %alen, 16`,
+      `  %tailable = and i1 %samelen, %short`,
+      `  br i1 %tailable, label %tail, label %order`,
+      `tail:`,
+      `  %toff = sub ${emitter.sizeType} %alen, 8`,
+      `  %atp = getelementptr inbounds i8, ptr %awp, ${emitter.sizeType} %toff`,
+      `  %btp = getelementptr inbounds i8, ptr %bwp, ${emitter.sizeType} %toff`,
+      `  %at = load i64, ptr %atp, align 1`,
+      `  %bt = load i64, ptr %btp, align 1`,
+      `  %tdiffer = icmp ne i64 %at, %bt`,
+      `  br i1 %tdiffer, label %differ, label %equal`,
+      `first:`,
+      `  %adata = getelementptr inbounds %ScrStr, ptr %a, i32 1`,
+      `  %bdata = getelementptr inbounds %ScrStr, ptr %b, i32 1`,
+      `  %x = load i8, ptr %adata`,
+      `  %y = load i8, ptr %bdata`,
+      `  %fdiffer = icmp ne i8 %x, %y`,
+      `  br i1 %fdiffer, label %bytes, label %order`,
+      // Two differing words. When neither has a byte of at least 0xED
+      // (a byte b is when its high bit and bit 7 of (b & 0x7f) + 0x13 are
+      // set), byte-swapped little-endian words compare in byte order.
+      // Otherwise the lowest set byte of their xor is the first differing
+      // byte.
+      `differ:`,
+      `  %dx = phi i64 [ %aw, %word ], [ %at, %tail ]`,
+      `  %dy = phi i64 [ %bw, %word ], [ %bt, %tail ]`,
+      `  %xl = and i64 %dx, 9187201950435737471`,
+      `  %yl = and i64 %dy, 9187201950435737471`,
+      `  %xa = add i64 %xl, 1374463283923456787`,
+      `  %ya = add i64 %yl, 1374463283923456787`,
+      `  %xh = and i64 %dx, %xa`,
+      `  %yh = and i64 %dy, %ya`,
+      `  %hh = or i64 %xh, %yh`,
+      `  %whigh = and i64 %hh, -9187201950435737472`,
+      `  %dlow = icmp eq i64 %whigh, 0`,
+      `  br i1 %dlow, label %wordorder, label %locate`,
+      `wordorder:`,
+      `  %xsw = call i64 @llvm.bswap.i64(i64 %dx)`,
+      `  %ysw = call i64 @llvm.bswap.i64(i64 %dy)`,
+      `  %wbelow = icmp ult i64 %xsw, %ysw`,
+      `  %wsign = select i1 %wbelow, i32 -1, i32 1`,
+      `  ret i32 %wsign`,
+      `locate:`,
+      `  %dxor = xor i64 %dx, %dy`,
+      `  %dtz = call i64 @llvm.cttz.i64(i64 %dxor, i1 true)`,
+      `  %dshift = and i64 %dtz, 56`,
+      `  %dxs = lshr i64 %dx, %dshift`,
+      `  %dys = lshr i64 %dy, %dshift`,
+      `  %dxb = trunc i64 %dxs to i8`,
+      `  %dyb = trunc i64 %dys to i8`,
+      `  br label %bytes`,
+      // The first differing bytes.
+      `bytes:`,
+      `  %bx = phi i8 [ %x, %first ], [ %dxb, %locate ]`,
+      `  %by = phi i8 [ %y, %first ], [ %dyb, %locate ]`,
+      `  %bmin = call i8 @llvm.umin.i8(i8 %bx, i8 %by)`,
+      `  %blow = icmp ult i8 %bmin, -19`,
+      `  br i1 %blow, label %byte, label %high`,
+      // Both at least 0xED. A lone surrogate (0xED) takes the runtime;
+      // supplementary lead bytes (0xF0..0xF4) order below 0xEE and 0xEF
+      // once 0x10 is subtracted from them.
+      `high:`,
+      `  %xed = icmp eq i8 %bx, -19`,
+      `  %yed = icmp eq i8 %by, -19`,
+      `  %ed = or i1 %xed, %yed`,
+      `  br i1 %ed, label %order, label %planes`,
+      `planes:`,
+      `  %xsupp = icmp uge i8 %bx, -16`,
+      `  %ysupp = icmp uge i8 %by, -16`,
+      `  %xlow = add i8 %bx, -16`,
+      `  %ylow = add i8 %by, -16`,
+      `  %xk = select i1 %xsupp, i8 %xlow, i8 %bx`,
+      `  %yk = select i1 %ysupp, i8 %ylow, i8 %by`,
+      `  %kbelow = icmp ult i8 %xk, %yk`,
+      `  %ksign = select i1 %kbelow, i32 -1, i32 1`,
+      `  ret i32 %ksign`,
+      `byte:`,
+      `  %below = icmp ult i8 %bx, %by`,
+      `  %sign = select i1 %below, i32 -1, i32 1`,
+      `  ret i32 %sign`,
+      `order:`,
+      `  %acw.p = getelementptr inbounds %ScrStr, ptr %a, i32 0, i32 2`,
+      `  %bcw.p = getelementptr inbounds %ScrStr, ptr %b, i32 0, i32 2`,
+      `  %acw = load i32, ptr %acw.p`,
+      `  %bcw = load i32, ptr %bcw.p`,
+      `  %cws = or i32 %acw, %bcw`,
+      `  %anyascii = icmp slt i32 %cws, 0`,
+      `  br i1 %anyascii, label %memorder, label %units`,
+      `memorder:`,
+      `  %m = call i32 @scr_str_cmp(ptr %a, ptr %b)`,
+      `  ret i32 %m`,
+      `units:`,
+      `  %c = call i32 @scr_str_cmp_u16_bytes(ptr %a, ptr %b) nounwind willreturn memory(argmem: read)`,
+      `  ret i32 %c`,
+      `equal:`,
+      `  ret i32 0`,
+      `}`,
+      ``,
+    );
+  }
+  // The declarations these helpers added must land in the extern block,
+  // which already flushed — append here instead (LLVM is order-free).
+  return defs.length > 0 ? [...defs] : defs;
+}
+
+/** LIBRARY mode: the profile-declared external definitions — the
+ * export-map wrappers plus init / sink-registration / reset / collect.
+ * Plain `define` (not `define internal`) — the exact linkage distinction
+ * that separates the executable lane's @main from everything else. The
+ * bodies delegate every runtime half to scr_library.c, mirroring the C
+ * emission line for line, so the two lanes are identical by
+ * construction. */
+export function emitLibDefs(
+  emitter: LlEmitter,
+  globals: IrGlobal[],
+  globalReleaseLines: (prefix: string) => string[],
+  stamps: string[],
+): string[] {
+  const lib = emitter.mod.lib!;
+  const autoReset = lib.resultResetSymbol === null;
+  const out: string[] = [``, `; ── library-mode entries (profile: ${lib.profileName}) ──`, ``];
+  // Every entry's prologue records its external symbol in the funnel's
+  // current-entry slot (structured trap-teaching field 2); the symbols
+  // live as internal constants, one per entry.
+  const symConst = (sym: string): string => `@sc_lib_sym_${sym}`;
+  const emitSymConst = (sym: string): void => {
+    out.push(
+      `${symConst(sym)} = internal constant [${Buffer.byteLength(sym, "utf8") + 1} x i8] c"${llStrBytes(sym)}"`,
+    );
+  };
+  emitSymConst(lib.initSymbol);
+  emitSymConst(lib.sinkRegisterSymbol);
+  if (lib.callbackRegisterSymbol !== null && lib.callbackRegisterSymbol !== undefined)
+    emitSymConst(lib.callbackRegisterSymbol);
+  if (lib.resultResetSymbol !== null) emitSymConst(lib.resultResetSymbol);
+  if (lib.collectSymbol !== null) emitSymConst(lib.collectSymbol);
+  for (const e of lib.exports) emitSymConst(e.symbol);
+  out.push(``);
+  if (emitter.wasi) {
+    for (const symbol of ["scriptc_alloc", "scriptc_free"]) emitSymConst(symbol);
+    out.push(
+      `define ptr @scriptc_alloc(i32 %size) ${FN_ATTRS} {`,
+      `entry:`,
+      `  call void @scr_library_entry(i1 zeroext false, ptr ${symConst("scriptc_alloc")})`,
+      `  %p = call ptr @malloc(i32 %size)`,
+      `  ret ptr %p`,
+      `}`,
+      ``,
+      `define void @scriptc_free(ptr %p) ${FN_ATTRS} {`,
+      `entry:`,
+      `  call void @scr_library_entry(i1 zeroext false, ptr ${symConst("scriptc_free")})`,
+      `  call void @free(ptr %p)`,
+      `  ret void`,
+      `}`,
+      ``,
+    );
+  }
+  // The runtime detected-trap overlay table (scr_runtime.h declares it,
+  // the library trap funnel consults it): flat code/teaching/remediation
+  // triples, one per runtime trap code (SC4013–SC4019) the profile
+  // declares text for. The funnel assembles the structured sink message.
+  // The empty table still defines the symbols the funnel links against.
+  const ovlCells: string[] = [];
+  lib.trapOverlays.forEach((o, i) => {
+    const cell = (name: string, text: string | undefined): void => {
+      if (text === undefined) {
+        ovlCells.push("ptr null");
+        return;
+      }
+      const sym = `@sc_lib_ovl_${i}_${name}`;
+      out.push(
+        `${sym} = internal constant [${Buffer.byteLength(text, "utf8") + 1} x i8] c"${llStrBytes(text)}"`,
+      );
+      ovlCells.push(`ptr ${sym}`);
+    };
+    cell("code", o.code);
+    cell("teach", o.teaching);
+    cell("rem", o.remediation);
+  });
+  out.push(
+    ovlCells.length === 0
+      ? `@scr_library_trap_overlays = constant [1 x ptr] zeroinitializer`
+      : `@scr_library_trap_overlays = constant [${ovlCells.length} x ptr] [${ovlCells.join(", ")}]`,
+    `@scr_library_trap_overlays_len = constant ${emitter.sizeType} ${lib.trapOverlays.length}`,
+    ``,
+  );
+  // The init entry: full deterministic reset-and-reevaluate. Program
+  // globals release and zero first (run-once guards included), then the
+  // runtime session reset, the error-vt interval stamps verbatim from
+  // the executable main, %main itself, and the escaped-exception check.
+  const zeroStores = globals.map((g) => {
+    const ty = emitter.llType(g.type);
+    const zero = ty === "double" ? f64Lit(0) : ty === "ptr" ? "null" : "false";
+    return `  store ${ty} ${zero}, ptr @${mangleGlobal(g.id)} ; ${g.name}`;
+  });
+  out.push(
+    `define void @${lib.initSymbol}() ${FN_ATTRS} {`,
+    `entry:`,
+    `  call void @scr_library_entry(i1 zeroext true, ptr ${symConst(lib.initSymbol)}) ; init always resets the result arena`,
+    ...globalReleaseLines("ci"),
+    ...zeroStores,
+    `  call void @scr_library_reset()`,
+    ...stamps,
+    `  call void @${mangleFunction(emitter.mod.entry)}()`,
+    `  call void @scr_library_check_exc()`,
+    `  ret void`,
+    `}`,
+    ``,
+    `define void @${lib.sinkRegisterSymbol}(ptr %fn, ptr %ctx) ${FN_ATTRS} {`,
+    `entry:`,
+    `  call void @scr_library_callback_entry_guard(ptr ${symConst(lib.sinkRegisterSymbol)})`,
+    `  call void @scr_library_set_sink(ptr %fn, ptr %ctx)`,
+    `  ret void`,
+    `}`,
+    ``,
+  );
+  if (lib.callbacks !== undefined && lib.callbacks.length > 0) {
+    // Host-callback channels: the per-channel name constants (the
+    // registration dispatch's strcmp operands), the per-channel
+    // unregistered-call trap constants (the ffiCall sites'
+    // scr_library_cb_require operands), and the registration function:
+    // a pure store dispatch
+    // (the sink registration's rule — no entry prologue, no poison
+    // guard) whose first operation rejects callback-time re-entry
+    // (SC4026). An unknown or NULL name is a defined -1, never a store.
+    for (const cb of lib.callbacks) {
+      out.push(
+        `@sc_lib_cb_name_${cb.slot} = internal constant [${Buffer.byteLength(cb.name, "utf8") + 1} x i8] c"${llStrBytes(cb.name)}"`,
+        `@sc_lib_cb_trap_${cb.slot} = internal constant [${Buffer.byteLength(cb.unregisteredTrap, "utf8") + 1} x i8] c"${llStrBytes(cb.unregisteredTrap)}"`,
+      );
+    }
+    out.push(
+      ``,
+      `define i32 @${lib.callbackRegisterSymbol}(ptr %name, ptr %fn, ptr %ctx) ${FN_ATTRS} {`,
+      `entry:`,
+      `  call void @scr_library_callback_entry_guard(ptr ${symConst(lib.callbackRegisterSymbol!)})`,
+      `  %isnull = icmp eq ptr %name, null`,
+      `  br i1 %isnull, label %miss, label %try0`,
+    );
+    lib.callbacks.forEach((cb, i) => {
+      const next = i + 1 < lib.callbacks!.length ? `try${i + 1}` : "miss";
+      out.push(
+        `try${i}: ; channel '${cb.name}'`,
+        `  %cmp${i} = call i32 @strcmp(ptr %name, ptr @sc_lib_cb_name_${cb.slot})`,
+        `  %eq${i} = icmp eq i32 %cmp${i}, 0`,
+        `  br i1 %eq${i}, label %set${i}, label %${next}`,
+        `set${i}:`,
+        `  call void @scr_library_cb_set(${emitter.sizeType} ${cb.slot}, ptr %fn, ptr %ctx)`,
+        `  ret i32 0`,
+      );
+    });
+    out.push(`miss:`, `  ret i32 -1`, `}`, ``);
+  }
+  if (lib.identity !== undefined && emitter.emitLibraryIdentity) {
+    // Profile-declared identity getters (the ask-2 sidecar's boot-time
+    // pairing fence): pure data returns with NO entry prologue — exempt
+    // from the poisoned guard and every runtime touch (ratified), so a
+    // host can read them before init and after a trap. The u64 rides
+    // i64 two's-complement (LLVM integer constants are signed).
+    for (const line of emitLibraryIdentityLines(lib.identity, FN_ATTRS)) out.push(line);
+  }
+  if (lib.resultResetSymbol !== null) {
+    out.push(
+      `define void @${lib.resultResetSymbol}() ${FN_ATTRS} {`,
+      `entry:`,
+      `  call void @scr_library_entry(i1 zeroext false, ptr ${symConst(lib.resultResetSymbol)})`,
+      `  call void @scr_library_arena_reset()`,
+      `  ret void`,
+      `}`,
+      ``,
+    );
+  }
+  if (lib.collectSymbol !== null) {
+    out.push(
+      `define void @${lib.collectSymbol}() ${FN_ATTRS} {`,
+      `entry:`,
+      `  call void @scr_library_entry(i1 zeroext false, ptr ${symConst(lib.collectSymbol)})`,
+      `  call void @scr_library_collect() ; arena reset + a full cycle collection`,
+      `  ret void`,
+      `}`,
+      ``,
+    );
+  }
+  for (const e of lib.exports) {
+    const params: string[] = [];
+    const body: string[] = [
+      `  call void @scr_library_entry(i1 zeroext ${autoReset ? "true" : "false"}, ptr ${symConst(e.symbol)})`,
+    ];
+    const args: string[] = [];
+    if (e.inboundBytesTrap !== undefined) {
+      // The bytes-in helper's trap message: the compiler-assembled
+      // structured trap-teaching form (0x01 text 0x1F SC4012 0x1F symbol
+      // [0x1F remediation]) consumed by the runtime sink.
+      const trapBytes = Buffer.byteLength(e.inboundBytesTrap, "utf8");
+      out.push(
+        `@sc_lib_bytes_trap_${e.symbol} = internal constant [${trapBytes + 1} x i8] c"${llStrBytes(e.inboundBytesTrap)}"`,
+        ``,
+      );
+    }
+    if (e.inboundIntTrap !== undefined) {
+      // The i64/u64-in helpers' host-contract trap message (ask 4): an
+      // inbound integer past ±(2^53−1) cannot ride f64 exactly. Same
+      // assembled structured form, same SC4012 code, same
+      // emission-invariance argument as the bytes trap.
+      const trapBytes = Buffer.byteLength(e.inboundIntTrap, "utf8");
+      out.push(
+        `@sc_lib_int_trap_${e.symbol} = internal constant [${trapBytes + 1} x i8] c"${llStrBytes(e.inboundIntTrap)}"`,
+        ``,
+      );
+    }
+    if (e.inboundCstringTrap !== undefined) {
+      // The cstring-in helper's host-contract trap message (a NULL
+      // `const char *`): same assembled structured form and SC4012 code.
+      const trapBytes = Buffer.byteLength(e.inboundCstringTrap, "utf8");
+      out.push(
+        `@sc_lib_cstr_trap_${e.symbol} = internal constant [${trapBytes + 1} x i8] c"${llStrBytes(e.inboundCstringTrap)}"`,
+        ``,
+      );
+    }
+    e.params.forEach((cls, i) => {
+      switch (cls) {
+        case "f64":
+          params.push(`double %a${i}`);
+          args.push(`double %a${i}`);
+          break;
+        case "bool":
+          params.push(`i8 %a${i}`);
+          body.push(`  %c${i} = icmp ne i8 %a${i}, 0`);
+          args.push(`i1 %c${i}`);
+          break;
+        case "u8":
+          params.push(`i8 %a${i}`);
+          body.push(`  %c${i} = uitofp i8 %a${i} to double`);
+          args.push(`double %c${i}`);
+          break;
+        case "u32":
+          params.push(`i32 %a${i}`);
+          body.push(`  %c${i} = uitofp i32 %a${i} to double`);
+          args.push(`double %c${i}`);
+          break;
+        case "i32":
+          params.push(`i32 %a${i}`);
+          body.push(`  %c${i} = sitofp i32 %a${i} to double`);
+          args.push(`double %c${i}`);
+          break;
+        case "i64":
+          // Inbound declared-integer edge (ask 4): the helper converts
+          // exactly or delivers the host-contract trap (past ±(2^53−1)
+          // the value cannot ride f64 without rounding).
+          params.push(`i64 %a${i}`);
+          body.push(
+            `  %c${i} = call double @scr_library_i64_in(i64 %a${i}, ptr @sc_lib_int_trap_${e.symbol})`,
+          );
+          args.push(`double %c${i}`);
+          break;
+        case "u64":
+          params.push(`i64 %a${i}`);
+          body.push(
+            `  %c${i} = call double @scr_library_u64_in(i64 %a${i}, ptr @sc_lib_int_trap_${e.symbol})`,
+          );
+          args.push(`double %c${i}`);
+          break;
+        case "string":
+          params.push(`ptr %a${i}_ptr`, `${emitter.sizeType} %a${i}_len`);
+          body.push(
+            `  %c${i} = call ptr @scr_library_str_in(ptr %a${i}_ptr, ${emitter.sizeType} %a${i}_len)`,
+          );
+          args.push(`ptr %c${i}`);
+          break;
+        case "bytes":
+          params.push(`ptr %a${i}_ptr`, `${emitter.sizeType} %a${i}_len`);
+          body.push(
+            `  %c${i} = call ptr @scr_library_bytes_in(ptr %a${i}_ptr, ${emitter.sizeType} %a${i}_len, ptr @sc_lib_bytes_trap_${e.symbol})`,
+          );
+          args.push(`ptr %c${i}`);
+          break;
+        case "cstring":
+          params.push(`ptr %a${i}`);
+          body.push(
+            `  %c${i} = call ptr @scr_library_cstr_in(ptr %a${i}, ptr @sc_lib_cstr_trap_${e.symbol})`,
+          );
+          args.push(`ptr %c${i}`);
+          break;
+      }
+    });
+    if (e.returns === "string" || e.returns === "bytes") {
+      params.push(`ptr %out`, `ptr %out_len`);
+    }
+    const target = `@${mangleFunction(e.fnName)}`;
+    const callArgs = args.join(", ");
+    let retType = "void";
+    switch (e.returns) {
+      case "void":
+        body.push(
+          `  call void ${target}(${callArgs})`,
+          `  call void @scr_library_check_exc()`,
+          `  ret void`,
+        );
+        break;
+      case "f64":
+        retType = "double";
+        body.push(
+          `  %r = call double ${target}(${callArgs})`,
+          `  call void @scr_library_check_exc()`,
+          `  ret double %r`,
+        );
+        break;
+      case "i64":
+      case "u64":
+        // The outbound declared-integer edge (ask 4): every value
+        // reaching this return was PROVEN whole and inside the class's
+        // range at compile time, so the fp-to-int conversion is exact
+        // by construction — the crossing carries the mathematically
+        // exact integer the f64 held.
+        retType = "i64";
+        body.push(
+          `  %r = call double ${target}(${callArgs})`,
+          `  call void @scr_library_check_exc()`,
+          `  %z = ${e.returns === "i64" ? "fptosi" : "fptoui"} double %r to i64`,
+          `  ret i64 %z`,
+        );
+        break;
+      case "bool":
+        retType = "i8";
+        body.push(
+          `  %r = call i1 ${target}(${callArgs})`,
+          `  call void @scr_library_check_exc()`,
+          `  %z = zext i1 %r to i8`,
+          `  ret i8 %z`,
+        );
+        break;
+      case "string":
+        body.push(
+          `  %r = call ptr ${target}(${callArgs})`,
+          `  call void @scr_library_check_exc()`,
+          `  call void @scr_library_str_out(ptr %r, ptr %out, ptr %out_len)`,
+          `  ret void`,
+        );
+        break;
+      case "bytes":
+        body.push(
+          `  %r = call ptr ${target}(${callArgs})`,
+          `  call void @scr_library_check_exc()`,
+          `  call void @scr_library_bytes_out(ptr %r, ptr %out, ptr %out_len)`,
+          `  ret void`,
+        );
+        break;
+      case "cstring":
+        // The result's arena copy, returned as `const char *`.
+        retType = "ptr";
+        body.push(
+          `  %r = call ptr ${target}(${callArgs})`,
+          `  call void @scr_library_check_exc()`,
+          `  %z = call ptr @scr_library_cstr_out(ptr %r)`,
+          `  ret ptr %z`,
+        );
+        break;
+    }
+    out.push(
+      `define ${retType} @${e.symbol}(${params.join(", ")}) ${FN_ATTRS} { ; library export ${e.fnName}`,
+      `entry:`,
+      ...body,
+      `}`,
+      ``,
+    );
+  }
+  return out;
+}
+
+/** C-callable scalar callback trampolines. A callback with an explicit
+ * context entry receives the closure at that exact ABI position. A raw
+ * callback loads it from a call-scoped TLS slot installed around the
+ * outer native call. */
+export function emitFfiCallbackDefs(emitter: LlEmitter): { globals: string[]; defs: string[] } {
+  const globals: string[] = [];
+  const defs: string[] = [];
+  if (emitter.ffiCallbackAdapters.size === 0) return { globals, defs };
+  emitter.declare(`declare void @scr_trap(ptr)`);
+  const expired = emitter.cstr(
+    "scriptc: native callback invoked outside its call-scoped lifetime\n",
+  );
+  const released = emitter.cstr("scriptc: native callback invoked outside its retained lifetime\n");
+  for (const adapter of emitter.ffiCallbackAdapters.values()) {
+    const cb = adapter.callback;
+    if (adapter.tls !== null)
+      globals.push(`@${adapter.tls} = internal thread_local global ptr null`);
+    if (adapter.global !== null)
+      globals.push(`@${adapter.global} = internal thread_local global ptr null`);
+    if (adapter.table !== null) {
+      globals.push(
+        `@${adapter.table} = internal ${emitter.mod.workers ? "thread_local " : ""}global %ScrFfiTable zeroinitializer`,
+      );
+    }
+    const params = cb.params.flatMap((param, i): string[] => {
+      if (isFfiContextParam(param)) return [`ptr %ctx`];
+      if (param === "string" || param === "bytes") {
+        return [`ptr %a${i}`, `${emitter.sizeType} %a${i}_len`];
+      }
+      return [`${ffiNativeParamLl(param, emitter.ffiExtendNarrowIntegers)} %a${i}`];
+    });
+    if (cb.invoke === "foreign") {
+      if (
+        adapter.table === null ||
+        !cb.params.some(isFfiContextParam) ||
+        cb.returns !== "void" ||
+        cb.params.some((param) => param === "i64" || param === "u64" || param === "pointer")
+      ) {
+        throw new InternalCompilerError(
+          "llvm emitter bug: invalid foreign FFI callback descriptor",
+        );
+      }
+      const dispatch = `${adapter.symbol}_dispatch`;
+      const scriptArgs: string[] = [];
+      const dispatchBody: string[] = [
+        `define internal void @${dispatch}(ptr %cb, ptr %call) ${FN_ATTRS} {`,
+        `entry:`,
+        `  %fnp = getelementptr inbounds %ScrClosure, ptr %cb, i64 0, i32 1`,
+        `  %fn = load ptr, ptr %fnp`,
+      ];
+      for (let i = 0; i < cb.params.length; i++) {
+        const param = cb.params[i]!;
+        if (isFfiContextParam(param)) continue;
+        switch (param) {
+          case "f64":
+          case "f32":
+          case "i8":
+          case "u16":
+          case "i16":
+            emitter.declare(`declare double @scr_ffi_call_get_f64(ptr, ${emitter.sizeType})`);
+            dispatchBody.push(
+              `  %s${i} = call double @scr_ffi_call_get_f64(ptr %call, ${emitter.sizeType} ${i})`,
+            );
+            scriptArgs.push(`double %s${i}`);
+            break;
+          case "bool":
+            emitter.declare(`declare zeroext i1 @scr_ffi_call_get_bool(ptr, ${emitter.sizeType})`);
+            dispatchBody.push(
+              `  %s${i} = call zeroext i1 @scr_ffi_call_get_bool(ptr %call, ${emitter.sizeType} ${i})`,
+            );
+            scriptArgs.push(`i1 %s${i}`);
+            break;
+          case "u8":
+          case "u32":
+          case "i32":
+            emitter.declare(`declare double @scr_ffi_call_get_${param}(ptr, ${emitter.sizeType})`);
+            dispatchBody.push(
+              `  %s${i} = call double @scr_ffi_call_get_${param}(ptr %call, ${emitter.sizeType} ${i})`,
+            );
+            scriptArgs.push(`double %s${i}`);
+            break;
+          case "cstring":
+          case "string":
+          case "bytes": {
+            emitter.declare(`declare ptr @scr_ffi_call_get_data(ptr, ${emitter.sizeType})`);
+            emitter.declare(
+              `declare ${emitter.sizeType} @scr_ffi_call_get_len(ptr, ${emitter.sizeType})`,
+            );
+            dispatchBody.push(
+              `  %data${i} = call ptr @scr_ffi_call_get_data(ptr %call, ${emitter.sizeType} ${i})`,
+              `  %len${i} = call ${emitter.sizeType} @scr_ffi_call_get_len(ptr %call, ${emitter.sizeType} ${i})`,
+            );
+            if (param === "bytes") {
+              emitter.declare(`declare ptr @scr_bytes_from_data(ptr, ${emitter.sizeType})`);
+              dispatchBody.push(
+                `  %s${i} = call ptr @scr_bytes_from_data(ptr %data${i}, ${emitter.sizeType} %len${i})`,
+              );
+            } else {
+              emitter.declare(`declare ptr @scr_str_from_utf8_lossy(ptr, ${emitter.sizeType})`);
+              dispatchBody.push(
+                `  %s${i} = call ptr @scr_str_from_utf8_lossy(ptr %data${i}, ${emitter.sizeType} %len${i})`,
+              );
+            }
+            scriptArgs.push(`ptr %s${i}`);
+            break;
+          }
+        }
+      }
+      dispatchBody.push(
+        `  call void %fn(${[`ptr %cb`, ...scriptArgs].join(", ")})`,
+        `  ret void`,
+        `}`,
+        ``,
+      );
+      for (const line of dispatchBody) defs.push(line);
+
+      emitter.declare(`declare ptr @scr_ffi_call_new(ptr, ptr, ptr, ${emitter.sizeType})`);
+      emitter.declare(`declare void @scr_ffi_post(ptr)`);
+      defs.push(
+        `define internal void @${adapter.symbol}(${params.join(", ")}) ${FN_ATTRS} {`,
+        `entry:`,
+        `  %cb = getelementptr inbounds i8, ptr %ctx, i64 0`,
+        `  %call = call ptr @scr_ffi_call_new(ptr @${adapter.table}, ptr %cb, ptr @${dispatch}, ${emitter.sizeType} ${cb.params.length})`,
+      );
+      for (let i = 0; i < cb.params.length; i++) {
+        const param = cb.params[i]!;
+        if (isFfiContextParam(param)) continue;
+        if (param === "cstring") {
+          emitter.declare(`declare void @scr_ffi_call_copy_cstring(ptr, ${emitter.sizeType}, ptr)`);
+          defs.push(
+            `  call void @scr_ffi_call_copy_cstring(ptr %call, ${emitter.sizeType} ${i}, ptr %a${i})`,
+          );
+        } else if (param === "string" || param === "bytes") {
+          emitter.declare(
+            `declare void @scr_ffi_call_copy_${param}(ptr, ${emitter.sizeType}, ptr, ${emitter.sizeType})`,
+          );
+          defs.push(
+            `  call void @scr_ffi_call_copy_${param}(ptr %call, ${emitter.sizeType} ${i}, ptr %a${i}, ${emitter.sizeType} %a${i}_len)`,
+          );
+        } else if (param === "f32" || param === "i8" || param === "u16" || param === "i16") {
+          const nativeTy = ffiNativeTypeLl(param);
+          const op = param === "f32" ? "fpext" : param === "u16" ? "uitofp" : "sitofp";
+          emitter.declare(`declare void @scr_ffi_call_set_f64(ptr, ${emitter.sizeType}, double)`);
+          defs.push(
+            `  %wide${i} = ${op} ${nativeTy} %a${i} to double`,
+            `  call void @scr_ffi_call_set_f64(ptr %call, ${emitter.sizeType} ${i}, double %wide${i})`,
+          );
+        } else {
+          const nativeTy = ffiNativeTypeLl(param);
+          emitter.declare(
+            `declare void @scr_ffi_call_set_${param}(ptr, ${emitter.sizeType}, ${nativeTy})`,
+          );
+          defs.push(
+            `  call void @scr_ffi_call_set_${param}(ptr %call, ${emitter.sizeType} ${i}, ${nativeTy} %a${i})`,
+          );
+        }
+      }
+      defs.push(`  call void @scr_ffi_post(ptr %call)`, `  ret void`, `}`, ``);
+      continue;
+    }
+    defs.push(
+      `define internal ${ffiNativeReturnLl(cb.returns, emitter.ffiExtendNarrowIntegers)} @${adapter.symbol}(${params.join(", ")}) ${FN_ATTRS} {`,
+      `entry:`,
+      adapter.tls !== null
+        ? `  %cb = load ptr, ptr @${adapter.tls}`
+        : adapter.global !== null
+          ? `  %cb = load ptr, ptr @${adapter.global}`
+          : `  %cb = getelementptr inbounds i8, ptr %ctx, i64 0`,
+      `  %missing = icmp eq ptr %cb, null`,
+      `  br i1 %missing, label %expired, label %ready`,
+      `expired:`,
+      `  call void @scr_trap(ptr ${adapter.callback.lifetime === "call" ? expired : released})`,
+      `  unreachable`,
+      `ready:`,
+      ...emitter.pendingTestLines("%pending"),
+      `  br i1 %pending, label %skip, label %invoke`,
+      `skip:`,
+      `  ret ${ffiCallbackDummyLl(cb)}`,
+      `invoke:`,
+    );
+    // Validate every native pointer before allocating any copy-in value.
+    // A later bad slot therefore cannot leak an earlier materialization.
+    for (let i = 0; i < cb.params.length; i++) {
+      const param = cb.params[i]!;
+      if (param !== "cstring" && param !== "string" && param !== "bytes") continue;
+      const invalid = `%invalid${i}`;
+      defs.push(`  %null${i} = icmp eq ptr %a${i}, null`);
+      if (param === "cstring") {
+        defs.push(`  ${invalid} = or i1 %null${i}, false`);
+      } else {
+        defs.push(
+          `  %nonempty${i} = icmp ne ${emitter.sizeType} %a${i}_len, 0`,
+          `  ${invalid} = and i1 %null${i}, %nonempty${i}`,
+        );
+      }
+      const message =
+        param === "cstring"
+          ? "scriptc: native callback passed a NULL cstring\n"
+          : `scriptc: native callback passed a NULL ${param} span with nonzero length\n`;
+      defs.push(
+        `  br i1 ${invalid}, label %invalid_param${i}, label %param_ok${i}`,
+        `invalid_param${i}:`,
+        `  call void @scr_trap(ptr ${emitter.cstr(message)})`,
+        `  unreachable`,
+        `param_ok${i}:`,
+      );
+    }
+    defs.push(
+      `  %fnp = getelementptr inbounds %ScrClosure, ptr %cb, i64 0, i32 1`,
+      `  %fn = load ptr, ptr %fnp`,
+    );
+    const scriptArgs: string[] = [];
+    for (let i = 0; i < cb.params.length; i++) {
+      const param = cb.params[i]!;
+      if (isFfiContextParam(param)) continue;
+      switch (param) {
+        case "i64":
+        case "u64":
+        case "pointer": {
+          const ty = ffiNativeTypeLl(param);
+          emitter.declare(`declare ptr @scr_bigint_from_${param}(${ty})`);
+          defs.push(`  %s${i} = call ptr @scr_bigint_from_${param}(${ty} %a${i})`);
+          scriptArgs.push(`ptr %s${i}`);
+          break;
+        }
+        case "f64":
+          scriptArgs.push(`double %a${i}`);
+          break;
+        case "f32":
+        case "i8":
+        case "u16":
+        case "i16": {
+          const nativeTy = ffiNativeTypeLl(param);
+          const op = param === "f32" ? "fpext" : param === "u16" ? "uitofp" : "sitofp";
+          defs.push(`  %s${i} = ${op} ${nativeTy} %a${i} to double`);
+          scriptArgs.push(`double %s${i}`);
+          break;
+        }
+        case "bool":
+          defs.push(`  %s${i} = icmp ne i8 %a${i}, 0`);
+          scriptArgs.push(`i1 %s${i}`);
+          break;
+        case "u8":
+          defs.push(`  %s${i} = uitofp i8 %a${i} to double`);
+          scriptArgs.push(`double %s${i}`);
+          break;
+        case "u32":
+          defs.push(`  %s${i} = uitofp i32 %a${i} to double`);
+          scriptArgs.push(`double %s${i}`);
+          break;
+        case "i32":
+          defs.push(`  %s${i} = sitofp i32 %a${i} to double`);
+          scriptArgs.push(`double %s${i}`);
+          break;
+        case "cstring":
+          emitter.declare(`declare ${emitter.sizeType} @strlen(ptr)`);
+          emitter.declare(`declare ptr @scr_str_from_utf8_lossy(ptr, ${emitter.sizeType})`);
+          defs.push(
+            `  %len${i} = call ${emitter.sizeType} @strlen(ptr %a${i})`,
+            `  %s${i} = call ptr @scr_str_from_utf8_lossy(ptr %a${i}, ${emitter.sizeType} %len${i})`,
+          );
+          scriptArgs.push(`ptr %s${i}`);
+          break;
+        case "string":
+          emitter.declare(`declare ptr @scr_str_from_utf8_lossy(ptr, ${emitter.sizeType})`);
+          defs.push(
+            `  %s${i} = call ptr @scr_str_from_utf8_lossy(ptr %a${i}, ${emitter.sizeType} %a${i}_len)`,
+          );
+          scriptArgs.push(`ptr %s${i}`);
+          break;
+        case "bytes":
+          emitter.declare(`declare ptr @scr_bytes_from_data(ptr, ${emitter.sizeType})`);
+          defs.push(
+            `  %s${i} = call ptr @scr_bytes_from_data(ptr %a${i}, ${emitter.sizeType} %a${i}_len)`,
+          );
+          scriptArgs.push(`ptr %s${i}`);
+          break;
+      }
+    }
+    const ft = ffiCallbackType(cb);
+    const internalRet = emitter.llType(ft.ret);
+    const callArgs = [`ptr %cb`, ...scriptArgs].join(", ");
+    if (cb.lifetime === "retained") {
+      emitter.declare(`declare ptr @scr_closure_retain_v(ptr)`);
+      emitter.declare(`declare void @scr_closure_release_v(ptr)`);
+      defs.push(`  %invoke_pin = call ptr @scr_closure_retain_v(ptr %cb)`);
+    }
+    if (cb.returns === "void") {
+      defs.push(
+        `  call void %fn(${callArgs})`,
+        ...(cb.lifetime === "retained"
+          ? [`  call void @scr_closure_release_v(ptr %invoke_pin)`]
+          : []),
+        `  ret void`,
+        `}`,
+        ``,
+      );
+      continue;
+    }
+    defs.push(`  %result = call ${internalRet} %fn(${callArgs})`);
+    if (cb.lifetime === "retained") {
+      defs.push(`  call void @scr_closure_release_v(ptr %invoke_pin)`);
+    }
+    switch (cb.returns) {
+      case "i64":
+      case "u64":
+      case "pointer": {
+        const ty = ffiNativeTypeLl(cb.returns);
+        emitter.declare(`declare ${ty} @scr_bigint_to_${cb.returns}(ptr)`);
+        emitter.declare(`declare void @scr_bigint_release(ptr)`);
+        defs.push(
+          `  %out = call ${ty} @scr_bigint_to_${cb.returns}(ptr %result)`,
+          `  call void @scr_bigint_release(ptr %result)`,
+          `  ret ${ty} %out`,
+        );
+        break;
+      }
+      case "f64":
+        defs.push(`  ret double %result`);
+        break;
+      case "f32":
+        defs.push(`  %out = fptrunc double %result to float`, `  ret float %out`);
+        break;
+      case "bool":
+        defs.push(`  %out = zext i1 %result to i8`, `  ret i8 %out`);
+        break;
+      case "u8":
+      case "i8":
+      case "u16":
+      case "i16":
+      case "u32":
+        emitter.declare(`declare double @scr_bit_ushr(double, double)`);
+        defs.push(
+          `  %coerced = call double @scr_bit_ushr(double %result, double ${f64Lit(0)})`,
+          `  %wide = fptoui double %coerced to i32`,
+        );
+        if (cb.returns !== "u32") {
+          const nativeTy = ffiNativeTypeLl(cb.returns);
+          defs.push(`  %out = trunc i32 %wide to ${nativeTy}`, `  ret ${nativeTy} %out`);
+        } else {
+          defs.push(`  ret i32 %wide`);
+        }
+        break;
+      case "i32":
+        emitter.declare(`declare double @scr_bit_or(double, double)`);
+        defs.push(
+          `  %coerced = call double @scr_bit_or(double %result, double ${f64Lit(0)})`,
+          `  %out = fptosi double %coerced to i32`,
+          `  ret i32 %out`,
+        );
+        break;
+    }
+    defs.push(`}`, ``);
+  }
+  return { globals, defs };
+}
+
+export function emitParts(emitter: LlEmitter): string[] {
+  const parts = [
+    ...limitInlineDynReleases(emitter.emitModuleParts()),
+    ...emitter.disposeObserverGates(),
+  ];
+  if (!emitter.executableTls) return parts;
+  // A worker executable's thread-locals all live in the executable's own
+  // TLS block: the program's internal ones, and the runtime's external
+  // ones, because the runtime is always linked statically into the
+  // executable. So on ELF they can all use the local-exec model: LLVM's
+  // default general-dynamic sequence (relaxed by the linker to `mov %fs:0`
+  // plus an add), and even initial-exec (relaxed to `mov $offset` plus an
+  // indexed access), become one %fs-relative operand LLVM can fold into
+  // loads and compares. Darwin's thread-local variables have one model.
+  return parts.map((part) =>
+    part
+      .replace(
+        /^(@[-$._A-Za-z0-9]+ = internal )thread_local global /gm,
+        "$1thread_local(localexec) global ",
+      )
+      .replace(
+        /^(@[-$._A-Za-z0-9]+ = external )thread_local global /gm,
+        "$1thread_local(localexec) global ",
+      ),
+  );
+}
diff --git a/packages/compiler/src/backend/llvm/emit-statements.ts b/packages/compiler/src/backend/llvm/emit-statements.ts
new file mode 100644
index 000000000..e641f3ecd
--- /dev/null
+++ b/packages/compiler/src/backend/llvm/emit-statements.ts
@@ -0,0 +1,1985 @@
+/* LlEmitter's statement emission: the statement switch, try/catch, switch, loop copies, speculative writes and string self-concatenation. */
+import { type LlEmitter, type LlScopeEntry, adoptingAwaitOf } from "./emitter.js";
+import { CAUGHT, type IrExpr, type IrStmt, STRING, isRefCounted } from "../../ir/ir.js";
+import { emitStringSliceSnapshot } from "./string-slices.js";
+import {
+  canDeferSplitPiece,
+  emitSplitCursor,
+  emitSplitNext,
+  emitSplitScratch,
+  emitSplitSnapshot,
+  emitSplitSpanNext,
+  loadSplitSnapshot,
+  storeSplitSnapshot,
+  stringSplit,
+} from "./split-loops.js";
+import {
+  type StackObjectField,
+  type StackObjectSource,
+  emitStackObject,
+  stackObjectFields,
+  stackObjectStruct,
+} from "./stack-objects.js";
+import { emitStackUnion } from "./stack-unions.js";
+import { emitBorrowedArrayRead, emitLocalArrayRead } from "./local-array-reads.js";
+import { emitStackMapRead } from "./map-read-lifetimes.js";
+import { allocateLocalUnion, storeLocalUnion } from "./local-union-storage.js";
+import { boxAccess, boxNewCall, elemAccess } from "./shapes.js";
+import { dynHoleRead } from "./loop-array-borrows.js";
+import { endsWithJump, matchStringSelfConcat } from "../../ir/analysis.js";
+import { emitDiscardedSplice } from "./expr-containers.js";
+import { InternalCompilerError } from "../../errors.js";
+import { emitDenseArrayGet, emitDenseArrayPop, emitDenseArraySet } from "./dense-array-access.js";
+import { emitBorrowedInput } from "./borrowed-inputs.js";
+import { f64Lit, llvmCommentText, sizeToDouble } from "./common.js";
+import { RESULT_DST_ID, RESULT_ENTRY_PREFIX } from "./record-results.js";
+import {
+  matchIntegerArrayForLoop,
+  matchIntegerBytesForLoop,
+  matchIntegerCountedForLoop,
+} from "../../ir/integer-loops.js";
+import { emitByteWindowGuard, matchByteWindow } from "./byte-windows.js";
+import { countedDenseShape, emitDenseLoopGuard, matchDenseArrayLoop } from "./dense-array-loops.js";
+import { emitCountedLoopLimit } from "./counted-loops.js";
+import { mangleLocal } from "../mangle.js";
+import { LlvmUnsupportedError } from "./unsupported.js";
+import type { LlValue } from "./expr-context.js";
+import { SCALAR_UNION_RESULT } from "./int32-abi.js";
+import { emitLiteralSwitch } from "./switch-dispatch.js";
+import {
+  SPECULATIVE_RANGE,
+  emitSafeIntegerCheck,
+  emitSpeculativeInteger,
+  planSpeculativeLoop,
+  speculativeReads,
+  speculativeWriteTarget,
+} from "./speculative-integers.js";
+import {
+  emitConcatInputs,
+  emitMixedConcat,
+  numberPart,
+  stringParts,
+} from "./string-construction.js";
+import { emitStringInputs } from "./string-lifetimes.js";
+
+export function emitStmtBody(emitter: LlEmitter, s: IrStmt): void {
+  const B = emitter.B;
+  emitter.frames.push([]);
+  switch (s.kind) {
+    case "varDecl": {
+      if (s.init && emitter.int32Locals.has(s.localId)) {
+        emitter.storeInt32Local(s.localId, emitter.emitExpr(s.init), s.init);
+        break;
+      }
+      const b = emitter.binding(s.localId);
+      if (emitter.walkBorrows.has(s.localId) && b.kind === "local") {
+        // A borrowed walk pointer: no retain now, no release at scope exit.
+        const v = s.init === null ? "null" : emitter.emitReadReceiver(s.init).name;
+        B.line(`store ptr ${v}, ptr ${b.slot}`);
+        break;
+      }
+      const slice = emitter.scalarStringSlices.get(s.localId);
+      if (slice) {
+        const snapshot = emitStringSliceSnapshot(emitter, slice);
+        emitter.stringSlices.set(s.localId, snapshot);
+        emitter.scopes[emitter.scopes.length - 1]!.push({ slot: snapshot.source, type: STRING });
+        break;
+      }
+      const split = emitter.privateSplitLocals.get(s.localId);
+      if (split) {
+        const snapshot = storeSplitSnapshot(emitter, emitSplitSnapshot(emitter, split));
+        emitter.storedSplits.set(s.localId, snapshot);
+        emitter.scopes[emitter.scopes.length - 1]!.push(
+          { slot: snapshot.sourceSlot, type: STRING },
+          { slot: snapshot.separatorSlot, type: STRING },
+        );
+        break;
+      }
+      const stackObject = emitter.localStackObjects.get(s.localId);
+      if (stackObject) {
+        const value = emitStackObject(emitter, stackObject, (fields) =>
+          emitter.ownScopeFields(fields),
+        );
+        B.line(`store ptr ${value.name}, ptr ${b.slot}`);
+        break;
+      }
+      if (s.init && emitter.reassignedStackObjects.has(s.localId)) {
+        const slot = emitter.stackObjectSlot(s.localId, s.init.type);
+        emitStackObject(
+          emitter,
+          s.init as StackObjectSource,
+          (fields) => emitter.ownScopeFields(fields),
+          slot,
+        );
+        B.line(`store ptr ${slot}, ptr ${b.slot}`);
+        break;
+      }
+      const localUnion = emitter.localStackUnions.get(s.localId);
+      if (localUnion) {
+        const union = emitStackUnion(emitter, localUnion);
+        B.line(`store ptr ${union.value.name}, ptr ${b.slot}`);
+        if (union.payload) {
+          emitter.toFrame(union.payload);
+          emitter.scopes[emitter.scopes.length - 1]!.push({
+            slot: union.payloadSlot,
+            type: union.payload.type,
+          });
+        }
+        break;
+      }
+      const localRead = emitter.localArrayReads.get(s.localId);
+      if (localRead) {
+        const owner = emitLocalArrayRead(
+          emitter,
+          !localRead.borrow && emitter.unwrittenLocalArrayRead(s, localRead)
+            ? { ...localRead, borrow: true }
+            : localRead,
+          b.slot,
+        );
+        if (owner) emitter.scopes[emitter.scopes.length - 1]!.push(owner);
+        break;
+      }
+      const mapRead = emitter.mapReadLifetimes.locals.get(s.localId);
+      if (mapRead) {
+        const result = emitStackMapRead(emitter, mapRead);
+        B.line(`store ptr ${result.value.name}, ptr ${b.slot}`);
+        if (result.owner) emitter.scopes[emitter.scopes.length - 1]!.push(result.owner);
+        break;
+      }
+      const localStorage = emitter.localUnionStorageProofs.get(s.localId);
+      if (localStorage && s.init) {
+        const storage = allocateLocalUnion(emitter, localStorage);
+        emitter.localUnionStorage.set(s.localId, storage);
+        storeLocalUnion(emitter, storage, s.init);
+        B.line(`store ptr ${storage.box}, ptr ${b.slot}`);
+        if (storage.owner && storage.ownerType)
+          emitter.scopes[emitter.scopes.length - 1]!.push({
+            slot: storage.owner,
+            type: storage.ownerType,
+          });
+        break;
+      }
+      if (b.kind === "boxed") {
+        const stack = emitter.stackCaptures.emit(emitter, s.localId, b.type);
+        if (stack) {
+          B.line(`store ptr ${stack.box}, ptr ${b.slot}`);
+          if (stack.owner) emitter.scopes[emitter.scopes.length - 1]!.push(stack.owner);
+          if (s.init) {
+            const value = emitter.emitExpr(s.init);
+            if (isRefCounted(value.type)) emitter.toFrame(value);
+            emitter.boxSet(stack.box, b.type, value.name);
+          }
+          break;
+        }
+        // Box FIRST, then evaluate the initializer: a named function
+        // expression's closure captures this box during init evaluation.
+        // A SCALAR TDZ box rides an ARR-kind box: the value lives in a
+        // one-element array cell, so the empty (NULL) slot stays the
+        // not-yet-initialized sentinel — a raw scalar slot has no spare
+        // bit pattern to spend on it (stmts.ts's varDecl).
+        const boxNew =
+          b.local!.tdz === true && boxAccess(b.type) !== "ref"
+            ? (emitter.declare(`declare ptr @scr_box_new(i32)`), `call ptr @scr_box_new(i32 3)`)
+            : boxNewCall(emitter.shapeHost, b.type);
+        const box = B.tmp();
+        B.line(`${box} = ${boxNew} ; let ${b.local!.name} (boxed)`);
+        B.line(`store ptr ${box}, ptr ${b.slot}`);
+        emitter.scopes[emitter.scopes.length - 1]!.push({
+          slot: b.slot,
+          type: b.type,
+          boxed: true,
+        });
+        if (s.init === null) {
+          // An empty TDZ box whose payload can legitimately be NULL
+          // starts at its distinct sentinel (tdzEmptySentinel).
+          const sentinel = b.local!.tdz === true ? emitter.tdzEmptySentinel(b.type) : null;
+          if (sentinel !== null) B.line(`store ptr ${sentinel}, ptr ${emitter.boxSlot(box)}`);
+          break;
+        }
+        const v = emitter.emitExpr(s.init);
+        if (isRefCounted(v.type)) emitter.toHeap(v); // the box takes ownership
+        if (b.local!.tdz === true && boxAccess(b.type) !== "ref") {
+          emitter.tdzScalarInit(box, b.type, v.name);
+        } else {
+          emitter.boxSet(box, b.type, v.name);
+        }
+        break;
+      }
+      if (s.init === null) {
+        // Declared, uninitialized (`let x: number;`): reset the slot —
+        // inside a loop the previous iteration's scope exit released the
+        // old value and left a stale pointer (NULL-tolerant releases).
+        if (isRefCounted(b.type)) {
+          B.line(`store ptr null, ptr ${b.slot}`);
+          emitter.scopes[emitter.scopes.length - 1]!.push({ slot: b.slot, type: b.type });
+        }
+        break;
+      }
+      if (emitter.loopArrayBorrows.has(s) && s.init.kind === "arrayGet") {
+        emitBorrowedArrayRead(emitter, s.init, b.slot);
+        break;
+      }
+      const holeRead = emitter.loopArrayBorrows.has(s) ? dynHoleRead(s.init) : null;
+      if (holeRead && s.init.kind === "ternary") {
+        // A hole reads as the immortal undefined value, which needs no owner.
+        const present = emitter.emitExpr(s.init.cond);
+        const filled = B.newLabel("borrow.hole.filled"),
+          missing = B.newLabel("borrow.hole.missing"),
+          done = B.newLabel("borrow.hole.done");
+        B.condBr(present.name, filled, missing);
+        B.startBlock(filled);
+        emitBorrowedArrayRead(emitter, holeRead, b.slot);
+        B.br(done);
+        B.startBlock(missing);
+        emitter.declare("declare ptr @scr_dyn_undefined()");
+        const undef = B.tmp();
+        B.line(`${undef} = call ptr @scr_dyn_undefined()`);
+        B.line(`store ptr ${undef}, ptr ${b.slot}`);
+        B.br(done);
+        B.startBlock(done);
+        break;
+      }
+      // A stable lexical alias cannot outlive its unchanged local owner.
+      // Whole-value uses still retain their own copies, so returning or
+      // storing the alias preserves the ordinary heap representation.
+      // Boxed captures, reassigned sources and projections need ownership.
+      if (
+        b.kind === "local" &&
+        b.local &&
+        isRefCounted(b.type) &&
+        emitter.stableCallBindings.has(s.localId) &&
+        (emitter.canBorrowCallArgument(s.init) || emitter.unwrittenAlias(s))
+      ) {
+        const v = emitter.emitReadReceiver(s.init);
+        B.line(`store ptr ${v.name}, ptr ${b.slot}`);
+        break;
+      }
+      const v = emitter.emitExpr(s.init);
+      if (b.kind === "global") emitter.toHeap(v);
+      else emitter.toFrame(v);
+      B.line(`store ${emitter.llType(b.type)} ${v.name}, ptr ${b.slot}`);
+      emitter.storeIntegerView(s.localId, v, s.init);
+      if (isRefCounted(b.type)) {
+        emitter.scopes[emitter.scopes.length - 1]!.push({ slot: b.slot, type: b.type });
+        emitter.noteLastUseMove(s, b);
+      }
+      break;
+    }
+    case "assign": {
+      if (emitter.int32Locals.has(s.localId)) {
+        emitter.storeInt32Local(s.localId, emitter.emitExpr(s.value), s.value);
+        break;
+      }
+      const owner = emitter.reboundOwnerSlots.get(s.localId);
+      if (owner !== undefined && !emitter.walkBorrows.has(s.localId)) {
+        // A rebound borrowed parameter: the new value moves into the owner
+        // slot, replacing (and releasing) the previous owned value. This
+        // precedes the in-place string append, which would release the
+        // caller's borrow.
+        const param = emitter.binding(s.localId);
+        const slot = param.slot;
+        const v = emitter.emitExpr(s.value);
+        emitter.toFrame(v);
+        const old = B.tmp();
+        B.line(`${old} = load ptr, ptr ${owner}`);
+        emitter.releaseFrame(old, param.type);
+        B.line(`store ptr ${v.name}, ptr ${slot}`);
+        B.line(`store ptr ${v.name}, ptr ${owner}`);
+        break;
+      }
+      if (emitter.reassignedStackObjects.has(s.localId)) {
+        // The new value may read the old one: build it apart (its
+        // reference fields owned by this statement until it completes),
+        // then copy it over the binding's slot. The binding takes over the
+        // new fields; the old ones are released after the slot no longer
+        // holds them.
+        const struct = stackObjectStruct(s.value.type);
+        let owned: readonly StackObjectField[] = [];
+        const value = emitStackObject(emitter, s.value as StackObjectSource, (fields) => {
+          owned = fields;
+          for (const field of fields) emitter.ownSlot(field.ptr, field.type);
+        });
+        const target = emitter.stackObjectSlot(s.localId, s.value.type);
+        const old = stackObjectFields(emitter, s.value.type, target).map((field) => {
+          const t = B.tmp();
+          B.line(`${t} = load ptr, ptr ${field.ptr}`);
+          return { name: t, type: field.type };
+        });
+        const bits = B.tmp();
+        B.line(`${bits} = load ${struct}, ptr ${value.name}`);
+        B.line(`store ${struct} ${bits}, ptr ${target}`);
+        emitter.disownSlots(owned);
+        for (const field of old) emitter.releaseFrame(field.name, field.type);
+        break;
+      }
+      const localStorage = emitter.localUnionStorage.get(s.localId);
+      if (localStorage) {
+        storeLocalUnion(emitter, localStorage, s.value);
+        break;
+      }
+      const self = matchStringSelfConcat(s.localId, s.value);
+      if (self) {
+        emitter.emitStringSelfConcatAssign(s.localId, self.left, self.suffix, false);
+        break;
+      }
+      const b = emitter.binding(s.localId);
+      if (emitter.walkBorrows.has(s.localId) && b.kind === "local") {
+        // Rebinding a borrowed walk pointer releases nothing.
+        B.line(`store ptr ${emitter.emitReadReceiver(s.value).name}, ptr ${b.slot}`);
+        break;
+      }
+      const v = emitter.emitExpr(s.value);
+      if (b.kind === "global" && !s.initializes) emitter.checkGlobalTdz(s.localId);
+      if (b.kind === "boxed") {
+        emitter.writeBindingBox(emitter.loadBox(b.slot), b.local!, v.name, s.initializes);
+        // The RHS remains frame-owned until a possible TDZ throw passes.
+        if (isRefCounted(v.type)) emitter.toHeap(v);
+        break;
+      }
+      if (b.kind === "global") emitter.toHeap(v);
+      else emitter.toFrame(v);
+      if (isRefCounted(b.type)) {
+        const old = B.tmp();
+        B.line(`${old} = load ptr, ptr ${b.slot}`);
+        if (b.kind === "global") emitter.releaseHeap(old, b.type);
+        else emitter.releaseFrame(old, b.type);
+      }
+      B.line(`store ${emitter.llType(b.type)} ${v.name}, ptr ${b.slot}`);
+      emitter.storeIntegerView(s.localId, v, s.value);
+      if (b.kind === "global" && emitter.immortalGlobals.has(s.localId)) {
+        // An Immutable module constant (contracts/check.ts proved it is
+        // fresh, publishable and never written): its graph becomes
+        // immortal, so reads skip reference counting and the collector
+        // never visits it.
+        const lines = emitter.publishWalkers.emitPublish(v.name, v.type, s.loc);
+        for (const line of lines) B.line(line.trimStart());
+        // Reads of this global skip retains from here on, which is only
+        // sound once the graph really is immortal. Node.js never fails
+        // here, so a refusal means the contract proof was wrong: stop
+        // rather than keep running with a mortal graph read as immortal.
+        if (lines.length > 0) {
+          emitter.declare(`declare zeroext i1 @scr_exc_pending()`);
+          emitter.declare(`declare void @scr_trap(ptr)`);
+          const refused = B.tmp();
+          B.line(`${refused} = call zeroext i1 @scr_exc_pending()`);
+          const stop = B.newLabel("immutable.refused");
+          const done = B.newLabel("immutable.published");
+          B.condBr(refused, stop, done);
+          B.startBlock(stop);
+          B.line(
+            `call void @scr_trap(ptr ${emitter.cstr("scriptc: internal error: an Immutable value could not be published\n")})`,
+          );
+          B.terminate("unreachable");
+          B.startBlock(done);
+        }
+      }
+      break;
+    }
+    case "exprStmt":
+      // A statement-position splice never observes its removed elements.
+      if (!emitDiscardedSplice(emitter, s.expr)) emitter.emitDiscarded(s.expr);
+      break;
+    case "arraySet": {
+      // Evaluation order matches JS: array, index, then value. Ownership
+      // of a refcounted value moves into the array (the runtime releases
+      // the replaced element itself). A local receiver that the index and
+      // value cannot rebind is read in place, as for field stores; the
+      // released element cannot reach that binding.
+      if (emitter.emitArraySelfConcat(s)) break;
+      const arr = emitter.emitStableReceiver(s.arr, [s.index, s.value]);
+      const idx = emitter.emitExpr(s.index);
+      const v = emitter.emitExpr(s.value);
+      if (s.arr.type.kind !== "array")
+        throw new InternalCompilerError("llvm emitter bug: arraySet on non-array");
+      const acc = elemAccess(s.arr.type.elem);
+      emitter.emitPublishedArrayGuard(arr.name, s.arr.type, 0, idx.name);
+      if (acc === "ref") emitter.toHeap(v);
+      emitDenseArraySet(
+        emitter,
+        arr.name,
+        idx,
+        s.index,
+        acc,
+        s.arr.type.elem,
+        v.name,
+        emitter.provenDenseIndex(s.arr, s.index),
+      );
+      break;
+    }
+    case "arraySetLength": {
+      // Pop's `length = 0` store on an empty array only matters when the
+      // array can be frozen (published); its operand is a local.
+      if (
+        s.pop === true &&
+        s.length.kind === "numLit" &&
+        s.length.value === 0 &&
+        emitter.publishedTypes?.containerGuarded(s.arr.type) !== true
+      )
+        break;
+      const arr = emitBorrowedInput(emitter, s.arr);
+      const length = emitter.emitExpr(s.length);
+      if (s.arr.type.kind !== "array")
+        throw new InternalCompilerError("llvm emitter bug: arraySetLength on non-array");
+      emitter.emitPublishedArrayGuard(arr.name, s.arr.type, s.pop === true ? 2 : 3);
+      emitter.declare(`declare void @scr_arr_set_len(ptr, double)`);
+      // Assigning the current length (a reused work array reset to where
+      // it already is) changes nothing: the runtime's validation accepts
+      // exactly the value equal to the length (-0 included, NaN never),
+      // and no element is released. Everything else keeps the call.
+      const lenPtr = B.tmp(),
+        len = B.tmp(),
+        lenNumber = B.tmp(),
+        same = B.tmp();
+      const resize = B.newLabel("arr.len.set"),
+        done = B.newLabel("arr.len.done");
+      B.line(`${lenPtr} = getelementptr inbounds %ScrArr, ptr ${arr.name}, i32 0, i32 1`);
+      emitter.markMemoryPointer(lenPtr, "array:header");
+      B.line(
+        `${len} = load ${emitter.sizeType}, ptr ${lenPtr}${emitter.fieldAliasAttachment(lenPtr)}${emitter.arrayLengthRange}`,
+      );
+      B.line(
+        `${lenNumber} = ${sizeToDouble(emitter.sizeType)} ${emitter.sizeType} ${len} to double`,
+      );
+      B.line(`${same} = fcmp oeq double ${length.name}, ${lenNumber}`);
+      B.condBr(same, done, resize);
+      B.startBlock(resize);
+      if (s.pop === true) {
+        // A discarded pop's `length - 1` on a packed array removes the
+        // last element inline, then releases it.
+        const call = B.newLabel("arr.len.call"),
+          pop = B.newLabel("arr.len.pop");
+        const lastNumber = B.tmp(),
+          dropsLast = B.tmp();
+        B.line(`${lastNumber} = fsub double ${lenNumber}, 1.0`);
+        B.line(`${dropsLast} = fcmp oeq double ${length.name}, ${lastNumber}`);
+        B.condBr(dropsLast, pop, call);
+        B.startBlock(pop);
+        const elem = s.arr.type.elem;
+        const acc = elemAccess(elem);
+        const raw = emitDenseArrayPop(emitter, arr.name, acc, call, call);
+        if (acc === "ref" && isRefCounted(elem)) {
+          const old = B.tmp();
+          B.line(`${old} = inttoptr i64 ${raw} to ptr`);
+          emitter.releaseHeap(old, elem);
+        }
+        B.br(done);
+        B.startBlock(call);
+      }
+      B.line(`call void @scr_arr_set_len(ptr ${arr.name}, double ${length.name})`);
+      emitter.emitPendingCheck();
+      B.br(done);
+      B.startBlock(done);
+      break;
+    }
+    case "arraySetUndefined":
+    case "arrayDelete": {
+      const arr = emitBorrowedInput(emitter, s.arr);
+      const idx = emitter.emitExpr(s.index);
+      if (s.arr.type.kind !== "array")
+        throw new InternalCompilerError(`llvm emitter bug: ${s.kind} on non-array`);
+      emitter.emitPublishedArrayGuard(
+        arr.name,
+        s.arr.type,
+        s.kind === "arrayDelete" ? 5 : 0,
+        idx.name,
+      );
+      const fn = s.kind === "arraySetUndefined" ? "scr_arr_set_undefined" : "scr_arr_delete";
+      emitter.declare(
+        `declare ${s.kind === "arrayDelete" ? "zeroext i1" : "void"} @${fn}(ptr, double)`,
+      );
+      if (s.kind === "arrayDelete")
+        B.line(`call zeroext i1 @${fn}(ptr ${arr.name}, double ${idx.name})`);
+      else B.line(`call void @${fn}(ptr ${arr.name}, double ${idx.name})`);
+      break;
+    }
+    case "bytesSet": {
+      // Typed-array element write: same evaluation order as arraySet;
+      // the value is a scalar (the kind-specific inline path coerces
+      // JS-exactly), so no ownership moves. Invalid writes are ignored.
+      // IrBytesElem is static, so never rediscover it through the
+      // generic runtime switch in a hot loop.
+      const arr = emitter.emitStableReceiver(s.arr, [s.index, s.value]);
+      const idx = emitter.emitExpr(s.index);
+      const v = emitter.emitExpr(s.value);
+      if (s.arr.type.kind !== "bytes")
+        throw new InternalCompilerError("llvm emitter bug: bytesSet on non-bytes");
+      emitter.emitBytesSet(
+        s.arr.type.elem,
+        arr.name,
+        idx,
+        v,
+        s.index,
+        s.value,
+        emitter.bytesBounds.has(s),
+      );
+      break;
+    }
+    case "fieldSet":
+    case "recordSet": {
+      // Evaluation order: obj, then value. New value moved in; the old
+      // value is released AFTER the field is overwritten (unlink-then-
+      // release — a release can trigger a cycle collection, which must
+      // never see a heap edge whose count was already given up).
+      // Classes and records share the struct layout, so one emission.
+      const nullable =
+        s.kind === "fieldSet" ? emitter.nullableFields.get(s.className, s.field) : null;
+      if (nullable && s.kind === "fieldSet") {
+        const obj = emitter.emitStableReceiver(s.obj, [s.value]);
+        // (The guard precedes the value here: the nullable store
+        // evaluates it itself.)
+        emitter.emitStoreGuard(obj.name, s);
+        emitter.emitNullableFieldStore(obj.name, s.className, s.field, nullable, s.value);
+        break;
+      }
+      if (s.kind === "fieldSet" && emitter.int32Slots.isField(s.className, s.field)) {
+        const obj = emitter.emitStableReceiver(s.obj, [s.value]);
+        const v = emitter.emitExpr(s.value);
+        emitter.emitStoreGuard(obj.name, s);
+        const { ptr } = emitter.classFieldPtr(obj.name, s.className, s.field);
+        emitter.storeInt32Field(ptr, v, s.value);
+        break;
+      }
+      if (emitter.emitFieldSelfConcat(s)) break;
+      const obj = emitter.emitStableReceiver(s.obj, [s.value]);
+      const v = emitter.emitFieldValue(
+        s.value,
+        s.kind === "recordSet"
+          ? emitter.recordFieldInline(s.shapeId, s.field)
+          : emitter.inlineUnions.classField(s.className, s.field),
+      );
+      if (s.kind === "fieldSet") emitter.emitStoreGuard(obj.name, s);
+      else if (emitter.publishedTypes?.recordGuarded(s.shapeId) === true)
+        emitter.emitPublishedFieldGuard(obj.name, null, s.field);
+      const { ptr, type, inline } =
+        s.kind === "fieldSet"
+          ? emitter.classFieldPtr(obj.name, s.className, s.field)
+          : emitter.recordFieldPtr(obj.name, s.shapeId, s.field);
+      // A result-slot entry fills zeroed caller storage, each field once.
+      if (
+        s.kind === "recordSet" &&
+        s.obj.kind === "varRef" &&
+        s.obj.localId === RESULT_DST_ID &&
+        emitter.currentFunctionName.startsWith(RESULT_ENTRY_PREFIX)
+      )
+        emitter.initField(ptr, type, inline, v);
+      else emitter.replaceField(ptr, type, inline, v);
+      if (
+        s.kind === "fieldSet" &&
+        s.field === "name" &&
+        emitter.classMeta.get(s.className)?.root.def.name === "%Error"
+      ) {
+        const present = emitter.classFieldPtr(obj.name, s.className, "%namePresent").ptr;
+        const enumerable = emitter.classFieldPtr(obj.name, s.className, "%nameEnumerable").ptr;
+        const wasPresent = B.tmp(),
+          wasEnumerable = B.tmp(),
+          isPresent = B.tmp(),
+          nextEnumerable = B.tmp();
+        B.line(`${wasPresent} = load i8, ptr ${present}`);
+        B.line(`${wasEnumerable} = load i8, ptr ${enumerable}`);
+        B.line(`${isPresent} = icmp ne i8 ${wasPresent}, 0`);
+        B.line(`${nextEnumerable} = select i1 ${isPresent}, i8 ${wasEnumerable}, i8 1`);
+        B.line(`store i8 1, ptr ${present}`);
+        B.line(`store i8 ${nextEnumerable}, ptr ${enumerable}`);
+      }
+      break;
+    }
+    case "recordKeyDelete": {
+      // `delete obj[k]` on a pure index-signature shape: a Map delete on
+      // the overflow (key and value released; absent keys no-op).
+      const obj = emitter.emitExpr(s.obj);
+      const key = emitter.emitExpr(s.key);
+      if (emitter.publishedTypes?.recordGuarded(s.shapeId) === true) {
+        // Node: "Cannot delete property 'k' of #<Object>" (key known at
+        // run time only; the guard reports the frozen record generically).
+        emitter.emitPublishedFieldGuard(obj.name, null, "[key]");
+      }
+      const ovf = emitter.recordOvfPtr(obj.name, s.shapeId);
+      emitter.declare(`declare zeroext i1 @scr_map_delete_str(ptr, ptr)`);
+      const t = B.tmp();
+      B.line(`${t} = call zeroext i1 @scr_map_delete_str(ptr ${ovf}, ptr ${key.name})`);
+      break;
+    }
+    case "recordKeySet": {
+      // Dynamic-keyed record write (the C per-shape helper, inline):
+      // declared keys write through (same-typed — dyn-valued shapes,
+      // whose writes validate and can throw, stay refused), undeclared
+      // keys insert/replace in the overflow map. Evaluation order: obj,
+      // key, value; the write OWNS the value (+1 moves in).
+      const obj = emitter.emitExpr(s.obj);
+      const key = emitter.emitExpr(s.key);
+      const v = emitter.emitExpr(s.value);
+      if (emitter.publishedTypes?.recordGuarded(s.shapeId) === true)
+        emitter.emitPublishedFieldGuard(obj.name, null, "[key]");
+      if (isRefCounted(v.type)) emitter.toHeap(v);
+      const shape = emitter.recordShape(s.shapeId);
+      // Signature-free shapes dispatch over their (one-typed) declared
+      // fields and TRAP on a miss (scr_record_key_miss — JS would add
+      // the property, which a monomorphic struct cannot); overflow
+      // shapes keep the map insert tail.
+      const iv = shape.indexValue ?? shape.fields[0]?.type;
+      if (!iv)
+        throw new InternalCompilerError(
+          `llvm emitter bug: keyed write on field-free non-overflow shape ${s.shapeId}`,
+        );
+      const vAcc = iv.kind === "f64" ? "f64" : iv.kind === "bool" ? "bool" : "ref";
+      if (s.overflowOnly === true) {
+        // A LITERAL key naming no declared field: a plain overflow
+        // insert — no field chain.
+        const ovf = emitter.recordOvfPtr(obj.name, s.shapeId);
+        emitter.mapSet(ovf, "str", vAcc, key.name, v.name);
+        break;
+      }
+      const join = B.newLabel("rks.j");
+      if (iv.kind === "dyn" && shape.indexValue) {
+        // A dyn-valued shape (the C recordKeySetHelper's dyn arm,
+        // inline): declared keys VALIDATE the dyn value against the
+        // field's type first (dynCheck — a mismatched write throws the
+        // catchable TypeError and leaves the field untouched; JS would
+        // store anything, the documented divergence); undeclared keys
+        // insert the dyn value into the overflow map as-is.
+        emitter.declare(`declare void @scr_dyn_release(ptr)`);
+        for (const f of shape.fields) {
+          const hit = B.tmp();
+          B.line(
+            `${hit} = call zeroext i1 ${emitter.literalEquals(f.name)}(ptr ${key.name}) ; ${llvmCommentText(f.name)}`,
+          );
+          const lh = B.newLabel("rks.h");
+          const ln = B.newLabel("rks.n");
+          B.condBr(hit, lh, ln);
+          B.startBlock(lh);
+          const pathSlot = B.slot();
+          B.entryAllocas.push(`${pathSlot} = alloca %ScrDynPath`);
+          const pp = B.tmp();
+          const kp = B.tmp();
+          const ip = B.tmp();
+          B.line(`${pp} = getelementptr inbounds %ScrDynPath, ptr ${pathSlot}, i64 0, i32 0`);
+          B.line(`store ptr null, ptr ${pp}`);
+          B.line(`${kp} = getelementptr inbounds %ScrDynPath, ptr ${pathSlot}, i64 0, i32 1`);
+          B.line(`store ptr ${emitter.cstr(f.name)}, ptr ${kp}`);
+          B.line(`${ip} = getelementptr inbounds %ScrDynPath, ptr ${pathSlot}, i64 0, i32 2`);
+          B.line(`store ${emitter.sizeType} 0, ptr ${ip}`);
+          const helper = emitter.dyn.dynCheckHelper(f.type);
+          const fty = emitter.llType(f.type);
+          const nv = B.tmp();
+          B.line(
+            `${nv} = call ${fty === "i1" ? "zeroext i1" : fty} @${helper}(ptr ${v.name}, ptr ${pathSlot})`,
+          );
+          B.line(`call void @scr_dyn_release(ptr ${v.name})`);
+          // Mismatched write: TypeError pending, field untouched — the
+          // statement-level check below unwinds.
+          const pend = B.tmp();
+          for (const line of emitter.pendingTestLines(pend)) B.line(line.trimStart());
+          const lw = B.newLabel("rks.w");
+          B.condBr(pend, join, lw);
+          B.startBlock(lw);
+          const { ptr, type, inline } = emitter.recordFieldPtr(obj.name, s.shapeId, f.name);
+          if (inline) {
+            // The slot copies the checked value's bits; nv is released below.
+            emitter.storeField(ptr, type, nv, true);
+            emitter.releaseFrame(nv, type);
+          } else if (isRefCounted(type)) {
+            const old = B.tmp();
+            B.line(`${old} = load ptr, ptr ${ptr}`);
+            emitter.storeField(ptr, type, nv, false);
+            emitter.releaseHeap(old, type);
+          } else {
+            emitter.storeField(ptr, type, nv, false);
+          }
+          B.br(join);
+          B.startBlock(ln);
+        }
+        const ovf = emitter.recordOvfPtr(obj.name, s.shapeId);
+        emitter.mapSet(ovf, "str", vAcc, key.name, v.name);
+        B.br(join);
+        B.startBlock(join);
+        // MAY THROW exactly when a dyn value can validate against a
+        // declared field (stmts.ts's condition).
+        if (shape.fields.length > 0) emitter.emitPendingCheck();
+        break;
+      }
+      for (const f of shape.fields) {
+        // typeEquals(f.type, iv) — the frontend fences everything else.
+        const hit = B.tmp();
+        B.line(
+          `${hit} = call zeroext i1 ${emitter.literalEquals(f.name)}(ptr ${key.name}) ; ${llvmCommentText(f.name)}`,
+        );
+        const lh = B.newLabel("rks.h");
+        const ln = B.newLabel("rks.n");
+        B.condBr(hit, lh, ln);
+        B.startBlock(lh);
+        const { ptr, type, inline } = emitter.recordFieldPtr(obj.name, s.shapeId, f.name);
+        if (inline) {
+          // The write owns the moved-in value; the slot copies its bits.
+          emitter.storeField(ptr, type, v.name, true);
+          emitter.releaseHeap(v.name, type);
+        } else if (isRefCounted(type)) {
+          const old = B.tmp();
+          B.line(`${old} = load ptr, ptr ${ptr}`);
+          emitter.storeField(ptr, type, v.name, false);
+          emitter.releaseHeap(old, type);
+        } else {
+          emitter.storeField(ptr, type, v.name, false);
+        }
+        B.br(join);
+        B.startBlock(ln);
+      }
+      if (!shape.indexValue) {
+        // The MISS on a fixed shape: release the moved-in value, throw
+        // the catchable TypeError naming the key (scr_record_key_miss —
+        // JS would add the property, the documented divergence).
+        if (isRefCounted(iv)) emitter.releaseHeap(v.name, iv);
+        emitter.declare(`declare void @scr_record_key_miss(ptr)`);
+        B.line(`call void @scr_record_key_miss(ptr ${key.name})`);
+        B.br(join);
+        B.startBlock(join);
+        emitter.emitPendingCheck();
+        break;
+      }
+      const ovf = emitter.recordOvfPtr(obj.name, s.shapeId);
+      emitter.mapSet(ovf, "str", vAcc, key.name, v.name);
+      B.br(join);
+      B.startBlock(join);
+      break;
+    }
+    case "block": {
+      if (s.labels === undefined) {
+        emitter.emitBlock(s.body);
+        break;
+      }
+      // A labeled block: `break lbl` inside branches to the end label.
+      const le = B.newLabel("blk.e");
+      emitter.jumpTargets.push({
+        kind: "block",
+        brkLabel: le,
+        contLabel: null,
+        labels: s.labels,
+        frameDepth: emitter.frames.length,
+        scopeDepth: emitter.scopes.length,
+        finallyDepth: emitter.finallyStack.length,
+      });
+      emitter.emitBlock(s.body);
+      emitter.jumpTargets.pop();
+      B.br(le);
+      B.startBlock(le);
+      break;
+    }
+    case "if": {
+      const cond = emitter.emitCondition(s.cond);
+      const trueLabel = B.newLabel("if.t");
+      const joinLabel = B.newLabel("if.j");
+      const falseLabel = s.else_ ? B.newLabel("if.f") : joinLabel;
+      B.condBr(cond, trueLabel, falseLabel);
+      B.startBlock(trueLabel);
+      emitter.emitBlock(s.then);
+      B.br(joinLabel);
+      if (s.else_) {
+        B.startBlock(falseLabel);
+        emitter.emitBlock(s.else_);
+        B.br(joinLabel);
+      }
+      B.startBlock(joinLabel);
+      break;
+    }
+    case "while": {
+      const workerBudget = emitter.workerLoopBudget(s);
+      const le = B.newLabel("loop.e");
+      emitter.emitLoopCopies(s, true, le, (exit) => {
+        const lc = B.newLabel("loop.c");
+        const lb = B.newLabel("loop.b");
+        const lp = workerBudget !== null ? B.newLabel("loop.p") : lc;
+        B.br(lc);
+        B.startBlock(lc);
+        B.condBr(emitter.emitCondition(s.cond), lb, exit);
+        B.startBlock(lb);
+        emitter.jumpTargets.push({
+          kind: "loop",
+          brkLabel: exit,
+          contLabel: lp,
+          labels: s.labels,
+          frameDepth: emitter.frames.length,
+          scopeDepth: emitter.scopes.length,
+          finallyDepth: emitter.finallyStack.length,
+        });
+        emitter.emitBlock(s.body);
+        emitter.jumpTargets.pop();
+        B.br(lp);
+        if (lp !== lc) {
+          B.startBlock(lp);
+          emitter.emitWorkerLoopCheck(workerBudget);
+          B.br(lc);
+        }
+      });
+      B.startBlock(le);
+      break;
+    }
+    case "doWhile": {
+      const workerBudget = emitter.workerLoopBudget(s);
+      // Body first (runs at least once); continue jumps to the CONDITION.
+      const le = B.newLabel("loop.e");
+      emitter.emitLoopCopies(s, true, le, (exit) => {
+        const lb = B.newLabel("loop.b");
+        const lc = B.newLabel("loop.c");
+        B.br(lb);
+        B.startBlock(lb);
+        emitter.jumpTargets.push({
+          kind: "loop",
+          brkLabel: exit,
+          contLabel: lc,
+          labels: s.labels,
+          frameDepth: emitter.frames.length,
+          scopeDepth: emitter.scopes.length,
+          finallyDepth: emitter.finallyStack.length,
+        });
+        emitter.emitBlock(s.body);
+        emitter.jumpTargets.pop();
+        B.br(lc);
+        B.startBlock(lc);
+        emitter.emitWorkerLoopCheck(workerBudget);
+        B.condBr(emitter.emitCondition(s.cond), lb, exit);
+      });
+      B.startBlock(le);
+      break;
+    }
+    case "for": {
+      // The init's scope wraps the whole loop (break/continue must NOT
+      // release it — scopeDepth captured after the push, C parity).
+      const integerArrayLoop =
+        emitter.debug === null
+          ? matchIntegerArrayForLoop(s, emitter.currentLocals, emitter.integerArrayBindings)
+          : null;
+      const integerLoop =
+        integerArrayLoop ??
+        (emitter.debug === null ? matchIntegerBytesForLoop(s, emitter.numericLocals) : null);
+      const countedLoop =
+        !integerLoop && emitter.countedLoopsEnabled
+          ? matchIntegerCountedForLoop(
+              s,
+              emitter.numericLocals,
+              emitter.integerRanges,
+              emitter.unaliasedArrays,
+            )
+          : null;
+      const window =
+        countedLoop && emitter.byteWindowsEnabled
+          ? matchByteWindow(
+              s,
+              countedLoop,
+              emitter.numericLocals,
+              emitter.captureIds,
+              emitter.integerRanges,
+              emitter.byteWindowEntries.get(s) ?? new Set(),
+            )
+          : null;
+      const denseShape = !emitter.denseLoopsEnabled
+        ? null
+        : integerArrayLoop
+          ? {
+              counter: integerArrayLoop.localId,
+              length: integerArrayLoop.limitReceiver as IrExpr & { kind: "varRef" },
+              range: { min: 0, max: 4294967294 },
+            }
+          : countedLoop && !countedLoop.guarded
+            ? countedDenseShape(s, countedLoop)
+            : null;
+      const dense =
+        denseShape && !window
+          ? matchDenseArrayLoop(
+              s,
+              denseShape,
+              emitter.numericLocals,
+              emitter.unaliasedArrays,
+              emitter.denseLoopEntries.get(s) ?? new Set(),
+            )
+          : null;
+      if (dense) {
+        const valid = emitDenseLoopGuard(emitter, dense);
+        const fast = B.newLabel("dense.loop.fast"),
+          slow = B.newLabel("dense.loop.slow"),
+          done = B.newLabel("dense.loop.done");
+        B.condBr(valid, fast, slow);
+        emitter.denseLoopsEnabled = false;
+        try {
+          B.startBlock(slow);
+          emitter.emitStmt(s);
+          B.br(done);
+          B.startBlock(fast);
+          emitter.denseLoop = dense;
+          emitter.emitStmt(s);
+          B.br(done);
+        } finally {
+          emitter.denseLoop = null;
+          emitter.denseLoopsEnabled = true;
+        }
+        B.startBlock(done);
+        break;
+      }
+      if (window) {
+        const valid = emitByteWindowGuard(emitter, window);
+        const fast = B.newLabel("bytes.window.fast"),
+          slow = B.newLabel("bytes.window.slow"),
+          done = B.newLabel("bytes.window.done");
+        B.condBr(valid, fast, slow);
+        const originalRanges = emitter.integerRanges,
+          originalBounds = emitter.bytesBounds;
+        emitter.byteWindowsEnabled = false;
+        try {
+          B.startBlock(slow);
+          emitter.emitStmt(s);
+          B.br(done);
+          B.startBlock(fast);
+          emitter.integerRanges = window.ranges;
+          emitter.bytesBounds = new Set([...originalBounds, ...window.bounds]);
+          emitter.emitStmt(s);
+          B.br(done);
+        } finally {
+          emitter.integerRanges = originalRanges;
+          emitter.bytesBounds = originalBounds;
+          emitter.byteWindowsEnabled = true;
+        }
+        B.startBlock(done);
+        break;
+      }
+      let countedJoin: string | null = null;
+      if (countedLoop?.guarded) {
+        let safe = "true";
+        if (countedLoop.limitGuarded) {
+          const bound = emitter.emitExpr(countedLoop.limit);
+          safe = B.tmp();
+          B.line(
+            `${safe} = fcmp ${countedLoop.step > 0 ? "ole" : "oge"} double ${bound.name}, ${f64Lit(countedLoop.guardLimit)}`,
+          );
+        }
+        if (countedLoop.startGuarded) {
+          // An exact integer of at most 2^53 - 1 in magnitude, and not -0
+          // (the bit patterns of the value and its round trip agree).
+          // NaN and infinities fail the ordered range tests.
+          const start = emitter.emitExpr(countedLoop.start);
+          const low = B.tmp(),
+            high = B.tmp(),
+            raw = B.tmp(),
+            wide = B.tmp(),
+            back = B.tmp(),
+            bits = B.tmp(),
+            backBits = B.tmp(),
+            exact = B.tmp(),
+            inRange = B.tmp(),
+            ok = B.tmp();
+          B.line(`${low} = fcmp oge double ${start.name}, ${f64Lit(-Number.MAX_SAFE_INTEGER)}`);
+          B.line(`${high} = fcmp ole double ${start.name}, ${f64Lit(Number.MAX_SAFE_INTEGER)}`);
+          B.line(`${inRange} = and i1 ${low}, ${high}`);
+          B.line(`${raw} = fptosi double ${start.name} to i64`);
+          B.line(`${wide} = freeze i64 ${raw}`);
+          B.line(`${back} = sitofp i64 ${wide} to double`);
+          B.line(`${bits} = bitcast double ${start.name} to i64`);
+          B.line(`${backBits} = bitcast double ${back} to i64`);
+          B.line(`${exact} = icmp eq i64 ${bits}, ${backBits}`);
+          B.line(`${ok} = and i1 ${inRange}, ${exact}`);
+          if (safe === "true") safe = ok;
+          else {
+            const both = B.tmp();
+            B.line(`${both} = and i1 ${safe}, ${ok}`);
+            safe = both;
+          }
+        }
+        const fast = B.newLabel("counted.fast");
+        const slow = B.newLabel("counted.slow");
+        countedJoin = B.newLabel("counted.done");
+        B.condBr(safe, fast, slow);
+        B.startBlock(slow);
+        emitter.countedLoopsEnabled = false;
+        emitter.emitStmt(s);
+        emitter.countedLoopsEnabled = true;
+        B.br(countedJoin);
+        B.startBlock(fast);
+      }
+      emitter.scopes.push([]);
+      let integerSlot: string | null = null;
+      let countedLimit: string | null = null;
+      if (integerLoop) {
+        integerSlot = B.slot();
+        B.entryAllocas.push(
+          `${integerSlot} = alloca ${emitter.sizeType} ; integer induction ${emitter.currentLocals.get(integerLoop.localId)!.name}`,
+        );
+        let start = "0";
+        if (integerArrayLoop && s.init?.kind === "varDecl" && s.init.init) {
+          const value = emitter.emitExpr(s.init.init);
+          start = B.tmp();
+          // The start is 0 or an enclosing array index plus one (at most
+          // 2^32 - 1): on 64-bit targets the signed conversion is exact
+          // and avoids x86-64's unsigned 64-bit conversion sequence.
+          const conversion = emitter.sizeType === "i64" ? "fptosi" : "fptoui";
+          B.line(`${start} = ${conversion} double ${value.name} to ${emitter.sizeType}`);
+          emitter.integerArrayBindings.add(integerLoop.localId);
+        }
+        B.line(`store ${emitter.sizeType} ${start}, ptr ${integerSlot}`);
+        emitter.integerLoopBindings.set(integerLoop.localId, {
+          slot: integerSlot,
+          type: emitter.sizeType,
+          range:
+            emitter.denseLoop?.counter === integerLoop.localId
+              ? emitter.denseLoop.range
+              : { min: 0, max: integerArrayLoop ? 4294967294 : Number.MAX_SAFE_INTEGER - 1 },
+        });
+      } else if (countedLoop) {
+        integerSlot = B.slot();
+        B.entryAllocas.push(
+          `${integerSlot} = alloca i64 ; integer induction ${emitter.currentLocals.get(countedLoop.localId)!.name}`,
+        );
+        const startNumber = emitter.emitExpr(countedLoop.start);
+        const start = B.tmp();
+        B.line(`${start} = fptosi double ${startNumber.name} to i64`);
+        B.line(`store i64 ${start}, ptr ${integerSlot}`);
+        emitter.integerLoopBindings.set(countedLoop.localId, {
+          slot: integerSlot,
+          type: "i64",
+          signed: true,
+          range:
+            emitter.denseLoop?.counter === countedLoop.localId
+              ? emitter.denseLoop.range
+              : countedLoop.range,
+        });
+        countedLimit = emitCountedLoopLimit(emitter, countedLoop);
+      } else if (s.init) {
+        // A multi-declarator head shares the loop's scope. Emitting its
+        // IR block as an ordinary block would release captured/ref locals
+        // before the first condition.
+        const initializers = s.init.kind === "block" ? s.init.body : [s.init];
+        for (const initializer of initializers) emitter.emitStmt(initializer);
+      }
+      const le = B.newLabel("loop.e");
+      // JS `for (let i ...)`: each iteration gets a FRESH binding holding
+      // a copy of the previous one (closures made in iteration k keep
+      // seeing iteration k's value) — only observable, and only emitted,
+      // when a let variable is captured (boxed). Freshen before the first
+      // condition and again in the continue-target block before updating.
+      const initializers = s.init?.kind === "block" ? s.init.body : s.init ? [s.init] : [];
+      const capturedLets = initializers.flatMap((init) => {
+        const local = init.kind === "varDecl" ? emitter.currentLocals.get(init.localId) : undefined;
+        return local?.boxed && local.mutable ? [local] : [];
+      });
+      const freshenBindings = (): void => {
+        for (const local of capturedLets) {
+          const slot = `%${mangleLocal(local.id)}`;
+          const fresh = B.tmp();
+          const old = B.tmp();
+          B.line(
+            `${fresh} = ${boxNewCall(emitter.shapeHost, local.type)} ; per-iteration ${local.name}`,
+          );
+          B.line(`${old} = load ptr, ptr ${slot}`);
+          const val = emitter.boxGet(old, local.type);
+          emitter.boxSet(fresh, local.type, val);
+          emitter.declare(`declare void @scr_box_release(ptr)`);
+          B.line(`call void @scr_box_release(ptr ${old})`);
+          B.line(`store ptr ${fresh}, ptr ${slot}`);
+        }
+      };
+      const workerBudget = emitter.workerLoopBudget(s);
+      freshenBindings();
+      emitter.emitLoopCopies(s, capturedLets.length === 0, le, (exit) => {
+        const lc = B.newLabel("loop.c");
+        const lb = B.newLabel("loop.b");
+        const lu =
+          s.update || capturedLets.length > 0 || workerBudget !== null ? B.newLabel("loop.u") : lc;
+        B.br(lc);
+        B.startBlock(lc);
+        if (integerLoop && integerSlot) {
+          const receiver = emitter.emitStableReceiver(integerLoop.limitReceiver, []);
+          const lenPtr = B.tmp();
+          const len = B.tmp();
+          const index = B.tmp();
+          const inBounds = B.tmp();
+          B.line(
+            `${lenPtr} = getelementptr inbounds %${integerArrayLoop ? "ScrArr" : "ScrBytes"}, ptr ${receiver.name}, i64 0, i32 1`,
+          );
+          if (integerArrayLoop) emitter.markMemoryPointer(lenPtr, "array:header");
+          B.line(
+            `${len} = load ${emitter.sizeType}, ptr ${lenPtr}${emitter.fieldAliasAttachment(lenPtr)}`,
+          );
+          B.line(`${index} = load ${emitter.sizeType}, ptr ${integerSlot}`);
+          B.line(`${inBounds} = icmp ult ${emitter.sizeType} ${index}, ${len}`);
+          B.condBr(inBounds, lb, exit);
+        } else if (countedLoop && integerSlot && countedLimit) {
+          const index = B.tmp();
+          const inBounds = B.tmp();
+          B.line(`${index} = load i64, ptr ${integerSlot}`);
+          B.line(
+            `${inBounds} = icmp ${countedLoop.step > 0 ? "slt" : "sgt"} i64 ${index}, ${countedLimit}`,
+          );
+          B.condBr(inBounds, lb, exit);
+        } else if (s.cond) B.condBr(emitter.emitCondition(s.cond), lb, exit);
+        else B.br(lb);
+        B.startBlock(lb);
+        emitter.jumpTargets.push({
+          kind: "loop",
+          brkLabel: exit,
+          contLabel: lu,
+          labels: s.labels,
+          frameDepth: emitter.frames.length,
+          scopeDepth: emitter.scopes.length,
+          finallyDepth: emitter.finallyStack.length,
+        });
+        emitter.emitBlock(s.body);
+        emitter.jumpTargets.pop();
+        B.br(lu);
+        if (lu !== lc) {
+          B.startBlock(lu);
+          emitter.emitWorkerLoopCheck(workerBudget);
+          freshenBindings();
+          if (integerLoop && integerSlot) {
+            const old = B.tmp();
+            const next = B.tmp();
+            B.line(`${old} = load ${emitter.sizeType}, ptr ${integerSlot}`);
+            B.line(`${next} = add nuw ${emitter.sizeType} ${old}, 1`);
+            B.line(`store ${emitter.sizeType} ${next}, ptr ${integerSlot}`);
+          } else if (countedLoop && integerSlot) {
+            const old = B.tmp();
+            const next = B.tmp();
+            B.line(`${old} = load i64, ptr ${integerSlot}`);
+            B.line(`${next} = add nsw i64 ${old}, ${countedLoop.step}`);
+            B.line(`store i64 ${next}, ptr ${integerSlot}`);
+          } else if (s.update) emitter.emitStmt(s.update);
+          B.br(lc);
+        }
+      });
+      B.startBlock(le);
+      emitter.releaseScope(emitter.scopes.pop()!);
+      if (integerLoop) emitter.integerLoopBindings.delete(integerLoop.localId);
+      if (countedLoop) emitter.integerLoopBindings.delete(countedLoop.localId);
+      if (integerArrayLoop) emitter.integerArrayBindings.delete(integerArrayLoop.localId);
+      if (countedJoin) {
+        B.br(countedJoin);
+        B.startBlock(countedJoin);
+      }
+      break;
+    }
+    case "forOf": {
+      // Ascending index loop; the length is re-read every iteration
+      // (JS-exact — pushes inside the body extend the iteration). The
+      // iterable temp lives in this statement's frame, so it is released
+      // when the whole loop ends (and by `return`'s frame sweep).
+      if (s.iterable.type.kind !== "array")
+        throw new LlvmUnsupportedError(`forOf:${s.iterable.type.kind}`, s.loc);
+      const elem = s.iterable.type.elem;
+      const stored =
+        s.iterable.kind === "varRef" ? emitter.storedSplits.get(s.iterable.localId) : undefined;
+      const direct = emitter.streamingSplitsEnabled ? stringSplit(s.iterable) : null;
+      const snapshot = stored
+        ? loadSplitSnapshot(emitter, stored)
+        : direct
+          ? emitSplitSnapshot(emitter, direct)
+          : null;
+      const arr = snapshot ? null : emitter.emitExpr(s.iterable);
+      const cursor = snapshot ? emitSplitCursor(emitter, snapshot) : null;
+      const scratch = snapshot ? emitSplitScratch(emitter) : null;
+      const deferred = snapshot && canDeferSplitPiece(s, emitter.currentLocals.get(s.localId));
+      const spanLength = deferred ? B.slot() : null;
+      if (spanLength) B.entryAllocas.push(`${spanLength} = alloca ${emitter.sizeType}`);
+      const idxSlot = snapshot ? null : B.slot();
+      if (idxSlot) {
+        B.entryAllocas.push(`${idxSlot} = alloca double`);
+        B.line(`store double ${f64Lit(0)}, ptr ${idxSlot}`);
+      }
+      const lc = B.newLabel("fof.c");
+      const lb = B.newLabel("fof.b");
+      const lu = B.newLabel("fof.u");
+      const le = B.newLabel("fof.e");
+      const workerBudget = emitter.workerLoopBudget(s);
+      B.br(lc);
+      B.startBlock(lc);
+      const inBounds = B.tmp();
+      let cur: string;
+      if (snapshot && cursor && scratch) {
+        cur = spanLength
+          ? emitSplitSpanNext(emitter, snapshot, cursor, spanLength)
+          : emitSplitNext(emitter, snapshot, cursor, scratch);
+        B.line(`${inBounds} = icmp ne ptr ${cur}, null`);
+      } else {
+        const i = B.tmp(),
+          lenPtr = B.tmp(),
+          rawLen = B.tmp(),
+          len = B.tmp();
+        B.line(`${i} = load double, ptr ${idxSlot}`);
+        // The inline form of scr_arr_len, like the `length` intrinsic.
+        B.line(`${lenPtr} = getelementptr inbounds %ScrArr, ptr ${arr!.name}, i32 0, i32 1`);
+        emitter.markMemoryPointer(lenPtr, "array:header");
+        B.line(
+          `${rawLen} = load ${emitter.sizeType}, ptr ${lenPtr}${emitter.fieldAliasAttachment(lenPtr)}${emitter.arrayLengthRange}`,
+        );
+        B.line(
+          `${len} = ${sizeToDouble(emitter.sizeType)} ${emitter.sizeType} ${rawLen} to double`,
+        );
+        B.line(`${inBounds} = fcmp olt double ${i}, ${len}`);
+        cur = i;
+      }
+      B.condBr(inBounds, lb, le);
+      B.startBlock(lb);
+      emitter.jumpTargets.push({
+        kind: "loop",
+        brkLabel: le,
+        contLabel: lu,
+        labels: s.labels,
+        frameDepth: emitter.frames.length,
+        scopeDepth: emitter.scopes.length,
+        finallyDepth: emitter.finallyStack.length,
+      });
+      // The loop variable is a fresh const per iteration: its scope opens
+      // here, holds the (for ref elements: owned +1) current element, and
+      // releases it at the end of each iteration.
+      emitter.scopes.push([]);
+      const localInfo = emitter.currentLocals.get(s.localId);
+      const slot = `%${mangleLocal(s.localId)}`;
+      const borrowedElement = !snapshot && emitter.loopArrayBorrows.has(s);
+      if (!snapshot) {
+        const acc = elemAccess(elem);
+        const getter = borrowedElement ? "scr_arr_borrow_ref" : `scr_arr_get_${acc}`;
+        cur = emitDenseArrayGet(
+          emitter,
+          arr!.name,
+          { name: cur, type: { kind: "f64" } },
+          undefined,
+          acc,
+          elem,
+          getter,
+          !borrowedElement,
+        );
+      }
+      if (spanLength) {
+        const length = B.tmp();
+        B.line(`${length} = load ${emitter.sizeType}, ptr ${spanLength}`);
+        emitter.splitSpans.set(s.localId, { bytes: cur, length, scratch: scratch! });
+        cur = "null";
+      }
+      if (localInfo?.boxed) {
+        // Captured loop variable: a fresh box per iteration, matching the
+        // fresh const binding. The box takes ownership of a ref element's
+        // +1 and is released with the iteration's scope.
+        const box = B.tmp();
+        B.line(`${box} = ${boxNewCall(emitter.shapeHost, elem)} ; per-iteration ${localInfo.name}`);
+        emitter.boxSet(box, elem, cur);
+        B.line(`store ptr ${box}, ptr ${slot}`);
+        emitter.scopes[emitter.scopes.length - 1]!.push({ slot, type: elem, boxed: true });
+      } else {
+        B.line(`store ${emitter.llType(elem)} ${cur}, ptr ${slot}`);
+        if (isRefCounted(elem) && !borrowedElement)
+          emitter.scopes[emitter.scopes.length - 1]!.push({ slot, type: elem });
+      }
+      emitter.emitStmts(s.body);
+      if (spanLength) emitter.splitSpans.delete(s.localId);
+      const endedWithJump = endsWithJump(s.body);
+      const scope = emitter.scopes.pop()!;
+      if (!endedWithJump) emitter.releaseScope(scope);
+      emitter.jumpTargets.pop();
+      B.br(lu);
+      B.startBlock(lu);
+      emitter.emitWorkerLoopCheck(workerBudget);
+      if (idxSlot) {
+        const i2 = B.tmp(),
+          i3 = B.tmp();
+        B.line(`${i2} = load double, ptr ${idxSlot}`);
+        B.line(`${i3} = fadd double ${i2}, ${f64Lit(1)}`);
+        B.line(`store double ${i3}, ptr ${idxSlot}`);
+      }
+      B.br(lc);
+      B.startBlock(le);
+      break;
+    }
+    case "switch":
+      emitter.emitSwitch(s);
+      break;
+    case "break": {
+      // Unlabeled: the innermost loop OR switch (labeled blocks are
+      // skipped); labeled: the entry carrying the label.
+      let target: (typeof emitter.jumpTargets)[number] | undefined;
+      for (let i = emitter.jumpTargets.length - 1; i >= 0; i--) {
+        const t = emitter.jumpTargets[i]!;
+        if (s.label !== undefined ? t.labels?.includes(s.label) : t.kind !== "block") {
+          target = t;
+          break;
+        }
+      }
+      if (!target) throw new InternalCompilerError("llvm emitter bug: break target not found");
+      emitter.emitFinallysForJump(target.finallyDepth, target.frameDepth, target.scopeDepth);
+      if (!B.isTerminated()) B.terminate(`br label %${target.brkLabel}`);
+      break;
+    }
+    case "continue": {
+      // Unlabeled: the innermost loop; labeled: the loop carrying the
+      // label (tsc + the validator guarantee it IS a loop).
+      let target: (typeof emitter.jumpTargets)[number] | undefined;
+      for (let i = emitter.jumpTargets.length - 1; i >= 0; i--) {
+        const t = emitter.jumpTargets[i]!;
+        if (t.kind === "loop" && (s.label === undefined || t.labels?.includes(s.label))) {
+          target = t;
+          break;
+        }
+      }
+      if (!target || target.contLabel === null)
+        throw new InternalCompilerError("llvm emitter bug: continue target not found");
+      emitter.emitFinallysForJump(target.finallyDepth, target.frameDepth, target.scopeDepth);
+      if (!B.isTerminated()) B.terminate(`br label %${target.contLabel}`);
+      break;
+    }
+    case "return": {
+      // The value computes FIRST (an SSA temp — finally mutations of
+      // returned locals cannot change it, Node-exact), then every
+      // crossed finally runs innermost-first with the frames/scopes/
+      // tryStack it sees truncated to its region (its releases already
+      // ran; a throw inside a copy propagates OUT of the completing
+      // try, past its own catch), then the function-level releases and
+      // the actual ret. The parked value owns a synthetic slot-backed
+      // scope entry during each copy so a throwing finally releases it.
+      const adopted =
+        emitter.finallyStack.length > 0 || emitter.tryStack.length > 0
+          ? adoptingAwaitOf(s.value)
+          : null;
+      if (adopted !== null) {
+        emitter.emitAdoptingReturn(s, adopted);
+        break;
+      }
+      let v: LlValue | null = null;
+      const moved =
+        emitter.finallyStack.length === 0 && !emitter.currentUnionResult
+          ? emitter.movableReturn(s.value)
+          : null;
+      if (s.value !== null && emitter.currentUnionResult) {
+        // The tag and payload bits leave in registers; a heap box the
+        // value needed is released with its frame below.
+        const box = emitter.emitUnionProjection(s.value);
+        v = { name: emitter.scalarUnionPair(box.name, s.value.type), type: s.value.type };
+      } else if (moved !== null) {
+        // Returning an owned local hands its reference to the caller: no
+        // retain now and no release of the local below.
+        const t = B.tmp();
+        B.line(`${t} = load ptr, ptr ${moved.entry.slot}`);
+        v = { name: t, type: s.value!.type };
+        moved.scope.splice(moved.scope.indexOf(moved.entry), 1);
+        emitter.releaseForJump(0, 0);
+        moved.scope.splice(moved.index, 0, moved.entry);
+      } else if (s.value !== null && emitter.currentBorrowedReturn) {
+        // A borrowed-return body hands back its walk without a reference
+        // (it has no try statements, so no finally can intervene). An
+        // optional element read lends the element its array keeps alive.
+        const read = emitter.optionalArrayReads.get(s.value);
+        if (read) {
+          const slot = B.slot();
+          B.entryAllocas.push(`${slot} = alloca ptr`);
+          emitLocalArrayRead(emitter, { ...read, borrow: true }, slot);
+          const t = B.tmp();
+          B.line(`${t} = load ptr, ptr ${slot}`);
+          v = { name: t, type: s.value.type };
+        } else v = emitter.emitReadReceiver(s.value);
+      } else if (s.value !== null) {
+        v = emitter.emitExpr(s.value);
+        if (emitter.currentCoro !== null) emitter.toHeap(v);
+        else emitter.toFrame(v);
+      }
+      // An async generator's `return v` awaits v before any crossed
+      // finally runs. Past finally regions that turn is taken here and
+      // the request settles at completion; otherwise the completion's
+      // own turn is the await (nothing runs in between).
+      const genSettles =
+        emitter.currentAsyncGenerator && (s.awaited === true || emitter.finallyStack.length > 0);
+      // A completion turn that awaits x replaces a return() request's
+      // already-taken await.
+      if (emitter.currentAsyncGenerator && !genSettles) {
+        emitter.declare(`declare void @scr_async_gen_return_awaits()`);
+        B.line(`call void @scr_async_gen_return_awaits()`);
+      }
+      if (emitter.currentAsyncGenerator && s.awaited !== true && emitter.finallyStack.length > 0) {
+        if (emitter.wasi) emitter.emitWasiSuspend(null);
+        else {
+          emitter.declare(`declare void @scr_await_hop()`);
+          B.line(`call void @scr_await_hop()`);
+        }
+      }
+      if (emitter.finallyStack.length > 0) {
+        let pretSlot: string | null = null;
+        if (v !== null && isRefCounted(v.type) && !emitter.currentUnionResult) {
+          pretSlot = B.slot();
+          B.entryAllocas.push(`${pretSlot} = alloca ptr ; pending return (through finally)`);
+          B.line(`store ptr ${v.name}, ptr ${pretSlot}`);
+        }
+        const savedFrames = emitter.frames;
+        const savedScopes = emitter.scopes;
+        const savedFinally = emitter.finallyStack;
+        const savedTry = emitter.tryStack;
+        for (let i = savedFinally.length - 1; i >= 0 && !B.isTerminated(); i--) {
+          const fin = savedFinally[i]!;
+          emitter.releaseForJump(fin.frameDepth, fin.scopeDepth);
+          emitter.frames = emitter.frames.slice(0, fin.frameDepth);
+          emitter.scopes = emitter.scopes.slice(0, fin.scopeDepth);
+          emitter.finallyStack = savedFinally.slice(0, i);
+          emitter.tryStack = savedTry.slice(0, fin.tryDepth);
+          if (pretSlot !== null) emitter.scopes.push([{ slot: pretSlot, type: v!.type }]);
+          emitter.emitBlock(fin.body);
+          if (pretSlot !== null) emitter.scopes.pop();
+        }
+        if (!B.isTerminated()) emitter.releaseForJump(0, 0);
+        emitter.frames = savedFrames;
+        emitter.scopes = savedScopes;
+        emitter.finallyStack = savedFinally;
+        emitter.tryStack = savedTry;
+      } else if (moved === null) {
+        emitter.releaseForJump(0, 0);
+      }
+      if (!B.isTerminated()) {
+        if (genSettles) emitter.emitAsyncGenSettled();
+        if (emitter.currentCoro !== null) {
+          emitter.emitWasiFulfill(v);
+          B.terminate(`br label %${emitter.currentCoro.finalLabel}`);
+        } else if (v === null) B.terminate("ret void");
+        else if (emitter.currentInt32Result)
+          B.terminate(`ret i32 ${emitter.int32Argument(v, s.value!)}`);
+        else if (emitter.currentUnionResult) B.terminate(`ret ${SCALAR_UNION_RESULT} ${v.name}`);
+        else B.terminate(`ret ${emitter.llType(s.value!.type)} ${v.name}`);
+      }
+      break;
+    }
+    case "throw": {
+      // Evaluate, move ownership into the runtime's exception cell, then
+      // unwind unconditionally (the innermost try handler, or out of the
+      // function) — the same release path as return/break/continue.
+      const v = emitter.emitExpr(s.value);
+      if (isRefCounted(s.value.type)) emitter.toHeap(v); // the cell takes ownership
+      emitter.emitThrowValue({ name: v.name, type: s.value.type });
+      emitter.emitUnwind();
+      break;
+    }
+    case "rethrow": {
+      // Re-raise the saved snapshot (payload retained — the binding
+      // local releases with its scope) and unwind like `throw`.
+      const c = emitter.emitExpr({ kind: "varRef", localId: s.localId, type: CAUGHT, loc: s.loc });
+      emitter.declare(`declare void @scr_rethrow(ptr)`);
+      B.line(`call void @scr_rethrow(ptr ${c.name})`);
+      emitter.emitUnwind();
+      break;
+    }
+    case "runtimeFence": {
+      // The deferred JS compile fence: throw a catchable Error naming
+      // the construct (message) with the SC code stamped on `code`,
+      // then unwind exactly like `throw`. SCR_ERR_ERROR = 0.
+      const bytes = Buffer.byteLength(s.message, "utf8");
+      emitter.declare(`declare void @scr_throw_error_msg_code(i32, ptr, ${emitter.sizeType}, ptr)`);
+      B.line(
+        `call void @scr_throw_error_msg_code(i32 0, ptr ${emitter.cstr(s.message)}, ${emitter.sizeType} ${bytes}, ptr ${emitter.cstr(s.code)})`,
+      );
+      emitter.emitUnwind();
+      break;
+    }
+    case "tryCatch":
+      emitter.emitTryCatch(s);
+      break;
+    default: {
+      // Statement coverage is now total (bytesSet closed the set) —
+      // keep throwing LlvmUnsupportedError for any future IR statement kind.
+      const rest: never = s;
+      const k = (rest as IrStmt).kind;
+      throw new LlvmUnsupportedError(`stmt:${k}`, (rest as IrStmt).loc);
+    }
+  }
+  const frame = emitter.frames.pop()!;
+  // return/throw already released their frames on the jump path; the
+  // fall-through releases after them would be dead double-release code.
+  if (
+    s.kind !== "return" &&
+    s.kind !== "throw" &&
+    s.kind !== "rethrow" &&
+    s.kind !== "runtimeFence"
+  ) {
+    emitter.releaseTemps(frame);
+  }
+}
+
+/** try/catch/finally via pending-flag unwinding — stmts.ts's
+ * emitTryCatch, block-flavored. Entering a try emits NO code: the try
+ * context is compile-time state (tryStack) redirecting unwinds inside
+ * the region to a label here. Shape:
+ *
+ *   { try body }           unwinds inside release frames/scopes down to
+ *                          this statement's depths, then br the handler
+ *   br after               (normal completion skips the handler)
+ *   try.c:                 (emitted only when some unwind targets it)
+ *     binding = scr_exc_take()   (or scr_exc_clear() when bindingless)
+ *     { catch body }
+ *   after: { finally body }      normal path
+ *   br try.e
+ *   try.fx:                exception path: the pending exception is
+ *     stash = scr_exc_take()     STASHED across the finally body so the
+ *     { finally body }           body's own pending checks answer for
+ *     scr_rethrow(stash)         themselves; a throw inside REPLACES the
+ *     <unwind>                   stash (it unwinds through the synthetic
+ *   try.e:                       scope entry) — JS's semantics exactly
+ *
+ * Abrupt completions inside tryBody/catchBody ride the finallyStack:
+ * returns inline copies at the return site, while break/continue use the
+ * shared region walk before branching to their resolved target. */
+export function emitTryCatch(emitter: LlEmitter, s: IrStmt & { kind: "tryCatch" }): void {
+  const B = emitter.B;
+  const hasCatch = s.catchBody !== null;
+  const hasFinally = s.finallyBody !== null;
+  const catchLabel = B.newLabel("try.c");
+  const finExcLabel = B.newLabel("try.fx");
+  const endLabel = B.newLabel("try.e");
+  const afterTryLabel = hasFinally ? B.newLabel("try.f") : endLabel;
+
+  const handler = {
+    label: hasCatch ? catchLabel : finExcLabel,
+    used: false,
+    frameDepth: emitter.frames.length,
+    scopeDepth: emitter.scopes.length,
+  };
+  if (hasFinally) {
+    emitter.finallyStack.push({
+      frameDepth: emitter.frames.length,
+      scopeDepth: emitter.scopes.length,
+      tryDepth: emitter.tryStack.length,
+      body: s.finallyBody!,
+    });
+  }
+  emitter.tryStack.push(handler);
+  emitter.emitBlock(s.tryBody);
+  emitter.tryStack.pop();
+  B.br(afterTryLabel); // no-op when the try body already terminated
+
+  // Exceptions raised in the CATCH body unwind to the exception-path
+  // finally (pending stays set through it) when one exists.
+  const excHandler = {
+    label: finExcLabel,
+    used: !hasCatch && handler.used,
+    frameDepth: emitter.frames.length,
+    scopeDepth: emitter.scopes.length,
+  };
+
+  if (hasCatch && handler.used) {
+    B.startBlock(catchLabel);
+    if (hasFinally) emitter.tryStack.push(excHandler);
+    if (emitter.currentGenerator !== null) {
+      // Generator bodies: a pending GENRET sentinel (.return(v)
+      // injected at a yield) is a RETURN completion, not a throw —
+      // catch must not take it. Re-unwind past this handler (finally
+      // still runs — the unwind targets the exception-path finally or
+      // the enclosing context; the depths here equal the handler's).
+      emitter.declare(`declare zeroext i1 @scr_exc_genret_pending()`);
+      const gr = B.tmp();
+      B.line(`${gr} = call zeroext i1 @scr_exc_genret_pending()`);
+      const lg = B.newLabel("try.gr");
+      const lk = B.newLabel("try.gk");
+      B.condBr(gr, lg, lk);
+      B.startBlock(lg);
+      emitter.emitUnwind();
+      B.startBlock(lk);
+    }
+    if (s.catchLocalId !== null) {
+      // catch (e): the exception MOVES into the binding's snapshot box,
+      // owned by the catch body's scope (released on every exit —
+      // normal fall-through, jumps out, and unwinds from the body).
+      const slot = `%${mangleLocal(s.catchLocalId)}`;
+      emitter.declare(`declare ptr @scr_exc_take()`);
+      emitter.emitBlock(s.catchBody!, (scope) => {
+        const c = B.tmp();
+        B.line(`${c} = call ptr @scr_exc_take() ; catch binding`);
+        if (emitter.currentLocals.get(s.catchLocalId!)?.boxed) {
+          const box = B.tmp();
+          B.line(`${box} = ${boxNewCall(emitter.shapeHost, CAUGHT)} ; captured exception`);
+          emitter.boxSet(box, CAUGHT, c);
+          B.line(`store ptr ${box}, ptr ${slot}`);
+          scope.push({ slot, type: CAUGHT, boxed: true });
+        } else {
+          B.line(`store ptr ${c}, ptr ${slot}`);
+          scope.push({ slot, type: CAUGHT });
+        }
+      });
+    } else {
+      emitter.declare(`declare void @scr_exc_clear()`);
+      B.line(`call void @scr_exc_clear() ; catch takes the exception`);
+      emitter.emitBlock(s.catchBody!);
+    }
+    if (hasFinally) emitter.tryStack.pop();
+    B.br(afterTryLabel); // the catch's normal completion
+  }
+  if (hasFinally) emitter.finallyStack.pop();
+
+  if (hasFinally) {
+    B.startBlock(afterTryLabel);
+    emitter.emitBlock(s.finallyBody!); // normal path
+    B.br(endLabel);
+    if (excHandler.used) {
+      // The pending exception is STASHED across the finally body (a
+      // ScrCaught snapshot, re-raised after) so the body runs with a
+      // CLEAN cell — see stmts.ts's exception-path copy. The
+      // stash rides an alloca slot so a throw inside the body unwinds
+      // through the synthetic scope entry (replace semantics).
+      B.startBlock(finExcLabel);
+      emitter.declare(`declare ptr @scr_exc_take()`);
+      emitter.declare(`declare void @scr_rethrow(ptr)`);
+      emitter.declare(`declare void @scr_caught_release(ptr)`);
+      const stash = B.tmp();
+      const stashSlot = B.slot();
+      B.entryAllocas.push(`${stashSlot} = alloca ptr ; finally exception stash`);
+      B.line(`${stash} = call ptr @scr_exc_take() ; stash across finally`);
+      B.line(`store ptr ${stash}, ptr ${stashSlot}`);
+      emitter.scopes.push([{ slot: stashSlot, type: CAUGHT }]);
+      const suppressHandler =
+        s.suppressFinallyErrors || s.dropFinallyErrors
+          ? {
+              label: B.newLabel("try.fs"),
+              used: false,
+              frameDepth: emitter.frames.length,
+              scopeDepth: emitter.scopes.length,
+            }
+          : null;
+      if (suppressHandler) emitter.tryStack.push(suppressHandler);
+      emitter.emitBlock(s.finallyBody!);
+      if (suppressHandler) emitter.tryStack.pop();
+      emitter.scopes.pop(); // normal completion keeps the stash for the re-raise
+      B.line(`call void @scr_rethrow(ptr ${stash})`);
+      B.line(`call void @scr_caught_release(ptr ${stash})`);
+      emitter.emitUnwind();
+      if (suppressHandler?.used) {
+        B.startBlock(suppressHandler.label);
+        const cleanup = s.dropFinallyErrors ? "scr_exc_keep_first" : "scr_exc_suppress";
+        emitter.declare(`declare void @${cleanup}(ptr)`);
+        B.line(`call void @${cleanup}(ptr ${stash}) ; consumes stash`);
+        emitter.emitUnwind();
+      }
+    }
+    B.startBlock(endLabel);
+  } else {
+    B.startBlock(endLabel);
+  }
+}
+
+/** JS-exact switch: lazily evaluated, arbitrary-expression case tests in
+ * source order, bodies falling through in source order until a break —
+ * Literal-only tests can use native dispatch; other tests keep a chain
+ * of conditional branches. All case bodies
+ * share ONE scope; because dispatch can jump PAST a varDecl into a later
+ * case, refcounted/boxed case-body locals are NULL-reset up front and
+ * the scope-exit releases rely on NULL tolerance. */
+export function emitSwitch(emitter: LlEmitter, s: IrStmt & { kind: "switch" }): void {
+  const B = emitter.B;
+  const discKind = s.disc.type.kind;
+  if (discKind !== "f64" && discKind !== "string" && discKind !== "bool") {
+    throw new LlvmUnsupportedError(`switch:${discKind}`, s.loc);
+  }
+  // The disc temp lives in the whole statement's frame: for a string
+  // discriminant it stays alive across every test and body, released
+  // when the switch statement ends (break lands past this statement's
+  // frame release — releaseForJump keeps the target's own frame).
+  const disc = emitter.emitExpr(s.disc);
+  for (const c of s.cases) {
+    for (const stmt of c.body) {
+      if (stmt.kind !== "varDecl") continue;
+      const local = emitter.currentLocals.get(stmt.localId)!;
+      if (local.boxed || isRefCounted(local.type)) {
+        B.line(`store ptr null, ptr %${mangleLocal(local.id)} ; case-scoped ${local.name}`);
+      }
+    }
+  }
+  const end = B.newLabel("sw.e");
+  const caseLabels = s.cases.map(() => B.newLabel("sw.c"));
+  const defaultIdx = s.cases.findIndex((c) => c.test === null);
+  const fallback = defaultIdx >= 0 ? caseLabels[defaultIdx]! : end;
+  if (!emitLiteralSwitch(emitter, disc, s.disc, s.cases, caseLabels, fallback)) {
+    s.cases.forEach((c, i) => {
+      if (c.test === null) return;
+      // Lazy source-order test evaluation (a test after the match never
+      // runs). Each test's temps release right after its comparison.
+      emitter.frames.push([]);
+      const t = emitter.emitExpr(c.test);
+      const hit = B.tmp();
+      if (c.test.kind === "strLit") {
+        B.line(`${hit} = call zeroext i1 ${emitter.literalEquals(c.test.value)}(ptr ${disc.name})`);
+      } else if (c.test.type.kind === "string") {
+        emitter.declare(`declare zeroext i1 @scr_str_eq(ptr, ptr)`);
+        B.line(`${hit} = call zeroext i1 @sc_str_eq(ptr ${disc.name}, ptr ${t.name})`);
+      } else if (c.test.type.kind === "bool") {
+        B.line(`${hit} = icmp eq i1 ${disc.name}, ${t.name}`);
+      } else {
+        B.line(`${hit} = fcmp oeq double ${disc.name}, ${t.name}`);
+      }
+      emitter.releaseTemps(emitter.frames.pop()!);
+      const next = B.newLabel("sw.t");
+      B.condBr(hit, caseLabels[i]!, next);
+      B.startBlock(next);
+    });
+    B.br(fallback);
+  }
+
+  emitter.jumpTargets.push({
+    kind: "switch",
+    brkLabel: end,
+    contLabel: null,
+    labels: s.labels,
+    frameDepth: emitter.frames.length,
+    scopeDepth: emitter.scopes.length,
+    finallyDepth: emitter.finallyStack.length,
+  });
+  const scope: LlScopeEntry[] = [];
+  emitter.scopes.push(scope);
+  s.cases.forEach((c, i) => {
+    B.br(caseLabels[i]!); // the previous body's natural fall-through
+    B.startBlock(caseLabels[i]!);
+    emitter.emitStmts(c.body);
+  });
+  emitter.jumpTargets.pop();
+  emitter.scopes.pop();
+  // Natural fall-off of the last body releases the shared scope; a jump
+  // already released it before jumping.
+  const lastBody = s.cases[s.cases.length - 1]?.body;
+  if (!lastBody || !endsWithJump(lastBody)) emitter.releaseScope(scope);
+  B.br(end);
+  B.startBlock(end);
+}
+
+/** Emit a loop's condition, body and update through `emitCopy`, twice
+ * when speculative-integers.ts plans a fast integer copy. Both copies
+ * share the loop's setup and exit; the ordinary copy comes first so the
+ * fast copy is only emitted when every resume point exists. */
+export function emitLoopCopies(
+  emitter: LlEmitter,
+  loop: Extract<IrStmt, { kind: "while" | "doWhile" | "for" }>,
+  allowed: boolean,
+  exit: string,
+  emitCopy: (exit: string) => void,
+): void {
+  const plan =
+    allowed &&
+    emitter.speculativeLoopsEnabled &&
+    emitter.speculation === null &&
+    emitter.speculationResume === null
+      ? planSpeculativeLoop(
+          loop,
+          (id) => emitter.speculativeLocal(id),
+          (id) => emitter.integerLoopBindings.has(id) || emitter.int32Locals.has(id),
+          (e) => {
+            const range = emitter.integerRanges.get(e);
+            return (
+              range !== undefined &&
+              range !== null &&
+              range.min >= -Number.MAX_SAFE_INTEGER &&
+              range.max <= Number.MAX_SAFE_INTEGER
+            );
+          },
+          (id) => emitter.speculativeLocal(id) || emitter.speculativeInvariantGlobal(id),
+        )
+      : null;
+  if (!plan) {
+    emitCopy(exit);
+    return;
+  }
+  const B = emitter.B;
+  const entries = new Map<string, string>();
+  let ok = "true";
+  for (const [id, live] of plan.locals) {
+    if (!live) continue;
+    const value = B.tmp();
+    B.line(`${value} = load double, ptr ${emitter.binding(id).slot}`);
+    const [integer, exact] = emitSafeIntegerCheck(emitter, value);
+    entries.set(id, integer);
+    if (ok === "true") ok = exact;
+    else {
+      const both = B.tmp();
+      B.line(`${both} = and i1 ${ok}, ${exact}`);
+      ok = both;
+    }
+  }
+  const fast = B.newLabel("spec.fast"),
+    slow = B.newLabel("spec.slow");
+  B.condBr(ok, fast, slow);
+  const resume = new Map<IrStmt, { label: string; placed: boolean }>();
+  for (const s of plan.writes) resume.set(s, { label: B.newLabel("spec.resume"), placed: false });
+  B.startBlock(slow);
+  emitter.speculationResume = resume;
+  try {
+    emitCopy(exit);
+  } finally {
+    emitter.speculationResume = null;
+  }
+  B.startBlock(fast);
+  if (![...resume.values()].every((r) => r.placed)) {
+    B.br(slow);
+    return;
+  }
+  for (const id of plan.locals.keys()) {
+    const shadow = B.slot();
+    B.entryAllocas.push(
+      `${shadow} = alloca i64 ; speculative integer ${emitter.currentLocals.get(id)?.name ?? id}`,
+    );
+    const entry = entries.get(id);
+    if (entry !== undefined) {
+      // The same double, now visibly an integer conversion: the double
+      // phis of the fast copy fold into integer phis.
+      const exact = B.tmp();
+      B.line(`store i64 ${entry}, ptr ${shadow}`);
+      B.line(`${exact} = sitofp i64 ${entry} to double`);
+      B.line(`store double ${exact}, ptr ${emitter.binding(id).slot}`);
+    } else B.line(`store i64 0, ptr ${shadow}`);
+    emitter.integerLoopBindings.set(id, {
+      slot: shadow,
+      type: "i64",
+      signed: true,
+      range: SPECULATIVE_RANGE,
+    });
+  }
+  // A global's store stays in the loop (calls may read it). When nothing
+  // in the loop can observe it, its double is written once on leaving the
+  // copy instead, so the loop keeps it in a register as the double copy
+  // would.
+  const deferred = new Set<string>();
+  // Worker loops also leave through their cancellation poll.
+  if (plan.observerFree && !emitter.mod.workers)
+    for (const s of plan.writes) {
+      const id = speculativeWriteTarget(s)!.localId;
+      if (!emitter.currentLocals.has(id)) deferred.add(id);
+    }
+  emitter.speculation = {
+    writes: plan.writes,
+    resume: new Map([...resume].map(([s, r]) => [s, r.label])),
+    deferred,
+  };
+  try {
+    if (deferred.size === 0) emitCopy(exit);
+    else {
+      const leave = B.newLabel("spec.leave");
+      emitCopy(leave);
+      B.startBlock(leave);
+      emitter.writeBackSpeculativeGlobals(deferred);
+      B.br(exit);
+    }
+  } finally {
+    emitter.speculation = null;
+    for (const id of plan.locals.keys()) emitter.integerLoopBindings.delete(id);
+  }
+}
+
+/** A speculated write in the fast copy: compute the value as a safe
+ * integer, store it to the shadow and its exact double to the local.
+ * Any failed check re-executes the statement in the ordinary copy. */
+export function emitSpeculativeWrite(emitter: LlEmitter, s: IrStmt, resume: string): void {
+  const B = emitter.B;
+  const target = speculativeWriteTarget(s)!;
+  const binding = emitter.integerLoopBindings.get(target.localId)!;
+  const failed = B.newLabel("spec.bail");
+  let bails = false;
+  emitter.declare("declare i1 @llvm.expect.i1(i1, i1)");
+  const bail = (condition: string): void => {
+    if (condition === "false") return;
+    bails = true;
+    const expected = B.tmp();
+    B.line(`${expected} = call i1 @llvm.expect.i1(i1 ${condition}, i1 false)`);
+    const next = B.newLabel("spec.ok");
+    B.condBr(expected, failed, next);
+    B.startBlock(next);
+  };
+  // Heap reads come first, before any check, and release their temporaries
+  // at once: a bailing path then owns nothing, and reads have no effect
+  // whose reordering before the arithmetic could be observed.
+  const reads = new Map<IrExpr, LlValue>();
+  if (target.value !== null) {
+    emitter.frames.push([]);
+    for (const read of speculativeReads(target.value)) reads.set(read, emitter.emitExpr(read));
+    emitter.releaseTemps(emitter.frames.pop()!);
+  }
+  emitter.frames.push([]);
+  let result: string;
+  if (target.value === null) {
+    const old = B.tmp();
+    result = B.tmp();
+    B.line(`${old} = load i64, ptr ${binding.slot}`);
+    B.line(`${result} = ${target.op === "+" ? "add" : "sub"} nsw i64 ${old}, 1`);
+    const biased = B.tmp(),
+      outside = B.tmp();
+    B.line(`${biased} = add i64 ${result}, ${Number.MAX_SAFE_INTEGER}`);
+    B.line(`${outside} = icmp ugt i64 ${biased}, ${2 * Number.MAX_SAFE_INTEGER}`);
+    bail(outside);
+  } else result = emitSpeculativeInteger(emitter, target.value, bail, reads);
+  // Speculable values read only numbers past this point.
+  if (emitter.frames.pop()!.length > 0)
+    throw new InternalCompilerError("llvm emitter bug: speculative write owns a temporary");
+  B.line(`store i64 ${result}, ptr ${binding.slot}`);
+  const deferred = emitter.speculation!.deferred;
+  if (!deferred.has(target.localId)) {
+    const number = B.tmp();
+    B.line(`${number} = sitofp i64 ${result} to double`);
+    B.line(`store double ${number}, ptr ${emitter.binding(target.localId).slot}`);
+  }
+  if (!bails) return;
+  const done = B.newLabel("spec.done");
+  B.br(done);
+  B.startBlock(failed);
+  emitter.writeBackSpeculativeGlobals(deferred);
+  B.br(resume);
+  B.startBlock(done);
+}
+
+/**
+ * Lower canonical `target = target + suffix` after evaluating the old
+ * left side and suffix in JavaScript order.  The snapshot stays owned by
+ * the statement frame while the destination relinquishes its CURRENT
+ * value, making the snapshot unique unless a real observable alias exists.
+ */
+export function emitStringSelfConcatAssign(
+  emitter: LlEmitter,
+  localId: string,
+  left: IrExpr,
+  suffix: IrExpr,
+  retainForYield: boolean,
+): LlValue {
+  const moved = emitter.emitMovedSelfConcat(localId, left, suffix, retainForYield);
+  if (moved) return moved;
+  const snapshot = emitter.emitExpr(left);
+  // A suffix of several parts, or a number, appends each operand to the
+  // snapshot directly (in place once the binding lets go of it) instead
+  // of first building the suffix as a separate string.
+  const parts = stringParts(suffix);
+  const mixed = parts.length > 1 || numberPart(parts[0]!) !== null;
+  const charCode = mixed ? null : emitter.emitSingleCharCode(suffix);
+  const inputs = mixed ? emitConcatInputs(emitter, parts) : [];
+  // The concat only reads the suffix; relinquishing the binding below
+  // runs no code that could rebind a borrowed local.
+  const right = mixed || charCode !== null ? null : emitStringInputs(emitter, [suffix])[0]!;
+  const b = emitter.binding(localId);
+  const B = emitter.B;
+  if (b.kind === "boxed") {
+    // set_ref(NULL) unlinks then releases the binding's post-suffix value.
+    emitter.boxSet(emitter.loadBox(b.slot), b.type, "null");
+  } else {
+    const old = B.tmp();
+    B.line(`${old} = load ptr, ptr ${b.slot}`);
+    B.line(`store ptr null, ptr ${b.slot}`);
+    if (b.kind === "global") emitter.releaseHeap(old, b.type);
+    else emitter.releaseFrame(old, b.type);
+  }
+  let raw: string;
+  if (charCode !== null) {
+    // The snapshot moves into the consuming character append.
+    emitter.toFrame(snapshot);
+    emitter.declare(`declare ptr @scr_str_concat_move_char_code(ptr, double)`);
+    raw = B.tmp();
+    B.line(
+      `${raw} = call ptr @scr_str_concat_move_char_code(ptr ${snapshot.name}, double ${charCode.name})`,
+    );
+  } else if (right === null) {
+    raw = emitMixedConcat(emitter, snapshot.name, inputs);
+  } else {
+    emitter.declare(`declare ptr @scr_str_concat(ptr, ptr)`);
+    raw = B.tmp();
+    B.line(`${raw} = call ptr @scr_str_concat(ptr ${snapshot.name}, ptr ${right.name})`);
+  }
+  const result = emitter.own({ name: raw, type: left.type });
+  if (retainForYield) {
+    const stored =
+      b.kind === "local"
+        ? emitter.retainFrame(result.name, result.type)
+        : emitter.retainHeap(result.name, result.type);
+    if (b.kind === "boxed") emitter.boxSet(emitter.loadBox(b.slot), b.type, stored);
+    else B.line(`store ptr ${stored}, ptr ${b.slot}`);
+  } else {
+    if (b.kind === "local") emitter.toFrame(result);
+    else emitter.toHeap(result);
+    if (b.kind === "boxed") emitter.boxSet(emitter.loadBox(b.slot), b.type, result.name);
+    else B.line(`store ptr ${result.name}, ptr ${b.slot}`);
+  }
+  return result;
+}
diff --git a/packages/compiler/src/backend/llvm/emitter.test.ts b/packages/compiler/src/backend/llvm/emitter.test.ts
index 74dc8f859..f413d6153 100644
--- a/packages/compiler/src/backend/llvm/emitter.test.ts
+++ b/packages/compiler/src/backend/llvm/emitter.test.ts
@@ -71,7 +71,7 @@ function moduleFor(
     loc,
   };
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [
@@ -336,7 +336,7 @@ const text = (obj: IrExpr): IrExpr => ({
 
 function work(expr: IrExpr, parameter: IrType, boxed = false, tdz = false): string {
   const module: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: receiverLoc.file,
     entry: "main",
     records: [
@@ -547,7 +547,7 @@ function sharedFieldModule(prefixes: IrType[][], fieldType: IrType): IrModule {
     ],
   }));
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     records,
diff --git a/packages/compiler/src/backend/llvm/emitter.ts b/packages/compiler/src/backend/llvm/emitter.ts
index 9e2d3524e..64a535027 100644
--- a/packages/compiler/src/backend/llvm/emitter.ts
+++ b/packages/compiler/src/backend/llvm/emitter.ts
@@ -1,8 +1,7 @@
-import { type ArraySearchKind, emitArraySearchHelpers } from "./array-search.js";
+import { jsTruthy } from "./jsval.js";
+import { type ArraySearchKind } from "./array-search.js";
 import { emitStringInputs } from "./string-lifetimes.js";
-import { emitLlvmLayouts } from "./layouts.js";
-import { emitThreadSlotsIntrinsic, threadSlotsBlockDefinitions } from "./thread-slots.js";
-import { compileRegexMatcher, type RegexMatcherCode } from "./regex-matchers.js";
+import { emitThreadSlotsIntrinsic } from "./thread-slots.js";
 import {
   CYC_BUF,
   CYC_HDR,
@@ -12,18 +11,16 @@ import {
   WEAK_KEYS_GATE,
 } from "./alloc.js";
 import { youngNurseryRequested } from "../young-nursery.js";
-import { hasLoneSurrogate, llvmBytes as llBytes, wtf8Bytes } from "../literals.js";
+import { llvmBytes as llBytes, wtf8Bytes } from "../literals.js";
 import { InternalCompilerError } from "../../errors.js";
 import { createHash } from "node:crypto";
 import {
   endsWithJump,
   matchFieldSelfConcat,
-  matchStringSelfConcat,
   readsArraySlot,
   streamTypedRefEligible,
   undefinedArmTag,
 } from "../../ir/analysis.js";
-import { emitLibraryIdentityLines } from "../library-identity-markers.js";
 import { loopTestsEveryIteration } from "../loop-polls.js";
 import type {
   IrBytesElem,
@@ -41,10 +38,7 @@ import type {
   SrcLoc,
 } from "../../ir/ir.js";
 import {
-  CAUGHT,
-  ffiCallbackType,
   isDynTypedRefType,
-  isFfiContextParam,
   isRefCounted,
   isUnitType,
   POINTER_KINDS,
@@ -55,77 +49,34 @@ import {
   RUNTIME_STREAM_CLASSES,
   typeEquals,
   typeKey,
-  STRING,
   VOID,
   classJsName,
 } from "../../ir/ir.js";
 import { moduleRuntimeFeatures, moduleUsesMockTimers } from "../../ir/runtime-features.js";
 import { captureFreeFunctions, observesStacks } from "../stack-observations.js";
+import { type DenseArrayLoop } from "./dense-array-loops.js";
+import { findInitializedByteLoopBindings } from "./byte-windows.js";
 import {
-  matchIntegerArrayForLoop,
-  matchIntegerBytesForLoop,
-  matchIntegerCountedForLoop,
-} from "../../ir/integer-loops.js";
-import { findUnaliasedLocalArrays } from "../../ir/array-length-stability.js";
-import {
-  countedDenseShape,
-  emitDenseLoopGuard,
-  matchDenseArrayLoop,
-  type DenseArrayLoop,
-} from "./dense-array-loops.js";
-import { emitCountedLoopLimit } from "./counted-loops.js";
-import {
-  emitSafeIntegerCheck,
-  emitSpeculativeInteger,
-  planSpeculativeLoop,
-  speculativeReads,
-  speculativeWriteTarget,
-  SPECULATIVE_RANGE,
-} from "./speculative-integers.js";
-import { emitLiteralSwitch } from "./switch-dispatch.js";
-import { findBytesBounds } from "./bytes-bounds.js";
-import {
-  emitByteWindowGuard,
-  findInitializedByteLoopBindings,
-  matchByteWindow,
-} from "./byte-windows.js";
-import {
-  canDeferSplitPiece,
-  emitSplitSpanNext,
   materializeSplitPiece,
   type SplitSpan,
-  emitSplitCursor,
-  emitSplitNext,
-  emitSplitScratch,
-  emitSplitSnapshot,
-  findPrivateSplitLocals,
-  loadSplitSnapshot,
-  storeSplitSnapshot,
-  stringSplit,
   type StoredSplitSnapshot,
   type StringSplit,
 } from "./split-loops.js";
 import { scalarizeNumericRecords } from "../../ir/scalar-records.js";
-import { RESULT_DST_ID, RESULT_ENTRY_PREFIX, addRecordResultEntries } from "./record-results.js";
+import { addRecordResultEntries } from "./record-results.js";
 import { specializeCallbackCalls } from "../../ir/callback-specialization.js";
 import { specializeNumericCalls } from "../../ir/numeric-call-specialization.js";
 import { everyExpr, everyExprChild, everyStmtChild, everyStmtList } from "../../ir/traverse.js";
-import {
-  analyzeIntegerRanges,
-  INT32_RANGE,
-  type IntegerRange,
-  type IntegerRanges,
-} from "../../ir/integer-ranges.js";
+import { INT32_RANGE, type IntegerRange, type IntegerRanges } from "../../ir/integer-ranges.js";
 import { unshareNodes } from "../../ir/unshare.js";
 import { copyStableCaptures } from "../../ir/capture-values.js";
 import { resolveSelfCaptures } from "../../ir/self-captures.js";
 import { analyzeInt32Slots, dynamicFieldStores, type Int32Slots } from "../../ir/int32-slots.js";
-import { analyzeFinalFields, constructorClass, type FinalFields } from "../../ir/final-fields.js";
+import { analyzeFinalFields, type FinalFields } from "../../ir/final-fields.js";
 import { foldConstantGlobals } from "../../ir/constant-globals.js";
 import { dropUnwrittenPropertyBags } from "../../ir/property-bags.js";
 import { freezeInitOnlyGlobals } from "../../ir/init-only-globals.js";
 import { hoistFinalFieldReads } from "../../ir/field-values.js";
-import { findIntegerViews } from "./integer-views.js";
 import {
   findInt32Abis,
   INT32_ABI_SUFFIX,
@@ -133,22 +84,10 @@ import {
   SCALAR_UNION_RESULT,
   type Int32Abi,
 } from "./int32-abi.js";
-import { findInt32Locals, type Int32Local } from "./int32-locals.js";
-import {
-  emitIntegerClone,
-  emitIntegerDispatcher,
-  findIntegerClones,
-  NO_INTEGER_CLONES,
-  type IntegerClones,
-} from "./integer-clones.js";
+import { type Int32Local } from "./int32-locals.js";
+import { findIntegerClones, NO_INTEGER_CLONES, type IntegerClones } from "./integer-clones.js";
 import { exactInteger, narrowInteger } from "./integer-values.js";
-import {
-  conditionalLoopWrites,
-  findInitializerBindings,
-  initializerLocalCandidates,
-  withInitializerBindings,
-  withInitializerLocals,
-} from "../../ir/initializer-bindings.js";
+import { findInitializerBindings } from "../../ir/initializer-bindings.js";
 import { findConstantNumericTables, type ConstantNumericTable } from "../../ir/constant-tables.js";
 import {
   allocateFfiCallbackAdapters,
@@ -156,47 +95,28 @@ import {
   hasRetainedFfiCallback,
   type FfiCallbackAdapter,
 } from "../ffi-callbacks.js";
-import { RUNTIME_ABI_MARKER } from "../runtime-abi.js";
 import { computeMayThrow } from "../may-throw.js";
 import {
-  mangleArgPack,
-  mangleAsyncAdoptCall,
-  mangleAsyncAwaitCall,
   mangleAsyncInlineAwaitCall,
   mangleAsyncSpawn,
   mangleBorrowedFunction,
   mangleClassObj,
-  mangleClassStruct,
   mangleFnClosure,
   mangleFunction,
-  mangleGenDrop,
-  mangleGenSourceClose,
   mangleGenSpawn,
   mangleGlobal,
   mangleLocal,
   mangleRecordStruct,
-  mangleTrampoline,
   mangleWrapper,
   mangleBorrowingWrapper,
-  mangleVtInstance,
 } from "../mangle.js";
 import { analyzeCallLifetimes, type CallLifetimes } from "./call-lifetimes.js";
-import { canStackUnion, emitStackUnion, findLocalStackUnions } from "./stack-unions.js";
 import {
-  emitStackObject,
-  findLocalStackObjects,
-  findReassignedStackObjects,
-  stackObjectFields,
   stackObjectStruct,
   type StackObjectField,
   type StackObjectSource,
 } from "./stack-objects.js";
 import {
-  allocateLocalUnion,
-  emitScalarOptional,
-  findLocalUnionStorage,
-  isScalarOptionalSource,
-  storeLocalUnion,
   type LocalUnionStorageProof,
   type LocalUnionStorage,
   type UnionSources,
@@ -211,63 +131,30 @@ import {
   storeInlineUnion,
   unionBoxBits,
 } from "./inline-unions.js";
-import {
-  emitLocalArrayRead,
-  emitProjectedArrayRead,
-  emitBorrowedArrayRead,
-  findLocalArrayReads,
-  findCallArrayReads,
-  OptionalArrayReads,
-  type LocalArrayRead,
-} from "./local-array-reads.js";
-import { CheckedNarrows, emitCheckedNarrowReceiver } from "./checked-narrows.js";
-import {
-  emitDenseArrayGet,
-  emitDenseArrayPop,
-  emitDenseArraySet,
-  emitDenseSlotUnlink,
-} from "./dense-array-access.js";
-import {
-  emitStackMapRead,
-  findMapReadLifetimes,
-  findReadNumberMapWrites,
-  matchMapRead,
-  type MapReadLifetimes,
-} from "./map-read-lifetimes.js";
-import { findMapEntryFusions, type MapEntryFusion } from "./map-entry-fusion.js";
+import { OptionalArrayReads, type LocalArrayRead } from "./local-array-reads.js";
+import { CheckedNarrows } from "./checked-narrows.js";
+import { emitDenseArraySet, emitDenseSlotUnlink } from "./dense-array-access.js";
+import { matchMapRead, type MapReadLifetimes } from "./map-read-lifetimes.js";
+import { type MapEntryFusion } from "./map-entry-fusion.js";
 import { emitBorrowedFieldSequence, guardedValue } from "./borrowed-receivers.js";
-import { borrowableInputs, emitBorrowedInput, emitBorrowedInputs } from "./borrowed-inputs.js";
-import { analyzeWalks, findWalkBorrows, type WalkBorrowHost } from "./walk-borrows.js";
+import { emitBorrowedInputs } from "./borrowed-inputs.js";
+import { findWalkBorrows, type WalkBorrowHost } from "./walk-borrows.js";
 import { lastUseRead } from "./local-extents.js";
 import { findReboundParameters } from "./rebound-parameters.js";
 import { ReferenceEffects } from "./reference-effects.js";
 import { ReferenceWrites, type Writes } from "./reference-writes.js";
 import { LlvmDebugInfo } from "./debug-info.js";
 import { StackCallbacks } from "./stack-callbacks.js";
-import { dynHoleRead, findLoopArrayBorrows } from "./loop-array-borrows.js";
 import { findAppendedArrayLiterals } from "./appended-array-literals.js";
 import { AmbientReceiverReaders, findConstantCallbacks } from "./constant-callbacks.js";
 import {
-  findScalarStringSlices,
-  findScratchStringSlices,
   findLentStringParameters,
-  emitStringSliceSnapshot,
   type LentStringParameters,
   type StringSliceSnapshot,
 } from "./string-slices.js";
 import { LazyCaptures } from "./lazy-captures.js";
 import { StackCaptures } from "./stack-captures.js";
-import {
-  ABSENT_FIELD_PAYLOAD,
-  emitFieldAbsentTest,
-  exactIndexLines,
-  f64Lit,
-  ffiNativeTypeLl,
-  ffiNativeParamLl,
-  ffiNativeReturnLl,
-  llvmCommentText,
-  sizeToDouble,
-} from "./common.js";
+import { emitFieldAbsentTest, f64Lit } from "./common.js";
 import { ffiExtendsNarrowIntegers } from "../targets.js";
 import {
   emitLiteralExpr,
@@ -277,7 +164,7 @@ import {
   emitRecordExpr,
 } from "./expr-primitives.js";
 import { emitControlExpr } from "./expr-control.js";
-import { emitBorrowedResultCall, emitCallExpr } from "./expr-calls.js";
+import { emitCallExpr } from "./expr-calls.js";
 import { emitDynamicExpr } from "./expr-dynamic.js";
 import { emitIntrinsicExpr, emitSerializationExpr, emitAsyncExpr } from "./expr-async.js";
 import { PublishWalkers } from "./publish.js";
@@ -320,7 +207,6 @@ import {
   emitArrayCopyLoop,
   emitStrIntrinsic,
   emitArrIntrinsic,
-  emitDiscardedSplice,
   wrapNullable,
   emitMapNew,
   mapSet,
@@ -370,8 +256,6 @@ import {
 import {
   buildClassGraph,
   classMembershipIntervals,
-  emitClassMembershipHelper,
-  classEnvironmentIndex,
   classFieldIndex,
   classStructSym,
   programLifetimeClass,
@@ -384,13 +268,6 @@ import { LlvmUnsupportedError } from "./unsupported.js";
 import { LlWalkers } from "./walkers.js";
 import { isObjectArm, NULLABLE_ABSENT, NULLABLE_NULL, NullableUnions } from "./nullable-unions.js";
 import { emitNullablePresent, emitUnionPeek, emitUnionTag } from "./union-repr.js";
-import { literalCapWord, literalCapWord32 } from "./string-key-hash.js";
-import {
-  MAP_ITER_DECL,
-  NUMBER_MAP_ENTRY_DECL,
-  STRING_MAP_ENTRY_DECL,
-} from "./map-number-lookup.js";
-import { STRING_READ_HELPERS, stringScanDecl } from "./string-reads.js";
 import {
   emitConcatInputs,
   emitMixedConcat,
@@ -403,30 +280,60 @@ import {
   boxNewCall,
   boxReleaseSym,
   computeTraced,
-  elemAccess,
   emitInlineRcHelpers,
   emitNullableRetainWrappers,
   emitShapeUnionHelpers,
   FN_ATTRS,
   inlineRcDecls,
   type InlineRcMode,
-  limitInlineDynReleases,
   llFieldType,
   mapFlagsOffset,
   type MapKeyAccess,
   releaseSym,
   retainSym,
   traceArg,
-  typedRefConstructor,
   vAdapters,
 } from "./shapes.js";
 import type { ExprOf, LibCallExpr, LlStreamTypedRefAdapter, LlValue } from "./expr-context.js";
-import { INLINE_LITERAL_BYTES, literalEqualityDefinition } from "./string-literal-equality.js";
-import { emitDowncastGuard, emitUnionNarrowGuard } from "./narrow-guards.js";
+import { INLINE_LITERAL_BYTES } from "./string-literal-equality.js";
+import {
+  emitFfiCallbackDefs,
+  emitLibDefs,
+  emitModuleParts,
+  emitParts,
+  helperDefs,
+} from "./emit-module.js";
+import {
+  emitLoopCopies,
+  emitSpeculativeWrite,
+  emitStmtBody,
+  emitStringSelfConcatAssign,
+  emitSwitch,
+  emitTryCatch,
+} from "./emit-statements.js";
+import {
+  emitArgPackAndTrampolinePrologue,
+  emitAsyncAwaitCall,
+  emitAsyncScaffolding,
+  emitFunction,
+  emitGenScaffolding,
+  emitWasiFulfill,
+  fiberlessAsyncFunctions,
+  parkingFunctions,
+} from "./emit-function.js";
+import {
+  analyzeBorrowedReturns,
+  canBorrowCallArgument,
+  canBorrowReceiver,
+  canStackReceiver,
+  emitReadReceiver,
+  fieldAliasMetadata,
+  isStackUnionSource,
+} from "./receivers.js";
 
 export { LlvmUnsupportedError } from "./unsupported.js";
 
-interface LlArgPackAndTrampolinePrologue {
+export interface LlArgPackAndTrampolinePrologue {
   definitions: string[];
   pack: string;
   lifted: boolean;
@@ -437,7 +344,7 @@ interface LlArgPackAndTrampolinePrologue {
   argPackLines: string[];
 }
 
-function ffiCallbackDummyLl(callback: IrFfiCallbackParam["callback"]): string {
+export function ffiCallbackDummyLl(callback: IrFfiCallbackParam["callback"]): string {
   switch (callback.returns) {
     case "i64":
     case "u64":
@@ -463,7 +370,7 @@ function ffiCallbackDummyLl(callback: IrFfiCallbackParam["callback"]): string {
   }
 }
 
-interface LlScopeEntry {
+export interface LlScopeEntry {
   slot: string;
   type: IrType;
   boxed?: boolean;
@@ -567,7 +474,7 @@ export function emitLlvmModuleSource(
   return parts.flatMap((part, index) => (index === 0 ? [part] : ["\n", part]));
 }
 
-function llStrBytes(text: string): string {
+export function llStrBytes(text: string): string {
   return llBytes(wtf8Bytes(text));
 }
 
@@ -575,7 +482,7 @@ const NO_BORROWED: ReadonlySet<number> = new Set();
 
 /** Runtime entry points (and await-call entries) that may park the running
  * execution context, as they appear in emitted function text. */
-const SUSPENDS =
+export const SUSPENDS =
   /@(?:scr_(?:await_|module_await\b|promise_await_settled\b|test_sub\b|gen_yield_|async_gen_|fiber_)|sc_a[wd]_)/;
 /** The suspensions of a fiber body's own awaits, which its stackless
  * coroutine form suspends itself at instead. */
@@ -586,7 +493,7 @@ const COROUTINE_SUSPENDS =
   /@(?:scr_(?:await_|module_await\b|promise_await_settled\b|test_sub\b|gen_yield_|async_gen_|fiber_(?!self\b|promise\b))|sc_a[wd]_)/;
 /** Captured bindings (boxes a body declares or receives) from which a
  * function compiles without LLVM optimization (see boxSlotCount). */
-const UNOPTIMIZED_BOX_SLOTS = 512;
+export const UNOPTIMIZED_BOX_SLOTS = 512;
 /** ScrExcKind tags of a generator slot holding a number or a boolean. */
 const SCR_EXC_F64 = 1;
 const SCR_EXC_BOOL = 2;
@@ -604,7 +511,7 @@ const SCR_EXC_BOOL = 2;
  * optnone bodies, as the native helper's does. Each use reloads its box
  * pointer and code generation stays linear. Semantics, boxes and
  * environments are unchanged; only that body's machine code is slower. */
-function boxSlotCount(fn: IrFunction): number {
+export function boxSlotCount(fn: IrFunction): number {
   const captured = new Set<string>();
   for (const capture of fn.captures ?? []) captured.add(capture.localId);
   for (const capture of fn.classCaptures ?? []) captured.add(capture.localId);
@@ -648,26 +555,26 @@ function mentionsLocal(e: IrExpr, localId: string): boolean {
 
 export class LlEmitter {
   localArrayReads = new Map<string, LocalArrayRead>();
-  private loopArrayBorrows: ReadonlySet<IrStmt> = new Set();
-  private scalarStringSlices = new Map<string, IrExpr & { kind: "strIntrinsic" }>();
+  loopArrayBorrows: ReadonlySet<IrStmt> = new Set();
+  scalarStringSlices = new Map<string, IrExpr & { kind: "strIntrinsic" }>();
   readonly stringSlices = new Map<string, StringSliceSnapshot>();
   /** Slices written into stack buffers (findScratchStringSlices). */
   scratchStringSlices: ReadonlySet<IrExpr> = new Set();
   /** String parameters a caller may lend scratch slices to. */
-  private lentStringParameters: LentStringParameters = new Map();
-  private localStackUnions = new Map<string, IrExpr & { kind: "unionWrap" }>();
-  private localStackObjects = new Map<string, StackObjectSource>();
-  private reassignedStackObjects = new Set<string>();
+  lentStringParameters: LentStringParameters = new Map();
+  localStackUnions = new Map<string, IrExpr & { kind: "unionWrap" }>();
+  localStackObjects = new Map<string, StackObjectSource>();
+  reassignedStackObjects = new Set<string>();
   /** The binding slot of each reassigned stack-object local. */
-  private stackObjectSlots = new Map<string, string>();
+  stackObjectSlots = new Map<string, string>();
   /** Entry-block pointers to the reference fields of each frame object
    * slot (stack-objects.ts stackObjectFields). */
   stackObjectFieldPtrs = new Map<string, readonly StackObjectField[]>();
-  private localUnionStorageProofs = new Map<string, LocalUnionStorageProof>();
-  private localUnionStorage = new Map<string, LocalUnionStorage>();
+  localUnionStorageProofs = new Map<string, LocalUnionStorageProof>();
+  localUnionStorage = new Map<string, LocalUnionStorage>();
   integerArrayBindings = new Set<string>();
-  private readonly fieldAliasTags = new Map<string, number>();
-  private readonly fieldPointerTags = new Map<string, number>();
+  readonly fieldAliasTags = new Map<string, number>();
+  readonly fieldPointerTags = new Map<string, number>();
 
   /** Native class fields with different property names cannot occupy the
    * same slot of one object. Inherited views of the same property share a
@@ -725,22 +632,13 @@ export class LlEmitter {
     const tag = this.fieldPointerTags.get(ptr);
     return tag === undefined ? "" : `, !tbaa !${tag}`;
   }
-
-  private fieldAliasMetadata(): string[] {
-    if (this.fieldAliasTags.size === 0) return [];
-    const lines = ['!0 = !{!"scriptc native fields"}'];
-    for (const tag of this.fieldAliasTags.values()) {
-      lines.push(
-        `!${tag - 1} = !{!"field.${tag}", !0, i64 0}`,
-        `!${tag} = !{!${tag - 1}, !${tag - 1}, i64 0}`,
-      );
-    }
-    return lines;
+  fieldAliasMetadata(): string[] {
+    return fieldAliasMetadata(this);
   }
-  private readonly debug: LlvmDebugInfo | null;
+  readonly debug: LlvmDebugInfo | null;
   /** Projection-only scalar objects may live in frame storage (stack-objects.ts). */
   readonly stackObjects: boolean;
-  private debugScope: string | null = null;
+  debugScope: string | null = null;
   readonly sizeType: "i32" | "i64";
   readonly ffiExtendNarrowIntegers: boolean;
   readonly cycleBufOffset: number;
@@ -759,48 +657,48 @@ export class LlEmitter {
    * generators' conditions; library and Windows builds keep fibers. */
   private stacklessAsyncAllowed = false;
   /** The async functions selectStacklessAsync lowered as coroutines. */
-  private readonly stacklessAsync = new Set<string>();
+  readonly stacklessAsync = new Set<string>();
   /** Some function in the module is lowered as a coroutine. */
-  private usesCoroutines = false;
+  usesCoroutines = false;
   /** The target lacks a rounding instruction at its baseline CPU (x86-64
    * before SSE4.1), so `llvm.trunc` would lower to a libm call: emit
    * truncation inline through an integer round trip instead. */
   readonly inlineTrunc: boolean;
   /** ELF worker executables give thread-locals the executable TLS models. */
-  private readonly executableTls: boolean;
+  readonly executableTls: boolean;
   /** Source loops enclosing the statement being emitted in the current
    * function body. */
-  private loopDepth = 0;
+  loopDepth = 0;
   /** Darwin worker executables read the stack guard from a pthread
    * thread-specific-data slot off the thread pointer (scr_runtime.h's
    * SCR_STACK_GUARD_TSD): the architecture names the access sequence. */
   private readonly stackGuardTsd: "aarch64" | "x86_64" | null;
-  private readonly emitLibraryIdentity: boolean;
-  private readonly runtimeAbiMarker: boolean;
-  private readonly detachedExit: boolean;
+  readonly emitLibraryIdentity: boolean;
+  readonly runtimeAbiMarker: boolean;
+  readonly detachedExit: boolean;
   /** Interned string literals: UTF-8 text → { symbol, byte length } —
    * first-use order, the runtime ABI’s determinism discipline. */
-  private readonly literals = new Map<string, { sym: string; len: number }>();
+  readonly literals = new Map<string, { sym: string; len: number }>();
   /** Literal equality helpers: literal text → helper symbol (literalEquals). */
-  private readonly literalEqualities = new Map<string, string>();
+  readonly literalEqualities = new Map<string, string>();
   /** Interned bigint literals: hex magnitude with sign → { symbol, value }. */
-  private readonly bigintLiterals = new Map<string, { sym: string; value: bigint }>();
+  readonly bigintLiterals = new Map<string, { sym: string; value: bigint }>();
   /** Symbols of interned constant data, named by content (contentSymbol). */
   private readonly contentSymbols = new Set<string>();
   /** Interned unit-armed union instances: "unionId:tag" → symbol — one
    * immortal (rc == SIZE_MAX) static per (union, unit tag).
    * RC entry points and the collector skip immortals. */
-  private readonly unitInstances = new Map<string, string>();
+  readonly unitInstances = new Map<string, string>();
   /** unionId → symbol of the union's immortal ABSENT field-slot instance. */
-  private readonly absentInstances = new Map<string, string>();
+  readonly absentInstances = new Map<string, string>();
   /** The zeroed box an inline store reads for a NULL union dummy. */
-  private needsUnionNone = false;
+  needsUnionNone = false;
   /** unionId → symbol of a flag set once a checked-dynamic cast caches one
    * of the union's boxes. A cached box is refreshed in place, possibly with
    * a tag that another union numbers apart, so it is never shared. */
-  private readonly retypeGuards = new Map<string, string>();
+  readonly retypeGuards = new Map<string, string>();
   /** The nullable-union ABSENT sentinel was referenced (absentInstanceRef). */
-  private needsNullableAbsent = false;
+  needsNullableAbsent = false;
   private readonly immortalValues = new Set<string>();
   /** Regex literal templates: "<flags>/<pattern>" → { symbol, interned
    * source/flags literal refs } — one immortal ScrRegex template per distinct
@@ -818,9 +716,9 @@ export class LlEmitter {
   readonly templateStringsInstances = new Map<string, { sym: string; slots: string[] }>();
   /** Interned NUL-terminated C-string constants (scr_jb_puts labels, the
    * stringify indent text): UTF-8 text → { symbol, byte length }. */
-  private readonly cstrs = new Map<string, { sym: string; len: number }>();
+  readonly cstrs = new Map<string, { sym: string; len: number }>();
   /** Interned ScrMapOps descriptors (scr_map.h): initializer → symbol. */
-  private readonly mapOpsConsts = new Map<string, string>();
+  readonly mapOpsConsts = new Map<string, string>();
   /** Type-directed walker functions (JSON serializers, the indent
    * rewriter, union ToString/join) — interned per typeKey/unionId, defs
    * flushed with the shape helpers. */
@@ -831,17 +729,17 @@ export class LlEmitter {
   /** Explicit callback boundary for standalone layout and walker stages. */
   readonly shapeHost: DynHost;
   /** External declarations, in first-use order. */
-  private readonly decls = new Set<string>();
+  readonly decls = new Set<string>();
   /** Declared functions referenced as values: each needs an env-signature
    * wrapper + an interned immortal closure (so `f === f` holds). */
   readonly fnValues = new Set<string>();
-  private needsOom = false;
+  needsOom = false;
   needsBadTag = false;
   needsBadKey = false;
-  private needsRetainBox = false;
+  needsRetainBox = false;
   /** Inline RC fast-path helpers requested by call sites (shapes.ts); null
    * when inline RC is off. */
-  private readonly rcHelpers: Set<string> | null;
+  readonly rcHelpers: Set<string> | null;
   private readonly rcMode: InlineRcMode | undefined;
   private readonly rcHelpersNoinline: boolean;
 
@@ -850,11 +748,11 @@ export class LlEmitter {
   appendedArrayLiterals: ReadonlySet<IrExpr> = new Set();
   /** Emitted LLVM text of every IR function body, by function name: the
    * fiberless-async analysis scans it for suspension entry points. */
-  private readonly fnDefText = new Map<string, string>();
+  readonly fnDefText = new Map<string, string>();
   readonly referenceEffects: ReferenceEffects;
   /** Field-sensitive reference writes (null in debug builds). */
   referenceWrites: ReferenceWrites | null = null;
-  private readonly borrowedReturnKeyCache = new Map<string, string[]>();
+  readonly borrowedReturnKeyCache = new Map<string, string[]>();
   /** The statement list being emitted and the current index, for blocks
    * whose bindings end with the list (emitBlock and function bodies). */
   private stmtCursor: { stmts: IrStmt[]; index: number } | null = null;
@@ -872,63 +770,63 @@ export class LlEmitter {
   currentConstantCallbacks: ReadonlyMap<string, string> = new Map();
   readonly stackCallbacks: StackCallbacks;
   readonly receiverReaders: AmbientReceiverReaders;
-  private readonly stackCaptures: StackCaptures;
-  private readonly lazyCaptures: LazyCaptures;
+  readonly stackCaptures: StackCaptures;
+  readonly lazyCaptures: LazyCaptures;
   /** Unchanged captured parameters of the current function: each maps to
    * the slot caching its box, NULL until the first closure needs it. */
-  private readonly lazyCaptureBoxes = new Map<string, string>();
-  private readonly lazyStackBoxes = new Map<string, string>();
-  private borrowedParameters = new Set<string>();
+  readonly lazyCaptureBoxes = new Map<string, string>();
+  readonly lazyStackBoxes = new Map<string, string>();
+  borrowedParameters = new Set<string>();
   /** Captures of the current closure body that its environment holds
    * unchanged for the closure's whole life (LazyCaptures.stableCaptures). */
-  private stableCaptureIds: ReadonlySet<string> = new Set<string>();
+  stableCaptureIds: ReadonlySet<string> = new Set<string>();
   /** Parameters proven projection-only: callers may pass stack boxes. */
-  private projectedParameters = new Set<string>();
-  private stableCallBindings: ReadonlySet<string> = new Set();
+  projectedParameters = new Set<string>();
+  stableCallBindings: ReadonlySet<string> = new Set();
   /** Locals and rebound parameters holding borrowed pointers for their
    * whole lifetime (walk-borrows.ts), per function and for the current one. */
-  private readonly walkBorrowsByFunction = new Map<string, ReadonlySet<string>>();
-  private walkBorrows: ReadonlySet<string> = new Set();
+  readonly walkBorrowsByFunction = new Map<string, ReadonlySet<string>>();
+  walkBorrows: ReadonlySet<string> = new Set();
   /** Functions whose borrowing body returns its result without a reference
    * (analyzeBorrowedReturns), and whether the current body is one. */
   readonly borrowedReturns = new Set<string>();
   /** Rebound parameters that keep the borrowed convention with an owner
    * slot (rebound-parameters.ts), per function, and the current owner slots. */
-  private readonly reboundByFunction = new Map<string, ReadonlySet<string>>();
-  private readonly reboundOwnerSlots = new Map<string, string>();
-  private currentBorrowedReturn = false;
+  readonly reboundByFunction = new Map<string, ReadonlySet<string>>();
+  readonly reboundOwnerSlots = new Map<string, string>();
+  currentBorrowedReturn = false;
   /** Manifest-bound native imports, used by ffiCall emission. */
   readonly ffiByName = new Map<string, IrFfiImport>();
   /** C-ABI callback trampolines and (for raw/no-userdata callbacks) their
    * distinct call-scoped TLS closure slots. */
-  private readonly ffiCallbackAdapters: Map<string, FfiCallbackAdapter>;
+  readonly ffiCallbackAdapters: Map<string, FfiCallbackAdapter>;
   /** Module-level constant consulted per ffiCall: with a retained
    * descriptor anywhere in the manifest, every native call is a
    * pending-exception checkpoint (may-throw derives the same fact from
    * the same helper). */
   readonly ffiHasRetainedCallback: boolean;
-  private readonly ffiHasForeignCallback: boolean;
+  readonly ffiHasForeignCallback: boolean;
   private readonly globalTypes = new Map<string, IrType>();
   /** Module constants that keep one value once initialized
    * (immutability.ts stableGlobals). */
-  private stableGlobals: ReadonlySet<string> = new Set();
+  stableGlobals: ReadonlySet<string> = new Set();
   private readonly tdzGlobals = new Map<string, string>();
   readonly constantNumericTables: ReadonlyMap<string, ConstantNumericTable>;
   /** Constant-key reads on checked-dynamic objects, each with its own
    * zero-initialized ScrDynReadIc (scr_runtime.h). */
-  private dynReadIcSites = 0;
+  dynReadIcSites = 0;
   /** ThreadSlots blocks by family name (thread-slots.ts). */
-  private readonly threadSlotsBlocks = new Map<string, string>();
+  readonly threadSlotsBlocks = new Map<string, string>();
   /** May-throw analysis (computeMayThrow): pending
    * checks are emitted only after calls that can actually raise. */
   readonly mayThrow: Set<string>;
   readonly indirectMayThrow: boolean;
   /** Worker programs: the functions that poll for termination on entry
    * (workerTerminationPolls); null outside worker programs. */
-  private readonly workerEntryPolls: ReadonlySet<string> | null;
+  readonly workerEntryPolls: ReadonlySet<string> | null;
   /** Functions that check the native stack guard on entry
    * (stackCheckedFunctions); null where the runtime has no guard. */
-  private readonly stackChecks: ReadonlySet<string> | null;
+  readonly stackChecks: ReadonlySet<string> | null;
   /** Static types whose values can be published (@scriptc/threads): their
    * stores carry the frozen-object guard. Null without publish calls. */
   readonly publishedTypes: PublishedTypes | null;
@@ -937,8 +835,8 @@ export class LlEmitter {
   private readonly immutableFields: ImmutableFields | null;
   /** Constructor function names: their bodies may still write their own
    * `this`'s construction-only fields. */
-  private readonly constructorFunctions: ReadonlySet<string>;
-  private inConstructor = false;
+  readonly constructorFunctions: ReadonlySet<string>;
+  inConstructor = false;
   /** Method names with at least one may-throw implementation — the
    * virtualCall pending check's key. */
   readonly mayThrowMethods = new Set<string>();
@@ -1014,30 +912,30 @@ export class LlEmitter {
   /** Class objects (classes as first-class values): className → the
    * interned .name literal ref — registered during body emission, the
    * statics and construct thunks assemble around the bodies. */
-  private readonly classObjs = new Map<string, { nameSym: string }>();
+  readonly classObjs = new Map<string, { nameSym: string }>();
   private readonly unionFieldReadGroups = new Map<string, number[][]>();
   /** Preorder intervals of the runtime error classes under THIS module's
    * class-forest numbering (main() stamps scr_error_vts with them, exactly
    * like the runtime ABI’s errorVtStampLines). */
-  private readonly errorIntervals: { kind: number; pre: number; post: number; lib: string }[] = [];
+  readonly errorIntervals: { kind: number; pre: number; post: number; lib: string }[] = [];
   /** The runtime emitter vtable's preorder interval, when the program
    * touches node:events (the class def rides the module exactly then) —
    * main() stamps scr_emitter_vt with it (emitterVtStampLines, ported). */
-  private emitterInterval: { pre: number; post: number } | null = null;
+  emitterInterval: { pre: number; post: number } | null = null;
   /** The runtime stream vtables' preorder intervals (streamVtStampLines,
    * ported): the defs ride every emitter-touching module (the frontend
    * collects the whole emitter-rooted tree), and scr_stream.c links on
    * the same predicate, so the stamps always have their globals. */
-  private readonly streamIntervals: { vt: string; pre: number; post: number; lib: string }[] = [];
+  readonly streamIntervals: { vt: string; pre: number; post: number; lib: string }[] = [];
 
   // ── per-function state (reset in emitFunction) ─────────────────────────
   B = new BlockBuilder();
   frames: LlValue[][] = [];
-  private scopes: LlScopeEntry[][] = [];
+  scopes: LlScopeEntry[][] = [];
   /** Scope slots dominate every throw site. Share their exceptional cleanup
    * for identical live bindings and handlers; statement temporaries stay at
    * their own throw sites because their SSA values are path-dependent. */
-  private readonly unwindCleanups = new Map<
+  readonly unwindCleanups = new Map<
     string,
     { label: string; entries: LlScopeEntry[]; terminator: string }
   >();
@@ -1048,7 +946,7 @@ export class LlEmitter {
    * continue binds to the innermost LOOP; a labeled jump binds to the
    * entry whose `labels` contains its label. `contLabel` is null exactly
    * for blocks and switches. */
-  private jumpTargets: {
+  jumpTargets: {
     kind: "loop" | "block" | "switch";
     brkLabel: string;
     contLabel: string | null;
@@ -1057,12 +955,12 @@ export class LlEmitter {
     scopeDepth: number;
     finallyDepth: number;
   }[] = [];
-  private currentLocals = new Map<string, IrLocal>();
-  private privateSplitLocals = new Map<string, StringSplit>();
+  currentLocals = new Map<string, IrLocal>();
+  privateSplitLocals = new Map<string, StringSplit>();
   readonly splitSpans = new Map<string, SplitSpan>();
-  private storedSplits = new Map<string, StoredSplitSnapshot>();
-  private streamingSplitsEnabled = false;
-  private readonly initializerBindings: ReturnType<typeof findInitializerBindings>;
+  storedSplits = new Map<string, StoredSplitSnapshot>();
+  streamingSplitsEnabled = false;
+  readonly initializerBindings: ReturnType<typeof findInitializerBindings>;
   /** Whole-program int32 storage and parameter/result facts. */
   readonly int32Slots: Int32Slots;
   /** The program has no runtime store into a checked-dynamic value
@@ -1086,56 +984,56 @@ export class LlEmitter {
   /** ProgramLifetime hierarchy roots (contract types): their instances are
    * immortal from construction (classes.ts programLifetimeClass). */
   readonly programLifetime: ReadonlySet<string>;
-  private numericLocals = new Map<string, IrLocal>();
+  numericLocals = new Map<string, IrLocal>();
   /** Local arrays of the current function that no other binding can hold
    * (ir/array-length-stability.ts). */
-  private unaliasedArrays: ReadonlySet<string> = new Set();
+  unaliasedArrays: ReadonlySet<string> = new Set();
   /** Dense array loops (dense-array-loops.ts) run in this function. */
-  private denseLoopsEnabled = false;
-  private denseLoopEntries: ReturnType<typeof findInitializedByteLoopBindings> = new Map();
+  denseLoopsEnabled = false;
+  denseLoopEntries: ReturnType<typeof findInitializedByteLoopBindings> = new Map();
   /** The fast copy of a dense array loop being emitted. */
-  private denseLoop: DenseArrayLoop | null = null;
-  private captureIds = new Set<string>();
+  denseLoop: DenseArrayLoop | null = null;
+  captureIds = new Set<string>();
   /** Active induction bindings retain their width independently of size_t. */
   integerLoopBindings = new Map<
     string,
     { slot: string; type: "i32" | "i64"; signed?: boolean; range?: { min: number; max: number } }
   >();
-  private countedLoopsEnabled = false;
+  countedLoopsEnabled = false;
   /** Speculative integer loops (speculative-integers.ts) run in this function. */
-  private speculativeLoopsEnabled = false;
+  speculativeLoopsEnabled = false;
   /** The fast copy of a speculative integer loop being emitted: its
    * integer-computed writes and where each resumes in the ordinary copy. */
-  private speculation: {
+  speculation: {
     writes: Set<IrStmt>;
     resume: Map<IrStmt, string>;
     /** Globals whose double is written back only when the copy is left. */
     deferred: Set<string>;
   } | null = null;
   /** The ordinary copy being emitted: resume labels still to place. */
-  private speculationResume: Map<IrStmt, { label: string; placed: boolean }> | null = null;
+  speculationResume: Map<IrStmt, { label: string; placed: boolean }> | null = null;
   /** The function being emitted, for speculative globals. */
-  private speculativeFunction = "";
+  speculativeFunction = "";
   /** Every function that writes each number global (computed on demand). */
   private globalWriters: Map<string, Set<string>> | null = null;
   /** Whole-program final reference fields (ir/final-fields.ts). */
-  private finalFields!: FinalFields;
+  finalFields!: FinalFields;
   /** The current function may borrow final fields of borrowable objects:
    * not a constructor (where they change), not async or a generator. */
-  private finalFieldBorrows = false;
+  finalFieldBorrows = false;
   integerRanges: IntegerRanges = new Map();
   /** Number arrays of the current function whose every present element is
    * an int32 (Int32[] contracts), or null when the module has none. */
   int32Elements: ((arr: IrExpr) => boolean) | null = null;
   /** Sums whose result only feeds 32-bit conversions (wrapping-sums.ts). */
   wrappingSums = new Set<IrExpr>();
-  private byteWindowsEnabled = true;
-  private byteWindowEntries: ReturnType<typeof findInitializedByteLoopBindings> = new Map();
+  byteWindowsEnabled = true;
+  byteWindowEntries: ReturnType<typeof findInitializedByteLoopBindings> = new Map();
   bytesBounds: ReadonlySet<IrExpr | IrStmt> = new Set();
   integerViews = new Map<string, string>();
   /** Module globals the current function owns outright (initializer
    * bindings): their function-local slot, which stands in for the global. */
-  private privateGlobalSlots = new Map<string, string>();
+  privateGlobalSlots = new Map<string, string>();
   /** Number locals of the current function stored only as an i32
    * (int32-locals.ts); their slots are `alloca i32`. */
   int32Locals = new Map<string, Int32Local>();
@@ -1150,7 +1048,7 @@ export class LlEmitter {
    * (past its own catch), so the copies emit under the truncated stack.
    * break/continue use the same region snapshots through
    * emitFinallysForJump. */
-  private finallyStack: {
+  finallyStack: {
     frameDepth: number;
     scopeDepth: number;
     tryDepth: number;
@@ -1161,15 +1059,15 @@ export class LlEmitter {
    * releases frames/scopes down to the recorded depths and branches to
    * `label` (the catch, or the exception-path finally) instead of
    * returning out of the function. Entering a try emits no code. */
-  private tryStack: { label: string; used: boolean; frameDepth: number; scopeDepth: number }[] = [];
+  tryStack: { label: string; used: boolean; frameDepth: number; scopeDepth: number }[] = [];
   /** Return type of the function being emitted — the unwind path returns
    * a dummy of this type (never read: callers check the flag first). */
   currentReturnType: IrType = VOID;
   /** The current body returns its number result as i32. */
-  private currentInt32Result = false;
+  currentInt32Result = false;
   /** The function's i32 entry returns its scalar union result as tag and
    * payload bits (Int32Abi.union). */
-  private currentUnionResult = false;
+  currentUnionResult = false;
   /** Active only while emitting a body lowered with LLVM's
    * switched-coroutine intrinsics (wasm32 async bodies and generators,
    * native synchronous generators; see coroLowered). */
@@ -1194,13 +1092,13 @@ export class LlEmitter {
    * catch prologue emits the GENRET sentinel re-unwind exactly here. */
   currentGenerator: { yieldT: IrType; nextT: IrType } | null = null;
   /** The function being emitted is an async generator body. */
-  private currentAsyncGenerator = false;
+  currentAsyncGenerator = false;
   /** Active optional-chain bind slots, by chain id (chainRecv reads). */
   readonly chainSlots = new Map<string, LlValue>();
   logArgSlots = 0;
-  private readonly stackTraces: boolean;
+  readonly stackTraces: boolean;
   /** Stack-trace mode: functions no capture can include (no frame push). */
-  private readonly unframedFunctions: ReadonlySet<string>;
+  readonly unframedFunctions: ReadonlySet<string>;
 
   constructor(
     readonly mod: IrModule,
@@ -1593,7 +1491,7 @@ export class LlEmitter {
     return this.virtualBorrows.entry(implFn);
   }
 
-  private implSlotBorrowed(implFn: string): ReadonlySet<number> {
+  implSlotBorrowed(implFn: string): ReadonlySet<number> {
     return this.virtualBorrows.implSlotBorrowed(implFn);
   }
 
@@ -1630,398 +1528,22 @@ export class LlEmitter {
       throw new InternalCompilerError(`llvm emitter bug: no callback adapter for ${binding}:${id}`);
     return adapter;
   }
-
-  /** C-callable scalar callback trampolines. A callback with an explicit
-   * context entry receives the closure at that exact ABI position. A raw
-   * callback loads it from a call-scoped TLS slot installed around the
-   * outer native call. */
-  private emitFfiCallbackDefs(): { globals: string[]; defs: string[] } {
-    const globals: string[] = [];
-    const defs: string[] = [];
-    if (this.ffiCallbackAdapters.size === 0) return { globals, defs };
-    this.declare(`declare void @scr_trap(ptr)`);
-    const expired = this.cstr(
-      "scriptc: native callback invoked outside its call-scoped lifetime\n",
-    );
-    const released = this.cstr("scriptc: native callback invoked outside its retained lifetime\n");
-    for (const adapter of this.ffiCallbackAdapters.values()) {
-      const cb = adapter.callback;
-      if (adapter.tls !== null)
-        globals.push(`@${adapter.tls} = internal thread_local global ptr null`);
-      if (adapter.global !== null)
-        globals.push(`@${adapter.global} = internal thread_local global ptr null`);
-      if (adapter.table !== null) {
-        globals.push(
-          `@${adapter.table} = internal ${this.mod.workers ? "thread_local " : ""}global %ScrFfiTable zeroinitializer`,
-        );
-      }
-      const params = cb.params.flatMap((param, i): string[] => {
-        if (isFfiContextParam(param)) return [`ptr %ctx`];
-        if (param === "string" || param === "bytes") {
-          return [`ptr %a${i}`, `${this.sizeType} %a${i}_len`];
-        }
-        return [`${ffiNativeParamLl(param, this.ffiExtendNarrowIntegers)} %a${i}`];
-      });
-      if (cb.invoke === "foreign") {
-        if (
-          adapter.table === null ||
-          !cb.params.some(isFfiContextParam) ||
-          cb.returns !== "void" ||
-          cb.params.some((param) => param === "i64" || param === "u64" || param === "pointer")
-        ) {
-          throw new InternalCompilerError(
-            "llvm emitter bug: invalid foreign FFI callback descriptor",
-          );
-        }
-        const dispatch = `${adapter.symbol}_dispatch`;
-        const scriptArgs: string[] = [];
-        const dispatchBody: string[] = [
-          `define internal void @${dispatch}(ptr %cb, ptr %call) ${FN_ATTRS} {`,
-          `entry:`,
-          `  %fnp = getelementptr inbounds %ScrClosure, ptr %cb, i64 0, i32 1`,
-          `  %fn = load ptr, ptr %fnp`,
-        ];
-        for (let i = 0; i < cb.params.length; i++) {
-          const param = cb.params[i]!;
-          if (isFfiContextParam(param)) continue;
-          switch (param) {
-            case "f64":
-            case "f32":
-            case "i8":
-            case "u16":
-            case "i16":
-              this.declare(`declare double @scr_ffi_call_get_f64(ptr, ${this.sizeType})`);
-              dispatchBody.push(
-                `  %s${i} = call double @scr_ffi_call_get_f64(ptr %call, ${this.sizeType} ${i})`,
-              );
-              scriptArgs.push(`double %s${i}`);
-              break;
-            case "bool":
-              this.declare(`declare zeroext i1 @scr_ffi_call_get_bool(ptr, ${this.sizeType})`);
-              dispatchBody.push(
-                `  %s${i} = call zeroext i1 @scr_ffi_call_get_bool(ptr %call, ${this.sizeType} ${i})`,
-              );
-              scriptArgs.push(`i1 %s${i}`);
-              break;
-            case "u8":
-            case "u32":
-            case "i32":
-              this.declare(`declare double @scr_ffi_call_get_${param}(ptr, ${this.sizeType})`);
-              dispatchBody.push(
-                `  %s${i} = call double @scr_ffi_call_get_${param}(ptr %call, ${this.sizeType} ${i})`,
-              );
-              scriptArgs.push(`double %s${i}`);
-              break;
-            case "cstring":
-            case "string":
-            case "bytes": {
-              this.declare(`declare ptr @scr_ffi_call_get_data(ptr, ${this.sizeType})`);
-              this.declare(`declare ${this.sizeType} @scr_ffi_call_get_len(ptr, ${this.sizeType})`);
-              dispatchBody.push(
-                `  %data${i} = call ptr @scr_ffi_call_get_data(ptr %call, ${this.sizeType} ${i})`,
-                `  %len${i} = call ${this.sizeType} @scr_ffi_call_get_len(ptr %call, ${this.sizeType} ${i})`,
-              );
-              if (param === "bytes") {
-                this.declare(`declare ptr @scr_bytes_from_data(ptr, ${this.sizeType})`);
-                dispatchBody.push(
-                  `  %s${i} = call ptr @scr_bytes_from_data(ptr %data${i}, ${this.sizeType} %len${i})`,
-                );
-              } else {
-                this.declare(`declare ptr @scr_str_from_utf8_lossy(ptr, ${this.sizeType})`);
-                dispatchBody.push(
-                  `  %s${i} = call ptr @scr_str_from_utf8_lossy(ptr %data${i}, ${this.sizeType} %len${i})`,
-                );
-              }
-              scriptArgs.push(`ptr %s${i}`);
-              break;
-            }
-          }
-        }
-        dispatchBody.push(
-          `  call void %fn(${[`ptr %cb`, ...scriptArgs].join(", ")})`,
-          `  ret void`,
-          `}`,
-          ``,
-        );
-        for (const line of dispatchBody) defs.push(line);
-
-        this.declare(`declare ptr @scr_ffi_call_new(ptr, ptr, ptr, ${this.sizeType})`);
-        this.declare(`declare void @scr_ffi_post(ptr)`);
-        defs.push(
-          `define internal void @${adapter.symbol}(${params.join(", ")}) ${FN_ATTRS} {`,
-          `entry:`,
-          `  %cb = getelementptr inbounds i8, ptr %ctx, i64 0`,
-          `  %call = call ptr @scr_ffi_call_new(ptr @${adapter.table}, ptr %cb, ptr @${dispatch}, ${this.sizeType} ${cb.params.length})`,
-        );
-        for (let i = 0; i < cb.params.length; i++) {
-          const param = cb.params[i]!;
-          if (isFfiContextParam(param)) continue;
-          if (param === "cstring") {
-            this.declare(`declare void @scr_ffi_call_copy_cstring(ptr, ${this.sizeType}, ptr)`);
-            defs.push(
-              `  call void @scr_ffi_call_copy_cstring(ptr %call, ${this.sizeType} ${i}, ptr %a${i})`,
-            );
-          } else if (param === "string" || param === "bytes") {
-            this.declare(
-              `declare void @scr_ffi_call_copy_${param}(ptr, ${this.sizeType}, ptr, ${this.sizeType})`,
-            );
-            defs.push(
-              `  call void @scr_ffi_call_copy_${param}(ptr %call, ${this.sizeType} ${i}, ptr %a${i}, ${this.sizeType} %a${i}_len)`,
-            );
-          } else if (param === "f32" || param === "i8" || param === "u16" || param === "i16") {
-            const nativeTy = ffiNativeTypeLl(param);
-            const op = param === "f32" ? "fpext" : param === "u16" ? "uitofp" : "sitofp";
-            this.declare(`declare void @scr_ffi_call_set_f64(ptr, ${this.sizeType}, double)`);
-            defs.push(
-              `  %wide${i} = ${op} ${nativeTy} %a${i} to double`,
-              `  call void @scr_ffi_call_set_f64(ptr %call, ${this.sizeType} ${i}, double %wide${i})`,
-            );
-          } else {
-            const nativeTy = ffiNativeTypeLl(param);
-            this.declare(
-              `declare void @scr_ffi_call_set_${param}(ptr, ${this.sizeType}, ${nativeTy})`,
-            );
-            defs.push(
-              `  call void @scr_ffi_call_set_${param}(ptr %call, ${this.sizeType} ${i}, ${nativeTy} %a${i})`,
-            );
-          }
-        }
-        defs.push(`  call void @scr_ffi_post(ptr %call)`, `  ret void`, `}`, ``);
-        continue;
-      }
-      defs.push(
-        `define internal ${ffiNativeReturnLl(cb.returns, this.ffiExtendNarrowIntegers)} @${adapter.symbol}(${params.join(", ")}) ${FN_ATTRS} {`,
-        `entry:`,
-        adapter.tls !== null
-          ? `  %cb = load ptr, ptr @${adapter.tls}`
-          : adapter.global !== null
-            ? `  %cb = load ptr, ptr @${adapter.global}`
-            : `  %cb = getelementptr inbounds i8, ptr %ctx, i64 0`,
-        `  %missing = icmp eq ptr %cb, null`,
-        `  br i1 %missing, label %expired, label %ready`,
-        `expired:`,
-        `  call void @scr_trap(ptr ${adapter.callback.lifetime === "call" ? expired : released})`,
-        `  unreachable`,
-        `ready:`,
-        ...this.pendingTestLines("%pending"),
-        `  br i1 %pending, label %skip, label %invoke`,
-        `skip:`,
-        `  ret ${ffiCallbackDummyLl(cb)}`,
-        `invoke:`,
-      );
-      // Validate every native pointer before allocating any copy-in value.
-      // A later bad slot therefore cannot leak an earlier materialization.
-      for (let i = 0; i < cb.params.length; i++) {
-        const param = cb.params[i]!;
-        if (param !== "cstring" && param !== "string" && param !== "bytes") continue;
-        const invalid = `%invalid${i}`;
-        defs.push(`  %null${i} = icmp eq ptr %a${i}, null`);
-        if (param === "cstring") {
-          defs.push(`  ${invalid} = or i1 %null${i}, false`);
-        } else {
-          defs.push(
-            `  %nonempty${i} = icmp ne ${this.sizeType} %a${i}_len, 0`,
-            `  ${invalid} = and i1 %null${i}, %nonempty${i}`,
-          );
-        }
-        const message =
-          param === "cstring"
-            ? "scriptc: native callback passed a NULL cstring\n"
-            : `scriptc: native callback passed a NULL ${param} span with nonzero length\n`;
-        defs.push(
-          `  br i1 ${invalid}, label %invalid_param${i}, label %param_ok${i}`,
-          `invalid_param${i}:`,
-          `  call void @scr_trap(ptr ${this.cstr(message)})`,
-          `  unreachable`,
-          `param_ok${i}:`,
-        );
-      }
-      defs.push(
-        `  %fnp = getelementptr inbounds %ScrClosure, ptr %cb, i64 0, i32 1`,
-        `  %fn = load ptr, ptr %fnp`,
-      );
-      const scriptArgs: string[] = [];
-      for (let i = 0; i < cb.params.length; i++) {
-        const param = cb.params[i]!;
-        if (isFfiContextParam(param)) continue;
-        switch (param) {
-          case "i64":
-          case "u64":
-          case "pointer": {
-            const ty = ffiNativeTypeLl(param);
-            this.declare(`declare ptr @scr_bigint_from_${param}(${ty})`);
-            defs.push(`  %s${i} = call ptr @scr_bigint_from_${param}(${ty} %a${i})`);
-            scriptArgs.push(`ptr %s${i}`);
-            break;
-          }
-          case "f64":
-            scriptArgs.push(`double %a${i}`);
-            break;
-          case "f32":
-          case "i8":
-          case "u16":
-          case "i16": {
-            const nativeTy = ffiNativeTypeLl(param);
-            const op = param === "f32" ? "fpext" : param === "u16" ? "uitofp" : "sitofp";
-            defs.push(`  %s${i} = ${op} ${nativeTy} %a${i} to double`);
-            scriptArgs.push(`double %s${i}`);
-            break;
-          }
-          case "bool":
-            defs.push(`  %s${i} = icmp ne i8 %a${i}, 0`);
-            scriptArgs.push(`i1 %s${i}`);
-            break;
-          case "u8":
-            defs.push(`  %s${i} = uitofp i8 %a${i} to double`);
-            scriptArgs.push(`double %s${i}`);
-            break;
-          case "u32":
-            defs.push(`  %s${i} = uitofp i32 %a${i} to double`);
-            scriptArgs.push(`double %s${i}`);
-            break;
-          case "i32":
-            defs.push(`  %s${i} = sitofp i32 %a${i} to double`);
-            scriptArgs.push(`double %s${i}`);
-            break;
-          case "cstring":
-            this.declare(`declare ${this.sizeType} @strlen(ptr)`);
-            this.declare(`declare ptr @scr_str_from_utf8_lossy(ptr, ${this.sizeType})`);
-            defs.push(
-              `  %len${i} = call ${this.sizeType} @strlen(ptr %a${i})`,
-              `  %s${i} = call ptr @scr_str_from_utf8_lossy(ptr %a${i}, ${this.sizeType} %len${i})`,
-            );
-            scriptArgs.push(`ptr %s${i}`);
-            break;
-          case "string":
-            this.declare(`declare ptr @scr_str_from_utf8_lossy(ptr, ${this.sizeType})`);
-            defs.push(
-              `  %s${i} = call ptr @scr_str_from_utf8_lossy(ptr %a${i}, ${this.sizeType} %a${i}_len)`,
-            );
-            scriptArgs.push(`ptr %s${i}`);
-            break;
-          case "bytes":
-            this.declare(`declare ptr @scr_bytes_from_data(ptr, ${this.sizeType})`);
-            defs.push(
-              `  %s${i} = call ptr @scr_bytes_from_data(ptr %a${i}, ${this.sizeType} %a${i}_len)`,
-            );
-            scriptArgs.push(`ptr %s${i}`);
-            break;
-        }
-      }
-      const ft = ffiCallbackType(cb);
-      const internalRet = this.llType(ft.ret);
-      const callArgs = [`ptr %cb`, ...scriptArgs].join(", ");
-      if (cb.lifetime === "retained") {
-        this.declare(`declare ptr @scr_closure_retain_v(ptr)`);
-        this.declare(`declare void @scr_closure_release_v(ptr)`);
-        defs.push(`  %invoke_pin = call ptr @scr_closure_retain_v(ptr %cb)`);
-      }
-      if (cb.returns === "void") {
-        defs.push(
-          `  call void %fn(${callArgs})`,
-          ...(cb.lifetime === "retained"
-            ? [`  call void @scr_closure_release_v(ptr %invoke_pin)`]
-            : []),
-          `  ret void`,
-          `}`,
-          ``,
-        );
-        continue;
-      }
-      defs.push(`  %result = call ${internalRet} %fn(${callArgs})`);
-      if (cb.lifetime === "retained") {
-        defs.push(`  call void @scr_closure_release_v(ptr %invoke_pin)`);
-      }
-      switch (cb.returns) {
-        case "i64":
-        case "u64":
-        case "pointer": {
-          const ty = ffiNativeTypeLl(cb.returns);
-          this.declare(`declare ${ty} @scr_bigint_to_${cb.returns}(ptr)`);
-          this.declare(`declare void @scr_bigint_release(ptr)`);
-          defs.push(
-            `  %out = call ${ty} @scr_bigint_to_${cb.returns}(ptr %result)`,
-            `  call void @scr_bigint_release(ptr %result)`,
-            `  ret ${ty} %out`,
-          );
-          break;
-        }
-        case "f64":
-          defs.push(`  ret double %result`);
-          break;
-        case "f32":
-          defs.push(`  %out = fptrunc double %result to float`, `  ret float %out`);
-          break;
-        case "bool":
-          defs.push(`  %out = zext i1 %result to i8`, `  ret i8 %out`);
-          break;
-        case "u8":
-        case "i8":
-        case "u16":
-        case "i16":
-        case "u32":
-          this.declare(`declare double @scr_bit_ushr(double, double)`);
-          defs.push(
-            `  %coerced = call double @scr_bit_ushr(double %result, double ${f64Lit(0)})`,
-            `  %wide = fptoui double %coerced to i32`,
-          );
-          if (cb.returns !== "u32") {
-            const nativeTy = ffiNativeTypeLl(cb.returns);
-            defs.push(`  %out = trunc i32 %wide to ${nativeTy}`, `  ret ${nativeTy} %out`);
-          } else {
-            defs.push(`  ret i32 %wide`);
-          }
-          break;
-        case "i32":
-          this.declare(`declare double @scr_bit_or(double, double)`);
-          defs.push(
-            `  %coerced = call double @scr_bit_or(double %result, double ${f64Lit(0)})`,
-            `  %out = fptosi double %coerced to i32`,
-            `  ret i32 %out`,
-          );
-          break;
-      }
-      defs.push(`}`, ``);
-    }
-    return { globals, defs };
+  emitFfiCallbackDefs(): { globals: string[]; defs: string[] } {
+    return emitFfiCallbackDefs(this);
   }
 
   emit(): string {
     return this.emitParts().join("\n");
   }
-
   emitParts(): string[] {
-    const parts = [
-      ...limitInlineDynReleases(this.emitModuleParts()),
-      ...this.disposeObserverGates(),
-    ];
-    if (!this.executableTls) return parts;
-    // A worker executable's thread-locals all live in the executable's own
-    // TLS block: the program's internal ones, and the runtime's external
-    // ones, because the runtime is always linked statically into the
-    // executable. So on ELF they can all use the local-exec model: LLVM's
-    // default general-dynamic sequence (relaxed by the linker to `mov %fs:0`
-    // plus an add), and even initial-exec (relaxed to `mov $offset` plus an
-    // indexed access), become one %fs-relative operand LLVM can fold into
-    // loads and compares. Darwin's thread-local variables have one model.
-    return parts.map((part) =>
-      part
-        .replace(
-          /^(@[-$._A-Za-z0-9]+ = internal )thread_local global /gm,
-          "$1thread_local(localexec) global ",
-        )
-        .replace(
-          /^(@[-$._A-Za-z0-9]+ = external )thread_local global /gm,
-          "$1thread_local(localexec) global ",
-        ),
-    );
+    return emitParts(this);
   }
 
   /** The dispose-observer gates the emitted frees and record writers test
    * (alloc.ts): defined after every helper is emitted, because dynCheck
    * builders, JSON schemas and weak collection constructors are requested
    * lazily. */
-  private disposeObserverGates(): string[] {
+  disposeObserverGates(): string[] {
     const weak = [...this.decls].some(
       (d) => d.includes("@scr_weak_map_new(") || d.includes("@scr_weak_set_new("),
     );
@@ -2031,1764 +1553,25 @@ export class LlEmitter {
       ``,
     ];
   }
-
-  private emitModuleParts(): string[] {
-    // Function bodies first (the literal/unit/fn-value tables fill as they
-    // emit), then the file assembles around them — the runtime ABI’s order.
-    const fnDefs: string[] = [];
-    for (const fn of this.mod.functions) {
-      const def = this.emitFunction(fn);
-      fnDefs.push(def);
-      this.fnDefText.set(fn.name, def);
-    }
-    this.selectStacklessAsync(fnDefs);
-    const errorViews: string[] = [];
-    for (const property of ["name", "message"])
-      if (this.mod.functions.some((fn) => fn.name === `%error.${property}.read`)) {
-        this.declare(`declare void @scr_error_install_${property}_reader(ptr)`);
-        errorViews.push(
-          `  call void @scr_error_install_${property}_reader(ptr @${mangleFunction(`%error.${property}.read`)})`,
-        );
-      }
-    for (const meta of this.classMeta.values()) {
-      if (meta.def.runtime || meta.root.def.name !== "%Error") continue;
-      const type: IrType = { kind: "object", className: meta.def.name };
-      const adapter = this.liveDynRefAdapter(type);
-      const rc = vAdapters(this.shapeHost, type);
-      const key = typeKey(type);
-      const name = `sc_error_view_${errorViews.length}`;
-      this.resolveThunkDefs.push(
-        `define internal ptr @${name}(ptr %v) ${FN_ATTRS} {`,
-        `entry:`,
-        `  %d = call ptr ${typedRefConstructor(this.shapeHost, type)}(ptr %v, ptr ${rc.retain}, ptr ${rc.release}, ptr ${this.cstr(key)}, ${this.sizeType} ${Buffer.byteLength(key, "utf8")}, ptr @${adapter.snapshot}, ptr ${adapter.commit})`,
-        `  ret ptr %d`,
-        `}`,
-        ``,
-      );
-      this.declare(`declare void @scr_error_register_dyn(ptr, ptr)`);
-      errorViews.push(
-        `  call void @scr_error_register_dyn(ptr @${mangleVtInstance(meta.def.name)}, ptr @${name})`,
-      );
-    }
-    const layouts = emitLlvmLayouts(
-      this.shapeHost,
-      this.mod,
-      this.classMeta,
-      this.classObjs,
-      this.fnByName,
-      (t) => this.llType(t),
-      this.nullableFields,
-      this.int32Slots,
-    );
-    const shapes = layouts.records;
-    const classShapes = layouts.classes;
-    const classObjDefs = layouts.classObjects;
-    const wrappers = this.emitFnValueDefs();
-    const asyncDefs = this.emitAsyncScaffolding();
-    const ffiCallbacks = this.emitFfiCallbackDefs();
-    const hasNoInlineRecordClone = [...this.recordCloneShapes].some(
-      (shapeId) => (this.recordsById.get(shapeId)?.fields.length ?? 0) >= 16,
-    );
-
-    // Module globals, FIRST OCCURRENCE per id: a class-expression static
-    // instantiated through several mixin applications registers one global
-    // id several times (2041-mixin-values) — C's tentative definitions
-    // accept the duplicates without an error, LLVM rejects redefinition, so the
-    // storage AND the release emit once per id here.
-    const seenGlobalIds = new Set<string>();
-    const globals = (this.mod.globals ?? []).filter((g) => {
-      if (seenGlobalIds.has(g.id)) return false;
-      seenGlobalIds.add(g.id);
-      return true;
-    });
-    // Refcounted globals release before main returns — the runtime ABI’s
-    // sc_release_globals, keeping the RC audit's live count exact. Built
-    // before the declaration table flushes (it adds the release symbols).
-    // Two spellings with distinct temp names: the normal exit and the
-    // uncaught-exception exit are separate blocks of the same function.
-    // Interned function-value closures are IMMORTAL (rc == SIZE_MAX), so
-    // an own-property table Object.defineProperties hung on one would
-    // outlive the RC audit — release it with the globals (the runtime ABI’s
-    // sc_release_globals tail). Only when the dispatch unit is even
-    // linked (defineProps is the only writer).
-    const runtimeFeatures = moduleRuntimeFeatures(this.mod);
-    const fnValueProps = [...this.fnValues];
-    if (fnValueProps.length > 0) this.declare(`declare void @scr_box_release(ptr)`);
-    if (this.classObjs.size > 0) this.declare(`declare void @scr_classobj_clear_properties(ptr)`);
-    const globalReleaseLines = (prefix: string): string[] => {
-      const lines: string[] = [];
-      globals.forEach((g, i) => {
-        if (!isRefCounted(g.type)) return;
-        lines.push(
-          `  %${prefix}${i} = load ptr, ptr @${mangleGlobal(g.id)}`,
-          `  call void ${releaseSym(this.shapeHost, g.type)}(ptr %${prefix}${i}) ; ${g.name}`,
-        );
-      });
-      fnValueProps.forEach((name, i) => {
-        // props sits at %ScrClosure field 3; release is NULL-tolerant —
-        // cleared so a second release path stays idempotent.
-        lines.push(
-          `  %${prefix}fp${i} = load ptr, ptr getelementptr inbounds (%ScrClosure, ptr @${mangleFnClosure(name)}, i64 0, i32 3)`,
-          `  call void @scr_box_release(ptr %${prefix}fp${i}) ; ${name}.props`,
-          `  store ptr null, ptr getelementptr inbounds (%ScrClosure, ptr @${mangleFnClosure(name)}, i64 0, i32 3)`,
-        );
-      });
-      for (const name of this.classObjs.keys())
-        lines.push(`  call void @scr_classobj_clear_properties(ptr @${mangleClassObj(name)})`);
-      return lines;
-    };
-    // Exit listeners can read MODULE GLOBALS directly, so they must run
-    // BEFORE the global releases (the runtime ABI’s runExitListeners
-    // ordering — the atexit half becomes an idempotent no-op).
-    const usesEvents = runtimeFeatures.processEvents;
-    const usesChildProcess = runtimeFeatures.childProcess;
-    const usesFsWatch = runtimeFeatures.fsWatch;
-    // Stream-surface programs fill the loop's stream hook (the deferred
-    // next-tick emissions) and the emitter's post-registration flow kick
-    // before %main — scr_stream.c links only when the line is emitted
-    // (native/executable.ts gates on the same predicate).
-    const usesStream = runtimeFeatures.stream;
-    // Net-surface programs fill the loop's net hooks (and the netSocket
-    // handle-dispatch ops for the checked-dynamic boundary); http-surface
-    // programs additionally stamp the httpReq/httpRes ops — the C main's
-    // install lines, gated on the same predicates native/executable.ts links by.
-    const usesNet = runtimeFeatures.net;
-    const usesDgram = runtimeFeatures.dgram;
-    const usesHttp2 = runtimeFeatures.http2;
-    const usesHttp = runtimeFeatures.http;
-    // Fetch-referencing programs register native fetch before main.
-    // Runtime selection compiles scr_fetch.c on the same predicate.
-    const usesFetch = runtimeFeatures.fetch;
-    const snapshotsTlsCa = runtimeFeatures.tls || runtimeFeatures.tlsCa;
-    // The process verdict has the same precedence as the C reference
-    // emitter: node:test owns the final status when present; otherwise an
-    // embedded process.exitCode owns it; ordinary programs return zero.
-    const usesNodeTest = runtimeFeatures.nodeTest;
-    // Declared NOW — the extern block flushes before main assembles.
-    if (usesEvents) this.declare(`declare void @scr_events_install()`);
-    if (usesChildProcess) this.declare(`declare void @scr_child_dyn_install()`);
-    const childStreamBoxes =
-      usesChildProcess &&
-      usesStream &&
-      this.classMeta.has("%Readable") &&
-      this.classMeta.has("%Writable")
-        ? [
-            this.dyn.toDynHelper({ kind: "object", className: "%Readable" }),
-            this.dyn.toDynHelper({ kind: "object", className: "%Writable" }),
-          ]
-        : null;
-    // worker.stdout and worker.stderr box the stream unit's Readable the
-    // same way, and worker.stdin its Writable when the program has one
-    // (scr_worker_stdio_install, scr_worker_events.c).
-    const workerStdioBox =
-      this.mod.workers === true && usesStream && this.classMeta.has("%Readable")
-        ? (childStreamBoxes?.[0] ??
-          this.dyn.toDynHelper({ kind: "object", className: "%Readable" }))
-        : null;
-    const workerStdinBox =
-      this.mod.workers === true && usesStream && this.classMeta.has("%Writable")
-        ? (childStreamBoxes?.[1] ??
-          this.dyn.toDynHelper({ kind: "object", className: "%Writable" }))
-        : null;
-    if (childStreamBoxes || workerStdioBox || workerStdinBox) {
-      this.declare(
-        `@scr_stream_child_ops = external constant { ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr }`,
-      );
-    }
-    if (childStreamBoxes)
-      this.declare(`declare void @scr_child_dyn_streams_install(ptr, ptr, ptr)`);
-    if (workerStdioBox || workerStdinBox)
-      this.declare(`declare void @scr_worker_stdio_install(ptr, ptr, ptr)`);
-    if (usesFsWatch) this.declare(`declare void @scr_watch_install()`);
-    if (this.ffiHasForeignCallback) this.declare(`declare void @scr_ffi_install()`);
-    if (usesStream) this.declare(`declare void @scr_stream_install()`);
-    if (usesNet) {
-      this.declare(`declare void @scr_net_install()`);
-      this.declare(`declare void @scr_net_dyn_install()`);
-    }
-    if (usesDgram) this.declare(`declare void @scr_dgram_install()`);
-    if (usesHttp2) this.declare(`declare void @scr_http2_dyn_install()`);
-    if (usesHttp) this.declare(`declare void @scr_http_dyn_install()`);
-    if (usesFetch) this.declare(`declare void @scr_fetch_install()`);
-
-    if (usesNodeTest) {
-      this.declare(`declare i32 @scr_test_exit_code()`);
-      this.declare(`declare void @scr_test_init()`);
-    }
-    if (snapshotsTlsCa) {
-      this.declare(`declare void @scr_tls_ca_install()`);
-    }
-    // Inline exit listeners run when something they must beat exists:
-    // the refcounted-global releases, or the retained-FFI atexit ledger
-    // sweep (a listener may legitimately release or pump a registration,
-    // and only the inline call orders ahead of every atexit handler —
-    // the runtime ABI’s runExitListeners stance). Plain event programs
-    // with neither keep the atexit path, so their listener timing is
-    // unchanged.
-    const hasRefGlobals = globals.some((g) => isRefCounted(g.type)) || fnValueProps.length > 0;
-    const inlineExitListeners =
-      usesEvents && (this.mod.workers || hasRefGlobals || this.ffiHasRetainedCallback);
-    this.declare(`declare i32 @scr_exit_code_hint_get()`);
-    if (inlineExitListeners) {
-      this.declare(`declare void @scr_run_exit_listeners(double)`);
-      this.declare(`declare i32 @scr_exit_code_hint_get()`);
-    }
-    const exitListenerLines = (prefix: string): string[] => {
-      if (!inlineExitListeners) return [];
-      return [
-        `  %${prefix}h = call i32 @scr_exit_code_hint_get()`,
-        `  %${prefix}hd = sitofp i32 %${prefix}h to double`,
-        `  call void @scr_run_exit_listeners(double %${prefix}hd)`,
-      ];
-    };
-    // The entry's exits release the module globals only where the thread
-    // frees its heap when its script ends (scr_exit_frees: workers, and
-    // builds that check for leaks); the main thread of other builds leaves
-    // it to the operating system.
-    const exitReleaseLines = (prefix: string): string[] => {
-      const releases = globalReleaseLines(prefix);
-      if (releases.length === 0) return releases;
-      this.declare(`declare zeroext i1 @scr_exit_frees()`);
-      return [
-        `  %${prefix}.frees = call zeroext i1 @scr_exit_frees()`,
-        `  br i1 %${prefix}.frees, label %${prefix}.release, label %${prefix}.kept`,
-        `${prefix}.release:`,
-        ...releases,
-        `  br label %${prefix}.kept`,
-        `${prefix}.kept:`,
-      ];
-    };
-    const globalReleases = exitReleaseLines("g");
-    const asyncEntry = this.fnByName.get(this.mod.entry)?.async === true;
-    const entryMayThrow = this.mayThrow.has(this.mod.entry);
-    // The event loop runs when timers appeared OR any async/generator
-    // function exists (the C main's hasAsync || hasGenerators ||
-    // usesTimers gate). Generator programs run
-    // the loop too: its exit accounting notes still-suspended generator
-    // fibers as abandoned, so the RC audit downgrades exactly like the
-    // async loop-exhaustion story.
-    const runsLoop =
-      this.usesTimers ||
-      this.ffiHasForeignCallback ||
-      this.mod.functions.some((f) => f.async === true || f.generator !== undefined);
-    const uncaughtReleases = entryMayThrow && !asyncEntry ? exitReleaseLines("gu") : [];
-    const loopReleasesU = runsLoop ? exitReleaseLines("gl") : [];
-    const loopReleasesR = runsLoop ? exitReleaseLines("gr") : [];
-    const topRejectReleases = asyncEntry ? exitReleaseLines("gt") : [];
-    const topPendingReleases = asyncEntry ? exitReleaseLines("gp") : [];
-    const loopReportedReleases = runsLoop ? exitReleaseLines("gq") : [];
-    // main's epilogues read the flag / the loop entry points — declared
-    // HERE, before the extern block flushes. They run once, so they keep
-    // the out-of-line scr_exc_pending call; per-call checks inline the
-    // test (pendingTestLines).
-    if (entryMayThrow || runsLoop) this.declare(`declare zeroext i1 @scr_exc_pending()`);
-    if (runsLoop) {
-      this.declare(`declare zeroext i1 @scr_loop_run(ptr)`);
-      if (this.mod.commonJsEntry === true) this.declare(`declare void @scr_loop_commonjs_entry()`);
-      this.declare(`declare zeroext i1 @scr_report_unhandled_rejections()`);
-      this.declare(`declare void @scr_discard_unhandled_rejections()`);
-    }
-    if (asyncEntry) {
-      this.declare(`declare i32 @scr_promise_finish_top_level(ptr)`);
-      this.declare(`declare void @scr_promise_rethrow_top_level(ptr)`);
-      this.declare(`declare void @scr_promise_release(ptr)`);
-      this.declare(`declare void @scr_exit_code_note(i32)`);
-    }
-    const topPendingExitLines = (): string[] => {
-      if (!asyncEntry) return [];
-      const lines: string[] = [];
-      // finish_top_level noted 13 unless the program set process.exitCode.
-      // A failed node:test run outranks either before exit listeners run.
-      if (usesNodeTest) {
-        lines.push(
-          `  %tla_program_exit = call i32 @scr_test_exit_code()`,
-          `  %tla_program_exit_zero = icmp eq i32 %tla_program_exit, 0`,
-          `  %tla_hint = call i32 @scr_exit_code_hint_get()`,
-          `  %tla_exit_status = select i1 %tla_program_exit_zero, i32 %tla_hint, i32 %tla_program_exit`,
-          `  call void @scr_exit_code_note(i32 %tla_exit_status)`,
-        );
-      }
-      for (const line of exitListenerLines("xp")) lines.push(line);
-      for (const line of topPendingReleases) lines.push(line);
-      // An exit listener may set process.exitCode again, as in Node.
-      lines.push(
-        `  %tla_exit_code = call i32 @scr_exit_code_hint_get()`,
-        `  ret i32 %tla_exit_code`,
-      );
-      return lines;
-    };
-    // LIBRARY mode: the runtime entry points the generated library
-    // symbols delegate to — declared before the extern block flushes.
-    if (this.mod.lib !== undefined) {
-      if (this.wasi) {
-        this.declare(`declare ptr @malloc(${this.sizeType})`);
-        this.declare(`declare void @free(ptr)`);
-      }
-      this.declare(`declare void @scr_library_entry(i1 zeroext, ptr)`);
-      this.declare(`declare void @scr_library_reset()`);
-      this.declare(`declare void @scr_library_check_exc()`);
-      this.declare(`declare void @scr_library_set_sink(ptr, ptr)`);
-      this.declare(`declare void @scr_library_callback_entry_guard(ptr)`);
-      this.declare(`declare void @scr_library_arena_reset()`);
-      this.declare(`declare void @scr_library_collect()`);
-      if ((this.mod.lib.callbacks?.length ?? 0) > 0) {
-        // Host-callback channels: the registration define's dispatch
-        // (strcmp over the declared names + the runtime slot store).
-        // The call-site fetch pair (scr_library_cb_require/_ctx) is
-        // declared at ffiCall emission like every body-driven runtime
-        // symbol.
-        this.declare(`declare void @scr_library_cb_set(${this.sizeType}, ptr, ptr)`);
-        this.declare(`declare i32 @strcmp(ptr, ptr)`);
-      }
-      if (this.mod.lib.exports.some((e) => e.params.includes("string"))) {
-        this.declare(`declare ptr @scr_library_str_in(ptr, ${this.sizeType})`);
-      }
-      if (this.mod.lib.exports.some((e) => e.params.includes("bytes"))) {
-        this.declare(`declare ptr @scr_library_bytes_in(ptr, ${this.sizeType}, ptr)`);
-      }
-      if (this.mod.lib.exports.some((e) => e.params.includes("i64"))) {
-        this.declare(`declare double @scr_library_i64_in(i64, ptr)`);
-      }
-      if (this.mod.lib.exports.some((e) => e.params.includes("u64"))) {
-        this.declare(`declare double @scr_library_u64_in(i64, ptr)`);
-      }
-      if (this.mod.lib.exports.some((e) => e.returns === "string")) {
-        this.declare(`declare void @scr_library_str_out(ptr, ptr, ptr)`);
-      }
-      if (this.mod.lib.exports.some((e) => e.returns === "bytes")) {
-        this.declare(`declare void @scr_library_bytes_out(ptr, ptr, ptr)`);
-      }
-      if (this.mod.lib.exports.some((e) => e.params.includes("cstring"))) {
-        this.declare(`declare ptr @scr_library_cstr_in(ptr, ptr)`);
-      }
-      if (this.mod.lib.exports.some((e) => e.returns === "cstring")) {
-        this.declare(`declare ptr @scr_library_cstr_out(ptr)`);
-      }
-    }
-    // Helpers assemble BEFORE the declaration table flushes (they add
-    // write/abort declarations).
-    const helpers = [
-      ...this.helperDefs(),
-      ...emitArraySearchHelpers(this.arraySearchKinds, this.sizeType, (line) => this.declare(line)),
-      ...emitClassMembershipHelper(this.classMeta, this.sizeType),
-      ...(this.publishWalkersCache?.defs() ?? []),
-      ...this.publishedClassNamesDefs(),
-      ...(this.regions?.moduleDefs() ?? []),
-    ];
-    if (this.constantNumericTables.size > 0)
-      this.declare(`declare double @scr_arr_get_number(ptr, double)`);
-    // Native matchers of the regex literals inside the compiled subset.
-    const regexMatchers = new Map<string, RegexMatcherCode>();
-    for (const [key, re] of this.regexInstances) {
-      const code = compileRegexMatcher(
-        `${re.sym}_match`,
-        re.pattern,
-        re.flags,
-        this.sizeType,
-        !this.wasi,
-      );
-      if (code === null) continue;
-      regexMatchers.set(key, code);
-      for (const decl of code.decls) this.declare(decl);
-    }
-
-    const out: string[] = [
-      `; Generated by scriptc (LLVM backend) from ${this.mod.sourceFile}. Do not edit.`,
-      ``,
-      // Type shapes shared with the runtime's C ABI. ScrStr is the header
-      // prefix only (the flexible-array tail is concrete per literal);
-      // ScrLogArg is { i32 tag; 8-byte union } — i64 at offset 8 matches
-      // the C layout (4 bytes padding after the tag). ScrUnion/ScrClosure
-      // mirror scr_runtime.h field-for-field (tag reads, slot peeks, the
-      // fn pointer, and the caps[] tail all address through them).
-      `%ScrStr = type { ${this.sizeType}, ${this.sizeType}, ${this.sizeType} }`,
-      `%ScrLogArg = type { i32, i64 }`,
-      `%ScrVt = type { ${this.sizeType}, ${this.sizeType}, ptr }`,
-      `%ScrUnion = type { ${this.sizeType}, i32, ptr, ptr, ptr, i64 }`,
-      `%ScrClosure = type { ${this.sizeType}, ptr, ${this.sizeType}, ptr, i32, i32, ptr, ptr }`,
-      `%ScrFfiTable = type { ptr, ${this.sizeType}, ${this.sizeType}, ptr, i8, ptr, ptr, ${this.sizeType}, ${this.sizeType}, ${this.sizeType}, ptr, ptr }`,
-      `%ScrRegex = type { ${this.sizeType}, ptr, ptr, ptr, double, ptr, ptr, ptr }`,
-      // ScrArr mirrors scr_runtime.h field-for-field: { rc, len, cap, elem,
-      // cyc, spare, filled, ops, data, present, ext } (field numbers in
-      // SCR_ARR_FIELD), where filled bounds the hole-free prefix, ops points at the element type's constant RC descriptor
-      // (%ScrArrOps, SCR_ELEM_REF only) and ext at the out-of-line sparse,
-      // property and metadata storage (NULL until first used). Live dynamic
-      // stream commits swap its dense, presence and out-of-line storage while
-      // preserving the target object's identity.
-      `%ScrArr = type { ${this.sizeType}, ${this.sizeType}, ${this.sizeType}, i8, i8, i16, i32, ptr, ptr, ptr, ptr }`,
-      `%ScrArrOps = type { ptr, ptr, ptr }`,
-      // The ScrMap prefix { rc, key_kind, val_kind, traced } — the inline
-      // RC fast paths test the traced byte (shapes.ts).
-      ...(this.rcHelpers === null ? [] : [`%ScrMapRc = type { ${this.sizeType}, i8, i8, i8 }`]),
-      // The complete ScrMap and its { key, val, hash } entry, read by the
-      // inline number-key lookup (sc_map_entry_f64) and the inline
-      // iteration steps (sc_map_iter_entry): field 8 is the i32 entry
-      // count, field 10 the i64 absent-key filter, entries is field 11,
-      // nbuckets and buckets fields 13 and 14, the direct index and its i32
-      // length fields 15 and 16.
-      ...(this.decls.has(NUMBER_MAP_ENTRY_DECL) ||
-      this.decls.has(STRING_MAP_ENTRY_DECL) ||
-      this.decls.has(MAP_ITER_DECL)
-        ? [
-            `%ScrMapIx = type { ${this.sizeType}, i8, i8, i8, i8, i32, ptr, ptr, i32, i32, i64, ptr, i32, i32, ptr, ptr, i32, i32 }`,
-          ]
-        : []),
-      // String-keyed reference reads load the value slot of the entry
-      // scr_map_entry_str returns (map-number-lookup.ts).
-      ...(this.decls.has(NUMBER_MAP_ENTRY_DECL) ||
-      this.decls.has(STRING_MAP_ENTRY_DECL) ||
-      this.decls.has(MAP_ITER_DECL)
-        ? [`%ScrMapEntry = type { i64, i64, i64 }`]
-        : []),
-      // The runtime error prefix { rc, vt, name, message, code, cause } and the
-      // class-object shape { rc, pre, post, ctor, name } — field reads on
-      // builtin errors and classval loads GEP through these.
-      `%ScrError = type { ${this.sizeType}, ptr, ptr, ptr, ptr, ptr, i8, i8, i8, i8, i8, ptr, ptr }`,
-      `%ScrClassObj = type { ${this.sizeType}, ${this.sizeType}, ${this.sizeType}, ptr, ptr, ${this.sizeType}, ${this.sizeType}, ptr, ptr }`,
-      // The runtime emitter prefix { rc, vt, reg, cls } — user subclasses
-      // embed it (classes.ts), and bare-emitter GEPs address through it.
-      `%ScrEmitter = type { ${this.sizeType}, ptr, ptr, ptr }`,
-      // The runtime stream layout { rc, vt, reg, cls, st } — one struct
-      // for all five stream classes; stream subclasses embed it.
-      `%ScrStream = type { ${this.sizeType}, ptr, ptr, ptr, ptr }`,
-      // The EventTarget and Event subclass prefixes { rc, vt, state, cls }.
-      ...(this.classMeta.has(RUNTIME_EVENT_TARGET_CLASS)
-        ? [`%ScrEventTargetObj = type { ${this.sizeType}, ptr, ptr, ptr }`]
-        : []),
-      ...(this.classMeta.has(RUNTIME_EVENT_CLASS)
-        ? [`%ScrEventObj = type { ${this.sizeType}, ptr, ptr, ptr }`]
-        : []),
-      // The catch-binding snapshot box { rc, kind, f64, b, payload,
-      // retain_fn, release_fn, trace_fn } — caughtTest kind reads and
-      // caughtNarrow payload extraction GEP through it (offsets match
-      // scr_runtime.h's natural alignment: kind at 8, f64 at 16, b at 24,
-      // payload at 32).
-      `%ScrCaught = type { ${this.sizeType}, i32, double, i8, ptr, ptr, ptr, ptr }`,
-      // ScrBytes { rc, len, elem(i32+pad), data, backing, brands, shared }. Indexed
-      // typed-array access GEPs through this directly: the IR type already
-      // fixes elem, so the hot path needs neither a runtime kind load nor
-      // the generic scr_bytes_get/set call.
-      `%ScrBytes = type { ${this.sizeType}, ${this.sizeType}, i32, ptr, ptr, i8, i8, i8, i8, ptr }`,
-      // The capture box { rc, kind, obj_retain, obj_release, obj_trace,
-      // slot } — TDZ reads peek the payload slot (offset 40) directly.
-      `%ScrBox = type { ${this.sizeType}, i32, ptr, ptr, ptr, i64 }`,
-      // The stack buffer of the emitted JSON serializers { data, len, cap }.
-      `%ScrJsonBuf = type { ptr, ${this.sizeType}, ${this.sizeType}, ptr, ${this.sizeType}, ${this.sizeType} }`,
-      // The dynCheck error-path spine { parent, key, index } — the emitted
-      // builders stack-allocate one per recursion level (dyn.ts).
-      `%ScrDynPath = type { ptr, ptr, ${this.sizeType} }`,
-      `%ScrIslandModule = type { ptr, ptr, ${this.sizeType}, ${this.sizeType}, i32, ptr, ${this.sizeType}, ${this.sizeType} }`,
-      `%ScrIslandEdge = type { ptr, ptr, ptr, i32 }`,
-      // A generator's prefix { rc, receiver, fiber, state, out } and its
-      // value slot { kind, f64, b, payload, release_fn } (scr_async.c pins
-      // both): number and boolean yields and drives address OUT directly.
-      ...(this.usesGenSlots
-        ? [
-            `%ScrGenSlot = type { i32, double, i8, ptr, ptr }`,
-            `%ScrGenHead = type { ${this.sizeType}, ptr, ptr, i32, %ScrGenSlot }`,
-          ]
-        : []),
-    ];
-    for (const line of shapes.typeDefs) out.push(line);
-    for (const line of classShapes.typeDefs) out.push(line);
-    // Thread-instanced library state (abi.instance_per_thread): the
-    // program TU's mutable globals — module globals, run-once guards, the
-    // lazily-compiled regex literal caches — and the runtime globals its
-    // init stamps live in thread-local storage, matching the runtime
-    // objects compiled with -DSCR_THREAD_INSTANCES. Immutable interned
-    // data (string literals, unit arms, template arrays, vtables) stays
-    // shared.
-    const tl =
-      this.mod.workers === true || this.mod.lib?.threadInstances === true ? "thread_local " : "";
-    out.push(
-      ``,
-      `@scr_error_vts = external ${tl}global [${RUNTIME_ERROR_CLASSES.size} x %ScrVt]`,
-      `declare void @scr_init()`,
-      `declare void @scr_lib_init(i32, ptr)`,
-      ...(this.mod.workers ? [`declare void @scr_runtime_workers_v8()`] : []),
-      ...(this.stackChecks?.size ? [`declare void @scr_stack_guard_init()`] : []),
-      ...(this.runtimeAbiMarker && this.mod.lib === undefined
-        ? [`declare void @${RUNTIME_ABI_MARKER}()`]
-        : []),
-      // Overrides the runtime's weak default (scr_lib.c).
-      ...(this.detachedExit && this.mod.lib === undefined
-        ? [`@scr_detached_exit = constant i8 1`]
-        : []),
-    );
-    for (const d of this.decls) out.push(d);
-    out.push(``);
-    const flushedDecls = new Set(this.decls);
-    {
-      const tl =
-        this.mod.workers === true || this.mod.lib?.threadInstances === true ? "thread_local " : "";
-      out.push(...threadSlotsBlockDefinitions(this.threadSlotsBlocks, tl !== ""));
-      for (let site = 0; site < this.dynReadIcSites; site++)
-        out.push(
-          `@sc_dyn_read_ic_${site} = internal ${tl}global { ptr, ${this.sizeType}, ${this.sizeType}, ptr } zeroinitializer`,
-        );
-    }
-    for (const table of this.constantNumericTables.values()) {
-      const n = table.values.length;
-      let tableTmp = 0;
-      const tableIndex = exactIndexLines("%i", String(n), "i64", () => `%ix${tableTmp++}`);
-      out.push(
-        `@${table.symbol} = private constant [${n} x double] [${table.values.map((v) => `double ${f64Lit(v)}`).join(", ")}]`,
-        `define internal double @${table.symbol}_get(ptr %a, double %i) alwaysinline #0 {`,
-        `entry:`,
-        `  %initialized = icmp ne ptr %a, null`,
-        ...tableIndex.lines.map((line) => `  ${line}`),
-        `  %safe = and i1 %initialized, ${tableIndex.ok}`,
-        `  br i1 %safe, label %read, label %fallback`,
-        `read:`,
-        `  %slot = getelementptr inbounds [${n} x double], ptr @${table.symbol}, i64 0, i64 ${tableIndex.wide}`,
-        `  %value = load double, ptr %slot`,
-        `  ret double %value`,
-        `fallback:`,
-        `  %generic = call double @scr_arr_get_number(ptr %a, double %i)`,
-        `  ret double %generic`,
-        `}`,
-        ``,
-      );
-    }
-    for (const [text, lit] of this.literals) {
-      // Immortal interned ScrStr: { rc = SIZE_MAX, len, cap = len, bytes\0 } —
-      // the runtime ABI’s static table, retain/release skip rc == SIZE_MAX.
-      // 64-bit (little-endian) targets split the capacity word: the high
-      // half carries the precomputed Map key hash (SCR_STR_HASH_CACHE).
-      // Bit 31 marks all-ASCII literals (SCR_STR_ASCII_BIT) on every target.
-      const capWord =
-        this.sizeType === "i64"
-          ? literalCapWord(wtf8Bytes(text))
-          : literalCapWord32(wtf8Bytes(text));
-      out.push(
-        `@${lit.sym} = internal global { ${this.sizeType}, ${this.sizeType}, ${this.sizeType}, [${lit.len + 1} x i8] } ` +
-          `{ ${this.sizeType} -1, ${this.sizeType} ${lit.len}, ${this.sizeType} ${capWord}, [${lit.len + 1} x i8] c"${llStrBytes(text)}" }`,
-      );
-    }
-    if (this.literals.size > 0) out.push(``);
-    for (const lit of this.bigintLiterals.values()) {
-      // Immortal ScrBigInt: { rc = SIZE_MAX, len, sign, cap, limbs } with
-      // pointer-sized little-endian limbs (scr_bigint.c); zero keeps one
-      // zero limb so limb 0 is always readable.
-      const size = this.sizeType;
-      const limbBits = size === "i64" ? 64n : 32n;
-      const mask = (1n << limbBits) - 1n;
-      const limbs: string[] = [];
-      for (let m = lit.value < 0n ? -lit.value : lit.value; m > 0n; m = m >> limbBits) {
-        limbs.push(`${size} ${m & mask}`);
-      }
-      const len = limbs.length;
-      if (len === 0) limbs.push(`${size} 0`);
-      const sign = lit.value < 0n ? -1 : lit.value > 0n ? 1 : 0;
-      out.push(
-        `@${lit.sym} = internal global { ${size}, ${size}, i32, i32, [${limbs.length} x ${size}] } ` +
-          `{ ${size} -1, ${size} ${len}, i32 ${sign}, i32 ${limbs.length}, [${limbs.length} x ${size}] [${limbs.join(", ")}] }`,
-      );
-    }
-    if (this.bigintLiterals.size > 0) out.push(``);
-    for (const [key, sym] of this.unitInstances) {
-      // One immortal instance per unit-armed (union, tag): tag set, payload
-      // slot and RC entry points zero — retain/release/collector all skip
-      // rc == SIZE_MAX, so these never join the RC audit or a trace walk.
-      const [unionId, tag] = key.split(":");
-      out.push(
-        `@${sym} = internal global %ScrUnion { ${this.sizeType} -1, i32 ${tag}, ptr null, ptr null, ptr null, i64 0 } ; ${unionId} unit arm`,
-      );
-    }
-    if (this.unitInstances.size > 0) out.push(``);
-    for (const [unionId, sym] of this.retypeGuards) {
-      // Thread-local like module globals: a thread's cast caches hold only
-      // its own boxes. Never written, the flag folds to false.
-      out.push(`@${sym} = internal ${tl}global i8 0 ; ${unionId} boxes in a cast cache`);
-    }
-    if (this.retypeGuards.size > 0) out.push(``);
-    for (const [unionId, sym] of this.absentInstances) {
-      // One immortal ABSENT field-slot instance per undefined-armed union:
-      // the undefined arm's tag with payload 1 (ordinary unit instances
-      // carry 0). Every tag reader sees undefined; recordHas and the
-      // field reads compare tag and payload, never the address, so the
-      // per-object copies of separately compiled units agree.
-      const tag = undefinedArmTag({ kind: "union", unionId }, this.unionsById);
-      out.push(
-        `@${sym} = internal global %ScrUnion { ${this.sizeType} -1, i32 ${tag}, ptr null, ptr null, ptr null, i64 ${ABSENT_FIELD_PAYLOAD} } ; ${unionId} absent field`,
-      );
-    }
-    if (this.absentInstances.size > 0) out.push(``);
-    if (this.needsUnionNone)
-      out.push(
-        `@sc_union_none = internal constant %ScrUnion zeroinitializer ; NULL union dummy read by inline stores`,
-        ``,
-      );
-    if (this.nullableUnions.usesNullSentinel) {
-      // `null` in every `C | null | undefined` union (NULL is undefined):
-      // one module-scope immortal object like the ABSENT sentinel.
-      const S = this.sizeType;
-      out.push(
-        `${NULLABLE_NULL} = internal global { ${S}, ${S}, ${S}, ${S} } { ${S} -1, ${S} 0, ${S} 0, ${S} 0 } ; nullable null arm`,
-        ``,
-      );
-    }
-    if (this.needsNullableAbsent) {
-      // The ABSENT field-slot state of every nullable-pointer union: one
-      // module-scope immortal object (rc == SIZE_MAX), distinct from NULL
-      // (undefined) and from every instance. RC entry points and the
-      // collector skip it like any immortal; field reads compare its address.
-      const S = this.sizeType;
-      out.push(
-        `${NULLABLE_ABSENT} = internal global { ${S}, ${S}, ${S}, ${S} } { ${S} -1, ${S} 0, ${S} 0, ${S} 0 } ; nullable absent field`,
-        ``,
-      );
-    }
-    for (const [key, re] of this.regexInstances) {
-      // One immortal ScrRegex per (pattern, flags) literal, pointing at
-      // the interned source/flags strings. The bc and translated-program
-      // slots start null (lazy compile, cached by the runtime) — a mutable
-      // global, not constant. The last slot is the build-time matcher.
-      const matcher = regexMatchers.has(key) ? `@${re.sym}_match` : "null";
-      out.push(
-        `@${re.sym} = internal ${tl}global %ScrRegex { ${this.sizeType} -1, ptr ${re.src}, ptr ${re.fl}, ptr null, double 0.0, ptr null, ptr null, ptr ${matcher} } ; ${key.replace(/\n/g, "\\n")}`,
-      );
-    }
-    if (this.regexInstances.size > 0) out.push(``);
-    for (const code of regexMatchers.values()) out.push(...code.lines, ``);
-    for (const [, inst] of this.templateStringsInstances) {
-      // One immortal ScrArr per tagged-template site: a [N x ptr] data
-      // global of interned cooked-string literals, and the ScrArr header
-      // over it (rc == SIZE_MAX, len == cap == filled, SCR_ELEM_STR = 2,
-      // no REF entry points). Every dense slot is present; reads retain
-      // immortal strings — a no-op.
-      const n = inst.slots.length;
-      const present =
-        n === 0 ? "zeroinitializer" : `[ ${inst.slots.map(() => "i8 1").join(", ")} ]`;
-      out.push(
-        `@${inst.sym}_data = internal constant [${n} x ptr] [ ${inst.slots.map((s) => `ptr ${s}`).join(", ")} ]`,
-        `@${inst.sym}_present = internal constant [${n} x i8] ${present}`,
-        `@${inst.sym} = internal global %ScrArr { ${this.sizeType} -1, ${this.sizeType} ${n}, ${this.sizeType} ${n}, i8 2, i8 0, i16 0, i32 ${n}, ptr null, ptr @${inst.sym}_data, ptr @${inst.sym}_present, ptr null }`,
-      );
-    }
-    if (this.templateStringsInstances.size > 0) out.push(``);
-    for (const [text, c] of this.cstrs) {
-      // NUL-terminated byte-array constants for scr_jb_puts and indentation.
-      out.push(`@${c.sym} = internal constant [${c.len + 1} x i8] c"${llStrBytes(text)}"`);
-    }
-    if (this.cstrs.size > 0) out.push(``);
-    for (const [body, sym] of this.mapOpsConsts) {
-      out.push(`@${sym} = internal constant { ptr, ptr, ptr, ptr, ptr, ptr, ptr } { ${body} }`);
-    }
-    if (this.mapOpsConsts.size > 0) out.push(``);
-
-    for (const line of ffiCallbacks.globals) out.push(line);
-    if (ffiCallbacks.globals.length > 0) out.push(``);
-    for (const g of globals) {
-      const ty = this.llType(g.type);
-      const zero = ty === "double" ? f64Lit(0) : ty === "ptr" ? "null" : "false";
-      const debug = this.debug?.global(g);
-      out.push(
-        `@${mangleGlobal(g.id)} = internal ${tl}global ${ty} ${zero}${debug ? `, !dbg ${debug}` : ""} ; ${g.name}`,
-      );
-    }
-    if (globals.length > 0) out.push(``);
-    for (const line of helpers) out.push(line);
-    for (const line of ffiCallbacks.defs) out.push(line);
-    for (const line of shapes.defs) out.push(line);
-    for (const line of classShapes.defs) out.push(line);
-    for (const line of classObjDefs) out.push(line);
-    for (const line of this.walkers.defs) out.push(line);
-    for (const line of this.dyn.defs) out.push(line);
-    for (const line of wrappers) out.push(line);
-    for (const line of asyncDefs) out.push(line);
-    for (const line of this.resolveThunkDefs) out.push(line);
-    out.push(fnDefs[0] ?? "");
-    for (let i = 1; i < fnDefs.length; i++) out.push("", fnDefs[i]!);
-    out.push("");
-
-    // main(): scr_init, the program-dependent error-vt interval stamps,
-    // scr_lib_init(argc, argv), then the entry function. An uncaught
-    // exception escaping top-level code prints and exits 1 (Node).
-    // The exception epilogue is emitted when the entry may throw.
-    const stamps: string[] = [...errorViews];
-    for (const iv of this.errorIntervals) {
-      const fields: [number, number][] = [
-        [0, iv.pre],
-        [1, iv.post],
-      ];
-      for (const [field, value] of fields) {
-        stamps.push(
-          `  store ${this.sizeType} ${value}, ptr getelementptr inbounds ([${RUNTIME_ERROR_CLASSES.size} x %ScrVt], ptr @scr_error_vts, i64 0, i64 ${iv.kind}, i32 ${field})${field === 1 ? ` ; ${iv.lib}` : ""}`,
-        );
-      }
-    }
-    if (this.emitterInterval !== null) {
-      // The runtime emitter vtable's interval (emitterVtStampLines): bare
-      // EventEmitter instances answer instanceof and dispatch dynamic
-      // teardown under THIS module's preorder numbering.
-      out.push(`@scr_emitter_vt = external ${tl}global %ScrVt`, ``);
-      stamps.push(
-        `  store ${this.sizeType} ${this.emitterInterval.pre}, ptr getelementptr inbounds (%ScrVt, ptr @scr_emitter_vt, i64 0, i32 0)`,
-        `  store ${this.sizeType} ${this.emitterInterval.post}, ptr getelementptr inbounds (%ScrVt, ptr @scr_emitter_vt, i64 0, i32 1) ; EventEmitter`,
-      );
-    }
-    for (const iv of this.streamIntervals) {
-      // The runtime stream vtables' intervals (streamVtStampLines) — the
-      // emitter story: instanceof and dynamic teardown dispatch through
-      // them.
-      out.push(`@${iv.vt} = external ${tl}global %ScrVt`);
-      stamps.push(
-        `  store ${this.sizeType} ${iv.pre}, ptr getelementptr inbounds (%ScrVt, ptr @${iv.vt}, i64 0, i32 0)`,
-        `  store ${this.sizeType} ${iv.post}, ptr getelementptr inbounds (%ScrVt, ptr @${iv.vt}, i64 0, i32 1) ; ${iv.lib}`,
-      );
-    }
-    if (this.streamIntervals.length > 0) out.push(``);
-    if ([...this.literals.keys(), ...this.cstrs.keys()].some(hasLoneSurrogate)) {
-      // The runtime skips surrogate work until a lone surrogate may exist
-      // (scr_wtf8_any); its own producers note one, and literals do here.
-      out.push(`declare void @scr_wtf8_note()`, ``);
-      stamps.push(`  call void @scr_wtf8_note()`);
-    }
-    if (this.errorIntervals.length > 0 && this.tracedShapes.has("object:%Error")) {
-      // The cycle fixpoint marked the Error hierarchy (a user subclass
-      // holds cycle-capable fields — capability is hierarchy-uniform), so
-      // the runtime's own error allocations need collector headers too.
-      // Declared inline: the extern block already flushed (LLVM is
-      // order-free, the helper-defs precedent).
-      out.push(`declare void @scr_error_set_traced()`, ``);
-      stamps.push(`  call void @scr_error_set_traced()`);
-    }
-    if ((entryMayThrow || runsLoop) && this.mod.lib === undefined) {
-      // Declared inline: the extern block already flushed (LLVM is
-      // order-free — the scr_error_set_traced precedent). Only the
-      // printer emits here (nothing else declares it); scr_exc_pending
-      // and the loop entry points rode the Set before the flush.
-      out.push(
-        `declare void @scr_exc_print_uncaught()`,
-        `declare zeroext i1 @scr_exc_handle_uncaught(i1 zeroext)`,
-        ``,
-      );
-    }
-    if (this.mod.lib !== undefined) {
-      // LIBRARY mode: no @main — the profile-declared external
-      // symbols specified by the library IR instead.
-      for (const line of this.emitLibDefs(globals, globalReleaseLines, stamps)) out.push(line);
-      out.push(...this.inlineRcTail(flushedDecls));
-      out.push(`attributes #0 = { sanitize_address }`);
-      if (this.usesCoroutines) out.push(`attributes #1 = { sanitize_address presplitcoroutine }`);
-      if (hasNoInlineRecordClone) out.push(`attributes #2 = { noinline sanitize_address }`);
-      out.push(``);
-      out.push(...this.fieldAliasMetadata());
-      if (this.debug !== null) out.push(this.debug.render());
-      return out;
-    }
-    out.push(
-      `define i32 @${this.mod.workers ? "sc_context_entry" : this.wasi ? "__main_argc_argv" : "main"}(i32 %argc, ptr %argv) ${FN_ATTRS} {`,
-      `entry:`,
-      ...(this.runtimeAbiMarker ? [`  call void @${RUNTIME_ABI_MARKER}()`] : []),
-      ...(this.mod.workers ? [`  call void @scr_runtime_workers_v8()`] : []),
-      `  call void @scr_init()`,
-      // Each context (the main thread, every worker) installs its stack
-      // guard before running compiled code that checks it.
-      ...(this.stackChecks?.size ? [`  call void @scr_stack_guard_init()`] : []),
-      ...stamps,
-      // Event-surface programs (signal/exit listeners) fill the loop's
-      // nullable event hooks before %main — scr_events.c links only when
-      // this line is emitted (native/executable.ts gates on the same predicate).
-      ...(usesEvents ? [`  call void @scr_events_install()`] : []),
-      ...(usesChildProcess ? [`  call void @scr_child_dyn_install()`] : []),
-      ...(childStreamBoxes
-        ? [
-            `  call void @scr_child_dyn_streams_install(ptr @scr_stream_child_ops, ptr @${childStreamBoxes[0]}, ptr @${childStreamBoxes[1]})`,
-          ]
-        : []),
-      ...(workerStdioBox || workerStdinBox
-        ? [
-            `  call void @scr_worker_stdio_install(ptr @scr_stream_child_ops, ptr ${workerStdioBox ? `@${workerStdioBox}` : "null"}, ptr ${workerStdinBox ? `@${workerStdinBox}` : "null"})`,
-          ]
-        : []),
-      // fs.watch programs fill the loop's watch hooks the same way —
-      // scr_watch.c links only when this line is emitted.
-      ...(usesFsWatch ? [`  call void @scr_watch_install()`] : []),
-      ...(this.ffiHasForeignCallback ? [`  call void @scr_ffi_install()`] : []),
-      ...(snapshotsTlsCa ? [`  call void @scr_tls_ca_install()`] : []),
-      ...(usesFetch ? [`  call void @scr_fetch_install()`] : []),
-      ...(usesNet ? [`  call void @scr_net_install()`, `  call void @scr_net_dyn_install()`] : []),
-      ...(usesHttp ? [`  call void @scr_http_dyn_install()`] : []),
-      ...(usesDgram ? [`  call void @scr_dgram_install()`] : []),
-      ...(usesHttp2 ? [`  call void @scr_http2_dyn_install()`] : []),
-      ...(usesStream ? [`  call void @scr_stream_install()`] : []),
-      `  call void @scr_lib_init(i32 %argc, ptr %argv)`,
-      // node:test takes Node's --test-update-snapshots out of argv first.
-      ...(usesNodeTest ? [`  call void @scr_test_init()`] : []),
-      ...(asyncEntry
-        ? [`  %top = call ptr @${mangleAsyncSpawn(this.mod.entry)}()`]
-        : [`  call void @${mangleFunction(this.mod.entry)}()`]),
-      // Uncaught exception from top-level code: Node exits 1.
-      ...(entryMayThrow && !asyncEntry
-        ? [
-            `  %exc = call zeroext i1 @scr_exc_pending()`,
-            `  br i1 %exc, label %uncaught, label %ok`,
-            `uncaught:`,
-            `  %handled = call zeroext i1 @scr_exc_handle_uncaught(i1 false)`,
-            `  br i1 %handled, label %ok, label %fatal`,
-            `fatal:`,
-            `  call void @scr_exc_print_uncaught()`,
-            ...exitListenerLines("xu"),
-            ...uncaughtReleases,
-            `  %failure_code_0 = call i32 @scr_exit_code_hint_get()`,
-            `  ret i32 %failure_code_0`,
-            `ok:`,
-          ]
-        : []),
-      // The event loop runs to exhaustion (microtasks before timers). A
-      // throw escaping a timer callback and unhandled promise rejections
-      // both exit 1, like Node — the C main's loop block exactly.
-      ...(runsLoop
-        ? [
-            ...(this.mod.commonJsEntry === true ? [`  call void @scr_loop_commonjs_entry()`] : []),
-            `  %loop_rejection = call zeroext i1 @scr_loop_run(ptr ${asyncEntry ? "%top" : "null"})`,
-            `  %lexc = call zeroext i1 @scr_exc_pending()`,
-            `  br i1 %lexc, label %luncaught, label %lok`,
-            `luncaught:`,
-            `  call void @scr_exc_print_uncaught()`,
-            ...(asyncEntry ? [`  call void @scr_promise_release(ptr %top)`] : []),
-            ...exitListenerLines("xl"),
-            ...loopReleasesU,
-            `  %failure_code_1 = call i32 @scr_exit_code_hint_get()`,
-            `  ret i32 %failure_code_1`,
-            `lok:`,
-            `  br i1 %loop_rejection, label %lreported, label %lclean`,
-            `lreported:`,
-            `  call void @scr_discard_unhandled_rejections()`,
-            ...(asyncEntry ? [`  call void @scr_promise_release(ptr %top)`] : []),
-            ...exitListenerLines("xq"),
-            ...loopReportedReleases,
-            `  %failure_code_2 = call i32 @scr_exit_code_hint_get()`,
-            `  ret i32 %failure_code_2`,
-            `lclean:`,
-            ...(asyncEntry
-              ? [
-                  `  %tla_status = call i32 @scr_promise_finish_top_level(ptr %top)`,
-                  `  %tla_rejected = icmp eq i32 %tla_status, 1`,
-                  `  br i1 %tla_rejected, label %tla_fail, label %tla_not_rejected`,
-                  `tla_fail:`,
-                  // The loop already delivered every earlier-checkpoint
-                  // rejection. Drop same-checkpoint competitors before
-                  // surfacing the fatal module verdict.
-                  `  call void @scr_discard_unhandled_rejections()`,
-                  `  call void @scr_promise_rethrow_top_level(ptr %top)`,
-                  `  call void @scr_promise_release(ptr %top)`,
-                  `  call void @scr_exc_print_uncaught()`,
-                  ...exitListenerLines("xt"),
-                  ...topRejectReleases,
-                  `  %failure_code_3 = call i32 @scr_exit_code_hint_get()`,
-                  `  ret i32 %failure_code_3`,
-                  `tla_not_rejected:`,
-                  `  call void @scr_promise_release(ptr %top)`,
-                ]
-              : []),
-            `  %rej = call zeroext i1 @scr_report_unhandled_rejections()`,
-            `  br i1 %rej, label %lrej, label %lrok`,
-            `lrej:`,
-            ...exitListenerLines("xr"),
-            ...loopReleasesR,
-            `  %failure_code_4 = call i32 @scr_exit_code_hint_get()`,
-            `  ret i32 %failure_code_4`,
-            `lrok:`,
-            ...(asyncEntry
-              ? [
-                  `  %tla_pending = icmp eq i32 %tla_status, 13`,
-                  `  br i1 %tla_pending, label %tla_stuck, label %tla_ok`,
-                  `tla_stuck:`,
-                  ...topPendingExitLines(),
-                  `tla_ok:`,
-                ]
-              : []),
-          ]
-        : []),
-      ...exitListenerLines("xn"),
-      ...globalReleases,
-      ...(usesNodeTest
-        ? [`  %test_exit = call i32 @scr_test_exit_code()`, `  ret i32 %test_exit`]
-        : [`  %native_exit = call i32 @scr_exit_code_hint_get()`, `  ret i32 %native_exit`]),
-      `}`,
-      ``,
-      ...this.inlineRcTail(flushedDecls),
-      // sanitize_address is inert under the plain pipeline; the sanitized
-      // lane's -fsanitize=address link activates instrumentation over the
-      // emitted functions too (the runtime TUs get theirs from clang).
-      `attributes #0 = { sanitize_address }`,
-      ...(this.usesCoroutines ? [`attributes #1 = { sanitize_address presplitcoroutine }`] : []),
-      ...(hasNoInlineRecordClone ? [`attributes #2 = { noinline sanitize_address }`] : []),
-      ``,
-    );
-    if (this.mod.workers) {
-      out.push(
-        `declare void @scr_context_cleanup()`,
-        `declare i32 @scr_worker_argc()`,
-        `declare ptr @scr_worker_argv()`,
-        `define i32 @sc_worker_entry(i32 %root) ${FN_ATTRS} {`,
-        `entry:`,
-        `  %argc = call i32 @scr_worker_argc()`,
-        `  %argv = call ptr @scr_worker_argv()`,
-        `  %result = call i32 @sc_context_entry(i32 %argc, ptr %argv)`,
-        `  ret i32 %result`,
-        `}`,
-        `define i32 @main(i32 %argc, ptr %argv) ${FN_ATTRS} {`,
-        `entry:`,
-        `  %result = call i32 @sc_context_entry(i32 %argc, ptr %argv)`,
-        `  call void @scr_context_cleanup()`,
-        `  ret i32 %result`,
-        `}`,
-      );
-    }
-    out.push(...this.fieldAliasMetadata());
-    if (this.debug !== null) out.push(this.debug.render());
-    return out;
+  emitModuleParts(): string[] {
+    return emitModuleParts(this);
   }
-
-  /** LIBRARY mode: the profile-declared external definitions — the
-   * export-map wrappers plus init / sink-registration / reset / collect.
-   * Plain `define` (not `define internal`) — the exact linkage distinction
-   * that separates the executable lane's @main from everything else. The
-   * bodies delegate every runtime half to scr_library.c, mirroring the C
-   * emission line for line, so the two lanes are identical by
-   * construction. */
-  private emitLibDefs(
+  emitLibDefs(
     globals: IrGlobal[],
     globalReleaseLines: (prefix: string) => string[],
     stamps: string[],
   ): string[] {
-    const lib = this.mod.lib!;
-    const autoReset = lib.resultResetSymbol === null;
-    const out: string[] = [``, `; ── library-mode entries (profile: ${lib.profileName}) ──`, ``];
-    // Every entry's prologue records its external symbol in the funnel's
-    // current-entry slot (structured trap-teaching field 2); the symbols
-    // live as internal constants, one per entry.
-    const symConst = (sym: string): string => `@sc_lib_sym_${sym}`;
-    const emitSymConst = (sym: string): void => {
-      out.push(
-        `${symConst(sym)} = internal constant [${Buffer.byteLength(sym, "utf8") + 1} x i8] c"${llStrBytes(sym)}"`,
-      );
-    };
-    emitSymConst(lib.initSymbol);
-    emitSymConst(lib.sinkRegisterSymbol);
-    if (lib.callbackRegisterSymbol !== null && lib.callbackRegisterSymbol !== undefined)
-      emitSymConst(lib.callbackRegisterSymbol);
-    if (lib.resultResetSymbol !== null) emitSymConst(lib.resultResetSymbol);
-    if (lib.collectSymbol !== null) emitSymConst(lib.collectSymbol);
-    for (const e of lib.exports) emitSymConst(e.symbol);
-    out.push(``);
-    if (this.wasi) {
-      for (const symbol of ["scriptc_alloc", "scriptc_free"]) emitSymConst(symbol);
-      out.push(
-        `define ptr @scriptc_alloc(i32 %size) ${FN_ATTRS} {`,
-        `entry:`,
-        `  call void @scr_library_entry(i1 zeroext false, ptr ${symConst("scriptc_alloc")})`,
-        `  %p = call ptr @malloc(i32 %size)`,
-        `  ret ptr %p`,
-        `}`,
-        ``,
-        `define void @scriptc_free(ptr %p) ${FN_ATTRS} {`,
-        `entry:`,
-        `  call void @scr_library_entry(i1 zeroext false, ptr ${symConst("scriptc_free")})`,
-        `  call void @free(ptr %p)`,
-        `  ret void`,
-        `}`,
-        ``,
-      );
-    }
-    // The runtime detected-trap overlay table (scr_runtime.h declares it,
-    // the library trap funnel consults it): flat code/teaching/remediation
-    // triples, one per runtime trap code (SC4013–SC4019) the profile
-    // declares text for. The funnel assembles the structured sink message.
-    // The empty table still defines the symbols the funnel links against.
-    const ovlCells: string[] = [];
-    lib.trapOverlays.forEach((o, i) => {
-      const cell = (name: string, text: string | undefined): void => {
-        if (text === undefined) {
-          ovlCells.push("ptr null");
-          return;
-        }
-        const sym = `@sc_lib_ovl_${i}_${name}`;
-        out.push(
-          `${sym} = internal constant [${Buffer.byteLength(text, "utf8") + 1} x i8] c"${llStrBytes(text)}"`,
-        );
-        ovlCells.push(`ptr ${sym}`);
-      };
-      cell("code", o.code);
-      cell("teach", o.teaching);
-      cell("rem", o.remediation);
-    });
-    out.push(
-      ovlCells.length === 0
-        ? `@scr_library_trap_overlays = constant [1 x ptr] zeroinitializer`
-        : `@scr_library_trap_overlays = constant [${ovlCells.length} x ptr] [${ovlCells.join(", ")}]`,
-      `@scr_library_trap_overlays_len = constant ${this.sizeType} ${lib.trapOverlays.length}`,
-      ``,
-    );
-    // The init entry: full deterministic reset-and-reevaluate. Program
-    // globals release and zero first (run-once guards included), then the
-    // runtime session reset, the error-vt interval stamps verbatim from
-    // the executable main, %main itself, and the escaped-exception check.
-    const zeroStores = globals.map((g) => {
-      const ty = this.llType(g.type);
-      const zero = ty === "double" ? f64Lit(0) : ty === "ptr" ? "null" : "false";
-      return `  store ${ty} ${zero}, ptr @${mangleGlobal(g.id)} ; ${g.name}`;
-    });
-    out.push(
-      `define void @${lib.initSymbol}() ${FN_ATTRS} {`,
-      `entry:`,
-      `  call void @scr_library_entry(i1 zeroext true, ptr ${symConst(lib.initSymbol)}) ; init always resets the result arena`,
-      ...globalReleaseLines("ci"),
-      ...zeroStores,
-      `  call void @scr_library_reset()`,
-      ...stamps,
-      `  call void @${mangleFunction(this.mod.entry)}()`,
-      `  call void @scr_library_check_exc()`,
-      `  ret void`,
-      `}`,
-      ``,
-      `define void @${lib.sinkRegisterSymbol}(ptr %fn, ptr %ctx) ${FN_ATTRS} {`,
-      `entry:`,
-      `  call void @scr_library_callback_entry_guard(ptr ${symConst(lib.sinkRegisterSymbol)})`,
-      `  call void @scr_library_set_sink(ptr %fn, ptr %ctx)`,
-      `  ret void`,
-      `}`,
-      ``,
-    );
-    if (lib.callbacks !== undefined && lib.callbacks.length > 0) {
-      // Host-callback channels: the per-channel name constants (the
-      // registration dispatch's strcmp operands), the per-channel
-      // unregistered-call trap constants (the ffiCall sites'
-      // scr_library_cb_require operands), and the registration function:
-      // a pure store dispatch
-      // (the sink registration's rule — no entry prologue, no poison
-      // guard) whose first operation rejects callback-time re-entry
-      // (SC4026). An unknown or NULL name is a defined -1, never a store.
-      for (const cb of lib.callbacks) {
-        out.push(
-          `@sc_lib_cb_name_${cb.slot} = internal constant [${Buffer.byteLength(cb.name, "utf8") + 1} x i8] c"${llStrBytes(cb.name)}"`,
-          `@sc_lib_cb_trap_${cb.slot} = internal constant [${Buffer.byteLength(cb.unregisteredTrap, "utf8") + 1} x i8] c"${llStrBytes(cb.unregisteredTrap)}"`,
-        );
-      }
-      out.push(
-        ``,
-        `define i32 @${lib.callbackRegisterSymbol}(ptr %name, ptr %fn, ptr %ctx) ${FN_ATTRS} {`,
-        `entry:`,
-        `  call void @scr_library_callback_entry_guard(ptr ${symConst(lib.callbackRegisterSymbol!)})`,
-        `  %isnull = icmp eq ptr %name, null`,
-        `  br i1 %isnull, label %miss, label %try0`,
-      );
-      lib.callbacks.forEach((cb, i) => {
-        const next = i + 1 < lib.callbacks!.length ? `try${i + 1}` : "miss";
-        out.push(
-          `try${i}: ; channel '${cb.name}'`,
-          `  %cmp${i} = call i32 @strcmp(ptr %name, ptr @sc_lib_cb_name_${cb.slot})`,
-          `  %eq${i} = icmp eq i32 %cmp${i}, 0`,
-          `  br i1 %eq${i}, label %set${i}, label %${next}`,
-          `set${i}:`,
-          `  call void @scr_library_cb_set(${this.sizeType} ${cb.slot}, ptr %fn, ptr %ctx)`,
-          `  ret i32 0`,
-        );
-      });
-      out.push(`miss:`, `  ret i32 -1`, `}`, ``);
-    }
-    if (lib.identity !== undefined && this.emitLibraryIdentity) {
-      // Profile-declared identity getters (the ask-2 sidecar's boot-time
-      // pairing fence): pure data returns with NO entry prologue — exempt
-      // from the poisoned guard and every runtime touch (ratified), so a
-      // host can read them before init and after a trap. The u64 rides
-      // i64 two's-complement (LLVM integer constants are signed).
-      for (const line of emitLibraryIdentityLines(lib.identity, FN_ATTRS)) out.push(line);
-    }
-    if (lib.resultResetSymbol !== null) {
-      out.push(
-        `define void @${lib.resultResetSymbol}() ${FN_ATTRS} {`,
-        `entry:`,
-        `  call void @scr_library_entry(i1 zeroext false, ptr ${symConst(lib.resultResetSymbol)})`,
-        `  call void @scr_library_arena_reset()`,
-        `  ret void`,
-        `}`,
-        ``,
-      );
-    }
-    if (lib.collectSymbol !== null) {
-      out.push(
-        `define void @${lib.collectSymbol}() ${FN_ATTRS} {`,
-        `entry:`,
-        `  call void @scr_library_entry(i1 zeroext false, ptr ${symConst(lib.collectSymbol)})`,
-        `  call void @scr_library_collect() ; arena reset + a full cycle collection`,
-        `  ret void`,
-        `}`,
-        ``,
-      );
-    }
-    for (const e of lib.exports) {
-      const params: string[] = [];
-      const body: string[] = [
-        `  call void @scr_library_entry(i1 zeroext ${autoReset ? "true" : "false"}, ptr ${symConst(e.symbol)})`,
-      ];
-      const args: string[] = [];
-      if (e.inboundBytesTrap !== undefined) {
-        // The bytes-in helper's trap message: the compiler-assembled
-        // structured trap-teaching form (0x01 text 0x1F SC4012 0x1F symbol
-        // [0x1F remediation]) consumed by the runtime sink.
-        const trapBytes = Buffer.byteLength(e.inboundBytesTrap, "utf8");
-        out.push(
-          `@sc_lib_bytes_trap_${e.symbol} = internal constant [${trapBytes + 1} x i8] c"${llStrBytes(e.inboundBytesTrap)}"`,
-          ``,
-        );
-      }
-      if (e.inboundIntTrap !== undefined) {
-        // The i64/u64-in helpers' host-contract trap message (ask 4): an
-        // inbound integer past ±(2^53−1) cannot ride f64 exactly. Same
-        // assembled structured form, same SC4012 code, same
-        // emission-invariance argument as the bytes trap.
-        const trapBytes = Buffer.byteLength(e.inboundIntTrap, "utf8");
-        out.push(
-          `@sc_lib_int_trap_${e.symbol} = internal constant [${trapBytes + 1} x i8] c"${llStrBytes(e.inboundIntTrap)}"`,
-          ``,
-        );
-      }
-      if (e.inboundCstringTrap !== undefined) {
-        // The cstring-in helper's host-contract trap message (a NULL
-        // `const char *`): same assembled structured form and SC4012 code.
-        const trapBytes = Buffer.byteLength(e.inboundCstringTrap, "utf8");
-        out.push(
-          `@sc_lib_cstr_trap_${e.symbol} = internal constant [${trapBytes + 1} x i8] c"${llStrBytes(e.inboundCstringTrap)}"`,
-          ``,
-        );
-      }
-      e.params.forEach((cls, i) => {
-        switch (cls) {
-          case "f64":
-            params.push(`double %a${i}`);
-            args.push(`double %a${i}`);
-            break;
-          case "bool":
-            params.push(`i8 %a${i}`);
-            body.push(`  %c${i} = icmp ne i8 %a${i}, 0`);
-            args.push(`i1 %c${i}`);
-            break;
-          case "u8":
-            params.push(`i8 %a${i}`);
-            body.push(`  %c${i} = uitofp i8 %a${i} to double`);
-            args.push(`double %c${i}`);
-            break;
-          case "u32":
-            params.push(`i32 %a${i}`);
-            body.push(`  %c${i} = uitofp i32 %a${i} to double`);
-            args.push(`double %c${i}`);
-            break;
-          case "i32":
-            params.push(`i32 %a${i}`);
-            body.push(`  %c${i} = sitofp i32 %a${i} to double`);
-            args.push(`double %c${i}`);
-            break;
-          case "i64":
-            // Inbound declared-integer edge (ask 4): the helper converts
-            // exactly or delivers the host-contract trap (past ±(2^53−1)
-            // the value cannot ride f64 without rounding).
-            params.push(`i64 %a${i}`);
-            body.push(
-              `  %c${i} = call double @scr_library_i64_in(i64 %a${i}, ptr @sc_lib_int_trap_${e.symbol})`,
-            );
-            args.push(`double %c${i}`);
-            break;
-          case "u64":
-            params.push(`i64 %a${i}`);
-            body.push(
-              `  %c${i} = call double @scr_library_u64_in(i64 %a${i}, ptr @sc_lib_int_trap_${e.symbol})`,
-            );
-            args.push(`double %c${i}`);
-            break;
-          case "string":
-            params.push(`ptr %a${i}_ptr`, `${this.sizeType} %a${i}_len`);
-            body.push(
-              `  %c${i} = call ptr @scr_library_str_in(ptr %a${i}_ptr, ${this.sizeType} %a${i}_len)`,
-            );
-            args.push(`ptr %c${i}`);
-            break;
-          case "bytes":
-            params.push(`ptr %a${i}_ptr`, `${this.sizeType} %a${i}_len`);
-            body.push(
-              `  %c${i} = call ptr @scr_library_bytes_in(ptr %a${i}_ptr, ${this.sizeType} %a${i}_len, ptr @sc_lib_bytes_trap_${e.symbol})`,
-            );
-            args.push(`ptr %c${i}`);
-            break;
-          case "cstring":
-            params.push(`ptr %a${i}`);
-            body.push(
-              `  %c${i} = call ptr @scr_library_cstr_in(ptr %a${i}, ptr @sc_lib_cstr_trap_${e.symbol})`,
-            );
-            args.push(`ptr %c${i}`);
-            break;
-        }
-      });
-      if (e.returns === "string" || e.returns === "bytes") {
-        params.push(`ptr %out`, `ptr %out_len`);
-      }
-      const target = `@${mangleFunction(e.fnName)}`;
-      const callArgs = args.join(", ");
-      let retType = "void";
-      switch (e.returns) {
-        case "void":
-          body.push(
-            `  call void ${target}(${callArgs})`,
-            `  call void @scr_library_check_exc()`,
-            `  ret void`,
-          );
-          break;
-        case "f64":
-          retType = "double";
-          body.push(
-            `  %r = call double ${target}(${callArgs})`,
-            `  call void @scr_library_check_exc()`,
-            `  ret double %r`,
-          );
-          break;
-        case "i64":
-        case "u64":
-          // The outbound declared-integer edge (ask 4): every value
-          // reaching this return was PROVEN whole and inside the class's
-          // range at compile time, so the fp-to-int conversion is exact
-          // by construction — the crossing carries the mathematically
-          // exact integer the f64 held.
-          retType = "i64";
-          body.push(
-            `  %r = call double ${target}(${callArgs})`,
-            `  call void @scr_library_check_exc()`,
-            `  %z = ${e.returns === "i64" ? "fptosi" : "fptoui"} double %r to i64`,
-            `  ret i64 %z`,
-          );
-          break;
-        case "bool":
-          retType = "i8";
-          body.push(
-            `  %r = call i1 ${target}(${callArgs})`,
-            `  call void @scr_library_check_exc()`,
-            `  %z = zext i1 %r to i8`,
-            `  ret i8 %z`,
-          );
-          break;
-        case "string":
-          body.push(
-            `  %r = call ptr ${target}(${callArgs})`,
-            `  call void @scr_library_check_exc()`,
-            `  call void @scr_library_str_out(ptr %r, ptr %out, ptr %out_len)`,
-            `  ret void`,
-          );
-          break;
-        case "bytes":
-          body.push(
-            `  %r = call ptr ${target}(${callArgs})`,
-            `  call void @scr_library_check_exc()`,
-            `  call void @scr_library_bytes_out(ptr %r, ptr %out, ptr %out_len)`,
-            `  ret void`,
-          );
-          break;
-        case "cstring":
-          // The result's arena copy, returned as `const char *`.
-          retType = "ptr";
-          body.push(
-            `  %r = call ptr ${target}(${callArgs})`,
-            `  call void @scr_library_check_exc()`,
-            `  %z = call ptr @scr_library_cstr_out(ptr %r)`,
-            `  ret ptr %z`,
-          );
-          break;
-      }
-      out.push(
-        `define ${retType} @${e.symbol}(${params.join(", ")}) ${FN_ATTRS} { ; library export ${e.fnName}`,
-        `entry:`,
-        ...body,
-        `}`,
-        ``,
-      );
-    }
-    return out;
+    return emitLibDefs(this, globals, globalReleaseLines, stamps);
   }
-
-  /** The shared abort helpers (emitted only when referenced): the OOM
-   * abort of untraced shape allocation and the invalid-union-tag abort —
-   * both print the runtime ABI’s exact message on fd 2 and abort. */
-  private helperDefs(): string[] {
-    const defs: string[] = [];
-    const msgHelper = (fnName: string, msgSym: string, msg: string): void => {
-      // The message routes through the runtime's trap funnel: executable
-      // builds expand to the historical bytes-on-stderr + abort; library
-      // builds route to the registered panic sink (scr_runtime.h).
-      const bytes = Buffer.byteLength(msg, "utf8");
-      this.declare(`declare void @scr_trap(ptr)`);
-      defs.push(
-        `@${msgSym} = internal constant [${bytes + 1} x i8] c"${llStrBytes(msg)}"`,
-        `define internal void @${fnName}() ${FN_ATTRS} {`,
-        `entry:`,
-        `  call void @scr_trap(ptr @${msgSym})`,
-        `  unreachable`,
-        `}`,
-        ``,
-      );
-    };
-    if (this.needsOom) msgHelper("sc_oom", "sc_oom_msg", "scriptc: out of memory\n");
-    if (this.needsBadTag) {
-      msgHelper("sc_bad_tag", "sc_bad_tag_msg", "scriptc: internal error: invalid union tag\n");
-    }
-    if (this.needsBadKey) {
-      // The keyed-read miss on a result type that cannot say `undefined`:
-      // trap like an array OOB read instead of corrupting a typed slot
-      // (SEMANTICS.md; the C helper's message additionally interpolates
-      // the runtime key — a trap-path debugging nicety, never reachable
-      // by a program whose behavior matches Node).
-      msgHelper(
-        "sc_bad_key",
-        "sc_bad_key_msg",
-        "scriptc: TypeError: record has no key (typed slot — no undefined is representable)\n",
-      );
-    }
-    if (this.needsRetainBox) {
-      // scr_box_retain is a static inline (increment-unless-immortal);
-      // emitted once with internal linkage, like the record retains.
-      defs.push(
-        `define internal ptr @sc_retain_box(ptr %b) ${FN_ATTRS} {`,
-        `entry:`,
-        `  %rc = load ${this.sizeType}, ptr %b`,
-        `  %imm = icmp eq ${this.sizeType} %rc, -1`,
-        `  br i1 %imm, label %done, label %inc`,
-        `inc:`,
-        `  %n = add ${this.sizeType} %rc, 1`,
-        `  store ${this.sizeType} %n, ptr %b`,
-        `  br label %done`,
-        `done:`,
-        `  ret ptr %b`,
-        `}`,
-        ``,
-      );
-    }
-    // Number-key Map/Set lookups probe the runtime's direct index inline:
-    // while ndense is nonzero every live key is an integer below it, so an
-    // in-range integral key reads its slot (entry index + 1, 0 = absent) and
-    // any other key is absent. Maps without the index (ndense 0) hash the
-    // key in sc_map_entry_f64_hashed, which scans the entries of a small map
-    // or probes a compact bucket table as scr_map_find_f64 does, and calls
-    // the runtime lookup for a wide table. It stays out of line so that the
-    // direct-index path stays small at every call site. Both only read
-    // memory, so LLVM merges lookups of one key when nothing is stored in
-    // between (a has() followed by get(), for example).
-    if (this.decls.has(NUMBER_MAP_ENTRY_DECL)) {
-      const sz = this.sizeType;
-      let mapTmp = 0;
-      const mapIndex = exactIndexLines("%k", "%nd", sz, () => `%ix${mapTmp++}`);
-      defs.push(
-        `define internal ptr @sc_map_entry_f64(ptr %m, double %k) ${FN_ATTRS} {`,
-        `entry:`,
-        `  %ndp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 16`,
-        ...(sz === "i64"
-          ? [`  %nd32 = load i32, ptr %ndp`, `  %nd = zext i32 %nd32 to i64`]
-          : [`  %nd = load i32, ptr %ndp`]),
-        // A non-integral key inside the table is as absent as one outside it.
-        ...mapIndex.lines.map((line) => `  ${line}`),
-        `  br i1 ${mapIndex.ok}, label %slot, label %outside`,
-        `slot:`,
-        sz === "i64"
-          ? `  %i = add i64 ${mapIndex.wide}, 0`
-          : `  %i = trunc i64 ${mapIndex.wide} to ${sz}`,
-        `  %dp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 15`,
-        `  %dense = load ptr, ptr %dp`,
-        `  %sp = getelementptr inbounds i32, ptr %dense, ${sz} %i`,
-        `  %s = load i32, ptr %sp`,
-        `  %empty = icmp eq i32 %s, 0`,
-        `  br i1 %empty, label %miss, label %hit`,
-        `hit:`,
-        `  %e32 = sub i32 %s, 1`,
-        sz === "i32" ? `  %e = add i32 %e32, 0` : `  %e = zext i32 %e32 to ${sz}`,
-        `  %ep = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 11`,
-        `  %entries = load ptr, ptr %ep`,
-        `  %found = getelementptr inbounds %ScrMapEntry, ptr %entries, ${sz} %e`,
-        `  ret ptr %found`,
-        `miss:`,
-        `  ret ptr null`,
-        `outside:`,
-        `  %dense.any = icmp ne ${sz} %nd, 0`,
-        `  br i1 %dense.any, label %miss, label %slow`,
-        `slow:`,
-        `  %hashed = call ptr @sc_map_entry_f64_hashed(ptr %m, double %k)`,
-        `  ret ptr %hashed`,
-        `}`,
-        ``,
-        // Hashing (scr_map_find_f64): the SameValueZero key word, its
-        // scr_key_mix hash (zero remapped to one) and the absent-key filter.
-        `define internal ptr @sc_map_entry_f64_hashed(ptr %m, double %k) noinline ${FN_ATTRS} {`,
-        `entry:`,
-        `  %nan = fcmp uno double %k, %k`,
-        `  %zero = fcmp oeq double %k, 0.0`,
-        `  %kz = select i1 %zero, double 0.0, double %k`,
-        `  %kzb = bitcast double %kz to i64`,
-        `  %kb = select i1 %nan, i64 9221120237041090560, i64 %kzb`,
-        `  %x1s = lshr i64 %kb, 30`,
-        `  %x1 = xor i64 %kb, %x1s`,
-        `  %x2 = mul i64 %x1, -4658895280553007687`,
-        `  %x3s = lshr i64 %x2, 27`,
-        `  %x3 = xor i64 %x2, %x3s`,
-        `  %x4 = mul i64 %x3, -7723592293110705685`,
-        `  %x5s = lshr i64 %x4, 31`,
-        `  %x5 = xor i64 %x4, %x5s`,
-        `  %hz = icmp eq i64 %x5, 0`,
-        `  %h = select i1 %hz, i64 1, i64 %x5`,
-        `  %f1s = lshr i64 %h, 44`,
-        `  %f1a = and i64 %f1s, 63`,
-        `  %f1 = shl i64 1, %f1a`,
-        `  %f2s = lshr i64 %h, 50`,
-        `  %f2a = and i64 %f2s, 63`,
-        `  %f2 = shl i64 1, %f2a`,
-        `  %fb = or i64 %f1, %f2`,
-        `  %fp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 10`,
-        `  %filter = load i64, ptr %fp`,
-        `  %fm = and i64 %filter, %fb`,
-        `  %fin = icmp eq i64 %fm, %fb`,
-        `  br i1 %fin, label %table, label %miss`,
-        `table:`,
-        `  %nbp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 13`,
-        ...(sz === "i64"
-          ? [`  %nb32 = load i32, ptr %nbp`, `  %nb = zext i32 %nb32 to i64`]
-          : [`  %nb = load i32, ptr %nbp`]),
-        `  %eps = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 11`,
-        `  %ents = load ptr, ptr %eps`,
-        `  %linear = icmp eq ${sz} %nb, 0`,
-        `  br i1 %linear, label %scan, label %buckets`,
-        // Small maps keep no bucket table: scan the cached entry hashes.
-        `scan:`,
-        `  %nep = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 8`,
-        ...(sz === "i64"
-          ? [`  %ne32 = load i32, ptr %nep`, `  %ne = zext i32 %ne32 to i64`]
-          : [`  %ne = load i32, ptr %nep`]),
-        `  br label %scan.loop`,
-        `scan.loop:`,
-        `  %si = phi ${sz} [ 0, %scan ], [ %si.next, %scan.next ]`,
-        `  %sdone = icmp eq ${sz} %si, %ne`,
-        `  br i1 %sdone, label %miss, label %scan.entry`,
-        `scan.entry:`,
-        `  %se = getelementptr inbounds %ScrMapEntry, ptr %ents, ${sz} %si`,
-        `  %seh = getelementptr inbounds %ScrMapEntry, ptr %se, i32 0, i32 2`,
-        `  %sh = load i64, ptr %seh`,
-        `  %sk = load i64, ptr %se`,
-        `  %shq = icmp eq i64 %sh, %h`,
-        `  %skq = icmp eq i64 %sk, %kb`,
-        `  %sq = and i1 %shq, %skq`,
-        `  br i1 %sq, label %scan.found, label %scan.next`,
-        `scan.found:`,
-        `  ret ptr %se`,
-        `scan.next:`,
-        `  %si.next = add ${sz} %si, 1`,
-        `  br label %scan.loop`,
-        // Compact tables tag each 24-bit entry index (+1) with the hash's
-        // top byte; wider tables take the runtime lookup.
-        `buckets:`,
-        `  %wide = icmp ugt ${sz} %nb, 16777216`,
-        `  br i1 %wide, label %runtime, label %probe`,
-        `probe:`,
-        `  %bp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 14`,
-        `  %bk = load ptr, ptr %bp`,
-        `  %mask = sub ${sz} %nb, 1`,
-        `  %ht = lshr i64 %h, 32`,
-        `  %ht32 = trunc i64 %ht to i32`,
-        `  %tag = and i32 %ht32, -16777216`,
-        sz === "i64" ? `  %hi = add i64 %h, 0` : `  %hi = trunc i64 %h to ${sz}`,
-        `  %i0 = and ${sz} %hi, %mask`,
-        `  br label %probe.loop`,
-        `probe.loop:`,
-        `  %pi = phi ${sz} [ %i0, %probe ], [ %pi.next, %probe.next ]`,
-        `  %bep = getelementptr inbounds i32, ptr %bk, ${sz} %pi`,
-        `  %b = load i32, ptr %bep`,
-        `  %bempty = icmp eq i32 %b, 0`,
-        `  br i1 %bempty, label %miss, label %probe.tag`,
-        `probe.tag:`,
-        `  %bt = and i32 %b, -16777216`,
-        `  %btq = icmp eq i32 %bt, %tag`,
-        `  br i1 %btq, label %probe.entry, label %probe.next`,
-        `probe.entry:`,
-        `  %bix = and i32 %b, 16777215`,
-        `  %bix1 = sub i32 %bix, 1`,
-        sz === "i32" ? `  %bi = add i32 %bix1, 0` : `  %bi = zext i32 %bix1 to ${sz}`,
-        `  %pe = getelementptr inbounds %ScrMapEntry, ptr %ents, ${sz} %bi`,
-        `  %peh = getelementptr inbounds %ScrMapEntry, ptr %pe, i32 0, i32 2`,
-        `  %ph = load i64, ptr %peh`,
-        `  %pk = load i64, ptr %pe`,
-        `  %phq = icmp eq i64 %ph, %h`,
-        `  %pkq = icmp eq i64 %pk, %kb`,
-        `  %pq = and i1 %phq, %pkq`,
-        `  br i1 %pq, label %probe.found, label %probe.next`,
-        `probe.found:`,
-        `  ret ptr %pe`,
-        `probe.next:`,
-        `  %pi.inc = add ${sz} %pi, 1`,
-        `  %pi.next = and ${sz} %pi.inc, %mask`,
-        `  br label %probe.loop`,
-        `miss:`,
-        `  ret ptr null`,
-        `runtime:`,
-        `  %r = call ptr @scr_map_entry_f64(ptr %m, double %k) memory(read) nounwind willreturn`,
-        `  ret ptr %r`,
-        `}`,
-        ``,
-      );
-    }
-    // Map/Set iteration steps read the entries array inline: an index is
-    // live when it is below the entry count and its entry's cached hash is
-    // nonzero (a tombstone's is zero), as scr_map_iter_live decides. The
-    // entry count is read again at every step, so entries appended during
-    // the iteration are visited.
-    if (this.decls.has(MAP_ITER_DECL)) {
-      const sz = this.sizeType;
-      defs.push(
-        `define internal ptr @sc_map_iter_entry(ptr %m, double %i) ${FN_ATTRS} {`,
-        `entry:`,
-        `  %np = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 8`,
-        `  %n = load i32, ptr %np`,
-        `  %nf = uitofp i32 %n to double`,
-        `  %lo = fcmp oge double %i, 0.0`,
-        `  %hi = fcmp olt double %i, %nf`,
-        `  %in = and i1 %lo, %hi`,
-        `  br i1 %in, label %load, label %none`,
-        `load:`,
-        `  %ix = fptoui double %i to ${sz}`,
-        `  %ep = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 11`,
-        `  %entries = load ptr, ptr %ep`,
-        `  %e = getelementptr inbounds %ScrMapEntry, ptr %entries, ${sz} %ix`,
-        `  %hp = getelementptr inbounds %ScrMapEntry, ptr %e, i32 0, i32 2`,
-        `  %h = load i64, ptr %hp`,
-        `  %live = icmp ne i64 %h, 0`,
-        `  br i1 %live, label %yes, label %none`,
-        `yes:`,
-        `  ret ptr %e`,
-        `none:`,
-        `  ret ptr null`,
-        `}`,
-        ``,
-        `define internal double @sc_map_iter_count(ptr %m) ${FN_ATTRS} {`,
-        `entry:`,
-        `  %np = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 8`,
-        `  %n = load i32, ptr %np`,
-        `  %nf = uitofp i32 %n to double`,
-        `  ret double %nf`,
-        `}`,
-        ``,
-      );
-    }
-    // String-key Map/Set lookups test the map's absent-key filter inline
-    // (scr_map.c scr_map_filter_bits): a key whose two filter bits are not
-    // both set is absent, so most misses on small and medium maps return
-    // without a call. On 64-bit targets the key's cached hash h is the high
-    // half of its capacity word, the runtime's widened hash is (h << 32) | h,
-    // and the filter reads its bits 44..55, which are the capacity word's
-    // own. A key without a cached hash, and every possible hit, take the
-    // runtime lookup.
-    if (this.decls.has(STRING_MAP_ENTRY_DECL)) {
-      defs.push(
-        `define internal ptr @sc_map_entry_str(ptr %m, ptr %k) ${FN_ATTRS} {`,
-        `entry:`,
-        ...(this.sizeType === "i64"
-          ? [
-              `  %fp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 10`,
-              `  %filter = load i64, ptr %fp`,
-              `  %capp = getelementptr inbounds %ScrStr, ptr %k, i32 0, i32 2`,
-              `  %cap = load i64, ptr %capp`,
-              `  %cached = icmp uge i64 %cap, 4294967296`,
-              `  br i1 %cached, label %test, label %slow`,
-              `test:`,
-              `  %s1 = lshr i64 %cap, 44`,
-              `  %i1 = and i64 %s1, 63`,
-              `  %b1 = shl i64 1, %i1`,
-              `  %s2 = lshr i64 %cap, 50`,
-              `  %i2 = and i64 %s2, 63`,
-              `  %b2 = shl i64 1, %i2`,
-              `  %bits = or i64 %b1, %b2`,
-              `  %have = and i64 %filter, %bits`,
-              `  %maybe = icmp eq i64 %have, %bits`,
-              `  br i1 %maybe, label %slow, label %absent`,
-              `absent:`,
-              `  ret ptr null`,
-            ]
-          : [`  br label %slow`]),
-        `slow:`,
-        `  %r = call ptr @scr_map_entry_str(ptr %m, ptr %k)`,
-        `  ret ptr %r`,
-        `}`,
-        ``,
-      );
-    }
-    // String comparisons enter through small internal wrappers that LLVM
-    // inlines at each site: interned literals and shared values compare by
-    // identity, and equality rejects different byte lengths, before any
-    // runtime call (scr_str_eq/scr_str_cmp keep the complete semantics).
-    if (this.decls.has(`declare zeroext i1 @scr_str_eq(ptr, ptr)`)) {
-      defs.push(
-        `define internal zeroext i1 @sc_str_eq(ptr %a, ptr %b) ${FN_ATTRS} {`,
-        `entry:`,
-        `  %same = icmp eq ptr %a, %b`,
-        `  br i1 %same, label %yes, label %lengths`,
-        `lengths:`,
-        `  %alen.p = getelementptr inbounds %ScrStr, ptr %a, i32 0, i32 1`,
-        `  %blen.p = getelementptr inbounds %ScrStr, ptr %b, i32 0, i32 1`,
-        `  %alen = load ${this.sizeType}, ptr %alen.p`,
-        `  %blen = load ${this.sizeType}, ptr %blen.p`,
-        `  %samelen = icmp eq ${this.sizeType} %alen, %blen`,
-        `  br i1 %samelen, label %bytes, label %no`,
-        `bytes:`,
-        `  %eq = call zeroext i1 @scr_str_eq(ptr %a, ptr %b)`,
-        `  ret i1 %eq`,
-        `yes:`,
-        `  ret i1 true`,
-        `no:`,
-        `  ret i1 false`,
-        `}`,
-        ``,
-      );
-    }
-    for (const [text, name] of this.literalEqualities) {
-      defs.push(
-        ...literalEqualityDefinition(
-          name,
-          wtf8Bytes(text),
-          this.internLiteral(text),
-          this.sizeType,
-          FN_ATTRS,
-        ),
-        ``,
-      );
-    }
-    // String length and charCodeAt read proven-ASCII strings inline: bit 31
-    // of the capacity word (SCR_STR_ASCII_BIT, the low half's sign bit on
-    // little-endian targets) makes UTF-16 units bytes. Unproven strings and
-    // anything but an in-range index take the runtime's UTF-16 mapping.
-    // A scan's receiver reads inline too where runtime state is ordinary
-    // global storage (ScrStrScan; SCR_TL makes it thread-local otherwise).
-    const scanInline = this.mod.workers !== true && this.mod.lib?.threadInstances !== true;
-    let scanDeclared = false;
-    for (const helper of STRING_READ_HELPERS) {
-      if (!this.decls.has(helper.decl)) continue;
-      if (scanInline && !scanDeclared) {
-        defs.push(stringScanDecl(this.sizeType), ``);
-        scanDeclared = true;
-      }
-      defs.push(...helper.define(this.sizeType, FN_ATTRS, scanInline), ``);
-    }
-    // Ordering also decides inline when the first bytes differ: byte order
-    // is the plain comparison's order, and the UTF-16 order whenever both
-    // bytes are ASCII. Callers only test the sign of the result.
-    for (const fn of ["scr_str_cmp", "scr_str_cmp_u16"]) {
-      if (!this.decls.has(`declare i32 @${fn}(ptr, ptr)`)) continue;
-      this.declare("declare i64 @llvm.bswap.i64(i64)");
-      const utf16 = fn === "scr_str_cmp_u16";
-      defs.push(
-        `define internal i32 @${fn.replace(/^scr_/, "sc_")}(ptr %a, ptr %b) ${FN_ATTRS} {`,
-        `entry:`,
-        `  %same = icmp eq ptr %a, %b`,
-        `  br i1 %same, label %equal, label %lengths`,
-        `lengths:`,
-        `  %alen.p = getelementptr inbounds %ScrStr, ptr %a, i32 0, i32 1`,
-        `  %blen.p = getelementptr inbounds %ScrStr, ptr %b, i32 0, i32 1`,
-        `  %alen = load ${this.sizeType}, ptr %alen.p`,
-        `  %blen = load ${this.sizeType}, ptr %blen.p`,
-        `  %aempty = icmp eq ${this.sizeType} %alen, 0`,
-        `  %bempty = icmp eq ${this.sizeType} %blen, 0`,
-        `  %empty = or i1 %aempty, %bempty`,
-        `  br i1 %empty, label %order, label %words`,
-        // Both at least 8 bytes: the first differing byte of one word pair.
-        // Byte-swapped little-endian words compare in byte order.
-        `words:`,
-        `  %along = icmp uge ${this.sizeType} %alen, 8`,
-        `  %blong = icmp uge ${this.sizeType} %blen, 8`,
-        `  %long = and i1 %along, %blong`,
-        `  br i1 %long, label %word, label %first`,
-        `word:`,
-        `  %awp = getelementptr inbounds %ScrStr, ptr %a, i32 1`,
-        `  %bwp = getelementptr inbounds %ScrStr, ptr %b, i32 1`,
-        `  %aw = load i64, ptr %awp, align 1`,
-        `  %bw = load i64, ptr %bwp, align 1`,
-        `  %wdiffer = icmp ne i64 %aw, %bw`,
-        `  br i1 %wdiffer, label %wdiff, label %wsame`,
-        `wdiff:`,
-        ...(utf16
-          ? [
-              `  %wbits = or i64 %aw, %bw`,
-              `  %whigh = and i64 %wbits, -9187201950435737472`,
-              `  %wascii = icmp eq i64 %whigh, 0`,
-              `  br i1 %wascii, label %wordorder, label %order`,
-            ]
-          : [`  br label %wordorder`]),
-        `wordorder:`,
-        `  %asw = call i64 @llvm.bswap.i64(i64 %aw)`,
-        `  %bsw = call i64 @llvm.bswap.i64(i64 %bw)`,
-        `  %wbelow = icmp ult i64 %asw, %bsw`,
-        `  %wsign = select i1 %wbelow, i32 -1, i32 1`,
-        `  ret i32 %wsign`,
-        // Equal first words and one length of at most 16 bytes: the word
-        // ending at that length covers the rest, and any difference lies
-        // past the equal first word.
-        `wsame:`,
-        `  %samelen = icmp eq ${this.sizeType} %alen, %blen`,
-        `  %short = icmp ule ${this.sizeType} %alen, 16`,
-        `  %tailable = and i1 %samelen, %short`,
-        `  br i1 %tailable, label %tail, label %order`,
-        `tail:`,
-        `  %toff = sub ${this.sizeType} %alen, 8`,
-        `  %atp = getelementptr inbounds i8, ptr %awp, ${this.sizeType} %toff`,
-        `  %btp = getelementptr inbounds i8, ptr %bwp, ${this.sizeType} %toff`,
-        `  %at = load i64, ptr %atp, align 1`,
-        `  %bt = load i64, ptr %btp, align 1`,
-        `  %tdiffer = icmp ne i64 %at, %bt`,
-        `  br i1 %tdiffer, label %tdiff, label %equal`,
-        `tdiff:`,
-        ...(utf16
-          ? [
-              `  %tbits = or i64 %at, %bt`,
-              `  %thigh = and i64 %tbits, -9187201950435737472`,
-              `  %tascii = icmp eq i64 %thigh, 0`,
-              `  br i1 %tascii, label %tailorder, label %order`,
-            ]
-          : [`  br label %tailorder`]),
-        `tailorder:`,
-        `  %ats = call i64 @llvm.bswap.i64(i64 %at)`,
-        `  %bts = call i64 @llvm.bswap.i64(i64 %bt)`,
-        `  %tbelow = icmp ult i64 %ats, %bts`,
-        `  %tsign = select i1 %tbelow, i32 -1, i32 1`,
-        `  ret i32 %tsign`,
-        `first:`,
-        `  %adata = getelementptr inbounds %ScrStr, ptr %a, i32 1`,
-        `  %bdata = getelementptr inbounds %ScrStr, ptr %b, i32 1`,
-        `  %x = load i8, ptr %adata`,
-        `  %y = load i8, ptr %bdata`,
-        `  %differ = icmp ne i8 %x, %y`,
-        ...(utf16
-          ? [
-              `  %bits = or i8 %x, %y`,
-              `  %ascii = icmp sge i8 %bits, 0`,
-              `  %decide = and i1 %differ, %ascii`,
-            ]
-          : [`  %decide = and i1 %differ, true`]),
-        `  br i1 %decide, label %byte, label %order`,
-        `byte:`,
-        `  %below = icmp ult i8 %x, %y`,
-        `  %sign = select i1 %below, i32 -1, i32 1`,
-        `  ret i32 %sign`,
-        `order:`,
-        `  %c = call i32 @${fn}(ptr %a, ptr %b)`,
-        `  ret i32 %c`,
-        `equal:`,
-        `  ret i32 0`,
-        `}`,
-        ``,
-      );
-    }
-    // The declarations these helpers added must land in the extern block,
-    // which already flushed — append here instead (LLVM is order-free).
-    return defs.length > 0 ? [...defs] : defs;
+  helperDefs(): string[] {
+    return helperDefs(this);
   }
 
   /** The inline RC helpers every call site requested, emitted last so
    * requests from main/library epilogues are included. Slow-path
    * declarations a late request added after the extern block flushed land
    * here too. */
-  private inlineRcTail(flushedDecls: ReadonlySet<string>): string[] {
+  inlineRcTail(flushedDecls: ReadonlySet<string>): string[] {
     const late = inlineRcDecls(this.shapeHost).filter((d) => !flushedDecls.has(d));
     // NULL-skipping retain wrappers of nullable unions; a runtime inner
     // retain requested after the extern block flushed is declared here.
@@ -3808,7 +1591,7 @@ export class LlEmitter {
   /** Env-signature wrappers + interned immortal closures for declared
    * functions used as values (the runtime ABI’s sc_w_/sc_fc_ pair): every
    * mention of `f` yields the same pointer, so `f === f` holds. */
-  private emitFnValueDefs(): string[] {
+  emitFnValueDefs(): string[] {
     const out: string[] = [];
     for (const name of this.fnValues) {
       const fn = this.fnByName.get(name)!;
@@ -3844,74 +1627,12 @@ export class LlEmitter {
     }
     return out;
   }
-
-  /** The argument-pack ABI and trampoline prefix shared by async functions
-   * and generators. Their promise/generator completion and spawn tails stay
-   * with the callers below. */
-  private emitArgPackAndTrampolinePrologue(fn: IrFunction): LlArgPackAndTrampolinePrologue {
-    const pack = mangleArgPack(fn.name);
-    const lifted = fn.captures !== undefined;
-    const fieldTys = [...(lifted ? ["ptr"] : []), ...fn.params.map((p) => this.llType(p.type))];
-    const definitions = [`%${pack} = type { ${fieldTys.join(", ") || "i8"} } ; ${fn.name} args`];
-    const sizeOf = `ptrtoint (ptr getelementptr (%${pack}, ptr null, i32 1) to ${this.sizeType})`;
-
-    // Async argument packs live from the spawn to the trampoline's first
-    // instructions, so they take the runtime's small-block allocator.
-    // Generator packs keep malloc: the runtime frees never-started ones.
-    const smallPack = fn.generator === undefined;
-    const packAlloc = smallPack ? "scr_rt_calloc" : "malloc";
-    const packFree = smallPack ? "scr_rt_free" : "free";
-    this.declare(`declare void @${packFree}(ptr)`);
-    this.declare(`declare ptr @${packAlloc}(${this.sizeType})`);
-
-    const tr: string[] = [
-      `define internal void @${mangleTrampoline(fn.name)}(ptr %self, ptr %ap) ${FN_ATTRS} {`,
-      `entry:`,
-    ];
-    const loads: string[] = [];
-    fieldTys.forEach((ty, i) => {
-      tr.push(
-        `  %fp${i} = getelementptr inbounds %${pack}, ptr %ap, i64 0, i32 ${i}`,
-        `  %a${i} = load ${ty}, ptr %fp${i}`,
-      );
-      loads.push(`${ty} %a${i}`);
-    });
-    tr.push(`  call void @${packFree}(ptr %ap)`);
-    const ret = fn.returnType;
-    const retTy = this.llType(ret);
-    const bodyCall = `call ${retTy} @${mangleFunction(fn.name)}(${loads.join(", ")})`;
-    tr.push(retTy === "void" ? `  ${bodyCall}` : `  %r = ${bodyCall}`);
-    if (lifted && !this.coroLowered(fn)) {
-      tr.push(`  call void @scr_closure_release(ptr %a0)`);
-    }
-
-    const spawnParams = fieldTys.map((ty, i) => `${ty} %a${i}`);
-    const argPackLines = [
-      `  %ap = call ptr @${packAlloc}(${this.sizeType} ${sizeOf})`,
-      `  %isnull = icmp eq ptr %ap, null`,
-      `  br i1 %isnull, label %oom, label %ok`,
-      `oom:`,
-      `  call void @sc_oom()`,
-      `  unreachable`,
-      `ok:`,
-    ];
-    if (lifted) {
-      // scr_closure_retain is a header static inline — the `_v` twin is
-      // the exported symbol.
-      argPackLines.push(`  %env = call ptr @scr_closure_retain_v(ptr %a0)`);
-    }
-    fieldTys.forEach((ty, i) => {
-      const src = lifted && i === 0 ? "%env" : `%a${i}`;
-      argPackLines.push(
-        `  %sp${i} = getelementptr inbounds %${pack}, ptr %ap, i64 0, i32 ${i}`,
-        `  store ${ty} ${src}, ptr %sp${i}`,
-      );
-    });
-    return { definitions, pack, lifted, fieldTys, ret, tr, spawnParams, argPackLines };
+  emitArgPackAndTrampolinePrologue(fn: IrFunction): LlArgPackAndTrampolinePrologue {
+    return emitArgPackAndTrampolinePrologue(this, fn);
   }
 
   /** Settles `promise` from a clean async body result `%r` (moved in). */
-  private asyncFulfillLines(ret: IrType, promise: string): string[] {
+  asyncFulfillLines(ret: IrType, promise: string): string[] {
     switch (ret.kind) {
       case "void":
         this.declare(`declare void @scr_promise_fulfill_void(ptr)`);
@@ -3938,34 +1659,12 @@ export class LlEmitter {
       }
     }
   }
-
-  /** Async functions whose calls can skip the fiber (scr_async_inline_*).
-   * A body qualifies only when nothing it runs can park its execution
-   * context: its emitted text, and the text of every module function it
-   * mentions (transitively), contains no suspension entry point. Such a
-   * body always completes before the call returns, which is exactly the
-   * behavior of a fiber that never suspends. Excluded conservatively:
-   * wasm32 (its coroutine lowering owns async bodies), module-evaluation
-   * bodies (their promise caches),
-   * `dyn` results (resolution may adopt a thenable), and every program
-   * that uses node:test subtests — `t.test()` runs a subtest inline and
-   * awaits it on the CURRENT fiber even from synchronous code. Worker
-   * programs keep fibers too: their fiber epilogue owns context
-   * termination (a stopping worker rejects and observes the promise), which
-   * the fiberless wrapper does not reproduce. A missed suspension still
-   * cannot reorder execution undetected: the runtime traps when a context parks while a
-   * fiberless body is on its stack. */
-  private fiberlessAsyncFunctions(): Set<string> {
-    const parks = this.parkingFunctions();
-    const eligible = parks === null ? new Set<string>() : this.neverParkingAsync(parks);
-    for (const name of this.inlineAwaitCallees)
-      if (!eligible.has(name))
-        throw new InternalCompilerError(`llvm emitter bug: inline await of suspending ${name}`);
-    return eligible;
+  fiberlessAsyncFunctions(): Set<string> {
+    return fiberlessAsyncFunctions(this);
   }
 
   /** The async functions `parks` leaves fiberless (fiberlessAsyncFunctions). */
-  private neverParkingAsync(parks: ReadonlySet<string>): Set<string> {
+  neverParkingAsync(parks: ReadonlySet<string>): Set<string> {
     const eligible = new Set<string>();
     for (const fn of this.mod.functions) {
       if (fn.async !== true || fn.generator !== undefined) continue;
@@ -3976,50 +1675,14 @@ export class LlEmitter {
     }
     return eligible;
   }
-
-  /** The module functions whose bodies may park their execution context:
-   * their emitted text mentions a suspension entry point (SUSPENDS), or
-   * they mention such a function (transitively). Null where async bodies
-   * must keep fibers regardless: wasm32 (its coroutine lowering owns async
-   * bodies), worker programs, and programs that use node:test subtests,
-   * whose `t.test()` awaits on the CURRENT fiber even from synchronous
-   * code. */
-  private parkingFunctions(): Set<string> | null {
-    if (this.wasi || this.mod.workers === true) return null;
-    for (const decl of this.decls) if (/@scr_test_sub\b/.test(decl)) return null;
-    for (const text of this.fnDefText.values()) if (/@scr_test_sub\b/.test(text)) return null;
-    // Reverse mention edges, then propagate "may park" to every mentioner.
-    const mentionedBy = new Map<string, Set<string>>();
-    const parks = new Set<string>();
-    const work: string[] = [];
-    for (const [name, text] of this.fnDefText) {
-      if (SUSPENDS.test(text)) {
-        parks.add(name);
-        work.push(name);
-      }
-      for (const callee of this.mentionedFunctions(text)) {
-        if (callee === name) continue;
-        let callers = mentionedBy.get(callee);
-        if (callers === undefined) mentionedBy.set(callee, (callers = new Set()));
-        callers.add(name);
-      }
-    }
-    while (work.length > 0) {
-      const callers = mentionedBy.get(work.pop()!);
-      if (callers === undefined) continue;
-      for (const caller of callers) {
-        if (parks.has(caller)) continue;
-        parks.add(caller);
-        work.push(caller);
-      }
-    }
-    return parks;
+  parkingFunctions(): Set<string> | null {
+    return parkingFunctions(this);
   }
 
   private mangledFunctions: Map<string, string> | null = null;
 
   /** The module functions whose ordinary or borrowed body `text` mentions. */
-  private *mentionedFunctions(text: string): Generator<string> {
+  *mentionedFunctions(text: string): Generator<string> {
     if (this.mangledFunctions === null) {
       this.mangledFunctions = new Map();
       for (const fn of this.mod.functions) {
@@ -4046,7 +1709,7 @@ export class LlEmitter {
    * otherwise the fiber form stays. Bodies that never suspend stay
    * fiberless, and module evaluation bodies and `dyn` results keep fibers
    * as they do there. The runtime traps if a stackless body ever parks. */
-  private selectStacklessAsync(fnDefs: string[]): void {
+  selectStacklessAsync(fnDefs: string[]): void {
     if (!this.stacklessAsyncAllowed) return;
     const parks = this.parkingFunctions();
     if (parks === null) return;
@@ -4080,7 +1743,7 @@ export class LlEmitter {
    * caller's stack between scr_async_inline_enter/leave and settles the
    * fresh promise from its outcome — the fiber trampoline's epilogue,
    * without the fiber. */
-  private emitFiberlessAsyncSpawn(fn: IrFunction, spawnParams: string[]): string[] {
+  emitFiberlessAsyncSpawn(fn: IrFunction, spawnParams: string[]): string[] {
     const ret = fn.returnType;
     const retTy = this.llType(ret);
     const lifted = fn.captures !== undefined;
@@ -4145,7 +1808,7 @@ export class LlEmitter {
    * body on the caller's stack between scr_async_inline_enter/exit, as in
    * its spawn wrapper, returning the result and leaving a throw pending for
    * the awaiting coroutine (emitCoroInlineAwait). */
-  private emitAsyncInlineAwaitCall(fn: IrFunction): string[] {
+  emitAsyncInlineAwaitCall(fn: IrFunction): string[] {
     const retTy = this.llType(fn.returnType);
     const params = fn.params.map((p, i) => `${this.llType(p.type)} %a${i}`);
     const args = params.join(", ");
@@ -4200,506 +1863,23 @@ export class LlEmitter {
     this.emitPendingCheck();
     return value;
   }
-
-  /** The await-call entry of an async function (`sc_aw_*`): one direct
-   * `await f(...)` as a call returning the awaited value, so the call site
-   * needs no promise of its own. A fiberless body runs on the caller's
-   * stack as in its spawn wrapper; a clean result then takes the await's
-   * one microtask turn (scr_await_hop) and is returned without ever
-   * materializing the promise, which nothing else could observe. A throw
-   * builds the rejected promise exactly as the spawn wrapper would and
-   * awaits it, so the rejection reaches the awaiter on the same turn. Other
-   * bodies pack their arguments as the spawn wrapper does and enter
-   * scr_async_spawn_await_*, which parks the caller on the promise as soon
-   * as the body first suspends. The adopting entry (`sc_ad_*`, for
-   * `return f(...)` in an async function) adds the turn of the then job
-   * that adopts the returned promise, before the await proper. */
-  private emitAsyncAwaitCall(
-    fn: IrFunction,
-    argPackLines: string[] | null,
-    adopt = false,
-  ): string[] {
-    const ret = fn.returnType;
-    const retTy = this.llType(ret);
-    const params = fn.params.map((p, i) => `${this.llType(p.type)} %a${i}`);
-    const awaitLine = (dest: string, promise: string): string => {
-      switch (ret.kind) {
-        case "void":
-          this.declare(`declare void @scr_await_void(ptr)`);
-          return `  call void @scr_await_void(ptr ${promise})`;
-        case "f64":
-        case "date":
-          this.declare(`declare double @scr_await_f64(ptr)`);
-          return `  ${dest} = call double @scr_await_f64(ptr ${promise})`;
-        case "bool":
-          this.declare(`declare zeroext i1 @scr_await_bool(ptr)`);
-          return `  ${dest} = call zeroext i1 @scr_await_bool(ptr ${promise})`;
-        case "string":
-          this.declare(`declare ptr @scr_await_str(ptr)`);
-          return `  ${dest} = call ptr @scr_await_str(ptr ${promise})`;
-        default:
-          this.declare(`declare ptr @scr_await_ref(ptr)`);
-          return `  ${dest} = call ptr @scr_await_ref(ptr ${promise})`;
-      }
-    };
-    const retLine = (v: string): string =>
-      retTy === "void" ? `  ret void` : `  ret ${retTy} ${v}`;
-    const head = adopt
-      ? `define internal ${retTy} @${mangleAsyncAdoptCall(fn.name)}(${params.join(", ")}) ${FN_ATTRS} { ; adopt ${fn.name}`
-      : `define internal ${retTy} @${mangleAsyncAwaitCall(fn.name)}(${params.join(", ")}) ${FN_ATTRS} { ; await ${fn.name}`;
-    const args = params.join(", ");
-    if (adopt && argPackLines !== null) {
-      // A body that may suspend settles later than the adoption's then job
-      // runs: materialize its promise, take that turn, then await it.
-      this.declare(`declare void @scr_await_hop()`);
-      this.declare(`declare void @scr_promise_release(ptr)`);
-      return [
-        head,
-        `entry:`,
-        `  %p = call ptr @${mangleAsyncSpawn(fn.name)}(${args})`,
-        `  call void @scr_await_hop()`,
-        awaitLine("%v", "%p"),
-        `  call void @scr_promise_release(ptr %p)`,
-        retLine("%v"),
-        `}`,
-        ``,
-      ];
-    }
-    if (argPackLines !== null && this.stacklessAsync.has(fn.name)) {
-      // A stackless body's eager prefix already runs on the awaiter's
-      // stack, which then awaits the promise like the two separate steps.
-      this.declare(`declare void @scr_promise_release(ptr)`);
-      return [
-        head,
-        `entry:`,
-        `  %p = call ptr @${mangleAsyncSpawn(fn.name)}(${args})`,
-        awaitLine("%v", "%p"),
-        `  call void @scr_promise_release(ptr %p)`,
-        retLine("%v"),
-        `}`,
-        ``,
-      ];
-    }
-    if (argPackLines !== null) {
-      const kind =
-        ret.kind === "void"
-          ? "void"
-          : ret.kind === "f64" || ret.kind === "date"
-            ? "f64"
-            : ret.kind === "bool"
-              ? "bool"
-              : ret.kind === "string"
-                ? "str"
-                : "ref";
-      const cret = kind === "bool" ? "zeroext i1" : retTy;
-      this.declare(`declare ${cret} @scr_async_spawn_await_${kind}(ptr, ptr)`);
-      this.needOom();
-      const call = `call ${cret} @scr_async_spawn_await_${kind}(ptr @${mangleTrampoline(fn.name)}, ptr %ap)`;
-      return [
-        head,
-        `entry:`,
-        ...argPackLines,
-        kind === "void" ? `  ${call}` : `  %v = ${call}`,
-        retLine("%v"),
-        `}`,
-        ``,
-      ];
-    }
-    this.declare(`declare void @scr_async_inline_enter(ptr)`);
-    this.declare(`declare void @scr_async_inline_exit(ptr)`);
-    this.declare(`declare void @scr_await_hop()`);
-    this.declare(`declare ptr @scr_promise_new()`);
-    this.declare(`declare void @scr_promise_reject_pending(ptr)`);
-    this.declare(`declare void @scr_promise_release(ptr)`);
-    const bodyCall = `call ${retTy} @${mangleFunction(fn.name)}(${args})`;
-    const out = [
-      head,
-      `entry:`,
-      `  %frame = alloca { ptr, ptr }`,
-      `  call void @scr_async_inline_enter(ptr %frame)`,
-      retTy === "void" ? `  ${bodyCall}` : `  %r = ${bodyCall}`,
-      ...this.pendingTestLines("%pend"),
-      `  call void @scr_async_inline_exit(ptr %frame)`,
-      // Adopting: the then job's turn comes before the settled promise's
-      // own reaction, whichever way the body completed.
-      ...(adopt ? [`  call void @scr_await_hop()`] : []),
-      `  br i1 %pend, label %thrown, label %clean`,
-      `clean:`,
-      `  call void @scr_await_hop()`,
-      retLine("%r"),
-      `thrown:`,
-    ];
-    if (ret.kind !== "void" && isRefCounted(ret)) {
-      // An escaping throw means %r is the never-read dummy (NULL).
-      out.push(`  call void ${releaseSym(this.shapeHost, ret)}(ptr %r)`);
-    }
-    out.push(
-      `  %p = call ptr @scr_promise_new()`,
-      `  call void @scr_promise_reject_pending(ptr %p)`,
-      awaitLine("%v", "%p"),
-      `  call void @scr_promise_release(ptr %p)`,
-      retLine("%v"),
-      `}`,
-      ``,
-    );
-    return out;
+  emitAsyncAwaitCall(fn: IrFunction, argPackLines: string[] | null, adopt = false): string[] {
+    return emitAsyncAwaitCall(this, fn, argPackLines, adopt);
   }
-
-  /** Per-async-function machinery — async.ts's scaffolding, .ll
-   * flavored: an argument-pack struct type, a fiber trampoline (unpacks,
-   * frees the pack, runs the ordinary compiled body, settles the
-   * promise — fulfilling on clean return, leaving a pending exception
-   * for the runtime to reject with), and a spawn wrapper call sites and
-   * closures enter through (packs the args +1, scr_async_spawn runs the
-   * fiber eagerly to its first suspension and returns the promise). */
-  private emitAsyncScaffolding(): string[] {
-    const out: string[] = [];
-    if (this.wasi) {
-      this.declare(`declare void @llvm.coro.resume(ptr)`);
-      this.declare(`declare void @llvm.coro.destroy(ptr)`);
-      out.push(
-        `define void @scr_wasi_coro_resume(ptr %handle) ${FN_ATTRS} {`,
-        `entry:`,
-        `  call void @llvm.coro.resume(ptr %handle)`,
-        `  ret void`,
-        `}`,
-        `define void @scr_wasi_coro_destroy(ptr %handle) ${FN_ATTRS} {`,
-        `entry:`,
-        `  call void @llvm.coro.destroy(ptr %handle)`,
-        `  ret void`,
-        `}`,
-        ``,
-      );
-    }
-    const fiberless = this.fiberlessAsyncFunctions();
-    for (const fn of this.mod.functions) {
-      if (fn.async !== true || fn.generator !== undefined) continue;
-      if (fiberless.has(fn.name) && this.awaitCallees.has(fn.name)) {
-        for (const line of this.emitAsyncAwaitCall(fn, null)) out.push(line);
-      }
-      if (fiberless.has(fn.name) && this.adoptCallees.has(fn.name)) {
-        for (const line of this.emitAsyncAwaitCall(fn, null, true)) out.push(line);
-      }
-      if (this.inlineAwaitCallees.has(fn.name)) {
-        for (const line of this.emitAsyncInlineAwaitCall(fn)) out.push(line);
-      }
-      if (fiberless.has(fn.name)) {
-        const fieldTys = [
-          ...(fn.captures !== undefined ? ["ptr"] : []),
-          ...fn.params.map((p) => this.llType(p.type)),
-        ];
-        const params = fieldTys.map((ty, i) => `${ty} %a${i}`);
-        for (const line of this.emitFiberlessAsyncSpawn(fn, params)) out.push(line);
-        continue;
-      }
-      const { definitions, ret, tr, spawnParams, argPackLines } =
-        this.emitArgPackAndTrampolinePrologue(fn);
-      for (const line of definitions) out.push(line);
-      if (this.awaitCallees.has(fn.name)) {
-        for (const line of this.emitAsyncAwaitCall(fn, argPackLines)) out.push(line);
-      }
-      if (this.adoptCallees.has(fn.name)) {
-        for (const line of this.emitAsyncAwaitCall(fn, argPackLines, true)) out.push(line);
-      }
-      const stackless = this.stacklessAsync.has(fn.name);
-      const spawn = stackless ? "scr_async_spawn_stackless" : "scr_async_spawn";
-      this.declare(`declare ptr @scr_fiber_promise(ptr)`);
-      this.declare(`declare ptr @${spawn}(ptr, ptr)`);
-      this.needOom();
-      if (this.wasi || stackless) {
-        // The coroutine body settles its own promise and owns the retained
-        // lifted environment until final suspension. Its initial call
-        // returns here at the first suspend (or final suspend).
-        tr.push(`  ret void`, `}`, ``);
-      } else {
-        if (fn.captures !== undefined) {
-          this.declare(`declare void @scr_closure_release(ptr)`);
-        }
-        tr.push(
-          ...this.pendingTestLines("%pend"),
-          `  br i1 %pend, label %thrown, label %clean`,
-          `clean:`,
-          `  %pr = call ptr @scr_fiber_promise(ptr %self)`,
-        );
-        for (const line of this.asyncFulfillLines(ret, "%pr")) tr.push(line);
-        tr.push(`  ret void`, `thrown:`);
-        if (ret.kind !== "void" && isRefCounted(ret)) {
-          // An escaping throw means %r is the never-read dummy (NULL).
-          tr.push(`  call void ${releaseSym(this.shapeHost, ret)}(ptr %r)`);
-        }
-        tr.push(`  ret void`, `}`, ``);
-      }
-      for (const line of tr) out.push(line);
-
-      // Spawn wrapper: pack the args (+1 moves in), spawn the fiber.
-      const cache = fn.asyncCacheGlobal !== undefined ? mangleGlobal(fn.asyncCacheGlobal) : null;
-      const cycleCache =
-        fn.asyncCycleCacheGlobal !== undefined ? mangleGlobal(fn.asyncCycleCacheGlobal) : null;
-      if (cache !== null || cycleCache !== null) {
-        this.declare(`declare ptr @scr_promise_retain_v(ptr)`);
-        this.declare(`declare void @scr_promise_release(ptr)`);
-      }
-      if (cache !== null) {
-        this.declare(`declare void @scr_promise_mark_handled(ptr)`);
-      }
-      if (fn.captures !== undefined) {
-        this.declare(`declare ptr @scr_closure_retain_v(ptr)`);
-      }
-      const sp: string[] = [
-        `define internal ptr @${mangleAsyncSpawn(fn.name)}(${spawnParams.join(", ")}) ${FN_ATTRS} { ; spawn ${fn.name}`,
-        `entry:`,
-        ...(cache !== null
-          ? [
-              `  %cached = load ptr, ptr @${cache}`,
-              `  %cache_hit = icmp ne ptr %cached, null`,
-              `  br i1 %cache_hit, label %cached_return, label %cache_miss`,
-              `cached_return:`,
-              `  %cached_owned = call ptr @scr_promise_retain_v(ptr %cached)`,
-              `  ret ptr %cached_owned`,
-              `cache_miss:`,
-            ]
-          : []),
-        ...argPackLines,
-      ];
-      sp.push(
-        `  %p = call ptr @${spawn}(ptr @${mangleTrampoline(fn.name)}, ptr %ap)`,
-        ...(cache !== null
-          ? [
-              // The module loader owns this evaluation promise
-              // immediately. A later sibling can throw before the
-              // aggregate dependency wait is built, but this rejection
-              // must never become an unrelated unhandled rejection.
-              `  call void @scr_promise_mark_handled(ptr %p)`,
-            ]
-          : []),
-        ...(cache !== null
-          ? [
-              `  %cache_owned = call ptr @scr_promise_retain_v(ptr %p)`,
-              // The eager spawn may have re-entered this guarded module
-              // through an admitted async cycle and installed a temporary
-              // cache entry. Drop that owned slot before replacing it
-              // with the outer evaluation promise.
-              `  %replaced_cache = load ptr, ptr @${cache}`,
-              `  call void @scr_promise_release(ptr %replaced_cache)`,
-              `  store ptr %cache_owned, ptr @${cache}`,
-            ]
-          : []),
-        ...(cycleCache !== null
-          ? [
-              // Eager recursive spawns publish from the inside out. The
-              // runtime-requested outermost member writes last and is the
-              // SCC's actual evaluation root.
-              `  %cycle_cache_owned = call ptr @scr_promise_retain_v(ptr %p)`,
-              `  %replaced_cycle_cache = load ptr, ptr @${cycleCache}`,
-              `  call void @scr_promise_release(ptr %replaced_cycle_cache)`,
-              `  store ptr %cycle_cache_owned, ptr @${cycleCache}`,
-            ]
-          : []),
-        `  ret ptr %p`,
-        `}`,
-        ``,
-      );
-      for (const line of sp) out.push(line);
-    }
-    for (const line of this.emitGenScaffolding()) out.push(line);
-    return out;
+  emitAsyncScaffolding(): string[] {
+    return emitAsyncScaffolding(this);
   }
 
   /** Whether `fn`'s body is emitted as an LLVM switched coroutine: every
    * wasm32 async or generator body, native synchronous generators, and the
    * native async bodies selectStacklessAsync chose. */
-  private coroLowered(fn: IrFunction): boolean {
+  coroLowered(fn: IrFunction): boolean {
     if (this.wasi) return fn.async === true || fn.generator !== undefined;
     if (fn.async === true) return fn.generator === undefined && this.stacklessAsync.has(fn.name);
     return this.stacklessGenerators && fn.generator !== undefined;
   }
-
-  /** Per-generator-function machinery — the async scaffolding's lazy
-   * sibling (async.ts's emitGenScaffolding): the same argument pack,
-   * a fiber trampoline whose epilogue stores the COMPLETION value (or
-   * consumes the GENRET sentinel, promoting the parked .return value), a
-   * spawn wrapper that only ALLOCATES the suspended fiber, and the
-   * never-started teardown that drops the packed (+1) arguments. */
-  private emitGenScaffolding(): string[] {
-    const out: string[] = [];
-    for (const fn of this.mod.functions) {
-      if (fn.generator === undefined) continue;
-      const { definitions, pack, lifted, fieldTys, ret, tr, spawnParams, argPackLines } =
-        this.emitArgPackAndTrampolinePrologue(fn);
-      for (const line of definitions) out.push(line);
-      this.declare(`declare zeroext i1 @scr_exc_genret_pending()`);
-      this.declare(`declare void @scr_exc_clear()`);
-      this.declare(`declare ptr @scr_gen_of_fiber(ptr)`);
-      this.declare(`declare void @scr_gen_ret_to_out(ptr)`);
-      this.declare(`declare ptr @scr_gen_new(ptr, ptr, ptr)`);
-      this.needOom();
-      const coroBody = this.coroLowered(fn);
-      if (lifted && !coroBody) {
-        this.declare(`declare void @scr_closure_release(ptr)`);
-      }
-      // Normal completion stores the (typed) return value; void completes
-      // with the NONE slot — JS's undefined done-value. A GENRET unwind
-      // consumes the sentinel and promotes the parked .return value; a
-      // real exception stays pending (the consumer-side resume moves it).
-      if (coroBody) {
-        tr.push(`  ret void`, `}`, ``);
-      } else {
-        tr.push(
-          `  %g = call ptr @scr_gen_of_fiber(ptr %self)`,
-          ...this.pendingTestLines("%pend"),
-          `  br i1 %pend, label %thrown, label %clean`,
-          `clean:`,
-        );
-        switch (ret.kind) {
-          case "void":
-            tr.push(`  br label %done ; void body: the done value is undefined (NONE)`);
-            break;
-          case "f64":
-          case "date":
-            this.declare(`declare void @scr_gen_out_f64(ptr, double)`);
-            tr.push(`  call void @scr_gen_out_f64(ptr %g, double %r)`, `  br label %done`);
-            break;
-          case "bool":
-            this.declare(`declare void @scr_gen_out_bool(ptr, i1 zeroext)`);
-            tr.push(`  call void @scr_gen_out_bool(ptr %g, i1 %r)`, `  br label %done`);
-            break;
-          default: {
-            const v = vAdapters(this.shapeHost, ret);
-            this.declare(`declare void @scr_gen_out_ref(ptr, ptr, ptr)`);
-            tr.push(
-              `  call void @scr_gen_out_ref(ptr %g, ptr %r, ptr ${v.release})`,
-              `  br label %done`,
-            );
-          }
-        }
-        tr.push(
-          `thrown:`,
-          `  %genret = call zeroext i1 @scr_exc_genret_pending()`,
-          `  br i1 %genret, label %promote, label %dropdummy`,
-          `promote:`,
-          `  call void @scr_exc_clear()`,
-          `  call void @scr_gen_ret_to_out(ptr %g)`,
-          `  br label %dropdummy`,
-          `dropdummy:`,
-        );
-        if (ret.kind !== "void" && isRefCounted(ret)) {
-          tr.push(
-            `  call void ${releaseSym(this.shapeHost, ret)}(ptr %r) ; unwound: the never-read dummy`,
-          );
-        }
-        tr.push(`  br label %done`, `done:`, `  ret void`, `}`, ``);
-      }
-      for (const line of tr) out.push(line);
-
-      let settleAsync: string | null = null;
-      if (fn.async) {
-        this.declare(`declare ptr @scr_async_gen_new(ptr, ptr, ptr, ptr)`);
-        const genT: IrType & { kind: "generator" } = {
-          kind: "generator",
-          async: true,
-          yieldT: fn.generator.yieldT,
-          retT: ret,
-          nextT: fn.generator.nextT,
-        };
-        const resultT = fn.generator.resultType;
-        const build = this.genResultThunkFor(genT, resultT);
-        settleAsync = `${build}_async`;
-        const settleKey = `ags:${typeKey(genT)}`;
-        if (!this.resolveThunks.has(settleKey)) {
-          this.resolveThunks.set(settleKey, settleAsync);
-          const adapters = vAdapters(this.shapeHost, resultT);
-          this.resolveThunkDefs.push(
-            `define internal void @${settleAsync}(ptr %g, ptr %p) ${FN_ATTRS} {`,
-            `entry:`,
-            `  %r = call ptr @${build}(ptr %g)`,
-            `  call void @scr_promise_fulfill_ref(ptr %p, ptr %r, ptr ${adapters.retain}, ptr ${adapters.release}, ptr ${traceArg(this.shapeHost, resultT)})`,
-            `  ret void`,
-            `}`,
-            ``,
-          );
-        }
-        this.declare(`declare void @scr_promise_fulfill_ref(ptr, ptr, ptr, ptr, ptr)`);
-      }
-
-      // The never-started teardown: drop the packed (+1) arguments.
-      const dr: string[] = [
-        `define internal void @${mangleGenDrop(fn.name)}(ptr %ap) ${FN_ATTRS} {`,
-        `entry:`,
-      ];
-      fieldTys.forEach((ty, i) => {
-        const pType = lifted && i === 0 ? null : fn.params[lifted ? i - 1 : i]!.type;
-        const refcounted = pType === null || isRefCounted(pType);
-        if (!refcounted) return;
-        dr.push(
-          `  %dp${i} = getelementptr inbounds %${pack}, ptr %ap, i64 0, i32 ${i}`,
-          `  %dv${i} = load ptr, ptr %dp${i}`,
-        );
-        if (pType === null) {
-          this.declare(`declare void @scr_closure_release(ptr)`);
-          dr.push(`  call void @scr_closure_release(ptr %dv${i})`);
-        } else {
-          dr.push(`  call void ${releaseSym(this.shapeHost, pType)}(ptr %dv${i})`);
-        }
-      });
-      dr.push(`  call void @free(ptr %ap)`, `  ret void`, `}`, ``);
-      for (const line of dr) out.push(line);
-
-      // An iterator helper's return() before its first next() closes the
-      // source generator in its first argument slot.
-      const closesSource = fn.generator.closesSource === true;
-      if (fn.generator.tag !== undefined) this.declare(`declare void @scr_gen_set_tag(ptr, ptr)`);
-      if (fn.generator.inheritsTag === true)
-        this.declare(`declare void @scr_gen_copy_tag(ptr, ptr)`);
-      if (closesSource) {
-        const field = lifted ? 1 : 0;
-        this.declare(`declare void @scr_gen_close(ptr)`);
-        this.declare(`declare void @scr_gen_set_unstarted_return(ptr, ptr)`);
-        out.push(
-          `define internal void @${mangleGenSourceClose(fn.name)}(ptr %ap) ${FN_ATTRS} {`,
-          `entry:`,
-          `  %sp = getelementptr inbounds %${pack}, ptr %ap, i64 0, i32 ${field}`,
-          `  %sv = load ptr, ptr %sp`,
-          `  call void @scr_gen_close(ptr %sv)`,
-          `  ret void`,
-          `}`,
-          ``,
-        );
-      }
-
-      // Spawn wrapper: pack the args (+1 moves in), allocate the
-      // SUSPENDED fiber — nothing runs until the first .next().
-      if (lifted) {
-        this.declare(`declare ptr @scr_closure_retain_v(ptr)`);
-      }
-      const sp: string[] = [
-        `define internal ptr @${mangleGenSpawn(fn.name)}(${spawnParams.join(", ")}) ${FN_ATTRS} { ; gen spawn ${fn.name}`,
-        `entry:`,
-        ...argPackLines,
-      ];
-      const genNew = coroBody && !this.wasi ? "scr_gen_new_stackless" : "scr_gen_new";
-      if (genNew !== "scr_gen_new") this.declare(`declare ptr @${genNew}(ptr, ptr, ptr)`);
-      sp.push(
-        settleAsync === null
-          ? `  %gg = call ptr @${genNew}(ptr @${mangleTrampoline(fn.name)}, ptr %ap, ptr @${mangleGenDrop(fn.name)})`
-          : `  %gg = call ptr @scr_async_gen_new(ptr @${mangleTrampoline(fn.name)}, ptr %ap, ptr @${mangleGenDrop(fn.name)}, ptr @${settleAsync})`,
-        ...(fn.generator.tag !== undefined
-          ? [`  call void @scr_gen_set_tag(ptr %gg, ptr ${this.cstr(fn.generator.tag)})`]
-          : []),
-        ...(fn.generator.inheritsTag === true
-          ? [`  call void @scr_gen_copy_tag(ptr %gg, ptr %a${lifted ? 1 : 0})`]
-          : []),
-        ...(closesSource
-          ? [
-              `  call void @scr_gen_set_unstarted_return(ptr %gg, ptr @${mangleGenSourceClose(fn.name)})`,
-            ]
-          : []),
-        `  ret ptr %gg`,
-        `}`,
-        ``,
-      );
-      for (const line of sp) out.push(line);
-    }
-    return out;
+  emitGenScaffolding(): string[] {
+    return emitGenScaffolding(this);
   }
 
   // ── plumbing (frame and scope ownership) ──────
@@ -5058,7 +2238,7 @@ export class LlEmitter {
     }
   }
 
-  private releaseScope(scope: LlScopeEntry[]): void {
+  releaseScope(scope: LlScopeEntry[]): void {
     for (const e of scope) {
       const t = this.B.tmp();
       this.B.line(`${t} = load ptr, ptr ${e.slot}`);
@@ -5087,7 +2267,7 @@ export class LlEmitter {
    * frames and entered scopes down to the given depths, innermost first —
    * everything whose normal fall-through releases the jump bypasses.
    * Release every scope crossed by the control-flow edge. */
-  private releaseForJump(frameDepth: number, scopeDepth: number): void {
+  releaseForJump(frameDepth: number, scopeDepth: number): void {
     for (let i = this.frames.length - 1; i >= frameDepth; i--) this.releaseTemps(this.frames[i]!);
     for (let i = this.scopes.length - 1; i >= scopeDepth; i--) this.releaseScope(this.scopes[i]!);
   }
@@ -5095,7 +2275,7 @@ export class LlEmitter {
   /** Run the finally regions an abrupt loop/block jump crosses, then
    * release to the already-resolved target. This is the return path's
    * completion walk without a parked result value. */
-  private emitFinallysForJump(finallyDepth: number, frameDepth: number, scopeDepth: number): void {
+  emitFinallysForJump(finallyDepth: number, frameDepth: number, scopeDepth: number): void {
     if (this.finallyStack.length <= finallyDepth) {
       this.releaseForJump(frameDepth, scopeDepth);
       return;
@@ -5129,7 +2309,7 @@ export class LlEmitter {
    * result of the function's own return type: with nothing to release, the
    * unwind returns it as the dummy, so a call in tail position keeps a single
    * return and stays eligible for tail-call and recursion elimination. */
-  private emitUnwind(passThrough?: string): void {
+  emitUnwind(passThrough?: string): void {
     if (this.mod.workers && this.tryStack.length > 0) {
       const stop = this.B.newLabel("context.stop");
       const ordinary = this.B.newLabel("context.throw");
@@ -5365,7 +2545,7 @@ export class LlEmitter {
 
   /** A recursive function's entry check: below the running stack's guard,
    * throw Node's RangeError and unwind like any other pending exception. */
-  private emitStackCheck(): void {
+  emitStackCheck(): void {
     const B = this.B;
     this.declare(`declare ptr @llvm.stacksave.p0()`);
     this.declare(`declare i1 @llvm.expect.i1(i1, i1)`);
@@ -5452,7 +2632,7 @@ export class LlEmitter {
     }
   }
 
-  private workerLoopBudget(
+  workerLoopBudget(
     loop: Extract<IrStmt, { kind: "while" | "doWhile" | "for" | "forOf" }>,
   ): string | null {
     if (!this.mod.workers) return null;
@@ -5464,128 +2644,16 @@ export class LlEmitter {
     this.B.line(`store i32 0, ptr ${slot}`);
     return slot;
   }
-
-  /** Emit a loop's condition, body and update through `emitCopy`, twice
-   * when speculative-integers.ts plans a fast integer copy. Both copies
-   * share the loop's setup and exit; the ordinary copy comes first so the
-   * fast copy is only emitted when every resume point exists. */
-  private emitLoopCopies(
+  emitLoopCopies(
     loop: Extract<IrStmt, { kind: "while" | "doWhile" | "for" }>,
     allowed: boolean,
     exit: string,
     emitCopy: (exit: string) => void,
   ): void {
-    const plan =
-      allowed &&
-      this.speculativeLoopsEnabled &&
-      this.speculation === null &&
-      this.speculationResume === null
-        ? planSpeculativeLoop(
-            loop,
-            (id) => this.speculativeLocal(id),
-            (id) => this.integerLoopBindings.has(id) || this.int32Locals.has(id),
-            (e) => {
-              const range = this.integerRanges.get(e);
-              return (
-                range !== undefined &&
-                range !== null &&
-                range.min >= -Number.MAX_SAFE_INTEGER &&
-                range.max <= Number.MAX_SAFE_INTEGER
-              );
-            },
-            (id) => this.speculativeLocal(id) || this.speculativeInvariantGlobal(id),
-          )
-        : null;
-    if (!plan) {
-      emitCopy(exit);
-      return;
-    }
-    const B = this.B;
-    const entries = new Map<string, string>();
-    let ok = "true";
-    for (const [id, live] of plan.locals) {
-      if (!live) continue;
-      const value = B.tmp();
-      B.line(`${value} = load double, ptr ${this.binding(id).slot}`);
-      const [integer, exact] = emitSafeIntegerCheck(this, value);
-      entries.set(id, integer);
-      if (ok === "true") ok = exact;
-      else {
-        const both = B.tmp();
-        B.line(`${both} = and i1 ${ok}, ${exact}`);
-        ok = both;
-      }
-    }
-    const fast = B.newLabel("spec.fast"),
-      slow = B.newLabel("spec.slow");
-    B.condBr(ok, fast, slow);
-    const resume = new Map<IrStmt, { label: string; placed: boolean }>();
-    for (const s of plan.writes) resume.set(s, { label: B.newLabel("spec.resume"), placed: false });
-    B.startBlock(slow);
-    this.speculationResume = resume;
-    try {
-      emitCopy(exit);
-    } finally {
-      this.speculationResume = null;
-    }
-    B.startBlock(fast);
-    if (![...resume.values()].every((r) => r.placed)) {
-      B.br(slow);
-      return;
-    }
-    for (const id of plan.locals.keys()) {
-      const shadow = B.slot();
-      B.entryAllocas.push(
-        `${shadow} = alloca i64 ; speculative integer ${this.currentLocals.get(id)?.name ?? id}`,
-      );
-      const entry = entries.get(id);
-      if (entry !== undefined) {
-        // The same double, now visibly an integer conversion: the double
-        // phis of the fast copy fold into integer phis.
-        const exact = B.tmp();
-        B.line(`store i64 ${entry}, ptr ${shadow}`);
-        B.line(`${exact} = sitofp i64 ${entry} to double`);
-        B.line(`store double ${exact}, ptr ${this.binding(id).slot}`);
-      } else B.line(`store i64 0, ptr ${shadow}`);
-      this.integerLoopBindings.set(id, {
-        slot: shadow,
-        type: "i64",
-        signed: true,
-        range: SPECULATIVE_RANGE,
-      });
-    }
-    // A global's store stays in the loop (calls may read it). When nothing
-    // in the loop can observe it, its double is written once on leaving the
-    // copy instead, so the loop keeps it in a register as the double copy
-    // would.
-    const deferred = new Set<string>();
-    // Worker loops also leave through their cancellation poll.
-    if (plan.observerFree && !this.mod.workers)
-      for (const s of plan.writes) {
-        const id = speculativeWriteTarget(s)!.localId;
-        if (!this.currentLocals.has(id)) deferred.add(id);
-      }
-    this.speculation = {
-      writes: plan.writes,
-      resume: new Map([...resume].map(([s, r]) => [s, r.label])),
-      deferred,
-    };
-    try {
-      if (deferred.size === 0) emitCopy(exit);
-      else {
-        const leave = B.newLabel("spec.leave");
-        emitCopy(leave);
-        B.startBlock(leave);
-        this.writeBackSpeculativeGlobals(deferred);
-        B.br(exit);
-      }
-    } finally {
-      this.speculation = null;
-      for (const id of plan.locals.keys()) this.integerLoopBindings.delete(id);
-    }
+    return emitLoopCopies(this, loop, allowed, exit, emitCopy);
   }
 
-  private writeBackSpeculativeGlobals(deferred: Set<string>): void {
+  writeBackSpeculativeGlobals(deferred: Set<string>): void {
     const B = this.B;
     for (const id of deferred) {
       const integer = B.tmp(),
@@ -5598,7 +2666,7 @@ export class LlEmitter {
 
   /** A number local whose only storage is its own double slot, so an i64
    * shadow beside it can stand for it within one loop. */
-  private speculativeLocal(id: string): boolean {
+  speculativeLocal(id: string): boolean {
     const local = this.currentLocals.get(id);
     if (!local) return this.speculativeGlobal(id);
     if (local.type.kind !== "f64" || local.boxed || local.tdz) return false;
@@ -5630,7 +2698,7 @@ export class LlEmitter {
   /** A module-level number a loop of any function only reads, written by
    * nothing but top-level code: an init function never runs during a loop
    * of another function, so the entry value stays its value. */
-  private speculativeInvariantGlobal(id: string): boolean {
+  speculativeInvariantGlobal(id: string): boolean {
     const writers = this.numberGlobalWriters(id);
     return writers !== null && [...writers].every((name) => name.startsWith("%init."));
   }
@@ -5664,65 +2732,8 @@ export class LlEmitter {
     }
     return this.globalWriters.get(id) ?? new Set<string>();
   }
-
-  /** A speculated write in the fast copy: compute the value as a safe
-   * integer, store it to the shadow and its exact double to the local.
-   * Any failed check re-executes the statement in the ordinary copy. */
   private emitSpeculativeWrite(s: IrStmt, resume: string): void {
-    const B = this.B;
-    const target = speculativeWriteTarget(s)!;
-    const binding = this.integerLoopBindings.get(target.localId)!;
-    const failed = B.newLabel("spec.bail");
-    let bails = false;
-    this.declare("declare i1 @llvm.expect.i1(i1, i1)");
-    const bail = (condition: string): void => {
-      if (condition === "false") return;
-      bails = true;
-      const expected = B.tmp();
-      B.line(`${expected} = call i1 @llvm.expect.i1(i1 ${condition}, i1 false)`);
-      const next = B.newLabel("spec.ok");
-      B.condBr(expected, failed, next);
-      B.startBlock(next);
-    };
-    // Heap reads come first, before any check, and release their temporaries
-    // at once: a bailing path then owns nothing, and reads have no effect
-    // whose reordering before the arithmetic could be observed.
-    const reads = new Map<IrExpr, LlValue>();
-    if (target.value !== null) {
-      this.frames.push([]);
-      for (const read of speculativeReads(target.value)) reads.set(read, this.emitExpr(read));
-      this.releaseTemps(this.frames.pop()!);
-    }
-    this.frames.push([]);
-    let result: string;
-    if (target.value === null) {
-      const old = B.tmp();
-      result = B.tmp();
-      B.line(`${old} = load i64, ptr ${binding.slot}`);
-      B.line(`${result} = ${target.op === "+" ? "add" : "sub"} nsw i64 ${old}, 1`);
-      const biased = B.tmp(),
-        outside = B.tmp();
-      B.line(`${biased} = add i64 ${result}, ${Number.MAX_SAFE_INTEGER}`);
-      B.line(`${outside} = icmp ugt i64 ${biased}, ${2 * Number.MAX_SAFE_INTEGER}`);
-      bail(outside);
-    } else result = emitSpeculativeInteger(this, target.value, bail, reads);
-    // Speculable values read only numbers past this point.
-    if (this.frames.pop()!.length > 0)
-      throw new InternalCompilerError("llvm emitter bug: speculative write owns a temporary");
-    B.line(`store i64 ${result}, ptr ${binding.slot}`);
-    const deferred = this.speculation!.deferred;
-    if (!deferred.has(target.localId)) {
-      const number = B.tmp();
-      B.line(`${number} = sitofp i64 ${result} to double`);
-      B.line(`store double ${number}, ptr ${this.binding(target.localId).slot}`);
-    }
-    if (!bails) return;
-    const done = B.newLabel("spec.done");
-    B.br(done);
-    B.startBlock(failed);
-    this.writeBackSpeculativeGlobals(deferred);
-    B.br(resume);
-    B.startBlock(done);
+    return emitSpeculativeWrite(this, s, resume);
   }
 
   /** The amortized cancellation poll, emitted on the loop's back edge (the
@@ -5730,7 +2741,7 @@ export class LlEmitter {
    * exit ahead of the body; LLVM then cannot rotate the loop, so loads that
    * the body repeats on every iteration (a typed array's length, for one)
    * stay in the loop. */
-  private emitWorkerLoopCheck(slot: string | null): void {
+  emitWorkerLoopCheck(slot: string | null): void {
     if (slot === null) return;
     const B = this.B;
     const budget = B.tmp(),
@@ -5881,6 +2892,8 @@ export class LlEmitter {
       // Process streams use a numeric descriptor internally, including zero
       // for stdin. They remain JavaScript objects in boolean contexts.
       case "procStream":
+      // A module namespace object is always present.
+      case "moduleNs":
         return "true";
       case "array":
       case "record":
@@ -5927,6 +2940,8 @@ export class LlEmitter {
         B.line(`${truthy} = call zeroext i1 @scr_dyn_truthy(ptr ${valueName})`);
         return truthy;
       }
+      case "jsval":
+        return jsTruthy(this, valueName);
       default:
         throw new LlvmUnsupportedError(`truthy:${unionArm ? "union:" : ""}${kind}`);
     }
@@ -6356,7 +3371,7 @@ export class LlEmitter {
     };
   }
 
-  private emitDebugLocal(local: IrLocal, slot: string, arg = 0, captured = false): void {
+  emitDebugLocal(local: IrLocal, slot: string, arg = 0, captured = false): void {
     const debug = this.debug?.local(local, this.debugScope, arg, captured);
     if (!debug) return;
     this.declare("declare void @llvm.dbg.declare(metadata, metadata, metadata)");
@@ -6373,7 +3388,7 @@ export class LlEmitter {
   }
 
   /** The payload slot of a capture box (ScrBox.slot, field 5). */
-  private boxSlot(box: string): string {
+  boxSlot(box: string): string {
     const slot = this.B.tmp();
     this.B.line(`${slot} = getelementptr inbounds %ScrBox, ptr ${box}, i32 0, i32 5`);
     return slot;
@@ -6452,7 +3467,7 @@ export class LlEmitter {
   /** The initializing write of a scalar TDZ box: mint the one-element
    * array cell holding the value and move it into the ARR-kind box
    * (set_ref releases nothing — the slot was the empty sentinel). */
-  private tdzScalarInit(box: string, t: IrType, value: string): void {
+  tdzScalarInit(box: string, t: IrType, value: string): void {
     const B = this.B;
     const acc = boxAccess(t);
     const cell = B.tmp();
@@ -6468,7 +3483,7 @@ export class LlEmitter {
    * read back as the temporal dead zone; such boxes start at the module's
    * immortal NULLABLE_ABSENT sentinel instead, which no value of the
    * binding can hold and every RC entry point and the collector skip. */
-  private tdzEmptySentinel(t: IrType): string | null {
+  tdzEmptySentinel(t: IrType): string | null {
     if (!this.nullableUnions.of(t)) return null;
     this.needsNullableAbsent = true;
     this.immortalValues.add(NULLABLE_ABSENT);
@@ -6752,75 +3767,13 @@ export class LlEmitter {
     );
     this.B.startBlock(resume);
   }
-
-  /** Move a clean async return value into the current fiber's promise. */
-  private emitWasiFulfill(v: LlValue | null): void {
-    const coro = this.currentCoro;
-    if (coro === null)
-      throw new InternalCompilerError("llvm emitter bug: wasm fulfillment outside async body");
-    const ret = this.currentReturnType;
-    if (coro.kind === "generator") {
-      this.declare(`declare ptr @scr_gen_of_fiber(ptr)`);
-      const gen = this.B.tmp();
-      this.B.line(`${gen} = call ptr @scr_gen_of_fiber(ptr ${coro.self})`);
-      switch (ret.kind) {
-        case "void":
-          return;
-        case "f64":
-        case "date":
-          this.declare(`declare void @scr_gen_out_f64(ptr, double)`);
-          this.B.line(`call void @scr_gen_out_f64(ptr ${gen}, double ${v!.name})`);
-          return;
-        case "bool":
-          this.declare(`declare void @scr_gen_out_bool(ptr, i1 zeroext)`);
-          this.B.line(`call void @scr_gen_out_bool(ptr ${gen}, i1 ${v!.name})`);
-          return;
-        default:
-          this.declare(`declare void @scr_gen_out_ref(ptr, ptr, ptr)`);
-          this.B.line(
-            `call void @scr_gen_out_ref(ptr ${gen}, ptr ${v!.name}, ptr ${vAdapters(this.shapeHost, ret).release})`,
-          );
-          return;
-      }
-    }
-    this.declare(`declare ptr @scr_fiber_promise(ptr)`);
-    const pr = this.B.tmp();
-    this.B.line(`${pr} = call ptr @scr_fiber_promise(ptr ${coro.self})`);
-    switch (ret.kind) {
-      case "void":
-        this.declare(`declare void @scr_promise_fulfill_void(ptr)`);
-        this.B.line(`call void @scr_promise_fulfill_void(ptr ${pr})`);
-        break;
-      case "f64":
-      case "date":
-        this.declare(`declare void @scr_promise_fulfill_f64(ptr, double)`);
-        this.B.line(`call void @scr_promise_fulfill_f64(ptr ${pr}, double ${v!.name})`);
-        break;
-      case "bool":
-        this.declare(`declare void @scr_promise_fulfill_bool(ptr, i1 zeroext)`);
-        this.B.line(`call void @scr_promise_fulfill_bool(ptr ${pr}, i1 ${v!.name})`);
-        break;
-      case "string":
-        this.declare(`declare void @scr_promise_fulfill_str(ptr, ptr)`);
-        this.B.line(`call void @scr_promise_fulfill_str(ptr ${pr}, ptr ${v!.name}) ; moves in`);
-        break;
-      case "dyn":
-        this.declare(`declare void @scr_promise_resolve_dyn(ptr, ptr)`);
-        this.B.line(`call void @scr_promise_resolve_dyn(ptr ${pr}, ptr ${v!.name}) ; moves in`);
-        break;
-      default: {
-        const rc = vAdapters(this.shapeHost, ret);
-        this.declare(`declare void @scr_promise_fulfill_ref(ptr, ptr, ptr, ptr, ptr)`);
-        this.B.line(
-          `call void @scr_promise_fulfill_ref(ptr ${pr}, ptr ${v!.name}, ptr ${rc.retain}, ptr ${rc.release}, ptr ${traceArg(this.shapeHost, ret)})`,
-        );
-      }
-    }
+  emitWasiFulfill(v: LlValue | null): void {
+    return emitWasiFulfill(this, v);
   }
 
   /** Number locals declared as a copy of a capture or of a lazily boxed
    * parameter, at the top of the body. */
-  private doubleCopies(fn: IrFunction): string[] {
+  doubleCopies(fn: IrFunction): string[] {
     const copies: string[] = [];
     for (const s of fn.body) {
       if (s.kind !== "varDecl") break;
@@ -6830,596 +3783,14 @@ export class LlEmitter {
     }
     return copies;
   }
-
-  private emitFunction(fn: IrFunction): string {
-    const B = new BlockBuilder();
-    this.B = B;
-    this.currentFunctionName = fn.name;
-    // Fiber switches restore the active exception cell before control
-    // returns to a synchronous frame (emitPendingCheck).
-    B.excCellInvariant = fn.async !== true && fn.generator === undefined;
-    this.debugScope = this.debug?.function(fn) ?? null;
-    B.debugLocation = this.debug?.location(fn.loc, this.debugScope) ?? null;
-    this.frames = [];
-    this.scopes = [];
-    this.unwindCleanups.clear();
-    this.jumpTargets = [];
-    this.currentLocals = new Map(fn.locals.map((l) => [l.id, l]));
-    this.lazyCaptureBoxes.clear();
-    this.lazyStackBoxes.clear();
-    // An unchanged captured parameter keeps its value in a plain slot; the
-    // binding is boxed only for closures (captureBox).
-    const lazyParameters = this.lazyCaptures.parameters(fn);
-    for (const id of lazyParameters) {
-      const { boxed: _boxed, ...plain } = this.currentLocals.get(id)!;
-      this.currentLocals.set(id, plain);
-      this.lazyCaptureBoxes.set(id, "");
-    }
-    this.currentConstantCallbacks =
-      this.debug === null ? (this.constantCallbacks.get(fn.name) ?? new Map()) : new Map();
-    // Preserve concrete source bindings for debugger inspection. Suspended
-    // functions keep the established array lifetime across continuations.
-    this.streamingSplitsEnabled = this.debug === null && !fn.async && !fn.generator;
-    this.stackCallbacks.reset(this.streamingSplitsEnabled);
-    this.stackCaptures.reset(fn, this.streamingSplitsEnabled, lazyParameters);
-    this.privateSplitLocals = this.streamingSplitsEnabled ? findPrivateSplitLocals(fn) : new Map();
-    this.storedSplits.clear();
-    this.splitSpans.clear();
-    this.stringSlices.clear();
-    const initializerBindings = this.initializerBindings.get(fn.name) ?? [];
-    const numericFn = withInitializerBindings(fn, initializerBindings);
-    this.numericLocals = new Map(numericFn.locals.map((l) => [l.id, l]));
-    this.unaliasedArrays = findUnaliasedLocalArrays(fn);
-    this.borrowedParameters.clear();
-    this.referenceWrites?.enter(fn);
-    this.reboundOwnerSlots.clear();
-    this.projectedParameters.clear();
-    const projectedParameterIndexes = this.callLifetimes.parameters.get(fn.name);
-    if (projectedParameterIndexes)
-      for (const index of projectedParameterIndexes)
-        this.projectedParameters.add(fn.params[index]!.localId);
-    this.stableCallBindings = this.callLifetimes.bindings.get(fn.name) ?? new Set();
-    const borrowedParameterIndexes = this.callLifetimes.borrowed.get(fn.name);
-    if (borrowedParameterIndexes) {
-      // Rebound walk parameters borrow too, but only unchanged ones may
-      // serve as stable owners for call arguments and aliases.
-      for (const index of borrowedParameterIndexes)
-        if (
-          !this.walkBorrowsByFunction.get(fn.name)?.has(fn.params[index]!.localId) &&
-          !this.reboundByFunction.get(fn.name)?.has(fn.params[index]!.localId)
-        )
-          this.borrowedParameters.add(fn.params[index]!.localId);
-    }
-    // A generator frame owns its unchanged parameters across suspensions.
-    const generatorParameters = this.callLifetimes.generatorParameters.get(fn.name);
-    if (generatorParameters !== undefined)
-      for (const id of generatorParameters) this.borrowedParameters.add(id);
-    this.captureIds = new Set(
-      [...(fn.captures ?? []), ...(fn.classCaptures ?? [])].map((c) => c.localId),
-    );
-    this.stableCaptureIds =
-      fn.captures !== undefined ? this.lazyCaptures.stableCaptures(fn.name) : new Set();
-    this.integerLoopBindings.clear();
-    this.countedLoopsEnabled = this.debug === null && !fn.async && !fn.generator;
-    this.speculativeLoopsEnabled = this.countedLoopsEnabled;
-    this.speculativeFunction = fn.name;
-    this.speculation = null;
-    this.speculationResume = null;
-    this.finalFieldBorrows =
-      !fn.async && !fn.generator && constructorClass(fn.name) === null && this.finalFields.size > 0;
-    this.byteWindowsEnabled = this.countedLoopsEnabled;
-    this.denseLoopsEnabled = this.countedLoopsEnabled;
-    this.denseLoop = null;
-    this.denseLoopEntries =
-      this.denseLoopsEnabled && numericFn.locals.some((l) => l.type.kind === "array")
-        ? findInitializedByteLoopBindings(fn)
-        : new Map();
-    this.byteWindowEntries =
-      this.byteWindowsEnabled && numericFn.locals.some((l) => l.type.kind === "bytes")
-        ? findInitializedByteLoopBindings(fn)
-        : new Map();
-    this.integerViews.clear();
-    this.fieldPointerTags.clear();
-    this.integerArrayBindings.clear();
-    this.loopArrayBorrows =
-      this.debug === null
-        ? findLoopArrayBorrows(
-            fn,
-            this.callLifetimes,
-            this.referenceEffects,
-            this.optionalArrayReads,
-            this.referenceWrites,
-            this.fnByName,
-          )
-        : new Set();
-    this.localArrayReads = findLocalArrayReads(
-      fn,
-      this.fnByName,
-      this.unionsById,
-      this.referenceEffects.functions,
-      this.callLifetimes,
-      this.optionalArrayReads,
-      this.loopArrayBorrows,
-      this.debug === null ? this.referenceEffects : undefined,
-    );
-    this.callArrayReads = findCallArrayReads(
-      fn,
-      this.optionalArrayReads,
-      this.referenceEffects.functions,
-      this.callLifetimes,
-      this.debug === null ? this.referenceEffects : undefined,
-    );
-    this.scalarStringSlices =
-      this.debug === null ? findScalarStringSlices(fn, this.callLifetimes) : new Map();
-    this.scratchStringSlices =
-      this.debug === null
-        ? findScratchStringSlices(
-            fn,
-            this.callLifetimes,
-            this.scalarStringSlices,
-            this.lentStringParameters,
-          )
-        : new Set();
-    this.mapReadLifetimes = findMapReadLifetimes(fn, this.boxedUnionsById, this.callLifetimes);
-    this.readNumberMapWrites = findReadNumberMapWrites(fn);
-    this.mapEntryFusion = this.debug === null ? findMapEntryFusions(fn) : null;
-    this.localStackUnions = findLocalStackUnions(fn, this.callLifetimes, this.boxedUnionsById);
-    this.localStackObjects = this.stackObjects
-      ? findLocalStackObjects(this, fn, this.callLifetimes)
-      : new Map();
-    this.reassignedStackObjects = this.stackObjects
-      ? findReassignedStackObjects(this, fn, this.callLifetimes)
-      : new Set();
-    this.stackObjectSlots = new Map();
-    this.stackObjectFieldPtrs = new Map();
-    this.localUnionStorageProofs = findLocalUnionStorage(fn, this.callLifetimes, this.unionSources);
-    this.localUnionStorage = new Map();
-    this.walkBorrows = this.walkBorrowsByFunction.get(fn.name) ?? new Set();
-    const slotFacts = this.int32Slots.facts(fn.name);
-    this.integerRanges = analyzeIntegerRanges(numericFn, slotFacts);
-    this.int32Elements = slotFacts.elements ?? null;
-    this.bytesBounds = findBytesBounds(numericFn, this.integerRanges);
-    // Debug builds keep every number local a double for the debugger's
-    // variable view. Lazily boxed captured parameters keep their double,
-    // which the box is created from, and so do plain copies of a capture or
-    // such a parameter (copyStableCaptures): the source already holds the
-    // double, which an i32 copy would convert and widen again on every call.
-    // Initializer bindings proven int32 move into an i32 local of their
-    // initializer: no other code observes the global, so the loop-carried
-    // value never round-trips through the double slot.
-    const initializerLocals = initializerLocalCandidates(initializerBindings);
-    const int32Locals =
-      this.debug === null
-        ? findInt32Locals(
-            withInitializerLocals(fn, initializerLocals),
-            this.integerRanges,
-            this.int32Slots.facts(fn.name),
-            new Set([...this.lazyCaptureBoxes.keys(), ...this.doubleCopies(fn)]),
-          )
-        : null;
-    this.int32Locals = int32Locals?.locals ?? new Map();
-    this.int32LocalWrites = int32Locals?.values ?? new Set();
-    const localizedGlobals = new Set<string>();
-    for (const global of initializerLocals) {
-      if (!this.int32Locals.has(global.id)) continue;
-      localizedGlobals.add(global.id);
-      this.currentLocals.set(global.id, {
-        id: global.id,
-        name: global.name,
-        type: global.type,
-        mutable: global.mutable,
-      });
-    }
-    this.chainSlots.clear();
-    this.finallyStack = [];
-    this.tryStack = [];
-    this.loopDepth = 0;
-    this.currentReturnType = fn.returnType;
-    const int32Abi = this.int32Abis.get(fn.name);
-    this.currentInt32Result = int32Abi?.result === true;
-    this.currentUnionResult = int32Abi?.union === true;
-    this.currentGenerator = fn.generator ?? null;
-    this.currentAsyncGenerator = fn.async === true && fn.generator !== undefined;
-    this.currentBorrowedReturn = this.borrowedReturns.has(fn.name);
-    this.lastUseMoves.clear();
-    this.varRefCounts = null;
-    this.currentFunctionBody = fn.body;
-    this.inConstructor = this.constructorFunctions.has(fn.name);
-    this.currentCoro = null;
-    this.logArgSlots = 0;
-
-    if (this.coroLowered(fn)) {
-      this.usesCoroutines = true;
-      this.declare(`declare token @llvm.coro.id(i32, ptr, ptr, ptr)`);
-      this.declare(`declare ${this.sizeType} @llvm.coro.size.${this.sizeType}()`);
-      this.declare(`declare ptr @llvm.coro.begin(token, ptr)`);
-      this.declare(`declare token @llvm.coro.save(ptr)`);
-      this.declare(`declare i8 @llvm.coro.suspend(token, i1)`);
-      this.declare(`declare ptr @llvm.coro.free(token, ptr)`);
-      this.declare(`declare void @llvm.coro.end(ptr, i1, token)`);
-      // Native frames come from the runtime's small-block allocator.
-      const frameAlloc = this.wasi ? "malloc" : "scr_rt_calloc";
-      this.declare(`declare ptr @${frameAlloc}(${this.sizeType})`);
-      this.declare(`declare void @${this.wasi ? "free" : "scr_rt_free"}(ptr)`);
-      const started = this.wasi ? "scr_wasi_coro_started" : "scr_coro_started";
-      this.declare(`declare void @${started}(ptr)`);
-      this.declare(`declare ptr @scr_fiber_self()`);
-      const id = B.tmp();
-      const size = B.tmp();
-      const mem = B.tmp();
-      const handle = B.tmp();
-      const self = B.tmp();
-      B.line(`${id} = call token @llvm.coro.id(i32 0, ptr null, ptr null, ptr null)`);
-      B.line(`${size} = call ${this.sizeType} @llvm.coro.size.${this.sizeType}()`);
-      B.line(`${mem} = call ptr @${frameAlloc}(${this.sizeType} ${size})`);
-      B.line(`${handle} = call ptr @llvm.coro.begin(token ${id}, ptr ${mem})`);
-      B.line(`call void @${started}(ptr ${handle})`);
-      B.line(`${self} = call ptr @scr_fiber_self()`);
-      // A native synchronous body owns its generator for the whole run (the
-      // ScrGen owns the frame), so its OUT slot address is fixed.
-      let out: string | null = null;
-      const yieldKind = fn.generator?.yieldT.kind;
-      if (
-        !this.wasi &&
-        fn.async !== true &&
-        (yieldKind === "f64" || yieldKind === "date" || yieldKind === "bool")
-      ) {
-        this.declare(`declare ptr @scr_gen_of_fiber(ptr)`);
-        const gen = B.tmp();
-        B.line(`${gen} = call ptr @scr_gen_of_fiber(ptr ${self})`);
-        out = this.genOutSlot(gen);
-      }
-      this.currentCoro = {
-        kind: fn.generator !== undefined ? "generator" : "async",
-        id,
-        handle,
-        self,
-        finalLabel: B.newLabel("coro.final"),
-        cleanupLabel: B.newLabel("coro.cleanup"),
-        suspendLabel: B.newLabel("coro.suspend"),
-        out,
-      };
-    }
-
-    const paramIds = new Set(fn.params.map((p) => p.localId));
-    if (this.debug === null) {
-      for (const id of findIntegerViews(numericFn)) {
-        // An i32 slot is its own view.
-        if (this.int32Locals.has(id)) continue;
-        const slot = B.slot();
-        B.entryAllocas.push(
-          `${slot} = alloca i32 ; integer view ${this.numericLocals.get(id)!.name}`,
-        );
-        this.integerViews.set(id, slot);
-      }
-    }
-    for (const global of initializerBindings) {
-      if (!this.integerViews.has(global.id)) continue;
-      const value = B.tmp();
-      B.line(`${value} = load double, ptr @${mangleGlobal(global.id)}`);
-      this.storeIntegerView(global.id, { name: value, type: global.type });
-    }
-    // A number global only its guarded, synchronous initializer reads or
-    // writes (findInitializerBindings) is invisible to every other function,
-    // and reentry returns before reaching it, so a local slot can stand in
-    // for it: LLVM keeps it in a register across calls and loops that would
-    // otherwise force a store and reload per iteration. The global's
-    // storage is never read again, so nothing writes the slot back. Bindings
-    // proven int32 already live in an i32 local (localizedGlobals above);
-    // this covers the remaining doubles.
-    this.privateGlobalSlots.clear();
-    if (this.debug === null && this.currentCoro === null && !fn.async && !fn.generator) {
-      const conditional = initializerLocals.length ? conditionalLoopWrites(fn.body) : null;
-      for (const global of initializerLocals) {
-        if (localizedGlobals.has(global.id)) continue;
-        // A conditional update in a loop stays a memory update (see
-        // conditionalLoopWrites).
-        if (conditional?.has(global.id)) continue;
-        const slot = B.slot();
-        const value = B.tmp();
-        B.entryAllocas.push(`${slot} = alloca double ; module binding ${global.name}`);
-        B.line(`${value} = load double, ptr @${mangleGlobal(global.id)}`);
-        B.line(`store double ${value}, ptr ${slot}`);
-        this.privateGlobalSlots.set(global.id, slot);
-      }
-    }
-    for (const local of this.currentLocals.values()) {
-      // Boxed locals' slots hold their capture BOX (a ptr); captured
-      // (env-borrowed) locals bind the incoming box below. A caught-typed
-      // local is a catch binding: its slot holds the ScrCaught snapshot
-      // box the catch prologue takes (scr_exc_take).
-      const slotTy =
-        local.boxed || this.captureIds.has(local.id) || local.type.kind === "caught"
-          ? "ptr"
-          : this.int32Locals.has(local.id)
-            ? "i32"
-            : this.llType(local.type);
-      B.entryAllocas.push(`%${mangleLocal(local.id)} = alloca ${slotTy} ; ${local.name}`);
-      this.emitDebugLocal(
-        local,
-        `%${mangleLocal(local.id)}`,
-        fn.params.findIndex((p) => p.localId === local.id) + 1,
-        this.captureIds.has(local.id),
-      );
-      // A localized initializer binding starts at its global's zero value.
-      if (localizedGlobals.has(local.id)) B.line(`store i32 0, ptr %${mangleLocal(local.id)}`);
-      // Refcounted/boxed locals start NULL (the C prologue's `= NULL`):
-      // scope-exit releases run whether or not an assign ever did.
-      if (paramIds.has(local.id) || this.captureIds.has(local.id)) continue;
-      if (local.boxed || isRefCounted(local.type)) {
-        B.line(`store ptr null, ptr %${mangleLocal(local.id)}`);
-      }
-    }
-    // A body holding thousands of capture boxes compiles unoptimized, its
-    // box pointers kept in their slots (see boxSlotCount).
-    const unoptimized = this.currentCoro === null && boxSlotCount(fn) >= UNOPTIMIZED_BOX_SLOTS;
-    if (unoptimized) {
-      const slots = new Set<string>();
-      for (const local of this.currentLocals.values())
-        if (local.boxed || this.captureIds.has(local.id)) slots.add(`%${mangleLocal(local.id)}`);
-      B.volatileSlots = slots;
-    }
-    // Captured bindings come in through the environment — borrowed for the
-    // whole call (the closure owns them): bound here, never released here.
-    (fn.captures ?? []).forEach((c, i) => {
-      const caps = B.tmp();
-      const p = B.tmp();
-      const box = B.tmp();
-      B.line(`${caps} = getelementptr inbounds %ScrClosure, ptr %sc_env, i64 1 ; caps`);
-      B.line(`${p} = getelementptr inbounds ptr, ptr ${caps}, ${this.sizeType} ${i} ; caps[${i}]`);
-      B.line(`${box} = load ptr, ptr ${p}`);
-      B.line(`store ptr ${box}, ptr %${mangleLocal(c.localId)} ; captured ${c.name}`);
-    });
-    (fn.classCaptures ?? []).forEach((c) => {
-      const self = fn.params[0]!;
-      if (self.type.kind !== "object")
-        throw new InternalCompilerError("class captures require an instance receiver");
-      const classSlot = B.tmp();
-      const classValue = B.tmp();
-      const caps = B.tmp();
-      const slot = B.tmp();
-      const box = B.tmp();
-      B.line(
-        `${classSlot} = getelementptr inbounds %${mangleClassStruct(self.type.className)}, ptr %p_${mangleLocal(self.localId)}, i64 0, i32 ${classEnvironmentIndex(this.classMeta.get(self.type.className)!)}`,
-      );
-      B.line(`${classValue} = load ptr, ptr ${classSlot}`);
-      B.line(`${caps} = getelementptr inbounds %ScrClassObj, ptr ${classValue}, i64 1`);
-      B.line(`${slot} = getelementptr inbounds ptr, ptr ${caps}, ${this.sizeType} ${c.slot}`);
-      B.line(`${box} = load ptr, ptr ${slot}`);
-      B.line(`store ptr ${box}, ptr %${mangleLocal(c.localId)} ; class capture ${c.name}`);
-    });
-    // Params spill into their slots; the function scope owns refcounted
-    // params (callees own their params — callers passed +1). Boxed params
-    // allocate the shared binding and move the raw value in.
-    const fnScope: LlScopeEntry[] = [];
-    for (const id of this.lazyCaptureBoxes.keys()) {
-      const cache = B.slot();
-      B.entryAllocas.push(`${cache} = alloca ptr ; lazy box ${this.currentLocals.get(id)!.name}`);
-      B.line(`store ptr null, ptr ${cache}`);
-      fnScope.push({
-        slot: cache,
-        type: this.currentLocals.get(id)!.type,
-        boxed: true,
-        lazy: true,
-      });
-      this.lazyCaptureBoxes.set(id, cache);
-      // Environments that finish during the call can share an immortal
-      // frame box. Its payload owner is released with the function scope.
-      const stack = this.stackCaptures.emit(this, id, this.currentLocals.get(id)!.type);
-      if (stack) {
-        this.lazyStackBoxes.set(id, stack.box);
-        if (stack.owner) fnScope.push(stack.owner);
-      }
-    }
-    const borrowed = this.callLifetimes.borrowed.get(fn.name);
-    for (const [index, p] of fn.params.entries()) {
-      const local = this.currentLocals.get(p.localId)!;
-      const slot = `%${mangleLocal(p.localId)}`;
-      if (local.boxed) {
-        const box = B.tmp();
-        B.line(`${box} = ${boxNewCall(this.shapeHost, p.type)} ; ${p.name} (boxed param)`);
-        this.boxSet(box, p.type, `%p_${mangleLocal(p.localId)}`);
-        B.line(`store ptr ${box}, ptr ${slot}`);
-        fnScope.push({ slot, type: p.type, boxed: true });
-        continue;
-      }
-      const incoming: LlValue = { name: `%p_${mangleLocal(p.localId)}`, type: p.type };
-      if (int32Abi?.params[index]) {
-        const bits = `%p_${mangleLocal(p.localId)}${INT32_ABI_SUFFIX}`;
-        incoming.uint32 = bits;
-        incoming.integer = { name: bits, type: "i32", signed: true, range: INT32_RANGE };
-      }
-      if (this.storeInt32Local(p.localId, incoming)) continue;
-      B.line(`store ${this.llType(p.type)} %p_${mangleLocal(p.localId)}, ptr ${slot}`);
-      this.storeIntegerView(p.localId, incoming);
-      if (isRefCounted(p.type) && !borrowed?.has(index)) {
-        fnScope.push({ slot, type: p.type });
-        this.noteParameterMove(fn, p.localId, slot);
-      }
-      if (this.reboundByFunction.get(fn.name)?.has(p.localId) && borrowed?.has(index)) {
-        // The caller's borrow stays in the parameter slot; values the body
-        // assigns are owned here until rebinding or exit releases them.
-        const owner = `${slot}.owner`;
-        B.entryAllocas.push(`${owner} = alloca ptr`);
-        B.line(`store ptr null, ptr ${owner}`);
-        fnScope.push({ slot: owner, type: p.type });
-        this.reboundOwnerSlots.set(p.localId, owner);
-      }
-    }
-    this.scopes.push(fnScope);
-    // Stackful native fibers and native coroutine frames retain these frames
-    // while suspended. The active exception context owns the chain, so
-    // concurrent fibers isolate it.
-    if (
-      this.stackTraces &&
-      !this.wasi &&
-      fn.sourceName !== undefined &&
-      !this.unframedFunctions.has(fn.name)
-    ) {
-      B.entryAllocas.push(`%source_frame = alloca { ptr, ptr }`);
-      const frame = this.cstr(`    at ${fn.sourceName} (${fn.loc.file})`);
-      if (
-        B.excCellInvariant &&
-        this.mod.lib === undefined &&
-        this.mod.workers !== true &&
-        this.sizeType === "i64"
-      ) {
-        // Executables link the active-cell pointer as a plain global, and a
-        // synchronous body sees one cell from entry to every return: push
-        // and pop the frame inline (ScrExcCell.stack is at byte 56 on
-        // 64-bit targets) instead of calling the runtime twice per call.
-        this.declare(`@scr_exc_active = external global ptr`);
-        B.line(`%source_frame.cell = load ptr, ptr @scr_exc_active`);
-        B.line(`%source_frame.chain = getelementptr inbounds i8, ptr %source_frame.cell, i64 56`);
-        B.line(`%source_frame.previous = load ptr, ptr %source_frame.chain`);
-        B.line(`store ptr %source_frame.previous, ptr %source_frame`);
-        B.line(`%source_frame.text = getelementptr inbounds i8, ptr %source_frame, i64 8`);
-        B.line(`store ptr ${frame}, ptr %source_frame.text`);
-        B.line(`store ptr %source_frame, ptr %source_frame.chain`);
-        B.returnEpilogue = `store ptr %source_frame.previous, ptr %source_frame.chain`;
-      } else {
-        this.declare(`declare void @scr_stack_enter(ptr, ptr)`);
-        this.declare(`declare void @scr_stack_leave(ptr)`);
-        B.line(`call void @scr_stack_enter(ptr %source_frame, ptr ${frame})`);
-        B.returnEpilogue = `call void @scr_stack_leave(ptr %source_frame)`;
-      }
-    }
-    if (this.stackChecks?.has(fn.name)) this.emitStackCheck();
-    if (this.workerEntryPolls?.has(fn.name)) this.emitPendingCheck(undefined, true);
-    this.emitStmts(fn.body, true);
-    // Implicit exit of a void function: release the function scope unless
-    // the body already terminated its final block (return, or a throw
-    // whose unwind released everything down to depth 0).
-    if (fn.returnType.kind === "void" && !B.isTerminated()) {
-      this.releaseScope(this.scopes[0]!);
-      // Completing by falling off the end has nothing to await.
-      if (this.currentAsyncGenerator) this.emitAsyncGenSettled();
-      if (this.currentCoro !== null) {
-        this.emitWasiFulfill(null);
-        B.terminate(`br label %${this.currentCoro.finalLabel}`);
-      } else {
-        B.terminate("ret void");
-      }
-    }
-    this.scopes.pop();
-
-    const coro = this.currentCoro;
-    if (coro !== null) {
-      B.startBlock(coro.finalLabel);
-      // Every exit of a coroutine body joins here: its source frame (part
-      // of the coroutine frame) leaves the generator's own chain.
-      const epilogue = B.returnEpilogue;
-      B.returnEpilogue = null;
-      if (epilogue !== null) B.line(epilogue);
-      if (fn.captures !== undefined) {
-        this.declare(`declare void @scr_closure_release(ptr)`);
-        B.line(`call void @scr_closure_release(ptr %sc_env)`);
-      }
-      if (coro.kind === "generator") {
-        const finish = this.wasi ? "scr_wasi_gen_finish" : "scr_gen_coro_finish";
-        this.declare(`declare void @${finish}(ptr)`);
-        B.line(`call void @${finish}(ptr ${coro.self})`);
-      } else {
-        const finish = this.wasi ? "scr_wasi_async_finish" : "scr_coro_async_finish";
-        this.declare(`declare void @${finish}(ptr)`);
-        B.line(`call void @${finish}(ptr ${coro.self})`);
-      }
-      const finalState = B.tmp();
-      B.line(`${finalState} = call i8 @llvm.coro.suspend(token none, i1 true)`);
-      B.terminate(
-        `switch i8 ${finalState}, label %${coro.suspendLabel} [ i8 1, label %${coro.cleanupLabel} ]`,
-      );
-      B.startBlock(coro.cleanupLabel);
-      const frame = B.tmp();
-      B.line(`${frame} = call ptr @llvm.coro.free(token ${coro.id}, ptr ${coro.handle})`);
-      B.line(`call void @${this.wasi ? "free" : "scr_rt_free"}(ptr ${frame})`);
-      B.br(coro.suspendLabel);
-      B.startBlock(coro.suspendLabel);
-      B.line(`call void @llvm.coro.end(ptr ${coro.handle}, i1 false, token none)`);
-      const ret = this.llType(fn.returnType);
-      if (ret === "void") B.terminate(`ret void`);
-      else if (ret === "double") B.terminate(`ret double ${f64Lit(0)}`);
-      else if (ret === "i1") B.terminate(`ret i1 false`);
-      else B.terminate(`ret ptr null`);
-    }
-
-    // Shared blocks have multiple source locations. Keep the location on
-    // each incoming exception check instead of assigning one to the cleanup.
-    B.debugLocation = null;
-    for (const cleanup of this.unwindCleanups.values()) {
-      B.startBlock(cleanup.label);
-      this.releaseScope(cleanup.entries);
-      B.terminate(cleanup.terminator);
-    }
-
-    if (this.logArgSlots > 0) {
-      B.entryAllocas.push(`%logargs = alloca [${this.logArgSlots} x %ScrLogArg]`);
-    }
-    const params = fn.params.map((p, index) =>
-      int32Abi?.params[index]
-        ? `i32 %p_${mangleLocal(p.localId)}${INT32_ABI_SUFFIX}`
-        : `${this.llType(p.type)} %p_${mangleLocal(p.localId)}`,
-    );
-    // The i32 entry widens its i32 parameters once; the proof makes the
-    // double exact, so readers of the incoming number see the same value.
-    if (int32Abi)
-      fn.params.forEach((p, index) => {
-        if (!int32Abi.params[index]) return;
-        const name = `%p_${mangleLocal(p.localId)}`;
-        B.entryAllocas.push(`${name} = sitofp i32 ${name}${INT32_ABI_SUFFIX} to double`);
-      });
-    // Lifted functions receive their closure first (the callValue ABI).
-    if (fn.captures !== undefined) params.unshift("ptr %sc_env");
-    const ret = int32Abi?.result
-      ? "i32"
-      : int32Abi?.union
-        ? SCALAR_UNION_RESULT
-        : this.llType(fn.returnType);
-    let attrs = coro !== null ? "#1" : FN_ATTRS;
-    // The shared indexed-read helper (lowerSafeIndexRead) is a dense bounds
-    // test, a state test and a load behind cold runtime fallbacks, called
-    // from every `a[i]` of one element type. Without the hint LLVM keeps the
-    // hot instances out of line once they have many callers: every read pays
-    // a call, and an integer index converts to a double and back across it.
-    if (fn.name.startsWith("%arr.idxOr.")) attrs = `inlinehint ${attrs}`;
-    // Interface dispatch is a few key tests and direct calls ahead of the
-    // checked dynamic call. Keeping that fallback out of line leaves the
-    // tests small enough to inline at each call site.
-    if (fn.name.startsWith("%dyn.class.protocol.fallback.")) attrs = `noinline ${attrs}`;
-    else if (fn.name.startsWith("%dyn.class.protocol.")) attrs = `inlinehint ${attrs}`;
-    if (fn.name.startsWith(RESULT_ENTRY_PREFIX)) attrs = `inlinehint ${attrs}`;
-    if (unoptimized && attrs === FN_ATTRS) attrs = `noinline optnone ${attrs}`;
-    const debug = this.debugScope === null ? "" : ` !dbg ${this.debugScope}`;
-    const symbol = borrowed ? mangleBorrowedFunction(fn.name) : mangleFunction(fn.name);
-    this.privateGlobalSlots.clear();
-    let body = `define internal ${ret} @${symbol}${int32Abi ? INT32_ABI_SUFFIX : ""}(${params.join(", ")}) ${attrs}${debug} { ; ${fn.name}\n${B.render()}\n}`;
-    if (int32Abi) body += "\n" + this.emitInt32AbiWrapper(fn, symbol, int32Abi);
-    if (this.integerClones.members.has(fn.name)) {
-      body += "\n" + emitIntegerClone(fn, this, this.stackChecks?.has(fn.name) === true);
-      if (this.integerClones.dispatched.has(fn.name))
-        body +=
-          "\n" +
-          emitIntegerDispatcher(
-            fn,
-            this,
-            `${symbol}${int32Abi ? INT32_ABI_SUFFIX : ""}`,
-            int32Abi?.params ?? [],
-            int32Abi?.result === true,
-          );
-    }
-    if (!borrowed) return body;
-    const slot = this.implSlotBorrowed(fn.name);
-    const virtual =
-      slot.size > 0 && slot.size !== borrowed.size
-        ? "\n" + this.emitOwnedCallAdapter(fn, borrowed, slot)
-        : "";
-    return body + "\n" + this.emitOwnedCallAdapter(fn, borrowed) + virtual;
+  emitFunction(fn: IrFunction): string {
+    return emitFunction(this, fn);
   }
 
   /** The double-ABI entry of a function with an i32 entry: every caller
    * that is not a direct call (closures, dispatch, adapters, the runtime)
    * enters here. A pending exception passes through to its caller. */
-  private emitInt32AbiWrapper(fn: IrFunction, symbol: string, abi: Int32Abi): string {
+  emitInt32AbiWrapper(fn: IrFunction, symbol: string, abi: Int32Abi): string {
     const lines: string[] = [];
     const params: string[] = [];
     const args: string[] = [];
@@ -7579,7 +3950,7 @@ export class LlEmitter {
   /** With `kept`, the virtual adapter of a borrowing slot instead: the
    * slot's parameters stay borrowed, the body's other borrowed ones are
    * released here. */
-  private emitOwnedCallAdapter(
+  emitOwnedCallAdapter(
     fn: IrFunction,
     borrowed: ReadonlySet<number>,
     kept: ReadonlySet<number> = NO_BORROWED,
@@ -7619,86 +3990,13 @@ export class LlEmitter {
       kept.size > 0 ? `${mangleBorrowedFunction(fn.name)}.virtual` : mangleFunction(fn.name);
     return `define internal ${ret} @${symbol}(${params.join(", ")}) ${FN_ATTRS} {\n${B.render()}\n}`;
   }
-
-  /** A local stable binding keeps its value alive while later arguments
-   * and the callee execute. A proven local union box cannot escape or be
-   * rebound during a call; its independent payload owner keeps it alive.
-   * Other writable bindings need an owned snapshot. */
   canBorrowCallArgument(value: IrExpr): boolean {
-    if (value.kind === "strLit") return true;
-    // An exact capsule owns its instance while the capsule's binding holds it.
-    if (value.kind === "dynCheck" && value.exact)
-      return value.value.kind === "varRef" && this.canBorrowCallArgument(value.value);
-    // An inline union field has no box to lend.
-    if (this.inlineFieldGet(value)) return false;
-    // Class casts reinterpret the same pointer (prefix layouts).
-    if (
-      (value.kind === "upcast" || value.kind === "downcast") &&
-      value.value.type.kind === "object"
-    )
-      return this.canBorrowCallArgument(value.value);
-    if (value.kind === "seqExpr") {
-      const guarded = guardedValue(value);
-      return guarded !== null && this.canBorrowCallArgument(guarded);
-    }
-    // A nullable-union wrap reinterprets its payload pointer; an immortal
-    // unit constant needs no owner at all.
-    const wrap = this.borrowableNullableWrap(value);
-    if (wrap === "unit") return true;
-    if (wrap === "ref" && value.kind === "unionWrap")
-      return this.canBorrowCallArgument(value.value);
-    // Checked casts (`x as C`, `x!` on a nullable) lower to a ternary whose
-    // failing arm always throws; the successful arm projects the same
-    // stable owner. The throwing arm's typed dummy owns nothing.
-    if (value.kind === "unionNarrow") return this.canBorrowCallArgument(value.value);
-    if (value.kind === "libCall") return value.fn === "error.nodeThrow";
-    // A final field never changes outside constructors: while its object is
-    // borrowable, so is the field's value. Nullable-pointer fields have no
-    // box to lend and keep their owning path.
-    if (
-      value.kind === "fieldGet" &&
-      this.finalFieldBorrows &&
-      isRefCounted(value.type) &&
-      this.finalFields.isFinal(value.className, value.field) &&
-      !this.nullableFieldGet(value)
-    )
-      return this.canBorrowReceiver(value.obj) && this.canBorrowCallArgument(value.obj);
-    if (value.kind === "ternary")
-      return (
-        this.canBorrowReceiver(value.then) &&
-        this.canBorrowReceiver(value.else_) &&
-        this.canBorrowCallArgument(value.then) &&
-        this.canBorrowCallArgument(value.else_)
-      );
-    // A construction-only field of a stable owner keeps its value until the
-    // owner dies: no later operand or callee can replace and release it.
-    if ((value.kind === "fieldGet" || value.kind === "recordGet") && this.immutableRead(value))
-      return this.canBorrowCallArgument(value.obj);
-    // An optional chain's bound receiver stays unchanged until its body
-    // finishes (see emitReadReceiver).
-    if (value.kind === "chainRecv") return this.chainSlots.has(value.id);
-    if (value.kind !== "varRef") return false;
-    const binding = this.binding(value.localId);
-    // A module constant owns its value for the rest of the program.
-    if (binding.kind === "global") return this.stableGlobals.has(value.localId);
-    // So does the environment for a capture nothing ever rebinds.
-    if (binding.kind === "boxed")
-      return this.stableCaptureIds.has(value.localId) && this.canBorrowReceiver(value);
-    return (
-      binding.kind === "local" &&
-      binding.local !== undefined &&
-      (!binding.local.mutable ||
-        this.stableCallBindings.has(value.localId) ||
-        this.borrowedParameters.has(value.localId) ||
-        this.localUnionStorage.has(value.localId)) &&
-      !binding.local.boxed &&
-      !binding.local.tdz
-    );
+    return canBorrowCallArgument(this, value);
   }
 
   /** A plain-pointer read of a construction-only field outside any
    * constructor (ImmutableFields). */
-  private immutableRead(e: ExprOf<"fieldGet" | "recordGet">): boolean {
+  immutableRead(e: ExprOf<"fieldGet" | "recordGet">): boolean {
     if (this.inConstructor || this.immutableFields === null) return false;
     const t = e.type.kind;
     if (t !== "object" && t !== "record" && t !== "array" && t !== "string") return false;
@@ -7722,7 +4020,7 @@ export class LlEmitter {
    * rest of its block (its whole lifetime) writes none of the projection's
    * locations: the source edge then keeps the value alive, and uses that
    * escape still retain their own copies. */
-  private unwrittenAlias(s: IrStmt & { kind: "varDecl" }): boolean {
+  unwrittenAlias(s: IrStmt & { kind: "varDecl" }): boolean {
     const cursor = this.stmtCursor;
     const rw = this.referenceWrites;
     if (rw === null || s.init === null || cursor === null || cursor.stmts[cursor.index] !== s)
@@ -7741,7 +4039,7 @@ export class LlEmitter {
    * element when the rest of the block writes no array element and none of
    * the locations keeping the array alive (which must itself be read
    * without a frame owner). */
-  private unwrittenLocalArrayRead(s: IrStmt & { kind: "varDecl" }, read: LocalArrayRead): boolean {
+  unwrittenLocalArrayRead(s: IrStmt & { kind: "varDecl" }, read: LocalArrayRead): boolean {
     const cursor = this.stmtCursor;
     const rw = this.referenceWrites;
     if (rw === null || s.init === null || cursor === null || cursor.stmts[cursor.index] !== s)
@@ -7771,7 +4069,7 @@ export class LlEmitter {
    * finally copies, like any pending return value, and the adopting await
    * runs afterwards with no handler in scope: a rejection settles the
    * function's promise instead of reaching its own catch clauses. */
-  private emitAdoptingReturn(s: IrStmt & { kind: "return" }, adopted: ExprOf<"awaitExpr">): void {
+  emitAdoptingReturn(s: IrStmt & { kind: "return" }, adopted: ExprOf<"awaitExpr">): void {
     const B = this.B;
     const promise = this.emitExpr(adopted.value);
     this.toFrame(promise);
@@ -7827,19 +4125,19 @@ export class LlEmitter {
 
   /** An async generator completing without a further turn: its request
    * settles as the body returns (scr_async_gen_hop_done). */
-  private emitAsyncGenSettled(): void {
+  emitAsyncGenSettled(): void {
     this.declare(`declare void @scr_async_gen_hop_done()`);
     this.B.line(`call void @scr_async_gen_hop_done()`);
   }
 
   /** Owned-binding reads that take over the binding's reference, by read
    * node (the binding's slot). */
-  private readonly lastUseMoves = new Map<IrExpr, string>();
+  readonly lastUseMoves = new Map<IrExpr, string>();
   /** How often each varRef node object occurs in the current function:
    * lowering may share one node between several reads, and a move keyed by
    * node identity must fire for exactly one of them. */
-  private varRefCounts: Map<IrExpr, number> | null = null;
-  private currentFunctionBody: IrStmt[] = [];
+  varRefCounts: Map<IrExpr, number> | null = null;
+  currentFunctionBody: IrStmt[] = [];
 
   private varRefCount(e: IrExpr): number {
     if (this.varRefCounts === null) {
@@ -7869,10 +4167,7 @@ export class LlEmitter {
 
   /** An owned local declared at the statement cursor whose last statement
    * reads it once (lastUseRead): that read moves the reference. */
-  private noteLastUseMove(
-    s: IrStmt & { kind: "varDecl" },
-    b: ReturnType<LlEmitter["binding"]>,
-  ): void {
+  noteLastUseMove(s: IrStmt & { kind: "varDecl" }, b: ReturnType<LlEmitter["binding"]>): void {
     const cursor = this.stmtCursor;
     if (
       !this.lastUseMovesAllowed() ||
@@ -7894,7 +4189,7 @@ export class LlEmitter {
    * parameter's slot (they need it until the function returns), so bodies
    * with walks keep their parameters, and locals rebound from the
    * parameter count as derived from it. */
-  private noteParameterMove(fn: IrFunction, localId: string, slot: string): void {
+  noteParameterMove(fn: IrFunction, localId: string, slot: string): void {
     if (
       !this.lastUseMovesAllowed() ||
       fn.async ||
@@ -7919,7 +4214,7 @@ export class LlEmitter {
 
   /** `return x` of a local whose slot is an owned scope entry of the same
    * type: the return can take over the local's reference. */
-  private movableReturn(
+  movableReturn(
     value: IrExpr | null,
   ): { scope: LlScopeEntry[]; entry: LlScopeEntry; index: number } | null {
     if (value === null || value.kind !== "varRef" || !isRefCounted(value.type)) return null;
@@ -7941,7 +4236,7 @@ export class LlEmitter {
   /** A walk host for a body that may write the heap: each walk must read
    * only locations the whole body (with its callees) never writes;
    * rebinding the walk locals themselves releases nothing. */
-  private unwrittenWalkHost(fn: IrFunction, host: WalkBorrowHost): WalkBorrowHost {
+  unwrittenWalkHost(fn: IrFunction, host: WalkBorrowHost): WalkBorrowHost {
     return {
       ...host,
       unwritten: (value, candidates) =>
@@ -8041,7 +4336,7 @@ export class LlEmitter {
 
   // ── statements ──────────────────────────────────────────────────────────
 
-  private emitStmts(stmts: IrStmt[], scoped = false): void {
+  emitStmts(stmts: IrStmt[], scoped = false): void {
     const saved = this.stmtCursor;
     const cursor = scoped ? { stmts, index: 0 } : null;
     try {
@@ -8064,7 +4359,7 @@ export class LlEmitter {
    * scope opens, before the statements — the catch-binding hook: it may
    * emit prelude lines and register entries the scope owns (released on
    * every exit, jumps and unwinds included). */
-  private emitBlock(stmts: IrStmt[], setup?: (scope: LlScopeEntry[]) => void): void {
+  emitBlock(stmts: IrStmt[], setup?: (scope: LlScopeEntry[]) => void): void {
     const scope: LlScopeEntry[] = [];
     this.scopes.push(scope);
     setup?.(scope);
@@ -8098,1674 +4393,21 @@ export class LlEmitter {
       if (loop) this.loopDepth--;
     }
   }
-
   private emitStmtBody(s: IrStmt): void {
-    const B = this.B;
-    this.frames.push([]);
-    switch (s.kind) {
-      case "varDecl": {
-        if (s.init && this.int32Locals.has(s.localId)) {
-          this.storeInt32Local(s.localId, this.emitExpr(s.init), s.init);
-          break;
-        }
-        const b = this.binding(s.localId);
-        if (this.walkBorrows.has(s.localId) && b.kind === "local") {
-          // A borrowed walk pointer: no retain now, no release at scope exit.
-          const v = s.init === null ? "null" : this.emitReadReceiver(s.init).name;
-          B.line(`store ptr ${v}, ptr ${b.slot}`);
-          break;
-        }
-        const slice = this.scalarStringSlices.get(s.localId);
-        if (slice) {
-          const snapshot = emitStringSliceSnapshot(this, slice);
-          this.stringSlices.set(s.localId, snapshot);
-          this.scopes[this.scopes.length - 1]!.push({ slot: snapshot.source, type: STRING });
-          break;
-        }
-        const split = this.privateSplitLocals.get(s.localId);
-        if (split) {
-          const snapshot = storeSplitSnapshot(this, emitSplitSnapshot(this, split));
-          this.storedSplits.set(s.localId, snapshot);
-          this.scopes[this.scopes.length - 1]!.push(
-            { slot: snapshot.sourceSlot, type: STRING },
-            { slot: snapshot.separatorSlot, type: STRING },
-          );
-          break;
-        }
-        const stackObject = this.localStackObjects.get(s.localId);
-        if (stackObject) {
-          const value = emitStackObject(this, stackObject, (fields) => this.ownScopeFields(fields));
-          B.line(`store ptr ${value.name}, ptr ${b.slot}`);
-          break;
-        }
-        if (s.init && this.reassignedStackObjects.has(s.localId)) {
-          const slot = this.stackObjectSlot(s.localId, s.init.type);
-          emitStackObject(
-            this,
-            s.init as StackObjectSource,
-            (fields) => this.ownScopeFields(fields),
-            slot,
-          );
-          B.line(`store ptr ${slot}, ptr ${b.slot}`);
-          break;
-        }
-        const localUnion = this.localStackUnions.get(s.localId);
-        if (localUnion) {
-          const union = emitStackUnion(this, localUnion);
-          B.line(`store ptr ${union.value.name}, ptr ${b.slot}`);
-          if (union.payload) {
-            this.toFrame(union.payload);
-            this.scopes[this.scopes.length - 1]!.push({
-              slot: union.payloadSlot,
-              type: union.payload.type,
-            });
-          }
-          break;
-        }
-        const localRead = this.localArrayReads.get(s.localId);
-        if (localRead) {
-          const owner = emitLocalArrayRead(
-            this,
-            !localRead.borrow && this.unwrittenLocalArrayRead(s, localRead)
-              ? { ...localRead, borrow: true }
-              : localRead,
-            b.slot,
-          );
-          if (owner) this.scopes[this.scopes.length - 1]!.push(owner);
-          break;
-        }
-        const mapRead = this.mapReadLifetimes.locals.get(s.localId);
-        if (mapRead) {
-          const result = emitStackMapRead(this, mapRead);
-          B.line(`store ptr ${result.value.name}, ptr ${b.slot}`);
-          if (result.owner) this.scopes[this.scopes.length - 1]!.push(result.owner);
-          break;
-        }
-        const localStorage = this.localUnionStorageProofs.get(s.localId);
-        if (localStorage && s.init) {
-          const storage = allocateLocalUnion(this, localStorage);
-          this.localUnionStorage.set(s.localId, storage);
-          storeLocalUnion(this, storage, s.init);
-          B.line(`store ptr ${storage.box}, ptr ${b.slot}`);
-          if (storage.owner && storage.ownerType)
-            this.scopes[this.scopes.length - 1]!.push({
-              slot: storage.owner,
-              type: storage.ownerType,
-            });
-          break;
-        }
-        if (b.kind === "boxed") {
-          const stack = this.stackCaptures.emit(this, s.localId, b.type);
-          if (stack) {
-            B.line(`store ptr ${stack.box}, ptr ${b.slot}`);
-            if (stack.owner) this.scopes[this.scopes.length - 1]!.push(stack.owner);
-            if (s.init) {
-              const value = this.emitExpr(s.init);
-              if (isRefCounted(value.type)) this.toFrame(value);
-              this.boxSet(stack.box, b.type, value.name);
-            }
-            break;
-          }
-          // Box FIRST, then evaluate the initializer: a named function
-          // expression's closure captures this box during init evaluation.
-          // A SCALAR TDZ box rides an ARR-kind box: the value lives in a
-          // one-element array cell, so the empty (NULL) slot stays the
-          // not-yet-initialized sentinel — a raw scalar slot has no spare
-          // bit pattern to spend on it (stmts.ts's varDecl).
-          const boxNew =
-            b.local!.tdz === true && boxAccess(b.type) !== "ref"
-              ? (this.declare(`declare ptr @scr_box_new(i32)`), `call ptr @scr_box_new(i32 3)`)
-              : boxNewCall(this.shapeHost, b.type);
-          const box = B.tmp();
-          B.line(`${box} = ${boxNew} ; let ${b.local!.name} (boxed)`);
-          B.line(`store ptr ${box}, ptr ${b.slot}`);
-          this.scopes[this.scopes.length - 1]!.push({ slot: b.slot, type: b.type, boxed: true });
-          if (s.init === null) {
-            // An empty TDZ box whose payload can legitimately be NULL
-            // starts at its distinct sentinel (tdzEmptySentinel).
-            const sentinel = b.local!.tdz === true ? this.tdzEmptySentinel(b.type) : null;
-            if (sentinel !== null) B.line(`store ptr ${sentinel}, ptr ${this.boxSlot(box)}`);
-            break;
-          }
-          const v = this.emitExpr(s.init);
-          if (isRefCounted(v.type)) this.toHeap(v); // the box takes ownership
-          if (b.local!.tdz === true && boxAccess(b.type) !== "ref") {
-            this.tdzScalarInit(box, b.type, v.name);
-          } else {
-            this.boxSet(box, b.type, v.name);
-          }
-          break;
-        }
-        if (s.init === null) {
-          // Declared, uninitialized (`let x: number;`): reset the slot —
-          // inside a loop the previous iteration's scope exit released the
-          // old value and left a stale pointer (NULL-tolerant releases).
-          if (isRefCounted(b.type)) {
-            B.line(`store ptr null, ptr ${b.slot}`);
-            this.scopes[this.scopes.length - 1]!.push({ slot: b.slot, type: b.type });
-          }
-          break;
-        }
-        if (this.loopArrayBorrows.has(s) && s.init.kind === "arrayGet") {
-          emitBorrowedArrayRead(this, s.init, b.slot);
-          break;
-        }
-        const holeRead = this.loopArrayBorrows.has(s) ? dynHoleRead(s.init) : null;
-        if (holeRead && s.init.kind === "ternary") {
-          // A hole reads as the immortal undefined value, which needs no owner.
-          const present = this.emitExpr(s.init.cond);
-          const filled = B.newLabel("borrow.hole.filled"),
-            missing = B.newLabel("borrow.hole.missing"),
-            done = B.newLabel("borrow.hole.done");
-          B.condBr(present.name, filled, missing);
-          B.startBlock(filled);
-          emitBorrowedArrayRead(this, holeRead, b.slot);
-          B.br(done);
-          B.startBlock(missing);
-          this.declare("declare ptr @scr_dyn_undefined()");
-          const undef = B.tmp();
-          B.line(`${undef} = call ptr @scr_dyn_undefined()`);
-          B.line(`store ptr ${undef}, ptr ${b.slot}`);
-          B.br(done);
-          B.startBlock(done);
-          break;
-        }
-        // A stable lexical alias cannot outlive its unchanged local owner.
-        // Whole-value uses still retain their own copies, so returning or
-        // storing the alias preserves the ordinary heap representation.
-        // Boxed captures, reassigned sources and projections need ownership.
-        if (
-          b.kind === "local" &&
-          b.local &&
-          isRefCounted(b.type) &&
-          this.stableCallBindings.has(s.localId) &&
-          (this.canBorrowCallArgument(s.init) || this.unwrittenAlias(s))
-        ) {
-          const v = this.emitReadReceiver(s.init);
-          B.line(`store ptr ${v.name}, ptr ${b.slot}`);
-          break;
-        }
-        const v = this.emitExpr(s.init);
-        if (b.kind === "global") this.toHeap(v);
-        else this.toFrame(v);
-        B.line(`store ${this.llType(b.type)} ${v.name}, ptr ${b.slot}`);
-        this.storeIntegerView(s.localId, v, s.init);
-        if (isRefCounted(b.type)) {
-          this.scopes[this.scopes.length - 1]!.push({ slot: b.slot, type: b.type });
-          this.noteLastUseMove(s, b);
-        }
-        break;
-      }
-      case "assign": {
-        if (this.int32Locals.has(s.localId)) {
-          this.storeInt32Local(s.localId, this.emitExpr(s.value), s.value);
-          break;
-        }
-        const owner = this.reboundOwnerSlots.get(s.localId);
-        if (owner !== undefined && !this.walkBorrows.has(s.localId)) {
-          // A rebound borrowed parameter: the new value moves into the owner
-          // slot, replacing (and releasing) the previous owned value. This
-          // precedes the in-place string append, which would release the
-          // caller's borrow.
-          const param = this.binding(s.localId);
-          const slot = param.slot;
-          const v = this.emitExpr(s.value);
-          this.toFrame(v);
-          const old = B.tmp();
-          B.line(`${old} = load ptr, ptr ${owner}`);
-          this.releaseFrame(old, param.type);
-          B.line(`store ptr ${v.name}, ptr ${slot}`);
-          B.line(`store ptr ${v.name}, ptr ${owner}`);
-          break;
-        }
-        if (this.reassignedStackObjects.has(s.localId)) {
-          // The new value may read the old one: build it apart (its
-          // reference fields owned by this statement until it completes),
-          // then copy it over the binding's slot. The binding takes over the
-          // new fields; the old ones are released after the slot no longer
-          // holds them.
-          const struct = stackObjectStruct(s.value.type);
-          let owned: readonly StackObjectField[] = [];
-          const value = emitStackObject(this, s.value as StackObjectSource, (fields) => {
-            owned = fields;
-            for (const field of fields) this.ownSlot(field.ptr, field.type);
-          });
-          const target = this.stackObjectSlot(s.localId, s.value.type);
-          const old = stackObjectFields(this, s.value.type, target).map((field) => {
-            const t = B.tmp();
-            B.line(`${t} = load ptr, ptr ${field.ptr}`);
-            return { name: t, type: field.type };
-          });
-          const bits = B.tmp();
-          B.line(`${bits} = load ${struct}, ptr ${value.name}`);
-          B.line(`store ${struct} ${bits}, ptr ${target}`);
-          this.disownSlots(owned);
-          for (const field of old) this.releaseFrame(field.name, field.type);
-          break;
-        }
-        const localStorage = this.localUnionStorage.get(s.localId);
-        if (localStorage) {
-          storeLocalUnion(this, localStorage, s.value);
-          break;
-        }
-        const self = matchStringSelfConcat(s.localId, s.value);
-        if (self) {
-          this.emitStringSelfConcatAssign(s.localId, self.left, self.suffix, false);
-          break;
-        }
-        const b = this.binding(s.localId);
-        if (this.walkBorrows.has(s.localId) && b.kind === "local") {
-          // Rebinding a borrowed walk pointer releases nothing.
-          B.line(`store ptr ${this.emitReadReceiver(s.value).name}, ptr ${b.slot}`);
-          break;
-        }
-        const v = this.emitExpr(s.value);
-        if (b.kind === "global" && !s.initializes) this.checkGlobalTdz(s.localId);
-        if (b.kind === "boxed") {
-          this.writeBindingBox(this.loadBox(b.slot), b.local!, v.name, s.initializes);
-          // The RHS remains frame-owned until a possible TDZ throw passes.
-          if (isRefCounted(v.type)) this.toHeap(v);
-          break;
-        }
-        if (b.kind === "global") this.toHeap(v);
-        else this.toFrame(v);
-        if (isRefCounted(b.type)) {
-          const old = B.tmp();
-          B.line(`${old} = load ptr, ptr ${b.slot}`);
-          if (b.kind === "global") this.releaseHeap(old, b.type);
-          else this.releaseFrame(old, b.type);
-        }
-        B.line(`store ${this.llType(b.type)} ${v.name}, ptr ${b.slot}`);
-        this.storeIntegerView(s.localId, v, s.value);
-        if (b.kind === "global" && this.immortalGlobals.has(s.localId)) {
-          // An Immutable module constant (contracts/check.ts proved it is
-          // fresh, publishable and never written): its graph becomes
-          // immortal, so reads skip reference counting and the collector
-          // never visits it.
-          const lines = this.publishWalkers.emitPublish(v.name, v.type, s.loc);
-          for (const line of lines) B.line(line.trimStart());
-          // Reads of this global skip retains from here on, which is only
-          // sound once the graph really is immortal. Node.js never fails
-          // here, so a refusal means the contract proof was wrong: stop
-          // rather than keep running with a mortal graph read as immortal.
-          if (lines.length > 0) {
-            this.declare(`declare zeroext i1 @scr_exc_pending()`);
-            this.declare(`declare void @scr_trap(ptr)`);
-            const refused = B.tmp();
-            B.line(`${refused} = call zeroext i1 @scr_exc_pending()`);
-            const stop = B.newLabel("immutable.refused");
-            const done = B.newLabel("immutable.published");
-            B.condBr(refused, stop, done);
-            B.startBlock(stop);
-            B.line(
-              `call void @scr_trap(ptr ${this.cstr("scriptc: internal error: an Immutable value could not be published\n")})`,
-            );
-            B.terminate("unreachable");
-            B.startBlock(done);
-          }
-        }
-        break;
-      }
-      case "exprStmt":
-        // A statement-position splice never observes its removed elements.
-        if (!emitDiscardedSplice(this, s.expr)) this.emitDiscarded(s.expr);
-        break;
-      case "arraySet": {
-        // Evaluation order matches JS: array, index, then value. Ownership
-        // of a refcounted value moves into the array (the runtime releases
-        // the replaced element itself). A local receiver that the index and
-        // value cannot rebind is read in place, as for field stores; the
-        // released element cannot reach that binding.
-        if (this.emitArraySelfConcat(s)) break;
-        const arr = this.emitStableReceiver(s.arr, [s.index, s.value]);
-        const idx = this.emitExpr(s.index);
-        const v = this.emitExpr(s.value);
-        if (s.arr.type.kind !== "array")
-          throw new InternalCompilerError("llvm emitter bug: arraySet on non-array");
-        const acc = elemAccess(s.arr.type.elem);
-        this.emitPublishedArrayGuard(arr.name, s.arr.type, 0, idx.name);
-        if (acc === "ref") this.toHeap(v);
-        emitDenseArraySet(
-          this,
-          arr.name,
-          idx,
-          s.index,
-          acc,
-          s.arr.type.elem,
-          v.name,
-          this.provenDenseIndex(s.arr, s.index),
-        );
-        break;
-      }
-      case "arraySetLength": {
-        // Pop's `length = 0` store on an empty array only matters when the
-        // array can be frozen (published); its operand is a local.
-        if (
-          s.pop === true &&
-          s.length.kind === "numLit" &&
-          s.length.value === 0 &&
-          this.publishedTypes?.containerGuarded(s.arr.type) !== true
-        )
-          break;
-        const arr = emitBorrowedInput(this, s.arr);
-        const length = this.emitExpr(s.length);
-        if (s.arr.type.kind !== "array")
-          throw new InternalCompilerError("llvm emitter bug: arraySetLength on non-array");
-        this.emitPublishedArrayGuard(arr.name, s.arr.type, s.pop === true ? 2 : 3);
-        this.declare(`declare void @scr_arr_set_len(ptr, double)`);
-        // Assigning the current length (a reused work array reset to where
-        // it already is) changes nothing: the runtime's validation accepts
-        // exactly the value equal to the length (-0 included, NaN never),
-        // and no element is released. Everything else keeps the call.
-        const lenPtr = B.tmp(),
-          len = B.tmp(),
-          lenNumber = B.tmp(),
-          same = B.tmp();
-        const resize = B.newLabel("arr.len.set"),
-          done = B.newLabel("arr.len.done");
-        B.line(`${lenPtr} = getelementptr inbounds %ScrArr, ptr ${arr.name}, i32 0, i32 1`);
-        this.markMemoryPointer(lenPtr, "array:header");
-        B.line(
-          `${len} = load ${this.sizeType}, ptr ${lenPtr}${this.fieldAliasAttachment(lenPtr)}${this.arrayLengthRange}`,
-        );
-        B.line(`${lenNumber} = ${sizeToDouble(this.sizeType)} ${this.sizeType} ${len} to double`);
-        B.line(`${same} = fcmp oeq double ${length.name}, ${lenNumber}`);
-        B.condBr(same, done, resize);
-        B.startBlock(resize);
-        if (s.pop === true) {
-          // A discarded pop's `length - 1` on a packed array removes the
-          // last element inline, then releases it.
-          const call = B.newLabel("arr.len.call"),
-            pop = B.newLabel("arr.len.pop");
-          const lastNumber = B.tmp(),
-            dropsLast = B.tmp();
-          B.line(`${lastNumber} = fsub double ${lenNumber}, 1.0`);
-          B.line(`${dropsLast} = fcmp oeq double ${length.name}, ${lastNumber}`);
-          B.condBr(dropsLast, pop, call);
-          B.startBlock(pop);
-          const elem = s.arr.type.elem;
-          const acc = elemAccess(elem);
-          const raw = emitDenseArrayPop(this, arr.name, acc, call, call);
-          if (acc === "ref" && isRefCounted(elem)) {
-            const old = B.tmp();
-            B.line(`${old} = inttoptr i64 ${raw} to ptr`);
-            this.releaseHeap(old, elem);
-          }
-          B.br(done);
-          B.startBlock(call);
-        }
-        B.line(`call void @scr_arr_set_len(ptr ${arr.name}, double ${length.name})`);
-        this.emitPendingCheck();
-        B.br(done);
-        B.startBlock(done);
-        break;
-      }
-      case "arraySetUndefined":
-      case "arrayDelete": {
-        const arr = emitBorrowedInput(this, s.arr);
-        const idx = this.emitExpr(s.index);
-        if (s.arr.type.kind !== "array")
-          throw new InternalCompilerError(`llvm emitter bug: ${s.kind} on non-array`);
-        this.emitPublishedArrayGuard(
-          arr.name,
-          s.arr.type,
-          s.kind === "arrayDelete" ? 5 : 0,
-          idx.name,
-        );
-        const fn = s.kind === "arraySetUndefined" ? "scr_arr_set_undefined" : "scr_arr_delete";
-        this.declare(
-          `declare ${s.kind === "arrayDelete" ? "zeroext i1" : "void"} @${fn}(ptr, double)`,
-        );
-        if (s.kind === "arrayDelete")
-          B.line(`call zeroext i1 @${fn}(ptr ${arr.name}, double ${idx.name})`);
-        else B.line(`call void @${fn}(ptr ${arr.name}, double ${idx.name})`);
-        break;
-      }
-      case "bytesSet": {
-        // Typed-array element write: same evaluation order as arraySet;
-        // the value is a scalar (the kind-specific inline path coerces
-        // JS-exactly), so no ownership moves. Invalid writes are ignored.
-        // IrBytesElem is static, so never rediscover it through the
-        // generic runtime switch in a hot loop.
-        const arr = this.emitStableReceiver(s.arr, [s.index, s.value]);
-        const idx = this.emitExpr(s.index);
-        const v = this.emitExpr(s.value);
-        if (s.arr.type.kind !== "bytes")
-          throw new InternalCompilerError("llvm emitter bug: bytesSet on non-bytes");
-        this.emitBytesSet(
-          s.arr.type.elem,
-          arr.name,
-          idx,
-          v,
-          s.index,
-          s.value,
-          this.bytesBounds.has(s),
-        );
-        break;
-      }
-      case "fieldSet":
-      case "recordSet": {
-        // Evaluation order: obj, then value. New value moved in; the old
-        // value is released AFTER the field is overwritten (unlink-then-
-        // release — a release can trigger a cycle collection, which must
-        // never see a heap edge whose count was already given up).
-        // Classes and records share the struct layout, so one emission.
-        const nullable =
-          s.kind === "fieldSet" ? this.nullableFields.get(s.className, s.field) : null;
-        if (nullable && s.kind === "fieldSet") {
-          const obj = this.emitStableReceiver(s.obj, [s.value]);
-          // (The guard precedes the value here: the nullable store
-          // evaluates it itself.)
-          this.emitStoreGuard(obj.name, s);
-          this.emitNullableFieldStore(obj.name, s.className, s.field, nullable, s.value);
-          break;
-        }
-        if (s.kind === "fieldSet" && this.int32Slots.isField(s.className, s.field)) {
-          const obj = this.emitStableReceiver(s.obj, [s.value]);
-          const v = this.emitExpr(s.value);
-          this.emitStoreGuard(obj.name, s);
-          const { ptr } = this.classFieldPtr(obj.name, s.className, s.field);
-          this.storeInt32Field(ptr, v, s.value);
-          break;
-        }
-        if (this.emitFieldSelfConcat(s)) break;
-        const obj = this.emitStableReceiver(s.obj, [s.value]);
-        const v = this.emitFieldValue(
-          s.value,
-          s.kind === "recordSet"
-            ? this.recordFieldInline(s.shapeId, s.field)
-            : this.inlineUnions.classField(s.className, s.field),
-        );
-        if (s.kind === "fieldSet") this.emitStoreGuard(obj.name, s);
-        else if (this.publishedTypes?.recordGuarded(s.shapeId) === true)
-          this.emitPublishedFieldGuard(obj.name, null, s.field);
-        const { ptr, type, inline } =
-          s.kind === "fieldSet"
-            ? this.classFieldPtr(obj.name, s.className, s.field)
-            : this.recordFieldPtr(obj.name, s.shapeId, s.field);
-        // A result-slot entry fills zeroed caller storage, each field once.
-        if (
-          s.kind === "recordSet" &&
-          s.obj.kind === "varRef" &&
-          s.obj.localId === RESULT_DST_ID &&
-          this.currentFunctionName.startsWith(RESULT_ENTRY_PREFIX)
-        )
-          this.initField(ptr, type, inline, v);
-        else this.replaceField(ptr, type, inline, v);
-        if (
-          s.kind === "fieldSet" &&
-          s.field === "name" &&
-          this.classMeta.get(s.className)?.root.def.name === "%Error"
-        ) {
-          const present = this.classFieldPtr(obj.name, s.className, "%namePresent").ptr;
-          const enumerable = this.classFieldPtr(obj.name, s.className, "%nameEnumerable").ptr;
-          const wasPresent = B.tmp(),
-            wasEnumerable = B.tmp(),
-            isPresent = B.tmp(),
-            nextEnumerable = B.tmp();
-          B.line(`${wasPresent} = load i8, ptr ${present}`);
-          B.line(`${wasEnumerable} = load i8, ptr ${enumerable}`);
-          B.line(`${isPresent} = icmp ne i8 ${wasPresent}, 0`);
-          B.line(`${nextEnumerable} = select i1 ${isPresent}, i8 ${wasEnumerable}, i8 1`);
-          B.line(`store i8 1, ptr ${present}`);
-          B.line(`store i8 ${nextEnumerable}, ptr ${enumerable}`);
-        }
-        break;
-      }
-      case "recordKeyDelete": {
-        // `delete obj[k]` on a pure index-signature shape: a Map delete on
-        // the overflow (key and value released; absent keys no-op).
-        const obj = this.emitExpr(s.obj);
-        const key = this.emitExpr(s.key);
-        if (this.publishedTypes?.recordGuarded(s.shapeId) === true) {
-          // Node: "Cannot delete property 'k' of #<Object>" (key known at
-          // run time only; the guard reports the frozen record generically).
-          this.emitPublishedFieldGuard(obj.name, null, "[key]");
-        }
-        const ovf = this.recordOvfPtr(obj.name, s.shapeId);
-        this.declare(`declare zeroext i1 @scr_map_delete_str(ptr, ptr)`);
-        const t = B.tmp();
-        B.line(`${t} = call zeroext i1 @scr_map_delete_str(ptr ${ovf}, ptr ${key.name})`);
-        break;
-      }
-      case "recordKeySet": {
-        // Dynamic-keyed record write (the C per-shape helper, inline):
-        // declared keys write through (same-typed — dyn-valued shapes,
-        // whose writes validate and can throw, stay refused), undeclared
-        // keys insert/replace in the overflow map. Evaluation order: obj,
-        // key, value; the write OWNS the value (+1 moves in).
-        const obj = this.emitExpr(s.obj);
-        const key = this.emitExpr(s.key);
-        const v = this.emitExpr(s.value);
-        if (this.publishedTypes?.recordGuarded(s.shapeId) === true)
-          this.emitPublishedFieldGuard(obj.name, null, "[key]");
-        if (isRefCounted(v.type)) this.toHeap(v);
-        const shape = this.recordShape(s.shapeId);
-        // Signature-free shapes dispatch over their (one-typed) declared
-        // fields and TRAP on a miss (scr_record_key_miss — JS would add
-        // the property, which a monomorphic struct cannot); overflow
-        // shapes keep the map insert tail.
-        const iv = shape.indexValue ?? shape.fields[0]?.type;
-        if (!iv)
-          throw new InternalCompilerError(
-            `llvm emitter bug: keyed write on field-free non-overflow shape ${s.shapeId}`,
-          );
-        const vAcc = iv.kind === "f64" ? "f64" : iv.kind === "bool" ? "bool" : "ref";
-        if (s.overflowOnly === true) {
-          // A LITERAL key naming no declared field: a plain overflow
-          // insert — no field chain.
-          const ovf = this.recordOvfPtr(obj.name, s.shapeId);
-          this.mapSet(ovf, "str", vAcc, key.name, v.name);
-          break;
-        }
-        const join = B.newLabel("rks.j");
-        if (iv.kind === "dyn" && shape.indexValue) {
-          // A dyn-valued shape (the C recordKeySetHelper's dyn arm,
-          // inline): declared keys VALIDATE the dyn value against the
-          // field's type first (dynCheck — a mismatched write throws the
-          // catchable TypeError and leaves the field untouched; JS would
-          // store anything, the documented divergence); undeclared keys
-          // insert the dyn value into the overflow map as-is.
-          this.declare(`declare void @scr_dyn_release(ptr)`);
-          for (const f of shape.fields) {
-            const hit = B.tmp();
-            B.line(
-              `${hit} = call zeroext i1 ${this.literalEquals(f.name)}(ptr ${key.name}) ; ${llvmCommentText(f.name)}`,
-            );
-            const lh = B.newLabel("rks.h");
-            const ln = B.newLabel("rks.n");
-            B.condBr(hit, lh, ln);
-            B.startBlock(lh);
-            const pathSlot = B.slot();
-            B.entryAllocas.push(`${pathSlot} = alloca %ScrDynPath`);
-            const pp = B.tmp();
-            const kp = B.tmp();
-            const ip = B.tmp();
-            B.line(`${pp} = getelementptr inbounds %ScrDynPath, ptr ${pathSlot}, i64 0, i32 0`);
-            B.line(`store ptr null, ptr ${pp}`);
-            B.line(`${kp} = getelementptr inbounds %ScrDynPath, ptr ${pathSlot}, i64 0, i32 1`);
-            B.line(`store ptr ${this.cstr(f.name)}, ptr ${kp}`);
-            B.line(`${ip} = getelementptr inbounds %ScrDynPath, ptr ${pathSlot}, i64 0, i32 2`);
-            B.line(`store ${this.sizeType} 0, ptr ${ip}`);
-            const helper = this.dyn.dynCheckHelper(f.type);
-            const fty = this.llType(f.type);
-            const nv = B.tmp();
-            B.line(
-              `${nv} = call ${fty === "i1" ? "zeroext i1" : fty} @${helper}(ptr ${v.name}, ptr ${pathSlot})`,
-            );
-            B.line(`call void @scr_dyn_release(ptr ${v.name})`);
-            // Mismatched write: TypeError pending, field untouched — the
-            // statement-level check below unwinds.
-            const pend = B.tmp();
-            for (const line of this.pendingTestLines(pend)) B.line(line.trimStart());
-            const lw = B.newLabel("rks.w");
-            B.condBr(pend, join, lw);
-            B.startBlock(lw);
-            const { ptr, type, inline } = this.recordFieldPtr(obj.name, s.shapeId, f.name);
-            if (inline) {
-              // The slot copies the checked value's bits; nv is released below.
-              this.storeField(ptr, type, nv, true);
-              this.releaseFrame(nv, type);
-            } else if (isRefCounted(type)) {
-              const old = B.tmp();
-              B.line(`${old} = load ptr, ptr ${ptr}`);
-              this.storeField(ptr, type, nv, false);
-              this.releaseHeap(old, type);
-            } else {
-              this.storeField(ptr, type, nv, false);
-            }
-            B.br(join);
-            B.startBlock(ln);
-          }
-          const ovf = this.recordOvfPtr(obj.name, s.shapeId);
-          this.mapSet(ovf, "str", vAcc, key.name, v.name);
-          B.br(join);
-          B.startBlock(join);
-          // MAY THROW exactly when a dyn value can validate against a
-          // declared field (stmts.ts's condition).
-          if (shape.fields.length > 0) this.emitPendingCheck();
-          break;
-        }
-        for (const f of shape.fields) {
-          // typeEquals(f.type, iv) — the frontend fences everything else.
-          const hit = B.tmp();
-          B.line(
-            `${hit} = call zeroext i1 ${this.literalEquals(f.name)}(ptr ${key.name}) ; ${llvmCommentText(f.name)}`,
-          );
-          const lh = B.newLabel("rks.h");
-          const ln = B.newLabel("rks.n");
-          B.condBr(hit, lh, ln);
-          B.startBlock(lh);
-          const { ptr, type, inline } = this.recordFieldPtr(obj.name, s.shapeId, f.name);
-          if (inline) {
-            // The write owns the moved-in value; the slot copies its bits.
-            this.storeField(ptr, type, v.name, true);
-            this.releaseHeap(v.name, type);
-          } else if (isRefCounted(type)) {
-            const old = B.tmp();
-            B.line(`${old} = load ptr, ptr ${ptr}`);
-            this.storeField(ptr, type, v.name, false);
-            this.releaseHeap(old, type);
-          } else {
-            this.storeField(ptr, type, v.name, false);
-          }
-          B.br(join);
-          B.startBlock(ln);
-        }
-        if (!shape.indexValue) {
-          // The MISS on a fixed shape: release the moved-in value, throw
-          // the catchable TypeError naming the key (scr_record_key_miss —
-          // JS would add the property, the documented divergence).
-          if (isRefCounted(iv)) this.releaseHeap(v.name, iv);
-          this.declare(`declare void @scr_record_key_miss(ptr)`);
-          B.line(`call void @scr_record_key_miss(ptr ${key.name})`);
-          B.br(join);
-          B.startBlock(join);
-          this.emitPendingCheck();
-          break;
-        }
-        const ovf = this.recordOvfPtr(obj.name, s.shapeId);
-        this.mapSet(ovf, "str", vAcc, key.name, v.name);
-        B.br(join);
-        B.startBlock(join);
-        break;
-      }
-      case "block": {
-        if (s.labels === undefined) {
-          this.emitBlock(s.body);
-          break;
-        }
-        // A labeled block: `break lbl` inside branches to the end label.
-        const le = B.newLabel("blk.e");
-        this.jumpTargets.push({
-          kind: "block",
-          brkLabel: le,
-          contLabel: null,
-          labels: s.labels,
-          frameDepth: this.frames.length,
-          scopeDepth: this.scopes.length,
-          finallyDepth: this.finallyStack.length,
-        });
-        this.emitBlock(s.body);
-        this.jumpTargets.pop();
-        B.br(le);
-        B.startBlock(le);
-        break;
-      }
-      case "if": {
-        const cond = this.emitCondition(s.cond);
-        const trueLabel = B.newLabel("if.t");
-        const joinLabel = B.newLabel("if.j");
-        const falseLabel = s.else_ ? B.newLabel("if.f") : joinLabel;
-        B.condBr(cond, trueLabel, falseLabel);
-        B.startBlock(trueLabel);
-        this.emitBlock(s.then);
-        B.br(joinLabel);
-        if (s.else_) {
-          B.startBlock(falseLabel);
-          this.emitBlock(s.else_);
-          B.br(joinLabel);
-        }
-        B.startBlock(joinLabel);
-        break;
-      }
-      case "while": {
-        const workerBudget = this.workerLoopBudget(s);
-        const le = B.newLabel("loop.e");
-        this.emitLoopCopies(s, true, le, (exit) => {
-          const lc = B.newLabel("loop.c");
-          const lb = B.newLabel("loop.b");
-          const lp = workerBudget !== null ? B.newLabel("loop.p") : lc;
-          B.br(lc);
-          B.startBlock(lc);
-          B.condBr(this.emitCondition(s.cond), lb, exit);
-          B.startBlock(lb);
-          this.jumpTargets.push({
-            kind: "loop",
-            brkLabel: exit,
-            contLabel: lp,
-            labels: s.labels,
-            frameDepth: this.frames.length,
-            scopeDepth: this.scopes.length,
-            finallyDepth: this.finallyStack.length,
-          });
-          this.emitBlock(s.body);
-          this.jumpTargets.pop();
-          B.br(lp);
-          if (lp !== lc) {
-            B.startBlock(lp);
-            this.emitWorkerLoopCheck(workerBudget);
-            B.br(lc);
-          }
-        });
-        B.startBlock(le);
-        break;
-      }
-      case "doWhile": {
-        const workerBudget = this.workerLoopBudget(s);
-        // Body first (runs at least once); continue jumps to the CONDITION.
-        const le = B.newLabel("loop.e");
-        this.emitLoopCopies(s, true, le, (exit) => {
-          const lb = B.newLabel("loop.b");
-          const lc = B.newLabel("loop.c");
-          B.br(lb);
-          B.startBlock(lb);
-          this.jumpTargets.push({
-            kind: "loop",
-            brkLabel: exit,
-            contLabel: lc,
-            labels: s.labels,
-            frameDepth: this.frames.length,
-            scopeDepth: this.scopes.length,
-            finallyDepth: this.finallyStack.length,
-          });
-          this.emitBlock(s.body);
-          this.jumpTargets.pop();
-          B.br(lc);
-          B.startBlock(lc);
-          this.emitWorkerLoopCheck(workerBudget);
-          B.condBr(this.emitCondition(s.cond), lb, exit);
-        });
-        B.startBlock(le);
-        break;
-      }
-      case "for": {
-        // The init's scope wraps the whole loop (break/continue must NOT
-        // release it — scopeDepth captured after the push, C parity).
-        const integerArrayLoop =
-          this.debug === null
-            ? matchIntegerArrayForLoop(s, this.currentLocals, this.integerArrayBindings)
-            : null;
-        const integerLoop =
-          integerArrayLoop ??
-          (this.debug === null ? matchIntegerBytesForLoop(s, this.numericLocals) : null);
-        const countedLoop =
-          !integerLoop && this.countedLoopsEnabled
-            ? matchIntegerCountedForLoop(
-                s,
-                this.numericLocals,
-                this.integerRanges,
-                this.unaliasedArrays,
-              )
-            : null;
-        const window =
-          countedLoop && this.byteWindowsEnabled
-            ? matchByteWindow(
-                s,
-                countedLoop,
-                this.numericLocals,
-                this.captureIds,
-                this.integerRanges,
-                this.byteWindowEntries.get(s) ?? new Set(),
-              )
-            : null;
-        const denseShape = !this.denseLoopsEnabled
-          ? null
-          : integerArrayLoop
-            ? {
-                counter: integerArrayLoop.localId,
-                length: integerArrayLoop.limitReceiver as IrExpr & { kind: "varRef" },
-                range: { min: 0, max: 4294967294 },
-              }
-            : countedLoop && !countedLoop.guarded
-              ? countedDenseShape(s, countedLoop)
-              : null;
-        const dense =
-          denseShape && !window
-            ? matchDenseArrayLoop(
-                s,
-                denseShape,
-                this.numericLocals,
-                this.unaliasedArrays,
-                this.denseLoopEntries.get(s) ?? new Set(),
-              )
-            : null;
-        if (dense) {
-          const valid = emitDenseLoopGuard(this, dense);
-          const fast = B.newLabel("dense.loop.fast"),
-            slow = B.newLabel("dense.loop.slow"),
-            done = B.newLabel("dense.loop.done");
-          B.condBr(valid, fast, slow);
-          this.denseLoopsEnabled = false;
-          try {
-            B.startBlock(slow);
-            this.emitStmt(s);
-            B.br(done);
-            B.startBlock(fast);
-            this.denseLoop = dense;
-            this.emitStmt(s);
-            B.br(done);
-          } finally {
-            this.denseLoop = null;
-            this.denseLoopsEnabled = true;
-          }
-          B.startBlock(done);
-          break;
-        }
-        if (window) {
-          const valid = emitByteWindowGuard(this, window);
-          const fast = B.newLabel("bytes.window.fast"),
-            slow = B.newLabel("bytes.window.slow"),
-            done = B.newLabel("bytes.window.done");
-          B.condBr(valid, fast, slow);
-          const originalRanges = this.integerRanges,
-            originalBounds = this.bytesBounds;
-          this.byteWindowsEnabled = false;
-          try {
-            B.startBlock(slow);
-            this.emitStmt(s);
-            B.br(done);
-            B.startBlock(fast);
-            this.integerRanges = window.ranges;
-            this.bytesBounds = new Set([...originalBounds, ...window.bounds]);
-            this.emitStmt(s);
-            B.br(done);
-          } finally {
-            this.integerRanges = originalRanges;
-            this.bytesBounds = originalBounds;
-            this.byteWindowsEnabled = true;
-          }
-          B.startBlock(done);
-          break;
-        }
-        let countedJoin: string | null = null;
-        if (countedLoop?.guarded) {
-          let safe = "true";
-          if (countedLoop.limitGuarded) {
-            const bound = this.emitExpr(countedLoop.limit);
-            safe = B.tmp();
-            B.line(
-              `${safe} = fcmp ${countedLoop.step > 0 ? "ole" : "oge"} double ${bound.name}, ${f64Lit(countedLoop.guardLimit)}`,
-            );
-          }
-          if (countedLoop.startGuarded) {
-            // An exact integer of at most 2^53 - 1 in magnitude, and not -0
-            // (the bit patterns of the value and its round trip agree).
-            // NaN and infinities fail the ordered range tests.
-            const start = this.emitExpr(countedLoop.start);
-            const low = B.tmp(),
-              high = B.tmp(),
-              raw = B.tmp(),
-              wide = B.tmp(),
-              back = B.tmp(),
-              bits = B.tmp(),
-              backBits = B.tmp(),
-              exact = B.tmp(),
-              inRange = B.tmp(),
-              ok = B.tmp();
-            B.line(`${low} = fcmp oge double ${start.name}, ${f64Lit(-Number.MAX_SAFE_INTEGER)}`);
-            B.line(`${high} = fcmp ole double ${start.name}, ${f64Lit(Number.MAX_SAFE_INTEGER)}`);
-            B.line(`${inRange} = and i1 ${low}, ${high}`);
-            B.line(`${raw} = fptosi double ${start.name} to i64`);
-            B.line(`${wide} = freeze i64 ${raw}`);
-            B.line(`${back} = sitofp i64 ${wide} to double`);
-            B.line(`${bits} = bitcast double ${start.name} to i64`);
-            B.line(`${backBits} = bitcast double ${back} to i64`);
-            B.line(`${exact} = icmp eq i64 ${bits}, ${backBits}`);
-            B.line(`${ok} = and i1 ${inRange}, ${exact}`);
-            if (safe === "true") safe = ok;
-            else {
-              const both = B.tmp();
-              B.line(`${both} = and i1 ${safe}, ${ok}`);
-              safe = both;
-            }
-          }
-          const fast = B.newLabel("counted.fast");
-          const slow = B.newLabel("counted.slow");
-          countedJoin = B.newLabel("counted.done");
-          B.condBr(safe, fast, slow);
-          B.startBlock(slow);
-          this.countedLoopsEnabled = false;
-          this.emitStmt(s);
-          this.countedLoopsEnabled = true;
-          B.br(countedJoin);
-          B.startBlock(fast);
-        }
-        this.scopes.push([]);
-        let integerSlot: string | null = null;
-        let countedLimit: string | null = null;
-        if (integerLoop) {
-          integerSlot = B.slot();
-          B.entryAllocas.push(
-            `${integerSlot} = alloca ${this.sizeType} ; integer induction ${this.currentLocals.get(integerLoop.localId)!.name}`,
-          );
-          let start = "0";
-          if (integerArrayLoop && s.init?.kind === "varDecl" && s.init.init) {
-            const value = this.emitExpr(s.init.init);
-            start = B.tmp();
-            // The start is 0 or an enclosing array index plus one (at most
-            // 2^32 - 1): on 64-bit targets the signed conversion is exact
-            // and avoids x86-64's unsigned 64-bit conversion sequence.
-            const conversion = this.sizeType === "i64" ? "fptosi" : "fptoui";
-            B.line(`${start} = ${conversion} double ${value.name} to ${this.sizeType}`);
-            this.integerArrayBindings.add(integerLoop.localId);
-          }
-          B.line(`store ${this.sizeType} ${start}, ptr ${integerSlot}`);
-          this.integerLoopBindings.set(integerLoop.localId, {
-            slot: integerSlot,
-            type: this.sizeType,
-            range:
-              this.denseLoop?.counter === integerLoop.localId
-                ? this.denseLoop.range
-                : { min: 0, max: integerArrayLoop ? 4294967294 : Number.MAX_SAFE_INTEGER - 1 },
-          });
-        } else if (countedLoop) {
-          integerSlot = B.slot();
-          B.entryAllocas.push(
-            `${integerSlot} = alloca i64 ; integer induction ${this.currentLocals.get(countedLoop.localId)!.name}`,
-          );
-          const startNumber = this.emitExpr(countedLoop.start);
-          const start = B.tmp();
-          B.line(`${start} = fptosi double ${startNumber.name} to i64`);
-          B.line(`store i64 ${start}, ptr ${integerSlot}`);
-          this.integerLoopBindings.set(countedLoop.localId, {
-            slot: integerSlot,
-            type: "i64",
-            signed: true,
-            range:
-              this.denseLoop?.counter === countedLoop.localId
-                ? this.denseLoop.range
-                : countedLoop.range,
-          });
-          countedLimit = emitCountedLoopLimit(this, countedLoop);
-        } else if (s.init) {
-          // A multi-declarator head shares the loop's scope. Emitting its
-          // IR block as an ordinary block would release captured/ref locals
-          // before the first condition.
-          const initializers = s.init.kind === "block" ? s.init.body : [s.init];
-          for (const initializer of initializers) this.emitStmt(initializer);
-        }
-        const le = B.newLabel("loop.e");
-        // JS `for (let i ...)`: each iteration gets a FRESH binding holding
-        // a copy of the previous one (closures made in iteration k keep
-        // seeing iteration k's value) — only observable, and only emitted,
-        // when a let variable is captured (boxed). Freshen before the first
-        // condition and again in the continue-target block before updating.
-        const initializers = s.init?.kind === "block" ? s.init.body : s.init ? [s.init] : [];
-        const capturedLets = initializers.flatMap((init) => {
-          const local = init.kind === "varDecl" ? this.currentLocals.get(init.localId) : undefined;
-          return local?.boxed && local.mutable ? [local] : [];
-        });
-        const freshenBindings = (): void => {
-          for (const local of capturedLets) {
-            const slot = `%${mangleLocal(local.id)}`;
-            const fresh = B.tmp();
-            const old = B.tmp();
-            B.line(
-              `${fresh} = ${boxNewCall(this.shapeHost, local.type)} ; per-iteration ${local.name}`,
-            );
-            B.line(`${old} = load ptr, ptr ${slot}`);
-            const val = this.boxGet(old, local.type);
-            this.boxSet(fresh, local.type, val);
-            this.declare(`declare void @scr_box_release(ptr)`);
-            B.line(`call void @scr_box_release(ptr ${old})`);
-            B.line(`store ptr ${fresh}, ptr ${slot}`);
-          }
-        };
-        const workerBudget = this.workerLoopBudget(s);
-        freshenBindings();
-        this.emitLoopCopies(s, capturedLets.length === 0, le, (exit) => {
-          const lc = B.newLabel("loop.c");
-          const lb = B.newLabel("loop.b");
-          const lu =
-            s.update || capturedLets.length > 0 || workerBudget !== null
-              ? B.newLabel("loop.u")
-              : lc;
-          B.br(lc);
-          B.startBlock(lc);
-          if (integerLoop && integerSlot) {
-            const receiver = this.emitStableReceiver(integerLoop.limitReceiver, []);
-            const lenPtr = B.tmp();
-            const len = B.tmp();
-            const index = B.tmp();
-            const inBounds = B.tmp();
-            B.line(
-              `${lenPtr} = getelementptr inbounds %${integerArrayLoop ? "ScrArr" : "ScrBytes"}, ptr ${receiver.name}, i64 0, i32 1`,
-            );
-            if (integerArrayLoop) this.markMemoryPointer(lenPtr, "array:header");
-            B.line(
-              `${len} = load ${this.sizeType}, ptr ${lenPtr}${this.fieldAliasAttachment(lenPtr)}`,
-            );
-            B.line(`${index} = load ${this.sizeType}, ptr ${integerSlot}`);
-            B.line(`${inBounds} = icmp ult ${this.sizeType} ${index}, ${len}`);
-            B.condBr(inBounds, lb, exit);
-          } else if (countedLoop && integerSlot && countedLimit) {
-            const index = B.tmp();
-            const inBounds = B.tmp();
-            B.line(`${index} = load i64, ptr ${integerSlot}`);
-            B.line(
-              `${inBounds} = icmp ${countedLoop.step > 0 ? "slt" : "sgt"} i64 ${index}, ${countedLimit}`,
-            );
-            B.condBr(inBounds, lb, exit);
-          } else if (s.cond) B.condBr(this.emitCondition(s.cond), lb, exit);
-          else B.br(lb);
-          B.startBlock(lb);
-          this.jumpTargets.push({
-            kind: "loop",
-            brkLabel: exit,
-            contLabel: lu,
-            labels: s.labels,
-            frameDepth: this.frames.length,
-            scopeDepth: this.scopes.length,
-            finallyDepth: this.finallyStack.length,
-          });
-          this.emitBlock(s.body);
-          this.jumpTargets.pop();
-          B.br(lu);
-          if (lu !== lc) {
-            B.startBlock(lu);
-            this.emitWorkerLoopCheck(workerBudget);
-            freshenBindings();
-            if (integerLoop && integerSlot) {
-              const old = B.tmp();
-              const next = B.tmp();
-              B.line(`${old} = load ${this.sizeType}, ptr ${integerSlot}`);
-              B.line(`${next} = add nuw ${this.sizeType} ${old}, 1`);
-              B.line(`store ${this.sizeType} ${next}, ptr ${integerSlot}`);
-            } else if (countedLoop && integerSlot) {
-              const old = B.tmp();
-              const next = B.tmp();
-              B.line(`${old} = load i64, ptr ${integerSlot}`);
-              B.line(`${next} = add nsw i64 ${old}, ${countedLoop.step}`);
-              B.line(`store i64 ${next}, ptr ${integerSlot}`);
-            } else if (s.update) this.emitStmt(s.update);
-            B.br(lc);
-          }
-        });
-        B.startBlock(le);
-        this.releaseScope(this.scopes.pop()!);
-        if (integerLoop) this.integerLoopBindings.delete(integerLoop.localId);
-        if (countedLoop) this.integerLoopBindings.delete(countedLoop.localId);
-        if (integerArrayLoop) this.integerArrayBindings.delete(integerArrayLoop.localId);
-        if (countedJoin) {
-          B.br(countedJoin);
-          B.startBlock(countedJoin);
-        }
-        break;
-      }
-      case "forOf": {
-        // Ascending index loop; the length is re-read every iteration
-        // (JS-exact — pushes inside the body extend the iteration). The
-        // iterable temp lives in this statement's frame, so it is released
-        // when the whole loop ends (and by `return`'s frame sweep).
-        if (s.iterable.type.kind !== "array")
-          throw new LlvmUnsupportedError(`forOf:${s.iterable.type.kind}`, s.loc);
-        const elem = s.iterable.type.elem;
-        const stored =
-          s.iterable.kind === "varRef" ? this.storedSplits.get(s.iterable.localId) : undefined;
-        const direct = this.streamingSplitsEnabled ? stringSplit(s.iterable) : null;
-        const snapshot = stored
-          ? loadSplitSnapshot(this, stored)
-          : direct
-            ? emitSplitSnapshot(this, direct)
-            : null;
-        const arr = snapshot ? null : this.emitExpr(s.iterable);
-        const cursor = snapshot ? emitSplitCursor(this, snapshot) : null;
-        const scratch = snapshot ? emitSplitScratch(this) : null;
-        const deferred = snapshot && canDeferSplitPiece(s, this.currentLocals.get(s.localId));
-        const spanLength = deferred ? B.slot() : null;
-        if (spanLength) B.entryAllocas.push(`${spanLength} = alloca ${this.sizeType}`);
-        const idxSlot = snapshot ? null : B.slot();
-        if (idxSlot) {
-          B.entryAllocas.push(`${idxSlot} = alloca double`);
-          B.line(`store double ${f64Lit(0)}, ptr ${idxSlot}`);
-        }
-        const lc = B.newLabel("fof.c");
-        const lb = B.newLabel("fof.b");
-        const lu = B.newLabel("fof.u");
-        const le = B.newLabel("fof.e");
-        const workerBudget = this.workerLoopBudget(s);
-        B.br(lc);
-        B.startBlock(lc);
-        const inBounds = B.tmp();
-        let cur: string;
-        if (snapshot && cursor && scratch) {
-          cur = spanLength
-            ? emitSplitSpanNext(this, snapshot, cursor, spanLength)
-            : emitSplitNext(this, snapshot, cursor, scratch);
-          B.line(`${inBounds} = icmp ne ptr ${cur}, null`);
-        } else {
-          const i = B.tmp(),
-            lenPtr = B.tmp(),
-            rawLen = B.tmp(),
-            len = B.tmp();
-          B.line(`${i} = load double, ptr ${idxSlot}`);
-          // The inline form of scr_arr_len, like the `length` intrinsic.
-          B.line(`${lenPtr} = getelementptr inbounds %ScrArr, ptr ${arr!.name}, i32 0, i32 1`);
-          this.markMemoryPointer(lenPtr, "array:header");
-          B.line(
-            `${rawLen} = load ${this.sizeType}, ptr ${lenPtr}${this.fieldAliasAttachment(lenPtr)}${this.arrayLengthRange}`,
-          );
-          B.line(`${len} = ${sizeToDouble(this.sizeType)} ${this.sizeType} ${rawLen} to double`);
-          B.line(`${inBounds} = fcmp olt double ${i}, ${len}`);
-          cur = i;
-        }
-        B.condBr(inBounds, lb, le);
-        B.startBlock(lb);
-        this.jumpTargets.push({
-          kind: "loop",
-          brkLabel: le,
-          contLabel: lu,
-          labels: s.labels,
-          frameDepth: this.frames.length,
-          scopeDepth: this.scopes.length,
-          finallyDepth: this.finallyStack.length,
-        });
-        // The loop variable is a fresh const per iteration: its scope opens
-        // here, holds the (for ref elements: owned +1) current element, and
-        // releases it at the end of each iteration.
-        this.scopes.push([]);
-        const localInfo = this.currentLocals.get(s.localId);
-        const slot = `%${mangleLocal(s.localId)}`;
-        const borrowedElement = !snapshot && this.loopArrayBorrows.has(s);
-        if (!snapshot) {
-          const acc = elemAccess(elem);
-          const getter = borrowedElement ? "scr_arr_borrow_ref" : `scr_arr_get_${acc}`;
-          cur = emitDenseArrayGet(
-            this,
-            arr!.name,
-            { name: cur, type: { kind: "f64" } },
-            undefined,
-            acc,
-            elem,
-            getter,
-            !borrowedElement,
-          );
-        }
-        if (spanLength) {
-          const length = B.tmp();
-          B.line(`${length} = load ${this.sizeType}, ptr ${spanLength}`);
-          this.splitSpans.set(s.localId, { bytes: cur, length, scratch: scratch! });
-          cur = "null";
-        }
-        if (localInfo?.boxed) {
-          // Captured loop variable: a fresh box per iteration, matching the
-          // fresh const binding. The box takes ownership of a ref element's
-          // +1 and is released with the iteration's scope.
-          const box = B.tmp();
-          B.line(`${box} = ${boxNewCall(this.shapeHost, elem)} ; per-iteration ${localInfo.name}`);
-          this.boxSet(box, elem, cur);
-          B.line(`store ptr ${box}, ptr ${slot}`);
-          this.scopes[this.scopes.length - 1]!.push({ slot, type: elem, boxed: true });
-        } else {
-          B.line(`store ${this.llType(elem)} ${cur}, ptr ${slot}`);
-          if (isRefCounted(elem) && !borrowedElement)
-            this.scopes[this.scopes.length - 1]!.push({ slot, type: elem });
-        }
-        this.emitStmts(s.body);
-        if (spanLength) this.splitSpans.delete(s.localId);
-        const endedWithJump = endsWithJump(s.body);
-        const scope = this.scopes.pop()!;
-        if (!endedWithJump) this.releaseScope(scope);
-        this.jumpTargets.pop();
-        B.br(lu);
-        B.startBlock(lu);
-        this.emitWorkerLoopCheck(workerBudget);
-        if (idxSlot) {
-          const i2 = B.tmp(),
-            i3 = B.tmp();
-          B.line(`${i2} = load double, ptr ${idxSlot}`);
-          B.line(`${i3} = fadd double ${i2}, ${f64Lit(1)}`);
-          B.line(`store double ${i3}, ptr ${idxSlot}`);
-        }
-        B.br(lc);
-        B.startBlock(le);
-        break;
-      }
-      case "switch":
-        this.emitSwitch(s);
-        break;
-      case "break": {
-        // Unlabeled: the innermost loop OR switch (labeled blocks are
-        // skipped); labeled: the entry carrying the label.
-        let target: (typeof this.jumpTargets)[number] | undefined;
-        for (let i = this.jumpTargets.length - 1; i >= 0; i--) {
-          const t = this.jumpTargets[i]!;
-          if (s.label !== undefined ? t.labels?.includes(s.label) : t.kind !== "block") {
-            target = t;
-            break;
-          }
-        }
-        if (!target) throw new InternalCompilerError("llvm emitter bug: break target not found");
-        this.emitFinallysForJump(target.finallyDepth, target.frameDepth, target.scopeDepth);
-        if (!B.isTerminated()) B.terminate(`br label %${target.brkLabel}`);
-        break;
-      }
-      case "continue": {
-        // Unlabeled: the innermost loop; labeled: the loop carrying the
-        // label (tsc + the validator guarantee it IS a loop).
-        let target: (typeof this.jumpTargets)[number] | undefined;
-        for (let i = this.jumpTargets.length - 1; i >= 0; i--) {
-          const t = this.jumpTargets[i]!;
-          if (t.kind === "loop" && (s.label === undefined || t.labels?.includes(s.label))) {
-            target = t;
-            break;
-          }
-        }
-        if (!target || target.contLabel === null)
-          throw new InternalCompilerError("llvm emitter bug: continue target not found");
-        this.emitFinallysForJump(target.finallyDepth, target.frameDepth, target.scopeDepth);
-        if (!B.isTerminated()) B.terminate(`br label %${target.contLabel}`);
-        break;
-      }
-      case "return": {
-        // The value computes FIRST (an SSA temp — finally mutations of
-        // returned locals cannot change it, Node-exact), then every
-        // crossed finally runs innermost-first with the frames/scopes/
-        // tryStack it sees truncated to its region (its releases already
-        // ran; a throw inside a copy propagates OUT of the completing
-        // try, past its own catch), then the function-level releases and
-        // the actual ret. The parked value owns a synthetic slot-backed
-        // scope entry during each copy so a throwing finally releases it.
-        const adopted =
-          this.finallyStack.length > 0 || this.tryStack.length > 0
-            ? adoptingAwaitOf(s.value)
-            : null;
-        if (adopted !== null) {
-          this.emitAdoptingReturn(s, adopted);
-          break;
-        }
-        let v: LlValue | null = null;
-        const moved =
-          this.finallyStack.length === 0 && !this.currentUnionResult
-            ? this.movableReturn(s.value)
-            : null;
-        if (s.value !== null && this.currentUnionResult) {
-          // The tag and payload bits leave in registers; a heap box the
-          // value needed is released with its frame below.
-          const box = this.emitUnionProjection(s.value);
-          v = { name: this.scalarUnionPair(box.name, s.value.type), type: s.value.type };
-        } else if (moved !== null) {
-          // Returning an owned local hands its reference to the caller: no
-          // retain now and no release of the local below.
-          const t = B.tmp();
-          B.line(`${t} = load ptr, ptr ${moved.entry.slot}`);
-          v = { name: t, type: s.value!.type };
-          moved.scope.splice(moved.scope.indexOf(moved.entry), 1);
-          this.releaseForJump(0, 0);
-          moved.scope.splice(moved.index, 0, moved.entry);
-        } else if (s.value !== null && this.currentBorrowedReturn) {
-          // A borrowed-return body hands back its walk without a reference
-          // (it has no try statements, so no finally can intervene). An
-          // optional element read lends the element its array keeps alive.
-          const read = this.optionalArrayReads.get(s.value);
-          if (read) {
-            const slot = B.slot();
-            B.entryAllocas.push(`${slot} = alloca ptr`);
-            emitLocalArrayRead(this, { ...read, borrow: true }, slot);
-            const t = B.tmp();
-            B.line(`${t} = load ptr, ptr ${slot}`);
-            v = { name: t, type: s.value.type };
-          } else v = this.emitReadReceiver(s.value);
-        } else if (s.value !== null) {
-          v = this.emitExpr(s.value);
-          if (this.currentCoro !== null) this.toHeap(v);
-          else this.toFrame(v);
-        }
-        // An async generator's `return v` awaits v before any crossed
-        // finally runs. Past finally regions that turn is taken here and
-        // the request settles at completion; otherwise the completion's
-        // own turn is the await (nothing runs in between).
-        const genSettles =
-          this.currentAsyncGenerator && (s.awaited === true || this.finallyStack.length > 0);
-        // A completion turn that awaits x replaces a return() request's
-        // already-taken await.
-        if (this.currentAsyncGenerator && !genSettles) {
-          this.declare(`declare void @scr_async_gen_return_awaits()`);
-          B.line(`call void @scr_async_gen_return_awaits()`);
-        }
-        if (this.currentAsyncGenerator && s.awaited !== true && this.finallyStack.length > 0) {
-          if (this.wasi) this.emitWasiSuspend(null);
-          else {
-            this.declare(`declare void @scr_await_hop()`);
-            B.line(`call void @scr_await_hop()`);
-          }
-        }
-        if (this.finallyStack.length > 0) {
-          let pretSlot: string | null = null;
-          if (v !== null && isRefCounted(v.type) && !this.currentUnionResult) {
-            pretSlot = B.slot();
-            B.entryAllocas.push(`${pretSlot} = alloca ptr ; pending return (through finally)`);
-            B.line(`store ptr ${v.name}, ptr ${pretSlot}`);
-          }
-          const savedFrames = this.frames;
-          const savedScopes = this.scopes;
-          const savedFinally = this.finallyStack;
-          const savedTry = this.tryStack;
-          for (let i = savedFinally.length - 1; i >= 0 && !B.isTerminated(); i--) {
-            const fin = savedFinally[i]!;
-            this.releaseForJump(fin.frameDepth, fin.scopeDepth);
-            this.frames = this.frames.slice(0, fin.frameDepth);
-            this.scopes = this.scopes.slice(0, fin.scopeDepth);
-            this.finallyStack = savedFinally.slice(0, i);
-            this.tryStack = savedTry.slice(0, fin.tryDepth);
-            if (pretSlot !== null) this.scopes.push([{ slot: pretSlot, type: v!.type }]);
-            this.emitBlock(fin.body);
-            if (pretSlot !== null) this.scopes.pop();
-          }
-          if (!B.isTerminated()) this.releaseForJump(0, 0);
-          this.frames = savedFrames;
-          this.scopes = savedScopes;
-          this.finallyStack = savedFinally;
-          this.tryStack = savedTry;
-        } else if (moved === null) {
-          this.releaseForJump(0, 0);
-        }
-        if (!B.isTerminated()) {
-          if (genSettles) this.emitAsyncGenSettled();
-          if (this.currentCoro !== null) {
-            this.emitWasiFulfill(v);
-            B.terminate(`br label %${this.currentCoro.finalLabel}`);
-          } else if (v === null) B.terminate("ret void");
-          else if (this.currentInt32Result)
-            B.terminate(`ret i32 ${this.int32Argument(v, s.value!)}`);
-          else if (this.currentUnionResult) B.terminate(`ret ${SCALAR_UNION_RESULT} ${v.name}`);
-          else B.terminate(`ret ${this.llType(s.value!.type)} ${v.name}`);
-        }
-        break;
-      }
-      case "throw": {
-        // Evaluate, move ownership into the runtime's exception cell, then
-        // unwind unconditionally (the innermost try handler, or out of the
-        // function) — the same release path as return/break/continue.
-        const v = this.emitExpr(s.value);
-        if (isRefCounted(s.value.type)) this.toHeap(v); // the cell takes ownership
-        this.emitThrowValue({ name: v.name, type: s.value.type });
-        this.emitUnwind();
-        break;
-      }
-      case "rethrow": {
-        // Re-raise the saved snapshot (payload retained — the binding
-        // local releases with its scope) and unwind like `throw`.
-        const c = this.emitExpr({ kind: "varRef", localId: s.localId, type: CAUGHT, loc: s.loc });
-        this.declare(`declare void @scr_rethrow(ptr)`);
-        B.line(`call void @scr_rethrow(ptr ${c.name})`);
-        this.emitUnwind();
-        break;
-      }
-      case "runtimeFence": {
-        // The deferred JS compile fence: throw a catchable Error naming
-        // the construct (message) with the SC code stamped on `code`,
-        // then unwind exactly like `throw`. SCR_ERR_ERROR = 0.
-        const bytes = Buffer.byteLength(s.message, "utf8");
-        this.declare(`declare void @scr_throw_error_msg_code(i32, ptr, ${this.sizeType}, ptr)`);
-        B.line(
-          `call void @scr_throw_error_msg_code(i32 0, ptr ${this.cstr(s.message)}, ${this.sizeType} ${bytes}, ptr ${this.cstr(s.code)})`,
-        );
-        this.emitUnwind();
-        break;
-      }
-      case "tryCatch":
-        this.emitTryCatch(s);
-        break;
-      default: {
-        // Statement coverage is now total (bytesSet closed the set) —
-        // keep throwing LlvmUnsupportedError for any future IR statement kind.
-        const rest: never = s;
-        const k = (rest as IrStmt).kind;
-        throw new LlvmUnsupportedError(`stmt:${k}`, (rest as IrStmt).loc);
-      }
-    }
-    const frame = this.frames.pop()!;
-    // return/throw already released their frames on the jump path; the
-    // fall-through releases after them would be dead double-release code.
-    if (
-      s.kind !== "return" &&
-      s.kind !== "throw" &&
-      s.kind !== "rethrow" &&
-      s.kind !== "runtimeFence"
-    ) {
-      this.releaseTemps(frame);
-    }
+    return emitStmtBody(this, s);
   }
-
-  /** try/catch/finally via pending-flag unwinding — stmts.ts's
-   * emitTryCatch, block-flavored. Entering a try emits NO code: the try
-   * context is compile-time state (tryStack) redirecting unwinds inside
-   * the region to a label here. Shape:
-   *
-   *   { try body }           unwinds inside release frames/scopes down to
-   *                          this statement's depths, then br the handler
-   *   br after               (normal completion skips the handler)
-   *   try.c:                 (emitted only when some unwind targets it)
-   *     binding = scr_exc_take()   (or scr_exc_clear() when bindingless)
-   *     { catch body }
-   *   after: { finally body }      normal path
-   *   br try.e
-   *   try.fx:                exception path: the pending exception is
-   *     stash = scr_exc_take()     STASHED across the finally body so the
-   *     { finally body }           body's own pending checks answer for
-   *     scr_rethrow(stash)         themselves; a throw inside REPLACES the
-   *     <unwind>                   stash (it unwinds through the synthetic
-   *   try.e:                       scope entry) — JS's semantics exactly
-   *
-   * Abrupt completions inside tryBody/catchBody ride the finallyStack:
-   * returns inline copies at the return site, while break/continue use the
-   * shared region walk before branching to their resolved target. */
-  private emitTryCatch(s: IrStmt & { kind: "tryCatch" }): void {
-    const B = this.B;
-    const hasCatch = s.catchBody !== null;
-    const hasFinally = s.finallyBody !== null;
-    const catchLabel = B.newLabel("try.c");
-    const finExcLabel = B.newLabel("try.fx");
-    const endLabel = B.newLabel("try.e");
-    const afterTryLabel = hasFinally ? B.newLabel("try.f") : endLabel;
-
-    const handler = {
-      label: hasCatch ? catchLabel : finExcLabel,
-      used: false,
-      frameDepth: this.frames.length,
-      scopeDepth: this.scopes.length,
-    };
-    if (hasFinally) {
-      this.finallyStack.push({
-        frameDepth: this.frames.length,
-        scopeDepth: this.scopes.length,
-        tryDepth: this.tryStack.length,
-        body: s.finallyBody!,
-      });
-    }
-    this.tryStack.push(handler);
-    this.emitBlock(s.tryBody);
-    this.tryStack.pop();
-    B.br(afterTryLabel); // no-op when the try body already terminated
-
-    // Exceptions raised in the CATCH body unwind to the exception-path
-    // finally (pending stays set through it) when one exists.
-    const excHandler = {
-      label: finExcLabel,
-      used: !hasCatch && handler.used,
-      frameDepth: this.frames.length,
-      scopeDepth: this.scopes.length,
-    };
-
-    if (hasCatch && handler.used) {
-      B.startBlock(catchLabel);
-      if (hasFinally) this.tryStack.push(excHandler);
-      if (this.currentGenerator !== null) {
-        // Generator bodies: a pending GENRET sentinel (.return(v)
-        // injected at a yield) is a RETURN completion, not a throw —
-        // catch must not take it. Re-unwind past this handler (finally
-        // still runs — the unwind targets the exception-path finally or
-        // the enclosing context; the depths here equal the handler's).
-        this.declare(`declare zeroext i1 @scr_exc_genret_pending()`);
-        const gr = B.tmp();
-        B.line(`${gr} = call zeroext i1 @scr_exc_genret_pending()`);
-        const lg = B.newLabel("try.gr");
-        const lk = B.newLabel("try.gk");
-        B.condBr(gr, lg, lk);
-        B.startBlock(lg);
-        this.emitUnwind();
-        B.startBlock(lk);
-      }
-      if (s.catchLocalId !== null) {
-        // catch (e): the exception MOVES into the binding's snapshot box,
-        // owned by the catch body's scope (released on every exit —
-        // normal fall-through, jumps out, and unwinds from the body).
-        const slot = `%${mangleLocal(s.catchLocalId)}`;
-        this.declare(`declare ptr @scr_exc_take()`);
-        this.emitBlock(s.catchBody!, (scope) => {
-          const c = B.tmp();
-          B.line(`${c} = call ptr @scr_exc_take() ; catch binding`);
-          if (this.currentLocals.get(s.catchLocalId!)?.boxed) {
-            const box = B.tmp();
-            B.line(`${box} = ${boxNewCall(this.shapeHost, CAUGHT)} ; captured exception`);
-            this.boxSet(box, CAUGHT, c);
-            B.line(`store ptr ${box}, ptr ${slot}`);
-            scope.push({ slot, type: CAUGHT, boxed: true });
-          } else {
-            B.line(`store ptr ${c}, ptr ${slot}`);
-            scope.push({ slot, type: CAUGHT });
-          }
-        });
-      } else {
-        this.declare(`declare void @scr_exc_clear()`);
-        B.line(`call void @scr_exc_clear() ; catch takes the exception`);
-        this.emitBlock(s.catchBody!);
-      }
-      if (hasFinally) this.tryStack.pop();
-      B.br(afterTryLabel); // the catch's normal completion
-    }
-    if (hasFinally) this.finallyStack.pop();
-
-    if (hasFinally) {
-      B.startBlock(afterTryLabel);
-      this.emitBlock(s.finallyBody!); // normal path
-      B.br(endLabel);
-      if (excHandler.used) {
-        // The pending exception is STASHED across the finally body (a
-        // ScrCaught snapshot, re-raised after) so the body runs with a
-        // CLEAN cell — see stmts.ts's exception-path copy. The
-        // stash rides an alloca slot so a throw inside the body unwinds
-        // through the synthetic scope entry (replace semantics).
-        B.startBlock(finExcLabel);
-        this.declare(`declare ptr @scr_exc_take()`);
-        this.declare(`declare void @scr_rethrow(ptr)`);
-        this.declare(`declare void @scr_caught_release(ptr)`);
-        const stash = B.tmp();
-        const stashSlot = B.slot();
-        B.entryAllocas.push(`${stashSlot} = alloca ptr ; finally exception stash`);
-        B.line(`${stash} = call ptr @scr_exc_take() ; stash across finally`);
-        B.line(`store ptr ${stash}, ptr ${stashSlot}`);
-        this.scopes.push([{ slot: stashSlot, type: CAUGHT }]);
-        const suppressHandler =
-          s.suppressFinallyErrors || s.dropFinallyErrors
-            ? {
-                label: B.newLabel("try.fs"),
-                used: false,
-                frameDepth: this.frames.length,
-                scopeDepth: this.scopes.length,
-              }
-            : null;
-        if (suppressHandler) this.tryStack.push(suppressHandler);
-        this.emitBlock(s.finallyBody!);
-        if (suppressHandler) this.tryStack.pop();
-        this.scopes.pop(); // normal completion keeps the stash for the re-raise
-        B.line(`call void @scr_rethrow(ptr ${stash})`);
-        B.line(`call void @scr_caught_release(ptr ${stash})`);
-        this.emitUnwind();
-        if (suppressHandler?.used) {
-          B.startBlock(suppressHandler.label);
-          const cleanup = s.dropFinallyErrors ? "scr_exc_keep_first" : "scr_exc_suppress";
-          this.declare(`declare void @${cleanup}(ptr)`);
-          B.line(`call void @${cleanup}(ptr ${stash}) ; consumes stash`);
-          this.emitUnwind();
-        }
-      }
-      B.startBlock(endLabel);
-    } else {
-      B.startBlock(endLabel);
-    }
+  emitTryCatch(s: IrStmt & { kind: "tryCatch" }): void {
+    return emitTryCatch(this, s);
   }
-
-  /** JS-exact switch: lazily evaluated, arbitrary-expression case tests in
-   * source order, bodies falling through in source order until a break —
-   * Literal-only tests can use native dispatch; other tests keep a chain
-   * of conditional branches. All case bodies
-   * share ONE scope; because dispatch can jump PAST a varDecl into a later
-   * case, refcounted/boxed case-body locals are NULL-reset up front and
-   * the scope-exit releases rely on NULL tolerance. */
-  private emitSwitch(s: IrStmt & { kind: "switch" }): void {
-    const B = this.B;
-    const discKind = s.disc.type.kind;
-    if (discKind !== "f64" && discKind !== "string" && discKind !== "bool") {
-      throw new LlvmUnsupportedError(`switch:${discKind}`, s.loc);
-    }
-    // The disc temp lives in the whole statement's frame: for a string
-    // discriminant it stays alive across every test and body, released
-    // when the switch statement ends (break lands past this statement's
-    // frame release — releaseForJump keeps the target's own frame).
-    const disc = this.emitExpr(s.disc);
-    for (const c of s.cases) {
-      for (const stmt of c.body) {
-        if (stmt.kind !== "varDecl") continue;
-        const local = this.currentLocals.get(stmt.localId)!;
-        if (local.boxed || isRefCounted(local.type)) {
-          B.line(`store ptr null, ptr %${mangleLocal(local.id)} ; case-scoped ${local.name}`);
-        }
-      }
-    }
-    const end = B.newLabel("sw.e");
-    const caseLabels = s.cases.map(() => B.newLabel("sw.c"));
-    const defaultIdx = s.cases.findIndex((c) => c.test === null);
-    const fallback = defaultIdx >= 0 ? caseLabels[defaultIdx]! : end;
-    if (!emitLiteralSwitch(this, disc, s.disc, s.cases, caseLabels, fallback)) {
-      s.cases.forEach((c, i) => {
-        if (c.test === null) return;
-        // Lazy source-order test evaluation (a test after the match never
-        // runs). Each test's temps release right after its comparison.
-        this.frames.push([]);
-        const t = this.emitExpr(c.test);
-        const hit = B.tmp();
-        if (c.test.kind === "strLit") {
-          B.line(`${hit} = call zeroext i1 ${this.literalEquals(c.test.value)}(ptr ${disc.name})`);
-        } else if (c.test.type.kind === "string") {
-          this.declare(`declare zeroext i1 @scr_str_eq(ptr, ptr)`);
-          B.line(`${hit} = call zeroext i1 @sc_str_eq(ptr ${disc.name}, ptr ${t.name})`);
-        } else if (c.test.type.kind === "bool") {
-          B.line(`${hit} = icmp eq i1 ${disc.name}, ${t.name}`);
-        } else {
-          B.line(`${hit} = fcmp oeq double ${disc.name}, ${t.name}`);
-        }
-        this.releaseTemps(this.frames.pop()!);
-        const next = B.newLabel("sw.t");
-        B.condBr(hit, caseLabels[i]!, next);
-        B.startBlock(next);
-      });
-      B.br(fallback);
-    }
-
-    this.jumpTargets.push({
-      kind: "switch",
-      brkLabel: end,
-      contLabel: null,
-      labels: s.labels,
-      frameDepth: this.frames.length,
-      scopeDepth: this.scopes.length,
-      finallyDepth: this.finallyStack.length,
-    });
-    const scope: LlScopeEntry[] = [];
-    this.scopes.push(scope);
-    s.cases.forEach((c, i) => {
-      B.br(caseLabels[i]!); // the previous body's natural fall-through
-      B.startBlock(caseLabels[i]!);
-      this.emitStmts(c.body);
-    });
-    this.jumpTargets.pop();
-    this.scopes.pop();
-    // Natural fall-off of the last body releases the shared scope; a jump
-    // already released it before jumping.
-    const lastBody = s.cases[s.cases.length - 1]?.body;
-    if (!lastBody || !endsWithJump(lastBody)) this.releaseScope(scope);
-    B.br(end);
-    B.startBlock(end);
+  emitSwitch(s: IrStmt & { kind: "switch" }): void {
+    return emitSwitch(this, s);
   }
 
   /** Evaluates a condition (IR conds are bool-typed) and releases its
    * temps BEFORE the branch — safe because the result is a scalar i1, and
    * required in loop-condition blocks (their temps must not survive into
    * later blocks across the back edge). */
-  private emitCondition(cond: IrExpr): string {
+  emitCondition(cond: IrExpr): string {
     const v = this.emitExpr(cond);
     const frame = this.currentFrame();
     this.releaseTemps(frame);
@@ -9848,7 +4490,7 @@ export class LlEmitter {
     return this.canBorrowCallArgument(value);
   }
 
-  private emitDiscarded(e: IrExpr): void {
+  emitDiscarded(e: IrExpr): void {
     // A statement-position yield never reads the resumed value: it stays
     // in the IN slot until the next resume replaces it.
     if (e.kind === "yieldExpr" && e.captureCompletion === undefined && e.type.kind !== "void") {
@@ -9903,81 +4545,19 @@ export class LlEmitter {
   ): LlValue {
     return emitStringExpr(this, e);
   }
-
-  /**
-   * Lower canonical `target = target + suffix` after evaluating the old
-   * left side and suffix in JavaScript order.  The snapshot stays owned by
-   * the statement frame while the destination relinquishes its CURRENT
-   * value, making the snapshot unique unless a real observable alias exists.
-   */
   emitStringSelfConcatAssign(
     localId: string,
     left: IrExpr,
     suffix: IrExpr,
     retainForYield: boolean,
   ): LlValue {
-    const moved = this.emitMovedSelfConcat(localId, left, suffix, retainForYield);
-    if (moved) return moved;
-    const snapshot = this.emitExpr(left);
-    // A suffix of several parts, or a number, appends each operand to the
-    // snapshot directly (in place once the binding lets go of it) instead
-    // of first building the suffix as a separate string.
-    const parts = stringParts(suffix);
-    const mixed = parts.length > 1 || numberPart(parts[0]!) !== null;
-    const charCode = mixed ? null : this.emitSingleCharCode(suffix);
-    const inputs = mixed ? emitConcatInputs(this, parts) : [];
-    // The concat only reads the suffix; relinquishing the binding below
-    // runs no code that could rebind a borrowed local.
-    const right = mixed || charCode !== null ? null : emitStringInputs(this, [suffix])[0]!;
-    const b = this.binding(localId);
-    const B = this.B;
-    if (b.kind === "boxed") {
-      // set_ref(NULL) unlinks then releases the binding's post-suffix value.
-      this.boxSet(this.loadBox(b.slot), b.type, "null");
-    } else {
-      const old = B.tmp();
-      B.line(`${old} = load ptr, ptr ${b.slot}`);
-      B.line(`store ptr null, ptr ${b.slot}`);
-      if (b.kind === "global") this.releaseHeap(old, b.type);
-      else this.releaseFrame(old, b.type);
-    }
-    let raw: string;
-    if (charCode !== null) {
-      // The snapshot moves into the consuming character append.
-      this.toFrame(snapshot);
-      this.declare(`declare ptr @scr_str_concat_move_char_code(ptr, double)`);
-      raw = B.tmp();
-      B.line(
-        `${raw} = call ptr @scr_str_concat_move_char_code(ptr ${snapshot.name}, double ${charCode.name})`,
-      );
-    } else if (right === null) {
-      raw = emitMixedConcat(this, snapshot.name, inputs);
-    } else {
-      this.declare(`declare ptr @scr_str_concat(ptr, ptr)`);
-      raw = B.tmp();
-      B.line(`${raw} = call ptr @scr_str_concat(ptr ${snapshot.name}, ptr ${right.name})`);
-    }
-    const result = this.own({ name: raw, type: left.type });
-    if (retainForYield) {
-      const stored =
-        b.kind === "local"
-          ? this.retainFrame(result.name, result.type)
-          : this.retainHeap(result.name, result.type);
-      if (b.kind === "boxed") this.boxSet(this.loadBox(b.slot), b.type, stored);
-      else B.line(`store ptr ${stored}, ptr ${b.slot}`);
-    } else {
-      if (b.kind === "local") this.toFrame(result);
-      else this.toHeap(result);
-      if (b.kind === "boxed") this.boxSet(this.loadBox(b.slot), b.type, result.name);
-      else B.line(`store ptr ${result.name}, ptr ${b.slot}`);
-    }
-    return result;
+    return emitStringSelfConcatAssign(this, localId, left, suffix, retainForYield);
   }
 
   /** The code of a one-argument `String.fromCharCode(c)` suffix, emitted, so
    * `s += String.fromCharCode(c)` appends the character without building
    * the one-character string; null for any other suffix. */
-  private emitSingleCharCode(suffix: IrExpr): LlValue | null {
+  emitSingleCharCode(suffix: IrExpr): LlValue | null {
     if (suffix.kind !== "libCall" || suffix.fn !== "string.fromCharCode") return null;
     const packed = suffix.args[0];
     if (packed?.kind !== "arrayLit" || packed.elems.length !== 1 || packed.spreads?.length)
@@ -9994,7 +4574,7 @@ export class LlEmitter {
    * copying the whole string on every append. Returns false (emitting
    * nothing) for every other store.
    */
-  private emitFieldSelfConcat(s: Extract<IrStmt, { kind: "fieldSet" | "recordSet" }>): boolean {
+  emitFieldSelfConcat(s: Extract<IrStmt, { kind: "fieldSet" | "recordSet" }>): boolean {
     const suffix = matchFieldSelfConcat(s);
     if (!suffix || s.value.kind !== "strConcat") return false;
     let fieldType: IrType | undefined;
@@ -10061,7 +4641,7 @@ export class LlEmitter {
    * the snapshot, the array lets go of it (emitDenseSlotUnlink) so the
    * concat can append in place, and the result is stored as usual.
    */
-  private emitArraySelfConcat(s: Extract<IrStmt, { kind: "arraySet" }>): boolean {
+  emitArraySelfConcat(s: Extract<IrStmt, { kind: "arraySet" }>): boolean {
     const value = s.value;
     if (
       value.kind !== "strConcat" ||
@@ -10112,7 +4692,7 @@ export class LlEmitter {
    * expressions): reading the binding after the suffix gives the value the
    * left side had, so it moves into a consuming concat, and the result takes
    * its place. Null when the general snapshot path is needed. */
-  private emitMovedSelfConcat(
+  emitMovedSelfConcat(
     localId: string,
     left: IrExpr,
     suffix: IrExpr,
@@ -10381,7 +4961,7 @@ export class LlEmitter {
 
   /** Lifetime regions in modules with lifetimeRegions (llvm/regions.ts).
    * Created with the class graph; null elsewhere. */
-  private regions: LifetimeRegions | null = null;
+  regions: LifetimeRegions | null = null;
 
   /** LifetimeRegion's runtime calls: create answers the region id, enter
    * and leave bracket run(), release condemns. */
@@ -10412,10 +4992,10 @@ export class LlEmitter {
     return { name: "", type: e.type };
   }
 
-  private publishWalkersCache: PublishWalkers | null = null;
+  publishWalkersCache: PublishWalkers | null = null;
 
   /** Per-type publication walkers, created on the first publish. */
-  private get publishWalkers(): PublishWalkers {
+  get publishWalkers(): PublishWalkers {
     if (this.publishWalkersCache !== null) return this.publishWalkersCache;
     const byPre = [...this.classMeta.values()].sort((a, b) => a.pre - b.pre);
     this.publishWalkersCache = new PublishWalkers({
@@ -10500,7 +5080,7 @@ export class LlEmitter {
   private publishedNamesSym: string | null = null;
 
   /** The class-name table the hierarchy field guards index by preorder. */
-  private publishedClassNamesDefs(): string[] {
+  publishedClassNamesDefs(): string[] {
     if (this.publishedNamesSym === null) return [];
     const metas = [...this.classMeta.values()];
     const size = metas.reduce((max, m) => Math.max(max, m.pre + 1), 0);
@@ -10514,7 +5094,7 @@ export class LlEmitter {
 
   /** The frozen-object guard of a class field store, unless the store
    * provably targets a still-private `this` (PublishedTypes.privateStores). */
-  private emitStoreGuard(obj: string, s: Extract<IrStmt, { kind: "fieldSet" }>): void {
+  emitStoreGuard(obj: string, s: Extract<IrStmt, { kind: "fieldSet" }>): void {
     if (this.publishedTypes?.privateStores.has(s) === true) return;
     this.emitPublishedFieldGuard(obj, s.className, s.field);
   }
@@ -10606,153 +5186,12 @@ export class LlEmitter {
   ): LlValue {
     return emitAsyncExpr(this, e);
   }
-
-  /** Read a receiver whose value is consumed immediately by a field or tag
-   * load. No user code may run between this read and its consumer. Locals
-   * and their projections already have an owner; other expressions keep
-   * their ordinary statement-frame ownership. The caller must retain any
-   * reference result before evaluating another expression. */
   emitReadReceiver(e: IrExpr): LlValue {
-    if (!isRefCounted(e.type)) return this.emitExpr(e);
-    if (e.kind === "strLit") return { name: this.internLiteral(e.value), type: e.type };
-    const guarded = guardedValue(e);
-    if (guarded !== null) {
-      // Throwing guards run in place, exactly as the sequence emits them.
-      for (const s of (e as IrExpr & { kind: "seqExpr" }).stmts) this.emitStmt(s);
-      return this.emitReadReceiver(guarded);
-    }
-    if (e.kind === "varRef") {
-      this.materializeSplitLocal(e.localId);
-      const binding = this.binding(e.localId);
-      if (binding.kind === "boxed") {
-        // A projection consumes this pointer before any user code runs.
-        // Keep TDZ checks and caught-value conversion on the owned path.
-        if (!this.canBorrowReceiver(e)) return this.emitExpr(e);
-        const box = this.loadBox(binding.slot);
-        const payload = this.B.tmp();
-        const value = this.B.tmp();
-        this.B.line(`${payload} = getelementptr inbounds %ScrBox, ptr ${box}, i32 0, i32 5`);
-        this.B.line(`${value} = load ptr, ptr ${payload}`);
-        return { name: value, type: e.type };
-      }
-      if (binding.kind === "global") this.checkGlobalTdz(e.localId);
-      const value = this.B.tmp();
-      this.B.line(`${value} = load ptr, ptr ${binding.slot}`);
-      return { name: value, type: e.type };
-    }
-    if (e.kind === "dynCheck" && e.exact) return this.emitExactCapsuleObject(e.value, e.type);
-    if (e.kind === "chainRecv") {
-      // The chain's bind slot holds its receiver unchanged until the body
-      // finishes, owned by the slot itself or by the chain's receiver.
-      const bound = this.chainSlots.get(e.id);
-      if (!bound)
-        throw new InternalCompilerError(`llvm emitter bug: chainRecv "${e.id}" outside its chain`);
-      const value = this.B.tmp();
-      this.B.line(`${value} = load ${this.llType(bound.type)}, ptr ${bound.name}`);
-      return { name: value, type: e.type };
-    }
-    if (e.kind === "arrayGet" && this.canBorrowReceiver(e)) {
-      // The array keeps the element alive until the consumer; a missing
-      // element still traps exactly like the owned read.
-      const slot = this.B.slot();
-      this.B.entryAllocas.push(`${slot} = alloca ptr`);
-      emitBorrowedArrayRead(this, e, slot);
-      const value = this.B.tmp();
-      this.B.line(`${value} = load ptr, ptr ${slot}`);
-      return { name: value, type: e.type };
-    }
-    const wrap = this.borrowableNullableWrap(e);
-    if (wrap === "unit" && e.kind === "unionWrap")
-      return { name: this.unitInstanceRef(e.unionId, e.tag), type: e.type };
-    if (wrap === "ref" && e.kind === "unionWrap")
-      return { name: this.emitReadReceiver(e.value).name, type: e.type };
-    const read = matchMapRead(e, this.boxedUnionsById);
-    if (read) {
-      const result = emitStackMapRead(this, read);
-      if (result.owner) this.ownSlot(result.owner.slot, result.owner.type);
-      return result.value;
-    }
-    // A borrowed-return helper (such as an optional element read) lends its
-    // result like any borrowed-return call.
-    if (e.kind === "call" && this.borrowedReturns.has(e.callee) && this.canBorrowReceiver(e))
-      return emitBorrowedResultCall(this, e);
-    const arrayRead = this.optionalArrayReads.get(e);
-    if (arrayRead) return emitProjectedArrayRead(this, arrayRead);
-    const narrow = this.checkedNarrows.get(e);
-    const narrowed = narrow ? emitCheckedNarrowReceiver(this, narrow) : null;
-    if (narrowed) return narrowed;
-    if (canStackUnion(e, this.boxedUnionsById)) return emitStackUnion(this, e).value;
-    if (e.kind === "unionNarrow") {
-      const union = this.emitUnionProjection(e.value);
-      emitUnionNarrowGuard(this, union.name, e.unionId, e.tag);
-      return { name: this.unionPeek(union.name, e.unionId), type: e.type };
-    }
-    if ((e.kind === "downcast" || e.kind === "upcast") && e.value.type.kind === "object") {
-      // Prefix layouts: a class cast reads the operand's own pointer; a
-      // downcast verifies its target class (narrow-guards.ts).
-      const receiver = this.emitReadReceiver(e.value);
-      if (e.kind === "downcast" && e.type.kind === "object")
-        emitDowncastGuard(this, receiver.name, e.value.type.className, e.type.className);
-      return { name: receiver.name, type: e.type };
-    }
-    // A nullable-pointer field has no box to borrow. Projections use
-    // emitUnionProjection; other borrowers get an owned heap box.
-    if (this.nullableFieldGet(e)) return this.emitExpr(e);
-    if (e.kind === "recordGet" || e.kind === "fieldGet") {
-      const receiver = this.emitReadReceiver(e.obj);
-      if (e.kind === "recordGet") {
-        // An inline union field answers a private stack box.
-        const { ptr, type, inline } = this.recordFieldPtr(receiver.name, e.shapeId, e.field);
-        return { name: this.loadRecordField(ptr, type, inline), type: e.type };
-      }
-      const { ptr, type, inline } = this.classFieldPtr(receiver.name, e.className, e.field);
-      if (this.int32Slots.isField(e.className, e.field)) return this.loadInt32Field(ptr, e.type);
-      return { name: this.loadField(ptr, type, inline), type: e.type };
-    }
-    if (e.kind === "ternary" && this.canBorrowReceiver(e.then) && this.canBorrowReceiver(e.else_)) {
-      // Checked projections lower to a ternary with an always-throwing
-      // arm. Keep that check at the use, but borrow the successful arm.
-      const B = this.B;
-      const cond = this.emitExpr(e.cond);
-      const slot = B.slot();
-      B.entryAllocas.push(`${slot} = alloca ptr`);
-      const yes = B.newLabel("read.then"),
-        no = B.newLabel("read.else"),
-        join = B.newLabel("read.join");
-      B.condBr(cond.name, yes, no);
-      for (const [label, value] of [
-        [yes, e.then],
-        [no, e.else_],
-      ] as const) {
-        B.startBlock(label);
-        this.frames.push([]);
-        const result = this.emitReadReceiver(value);
-        B.line(`store ptr ${result.name}, ptr ${slot}`);
-        this.releaseTemps(this.frames.pop()!);
-        B.br(join);
-      }
-      B.startBlock(join);
-      const value = B.tmp();
-      B.line(`${value} = load ptr, ptr ${slot}`);
-      return { name: value, type: e.type };
-    }
-    // Scalar optional values and register results answer a private stack
-    // box. A ternary of borrowable arms above keeps lending its arm.
-    if (
-      (e.kind === "optChain" ||
-        e.kind === "nullish" ||
-        e.kind === "ternary" ||
-        e.kind === "arrIntrinsic") &&
-      isScalarOptionalSource(e, this.unionSources)
-    )
-      return emitScalarOptional(this, e);
-    if (e.kind === "call" && this.scalarResultCall(e)) return emitCallExpr(this, e, false, true);
-    if (e.kind === "call" && this.canBorrowReceiver(e)) return emitBorrowedResultCall(this, e);
-    return this.emitExpr(e);
+    return emitReadReceiver(this, e);
   }
 
   /** The frame slot a reassigned stack-object local keeps for its value. */
-  private stackObjectSlot(localId: string, type: IrType): string {
+  stackObjectSlot(localId: string, type: IrType): string {
     let slot = this.stackObjectSlots.get(localId);
     if (slot === undefined) {
       slot = this.B.slot();
@@ -10761,24 +5200,11 @@ export class LlEmitter {
     }
     return slot;
   }
-
-  /** A private stack union source with an independently owned payload. */
   canStackReceiver(e: IrExpr): boolean {
-    return this.isStackUnionSource(e);
+    return canStackReceiver(this, e);
   }
-
-  /** True for union sources that emitReadReceiver can produce as a private
-   * stack box with an independently owned payload (no heap union). */
   isStackUnionSource(e: IrExpr): boolean {
-    if (e.type.kind !== "union") return false;
-    return (
-      canStackUnion(e, this.boxedUnionsById) ||
-      matchMapRead(e, this.boxedUnionsById) !== null ||
-      this.optionalArrayReads.get(e) !== null ||
-      isScalarOptionalSource(e, this.unionSources) ||
-      this.scalarResultCall(e) ||
-      this.inlineFieldGet(e)
-    );
+    return isStackUnionSource(this, e);
   }
 
   /** A read of a record or class field that stores its scalar union
@@ -10954,72 +5380,8 @@ export class LlEmitter {
     this.B.line(`${object} = load ptr, ptr ${slot}`);
     return { name: object, type };
   }
-
   canBorrowReceiver(e: IrExpr): boolean {
-    switch (e.kind) {
-      case "chainRecv":
-        return this.chainSlots.has(e.id);
-      case "varRef": {
-        const binding = this.binding(e.localId);
-        return (
-          binding.kind !== "boxed" ||
-          (!binding.local!.tdz &&
-            binding.type.kind === e.type.kind &&
-            e.type.kind !== "caught" &&
-            isRefCounted(e.type))
-        );
-      }
-      case "unionNarrow":
-      // Class casts reinterpret the same pointer (prefix layouts).
-      case "downcast":
-      case "upcast":
-        return this.canBorrowReceiver(e.value);
-      // An inline union field has no box to lend: projections read it
-      // through emitReadReceiver's private stack box.
-      case "fieldGet":
-      case "recordGet":
-        return !this.inlineFieldGet(e) && this.canBorrowReceiver(e.obj);
-      case "ternary":
-        return this.canBorrowReceiver(e.then) && this.canBorrowReceiver(e.else_);
-      case "seqExpr": {
-        const guarded = guardedValue(e);
-        return guarded !== null && this.canBorrowReceiver(guarded);
-      }
-      // The runtime always sets a pending exception; its unreachable
-      // typed dummy is null and owns no receiver.
-      case "libCall":
-        return e.fn === "error.nodeThrow";
-      case "unionWrap": {
-        const wrap = this.borrowableNullableWrap(e);
-        return wrap === "unit" || (wrap === "ref" && this.canBorrowReceiver(e.value));
-      }
-      // A borrowed-return result stays reachable from its borrowed
-      // arguments until the consumer runs. Each argument is lent without a
-      // snapshot, so neither the callee nor a later argument may replace
-      // what it was read from: a callee that preserves every edge cannot,
-      // and any other one must leave the argument's locations unwritten.
-      case "call": {
-        if (!this.borrowedReturns.has(e.callee)) return false;
-        if (!e.args.every((arg) => this.referenceEffects.preserves(arg))) return false;
-        const preserving = this.referenceEffects.functions.has(e.callee);
-        if (preserving)
-          return e.args.every((arg) => !isRefCounted(arg.type) || this.canBorrowReceiver(arg));
-        if (this.referenceWrites === null) return false;
-        const lent = borrowableInputs(this, e.args, false, this.referenceWrites.summary(e.callee));
-        return e.args.every((arg, i) => !isRefCounted(arg.type) || lent[i] === true);
-      }
-      // A required element read: the (borrowed) array owns the element
-      // while an edge-preserving index computes.
-      case "arrayGet":
-        return (
-          e.arr.type.kind === "array" &&
-          isRefCounted(e.arr.type.elem) &&
-          this.canBorrowReceiver(e.arr) &&
-          this.referenceEffects.preserves(e.index)
-        );
-      default:
-        return false;
-    }
+    return canBorrowReceiver(this, e);
   }
 
   /** A reference held as one plain pointer that emitReadReceiver can read
@@ -11039,65 +5401,8 @@ export class LlEmitter {
         return false;
     }
   }
-
-  /** Functions returning a walk of their borrowed parameters return it
-   * without a reference (+0) from their borrowing body; direct callers
-   * either consume it as a receiver/walk or retain it at once, and the owned
-   * adapter retains before releasing its parameters. Candidates preserve
-   * every heap edge (so the result stays reachable from the arguments),
-   * borrow every reference parameter and return plain pointers. The set
-   * grows to a fixpoint because a call to a borrowed-return function with
-   * walk arguments is itself a walk; walk facts are then recomputed with
-   * the final set, admitting only parameters whose convention borrows. */
   private analyzeBorrowedReturns(): void {
-    const pointer = (type: IrType): boolean => this.plainReference(type);
-    const borrowedIds = (fn: IrFunction): Set<string> => {
-      const indexes = this.callLifetimes.borrowed.get(fn.name);
-      return new Set(fn.params.filter((_, i) => indexes?.has(i)).map((p) => p.localId));
-    };
-    const hostFor = (fn: IrFunction): WalkBorrowHost => {
-      const allowed = borrowedIds(fn);
-      const host = {
-        pointerLocal: (local: IrLocal) => pointer(local.type),
-        borrowsWithoutOwning: (e: IrExpr) => this.borrowsWithoutOwning(e),
-        borrowedReturn: (callee: string) => this.borrowedReturns.has(callee),
-        parameterAllowed: (id: string) => allowed.has(id),
-      };
-      return this.referenceEffects.functions.has(fn.name) ? host : this.unwrittenWalkHost(fn, host);
-    };
-    // With ReferenceWrites, a body that writes none of its walks' locations
-    // qualifies like one that preserves every edge.
-    const preserving = [...this.fnByName.values()].filter(
-      (fn) => this.referenceEffects.functions.has(fn.name) || this.referenceWrites !== null,
-    );
-    const candidates = preserving.filter((fn) => {
-      if (!pointer(fn.returnType) || fn.async || fn.generator || fn.captures) return false;
-      // A borrowing vtable slot dispatches to the borrowing body (or its
-      // virtual adapter) directly, and virtual callers own the result.
-      if (this.implSlotBorrowed(fn.name).size > 0) return false;
-      const indexes = this.callLifetimes.borrowed.get(fn.name);
-      return (
-        indexes !== undefined &&
-        indexes.size > 0 &&
-        fn.params.every((p, i) => !isRefCounted(p.type) || indexes.has(i))
-      );
-    });
-    for (let changed = true; changed;) {
-      changed = false;
-      for (const fn of candidates) {
-        if (this.borrowedReturns.has(fn.name)) continue;
-        if (!analyzeWalks(fn, hostFor(fn)).returnsWalk) continue;
-        this.borrowedReturns.add(fn.name);
-        // Nested borrowed returns extend the locations a caller depends on.
-        this.borrowedReturnKeyCache.clear();
-        changed = true;
-      }
-    }
-    if (this.borrowedReturns.size === 0) return;
-    for (const fn of preserving) {
-      const walks = analyzeWalks(fn, hostFor(fn)).locals;
-      if (walks.size > 0) this.walkBorrowsByFunction.set(fn.name, walks);
-    }
+    return analyzeBorrowedReturns(this);
   }
 
   /** emitReadReceiver produces this node's pointer without acquiring a
@@ -11409,7 +5714,7 @@ export class LlEmitter {
     this.B.line(`store i32 ${integer}, ptr ${slot}`);
   }
 
-  private emitBytesSet(
+  emitBytesSet(
     elem: IrBytesElem,
     receiver: string,
     index: LlValue,
@@ -11548,7 +5853,7 @@ export class LlEmitter {
 
 /** The adopting await a `return` value resolves through, if any: the value
  * itself or the operand of its conversion into the declared result. */
-function adoptingAwaitOf(value: IrExpr | null): ExprOf<"awaitExpr"> | null {
+export function adoptingAwaitOf(value: IrExpr | null): ExprOf<"awaitExpr"> | null {
   if (value === null) return null;
   let found: ExprOf<"awaitExpr"> | null = null;
   everyExpr(value, {
diff --git a/packages/compiler/src/backend/llvm/expr-async.test.ts b/packages/compiler/src/backend/llvm/expr-async.test.ts
index 0388e9a1c..46418d332 100644
--- a/packages/compiler/src/backend/llvm/expr-async.test.ts
+++ b/packages/compiler/src/backend/llvm/expr-async.test.ts
@@ -17,7 +17,7 @@ const concat = (left: IrExpr, right: IrExpr): IrExpr => ({
 
 function logBody(name: "console.log" | "console.error", args: IrExpr[]): string {
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [
diff --git a/packages/compiler/src/backend/llvm/expr-calls.test.ts b/packages/compiler/src/backend/llvm/expr-calls.test.ts
index 884cfda8c..5c0427351 100644
--- a/packages/compiler/src/backend/llvm/expr-calls.test.ts
+++ b/packages/compiler/src/backend/llvm/expr-calls.test.ts
@@ -79,7 +79,7 @@ function apply(arg: "param" | "element"): IrFunction {
 function moduleWith(functions: IrFunction[], main: IrStmt[] = []): IrModule {
   const store = local("store", strings, { mutable: true, boxed: true });
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [
diff --git a/packages/compiler/src/backend/llvm/expr-primitives.test.ts b/packages/compiler/src/backend/llvm/expr-primitives.test.ts
index 9ab749a3e..1790854ef 100644
--- a/packages/compiler/src/backend/llvm/expr-primitives.test.ts
+++ b/packages/compiler/src/backend/llvm/expr-primitives.test.ts
@@ -26,7 +26,7 @@ function fixture(): IrModule {
     loc,
   });
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "__main",
     functions: [{ name: "__main", params: [], returnType: VOID, locals: [], body, loc }],
@@ -121,7 +121,7 @@ test("reference identity and instanceof borrow their operands", () => {
     body: [{ kind: "return" as const, value, loc }],
   });
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "__main",
     classes: [
diff --git a/packages/compiler/src/backend/llvm/expr-primitives.ts b/packages/compiler/src/backend/llvm/expr-primitives.ts
index 4e7d418f8..35e759110 100644
--- a/packages/compiler/src/backend/llvm/expr-primitives.ts
+++ b/packages/compiler/src/backend/llvm/expr-primitives.ts
@@ -379,7 +379,29 @@ export function emitOperatorExpr(
         const fn = libm[e.op];
         if (fn === undefined) throw new LlvmUnsupportedError(`bin:${e.op}`, e.loc);
         host.declare(`declare double @${fn}(double, double)`);
-        B.line(`${t} = call double @${fn}(double ${l.name}, double ${r.name})`);
+        // libm's pow answers 1 for pow(±1, ±Infinity) and pow(1, NaN), where
+        // `**` answers NaN (and LLVM folds pow(1.0, x) to 1.0): an inline
+        // guard selects NaN for a base of ±1 with a non-finite exponent and
+        // keeps the direct pow call. A finite literal exponent, or a literal
+        // base other than ±1, cannot meet those cases and needs no guard.
+        if (fn === "pow" && !libmPowAgrees(e.left, e.right)) {
+          host.declare(`declare double @llvm.fabs.f64(double)`);
+          const power = B.tmp();
+          B.line(`${power} = call double @pow(double ${l.name}, double ${r.name})`);
+          const base = B.tmp();
+          const unit = B.tmp();
+          const magnitude = B.tmp();
+          const finite = B.tmp();
+          const reject = B.tmp();
+          B.line(`${base} = call double @llvm.fabs.f64(double ${l.name})`);
+          B.line(`${unit} = fcmp oeq double ${base}, 1.0`);
+          B.line(`${magnitude} = call double @llvm.fabs.f64(double ${r.name})`);
+          B.line(`${finite} = fcmp olt double ${magnitude}, 0x7FF0000000000000`);
+          B.line(`${reject} = select i1 ${finite}, i1 false, i1 ${unit}`);
+          B.line(`${t} = select i1 ${reject}, double 0x7FF8000000000000, double ${power}`);
+        } else {
+          B.line(`${t} = call double @${fn}(double ${l.name}, double ${r.name})`);
+        }
       }
       return { name: t, type: e.type };
     }
@@ -602,7 +624,7 @@ export function emitStringExpr(
     }
     case "strCmp": {
       const [l, r] = emitStringInputs(host, [e.left, e.right]);
-      const fn = e.utf16 === true ? "scr_str_cmp_u16" : "scr_str_cmp";
+      const fn = "scr_str_cmp_u16";
       host.declare(`declare i32 @${fn}(ptr, ptr)`);
       const c = B.tmp();
       const t = B.tmp();
@@ -1106,3 +1128,19 @@ export function emitRecordLitFields(
     host.initField(ptr, type, inline, v);
   }
 }
+
+/** Whether libm pow matches `**` for these operands: every case except a
+ * base of ±1 with a NaN or infinite exponent agrees. */
+function libmPowAgrees(base: IrExpr, exponent: IrExpr): boolean {
+  const power = numericLiteral(exponent);
+  if (power !== null && Number.isFinite(power)) return true;
+  const value = numericLiteral(base);
+  return value !== null && !Number.isNaN(value) && Math.abs(value) !== 1;
+}
+
+function numericLiteral(expr: IrExpr): number | null {
+  if (expr.kind === "numLit") return expr.value;
+  if (expr.kind === "unary" && expr.op === "-" && expr.operand.kind === "numLit")
+    return -expr.operand.value;
+  return null;
+}
diff --git a/packages/compiler/src/backend/llvm/expr-stream-bridges.test.ts b/packages/compiler/src/backend/llvm/expr-stream-bridges.test.ts
index 54c93c163..5d8f5f26f 100644
--- a/packages/compiler/src/backend/llvm/expr-stream-bridges.test.ts
+++ b/packages/compiler/src/backend/llvm/expr-stream-bridges.test.ts
@@ -20,7 +20,7 @@ function sharedGraph(roots: number): IrModule {
     unionId: `input${index}`,
   }));
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     records: [
@@ -161,7 +161,7 @@ test("class instance capsules bind prototype member names by exact class", () =>
   const loc = { file: "live-references.ts", start: 0, end: 0 };
   const base: IrType = { kind: "object", className: "Base" };
   const module: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     classes: [
diff --git a/packages/compiler/src/backend/llvm/int32-abi.test.ts b/packages/compiler/src/backend/llvm/int32-abi.test.ts
index 0dad7a998..a21056fd3 100644
--- a/packages/compiler/src/backend/llvm/int32-abi.test.ts
+++ b/packages/compiler/src/backend/llvm/int32-abi.test.ts
@@ -48,7 +48,7 @@ function fn(name: string, params: string[], body: IrStmt[], returnType = F64): I
 
 function module(): IrModule {
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [
@@ -158,7 +158,7 @@ function unionModule(): IrModule {
     loc,
   };
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     unions: [{ id: "optional", arms: [F64, UNDEFINED_T] }],
diff --git a/packages/compiler/src/backend/llvm/integer-clones.test.ts b/packages/compiler/src/backend/llvm/integer-clones.test.ts
index 72c9a1c85..c331fe458 100644
--- a/packages/compiler/src/backend/llvm/integer-clones.test.ts
+++ b/packages/compiler/src/backend/llvm/integer-clones.test.ts
@@ -85,7 +85,7 @@ const fib = fn(
 
 function module(): IrModule {
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [
@@ -265,7 +265,7 @@ test("sums the static integer ranges prove skip the overflow check", () => {
   // n is within [0, 10], so n - 1 cannot overflow; the accumulated sum is
   // still checked.
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [
@@ -330,7 +330,7 @@ test("borrowed number arrays: length and element reads qualify", () => {
     F64,
     [arr, F64],
   );
-  const mod: IrModule = { irVersion: 16, sourceFile: loc.file, entry: "sum", functions: [sum] };
+  const mod: IrModule = { irVersion: 17, sourceFile: loc.file, entry: "sum", functions: [sum] };
   expect(findIntegerClones(mod).members.has("sum")).toBe(false);
   expect(findIntegerClones(mod, () => false).members.has("sum")).toBe(false);
   const clones = findIntegerClones(mod, (name, index) => name === "sum" && index === 0);
diff --git a/packages/compiler/src/backend/llvm/intern-tables.test.ts b/packages/compiler/src/backend/llvm/intern-tables.test.ts
index 2c26c7a8f..ce571cc49 100644
--- a/packages/compiler/src/backend/llvm/intern-tables.test.ts
+++ b/packages/compiler/src/backend/llvm/intern-tables.test.ts
@@ -7,7 +7,7 @@ const loc = { file: "intern-tables.ts", start: 0, end: 1 };
 
 function module(body: IrExpr[]): IrModule {
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [
diff --git a/packages/compiler/src/backend/llvm/jsval-encoding.ts b/packages/compiler/src/backend/llvm/jsval-encoding.ts
new file mode 100644
index 000000000..58c0dd68e
--- /dev/null
+++ b/packages/compiler/src/backend/llvm/jsval-encoding.ts
@@ -0,0 +1,21 @@
+/* jsval word encoding constants shared by the jsval emitter (jsval.ts) and
+ * the RC helpers (shapes.ts). The authoritative description is scr_js.h. */
+
+/** Bit patterns (decimal i64 literals; unsigned compares read them as
+ * the 0xFFF9... words). */
+export const JS_BITS = {
+  /** Words below this are doubles; it is also undefined's word. */
+  limit: "-1970324836974592",
+  undefined: "-1970324836974592",
+  null: "-1970324836974591",
+  false: "-1970324836974590",
+  true: "-1970324836974589",
+  cellTag: "-1688849860263936",
+  strTag: "-1407374883553280",
+  bigintTag: "-1125899906842624",
+  payloadMask: "281474976710655",
+  canonicalNan: "9221120237041090560",
+} as const;
+
+/** The tag of a word (its top 16 bits) for each heap kind. */
+export const JS_TAGS = { cell: 0xfffa, str: 0xfffb, bigint: 0xfffc } as const;
diff --git a/packages/compiler/src/backend/llvm/jsval.ts b/packages/compiler/src/backend/llvm/jsval.ts
new file mode 100644
index 000000000..9c1e7ac0e
--- /dev/null
+++ b/packages/compiler/src/backend/llvm/jsval.ts
@@ -0,0 +1,575 @@
+/* The dynamic tier's jsval values (two-tier design stage S3; runtime
+ * scr_js.h / scr_js_value.c).
+ *
+ * A jsval is a 64-bit NaN-boxed word carried as an LLVM `ptr` (the bits
+ * travel through ptrtoint/inttoptr and are never dereferenced untagged), so
+ * the emitter's frames, locals and calls handle it like any refcounted
+ * pointer; its retain/release helpers skip immediates. Encoding (scr_js.h):
+ *
+ *   below LIMIT        an IEEE double, NaN canonical (0x7FF8000000000000)
+ *   0xFFF9 << 48 | n   undefined 0, null 1, false 2, true 3
+ *   0xFFFA << 48 | p   a ScrDyn cell
+ *   0xFFFB << 48 | p   a ScrStr
+ *   0xFFFC << 48 | p   a ScrBigInt
+ *
+ * Every js.* builtin inlines its number case: an operand is a number when
+ * it is an immediate double or a NUM cell (values read from dyn objects
+ * stay cells), and results are canonicalized immediates. Everything else
+ * calls the runtime, which defers to the dyn operators. 32-bit targets
+ * have no room for a double in a pointer: there a jsval is a ScrDyn cell
+ * and every js.* builtin is a runtime call. */
+import { InternalCompilerError } from "../../errors.js";
+import { DYN, type IrExpr } from "../../ir/ir.js";
+import type { LibCallExpr, LlValue, LlvmEmitterContext } from "./expr-context.js";
+import { f64Lit } from "./common.js";
+import { JS_BITS, JS_TAGS } from "./jsval-encoding.js";
+import { releaseSym } from "./shapes.js";
+
+/** SCR_DYN_NUM and the ScrDyn layout facts the number fast path reads
+ * (64-bit targets only): kind at +8, v.num at +16. */
+const DYN_NUM = 2;
+
+type Host = LlvmEmitterContext;
+
+/** Whether this target represents jsvals as NaN-boxed words. */
+export function jsImmediates(host: { sizeType: "i32" | "i64" }): boolean {
+  return host.sizeType === "i64";
+}
+
+/** Whether an emitted value is a temp the current statement frames own
+ * (so a conversion may move it instead of retaining it). */
+function ownedTemp(host: Host, v: LlValue): boolean {
+  for (const frame of host.frames)
+    for (const entry of frame) if (entry.slot !== true && entry.name === v.name) return true;
+  return false;
+}
+
+/** An emitted value with its ownership taken: moved out of its frame when
+ * it was a temp, retained otherwise. */
+function takeOwned(host: Host, v: LlValue): string {
+  if (ownedTemp(host, v)) {
+    host.toFrame(v);
+    return v.name;
+  }
+  return host.retainFrame(v.name, v.type);
+}
+
+function bitsOf(host: Host, v: string): string {
+  const b = host.B.tmp();
+  host.B.line(`${b} = ptrtoint ptr ${v} to i64`);
+  return b;
+}
+
+function wordOf(host: Host, bits: string): string {
+  const v = host.B.tmp();
+  host.B.line(`${v} = inttoptr i64 ${bits} to ptr`);
+  return v;
+}
+
+/** A double as a jsval word: NaN canonicalized. */
+function boxDouble(host: Host, d: string): string {
+  const B = host.B;
+  const raw = B.tmp();
+  const nan = B.tmp();
+  const bits = B.tmp();
+  B.line(`${raw} = bitcast double ${d} to i64`);
+  B.line(`${nan} = fcmp uno double ${d}, ${d}`);
+  B.line(`${bits} = select i1 ${nan}, i64 ${JS_BITS.canonicalNan}, i64 ${raw}`);
+  return wordOf(host, bits);
+}
+
+/** An operand of a number fast path: its jsval word (computed on demand
+ * for a static number), and the double a fast path computes with. */
+interface Operand {
+  word: () => string;
+  /** Emits the number test: returns the double and branches to `slow`
+   * when the operand is not a number; a static number needs no test. */
+  number: (slow: string) => string;
+}
+
+/** A static value crossing into jsval: emitted, and its dyn converter
+ * requested exactly as the `dynFrom` it replaces requested it. Converters
+ * are numbered per module in request order, so skipping the request would
+ * renumber the converters static functions call (their code must not
+ * change by a byte). An unused converter is dead code LLVM drops. */
+function emitStaticSource(host: Host, value: IrExpr): LlValue {
+  const v = host.emitExpr(value);
+  host.dyn.toDynHelper(v.type);
+  return v;
+}
+
+function operand(host: Host, e: IrExpr): Operand {
+  const B = host.B;
+  if (e.kind === "libCall" && e.fn === "js.fromF64") {
+    const d = emitStaticSource(host, e.args[0]!).name;
+    const word: string[] = [];
+    return {
+      word: () => {
+        if (word.length === 0) word.push(boxDouble(host, d));
+        return word[0]!;
+      },
+      number: () => d,
+    };
+  }
+  const v = host.emitExpr(e).name;
+  return {
+    word: () => v,
+    number: (slow) => {
+      const bits = bitsOf(host, v);
+      const isDouble = B.tmp();
+      B.line(`${isDouble} = icmp ult i64 ${bits}, ${JS_BITS.limit}`);
+      const slot = B.slot();
+      B.entryAllocas.push(`${slot} = alloca double`);
+      const dbl = B.newLabel("js.dbl");
+      const notDbl = B.newLabel("js.cell");
+      const isNum = B.newLabel("js.num");
+      const ok = B.newLabel("js.n");
+      B.condBr(isDouble, dbl, notDbl);
+      B.startBlock(dbl);
+      const d = B.tmp();
+      B.line(`${d} = bitcast i64 ${bits} to double`);
+      B.line(`store double ${d}, ptr ${slot}`);
+      B.br(ok);
+      B.startBlock(notDbl);
+      const tag = B.tmp();
+      const cell = B.tmp();
+      B.line(`${tag} = lshr i64 ${bits}, 48`);
+      B.line(`${cell} = icmp eq i64 ${tag}, ${JS_TAGS.cell}`);
+      const cellBlock = B.newLabel("js.cellk");
+      B.condBr(cell, cellBlock, slow);
+      B.startBlock(cellBlock);
+      const addr = B.tmp();
+      const p = B.tmp();
+      const live = B.tmp();
+      B.line(`${addr} = and i64 ${bits}, ${JS_BITS.payloadMask}`);
+      B.line(`${p} = inttoptr i64 ${addr} to ptr`);
+      B.line(`${live} = icmp ne ptr ${p}, null`);
+      const kindBlock = B.newLabel("js.kind");
+      B.condBr(live, kindBlock, slow);
+      B.startBlock(kindBlock);
+      const kp = B.tmp();
+      const kind = B.tmp();
+      const num = B.tmp();
+      B.line(`${kp} = getelementptr inbounds i8, ptr ${p}, i64 8 ; ->kind`);
+      B.line(`${kind} = load i32, ptr ${kp}`);
+      B.line(`${num} = icmp eq i32 ${kind}, ${DYN_NUM}`);
+      B.condBr(num, isNum, slow);
+      B.startBlock(isNum);
+      const np = B.tmp();
+      const n = B.tmp();
+      B.line(`${np} = getelementptr inbounds i8, ptr ${p}, i64 16 ; ->v.num`);
+      B.line(`${n} = load double, ptr ${np}`);
+      B.line(`store double ${n}, ptr ${slot}`);
+      B.br(ok);
+      B.startBlock(ok);
+      const out = B.tmp();
+      B.line(`${out} = load double, ptr ${slot}`);
+      return out;
+    },
+  };
+}
+
+/** The common shape of an inlined builtin: the fast path stores its result
+ * into a slot, the slow path calls the runtime (and checks for a throw),
+ * and the join reads the slot. */
+function withSlowPath(
+  host: Host,
+  ty: "ptr" | "double" | "i1",
+  fast: (slow: string) => string,
+  slow: () => string,
+  mayThrow: boolean,
+): string {
+  const B = host.B;
+  const slot = B.slot();
+  B.entryAllocas.push(`${slot} = alloca ${ty}`);
+  const slowLabel = B.newLabel("js.slow");
+  const done = B.newLabel("js.done");
+  const fastValue = fast(slowLabel);
+  B.line(`store ${ty} ${fastValue}, ptr ${slot}`);
+  B.br(done);
+  B.startBlock(slowLabel);
+  const slowValue = slow();
+  B.line(`store ${ty} ${slowValue}, ptr ${slot}`);
+  if (mayThrow) host.emitPendingCheck();
+  B.br(done);
+  B.startBlock(done);
+  const out = B.tmp();
+  B.line(`${out} = load ${ty}, ptr ${slot}`);
+  return out;
+}
+
+function call(host: Host, ret: string, fn: string, args: [string, string][]): string {
+  host.declare(`declare ${ret} @${fn}(${args.map(([t]) => t).join(", ")})`);
+  const r = host.B.tmp();
+  host.B.line(`${r} = call ${ret} @${fn}(${args.map(([t, v]) => `${t} ${v}`).join(", ")})`);
+  return r;
+}
+
+const ARITH_OPS: Readonly<Record<string, string>> = {
+  "-": "fsub",
+  "*": "fmul",
+  "/": "fdiv",
+  "%": "frem",
+};
+
+const COMPARE_OPS: Readonly<Record<string, string>> = {
+  "<": "olt",
+  "<=": "ole",
+  ">": "ogt",
+  ">=": "oge",
+};
+
+function literalOp(e: IrExpr): string | null {
+  return e.kind === "strLit" ? e.value : null;
+}
+
+/** js.* libCalls. */
+export function emitJsLibCall(host: Host, e: LibCallExpr): LlValue {
+  if (!jsImmediates(host)) return emitBoxedJsLibCall(host, e);
+  const B = host.B;
+  const jsval = (name: string): LlValue => host.own({ name, type: e.type });
+  const immediate = (name: string): LlValue => host.markImmortal({ name, type: e.type });
+  switch (e.fn) {
+    case "js.fromDyn": {
+      const d = host.emitExpr(e.args[0]!);
+      const owned = takeOwned(host, d);
+      const bits = bitsOf(host, owned);
+      const tagged = B.tmp();
+      B.line(`${tagged} = or i64 ${bits}, ${JS_BITS.cellTag}`);
+      return jsval(wordOf(host, tagged));
+    }
+    case "js.toDyn": {
+      const v = host.emitExpr(e.args[0]!);
+      const moved = ownedTemp(host, v);
+      if (moved) host.toFrame(v);
+      const out = withSlowPath(
+        host,
+        "ptr",
+        (slow) => {
+          const bits = bitsOf(host, v.name);
+          const tag = B.tmp();
+          const cell = B.tmp();
+          B.line(`${tag} = lshr i64 ${bits}, 48`);
+          B.line(`${cell} = icmp eq i64 ${tag}, ${JS_TAGS.cell}`);
+          const cellBlock = B.newLabel("js.todyn.cell");
+          B.condBr(cell, cellBlock, slow);
+          B.startBlock(cellBlock);
+          const addr = B.tmp();
+          B.line(`${addr} = and i64 ${bits}, ${JS_BITS.payloadMask}`);
+          const p = wordOf(host, addr);
+          return moved ? p : host.retainFrame(p, DYN);
+        },
+        () =>
+          call(host, "ptr", moved ? "scr_js_to_dyn" : "scr_js_to_dyn_borrow", [["ptr", v.name]]),
+        false,
+      );
+      return host.own({ name: out, type: DYN });
+    }
+    case "js.fromF64":
+      return immediate(boxDouble(host, emitStaticSource(host, e.args[0]!).name));
+    case "js.fromBool": {
+      const b = emitStaticSource(host, e.args[0]!).name;
+      const bits = B.tmp();
+      B.line(`${bits} = select i1 ${b}, i64 ${JS_BITS.true}, i64 ${JS_BITS.false}`);
+      return immediate(wordOf(host, bits));
+    }
+    case "js.fromStr":
+    case "js.fromBigInt": {
+      const s = emitStaticSource(host, e.args[0]!);
+      const owned = takeOwned(host, s);
+      const bits = bitsOf(host, owned);
+      const tagged = B.tmp();
+      const tag = e.fn === "js.fromStr" ? JS_BITS.strTag : JS_BITS.bigintTag;
+      B.line(`${tagged} = or i64 ${bits}, ${tag}`);
+      return jsval(wordOf(host, tagged));
+    }
+    case "js.toF64": {
+      const a = operand(host, e.args[0]!);
+      const out = withSlowPath(
+        host,
+        "double",
+        (slow) => a.number(slow),
+        () => {
+          // dynCheck's number check, on the value as a cell: the same
+          // TypeError for a non-number.
+          const boxed = call(host, "ptr", "scr_js_to_dyn_borrow", [["ptr", a.word()]]);
+          const helper = host.dyn.dynCheckHelper(e.type, undefined);
+          const d = B.tmp();
+          B.line(`${d} = call double @${helper}(ptr ${boxed}, ptr null)`);
+          B.line(`call void ${releaseSym(host.shapeHost, DYN)}(ptr ${boxed})`);
+          return d;
+        },
+        true,
+      );
+      return { name: out, type: e.type };
+    }
+    case "js.add":
+    case "js.arithmetic": {
+      const op = e.fn === "js.add" ? "+" : literalOp(e.args[2]!);
+      const inst = op === "+" ? "fadd" : op !== null ? ARITH_OPS[op] : undefined;
+      const a = operand(host, e.args[0]!);
+      const b = operand(host, e.args[1]!);
+      const opArg = e.fn === "js.arithmetic" ? host.emitExpr(e.args[2]!).name : null;
+      const runtime = (): string =>
+        e.fn === "js.add"
+          ? call(host, "ptr", "scr_js_add", [
+              ["ptr", a.word()],
+              ["ptr", b.word()],
+            ])
+          : call(host, "ptr", "scr_js_arithmetic", [
+              ["ptr", a.word()],
+              ["ptr", b.word()],
+              ["ptr", opArg!],
+            ]);
+      if (inst === undefined) {
+        // `**` (pow's JS edge cases) stays in the runtime.
+        const r = runtime();
+        const out = jsval(r);
+        host.emitPendingCheck();
+        return out;
+      }
+      const out = withSlowPath(
+        host,
+        "ptr",
+        (slow) => {
+          const x = a.number(slow);
+          const y = b.number(slow);
+          const r = B.tmp();
+          B.line(`${r} = ${inst} double ${x}, ${y}`);
+          return boxDouble(host, r);
+        },
+        runtime,
+        true,
+      );
+      return jsval(out);
+    }
+    case "js.compare": {
+      const op = literalOp(e.args[2]!);
+      const pred = op !== null ? COMPARE_OPS[op] : undefined;
+      if (pred === undefined)
+        throw new InternalCompilerError(`llvm emitter bug: js.compare operator ${String(op)}`);
+      const a = operand(host, e.args[0]!);
+      const b = operand(host, e.args[1]!);
+      const opArg = host.emitExpr(e.args[2]!).name;
+      const out = withSlowPath(
+        host,
+        "i1",
+        (slow) => {
+          const x = a.number(slow);
+          const y = b.number(slow);
+          const r = B.tmp();
+          B.line(`${r} = fcmp ${pred} double ${x}, ${y}`);
+          return r;
+        },
+        () =>
+          call(host, "zeroext i1", "scr_js_compare", [
+            ["ptr", a.word()],
+            ["ptr", b.word()],
+            ["ptr", opArg],
+          ]),
+        true,
+      );
+      return { name: out, type: e.type };
+    }
+    case "js.toNumeric":
+    case "js.increment": {
+      const a = operand(host, e.args[0]!);
+      const step = e.fn === "js.increment" ? host.emitExpr(e.args[1]!).name : null;
+      const out = withSlowPath(
+        host,
+        "ptr",
+        (slow) => {
+          const x = a.number(slow);
+          if (step === null) return boxDouble(host, x);
+          const delta = B.tmp();
+          const r = B.tmp();
+          B.line(`${delta} = select i1 ${step}, double ${f64Lit(1)}, double ${f64Lit(-1)}`);
+          B.line(`${r} = fadd double ${x}, ${delta}`);
+          return boxDouble(host, r);
+        },
+        () =>
+          step === null
+            ? call(host, "ptr", "scr_js_to_numeric", [["ptr", a.word()]])
+            : call(host, "ptr", "scr_js_increment", [
+                ["ptr", a.word()],
+                ["i1 zeroext", step],
+              ]),
+        true,
+      );
+      return jsval(out);
+    }
+    case "js.toNumberCoerce": {
+      const a = operand(host, e.args[0]!);
+      const out = withSlowPath(
+        host,
+        "double",
+        (slow) => a.number(slow),
+        () => call(host, "double", "scr_js_to_number", [["ptr", a.word()]]),
+        true,
+      );
+      return { name: out, type: e.type };
+    }
+    case "js.bitwise": {
+      const a = host.emitExpr(e.args[0]!).name;
+      const b = host.emitExpr(e.args[1]!).name;
+      const opArg = host.emitExpr(e.args[2]!).name;
+      const r = call(host, "ptr", "scr_js_bitwise", [
+        ["ptr", a],
+        ["ptr", b],
+        ["ptr", opArg],
+      ]);
+      const out = jsval(r);
+      host.emitPendingCheck();
+      return out;
+    }
+    default:
+      throw new InternalCompilerError(`llvm emitter bug: unknown jsval builtin ${e.fn}`);
+  }
+}
+
+/** 32-bit targets: a jsval is a ScrDyn cell, so the conversions to and from
+ * dyn are moves and every operator is a runtime call. */
+function emitBoxedJsLibCall(host: Host, e: LibCallExpr): LlValue {
+  const B = host.B;
+  const args = (): LlValue[] => e.args.map((arg) => host.emitExpr(arg));
+  const owned = (name: string): LlValue => host.own({ name, type: e.type });
+  const throwing = (v: LlValue): LlValue => {
+    host.emitPendingCheck();
+    return v;
+  };
+  switch (e.fn) {
+    case "js.fromDyn":
+    case "js.toDyn": {
+      const v = host.emitExpr(e.args[0]!);
+      return owned(takeOwned(host, v));
+    }
+    case "js.fromF64":
+      return owned(
+        call(host, "ptr", "scr_dyn_new_num", [["double", emitStaticSource(host, e.args[0]!).name]]),
+      );
+    case "js.fromBool":
+      return owned(
+        call(host, "ptr", "scr_dyn_new_bool", [
+          ["i1 zeroext", emitStaticSource(host, e.args[0]!).name],
+        ]),
+      );
+    case "js.fromStr":
+      return owned(
+        call(host, "ptr", "scr_js_from_str", [["ptr", emitStaticSource(host, e.args[0]!).name]]),
+      );
+    case "js.fromBigInt":
+      return owned(
+        call(host, "ptr", "scr_js_from_bigint", [["ptr", emitStaticSource(host, e.args[0]!).name]]),
+      );
+    case "js.toF64": {
+      const v = host.emitExpr(e.args[0]!).name;
+      const helper = host.dyn.dynCheckHelper(e.type, undefined);
+      const d = B.tmp();
+      B.line(`${d} = call double @${helper}(ptr ${v}, ptr null)`);
+      return throwing({ name: d, type: e.type });
+    }
+    case "js.add": {
+      const [a, b] = args();
+      return throwing(
+        owned(
+          call(host, "ptr", "scr_js_add", [
+            ["ptr", a!.name],
+            ["ptr", b!.name],
+          ]),
+        ),
+      );
+    }
+    case "js.arithmetic":
+    case "js.bitwise": {
+      const [a, b, op] = args();
+      const fn = e.fn === "js.arithmetic" ? "scr_js_arithmetic" : "scr_js_bitwise";
+      return throwing(
+        owned(
+          call(host, "ptr", fn, [
+            ["ptr", a!.name],
+            ["ptr", b!.name],
+            ["ptr", op!.name],
+          ]),
+        ),
+      );
+    }
+    case "js.compare": {
+      const [a, b, op] = args();
+      const r = call(host, "zeroext i1", "scr_js_compare", [
+        ["ptr", a!.name],
+        ["ptr", b!.name],
+        ["ptr", op!.name],
+      ]);
+      return throwing({ name: r, type: e.type });
+    }
+    case "js.toNumeric":
+      return throwing(owned(call(host, "ptr", "scr_js_to_numeric", [["ptr", args()[0]!.name]])));
+    case "js.increment": {
+      const [a, step] = args();
+      return throwing(
+        owned(
+          call(host, "ptr", "scr_js_increment", [
+            ["ptr", a!.name],
+            ["i1 zeroext", step!.name],
+          ]),
+        ),
+      );
+    }
+    case "js.toNumberCoerce":
+      return throwing({
+        name: call(host, "double", "scr_js_to_number", [["ptr", args()[0]!.name]]),
+        type: e.type,
+      });
+    default:
+      throw new InternalCompilerError(`llvm emitter bug: unknown jsval builtin ${e.fn}`);
+  }
+}
+
+/** ToBoolean of a jsval (a toBool over an operator result): doubles and
+ * the special words inline, cells, strings and BigInts in the runtime. */
+export function jsTruthy(host: Host, v: string): string {
+  if (!jsImmediates(host)) {
+    host.declare(`declare zeroext i1 @scr_dyn_truthy(ptr)`);
+    const r = host.B.tmp();
+    host.B.line(`${r} = call zeroext i1 @scr_dyn_truthy(ptr ${v})`);
+    return r;
+  }
+  const B = host.B;
+  const slot = B.slot();
+  B.entryAllocas.push(`${slot} = alloca i1`);
+  const bits = bitsOf(host, v);
+  const isDouble = B.tmp();
+  B.line(`${isDouble} = icmp ult i64 ${bits}, ${JS_BITS.limit}`);
+  const dbl = B.newLabel("js.truthy.d");
+  const other = B.newLabel("js.truthy.o");
+  const special = B.newLabel("js.truthy.s");
+  const heap = B.newLabel("js.truthy.h");
+  const done = B.newLabel("js.truthy.j");
+  B.condBr(isDouble, dbl, other);
+  B.startBlock(dbl);
+  const d = B.tmp();
+  const t = B.tmp();
+  B.line(`${d} = bitcast i64 ${bits} to double`);
+  B.line(`${t} = fcmp one double ${d}, ${f64Lit(0)}`);
+  B.line(`store i1 ${t}, ptr ${slot}`);
+  B.br(done);
+  B.startBlock(other);
+  const tag = B.tmp();
+  const isSpecial = B.tmp();
+  B.line(`${tag} = lshr i64 ${bits}, 48`);
+  B.line(`${isSpecial} = icmp eq i64 ${tag}, 65529`);
+  B.condBr(isSpecial, special, heap);
+  B.startBlock(special);
+  const isTrue = B.tmp();
+  B.line(`${isTrue} = icmp eq i64 ${bits}, ${JS_BITS.true}`);
+  B.line(`store i1 ${isTrue}, ptr ${slot}`);
+  B.br(done);
+  B.startBlock(heap);
+  const r = call(host, "zeroext i1", "scr_js_truthy", [["ptr", v]]);
+  B.line(`store i1 ${r}, ptr ${slot}`);
+  B.br(done);
+  B.startBlock(done);
+  const out = B.tmp();
+  B.line(`${out} = load i1, ptr ${slot}`);
+  return out;
+}
diff --git a/packages/compiler/src/backend/llvm/lib-dispatch.ts b/packages/compiler/src/backend/llvm/lib-dispatch.ts
index 2328839c9..16759a592 100644
--- a/packages/compiler/src/backend/llvm/lib-dispatch.ts
+++ b/packages/compiler/src/backend/llvm/lib-dispatch.ts
@@ -11,6 +11,7 @@ import { InternalCompilerError } from "../../errors.js";
 import { MAY_THROW_LIB_FNS } from "../../ir/builtin-effects.js";
 import type { IrExpr, IrType } from "../../ir/ir.js";
 import { LlvmUnsupportedError } from "./unsupported.js";
+import { emitJsLibCall } from "./jsval.js";
 import type { LlvmEmitterContext, LibCallExpr, LibCallPrefix, LlValue } from "./expr-context.js";
 import {
   ASSERT_VERDICT_LIB_FNS,
@@ -763,6 +764,8 @@ export function emitLibCall(host: LlvmEmitterContext, e: LibCallExpr): LlValue {
     case "dyn":
     case "global":
       return host.emitDynamicLibCall(e);
+    case "js":
+      return emitJsLibCall(host, e);
     case "fs":
     case "fsp":
     case "fileHandle":
@@ -847,6 +850,7 @@ export function emitLibCall(host: LlvmEmitterContext, e: LibCallExpr): LlValue {
     case "util":
     case "bigint":
     case "crypto":
+    case "webcrypto":
     case "buffer":
     case "bytes":
     case "tlsca":
diff --git a/packages/compiler/src/backend/llvm/lib-process.ts b/packages/compiler/src/backend/llvm/lib-process.ts
index e6d8acdbe..eaf7f31cd 100644
--- a/packages/compiler/src/backend/llvm/lib-process.ts
+++ b/packages/compiler/src/backend/llvm/lib-process.ts
@@ -546,15 +546,24 @@ export function emitProcessLibCall(host: LlvmEmitterContext, e: LibCallExpr): Ll
       B.line(`call void @scr_stdin_on_end(ptr ${cb.name}, i1 ${once.name})`);
       return { name: "", type: e.type };
     }
+    // A string listener takes the setEncoding-decoded chunk.
+    const stringData = e.fn === "stdin.onData" && cbT.params[0]?.kind === "string";
     const adapter =
       e.fn === "stdin.onData"
         ? cbT.params.length === 0
           ? "scr_stdin_data_thunk0"
-          : "scr_stdin_data_thunk_bytes"
+          : stringData
+            ? "scr_stdin_data_thunk_str"
+            : "scr_stdin_data_thunk_bytes"
         : cbT.params.length === 0
           ? "scr_child_err_thunk0"
           : "scr_child_err_thunk_error";
-    const sym = e.fn === "stdin.onData" ? "scr_stdin_on_data" : "scr_stdin_on_error";
+    const sym =
+      e.fn === "stdin.onData"
+        ? stringData
+          ? "scr_stdin_on_data_str"
+          : "scr_stdin_on_data"
+        : "scr_stdin_on_error";
     host.declare(`declare void @${adapter}(ptr, ptr)`);
     host.declare(`declare void @${sym}(ptr, ptr, i1 zeroext)`);
     B.line(`call void @${sym}(ptr ${cb.name}, ptr @${adapter}, i1 ${once.name})`);
diff --git a/packages/compiler/src/backend/llvm/lib-shared.ts b/packages/compiler/src/backend/llvm/lib-shared.ts
index a713546a3..cbfe4caf5 100644
--- a/packages/compiler/src/backend/llvm/lib-shared.ts
+++ b/packages/compiler/src/backend/llvm/lib-shared.ts
@@ -94,6 +94,8 @@ export const LIB_FN_SYMS: Record<string, string> = {
   "num.parseInt": "scr_parse_int",
   "num.parseFloat": "scr_parse_float",
   "str.localeCompare": "scr_str_locale_compare",
+  "str.substr": "scr_str_substr",
+  "str.localeCase": "scr_str_locale_case",
   "str.replaceLiteral": "scr_str_replace_literal",
   "str.replaceChars": "scr_str_replace_chars",
   "num.fromString": "scr_string_to_number",
@@ -143,6 +145,8 @@ export const LIB_FN_SYMS: Record<string, string> = {
   "num.toExponential": "scr_num_to_exponential",
   "num.toFixed0": "scr_num_to_fixed0",
   "num.toFixed": "scr_num_to_fixed",
+  "num.toPrecision": "scr_num_to_precision",
+  "num.toExponentialDigits": "scr_num_to_exponential_digits",
   "num.toStringRadix": "scr_num_to_string_radix",
   "num.toStringRadixF64": "scr_num_to_string_radix_f64",
   "num.sameValue": "scr_num_same_value",
@@ -195,6 +199,7 @@ export const LIB_FN_SYMS: Record<string, string> = {
   "os.cpusModel": "scr_os_cpus_model",
   "os.cpusField": "scr_os_cpus_field",
   "os.constants": "scr_os_constants",
+  "fs.constants": "scr_fs_constants_object",
   "constants.object": "scr_node_constants",
   "os.release": "scr_os_release",
   "os.userName": "scr_os_user_name",
@@ -408,6 +413,7 @@ export const LIB_FN_SYMS: Record<string, string> = {
   "buffer.fromStr": "scr_bytes_from_str",
   "buffer.fromStrChecked": "scr_bytes_from_str_checked",
   "buffer.brand": "scr_bytes_as_buffer",
+  "buffer.isBranded": "scr_bytes_is_buffer",
   "buffer.fromDyn": "scr_buffer_from_dyn",
   "buffer.concat": "scr_buffer_concat",
   "buffer.concatLen": "scr_buffer_concat_len",
@@ -574,12 +580,19 @@ export const LIB_FN_SYMS: Record<string, string> = {
   "crypto.randomIntMax": "scr_crypto_random_int_max",
   "crypto.randomFillView": "scr_crypto_random_fill",
   "crypto.randomFillViewRest": "scr_crypto_random_fill_rest",
+  "crypto.getRandomValues": "scr_crypto_get_random_values",
+  "crypto.getRandomValuesDyn": "scr_crypto_get_random_values_dyn",
   "crypto.randomFillSyncDyn": "scr_crypto_random_fill_sync_dyn",
   "crypto.randomUUIDOpts": "scr_crypto_random_uuid_opts",
   "crypto.createSecretKey": "scr_crypto_create_secret_key",
   "crypto.generateKeySync": "scr_crypto_generate_key_sync",
   "crypto.keyObjectInput": "scr_crypto_key_object_input",
   "crypto.isKeyObject": "scr_crypto_is_key_object",
+  "webcrypto.importKey": "scr_webcrypto_import_key",
+  "webcrypto.sign": "scr_webcrypto_sign",
+  "webcrypto.verify": "scr_webcrypto_verify",
+  "webcrypto.digest": "scr_webcrypto_digest",
+  "webcrypto.isCryptoKey": "scr_webcrypto_is_crypto_key",
   "crypto.randomUUIDv7": "scr_crypto_random_uuid_v7",
   "crypto.pbkdf2": "scr_crypto_pbkdf2",
   "crypto.hkdf": "scr_crypto_hkdf",
@@ -886,12 +899,15 @@ export const LIB_FN_SYMS: Record<string, string> = {
   "dyn.typedRefIs": "scr_dyn_typed_ref_is_key",
   "dyn.classIs": "scr_dyn_class_is_key",
   "dyn.iterPack": "scr_dyn_iter_pack",
+  "dyn.destructureRest": "scr_dyn_destructure_rest",
   "dyn.iterator": "scr_dyn_iterator",
   "dyn.arrayFromIterator": "scr_dyn_array_from_iterator",
   "dyn.iteratorResult": "scr_dyn_iterator_result",
   "dyn.iteratorCanStep": "scr_dyn_iterator_can_step",
   "dyn.iteratorStep": "scr_dyn_iterator_step",
   "dyn.iteratorStepDone": "scr_dyn_iterator_step_done",
+  "dyn.setGeneratorMembers": "scr_dyn_set_generator_members",
+  "dyn.iteratorHelperMethod": "scr_dyn_iterator_helper_method",
   "dyn.collectionIteratorIndex": "scr_dyn_collection_iterator_index",
   "dyn.mapSeedEntries": "scr_dyn_map_seed_entries",
   "dyn.mapSeedEntry": "scr_dyn_map_seed_entry",
@@ -1329,6 +1345,7 @@ export const LIB_FN_SYMS: Record<string, string> = {
   "process.emitWarningText": "scr_process_emit_warning_text",
   "process.deprecationFlag": "scr_process_deprecation_flag",
   "process.setDeprecationFlag": "scr_process_set_deprecation_flag",
+  "process.setEmitWarning": "scr_process_set_emit_warning",
   "process.onUncaughtException": "scr_process_on_uncaught_exception",
   "process.offUncaughtException": "scr_process_off_uncaught_exception",
   "process.onUnhandledRejection": "scr_process_on_unhandled_rejection",
@@ -1464,6 +1481,10 @@ export const USES_TIMERS_LIB_FNS = new Set<string>([
   "process.emitWarning",
   // Decipheriv.setAuthTag reports DEP0182 on the next tick.
   "crypto.cipherNew",
+  // WebCrypto results settle through the deferred crypto queue.
+  "webcrypto.sign",
+  "webcrypto.verify",
+  "webcrypto.digest",
   "process.emitWarningText",
   // The legacy url entries queue DEP0169/DEP0170 on the next tick.
   "url.legacyParse",
diff --git a/packages/compiler/src/backend/llvm/local-array-reads.test.ts b/packages/compiler/src/backend/llvm/local-array-reads.test.ts
index b16fe2608..96221942f 100644
--- a/packages/compiler/src/backend/llvm/local-array-reads.test.ts
+++ b/packages/compiler/src/backend/llvm/local-array-reads.test.ts
@@ -129,7 +129,7 @@ function fixture(): IrModule {
     ],
   };
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     records: [{ id: "cell", fields: [{ name: "x", type: F64 }] }],
diff --git a/packages/compiler/src/backend/llvm/local-union-storage.test.ts b/packages/compiler/src/backend/llvm/local-union-storage.test.ts
index 9931b3a47..b8f44408d 100644
--- a/packages/compiler/src/backend/llvm/local-union-storage.test.ts
+++ b/packages/compiler/src/backend/llvm/local-union-storage.test.ts
@@ -82,7 +82,7 @@ function fixture(): IrModule {
     ],
   };
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     unions: [{ id: "optional", arms: [STRING, UNDEFINED_T] }],
@@ -359,7 +359,7 @@ test("number bindings of optional reads and `??` chains stay in stack storage",
   });
   const zero: IrExpr = { kind: "numLit", value: 0, type: F64, loc };
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     unions: [{ id: "maybe", arms: [F64, UNDEFINED_T] }],
diff --git a/packages/compiler/src/backend/llvm/map-entry-fusion.test.ts b/packages/compiler/src/backend/llvm/map-entry-fusion.test.ts
index 26f2a7c3c..58d3a33d6 100644
--- a/packages/compiler/src/backend/llvm/map-entry-fusion.test.ts
+++ b/packages/compiler/src/backend/llvm/map-entry-fusion.test.ts
@@ -94,7 +94,7 @@ function fixture(
     body: body(ref("map", map), ref("key", key), ref("other", map)),
   };
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     unions: [{ id: "optional", arms: [value, UNDEFINED_T] }],
diff --git a/packages/compiler/src/backend/llvm/map-number-lookup.test.ts b/packages/compiler/src/backend/llvm/map-number-lookup.test.ts
index 989527a32..5dc3589e4 100644
--- a/packages/compiler/src/backend/llvm/map-number-lookup.test.ts
+++ b/packages/compiler/src/backend/llvm/map-number-lookup.test.ts
@@ -62,7 +62,7 @@ function fixture(key: IrType, value: IrType, read: "key" | "value"): IrModule {
     body,
   };
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     records: [],
@@ -141,7 +141,7 @@ function lookupFixture(): IrModule {
     body: [{ kind: "return", value: has, loc }],
   };
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     records: [],
diff --git a/packages/compiler/src/backend/llvm/map-read-lifetimes.test.ts b/packages/compiler/src/backend/llvm/map-read-lifetimes.test.ts
index 6c696aeb5..3725db060 100644
--- a/packages/compiler/src/backend/llvm/map-read-lifetimes.test.ts
+++ b/packages/compiler/src/backend/llvm/map-read-lifetimes.test.ts
@@ -71,7 +71,7 @@ function fixture(value: IrType = record, key: IrType = F64): IrModule {
     ],
   };
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     records: [{ id: "cell", fields: [{ name: "x", type: F64 }] }],
@@ -401,7 +401,7 @@ test("a number-key write after a read stores into the found entry and appends th
     ],
   };
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     records: [],
diff --git a/packages/compiler/src/backend/llvm/nullable-unions.test.ts b/packages/compiler/src/backend/llvm/nullable-unions.test.ts
index 46bd688e7..47278453e 100644
--- a/packages/compiler/src/backend/llvm/nullable-unions.test.ts
+++ b/packages/compiler/src/backend/llvm/nullable-unions.test.ts
@@ -16,7 +16,7 @@ const c: IrType = { kind: "record", shapeId: "c" };
 
 function module(unions: IrUnionDef[], extra: Partial<IrModule> = {}): IrModule {
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     records: ["a", "b", "c"].map((id) => ({ id, fields: [{ name: id, type: F64 }] })),
diff --git a/packages/compiler/src/backend/llvm/publish.test.ts b/packages/compiler/src/backend/llvm/publish.test.ts
index c2d55804c..5a84caa96 100644
--- a/packages/compiler/src/backend/llvm/publish.test.ts
+++ b/packages/compiler/src/backend/llvm/publish.test.ts
@@ -7,7 +7,7 @@ const node = { kind: "object" as const, className: "Node" };
 const kids = { kind: "array" as const, elem: node };
 
 const mod: IrModule = {
-  irVersion: 16,
+  irVersion: 17,
   sourceFile: loc.file,
   entry: "main",
   functions: [
diff --git a/packages/compiler/src/backend/llvm/receivers.ts b/packages/compiler/src/backend/llvm/receivers.ts
new file mode 100644
index 000000000..a1c771797
--- /dev/null
+++ b/packages/compiler/src/backend/llvm/receivers.ts
@@ -0,0 +1,409 @@
+/* LlEmitter's receivers: receiver reads, and the analyses that decide when calls, receivers and returns borrow. */
+import type { LlEmitter } from "./emitter.js";
+import {
+  type IrExpr,
+  type IrFunction,
+  type IrLocal,
+  type IrType,
+  isRefCounted,
+} from "../../ir/ir.js";
+import type { LlValue } from "./expr-context.js";
+import { guardedValue } from "./borrowed-receivers.js";
+import { InternalCompilerError } from "../../errors.js";
+import { emitBorrowedArrayRead, emitProjectedArrayRead } from "./local-array-reads.js";
+import { emitStackMapRead, matchMapRead } from "./map-read-lifetimes.js";
+import { emitBorrowedResultCall, emitCallExpr } from "./expr-calls.js";
+import { emitCheckedNarrowReceiver } from "./checked-narrows.js";
+import { canStackUnion, emitStackUnion } from "./stack-unions.js";
+import { emitDowncastGuard, emitUnionNarrowGuard } from "./narrow-guards.js";
+import { emitScalarOptional, isScalarOptionalSource } from "./local-union-storage.js";
+import { borrowableInputs } from "./borrowed-inputs.js";
+import { type WalkBorrowHost, analyzeWalks } from "./walk-borrows.js";
+
+/** Read a receiver whose value is consumed immediately by a field or tag
+ * load. No user code may run between this read and its consumer. Locals
+ * and their projections already have an owner; other expressions keep
+ * their ordinary statement-frame ownership. The caller must retain any
+ * reference result before evaluating another expression. */
+export function emitReadReceiver(emitter: LlEmitter, e: IrExpr): LlValue {
+  if (!isRefCounted(e.type)) return emitter.emitExpr(e);
+  if (e.kind === "strLit") return { name: emitter.internLiteral(e.value), type: e.type };
+  const guarded = guardedValue(e);
+  if (guarded !== null) {
+    // Throwing guards run in place, exactly as the sequence emits them.
+    for (const s of (e as IrExpr & { kind: "seqExpr" }).stmts) emitter.emitStmt(s);
+    return emitter.emitReadReceiver(guarded);
+  }
+  if (e.kind === "varRef") {
+    emitter.materializeSplitLocal(e.localId);
+    const binding = emitter.binding(e.localId);
+    if (binding.kind === "boxed") {
+      // A projection consumes this pointer before any user code runs.
+      // Keep TDZ checks and caught-value conversion on the owned path.
+      if (!emitter.canBorrowReceiver(e)) return emitter.emitExpr(e);
+      const box = emitter.loadBox(binding.slot);
+      const payload = emitter.B.tmp();
+      const value = emitter.B.tmp();
+      emitter.B.line(`${payload} = getelementptr inbounds %ScrBox, ptr ${box}, i32 0, i32 5`);
+      emitter.B.line(`${value} = load ptr, ptr ${payload}`);
+      return { name: value, type: e.type };
+    }
+    if (binding.kind === "global") emitter.checkGlobalTdz(e.localId);
+    const value = emitter.B.tmp();
+    emitter.B.line(`${value} = load ptr, ptr ${binding.slot}`);
+    return { name: value, type: e.type };
+  }
+  if (e.kind === "dynCheck" && e.exact) return emitter.emitExactCapsuleObject(e.value, e.type);
+  if (e.kind === "chainRecv") {
+    // The chain's bind slot holds its receiver unchanged until the body
+    // finishes, owned by the slot itself or by the chain's receiver.
+    const bound = emitter.chainSlots.get(e.id);
+    if (!bound)
+      throw new InternalCompilerError(`llvm emitter bug: chainRecv "${e.id}" outside its chain`);
+    const value = emitter.B.tmp();
+    emitter.B.line(`${value} = load ${emitter.llType(bound.type)}, ptr ${bound.name}`);
+    return { name: value, type: e.type };
+  }
+  if (e.kind === "arrayGet" && emitter.canBorrowReceiver(e)) {
+    // The array keeps the element alive until the consumer; a missing
+    // element still traps exactly like the owned read.
+    const slot = emitter.B.slot();
+    emitter.B.entryAllocas.push(`${slot} = alloca ptr`);
+    emitBorrowedArrayRead(emitter, e, slot);
+    const value = emitter.B.tmp();
+    emitter.B.line(`${value} = load ptr, ptr ${slot}`);
+    return { name: value, type: e.type };
+  }
+  const wrap = emitter.borrowableNullableWrap(e);
+  if (wrap === "unit" && e.kind === "unionWrap")
+    return { name: emitter.unitInstanceRef(e.unionId, e.tag), type: e.type };
+  if (wrap === "ref" && e.kind === "unionWrap")
+    return { name: emitter.emitReadReceiver(e.value).name, type: e.type };
+  const read = matchMapRead(e, emitter.boxedUnionsById);
+  if (read) {
+    const result = emitStackMapRead(emitter, read);
+    if (result.owner) emitter.ownSlot(result.owner.slot, result.owner.type);
+    return result.value;
+  }
+  // A borrowed-return helper (such as an optional element read) lends its
+  // result like any borrowed-return call.
+  if (e.kind === "call" && emitter.borrowedReturns.has(e.callee) && emitter.canBorrowReceiver(e))
+    return emitBorrowedResultCall(emitter, e);
+  const arrayRead = emitter.optionalArrayReads.get(e);
+  if (arrayRead) return emitProjectedArrayRead(emitter, arrayRead);
+  const narrow = emitter.checkedNarrows.get(e);
+  const narrowed = narrow ? emitCheckedNarrowReceiver(emitter, narrow) : null;
+  if (narrowed) return narrowed;
+  if (canStackUnion(e, emitter.boxedUnionsById)) return emitStackUnion(emitter, e).value;
+  if (e.kind === "unionNarrow") {
+    const union = emitter.emitUnionProjection(e.value);
+    emitUnionNarrowGuard(emitter, union.name, e.unionId, e.tag);
+    return { name: emitter.unionPeek(union.name, e.unionId), type: e.type };
+  }
+  if ((e.kind === "downcast" || e.kind === "upcast") && e.value.type.kind === "object") {
+    // Prefix layouts: a class cast reads the operand's own pointer; a
+    // downcast verifies its target class (narrow-guards.ts).
+    const receiver = emitter.emitReadReceiver(e.value);
+    if (e.kind === "downcast" && e.type.kind === "object")
+      emitDowncastGuard(emitter, receiver.name, e.value.type.className, e.type.className);
+    return { name: receiver.name, type: e.type };
+  }
+  // A nullable-pointer field has no box to borrow. Projections use
+  // emitUnionProjection; other borrowers get an owned heap box.
+  if (emitter.nullableFieldGet(e)) return emitter.emitExpr(e);
+  if (e.kind === "recordGet" || e.kind === "fieldGet") {
+    const receiver = emitter.emitReadReceiver(e.obj);
+    if (e.kind === "recordGet") {
+      // An inline union field answers a private stack box.
+      const { ptr, type, inline } = emitter.recordFieldPtr(receiver.name, e.shapeId, e.field);
+      return { name: emitter.loadRecordField(ptr, type, inline), type: e.type };
+    }
+    const { ptr, type, inline } = emitter.classFieldPtr(receiver.name, e.className, e.field);
+    if (emitter.int32Slots.isField(e.className, e.field))
+      return emitter.loadInt32Field(ptr, e.type);
+    return { name: emitter.loadField(ptr, type, inline), type: e.type };
+  }
+  if (
+    e.kind === "ternary" &&
+    emitter.canBorrowReceiver(e.then) &&
+    emitter.canBorrowReceiver(e.else_)
+  ) {
+    // Checked projections lower to a ternary with an always-throwing
+    // arm. Keep that check at the use, but borrow the successful arm.
+    const B = emitter.B;
+    const cond = emitter.emitExpr(e.cond);
+    const slot = B.slot();
+    B.entryAllocas.push(`${slot} = alloca ptr`);
+    const yes = B.newLabel("read.then"),
+      no = B.newLabel("read.else"),
+      join = B.newLabel("read.join");
+    B.condBr(cond.name, yes, no);
+    for (const [label, value] of [
+      [yes, e.then],
+      [no, e.else_],
+    ] as const) {
+      B.startBlock(label);
+      emitter.frames.push([]);
+      const result = emitter.emitReadReceiver(value);
+      B.line(`store ptr ${result.name}, ptr ${slot}`);
+      emitter.releaseTemps(emitter.frames.pop()!);
+      B.br(join);
+    }
+    B.startBlock(join);
+    const value = B.tmp();
+    B.line(`${value} = load ptr, ptr ${slot}`);
+    return { name: value, type: e.type };
+  }
+  // Scalar optional values and register results answer a private stack
+  // box. A ternary of borrowable arms above keeps lending its arm.
+  if (
+    (e.kind === "optChain" ||
+      e.kind === "nullish" ||
+      e.kind === "ternary" ||
+      e.kind === "arrIntrinsic") &&
+    isScalarOptionalSource(e, emitter.unionSources)
+  )
+    return emitScalarOptional(emitter, e);
+  if (e.kind === "call" && emitter.scalarResultCall(e))
+    return emitCallExpr(emitter, e, false, true);
+  if (e.kind === "call" && emitter.canBorrowReceiver(e)) return emitBorrowedResultCall(emitter, e);
+  return emitter.emitExpr(e);
+}
+
+/** A local stable binding keeps its value alive while later arguments
+ * and the callee execute. A proven local union box cannot escape or be
+ * rebound during a call; its independent payload owner keeps it alive.
+ * Other writable bindings need an owned snapshot. */
+export function canBorrowCallArgument(emitter: LlEmitter, value: IrExpr): boolean {
+  if (value.kind === "strLit") return true;
+  // An exact capsule owns its instance while the capsule's binding holds it.
+  if (value.kind === "dynCheck" && value.exact)
+    return value.value.kind === "varRef" && emitter.canBorrowCallArgument(value.value);
+  // An inline union field has no box to lend.
+  if (emitter.inlineFieldGet(value)) return false;
+  // Class casts reinterpret the same pointer (prefix layouts).
+  if ((value.kind === "upcast" || value.kind === "downcast") && value.value.type.kind === "object")
+    return emitter.canBorrowCallArgument(value.value);
+  if (value.kind === "seqExpr") {
+    const guarded = guardedValue(value);
+    return guarded !== null && emitter.canBorrowCallArgument(guarded);
+  }
+  // A nullable-union wrap reinterprets its payload pointer; an immortal
+  // unit constant needs no owner at all.
+  const wrap = emitter.borrowableNullableWrap(value);
+  if (wrap === "unit") return true;
+  if (wrap === "ref" && value.kind === "unionWrap")
+    return emitter.canBorrowCallArgument(value.value);
+  // Checked casts (`x as C`, `x!` on a nullable) lower to a ternary whose
+  // failing arm always throws; the successful arm projects the same
+  // stable owner. The throwing arm's typed dummy owns nothing.
+  if (value.kind === "unionNarrow") return emitter.canBorrowCallArgument(value.value);
+  if (value.kind === "libCall") return value.fn === "error.nodeThrow";
+  // A final field never changes outside constructors: while its object is
+  // borrowable, so is the field's value. Nullable-pointer fields have no
+  // box to lend and keep their owning path.
+  if (
+    value.kind === "fieldGet" &&
+    emitter.finalFieldBorrows &&
+    isRefCounted(value.type) &&
+    emitter.finalFields.isFinal(value.className, value.field) &&
+    !emitter.nullableFieldGet(value)
+  )
+    return emitter.canBorrowReceiver(value.obj) && emitter.canBorrowCallArgument(value.obj);
+  if (value.kind === "ternary")
+    return (
+      emitter.canBorrowReceiver(value.then) &&
+      emitter.canBorrowReceiver(value.else_) &&
+      emitter.canBorrowCallArgument(value.then) &&
+      emitter.canBorrowCallArgument(value.else_)
+    );
+  // A construction-only field of a stable owner keeps its value until the
+  // owner dies: no later operand or callee can replace and release it.
+  if ((value.kind === "fieldGet" || value.kind === "recordGet") && emitter.immutableRead(value))
+    return emitter.canBorrowCallArgument(value.obj);
+  // An optional chain's bound receiver stays unchanged until its body
+  // finishes (see emitReadReceiver).
+  if (value.kind === "chainRecv") return emitter.chainSlots.has(value.id);
+  if (value.kind !== "varRef") return false;
+  const binding = emitter.binding(value.localId);
+  // A module constant owns its value for the rest of the program.
+  if (binding.kind === "global") return emitter.stableGlobals.has(value.localId);
+  // So does the environment for a capture nothing ever rebinds.
+  if (binding.kind === "boxed")
+    return emitter.stableCaptureIds.has(value.localId) && emitter.canBorrowReceiver(value);
+  return (
+    binding.kind === "local" &&
+    binding.local !== undefined &&
+    (!binding.local.mutable ||
+      emitter.stableCallBindings.has(value.localId) ||
+      emitter.borrowedParameters.has(value.localId) ||
+      emitter.localUnionStorage.has(value.localId)) &&
+    !binding.local.boxed &&
+    !binding.local.tdz
+  );
+}
+
+export function canBorrowReceiver(emitter: LlEmitter, e: IrExpr): boolean {
+  switch (e.kind) {
+    case "chainRecv":
+      return emitter.chainSlots.has(e.id);
+    case "varRef": {
+      const binding = emitter.binding(e.localId);
+      return (
+        binding.kind !== "boxed" ||
+        (!binding.local!.tdz &&
+          binding.type.kind === e.type.kind &&
+          e.type.kind !== "caught" &&
+          isRefCounted(e.type))
+      );
+    }
+    case "unionNarrow":
+    // Class casts reinterpret the same pointer (prefix layouts).
+    case "downcast":
+    case "upcast":
+      return emitter.canBorrowReceiver(e.value);
+    // An inline union field has no box to lend: projections read it
+    // through emitReadReceiver's private stack box.
+    case "fieldGet":
+    case "recordGet":
+      return !emitter.inlineFieldGet(e) && emitter.canBorrowReceiver(e.obj);
+    case "ternary":
+      return emitter.canBorrowReceiver(e.then) && emitter.canBorrowReceiver(e.else_);
+    case "seqExpr": {
+      const guarded = guardedValue(e);
+      return guarded !== null && emitter.canBorrowReceiver(guarded);
+    }
+    // The runtime always sets a pending exception; its unreachable
+    // typed dummy is null and owns no receiver.
+    case "libCall":
+      return e.fn === "error.nodeThrow";
+    case "unionWrap": {
+      const wrap = emitter.borrowableNullableWrap(e);
+      return wrap === "unit" || (wrap === "ref" && emitter.canBorrowReceiver(e.value));
+    }
+    // A borrowed-return result stays reachable from its borrowed
+    // arguments until the consumer runs. Each argument is lent without a
+    // snapshot, so neither the callee nor a later argument may replace
+    // what it was read from: a callee that preserves every edge cannot,
+    // and any other one must leave the argument's locations unwritten.
+    case "call": {
+      if (!emitter.borrowedReturns.has(e.callee)) return false;
+      if (!e.args.every((arg) => emitter.referenceEffects.preserves(arg))) return false;
+      const preserving = emitter.referenceEffects.functions.has(e.callee);
+      if (preserving)
+        return e.args.every((arg) => !isRefCounted(arg.type) || emitter.canBorrowReceiver(arg));
+      if (emitter.referenceWrites === null) return false;
+      const lent = borrowableInputs(
+        emitter,
+        e.args,
+        false,
+        emitter.referenceWrites.summary(e.callee),
+      );
+      return e.args.every((arg, i) => !isRefCounted(arg.type) || lent[i] === true);
+    }
+    // A required element read: the (borrowed) array owns the element
+    // while an edge-preserving index computes.
+    case "arrayGet":
+      return (
+        e.arr.type.kind === "array" &&
+        isRefCounted(e.arr.type.elem) &&
+        emitter.canBorrowReceiver(e.arr) &&
+        emitter.referenceEffects.preserves(e.index)
+      );
+    default:
+      return false;
+  }
+}
+
+/** Functions returning a walk of their borrowed parameters return it
+ * without a reference (+0) from their borrowing body; direct callers
+ * either consume it as a receiver/walk or retain it at once, and the owned
+ * adapter retains before releasing its parameters. Candidates preserve
+ * every heap edge (so the result stays reachable from the arguments),
+ * borrow every reference parameter and return plain pointers. The set
+ * grows to a fixpoint because a call to a borrowed-return function with
+ * walk arguments is itself a walk; walk facts are then recomputed with
+ * the final set, admitting only parameters whose convention borrows. */
+export function analyzeBorrowedReturns(emitter: LlEmitter): void {
+  const pointer = (type: IrType): boolean => emitter.plainReference(type);
+  const borrowedIds = (fn: IrFunction): Set<string> => {
+    const indexes = emitter.callLifetimes.borrowed.get(fn.name);
+    return new Set(fn.params.filter((_, i) => indexes?.has(i)).map((p) => p.localId));
+  };
+  const hostFor = (fn: IrFunction): WalkBorrowHost => {
+    const allowed = borrowedIds(fn);
+    const host = {
+      pointerLocal: (local: IrLocal) => pointer(local.type),
+      borrowsWithoutOwning: (e: IrExpr) => emitter.borrowsWithoutOwning(e),
+      borrowedReturn: (callee: string) => emitter.borrowedReturns.has(callee),
+      parameterAllowed: (id: string) => allowed.has(id),
+    };
+    return emitter.referenceEffects.functions.has(fn.name)
+      ? host
+      : emitter.unwrittenWalkHost(fn, host);
+  };
+  // With ReferenceWrites, a body that writes none of its walks' locations
+  // qualifies like one that preserves every edge.
+  const preserving = [...emitter.fnByName.values()].filter(
+    (fn) => emitter.referenceEffects.functions.has(fn.name) || emitter.referenceWrites !== null,
+  );
+  const candidates = preserving.filter((fn) => {
+    if (!pointer(fn.returnType) || fn.async || fn.generator || fn.captures) return false;
+    // A borrowing vtable slot dispatches to the borrowing body (or its
+    // virtual adapter) directly, and virtual callers own the result.
+    if (emitter.implSlotBorrowed(fn.name).size > 0) return false;
+    const indexes = emitter.callLifetimes.borrowed.get(fn.name);
+    return (
+      indexes !== undefined &&
+      indexes.size > 0 &&
+      fn.params.every((p, i) => !isRefCounted(p.type) || indexes.has(i))
+    );
+  });
+  for (let changed = true; changed;) {
+    changed = false;
+    for (const fn of candidates) {
+      if (emitter.borrowedReturns.has(fn.name)) continue;
+      if (!analyzeWalks(fn, hostFor(fn)).returnsWalk) continue;
+      emitter.borrowedReturns.add(fn.name);
+      // Nested borrowed returns extend the locations a caller depends on.
+      emitter.borrowedReturnKeyCache.clear();
+      changed = true;
+    }
+  }
+  if (emitter.borrowedReturns.size === 0) return;
+  for (const fn of preserving) {
+    const walks = analyzeWalks(fn, hostFor(fn)).locals;
+    if (walks.size > 0) emitter.walkBorrowsByFunction.set(fn.name, walks);
+  }
+}
+
+export function fieldAliasMetadata(emitter: LlEmitter): string[] {
+  if (emitter.fieldAliasTags.size === 0) return [];
+  const lines = ['!0 = !{!"scriptc native fields"}'];
+  for (const tag of emitter.fieldAliasTags.values()) {
+    lines.push(
+      `!${tag - 1} = !{!"field.${tag}", !0, i64 0}`,
+      `!${tag} = !{!${tag - 1}, !${tag - 1}, i64 0}`,
+    );
+  }
+  return lines;
+}
+
+/** A private stack union source with an independently owned payload. */
+export function canStackReceiver(emitter: LlEmitter, e: IrExpr): boolean {
+  return emitter.isStackUnionSource(e);
+}
+
+/** True for union sources that emitReadReceiver can produce as a private
+ * stack box with an independently owned payload (no heap union). */
+export function isStackUnionSource(emitter: LlEmitter, e: IrExpr): boolean {
+  if (e.type.kind !== "union") return false;
+  return (
+    canStackUnion(e, emitter.boxedUnionsById) ||
+    matchMapRead(e, emitter.boxedUnionsById) !== null ||
+    emitter.optionalArrayReads.get(e) !== null ||
+    isScalarOptionalSource(e, emitter.unionSources) ||
+    emitter.scalarResultCall(e) ||
+    emitter.inlineFieldGet(e)
+  );
+}
diff --git a/packages/compiler/src/backend/llvm/reference-effects.ts b/packages/compiler/src/backend/llvm/reference-effects.ts
index e7b044187..6ebe1222b 100644
--- a/packages/compiler/src/backend/llvm/reference-effects.ts
+++ b/packages/compiler/src/backend/llvm/reference-effects.ts
@@ -148,6 +148,14 @@ function expressionPreservesEdges(
         // Class brand tests compare a capsule's key; they run no user code.
         e.fn === "dyn.typedRefKeyIs" ||
         e.fn === "dyn.typedRefIs" ||
+        // jsval conversions (ir/jsval.ts) answer as the dyn forms they
+        // replace: moving a value between dyn and jsval reads it, and a
+        // number, boolean or string crosses like its dynFrom box.
+        e.fn === "js.fromDyn" ||
+        e.fn === "js.toDyn" ||
+        e.fn === "js.fromF64" ||
+        e.fn === "js.fromBool" ||
+        e.fn === "js.fromStr" ||
         isStableReceiverOperand(e, "")
       );
     // An exact capsule's instance is one load (and a retain when owned).
diff --git a/packages/compiler/src/backend/llvm/reference-writes.ts b/packages/compiler/src/backend/llvm/reference-writes.ts
index 63e4993e8..a0a153da1 100644
--- a/packages/compiler/src/backend/llvm/reference-writes.ts
+++ b/packages/compiler/src/backend/llvm/reference-writes.ts
@@ -118,6 +118,20 @@ const INERT_LIB_CALLS = new Set([
   "cp.spawnSyncOpts",
 ]);
 
+/** jsval conversions (ir/jsval.ts): no user code, no stores. */
+const JS_CONVERSIONS = new Set([
+  "js.fromDyn",
+  "js.toDyn",
+  "js.fromF64",
+  "js.fromBool",
+  "js.fromStr",
+  "js.fromBigInt",
+  "js.toF64",
+]);
+
+/** jsval conversions of static primitives. */
+const JS_PRIMITIVE_SOURCES = new Set(["js.fromF64", "js.fromBool", "js.fromStr", "js.fromBigInt"]);
+
 /** Array methods that never release an existing element or run user code. */
 const PRESERVING_ARRAY_METHODS = new Set([
   "length",
@@ -635,6 +649,13 @@ export class ReferenceWrites {
    * accessors) or absent. */
   private inertLibCall(e: IrExpr & { kind: "libCall" }): boolean {
     if (e.fn === "error.nodeThrow" || isStableReceiverOperand(e, "")) return true;
+    // jsval conversions run no user code: they move a value between its
+    // dyn and jsval forms, and js.toF64 is dynCheck's number check. A
+    // comparison is inert exactly when its dyn twin is: every operand a
+    // wrapped primitive.
+    if (JS_CONVERSIONS.has(e.fn)) return true;
+    if (e.fn === "js.compare")
+      return e.args.every((arg) => arg.type.kind !== "jsval" || this.jsPrimitive(arg));
     if (e.fn === "error.newOptions")
       return e.args.every(
         (arg) =>
@@ -654,6 +675,17 @@ export class ReferenceWrites {
     );
   }
 
+  /** A jsval operand made from a primitive: it has no methods to call
+   * back into. */
+  private jsPrimitive(e: IrExpr): boolean {
+    if (e.kind !== "libCall") return false;
+    if (e.fn === "js.fromDyn") {
+      const value = e.args[0]!;
+      return value.kind === "dynFrom" && this.primitive(value.value.type);
+    }
+    return JS_PRIMITIVE_SOURCES.has(e.fn);
+  }
+
   /** Numbers, booleans, strings and unit values (and unions of them). */
   private primitive(t: IrType): boolean {
     switch (t.kind) {
diff --git a/packages/compiler/src/backend/llvm/regions.test.ts b/packages/compiler/src/backend/llvm/regions.test.ts
index 2310db6c6..51ceb21c8 100644
--- a/packages/compiler/src/backend/llvm/regions.test.ts
+++ b/packages/compiler/src/backend/llvm/regions.test.ts
@@ -23,7 +23,7 @@ const span: IrType = { kind: "record", shapeId: "span" };
  * class that cannot reach any (Label). */
 function module(body: IrExpr[] = [], lifetimeRegions = true): IrModule {
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     ...(lifetimeRegions ? { lifetimeRegions: true as const } : {}),
diff --git a/packages/compiler/src/backend/llvm/regions.ts b/packages/compiler/src/backend/llvm/regions.ts
index 875f554eb..1ec46a5b1 100644
--- a/packages/compiler/src/backend/llvm/regions.ts
+++ b/packages/compiler/src/backend/llvm/regions.ts
@@ -120,6 +120,7 @@ export class LifetimeRegions {
       // Closures capture anything, and dyn values box class instances.
       case "func":
       case "dyn":
+      case "jsval":
         return true;
       default:
         return false;
diff --git a/packages/compiler/src/backend/llvm/shapes.test.ts b/packages/compiler/src/backend/llvm/shapes.test.ts
index f25dca3a3..347099c16 100644
--- a/packages/compiler/src/backend/llvm/shapes.test.ts
+++ b/packages/compiler/src/backend/llvm/shapes.test.ts
@@ -32,7 +32,7 @@ function declarationHost(
     tracedShapes: new Set(),
     tracedUnions: new Set(),
     nullableUnions: new NullableUnions({
-      irVersion: 16,
+      irVersion: 17,
       sourceFile: "test.ts",
       functions: [],
       entry: "main",
@@ -280,7 +280,7 @@ describe("inline dyn release budget", () => {
 describe("emitted object releases", () => {
   test("a surviving headered record enqueues only when not already buffered", () => {
     const mod: IrModule = {
-      irVersion: 16,
+      irVersion: 17,
       sourceFile: "cycle.ts",
       entry: "main",
       functions: [],
@@ -302,7 +302,7 @@ describe("emitted object releases", () => {
 
 describe("live-object audit notes", () => {
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: "audit.ts",
     entry: "main",
     functions: [],
diff --git a/packages/compiler/src/backend/llvm/shapes.ts b/packages/compiler/src/backend/llvm/shapes.ts
index 21f4fcb34..9cceaa443 100644
--- a/packages/compiler/src/backend/llvm/shapes.ts
+++ b/packages/compiler/src/backend/llvm/shapes.ts
@@ -14,6 +14,7 @@ import {
   RUNTIME_EVENT_TARGET_CLASS,
   RUNTIME_ERROR_CLASSES,
   RUNTIME_STREAM_CLASSES,
+  DYN,
   STRING,
 } from "../../ir/ir.js";
 import {
@@ -56,6 +57,7 @@ import {
   stackUnionBox,
   type InlineUnionFields,
 } from "./inline-unions.js";
+import { JS_BITS, JS_TAGS } from "./jsval-encoding.js";
 import { recordMayKeepSource } from "./record-sources.js";
 import { LlvmUnsupportedError } from "./unsupported.js";
 
@@ -268,6 +270,7 @@ export function vAdapters(host: ShapeHost, t: IrType): { retain: string; release
  * table above; the split exists so call sites read type-directedly.
  * Families with a mirrored fast path call the inline helper instead. */
 export function retainSym(host: ShapeHost, t: IrType): string {
+  if (t.kind === "jsval") return jsvalRcSym(host, "retain");
   const nullable = host.nullableUnions.of(t);
   if (nullable?.repr === "shapes") return shapeUnionRc(nullable).retain;
   if (nullable) return nullableRetainSym(host, nullable.arm);
@@ -411,6 +414,7 @@ export function emitNullableRetainWrappers(host: ShapeHost): string[] {
  * points serve where one exists; records use their emitted helper.
  * Families with a mirrored fast path call the inline helper instead. */
 export function releaseSym(host: ShapeHost, t: IrType): string {
+  if (t.kind === "jsval") return jsvalRcSym(host, "release");
   const nullable = host.nullableUnions.of(t);
   if (nullable?.repr === "shapes") return shapeUnionRc(nullable).release;
   if (nullable) return releaseSym(host, nullable.arm);
@@ -435,6 +439,67 @@ export function releaseSym(host: ShapeHost, t: IrType): string {
   }
 }
 
+/** jsval retain/release (llvm/jsval.ts). On 32-bit targets a jsval is a
+ * dyn cell and uses dyn's entry points. Otherwise the inline helper skips
+ * immediates and forwards a cell to dyn's own entry point (requested here,
+ * so it is emitted with the other helpers) and a string or BigInt to the
+ * runtime; without inline RC every retain/release is a runtime call. */
+function jsvalRcSym(host: ShapeHost, op: RcOp): string {
+  if (host.sizeType === "i32")
+    return op === "retain" ? retainSym(host, DYN) : releaseSym(host, DYN);
+  if (host.rcHelpers === null || mirroredFamily(host, "js", op) === null) {
+    const sym = op === "retain" ? "@scr_js_retain" : "@scr_js_release";
+    host.declare(op === "retain" ? `declare ptr ${sym}(ptr)` : `declare void ${sym}(ptr)`);
+    return sym;
+  }
+  if (op === "retain") retainSym(host, DYN);
+  else releaseSym(host, DYN);
+  return requestRcHelper(host, "js", op);
+}
+
+/** The inline retain/release helpers of jsval (64-bit targets). A cell
+ * goes through dyn's own retain/release entry point (inline or runtime);
+ * a string or BigInt through the runtime; immediates do nothing. */
+function jsvalRcHelper(host: ShapeHost, op: RcOp, attrs: string): string[] {
+  const dynOp = op === "retain" ? retainSym(host, DYN) : releaseSym(host, DYN);
+  const runtime = op === "retain" ? "@scr_js_retain" : "@scr_js_release";
+  // Always inlined (the helper is a tag dispatch): LLVM would otherwise
+  // weigh it together with the dyn helper it calls and keep both out of
+  // line. dyn's release tolerates NULL; its retain does not.
+  const inline = host.rcHelpersNoinline === true ? attrs : `alwaysinline ${attrs}`;
+  return [
+    `define internal ${op === "retain" ? "ptr" : "void"} @sc_rc_${op}_js(ptr %o) ${inline} { ; jsval ${op}: cells, strings and BigInts`,
+    `entry:`,
+    `  %b = ptrtoint ptr %o to i64`,
+    `  %tag = lshr i64 %b, 48`,
+    `  %cell = icmp eq i64 %tag, ${JS_TAGS.cell}`,
+    `  br i1 %cell, label %c, label %other`,
+    `c:`,
+    `  %a = and i64 %b, ${JS_BITS.payloadMask}`,
+    `  %p = inttoptr i64 %a to ptr`,
+    ...(op === "retain"
+      ? [
+          `  %live = icmp ne ptr %p, null`,
+          `  br i1 %live, label %rc, label %done`,
+          `rc:`,
+          `  %r = call ptr ${dynOp}(ptr %p)`,
+        ]
+      : [`  call void ${dynOp}(ptr %p)`]),
+    `  br label %done`,
+    `other:`,
+    `  %h = sub i64 %tag, ${JS_TAGS.str}`,
+    `  %heap = icmp ult i64 %h, 2`,
+    `  br i1 %heap, label %slow, label %done`,
+    `slow:`,
+    op === "retain" ? `  %s = call ptr ${runtime}(ptr %o)` : `  call void ${runtime}(ptr %o)`,
+    `  br label %done`,
+    `done:`,
+    `  ${op === "retain" ? "ret ptr %o" : "ret void"}`,
+    `}`,
+    ``,
+  ];
+}
+
 /* ── inline RC fast paths ─────────────────────────────────────────────── */
 
 /** How a runtime family decides whether an object carries a ScrCycHdr:
@@ -505,7 +570,17 @@ export function inlineRcFamily(host: ShapeHost, stem: string, op: RcOp): InlineR
  * because string-heavy programs have many release sites. */
 export type InlineRcMode = "release" | "speed";
 
-const RELEASE_RC_OPS = new Set(["str:retain", "dyn:retain", "dyn:release"]);
+const RELEASE_RC_OPS = new Set([
+  "str:retain",
+  "dyn:retain",
+  "dyn:release",
+  "js:retain",
+  "js:release",
+]);
+
+/** The jsval helpers' row: their bodies are custom (jsvalRcHelper), and
+ * they call the runtime themselves. */
+const JS_RC_ROW: InlineRcFamily = { cycle: "none", retainNull: true, release: null };
 
 /** The emitter's inline RC option for a native optimization posture: none
  * at `dev`, the `release` subset by default. Sanitized builds compile the
@@ -523,6 +598,8 @@ export function inlineRcOption(
 }
 
 function mirroredFamily(host: ShapeHost, family: string, op: RcOp): InlineRcFamily | null {
+  if (family === "js")
+    return host.rcMode !== "speed" && !RELEASE_RC_OPS.has(`js:${op}`) ? null : JS_RC_ROW;
   if (!Object.hasOwn(INLINE_RC_FAMILIES, family)) return null;
   if (host.rcMode !== "speed" && !RELEASE_RC_OPS.has(`${family}:${op}`)) return null;
   const row = INLINE_RC_FAMILIES[family]!;
@@ -548,15 +625,17 @@ export function boxReleaseSym(host: ShapeHost): string {
 /** Record the helper and declare the runtime symbols it calls now, so they
  * land in the extern block. */
 function requestRcHelper(host: ShapeHost, family: string, op: RcOp): string {
-  if (host.rcHelpers === null || mirroredFamily(host, family, op) === null) {
+  const row = host.rcHelpers === null ? null : mirroredFamily(host, family, op);
+  if (host.rcHelpers === null || row === null) {
     throw new LlvmUnsupportedError(`inline rc:${family}:${op}`);
   }
   host.rcHelpers.add(`${family}:${op}`);
   for (const decl of rcHelperDecls(family, op)) host.declare(decl);
   // Its body is written last (emitInlineRcHelpers), after the requests are
   // collected: a release that can buffer a candidate requests the append
-  // helper now.
-  if (op === "release" && INLINE_RC_FAMILIES[family]!.cycle === "always") requestCycleAppend(host);
+  // helper now. The jsval row (JS_RC_ROW) has no collector header; its
+  // cells release through dyn's helper, which makes its own request.
+  if (op === "release" && row.cycle === "always") requestCycleAppend(host);
   return `@${inlineRcName(family, op)}`;
 }
 
@@ -632,6 +711,10 @@ export function limitInlineDynReleases(parts: readonly string[]): string[] {
 }
 
 function rcHelperDecls(family: string, op: RcOp): string[] {
+  if (family === "js")
+    return [
+      op === "retain" ? `declare ptr @scr_js_retain(ptr)` : `declare void @scr_js_release(ptr)`,
+    ];
   const row = INLINE_RC_FAMILIES[family]!;
   if (op === "retain" || row.release === null) return [];
   return [
@@ -808,6 +891,10 @@ export function emitInlineRcHelpers(host: ShapeHost): string[] {
       continue;
     }
     const [family, op] = key.split(":") as [string, RcOp];
+    if (family === "js") {
+      out.push(...jsvalRcHelper(host, op, rcHelperAttrs(host)));
+      continue;
+    }
     const row = INLINE_RC_FAMILIES[family]!;
     out.push(
       ...(op === "retain" ? retainHelper(host, family, row) : releaseHelper(host, family, row)),
diff --git a/packages/compiler/src/backend/llvm/stack-objects.test.ts b/packages/compiler/src/backend/llvm/stack-objects.test.ts
index a413db333..a74878080 100644
--- a/packages/compiler/src/backend/llvm/stack-objects.test.ts
+++ b/packages/compiler/src/backend/llvm/stack-objects.test.ts
@@ -214,7 +214,7 @@ test("loop bindings are never reassigned into a fixed slot", () => {
     ],
   };
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     records: [{ id: "point", fields: [{ name: "x", type: F64 }] }],
diff --git a/packages/compiler/src/backend/llvm/stack-unions.test.ts b/packages/compiler/src/backend/llvm/stack-unions.test.ts
index 6baf328ed..221f4c903 100644
--- a/packages/compiler/src/backend/llvm/stack-unions.test.ts
+++ b/packages/compiler/src/backend/llvm/stack-unions.test.ts
@@ -73,7 +73,7 @@ function fixture(arm: IrType = record): IrModule {
     body: [ret(narrow(ref("value"), arm))],
   };
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     records: [{ id: "cell", fields: [{ name: "x", type: F64 }] }],
diff --git a/packages/compiler/src/backend/llvm/string-construction.test.ts b/packages/compiler/src/backend/llvm/string-construction.test.ts
index cfc7782d5..1b8e2a45f 100644
--- a/packages/compiler/src/backend/llvm/string-construction.test.ts
+++ b/packages/compiler/src/backend/llvm/string-construction.test.ts
@@ -17,7 +17,7 @@ const concat = (left: IrExpr, right: IrExpr): IrExpr => ({
 
 function module(value: IrExpr): IrModule {
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [
diff --git a/packages/compiler/src/backend/llvm/string-lifetimes.test.ts b/packages/compiler/src/backend/llvm/string-lifetimes.test.ts
index bf140d2e6..8622085b4 100644
--- a/packages/compiler/src/backend/llvm/string-lifetimes.test.ts
+++ b/packages/compiler/src/backend/llvm/string-lifetimes.test.ts
@@ -73,7 +73,7 @@ function fn(name: string, names: string[], value: IrExpr): IrFunction {
 }
 function mod(...functions: IrFunction[]): IrModule {
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [
@@ -432,7 +432,6 @@ test("borrowed literals keep UTF-16 string comparison without temporary owners",
     op: "<",
     left: str("a"),
     right: str("b"),
-    utf16: true,
     type: BOOL,
     loc,
   });
@@ -443,16 +442,14 @@ test("borrowed literals keep UTF-16 string comparison without temporary owners",
 });
 
 test("string comparisons decide identity, lengths and leading bytes before the runtime", () => {
-  const order = (utf16: boolean) =>
-    fn(`order${utf16 ? 16 : 8}`, [], {
-      kind: "strCmp",
-      op: "<",
-      left: str("apple"),
-      right: str("apricot"),
-      utf16,
-      type: BOOL,
-      loc,
-    });
+  const order = fn("order", [], {
+    kind: "strCmp",
+    op: "<",
+    left: str("apple"),
+    right: str("apricot"),
+    type: BOOL,
+    loc,
+  });
   const same = fn("same", ["a", "b"], {
     kind: "strEq",
     left: { kind: "varRef", localId: "a", type: STRING, loc },
@@ -462,23 +459,28 @@ test("string comparisons decide identity, lengths and leading bytes before the r
     loc,
   });
   for (const bits of [32, 64] as const) {
-    const ir = emitLlvmModule(mod(order(false), order(true), same), { pointerBits: bits });
+    const ir = emitLlvmModule(mod(order, same), { pointerBits: bits });
     const helper = (name: string) =>
       new RegExp(`^define internal [^\\n]*@${name}(?:\\.i32)?\\([^]*?^}`, "m").exec(ir)![0];
     const eq = helper("sc_str_eq");
     expect(eq).toContain("icmp eq ptr %a, %b");
     expect(eq).toMatch(/icmp eq i(32|64) %alen, %blen/);
     expect(eq).toContain("call zeroext i1 @scr_str_eq(ptr %a, ptr %b)");
-    const bytes = helper("sc_str_cmp");
-    expect(bytes).toContain("@llvm.bswap.i64");
-    expect(bytes).not.toContain("%ascii");
-    expect(bytes).toContain("call i32 @scr_str_cmp(ptr %a, ptr %b)");
     const units = helper("sc_str_cmp_u16");
-    expect(units).toContain("%wascii = icmp eq i64 %whigh, 0");
-    expect(units).toContain("%tascii = icmp eq i64 %thigh, 0");
-    expect(bytes).toContain("%tailable = and i1 %samelen, %short");
-    expect(units).toContain("%ascii = icmp sge i8 %bits, 0");
-    expect(units).toContain("call i32 @scr_str_cmp_u16(ptr %a, ptr %b)");
+    expect(units).toContain("%dx = phi i64 [ %aw, %word ], [ %at, %tail ]");
+    expect(units).toContain("%dlow = icmp eq i64 %whigh, 0");
+    expect(units).toContain("@llvm.bswap.i64");
+    expect(units).toContain("%dtz = call i64 @llvm.cttz.i64(i64 %dxor, i1 true)");
+    expect(units).toContain("%bx = phi i8 [ %x, %first ], [ %dxb, %locate ]");
+    expect(units).toContain("%blow = icmp ult i8 %bmin, -19");
+    expect(units).toContain("%kbelow = icmp ult i8 %xk, %yk");
+    expect(units).toContain("%below = icmp ult i8 %bx, %by");
+    expect(units).toContain("%tailable = and i1 %samelen, %short");
+    expect(units).toContain("%anyascii = icmp slt i32 %cws, 0");
+    expect(units).toContain("call i32 @scr_str_cmp(ptr %a, ptr %b)");
+    expect(units).toContain(
+      "call i32 @scr_str_cmp_u16_bytes(ptr %a, ptr %b) nounwind willreturn memory(argmem: read)",
+    );
   }
 });
 
diff --git a/packages/compiler/src/backend/llvm/switch-dispatch.test.ts b/packages/compiler/src/backend/llvm/switch-dispatch.test.ts
index 086d35a9d..7a93b6a49 100644
--- a/packages/compiler/src/backend/llvm/switch-dispatch.test.ts
+++ b/packages/compiler/src/backend/llvm/switch-dispatch.test.ts
@@ -13,7 +13,7 @@ function emit(type: IrType, tests: (IrExpr | null)[], pointerBits: 32 | 64 = 64)
 function emitWith(disc: IrExpr, tests: (IrExpr | null)[], pointerBits: 32 | 64 = 64): string {
   const type = disc.kind === "varRef" ? disc.type : F64;
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [
@@ -151,7 +151,7 @@ test("long string labels select by their first word and confirm the rest inline"
 function emitLlvmModuleFor(labels: string[]): string {
   const value: IrExpr = { kind: "varRef", localId: "value", type: STRING, loc };
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [
diff --git a/packages/compiler/src/backend/llvm/thread-slots.test.ts b/packages/compiler/src/backend/llvm/thread-slots.test.ts
index c7260b9fe..dba4453b3 100644
--- a/packages/compiler/src/backend/llvm/thread-slots.test.ts
+++ b/packages/compiler/src/backend/llvm/thread-slots.test.ts
@@ -23,7 +23,7 @@ function module(body: IrExpr[]): IrModule {
     loc,
   });
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     threadSlotKeys: ["Node"],
diff --git a/packages/compiler/src/backend/llvm/union-retype.test.ts b/packages/compiler/src/backend/llvm/union-retype.test.ts
index 0f0abdb68..a4d1aaa90 100644
--- a/packages/compiler/src/backend/llvm/union-retype.test.ts
+++ b/packages/compiler/src/backend/llvm/union-retype.test.ts
@@ -89,7 +89,7 @@ function fixture(): IrModule {
     loc,
   };
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     records: [{ id: "cell", fields: [{ name: "x", type: F64 }] }],
diff --git a/packages/compiler/src/backend/may-throw.test.ts b/packages/compiler/src/backend/may-throw.test.ts
index 07b127c37..0a950c2cc 100644
--- a/packages/compiler/src/backend/may-throw.test.ts
+++ b/packages/compiler/src/backend/may-throw.test.ts
@@ -28,7 +28,7 @@ function fn(name: string, body: IrStmt[], locals: IrLocal[] = [local]): IrFuncti
   return { name, body, locals, params: [], returnType: VOID, loc };
 }
 function moduleWith(...functions: IrFunction[]): IrModule {
-  return { irVersion: 16, sourceFile: loc.file, entry: "caller", functions };
+  return { irVersion: 17, sourceFile: loc.file, entry: "caller", functions };
 }
 const assignment: IrStmt = { kind: "assign", localId: local.id, value, loc };
 const expression: IrExpr = { kind: "assignExpr", localId: local.id, value, type: F64, loc };
diff --git a/packages/compiler/src/backend/native-link-info-core.ts b/packages/compiler/src/backend/native-link-info-core.ts
index 3beb84a20..86146259d 100644
--- a/packages/compiler/src/backend/native-link-info-core.ts
+++ b/packages/compiler/src/backend/native-link-info-core.ts
@@ -25,12 +25,21 @@ export interface NativeLinkFeatures {
   fileHandle: boolean;
   fetch: boolean;
   eventTarget?: boolean;
+  /** The program assigns process.emitWarning: links the
+   * SCR_WARNING_REPLACE variant of the dyn-async unit. */
+  warningReplace?: boolean;
+  /** The program uses process.stdin.setEncoding, string 'data' listeners
+   * or stdio 'resize' events: links the SCR_STDIO_EXTENDED events unit. */
+  stdioExtended?: boolean;
   zlib: boolean;
   assert: boolean;
   inspect: boolean;
   dynInvoke: boolean;
   dc: boolean;
   dynAsync: boolean;
+  /** Dynamic-tier jsval operations: the scr_js_* units. Absent (not false)
+   * for programs without them, so their link features stay unchanged. */
+  dynTier?: boolean;
   events: boolean;
   emitter: boolean;
   symbol: boolean;
@@ -51,6 +60,9 @@ export interface NativeLinkFeatures {
    * archive. */
   cipher: boolean;
   tlsCa: boolean;
+  /** crypto.subtle importKey/sign/verify/digest and CryptoKey values:
+   * scr_webcrypto.c. */
+  webcrypto: boolean;
 }
 
 export interface NativeLinkInfo {
diff --git a/packages/compiler/src/backend/native/contracts.ts b/packages/compiler/src/backend/native/contracts.ts
index 875a723bc..33b13960e 100644
--- a/packages/compiler/src/backend/native/contracts.ts
+++ b/packages/compiler/src/backend/native/contracts.ts
@@ -109,11 +109,19 @@ export interface CcOptions {
    * reactions, AsyncLocalStorage, the unhandledRejection/warning
    * process events. */
   dynAsync?: boolean;
+  /** The program has dynamic-tier jsval operations (moduleUsesDynTier on
+   * the IR): compiles the scr_js_* units (two-tier design I3). Programs
+   * without them link no scr_js_ symbol. */
+  dynTier?: boolean;
   /** The program constructs EventTarget/Event/CustomEvent values or
    * calls events.addAbortListener (the event.* libCalls), or uses the
    * native fetch AbortSignal built on the same engine: compiles
    * scr_event_target.c. */
   eventTarget?: boolean;
+  /** SCR_WARNING_REPLACE: process.emitWarning replacement support. */
+  warningReplace?: boolean;
+  /** SCR_STDIO_EXTENDED: stdin encoding, string data listeners, resize. */
+  stdioExtended?: boolean;
   /** The program uses the process-events surface (signal/exit listeners,
    * stdin events, for-await over stdin — moduleUsesProcessEvents on the
    * IR): compiles scr_events.c into the binary. Event-free binaries keep
@@ -199,6 +207,8 @@ export interface CcOptions {
   /** crypto.createCipheriv/createDecipheriv: compiles scr_cipher.c and links
    * the mbedTLS archive (shared with tls). */
   cipher?: boolean;
+  /** crypto.subtle importKey/sign/verify/digest: compiles scr_webcrypto.c. */
+  webcrypto?: boolean;
   /** Internal compiler hook: called only after a strict native artifact hit
    * or a successful stable build has installed `outPath`. The executable
    * frontend cache uses it to publish its stamp after native dependencies
@@ -267,6 +277,8 @@ export interface LibArchiveOptions {
   threadInstances?: boolean;
   /** IR-detected link gates (the compileC precedent, refusal-narrowed). */
   dynInvoke?: boolean;
+  /** See CompileOptions.dynTier: the scr_js_* units. */
+  dynTier?: boolean;
   regex?: boolean;
   assert?: boolean;
   inspect?: boolean;
diff --git a/packages/compiler/src/backend/native/executable.ts b/packages/compiler/src/backend/native/executable.ts
index 6c8673fe4..5ebb4796e 100644
--- a/packages/compiler/src/backend/native/executable.ts
+++ b/packages/compiler/src/backend/native/executable.ts
@@ -98,6 +98,218 @@ import { CacheInputsChangedError } from "./session.js";
 import { ensureRuntimeObjects, stageRuntimeObjects, clearCcCaches } from "./runtime-objects.js";
 import { localizeLibraryObjects } from "./object-merge.js";
 
+/** What the runtime-unit table reads: the build options, the target driver,
+ * the units other options imply, and the vendor inputs resolved for this
+ * build. */
+interface RuntimeUnitContext {
+  opts: CcOptions;
+  driver: ReturnType<typeof resolveCc>;
+  rt: (path: string) => string;
+  rtDir: string;
+  regex: boolean;
+  nativeFetch: boolean;
+  net: boolean;
+  http: boolean;
+  tls: boolean;
+  tlsCa: boolean;
+  cipher: boolean;
+  lreObjects: readonly string[];
+  zlibObjects: readonly string[];
+  tlsArchive: string | null;
+}
+
+/** An optional runtime input: runtime sources compiled when `when` holds,
+ * or command-line arguments computed from the build. */
+interface RuntimeUnit {
+  when: (u: RuntimeUnitContext) => boolean | undefined;
+  sources: readonly string[];
+  args?: (u: RuntimeUnitContext) => readonly string[];
+}
+
+const unit = (when: RuntimeUnit["when"], ...sources: string[]): RuntimeUnit => ({ when, sources });
+const unitArgs = (args: (u: RuntimeUnitContext) => readonly string[]): RuntimeUnit => ({
+  when: () => true,
+  sources: [],
+  args,
+});
+
+/** The optional runtime inputs, in link order. The order is part of the
+ * executable: a new unit goes next to the units it references. */
+const RUNTIME_UNITS: readonly RuntimeUnit[] = [
+  unit(
+    (u) => u.opts.workers,
+    "scr_worker.c",
+    "scr_worker_events.c",
+    "scr_mailbox.c",
+    "scr_message.c",
+  ),
+  unit((u) => u.opts.copying, "scr_copying.c"),
+  unit((u) => u.opts.fileHandle, "scr_file_handle.c"),
+  // win32 targets compile the libc-shim TU (stpcpy, arc4random_buf,
+  // gmtime_r, strcasestr — the _WIN32 block in scr_runtime.h declares
+  // them) and link advapi32 (the CSPRNG RtlGenRandom/SystemFunction036,
+  // GetUserNameA), iphlpapi (GetAdaptersAddresses behind
+  // os.networkInterfaces), and ws2_32 (inet_ntop there; the socket
+  // units ride the same import). Never present on the default path, so
+  // the historical line cannot change.
+  unitArgs((u) =>
+    targetPlatform(u.driver) === "win32"
+      ? [u.rt(join(u.rtDir, "scr_win.c")), "-ladvapi32", "-liphlpapi", "-lws2_32"]
+      : [],
+  ),
+  // musl deliberately has no libc-identification predefine; resolveCc's
+  // SCR_MUSL flag and this target-selected TU travel together.
+  unit((u) => isMuslTarget(u.driver), "scr_musl.c"),
+  // scr_glob.c (path.matchesGlob) compiles its segments through the
+  // regex unit and scr_idna.c (node:url's IDNA) normalizes through it,
+  // so both ride the same switch; section GC drops them from binaries
+  // that never use them.
+  unitArgs((u) =>
+    u.regex
+      ? [
+          "-I",
+          vendorEngineDir(),
+          u.rt(join(u.rtDir, "scr_regex.c")),
+          u.rt(join(u.rtDir, "scr_glob.c")),
+          u.rt(join(u.rtDir, "scr_idna.c")),
+          ...u.lreObjects,
+        ]
+      : [],
+  ),
+  unit((u) => u.opts.assert || u.regex || u.opts.symbol, "scr_assert.c"),
+  unit((u) => u.opts.inspect, "scr_inspect.c", "scr_console_native.c"),
+  unit((u) => u.opts.dynInvoke || u.opts.workers || u.nativeFetch, "scr_dyn_invoke.c"),
+  unit((u) => u.opts.dc, "scr_dc.c"),
+  unit((u) => u.opts.dynTier, "scr_js_value.c"),
+  unit((u) => u.opts.eventTarget || u.nativeFetch, "scr_event_target.c"),
+  unit(
+    (u) =>
+      u.opts.dynAsync ||
+      u.opts.dynInvoke ||
+      u.opts.workers ||
+      u.opts.dc ||
+      u.opts.fileHandle ||
+      u.nativeFetch,
+    "scr_async_dyn.c",
+  ),
+  // The performance timeline (every perf_hooks user-timing call selects
+  // dynAsync, whose unit carries the timeline's buffer warning).
+  unit((u) => u.opts.dynAsync, "scr_perf.c"),
+  // Blob and File (every blob.* call selects dynAsync, whose unit boxes
+  // their reads as dyn promises).
+  unit((u) => u.opts.dynAsync, "scr_blob.c"),
+  // The zlib UNIT (scr_zlib.c) gates on zlib.* IR use; the LINK (system
+  // libz on the default host-clang build, vendored objects on Zig builds)
+  // also serves the native fetch's gzip decoder — spread exactly once.
+  unitArgs((u) =>
+    u.opts.zlib
+      ? isZigDriver(u.driver)
+        ? ["-I", vendorZlibDir(), u.rt(join(u.rtDir, "scr_zlib.c")), ...u.zlibObjects]
+        : [u.rt(join(u.rtDir, "scr_zlib.c"))]
+      : u.nativeFetch
+        ? isZigDriver(u.driver)
+          ? ["-I", vendorZlibDir(), ...u.zlibObjects]
+          : []
+        : [],
+  ),
+  unit((u) => u.opts.events, "scr_events.c", "scr_readline.c"),
+  // readline's terminal mode: rl.terminal sets the regex unit it
+  // measures with.
+  unit((u) => u.opts.events && u.regex, "scr_readline_tty.c"),
+  unit((u) => u.opts.emitter || u.opts.workers, "scr_events_emitter.c"),
+  // The checked-dynamic HANDLE support unit (listener gate + runtime
+  // adapter closures): every referencing unit is one of the emitter or
+  // net families (http implies net), so handle-free binaries keep
+  // their exact size class.
+  unit((u) => u.opts.emitter || u.opts.workers || u.net, "scr_dyn_handle.c"),
+  unit((u) => u.opts.symbol, "scr_symbol.c"),
+  unit((u) => u.opts.assert && u.opts.bigint, "scr_bigint_assert.c"),
+  unit((u) => u.opts.qs, "scr_qs.c"),
+  // The legacy url unit references the regex, querystring and dyn-async
+  // units; the url.parse family's IR sets all three.
+  unit((u) => u.regex && u.opts.qs && u.opts.dynAsync, "scr_url_legacy.c"),
+  unit((u) => u.opts.parseArgs, "scr_util.c"),
+  unit((u) => u.opts.parseArgs && u.opts.symbol, "scr_util_compare.c"),
+  unit((u) => u.opts.parseArgs && u.opts.inspect && u.opts.dynAsync, "scr_util_style.c"),
+  unit(
+    (u) => u.opts.parseArgs && u.opts.inspect && u.opts.dynAsync && u.opts.dynInvoke && u.regex,
+    "scr_util_callable.c",
+  ),
+  unit((u) => u.opts.stream, "scr_stream.c", "scr_fs_stream.c"),
+  // The zlib stream classes reference both the zlib engine and the
+  // stream unit.
+  unit((u) => u.opts.zlib && u.opts.stream, "scr_zlib_stream.c"),
+  unit((u) => u.opts.stream && u.opts.dynAsync, "scr_stream_ops.c"),
+  // FileHandle streams reference both the stream unit and FileHandle.
+  unit((u) => u.opts.stream && u.opts.fileHandle, "scr_fs_stream_fh.c"),
+  // The readiness-poller backends (scr_platform.h): kqueue on macOS/BSD,
+  // epoll on Linux, WSAPoll on Windows — each TU is empty off its
+  // platform, so all three link whenever a poller-using unit does and
+  // the others cost nothing (ws2_32 rides the unconditional win32 libs
+  // above).
+  unit((u) => u.net || u.opts.dgram, "scr_loop_kqueue.c", "scr_loop_epoll.c", "scr_loop_wsapoll.c"),
+  unit((u) => u.net, "scr_net.c"),
+  unit((u) => u.http, "scr_http.c"),
+  unit((u) => u.opts.http2, "scr_http2.c"),
+  unit((u) => u.opts.dgram, "scr_dgram.c"),
+  unit((u) => u.opts.watch, "scr_watch.c"),
+  unit((u) => u.opts.foreignFfi, "scr_ffi_queue.c"),
+  unit((u) => u.opts.nodeTest, "scr_test.c"),
+  unit((u) => u.opts.webcrypto, "scr_webcrypto.c"),
+  // The CA-store unit rides its own gate OR the tls one: scr_tls.c
+  // references its default-set override unconditionally.
+  unit((u) => u.tlsCa, "scr_tls_ca.c"),
+  unitArgs((u) =>
+    u.tlsArchive
+      ? [
+          "-I",
+          join(vendorTlsDir(), "include"),
+          ...(u.tls ? [u.rt(join(u.rtDir, "scr_tls.c"))] : []),
+          ...(u.cipher ? [u.rt(join(u.rtDir, "scr_cipher.c"))] : []),
+          u.tlsArchive,
+          // mbedTLS's win32 entropy poll is BCryptGenRandom (bcrypt.h).
+          // The unconditional win32 libs above do not carry it.
+          // Never present on the default path, so the historical TLS
+          // link line cannot change.
+          ...(targetPlatform(u.driver) === "win32" ? ["-lbcrypt"] : []),
+        ]
+      : [],
+  ),
+  // scr_tls_ca.c enumerates and PEM-encodes Windows system-store entries.
+  // This is independent of the mbedTLS archive: getCACertificates-only
+  // programs need crypt32 too, while TLS programs imply the CA unit.
+  unitArgs((u) => (u.tlsCa && targetPlatform(u.driver) === "win32" ? ["-lcrypt32"] : [])),
+  // Fetch uses the native network, TLS, and HTTP runtime.
+  unit((u) => u.nativeFetch, "scr_fetch.c"),
+];
+
+/** The arguments of the optional runtime inputs, in link order. */
+function runtimeUnitArgs(u: RuntimeUnitContext): string[] {
+  return RUNTIME_UNITS.flatMap((entry) =>
+    entry.args
+      ? [...entry.args(u)]
+      : entry.when(u)
+        ? entry.sources.map((source) => u.rt(join(u.rtDir, source)))
+        : [],
+  );
+}
+
+/** The runtime's optional compile-time definitions, in command-line order.
+ * Both the program build and the runtime-object flags use this list. */
+const RUNTIME_DEFINES: readonly {
+  define: string;
+  when: (opts: CcOptions) => boolean | undefined;
+}[] = [
+  { define: "SCR_TEXT_DECODER_LEGACY", when: (opts) => opts.textDecoderLegacy },
+  { define: "SCR_WARNING_REPLACE", when: (opts) => opts.warningReplace },
+  { define: "SCR_STDIO_EXTENDED", when: (opts) => opts.stdioExtended },
+  { define: "SCR_YIN", when: (opts) => opts.youngNursery },
+];
+
+function runtimeDefineArgs(opts: CcOptions): string[] {
+  return RUNTIME_DEFINES.filter((d) => d.when(opts)).map((d) => `-D${d.define}`);
+}
+
 export async function compileCInternal(
   opts: CcOptions,
   cacheWarmOnly: boolean,
@@ -444,8 +656,7 @@ export async function compileCInternal(
       ? ["-O1", "-fsanitize=address", "-DSCR_RC_AUDIT"]
       : [optimization === "dev" ? "-O0" : "-O2"]),
     ...executableSectionFlags.compile,
-    ...(opts.textDecoderLegacy ? ["-DSCR_TEXT_DECODER_LEGACY"] : []),
-    ...(opts.youngNursery ? ["-DSCR_YIN"] : []),
+    ...runtimeDefineArgs(opts),
     "-fno-math-errno",
     // The runtime object model uses type-punned C: a hierarchy
     // upcast is a raw pointer cast, so one object's header (rc, vt) and
@@ -463,144 +674,22 @@ export async function compileCInternal(
     "-I",
     rtDir,
     ...runtimeSources.map((f) => rt(join(rtDir, f))),
-    ...(opts.workers
-      ? ["scr_worker.c", "scr_worker_events.c", "scr_mailbox.c", "scr_message.c"].map((f) =>
-          rt(join(rtDir, f)),
-        )
-      : []),
-    ...(opts.copying ? [rt(join(rtDir, "scr_copying.c"))] : []),
-    ...(opts.fileHandle ? [rt(join(rtDir, "scr_file_handle.c"))] : []),
-    // win32 targets compile the libc-shim TU (stpcpy, arc4random_buf,
-    // gmtime_r, strcasestr — the _WIN32 block in scr_runtime.h declares
-    // them) and link advapi32 (the CSPRNG RtlGenRandom/SystemFunction036,
-    // GetUserNameA), iphlpapi (GetAdaptersAddresses behind
-    // os.networkInterfaces), and ws2_32 (inet_ntop there; the socket
-    // units ride the same import). Never present on the default path, so
-    // the historical line cannot change.
-    ...(targetPlatform(driver) === "win32"
-      ? [rt(join(rtDir, "scr_win.c")), "-ladvapi32", "-liphlpapi", "-lws2_32"]
-      : []),
-    // musl deliberately has no libc-identification predefine; resolveCc's
-    // SCR_MUSL flag and this target-selected TU travel together.
-    ...(isMuslTarget(driver) ? [rt(join(rtDir, "scr_musl.c"))] : []),
-    // scr_glob.c (path.matchesGlob) compiles its segments through the
-    // regex unit and scr_idna.c (node:url's IDNA) normalizes through it,
-    // so both ride the same switch; section GC drops them from binaries
-    // that never use them.
-    ...(regex
-      ? [
-          "-I",
-          vendorEngineDir(),
-          rt(join(rtDir, "scr_regex.c")),
-          rt(join(rtDir, "scr_glob.c")),
-          rt(join(rtDir, "scr_idna.c")),
-          ...lreObjects,
-        ]
-      : []),
-    ...(opts.assert || regex || opts.symbol ? [rt(join(rtDir, "scr_assert.c"))] : []),
-    ...(opts.inspect
-      ? [rt(join(rtDir, "scr_inspect.c")), rt(join(rtDir, "scr_console_native.c"))]
-      : []),
-    ...(opts.dynInvoke || opts.workers || nativeFetch ? [rt(join(rtDir, "scr_dyn_invoke.c"))] : []),
-    ...(opts.dc ? [rt(join(rtDir, "scr_dc.c"))] : []),
-    ...(opts.eventTarget || nativeFetch ? [rt(join(rtDir, "scr_event_target.c"))] : []),
-    ...(opts.dynAsync || opts.dynInvoke || opts.workers || opts.dc || opts.fileHandle || nativeFetch
-      ? [rt(join(rtDir, "scr_async_dyn.c"))]
-      : []),
-    // The performance timeline (every perf_hooks user-timing call selects
-    // dynAsync, whose unit carries the timeline's buffer warning).
-    ...(opts.dynAsync ? [rt(join(rtDir, "scr_perf.c"))] : []),
-    // Blob and File (every blob.* call selects dynAsync, whose unit boxes
-    // their reads as dyn promises).
-    ...(opts.dynAsync ? [rt(join(rtDir, "scr_blob.c"))] : []),
-    // The zlib UNIT (scr_zlib.c) gates on zlib.* IR use; the LINK (system
-    // libz on the default host-clang build, vendored objects on Zig builds)
-    // also serves the native fetch's gzip decoder — spread exactly once.
-    ...(opts.zlib
-      ? isZigDriver(driver)
-        ? ["-I", vendorZlibDir(), rt(join(rtDir, "scr_zlib.c")), ...zlibObjects]
-        : [rt(join(rtDir, "scr_zlib.c"))]
-      : nativeFetch
-        ? isZigDriver(driver)
-          ? ["-I", vendorZlibDir(), ...zlibObjects]
-          : []
-        : []),
-
-    // through the native installation hooks — the emitted main calls its
-    // installer exactly then.
-    ...(opts.events ? [rt(join(rtDir, "scr_events.c")), rt(join(rtDir, "scr_readline.c"))] : []),
-    // readline's terminal mode: rl.terminal sets the regex unit it
-    // measures with.
-    ...(opts.events && regex ? [rt(join(rtDir, "scr_readline_tty.c"))] : []),
-    ...(opts.emitter || opts.workers ? [rt(join(rtDir, "scr_events_emitter.c"))] : []),
-    // The checked-dynamic HANDLE support unit (listener gate + runtime
-    // adapter closures): every referencing unit is one of the emitter or
-    // net families (http implies net), so handle-free binaries keep
-    // their exact size class.
-    ...(opts.emitter || opts.workers || net ? [rt(join(rtDir, "scr_dyn_handle.c"))] : []),
-    ...(opts.symbol ? [rt(join(rtDir, "scr_symbol.c"))] : []),
-    ...(opts.assert && opts.bigint ? [rt(join(rtDir, "scr_bigint_assert.c"))] : []),
-    ...(opts.qs ? [rt(join(rtDir, "scr_qs.c"))] : []),
-    // The legacy url unit references the regex, querystring and dyn-async
-    // units; the url.parse family's IR sets all three.
-    ...(regex && opts.qs && opts.dynAsync ? [rt(join(rtDir, "scr_url_legacy.c"))] : []),
-    ...(opts.parseArgs ? [rt(join(rtDir, "scr_util.c"))] : []),
-    ...(opts.parseArgs && opts.symbol ? [rt(join(rtDir, "scr_util_compare.c"))] : []),
-    ...(opts.parseArgs && opts.inspect && opts.dynAsync
-      ? [rt(join(rtDir, "scr_util_style.c"))]
-      : []),
-    ...(opts.parseArgs && opts.inspect && opts.dynAsync && opts.dynInvoke && regex
-      ? [rt(join(rtDir, "scr_util_callable.c"))]
-      : []),
-    ...(opts.stream ? [rt(join(rtDir, "scr_stream.c")), rt(join(rtDir, "scr_fs_stream.c"))] : []),
-    // The zlib stream classes reference both the zlib engine and the
-    // stream unit.
-    ...(opts.zlib && opts.stream ? [rt(join(rtDir, "scr_zlib_stream.c"))] : []),
-    ...(opts.stream && opts.dynAsync ? [rt(join(rtDir, "scr_stream_ops.c"))] : []),
-    // FileHandle streams reference both the stream unit and FileHandle.
-    ...(opts.stream && opts.fileHandle ? [rt(join(rtDir, "scr_fs_stream_fh.c"))] : []),
-    // The readiness-poller backends (scr_platform.h): kqueue on macOS/BSD,
-    // epoll on Linux, WSAPoll on Windows — each TU is empty off its
-    // platform, so all three link whenever a poller-using unit does and
-    // the others cost nothing (ws2_32 rides the unconditional win32 libs
-    // above).
-    ...(net || opts.dgram
-      ? [
-          rt(join(rtDir, "scr_loop_kqueue.c")),
-          rt(join(rtDir, "scr_loop_epoll.c")),
-          rt(join(rtDir, "scr_loop_wsapoll.c")),
-        ]
-      : []),
-    ...(net ? [rt(join(rtDir, "scr_net.c"))] : []),
-    ...(http ? [rt(join(rtDir, "scr_http.c"))] : []),
-    ...((opts.http2 ?? false) ? [rt(join(rtDir, "scr_http2.c"))] : []),
-    ...(opts.dgram ? [rt(join(rtDir, "scr_dgram.c"))] : []),
-    ...(opts.watch ? [rt(join(rtDir, "scr_watch.c"))] : []),
-    ...(opts.foreignFfi ? [rt(join(rtDir, "scr_ffi_queue.c"))] : []),
-    ...(opts.nodeTest ? [rt(join(rtDir, "scr_test.c"))] : []),
-    // The CA-store unit rides its own gate OR the tls one: scr_tls.c
-    // references its default-set override unconditionally.
-    ...(tlsCa ? [rt(join(rtDir, "scr_tls_ca.c"))] : []),
-    ...(tlsArchive
-      ? [
-          "-I",
-          join(vendorTlsDir(), "include"),
-          ...(tls ? [rt(join(rtDir, "scr_tls.c"))] : []),
-          ...(cipher ? [rt(join(rtDir, "scr_cipher.c"))] : []),
-          tlsArchive,
-          // mbedTLS's win32 entropy poll is BCryptGenRandom (bcrypt.h).
-          // The unconditional win32 libs above do not carry it.
-          // Never present on the default path, so the historical TLS
-          // link line cannot change.
-          ...(targetPlatform(driver) === "win32" ? ["-lbcrypt"] : []),
-        ]
-      : []),
-    // scr_tls_ca.c enumerates and PEM-encodes Windows system-store entries.
-    // This is independent of the mbedTLS archive: getCACertificates-only
-    // programs need crypt32 too, while TLS programs imply the CA unit.
-    ...(tlsCa && targetPlatform(driver) === "win32" ? ["-lcrypt32"] : []),
-    // Fetch uses the native network, TLS, and HTTP runtime.
-    ...(nativeFetch ? [rt(join(rtDir, "scr_fetch.c"))] : []),
+    ...runtimeUnitArgs({
+      opts,
+      driver,
+      rt,
+      rtDir,
+      regex,
+      nativeFetch,
+      net,
+      http,
+      tls,
+      tlsCa,
+      cipher,
+      lreObjects,
+      zlibObjects,
+      tlsArchive,
+    }),
     // A .ll program TU (the LLVM backend) deliberately carries no target
     // triple (byte-stable output; clang supplies the host/SCRIPTC_TARGET
     // triple exactly as it does for .c) — silence the -Woverride-module
@@ -643,8 +732,7 @@ export async function compileCInternal(
       ? ["-O1", "-fsanitize=address", "-DSCR_RC_AUDIT"]
       : [optimization === "dev" ? "-O0" : "-O2"]),
     ...executableSectionFlags.compile,
-    ...(opts.textDecoderLegacy ? ["-DSCR_TEXT_DECODER_LEGACY"] : []),
-    ...(opts.youngNursery ? ["-DSCR_YIN"] : []),
+    ...runtimeDefineArgs(opts),
     "-fno-math-errno",
     "-fno-strict-aliasing", // the emitted object model type-puns — see buildArgs
     "-Wno-deprecated-declarations",
diff --git a/packages/compiler/src/backend/native/library.ts b/packages/compiler/src/backend/native/library.ts
index dffa4ef5b..23d081bfe 100644
--- a/packages/compiler/src/backend/native/library.ts
+++ b/packages/compiler/src/backend/native/library.ts
@@ -112,6 +112,7 @@ export async function compileLibArchive(opts: LibArchiveOptions): Promise<void>
     ...(opts.assert && opts.bigint ? ["scr_bigint_assert.c"] : []),
     ...(opts.emitter ? ["scr_events_emitter.c", "scr_dyn_handle.c"] : []),
     ...(opts.dynInvoke ? ["scr_dyn_invoke.c"] : []),
+    ...(opts.dynTier === true ? ["scr_js_value.c"] : []),
     ...(opts.zlib ? ["scr_zlib.c"] : []),
     ...(opts.copying ? ["scr_copying.c"] : []),
   ];
diff --git a/packages/compiler/src/backend/publication.test.ts b/packages/compiler/src/backend/publication.test.ts
index 38dd11833..149ea4bb9 100644
--- a/packages/compiler/src/backend/publication.test.ts
+++ b/packages/compiler/src/backend/publication.test.ts
@@ -54,7 +54,7 @@ test("published types close over fields, containers and whole hierarchies", () =
     cls("Other", [["n", F64]]),
   ];
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     classes,
diff --git a/packages/compiler/src/backend/runtime-pack-core.ts b/packages/compiler/src/backend/runtime-pack-core.ts
index 16fbc2a36..6a660e00c 100644
--- a/packages/compiler/src/backend/runtime-pack-core.ts
+++ b/packages/compiler/src/backend/runtime-pack-core.ts
@@ -82,6 +82,9 @@ export interface RuntimeFeatureSet extends NativeLinkFeatures {
   workers: boolean;
   youngNursery: boolean;
   eventTarget: boolean;
+  dynTier: boolean;
+  warningReplace: boolean;
+  stdioExtended: boolean;
   nativeFetch: boolean;
   netEffective: boolean;
   httpEffective: boolean;
@@ -269,6 +272,9 @@ export function effectiveRuntimeFeatures(
     workers: features.workers === true,
     youngNursery: features.youngNursery === true,
     eventTarget: features.eventTarget === true,
+    dynTier: features.dynTier === true,
+    warningReplace: features.warningReplace === true,
+    stdioExtended: features.stdioExtended === true,
     nativeFetch,
     netEffective,
     httpEffective,
diff --git a/packages/compiler/src/backend/runtime-pack-targets.test.ts b/packages/compiler/src/backend/runtime-pack-targets.test.ts
index faa335e33..fd57cb49d 100644
--- a/packages/compiler/src/backend/runtime-pack-targets.test.ts
+++ b/packages/compiler/src/backend/runtime-pack-targets.test.ts
@@ -119,6 +119,7 @@ const features = {
   tls: false,
   tlsCa: false,
   cipher: false,
+  webcrypto: false,
 };
 
 test.each([
diff --git a/packages/compiler/src/backend/runtime-pack.test.ts b/packages/compiler/src/backend/runtime-pack.test.ts
index ffe581366..61d1dba5e 100644
--- a/packages/compiler/src/backend/runtime-pack.test.ts
+++ b/packages/compiler/src/backend/runtime-pack.test.ts
@@ -56,6 +56,7 @@ const BASE: NativeLinkFeatures = {
   tls: false,
   tlsCa: false,
   cipher: false,
+  webcrypto: false,
 };
 
 async function fixture(target: NativeTargetSpec = MACOS_ARM64_TARGET) {
diff --git a/packages/compiler/src/backend/stack-observations.test.ts b/packages/compiler/src/backend/stack-observations.test.ts
index f58c89ad8..a95f0140f 100644
--- a/packages/compiler/src/backend/stack-observations.test.ts
+++ b/packages/compiler/src/backend/stack-observations.test.ts
@@ -34,7 +34,7 @@ const fn = (name: string, body: IrStmt[]): IrFunction => ({
   body,
 });
 const mod = (functions: IrFunction[], extra: Partial<IrModule> = {}): IrModule => ({
-  irVersion: 16,
+  irVersion: 17,
   sourceFile: "stack-observations.ts",
   entry: "%main",
   functions,
diff --git a/packages/compiler/src/backend/target-diagnostics.test.ts b/packages/compiler/src/backend/target-diagnostics.test.ts
index bc16eaa31..e1b344f37 100644
--- a/packages/compiler/src/backend/target-diagnostics.test.ts
+++ b/packages/compiler/src/backend/target-diagnostics.test.ts
@@ -35,7 +35,7 @@ const fetch: IrExpr = {
 };
 function module(direct: IrExpr[] = []): IrModule {
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "%main",
     records: [],
diff --git a/packages/compiler/src/backend/warm-cache.ts b/packages/compiler/src/backend/warm-cache.ts
index 67e627c91..2cd111060 100644
--- a/packages/compiler/src/backend/warm-cache.ts
+++ b/packages/compiler/src/backend/warm-cache.ts
@@ -61,6 +61,7 @@ export async function warmNativeCaches(
         nodeTest: false,
         tls: false,
         cipher: false,
+        webcrypto: false,
         tlsCa: false,
       },
     });
diff --git a/packages/compiler/src/coverage/verdict-cache.test.ts b/packages/compiler/src/coverage/verdict-cache.test.ts
index 1c3e9bc3d..0380e8b8d 100644
--- a/packages/compiler/src/coverage/verdict-cache.test.ts
+++ b/packages/compiler/src/coverage/verdict-cache.test.ts
@@ -11,7 +11,8 @@ afterAll(() => rmSync(dir, { recursive: true, force: true }));
 
 test("unchanged and comment-only reruns replay the verdict; code edits relower", () => {
   const entry = join(dir, "main.ts");
-  const program = `const pairs: [number, number][] = [[1, 2]];\nconst [[a, b]] = pairs;\nconsole.log(a + b);\nconst { length } = [1, 2] as number[];\nconsole.log(length);\n`;
+  // The blocker: an object pattern over a union source (arrays alone compile).
+  const program = `const pairs: [number, number][] = [[1, 2]];\nconst [[a, b]] = pairs;\nconsole.log(a + b);\nconst { length } = (a > 9 ? [1, 2] : "ab") as number[] | string;\nconsole.log(length);\n`;
   writeFileSync(entry, program);
   const entries = new Map<string, string>();
   const store: VerdictStore = {
diff --git a/packages/compiler/src/executable/executable-cache.test.ts b/packages/compiler/src/executable/executable-cache.test.ts
index e5887e855..1b42c3eca 100644
--- a/packages/compiler/src/executable/executable-cache.test.ts
+++ b/packages/compiler/src/executable/executable-cache.test.ts
@@ -57,6 +57,7 @@ const native: EarlyExecutableNativeFeatures = {
   tls: false,
   tlsCa: false,
   cipher: false,
+  webcrypto: false,
 };
 
 async function fixture(): Promise<{
diff --git a/packages/compiler/src/executable/executable-cache.ts b/packages/compiler/src/executable/executable-cache.ts
index ee9d84fcf..8c67c1006 100644
--- a/packages/compiler/src/executable/executable-cache.ts
+++ b/packages/compiler/src/executable/executable-cache.ts
@@ -56,12 +56,15 @@ export interface EarlyExecutableNativeFeatures {
   fileHandle: boolean;
   fetch: boolean;
   eventTarget?: boolean;
+  warningReplace?: boolean;
+  stdioExtended?: boolean;
   zlib: boolean;
   assert: boolean;
   inspect: boolean;
   dynInvoke: boolean;
   dc: boolean;
   dynAsync: boolean;
+  dynTier?: boolean;
   events: boolean;
   emitter: boolean;
   symbol: boolean;
@@ -80,6 +83,7 @@ export interface EarlyExecutableNativeFeatures {
   tls: boolean;
   cipher: boolean;
   tlsCa: boolean;
+  webcrypto: boolean;
 }
 
 interface EarlyExecutableCacheStamp {
@@ -193,6 +197,7 @@ const BOOLEAN_NATIVE_KEYS = [
   "tls",
   "tlsCa",
   "cipher",
+  "webcrypto",
 ] as const satisfies readonly (keyof EarlyExecutableNativeFeatures)[];
 
 function validNativeFeatures(value: unknown): value is EarlyExecutableNativeFeatures {
diff --git a/packages/compiler/src/frontend/contract-types.ts b/packages/compiler/src/frontend/contract-types.ts
index 9ba041d2c..c30788fa1 100644
--- a/packages/compiler/src/frontend/contract-types.ts
+++ b/packages/compiler/src/frontend/contract-types.ts
@@ -109,7 +109,7 @@ function markerNamed(
   if (!MARKERS.has(written)) return null;
   let member = written;
   const symbol = checker.getSymbolAtLocation(ident);
-  const decl = symbol ? checker.declarationsOf(symbol)[0] : undefined;
+  const decl = symbol ? symbol.declarations[0] : undefined;
   if (decl === undefined) return null;
   let importDecl: ts.Node | undefined;
   if (ts.isImportSpecifier(decl) && !qualified) {
diff --git a/packages/compiler/src/frontend/experimental-import.ts b/packages/compiler/src/frontend/experimental-import.ts
index 86aa10933..8fc2238bf 100644
--- a/packages/compiler/src/frontend/experimental-import.ts
+++ b/packages/compiler/src/frontend/experimental-import.ts
@@ -18,7 +18,7 @@ export function experimentalImportOf(
 ): ExperimentalMember | null {
   const checker = program.getTypeChecker();
   const symbol = checker.getSymbolAtLocation(ident);
-  const decl = symbol ? checker.declarationsOf(symbol)[0] : undefined;
+  const decl = symbol ? symbol.declarations[0] : undefined;
   if (decl === undefined || !ts.isImportSpecifier(decl)) return null;
   const importDecl = decl.parent?.parent?.parent;
   if (
@@ -67,7 +67,7 @@ export function lifetimeRegionMemberOf(
 ): "run" | "release" | null {
   const checker = program.getTypeChecker();
   const symbol = checker.getSymbolAtLocation(access.name);
-  const decl = symbol ? checker.declarationsOf(symbol)[0] : undefined;
+  const decl = symbol ? symbol.declarations[0] : undefined;
   if (decl === undefined || !ts.isMethodDeclaration(decl)) return null;
   const owner = decl.parent;
   if (
@@ -91,7 +91,7 @@ export function internTableMemberOf(
 ): InternTableMember | null {
   const checker = program.getTypeChecker();
   const symbol = checker.getSymbolAtLocation(access.name);
-  const decl = symbol ? checker.declarationsOf(symbol)[0] : undefined;
+  const decl = symbol ? symbol.declarations[0] : undefined;
   if (
     decl === undefined ||
     !(
@@ -129,7 +129,7 @@ export function threadSlotsMemberOf(
 ): ThreadSlotsMember | null {
   const checker = program.getTypeChecker();
   const symbol = checker.getSymbolAtLocation(access.name);
-  const decl = symbol ? checker.declarationsOf(symbol)[0] : undefined;
+  const decl = symbol ? symbol.declarations[0] : undefined;
   if (decl === undefined || !ts.isMethodDeclaration(decl)) return null;
   const owner = decl.parent;
   if (
diff --git a/packages/compiler/src/frontend/fork-target.ts b/packages/compiler/src/frontend/fork-target.ts
index a7248c674..592bbb2d6 100644
--- a/packages/compiler/src/frontend/fork-target.ts
+++ b/packages/compiler/src/frontend/fork-target.ts
@@ -8,7 +8,7 @@ import { moduleSourceCandidates } from "./module-source-candidates.js";
 export function isNodeGlobal(program: ts.Program, expression: ts.Identifier): boolean {
   const checker = program.getTypeChecker();
   const symbol = checker.getSymbolAtLocation(expression);
-  const declarations = symbol ? checker.declarationsOf(symbol) : [];
+  const declarations = symbol ? symbol.declarations : [];
   return (
     declarations.length > 0 &&
     declarations.every((declaration) => {
@@ -45,7 +45,7 @@ export function isBuiltinMemberImport(
 ): boolean {
   const checker = program.getTypeChecker();
   const symbol = checker.getSymbolAtLocation(ident);
-  const decl = symbol ? checker.declarationsOf(symbol)[0] : undefined;
+  const decl = symbol ? symbol.declarations[0] : undefined;
   if (decl !== undefined && ts.isImportSpecifier(decl)) {
     const importDecl = decl.parent?.parent?.parent;
     if (ts.isImportDeclaration(importDecl) && ts.isStringLiteral(importDecl.moduleSpecifier)) {
@@ -60,7 +60,7 @@ export function isBuiltinMemberImport(
   }
   if (symbol !== undefined && (symbol.flags & ts.SymbolFlags.Alias) !== 0) {
     const target = checker.getAliasedSymbol(symbol);
-    const targetDecl = checker.declarationsOf(target)[0];
+    const targetDecl = target.declarations[0];
     if (targetDecl !== undefined && targetDecl.getSourceFile().isDeclarationFile) {
       for (
         let parent: ts.Node | undefined = targetDecl.parent;
@@ -88,7 +88,7 @@ export function isBuiltinNamespaceImport(
 ): boolean {
   const checker = program.getTypeChecker();
   const symbol = checker.getSymbolAtLocation(ident);
-  const decl = symbol ? checker.declarationsOf(symbol)[0] : undefined;
+  const decl = symbol ? symbol.declarations[0] : undefined;
   let importDecl: ts.ImportDeclaration | undefined;
   if (decl !== undefined && ts.isNamespaceImport(decl)) {
     const candidate = decl.parent?.parent;
@@ -108,12 +108,9 @@ function constInitializer(program: ts.Program, expr: ts.Expression): ts.Expressi
   if (!ts.isIdentifier(current)) return null;
   const symbol = program.getTypeChecker().getSymbolAtLocation(current);
   const decl = symbol
-    ? program
-        .getTypeChecker()
-        .declarationsOf(symbol)
-        .find((candidate): candidate is ts.VariableDeclaration =>
-          ts.isVariableDeclaration(candidate),
-        )
+    ? symbol.declarations.find((candidate): candidate is ts.VariableDeclaration =>
+        ts.isVariableDeclaration(candidate),
+      )
     : undefined;
   if (
     decl === undefined ||
diff --git a/packages/compiler/src/frontend/inferred-js-diagnostics.ts b/packages/compiler/src/frontend/inferred-js-diagnostics.ts
index a4ad48892..7095cea5d 100644
--- a/packages/compiler/src/frontend/inferred-js-diagnostics.ts
+++ b/packages/compiler/src/frontend/inferred-js-diagnostics.ts
@@ -25,15 +25,13 @@ export function inferredJsDiagnosticSuppressed(
       const symbol = checker.getSymbolAtLocation(node.name);
       if (
         symbol &&
-        checker
-          .declarationsOf(symbol)
-          .some(
-            (decl) =>
-              ts.isPropertyDeclaration(decl) &&
-              !decl.type &&
-              !decl.initializer &&
-              !/@type\b/.test(file.text.slice(decl.pos, decl.getStart(file))),
-          )
+        symbol.declarations.some(
+          (decl) =>
+            ts.isPropertyDeclaration(decl) &&
+            !decl.type &&
+            !decl.initializer &&
+            !/@type\b/.test(file.text.slice(decl.pos, decl.getStart(file))),
+        )
       ) {
         // Bare JS fields exist with value undefined before the first write;
         // native storage includes that arm even when inference omits it.
@@ -43,7 +41,7 @@ export function inferredJsDiagnosticSuppressed(
     }
     if (diagnostic.code === 2554 && ts.isCallExpression(node)) {
       const signature = checker.getResolvedSignature(node);
-      const declaration = signature && checker.signatureDeclaration(signature);
+      const declaration = signature && signature.declaration;
       if (
         declaration &&
         isJsSourceFileName(declaration.getSourceFile().fileName) &&
@@ -83,9 +81,7 @@ export function inferredJsDiagnosticSuppressed(
         checker.getTypeOfSymbolAtLocation(throwMethod, node.expression),
       );
       const declaration =
-        throwSignatures.length === 1
-          ? checker.signatureDeclaration(throwSignatures[0]!)
-          : undefined;
+        throwSignatures.length === 1 ? throwSignatures[0]!.declaration : undefined;
       // A sole throw cannot return an invalid IteratorResult. Avoid inferring
       // termination through arbitrary control flow or explicit return types.
       if (
diff --git a/packages/compiler/src/frontend/lowering/assert-instances.ts b/packages/compiler/src/frontend/lowering/assert-instances.ts
index feeb23019..ee8a34ea2 100644
--- a/packages/compiler/src/frontend/lowering/assert-instances.ts
+++ b/packages/compiler/src/frontend/lowering/assert-instances.ts
@@ -176,7 +176,7 @@ export function assertInstanceOf(
 ): AssertInstanceOptions | null {
   if (!ts.isIdentifier(expr)) return null;
   const symbol = lowerer.checker.getSymbolAtLocation(expr);
-  const decl = symbol ? lowerer.checker.declarationsOf(symbol)[0] : undefined;
+  const decl = symbol ? symbol.declarations[0] : undefined;
   if (decl === undefined || !ts.isVariableDeclaration(decl)) return null;
   return staticAssertInstanceDecl(lowerer, decl.name, decl.initializer);
 }
diff --git a/packages/compiler/src/frontend/lowering/assertion-identity.ts b/packages/compiler/src/frontend/lowering/assertion-identity.ts
new file mode 100644
index 000000000..6a00b7afe
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/assertion-identity.ts
@@ -0,0 +1,78 @@
+/* Type assertions of the global object.
+ *
+ * `globalThis as { [KEY]?: State }` is the process-global state idiom: a
+ * module asserts the global object to a record type and reads and writes
+ * its members, and every other module that asserts it sees the same
+ * members. Node evaluates the assertion to the global object itself.
+ *
+ * The global object is a checked-dynamic value, and a checked-dynamic value
+ * asserted to a record or array type takes the checked extraction
+ * (dynCheck), which builds a new native value. For the global object that
+ * copy is always wrong: a write through it never reached the global object,
+ * and a view bound before another module's write never saw it. So an
+ * assertion of the global object keeps the checked-dynamic value itself: a
+ * view whose member reads and writes go to the global object, and bindings
+ * of it hold that object.
+ *
+ * Other checked-dynamic operands keep the checked extraction: a native value
+ * held as `unknown` unwraps by identity there, and a checked-dynamic tree is
+ * copied at the documented checked-value boundary.
+ */
+import * as ts from "../ts7/adapter.js";
+import type { IrType } from "../../ir/ir.js";
+import type { Lowerer } from "./lowerer.js";
+import { stdlibGlobalNameOf } from "./surfaces.js";
+
+/** A target whose checked extraction builds a new mutable value. */
+export function extractionCopiesReference(lowerer: Lowerer, type: IrType): boolean {
+  const seen = new Set<string>();
+  const copies = (t: IrType): boolean => {
+    if (t.kind === "record" || t.kind === "array") return true;
+    if (t.kind !== "union" || seen.has(t.unionId)) return false;
+    seen.add(t.unionId);
+    return lowerer.unions.get(t.unionId)?.arms.some(copies) ?? false;
+  };
+  return copies(type);
+}
+
+/** The asserted expression without parentheses, `!` and nested
+ * assertions (`globalThis as unknown as T`). */
+function assertedSource(expr: ts.Expression): ts.Expression {
+  let e = expr;
+  while (
+    ts.isParenthesizedExpression(e) ||
+    ts.isNonNullExpression(e) ||
+    ts.isAsExpression(e) ||
+    ts.isTypeAssertion(e) ||
+    ts.isSatisfiesExpression(e)
+  )
+    e = e.expression;
+  return e;
+}
+
+/** `expr` asserts the global object (`globalThis`, `global`). */
+export function assertsGlobalObject(
+  lowerer: Lowerer,
+  expr: ts.AsExpression | ts.TypeAssertion,
+): boolean {
+  const name = stdlibGlobalNameOf(lowerer, assertedSource(expr.expression));
+  return name === "globalThis" || name === "global";
+}
+
+/** The assertion a binding initializer is, when it keeps the global object:
+ * bindings of it hold that object rather than a native value of the
+ * asserted type. A target with no native layout keeps the object as well
+ * (the assertion lowers to the checked-dynamic value either way). */
+export function keptIdentityAssertion(
+  lowerer: Lowerer,
+  initializer: ts.Expression,
+): ts.AsExpression | ts.TypeAssertion | undefined {
+  let e = initializer;
+  while (ts.isParenthesizedExpression(e)) e = e.expression;
+  if (!ts.isAsExpression(e) && !ts.isTypeAssertion(e)) return undefined;
+  if (!assertsGlobalObject(lowerer, e)) return undefined;
+  const target = lowerer.mapTypeOf(lowerer.checker.getTypeFromTypeNode(e.type));
+  return !target || target.kind === "dyn" || extractionCopiesReference(lowerer, target)
+    ? e
+    : undefined;
+}
diff --git a/packages/compiler/src/frontend/lowering/binding-analysis.ts b/packages/compiler/src/frontend/lowering/binding-analysis.ts
index 816294e08..88b0f91dc 100644
--- a/packages/compiler/src/frontend/lowering/binding-analysis.ts
+++ b/packages/compiler/src/frontend/lowering/binding-analysis.ts
@@ -114,7 +114,7 @@ export function nullishValueUnitOf(
   const cached = lowerer.nullishBindings.get(sym);
   if (cached !== undefined) return cached;
   lowerer.nullishBindings.set(sym, null); // cycle guard: self-referential probes answer non-qualifying
-  const decl = lowerer.checker.valueDeclarationOf(sym);
+  const decl = sym.valueDeclaration;
   // Statement-position declarators only: a for-loop head (`for (let x =
   // null as any; ...)`) declares a LOCAL with per-iteration semantics —
   // lowerVarDeclList's contract requires a lowered statement for it, so
diff --git a/packages/compiler/src/frontend/lowering/builtin-function-fences.ts b/packages/compiler/src/frontend/lowering/builtin-function-fences.ts
new file mode 100644
index 000000000..e6221384b
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/builtin-function-fences.ts
@@ -0,0 +1,52 @@
+/** A builtin module function used as a JavaScript value when it has no
+ * value adapter (lowerNativeCallableValue). Node hands the program a real
+ * function; the compiled value is one function per builtin that throws the
+ * named fence when called. Identity flows (`fn === fs.readFileSync`, Set
+ * membership) still hold, `typeof` answers "function" and inspection
+ * prints `[Function: name]`, where a string token would answer "string"
+ * and turn a call into an ordinary "is not a function" TypeError. */
+import * as ts from "../ts7/adapter.js";
+import { DYN, type IrExpr, type SrcLoc, funcOf } from "../../ir/ir.js";
+import { unsupportedDiag } from "../../diagnostics/diagnostic.js";
+import type { Lowerer } from "./lowerer.js";
+
+export function builtinFunctionFenceValue(
+  lowerer: Lowerer,
+  bi: { module: string; member: string },
+  node: ts.Identifier,
+  loc: SrcLoc,
+): IrExpr {
+  const display = `${bi.module}.${bi.member}`;
+  const name = `%builtin.fence.${display}`;
+  if (!lowerer.liftedFns.some((fn) => fn.name === name)) {
+    const diag = unsupportedDiag(
+      "SC1090",
+      loc,
+      `library functions as values ('${display}' has no function-value lowering; call it directly)`,
+    );
+    lowerer.runtimeFences.push(diag);
+    const line = ts.getLineAndCharacterOfPosition(node.getSourceFile(), loc.start).line + 1;
+    lowerer.liftedFns.push({
+      name,
+      params: [],
+      locals: [],
+      returnType: DYN,
+      body: [
+        {
+          kind: "runtimeFence",
+          code: diag.code,
+          message: `${diag.message} [${diag.code} at ${loc.file}:${line}]`,
+          loc,
+        },
+      ],
+      loc,
+    });
+  }
+  return {
+    kind: "dynFrom",
+    value: { kind: "closure", fnName: name, captures: [], type: funcOf([], DYN), loc },
+    fnName: bi.member,
+    type: DYN,
+    loc,
+  };
+}
diff --git a/packages/compiler/src/frontend/lowering/builtins/async-context.ts b/packages/compiler/src/frontend/lowering/builtins/async-context.ts
index 708284be1..e6de99b09 100644
--- a/packages/compiler/src/frontend/lowering/builtins/async-context.ts
+++ b/packages/compiler/src/frontend/lowering/builtins/async-context.ts
@@ -34,7 +34,7 @@ export function lowerDiagnosticsSubscriber(lowerer: Lowerer, node: ts.Expression
   // has no other first-class story.
   if (ts.isIdentifier(node) && node.text === "setImmediate") {
     const sym = lowerer.checker.getSymbolAtLocation(node);
-    const decls = sym ? lowerer.checker.declarationsOf(sym) : [];
+    const decls = sym ? sym.declarations : [];
     if (decls.length > 0 && decls.every((d) => lowerer.isStdlibFile(d.getSourceFile()))) {
       return {
         kind: "libCall",
diff --git a/packages/compiler/src/frontend/lowering/builtins/class-values.ts b/packages/compiler/src/frontend/lowering/builtins/class-values.ts
index 5e4db921c..416217716 100644
--- a/packages/compiler/src/frontend/lowering/builtins/class-values.ts
+++ b/packages/compiler/src/frontend/lowering/builtins/class-values.ts
@@ -93,7 +93,7 @@ export function builtinClassAliasOwnsNoSlot(lowerer: Lowerer, symbol: ts.Symbol)
   if (builtinClassAliasOf(lowerer, symbol) === null) return false;
   const binding =
     symbol.flags & ts.SymbolFlags.Alias ? lowerer.checker.getAliasedSymbol(symbol) : symbol;
-  const decl = lowerer.checker.valueDeclarationOf(binding);
+  const decl = binding.valueDeclaration;
   if (decl === undefined || !ts.isVariableDeclaration(decl)) return false;
   if (builtinMemberRequireDecl(decl.name, decl.initializer)) return false;
   if (streamClassAliasDecl(lowerer, decl.name, decl.initializer)) return false;
@@ -189,7 +189,7 @@ export function sameBuiltinClass(a: BuiltinClassRef, b: BuiltinClassRef): boolea
  * can name a class (an identifier or a property access), or null. */
 function constInitializerOf(lowerer: Lowerer, symbol: ts.Symbol): ts.Expression | null {
   if ((symbol.flags & ts.SymbolFlags.BlockScopedVariable) === 0) return null;
-  const decl = lowerer.checker.valueDeclarationOf(symbol);
+  const decl = symbol.valueDeclaration;
   if (
     decl === undefined ||
     !ts.isVariableDeclaration(decl) ||
diff --git a/packages/compiler/src/frontend/lowering/builtins/compression.ts b/packages/compiler/src/frontend/lowering/builtins/compression.ts
index 0cd25cde6..e69011522 100644
--- a/packages/compiler/src/frontend/lowering/builtins/compression.ts
+++ b/packages/compiler/src/frontend/lowering/builtins/compression.ts
@@ -138,9 +138,7 @@ export function zlibStreamModeOf(
     symbol.flags & ts.SymbolFlags.Alias ? lowerer.checker.getAliasedSymbol(symbol) : symbol;
   const mode = ZLIB_STREAM_MODES.get(target.name);
   if (mode === undefined) return null;
-  return lowerer.checker
-    .declarationsOf(target)
-    .some((d) => ts.isClassDeclaration(d) && isZlibFallbackDecl(lowerer, d))
+  return target.declarations.some((d) => ts.isClassDeclaration(d) && isZlibFallbackDecl(lowerer, d))
     ? mode
     : null;
 }
@@ -161,15 +159,13 @@ function isZlibFallbackDecl(lowerer: Lowerer, d: ts.Node): boolean {
 export function isZlibStreamMember(lowerer: Lowerer, access: ts.PropertyAccessExpression): boolean {
   const symbol = lowerer.checker.getSymbolAtLocation(access.name);
   if (!symbol) return false;
-  return lowerer.checker
-    .declarationsOf(symbol)
-    .some(
-      (d) =>
-        d.parent !== undefined &&
-        ts.isClassDeclaration(d.parent) &&
-        d.parent.name?.text === "ZlibBase" &&
-        isZlibFallbackDecl(lowerer, d.parent),
-    );
+  return symbol.declarations.some(
+    (d) =>
+      d.parent !== undefined &&
+      ts.isClassDeclaration(d.parent) &&
+      d.parent.name?.text === "ZlibBase" &&
+      isZlibFallbackDecl(lowerer, d.parent),
+  );
 }
 
 /** `stream.bytesWritten` on a zlib stream. */
diff --git a/packages/compiler/src/frontend/lowering/builtins/constants.ts b/packages/compiler/src/frontend/lowering/builtins/constants.ts
index dd9fcf987..611805d94 100644
--- a/packages/compiler/src/frontend/lowering/builtins/constants.ts
+++ b/packages/compiler/src/frontend/lowering/builtins/constants.ts
@@ -1,11 +1,11 @@
 import * as ts from "../../ts7/adapter.js";
 import { type Lowerer, own } from "../lowerer.js";
-import { canonicalBuiltinModule, locOf, requireSpecOf } from "../../program.js";
+import { canonicalBuiltinModule, isJsSourceFile, locOf, requireSpecOf } from "../../program.js";
 import { builtinConstLit } from "../surfaces.js";
 import { HTTP2_CONSTANTS } from "../http2-constants.js";
 import { CRYPTO_CONSTANTS } from "../crypto-tables.js";
 import { ZLIB_CONSTANTS } from "../zlib-constants.js";
-import { F64, type IrExpr } from "../../../ir/ir.js";
+import { DYN, F64, type IrExpr, STRING, type SrcLoc } from "../../../ir/ir.js";
 import { builtinImportOf } from "./module-bindings.js";
 
 /** The builtin modules whose `constants` object bakes as literals at
@@ -106,7 +106,7 @@ export function builtinConstantsDestructureDecl(
  * its baked literal value. Null for every other binding. */
 export function builtinConstantBindingOf(lowerer: Lowerer, ident: ts.Identifier): IrExpr | null {
   const symbol = lowerer.checker.getSymbolAtLocation(ident);
-  const decl = symbol ? lowerer.checker.declarationsOf(symbol)[0] : undefined;
+  const decl = symbol ? symbol.declarations[0] : undefined;
   if (!decl || !ts.isBindingElement(decl) || decl.dotDotDotToken || decl.initializer) return null;
   if (!ts.isObjectBindingPattern(decl.parent)) return null;
   const varDecl = decl.parent.parent;
@@ -147,12 +147,30 @@ export function lowerFsConstantsProperty(
     COPYFILE_FICLONE_FORCE: 4,
   };
   const value = own(MODES, expr.name.text);
-  if (value === undefined) {
-    lowerer.noLowering(
-      `fs.constants.${expr.name.text}`,
-      expr,
-      "F_OK, R_OK, W_OK, X_OK, and COPYFILE_* are the lowered constants",
-    );
-  }
+  if (value === undefined) return fsConstantMemberRead(expr);
   return { kind: "numLit", value, type: F64, loc: locOf(expr) };
 }
+
+/** fs.constants as a value: the target's null-prototype constants object,
+ * built by the runtime from its own libc's macros. */
+export function fsConstantsObject(loc: SrcLoc): IrExpr {
+  return { kind: "libCall", fn: "fs.constants", args: [], type: DYN, loc };
+}
+
+/** `fs.constants.O_RDONLY` (any member the access-mode literals do not
+ * cover): a read of the runtime object, so a constant the target lacks
+ * reads as undefined in JavaScript and fails the number check in
+ * TypeScript, whose declarations promise every name. */
+export function fsConstantMemberRead(expr: ts.PropertyAccessExpression): IrExpr {
+  const loc = locOf(expr);
+  const read: IrExpr = {
+    kind: "dynKeyGet",
+    value: fsConstantsObject(loc),
+    key: { kind: "strLit", value: expr.name.text, type: STRING, loc },
+    type: DYN,
+    loc,
+  };
+  return isJsSourceFile(expr.getSourceFile())
+    ? read
+    : { kind: "dynCheck", value: read, type: F64, loc };
+}
diff --git a/packages/compiler/src/frontend/lowering/builtins/crypto.ts b/packages/compiler/src/frontend/lowering/builtins/crypto.ts
index 575748ef6..cd490bc87 100644
--- a/packages/compiler/src/frontend/lowering/builtins/crypto.ts
+++ b/packages/compiler/src/frontend/lowering/builtins/crypto.ts
@@ -263,6 +263,7 @@ export function lowerCryptoModuleCall(
   if (args.some(ts.isSpreadElement)) {
     lowerer.noLowering(`crypto.${bi.member} with spread arguments`, expr);
   }
+  if (bi.member === "getRandomValues") return lowerCryptoGetRandomValues(lowerer, expr);
   if (bi.member === "randomBytes") {
     if (args.length === 1) return null;
     if (args.length !== 2) {
@@ -878,7 +879,7 @@ export function isCipherType(lowerer: Lowerer, type: ts.Type): boolean {
   return (
     !!symbol &&
     CIPHER_TYPE_NAMES.has(symbol.name) &&
-    lowerer.checker.declarationsOf(symbol).some((d) => lowerer.isStdlibFile(d.getSourceFile()))
+    symbol.declarations.some((d) => lowerer.isStdlibFile(d.getSourceFile()))
   );
 }
 
@@ -1284,3 +1285,49 @@ export function lowerPromisifiedCryptoCall(
     "KeyObject",
   );
 }
+
+/** `crypto.getRandomValues(view)` — the WebCrypto global, node:crypto's
+ * export and `webcrypto.getRandomValues`: a typed view fills in place and
+ * returns itself at its own type (float views, DataViews and views over
+ * 65536 bytes throw Node's DOMExceptions at run time); any other value
+ * takes the checked form. Null for other arities (the member fence keeps
+ * them). */
+export function lowerCryptoGetRandomValues(
+  lowerer: Lowerer,
+  call: ts.CallExpression,
+): IrExpr | null {
+  if (call.arguments.nodes.length !== 1 || ts.isSpreadElement(call.arguments.nodes[0]!))
+    return null;
+  const loc = locOf(call);
+  const value = lowerer.lowerExpr(call.arguments.nodes[0]!);
+  if (value.type.kind === "bytes")
+    return { kind: "libCall", fn: "crypto.getRandomValues", args: [value], type: value.type, loc };
+  return {
+    kind: "libCall",
+    fn: "crypto.getRandomValuesDyn",
+    args: [lowerer.coerceInto(call.arguments.nodes[0]!, value, DYN)],
+    type: DYN,
+    loc,
+  };
+}
+
+/** Whether `receiver` names a WebCrypto Crypto object: the `crypto`
+ * global (also through globalThis) or node:crypto's `webcrypto`. */
+export function isWebCryptoReceiver(lowerer: Lowerer, receiver: ts.Expression): boolean {
+  if (ts.isIdentifier(receiver)) {
+    if (receiver.text === "crypto" && lowerer.isStdlibGlobal(receiver, "crypto")) return true;
+    const imported = lowerer.builtinImportOf(receiver);
+    return imported?.module === "crypto" && imported.member === "webcrypto";
+  }
+  if (ts.isPropertyAccessExpression(receiver) && !receiver.questionDotToken) {
+    if (
+      receiver.name.text === "crypto" &&
+      ts.isIdentifier(receiver.expression) &&
+      lowerer.isStdlibGlobal(receiver.expression, "globalThis")
+    )
+      return true;
+    const member = lowerer.builtinMemberOf(receiver);
+    return member?.module === "crypto" && member.member === "webcrypto";
+  }
+  return false;
+}
diff --git a/packages/compiler/src/frontend/lowering/builtins/errors.ts b/packages/compiler/src/frontend/lowering/builtins/errors.ts
index 1572aa6ab..0313cdd10 100644
--- a/packages/compiler/src/frontend/lowering/builtins/errors.ts
+++ b/packages/compiler/src/frontend/lowering/builtins/errors.ts
@@ -19,9 +19,9 @@ export function isExecExceptionType(lowerer: Lowerer, t: ts.Type): boolean {
   const sym = t.getSymbol();
   return (
     sym?.name === "ExecException" &&
-    lowerer.checker
-      .declarationsOf(sym)
-      .some((d) => ts.isInterfaceDeclaration(d) && lowerer.isStdlibFile(d.getSourceFile()))
+    sym.declarations.some(
+      (d) => ts.isInterfaceDeclaration(d) && lowerer.isStdlibFile(d.getSourceFile()),
+    )
   );
 }
 
diff --git a/packages/compiler/src/frontend/lowering/builtins/fs-streams.ts b/packages/compiler/src/frontend/lowering/builtins/fs-streams.ts
index 58ad82358..22e524690 100644
--- a/packages/compiler/src/frontend/lowering/builtins/fs-streams.ts
+++ b/packages/compiler/src/frontend/lowering/builtins/fs-streams.ts
@@ -34,15 +34,13 @@ function isFsFallbackDecl(lowerer: Lowerer, d: ts.Node): boolean {
 export function isFsStreamMember(lowerer: Lowerer, access: ts.PropertyAccessExpression): boolean {
   const symbol = lowerer.checker.getSymbolAtLocation(access.name);
   if (!symbol) return false;
-  return lowerer.checker
-    .declarationsOf(symbol)
-    .some(
-      (d) =>
-        d.parent !== undefined &&
-        ts.isClassDeclaration(d.parent) &&
-        (d.parent.name?.text === "ReadStream" || d.parent.name?.text === "WriteStream") &&
-        isFsFallbackDecl(lowerer, d.parent),
-    );
+  return symbol.declarations.some(
+    (d) =>
+      d.parent !== undefined &&
+      ts.isClassDeclaration(d.parent) &&
+      (d.parent.name?.text === "ReadStream" || d.parent.name?.text === "WriteStream") &&
+      isFsFallbackDecl(lowerer, d.parent),
+  );
 }
 
 /** bytesRead / bytesWritten / pending / path reads. Null for other
@@ -156,9 +154,9 @@ export function fsStreamClassOf(
   symbol: ts.Symbol | null | undefined,
 ): "ReadStream" | "WriteStream" | null {
   if (!symbol || (symbol.name !== "ReadStream" && symbol.name !== "WriteStream")) return null;
-  const declared = lowerer.checker
-    .declarationsOf(symbol)
-    .some((d) => ts.isClassDeclaration(d) && isFsFallbackDecl(lowerer, d));
+  const declared = symbol.declarations.some(
+    (d) => ts.isClassDeclaration(d) && isFsFallbackDecl(lowerer, d),
+  );
   return declared ? symbol.name : null;
 }
 
diff --git a/packages/compiler/src/frontend/lowering/builtins/json.ts b/packages/compiler/src/frontend/lowering/builtins/json.ts
index b89e25f39..b48030ba5 100644
--- a/packages/compiler/src/frontend/lowering/builtins/json.ts
+++ b/packages/compiler/src/frontend/lowering/builtins/json.ts
@@ -504,9 +504,7 @@ function jsonNullishArgument(lowerer: Lowerer, node: ts.Expression): boolean {
   const symbol = lowerer.checker.getSymbolAtLocation(node);
   return (
     symbol !== undefined &&
-    lowerer.checker
-      .declarationsOf(symbol)
-      .every((decl) => lowerer.isStdlibFile(decl.getSourceFile()))
+    symbol.declarations.every((decl) => lowerer.isStdlibFile(decl.getSourceFile()))
   );
 }
 
diff --git a/packages/compiler/src/frontend/lowering/builtins/module-bindings.ts b/packages/compiler/src/frontend/lowering/builtins/module-bindings.ts
index 3a178b126..86d93de2c 100644
--- a/packages/compiler/src/frontend/lowering/builtins/module-bindings.ts
+++ b/packages/compiler/src/frontend/lowering/builtins/module-bindings.ts
@@ -28,7 +28,7 @@ export function builtinImportOf(
     ts.isShorthandPropertyAssignment(ident.parent) && ident.parent.name === ident
       ? lowerer.checker.getShorthandAssignmentValueSymbol(ident.parent)
       : lowerer.checker.getSymbolAtLocation(ident);
-  const decl = symbol ? lowerer.checker.declarationsOf(symbol)[0] : undefined;
+  const decl = symbol ? symbol.declarations[0] : undefined;
   if (!decl) return null;
   // The CommonJS twin of the named import: a destructured require
   // binding (`const { readFileSync } = require("fs")`, renames via
@@ -123,7 +123,7 @@ export function builtinImportOf(
   // keys the same tables under the builtin's own member name.
   if (symbol !== undefined && (symbol.flags & ts.SymbolFlags.Alias) !== 0) {
     const target = lowerer.checker.getAliasedSymbol(symbol);
-    const tdecl = lowerer.checker.declarationsOf(target)[0];
+    const tdecl = target.declarations[0];
     if (tdecl !== undefined && tdecl.getSourceFile().isDeclarationFile) {
       for (
         let p: ts.Node | undefined = tdecl.parent;
@@ -153,7 +153,7 @@ export function esmImportBindingKind(
   ident: ts.Identifier,
 ): "namespace" | "named" | null {
   const symbol = lowerer.checker.getSymbolAtLocation(ident);
-  const decl = symbol ? lowerer.checker.declarationsOf(symbol)[0] : undefined;
+  const decl = symbol ? symbol.declarations[0] : undefined;
   if (decl === undefined) return null;
   if (ts.isNamespaceImport(decl)) return "namespace";
   return ts.isImportSpecifier(decl) ? "named" : null;
@@ -290,7 +290,7 @@ export function createRequireCalleeFileOf(
   }
   if (!ts.isIdentifier(e)) return null;
   const symbol = lowerer.checker.getSymbolAtLocation(e);
-  const decl = symbol ? lowerer.checker.declarationsOf(symbol)[0] : undefined;
+  const decl = symbol ? symbol.declarations[0] : undefined;
   if (!decl || !ts.isVariableDeclaration(decl) || decl.initializer === undefined) return null;
   return createRequireBindingDecl(lowerer, decl.name, decl.initializer)
     ? decl.getSourceFile()
@@ -391,7 +391,7 @@ export function createRequireProgramModuleDecl(
  * binding poison with the same module-naming diagnostic. */
 export function fencedBuiltinImportOf(lowerer: Lowerer, ident: ts.Identifier): string | null {
   const symbol = lowerer.checker.getSymbolAtLocation(ident);
-  const decl = symbol ? lowerer.checker.declarationsOf(symbol)[0] : undefined;
+  const decl = symbol ? symbol.declarations[0] : undefined;
   if (!decl) return null;
   // The CommonJS twins: `const x = require("net")` and
   // `const { createServer } = require("net")` — the require statement
diff --git a/packages/compiler/src/frontend/lowering/builtins/navigator.ts b/packages/compiler/src/frontend/lowering/builtins/navigator.ts
new file mode 100644
index 000000000..637edaf3c
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/builtins/navigator.ts
@@ -0,0 +1,60 @@
+/* Node 24's `navigator` global (lib/internal/navigator.js), the part
+ * libraries read to tell runtimes apart: `typeof navigator` is "object"
+ * and `navigator.userAgent` is `Node.js/<major>`. jose reads exactly
+ * that at module load (jwks/remote.js). Both fold to string literals, so
+ * nothing links. The other members (hardwareConcurrency, language,
+ * languages, platform, locks) and the object as a value keep a named
+ * refusal. */
+import * as ts from "../../ts7/adapter.js";
+import { strLit } from "../../../ir/build.js";
+import type { IrExpr } from "../../../ir/ir.js";
+import { isJsSourceFile, locOf } from "../../program.js";
+import type { Lowerer } from "../lowerer.js";
+
+/** True when `node` names Node's global `navigator`: the @types/node
+ * declaration, or, in a JavaScript file, the free name no declaration
+ * binds (Node defines it on the global object). */
+export function isNavigatorGlobal(lowerer: Lowerer, node: ts.Expression): boolean {
+  let expr = node;
+  while (ts.isParenthesizedExpression(expr)) expr = expr.expression;
+  if (!ts.isIdentifier(expr) || expr.text !== "navigator") return false;
+  if (lowerer.isStdlibGlobal(expr, "navigator")) return true;
+  return (
+    isJsSourceFile(expr.getSourceFile()) && lowerer.checker.getSymbolAtLocation(expr) === undefined
+  );
+}
+
+/** `navigator.userAgent` (`Node.js/<major>` of `nodeVersion`, the pinned
+ * release builtins/process.ts names), or the named refusal for another
+ * member. Null when the receiver is not the global. */
+export function lowerNavigatorMember(
+  lowerer: Lowerer,
+  access: ts.PropertyAccessExpression,
+  nodeVersion: string,
+): IrExpr | null {
+  if (!isNavigatorGlobal(lowerer, access.expression)) return null;
+  if (access.name.text === "userAgent") {
+    return strLit(`Node.js/${nodeVersion.split(".")[0]}`, locOf(access));
+  }
+  return refuseNavigator(
+    lowerer,
+    access,
+    `navigator.${access.name.text}`,
+    lowerer.checker.getSymbolAtLocation(access.name),
+  );
+}
+
+/** The refusal for the `navigator` object itself or an unlowered member. */
+export function refuseNavigator(
+  lowerer: Lowerer,
+  node: ts.Node,
+  what: string,
+  symbol?: ts.Symbol,
+): never {
+  return lowerer.noLowering(
+    what,
+    node,
+    "of Node's navigator global only typeof navigator and navigator.userAgent compile",
+    symbol ?? null,
+  );
+}
diff --git a/packages/compiler/src/frontend/lowering/builtins/process.ts b/packages/compiler/src/frontend/lowering/builtins/process.ts
index e4e5004c1..555eaf84f 100644
--- a/packages/compiler/src/frontend/lowering/builtins/process.ts
+++ b/packages/compiler/src/frontend/lowering/builtins/process.ts
@@ -26,6 +26,7 @@ import {
   funcOf,
 } from "../../../ir/ir.js";
 import { lowerBuiltinLoaderValue } from "../lower-builtin-values.js";
+import { canonicalBuiltinModule } from "../../builtin-modules.js";
 import { lowerProcessIpcSend, ipcMessageListener, ipcDisconnectListener } from "./ipc.js";
 import { lowerDiagnosticsSubscriber, lowerTracingArguments } from "./async-context.js";
 
@@ -148,6 +149,18 @@ export function lowerProcessStreamProperty(
         loc: locOf(expr),
       };
   }
+  // `if (process.stdin.setRawMode)`: Node's stdin has the method only
+  // when it is a TTY. The runtime's stream object answers the same
+  // presence (the method or undefined); calls keep their direct lowering.
+  if (direct === "stdin" && member === "setRawMode") {
+    return {
+      kind: "dynKeyGet",
+      value: lowerer.lowerExpr(expr.expression),
+      key: strLit(member, locOf(expr.name)),
+      type: DYN,
+      loc: locOf(expr),
+    };
+  }
   if (member !== "isTTY" && member !== "columns" && member !== "rows") return null;
   let recv: ts.Expression = expr.expression;
   while (ts.isParenthesizedExpression(recv) || ts.isAsExpression(recv) || ts.isTypeAssertion(recv))
@@ -364,6 +377,11 @@ export function lowerProcessProperty(
   if (member === "versions") {
     return { kind: "libCall", fn: "process.versions", args: [], type: DYN, loc };
   }
+  // process.features as a value (`"sea" in process.features`): an object
+  // holding none of the flags, consistent with the member reads above.
+  if (member === "features") {
+    return { kind: "dynObjLit", type: DYN, loc };
+  }
   // process.noDeprecation / process.throwDeprecation: the values the
   // program assigned (undefined before that — no Node flags reach a
   // compiled binary).
@@ -627,6 +645,73 @@ export function lowerProcessMethodCall(
     }
     return { kind: "libCall", fn: "process.stdinSetRawMode", args: [mode], type: VOID, loc };
   }
+  // process.stdout.on("resize", cb) (and once/off/removeListener/
+  // addListener, stderr too): the terminal resize event, registered on the
+  // runtime's process stream object (a SIGWINCH listener that emits when a
+  // TTY's size changed; it never keeps the loop alive). Statement position:
+  // Node returns the stream.
+  if (
+    ["on", "once", "off", "removeListener", "addListener"].includes(access.name.text) &&
+    ts.isPropertyAccessExpression(access.expression) &&
+    call.arguments.nodes.length === 2 &&
+    !call.arguments.nodes.some(ts.isSpreadElement) &&
+    ts.isExpressionStatement(call.parent)
+  ) {
+    const stream = lowerer.stdlibGlobalMember(access.expression, "process");
+    const evT = lowerer.typeOf(call.arguments.nodes[0]!);
+    if (
+      (stream === "stdout" || stream === "stderr") &&
+      evT.isStringLiteralType() &&
+      evT.value === "resize"
+    ) {
+      const loc = locOf(call);
+      const receiverLocal = lowerer.declareHiddenLocal("%stdioReceiver", DYN);
+      const receiver = varRef(receiverLocal.id, DYN, loc);
+      const method =
+        access.name.text === "off"
+          ? "removeListener"
+          : access.name.text === "addListener"
+            ? "on"
+            : access.name.text;
+      return {
+        kind: "seqExpr",
+        stmts: [
+          {
+            kind: "varDecl",
+            localId: receiverLocal.id,
+            init: {
+              kind: "libCall",
+              fn: "process.stdio",
+              args: [numLit(stream === "stdout" ? 1 : 2, loc)],
+              type: DYN,
+              loc,
+            },
+            loc,
+          },
+        ],
+        result: {
+          kind: "dynCall",
+          callee: {
+            kind: "dynKeyGet",
+            value: receiver,
+            key: strLit(method, locOf(access.name)),
+            type: DYN,
+            loc,
+          },
+          receiver,
+          calleeName: access.getText(),
+          args: [
+            lowerer.lowerExprExpecting(call.arguments.nodes[0]!, DYN),
+            lowerer.lowerExprExpecting(call.arguments.nodes[1]!, DYN),
+          ],
+          type: DYN,
+          loc,
+        },
+        type: DYN,
+        loc,
+      };
+    }
+  }
   // process.stdin.on/once("data" | "end" | "error", cb): the piped-stdin
   // event slice. A 'data' listener keeps the event loop alive until EOF
   // (Node's flowing stdin); 'end'/'error' listeners alone do not. `once`
@@ -678,11 +763,18 @@ export function lowerProcessMethodCall(
     const param = cb.type.params[0];
     const onceArg: IrExpr = { kind: "boolLit", value: once, type: BOOL, loc };
     if (event === "data") {
-      if (param !== undefined && !(param.kind === "bytes" && param.elem === "u8")) {
+      // A string parameter receives the chunks process.stdin.setEncoding
+      // decodes (pi-tui's terminal input); the runtime refuses a delivery
+      // while no encoding is set, where Node would pass a Buffer.
+      if (
+        param !== undefined &&
+        !(param.kind === "bytes" && param.elem === "u8") &&
+        param.kind !== "string"
+      ) {
         lowerer.unsupported(
           "SC1090",
           call.arguments.nodes[1]!,
-          `data listeners whose parameter is not 'Uint8Array' (got '${lowerer.fmt(param)}')`,
+          `data listeners whose parameter is not 'Uint8Array' or 'string' (got '${lowerer.fmt(param)}')`,
         );
       }
       return { kind: "libCall", fn: "stdin.onData", args: [cb, onceArg], type: VOID, loc };
@@ -1537,3 +1629,36 @@ function processCredentialCall(member: string, loc: SrcLoc): IrExpr {
     loc,
   };
 }
+
+/** `process.getBuiltinModule("node:os")`: a string-literal id naming a
+ * supported builtin whose call the checker types as that module's
+ * namespace (@types/node's BuiltInModule map) answers the namespace value
+ * `import * as ns` binds, so its members key the builtin tables at their
+ * use sites. The receiver may be cast (`(process as P)`) and the call
+ * optional: Node 24's process always has the member, and the cast changes
+ * no runtime value. Other ids keep the dynamic loader (undefined for
+ * unknown ids, Node's argument errors). */
+export function lowerProcessBuiltinModuleNamespace(
+  lowerer: Lowerer,
+  call: ts.CallExpression,
+): IrExpr | null {
+  const callee = call.expression;
+  if (!ts.isPropertyAccessExpression(callee) || callee.name.text !== "getBuiltinModule")
+    return null;
+  const id = call.arguments.nodes[0];
+  if (call.arguments.nodes.length !== 1 || !id || !ts.isStringLiteralLike(id)) return null;
+  let receiver: ts.Expression = callee.expression;
+  while (
+    ts.isParenthesizedExpression(receiver) ||
+    ts.isAsExpression(receiver) ||
+    ts.isSatisfiesExpression(receiver) ||
+    ts.isNonNullExpression(receiver)
+  )
+    receiver = receiver.expression;
+  if (!lowerer.isStdlibGlobal(receiver, "process")) return null;
+  const module = canonicalBuiltinModule(id.text);
+  if (module === null) return null;
+  const type = lowerer.mapTypeOf(lowerer.checker.getNonNullableType(lowerer.typeOf(call)));
+  if (type?.kind !== "moduleNs" || type.moduleId !== `builtin:${module}`) return null;
+  return { kind: "moduleNsRef", moduleId: type.moduleId, type, loc: locOf(call) };
+}
diff --git a/packages/compiler/src/frontend/lowering/builtins/readline.ts b/packages/compiler/src/frontend/lowering/builtins/readline.ts
index 830e6823d..bcf77a39b 100644
--- a/packages/compiler/src/frontend/lowering/builtins/readline.ts
+++ b/packages/compiler/src/frontend/lowering/builtins/readline.ts
@@ -47,7 +47,7 @@ export function isReadlineTyped(lowerer: Lowerer, node: ts.Expression): boolean
   const t = lowerer.checker.getTypeAtLocation(node);
   const sym = t.getAliasSymbol() ?? t.getSymbol();
   if (sym?.name !== "Interface") return false;
-  return lowerer.checker.declarationsOf(sym).some((d) => {
+  return sym.declarations.some((d) => {
     if (!ts.isClassDeclaration(d) && !ts.isInterfaceDeclaration(d)) return false;
     if (!lowerer.isStdlibFile(d.getSourceFile())) return false;
     return isReadlineModule(ambientModuleOf(d));
@@ -108,7 +108,7 @@ function isReadlineUiTyped(lowerer: Lowerer, node: ts.Expression): boolean {
   const t = lowerer.checker.getTypeAtLocation(node);
   const sym = t.getAliasSymbol() ?? t.getSymbol();
   if (sym?.name !== "Readline") return false;
-  return lowerer.checker.declarationsOf(sym).some((d) => {
+  return sym.declarations.some((d) => {
     if (!ts.isClassDeclaration(d) && !ts.isInterfaceDeclaration(d)) return false;
     if (!lowerer.isStdlibFile(d.getSourceFile())) return false;
     const spec = ambientModuleOf(d);
diff --git a/packages/compiler/src/frontend/lowering/builtins/receiver-types.ts b/packages/compiler/src/frontend/lowering/builtins/receiver-types.ts
index b90eb4844..fc507e2bd 100644
--- a/packages/compiler/src/frontend/lowering/builtins/receiver-types.ts
+++ b/packages/compiler/src/frontend/lowering/builtins/receiver-types.ts
@@ -11,11 +11,9 @@ export function isBuiltinClassInstance(
   const type = lowerer.checker.getTypeAtLocation(node);
   const symbol = type.getAliasSymbol() ?? type.getSymbol();
   if (symbol?.name !== name) return false;
-  return lowerer.checker
-    .declarationsOf(symbol)
-    .some(
-      (declaration) =>
-        (ts.isClassDeclaration(declaration) || ts.isInterfaceDeclaration(declaration)) &&
-        lowerer.isStdlibFile(declaration.getSourceFile()),
-    );
+  return symbol.declarations.some(
+    (declaration) =>
+      (ts.isClassDeclaration(declaration) || ts.isInterfaceDeclaration(declaration)) &&
+      lowerer.isStdlibFile(declaration.getSourceFile()),
+  );
 }
diff --git a/packages/compiler/src/frontend/lowering/builtins/strings.ts b/packages/compiler/src/frontend/lowering/builtins/strings.ts
index 013cd3fda..54ab22c05 100644
--- a/packages/compiler/src/frontend/lowering/builtins/strings.ts
+++ b/packages/compiler/src/frontend/lowering/builtins/strings.ts
@@ -4,7 +4,19 @@ import { type Lowerer } from "../lowerer.js";
 import { locOf } from "../../program.js";
 import { lowerOptionalArgument, lowerStringSearchArgument } from "../optional-arguments.js";
 import { lowerToNumberArgument } from "../lower-exprs.js";
-import { F64, type IrExpr, STRING, arrayOf, isUnitType, typeEquals } from "../../../ir/ir.js";
+import {
+  BOOL,
+  DYN,
+  F64,
+  type IrExpr,
+  type IrStmt,
+  NULL_T,
+  STRING,
+  arrayOf,
+  bytesOf,
+  isUnitType,
+  typeEquals,
+} from "../../../ir/ir.js";
 
 /** `String.fromCharCode/fromCodePoint(...codes)` on THE String global: every argument
  * lowers as a number and packs into ONE f64[] array-literal argument
@@ -17,6 +29,8 @@ export function lowerStringStaticCall(
   access: ts.PropertyAccessExpression,
 ): IrExpr | null {
   if (call.questionDotToken) return null;
+  const applied = lowerFromCharCodeApply(lowerer, call, access);
+  if (applied) return applied;
   const member = lowerer.stdlibGlobalMember(access, "String");
   if (member !== "fromCharCode" && member !== "fromCodePoint" && member !== "raw") return null;
   const loc = locOf(call);
@@ -108,6 +122,99 @@ export function lowerStringStaticCall(
   return { kind: "libCall", fn: `string.${member}`, args: [packed], type: STRING, loc };
 }
 
+/** `String.fromCharCode.apply(thisArg, codes)`, the btoa chunking idiom
+ * (`String.fromCharCode.apply(null, bytes.subarray(i, j))`): the receiver
+ * is ignored, and a typed array or number array forwards to the packed
+ * fromCharCode like a spread. An untyped list reads a Uint8Array the same
+ * way at run time; any other value keeps Function.prototype.apply's
+ * generic array-like call. Null for every other call. */
+function lowerFromCharCodeApply(
+  lowerer: Lowerer,
+  call: ts.CallExpression,
+  access: ts.PropertyAccessExpression,
+): IrExpr | null {
+  if (access.name.text !== "apply" || access.questionDotToken) return null;
+  const target = access.expression;
+  if (
+    !ts.isPropertyAccessExpression(target) ||
+    lowerer.stdlibGlobalMember(target, "String") !== "fromCharCode"
+  ) {
+    return null;
+  }
+  if (call.arguments.nodes.length !== 2 || call.arguments.nodes.some(ts.isSpreadElement))
+    return null;
+  const listNode = call.arguments.nodes[1]!;
+  const checkerT = lowerer.typeOf(listNode);
+  const untyped = (checkerT.flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !== 0;
+  const listT = untyped ? DYN : lowerer.mapTypeOf(checkerT);
+  if (
+    listT === null ||
+    (listT.kind !== "bytes" && listT.kind !== "dyn" && !typeEquals(listT, arrayOf(F64)))
+  ) {
+    return null;
+  }
+  const loc = locOf(call);
+  const thisArg = lowerer.lowerExprExpecting(call.arguments.nodes[0]!, DYN);
+  const stmts: IrStmt[] = [{ kind: "exprStmt", expr: thisArg, loc: thisArg.loc }];
+  if (listT.kind !== "dyn") {
+    const list = lowerer.lowerExprExpecting(listNode, listT);
+    const result: IrExpr = {
+      kind: "libCall",
+      fn: "string.fromCharCode",
+      args: [list],
+      type: STRING,
+      loc,
+    };
+    return { kind: "seqExpr", stmts, result, type: STRING, loc };
+  }
+  const listLocal = lowerer.declareHiddenLocal("%charCodes", DYN);
+  stmts.push({
+    kind: "varDecl",
+    localId: listLocal.id,
+    init: lowerer.lowerExprExpecting(listNode, DYN),
+    loc,
+  });
+  const list = (): IrExpr => ({ kind: "varRef", localId: listLocal.id, type: DYN, loc });
+  const bytes = bytesOf("u8");
+  const generic: IrExpr = {
+    kind: "dynCheck",
+    value: {
+      kind: "dynInvoke",
+      recv: lowerer.lowerExprExpecting(target, DYN),
+      method: "apply",
+      calleeName: "String.fromCharCode.apply",
+      args: [
+        {
+          kind: "dynFrom",
+          value: { kind: "unitLit", unit: "null", type: NULL_T, loc },
+          type: DYN,
+          loc,
+        },
+        list(),
+      ],
+      type: DYN,
+      loc,
+    },
+    type: STRING,
+    loc,
+  };
+  const result: IrExpr = {
+    kind: "ternary",
+    cond: { kind: "dynTest", test: "bytes", bytesElem: "u8", value: list(), type: BOOL, loc },
+    then: {
+      kind: "libCall",
+      fn: "string.fromCharCode",
+      args: [{ kind: "dynCheck", value: list(), type: bytes, loc }],
+      type: STRING,
+      loc,
+    },
+    else_: generic,
+    type: STRING,
+    loc,
+  };
+  return { kind: "seqExpr", stmts, result, type: STRING, loc };
+}
+
 /** `s.lastIndexOf(searchValue?, position?)` on string receivers, using UTF-16
  * indices. An omitted search value searches for "undefined". Omitted or undefined positions clamp to the string's end;
  * MAX_SAFE_INTEGER has the same effect for every representable string.
diff --git a/packages/compiler/src/frontend/lowering/builtins/text-codecs.ts b/packages/compiler/src/frontend/lowering/builtins/text-codecs.ts
index a5f34f44e..e89b1f07e 100644
--- a/packages/compiler/src/frontend/lowering/builtins/text-codecs.ts
+++ b/packages/compiler/src/frontend/lowering/builtins/text-codecs.ts
@@ -361,13 +361,11 @@ export function storedTextCodecClassOf(
 ): TextCodecCtor["cls"] | null {
   const sym = lowerer.typeOf(expr).getSymbol();
   if (!sym || (sym.name !== "TextEncoder" && sym.name !== "TextDecoder")) return null;
-  return lowerer.checker
-    .declarationsOf(sym)
-    .some(
-      (d) =>
-        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-        lowerer.isStdlibFile(d.getSourceFile()),
-    )
+  return sym.declarations.some(
+    (d) =>
+      (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+      lowerer.isStdlibFile(d.getSourceFile()),
+  )
     ? sym.name
     : null;
 }
diff --git a/packages/compiler/src/frontend/lowering/builtins/timers.ts b/packages/compiler/src/frontend/lowering/builtins/timers.ts
index dabfb1d2a..9f950cddc 100644
--- a/packages/compiler/src/frontend/lowering/builtins/timers.ts
+++ b/packages/compiler/src/frontend/lowering/builtins/timers.ts
@@ -155,9 +155,9 @@ function isTimerHandleTyped(
   const t = lowerer.checker.getTypeAtLocation(node);
   const sym = t.getAliasSymbol() ?? t.getSymbol();
   if (sym?.name !== name) return false;
-  return lowerer.checker
-    .declarationsOf(sym)
-    .some((d) => ts.isInterfaceDeclaration(d) && lowerer.isStdlibFile(d.getSourceFile()));
+  return sym.declarations.some(
+    (d) => ts.isInterfaceDeclaration(d) && lowerer.isStdlibFile(d.getSourceFile()),
+  );
 }
 function isTimeoutTyped(lowerer: Lowerer, node: ts.Expression): boolean {
   return isTimerHandleTyped(lowerer, node, "Timeout");
diff --git a/packages/compiler/src/frontend/lowering/builtins/webcrypto.ts b/packages/compiler/src/frontend/lowering/builtins/webcrypto.ts
new file mode 100644
index 000000000..2a9ff9eef
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/builtins/webcrypto.ts
@@ -0,0 +1,130 @@
+import * as ts from "../../ts7/adapter.js";
+import { type Lowerer } from "../lowerer.js";
+import { isJsSourceFile, locOf } from "../../program.js";
+import { BOOL, DYN, type IrExpr, type IrLibFn } from "../../../ir/ir.js";
+import { lowerDynObjectLiteral } from "../expressions/object-literals.js";
+import { stdlibGlobalNameOf } from "../surfaces.js";
+import { WEBCRYPTO_DYN_TYPES } from "../../type-mapper.js";
+
+/* WebCrypto's HMAC slice (scr_webcrypto.c): `crypto.subtle.importKey`,
+ * `sign`, `verify` and `digest` called on the crypto global (also through
+ * globalThis) lower to runtime entry points that take the argument vector
+ * as one dyn array and answer a promise, so Web IDL conversion, algorithm
+ * normalization and every error stay Node-shaped at run time. CryptoKey
+ * values are native handles; their type maps to dyn and their members
+ * are handle reads. Other SubtleCrypto methods are refused by name. */
+
+const SUBTLE_LOWERED: ReadonlyMap<string, IrLibFn> = new Map([
+  ["importKey", "webcrypto.importKey"],
+  ["sign", "webcrypto.sign"],
+  ["verify", "webcrypto.verify"],
+  ["digest", "webcrypto.digest"],
+]);
+
+const SUBTLE_HINT =
+  "the native WebCrypto surface is crypto.subtle.importKey('raw', ...) for HMAC keys, sign and verify with HMAC, and digest with SHA-1, SHA-256, SHA-384 or SHA-512, each called directly on crypto.subtle";
+
+/** Whether `node` is `crypto.subtle` on the WebCrypto global. */
+function isSubtleReceiver(lowerer: Lowerer, node: ts.Expression): boolean {
+  while (ts.isParenthesizedExpression(node)) node = node.expression;
+  return (
+    ts.isPropertyAccessExpression(node) &&
+    !node.questionDotToken &&
+    node.name.text === "subtle" &&
+    stdlibGlobalNameOf(lowerer, node.expression) === "crypto"
+  );
+}
+
+/** `crypto.subtle.<method>(...args)`: the lowered methods become their
+ * libCall over the argument vector; every other method is refused. */
+export function lowerWebCryptoCall(lowerer: Lowerer, call: ts.CallExpression): IrExpr | null {
+  const callee = call.expression;
+  if (!ts.isPropertyAccessExpression(callee) || !isSubtleReceiver(lowerer, callee.expression)) {
+    return null;
+  }
+  const member = callee.name.text;
+  const fn = SUBTLE_LOWERED.get(member);
+  if (fn === undefined) lowerer.noLowering(`crypto.subtle.${member}`, callee, SUBTLE_HINT);
+  if (callee.questionDotToken || call.questionDotToken) {
+    lowerer.noLowering(`optional calls of crypto.subtle.${member}`, call, SUBTLE_HINT);
+  }
+  if (call.arguments.nodes.some(ts.isSpreadElement)) {
+    lowerer.noLowering(`crypto.subtle.${member} with spread arguments`, call, SUBTLE_HINT);
+  }
+  // JsonWebKey imports are not implemented: a literal 'jwk' format is
+  // refused here (the runtime refuses a computed one).
+  const format = call.arguments.nodes[0];
+  if (
+    member === "importKey" &&
+    format !== undefined &&
+    ts.isStringLiteralLike(format) &&
+    format.text === "jwk"
+  ) {
+    lowerer.noLowering("crypto.subtle.importKey with the 'jwk' key format", format, SUBTLE_HINT);
+  }
+  const loc = locOf(call);
+  const args = call.arguments.nodes.map((arg) =>
+    ts.isObjectLiteralExpression(arg)
+      ? lowerDynObjectLiteral(lowerer, arg)
+      : lowerer.lowerExprExpecting(arg, DYN),
+  );
+  return {
+    kind: "libCall",
+    fn,
+    args: [{ kind: "dynArrLit", elems: args, type: DYN, loc }],
+    type: { kind: "promise", inner: member === "verify" ? BOOL : DYN },
+    loc,
+  };
+}
+
+/** `v instanceof CryptoKey` against the global. */
+export function lowerCryptoKeyInstanceof(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+): IrExpr | null {
+  if (stdlibGlobalNameOf(lowerer, expr.right) !== "CryptoKey") return null;
+  const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
+  return {
+    kind: "libCall",
+    fn: "webcrypto.isCryptoKey",
+    args: [value],
+    type: BOOL,
+    loc: locOf(expr),
+  };
+}
+
+/** TypeScript reads of `crypto.subtle` and its members outside a direct
+ * call: the global's dynamic object does not carry the lowered methods,
+ * so a detached read is refused rather than answering a value without
+ * them. JavaScript keeps the dynamic object's reads. */
+export function fenceWebCryptoMember(
+  lowerer: Lowerer,
+  access: ts.PropertyAccessExpression | ts.ElementAccessExpression,
+  use: "read" | "call",
+): IrExpr | null {
+  if (use !== "read" || !ts.isPropertyAccessExpression(access)) return null;
+  if (isJsSourceFile(access.getSourceFile())) return null;
+  if (isSubtleReceiver(lowerer, access)) {
+    lowerer.noLowering("crypto.subtle as a value", access, SUBTLE_HINT);
+  }
+  if (isSubtleReceiver(lowerer, access.expression)) {
+    lowerer.noLowering(`crypto.subtle.${access.name.text} as a value`, access, SUBTLE_HINT);
+  }
+  return null;
+}
+
+/** Whether a checker type is one of the WebCrypto interfaces reached
+ * through the crypto global's members (SubtleCrypto, CryptoKey and the
+ * algorithm dictionaries). While `crypto` was typed `unknown` those member
+ * reads were untyped, so JavaScript destructurings of them keep the
+ * module-global path untyped bindings take. `Crypto` itself is excluded:
+ * the global was `unknown`, which already mapped to dyn. */
+export function isWebCryptoMemberType(lowerer: Lowerer, type: ts.Type): boolean {
+  const symbol = type.getAliasSymbol() ?? type.getSymbol();
+  return (
+    symbol !== undefined &&
+    symbol.name !== "Crypto" &&
+    WEBCRYPTO_DYN_TYPES.has(symbol.name) &&
+    lowerer.isStdlibSymbol(symbol)
+  );
+}
diff --git a/packages/compiler/src/frontend/lowering/builtins/workers.ts b/packages/compiler/src/frontend/lowering/builtins/workers.ts
index aa826cc53..335fdb969 100644
--- a/packages/compiler/src/frontend/lowering/builtins/workers.ts
+++ b/packages/compiler/src/frontend/lowering/builtins/workers.ts
@@ -175,7 +175,7 @@ function isWorkerThreadsClass(lowerer: Lowerer, node: ts.Expression, name: strin
   const t = lowerer.checker.getTypeAtLocation(node);
   const sym = t.getSymbol();
   if (sym?.name !== name) return false;
-  return lowerer.checker.declarationsOf(sym).some((d) => {
+  return sym.declarations.some((d) => {
     if (!ts.isClassDeclaration(d) && !ts.isInterfaceDeclaration(d)) return false;
     if (!lowerer.isStdlibFile(d.getSourceFile())) return false;
     let up: ts.Node | undefined = d.parent;
diff --git a/packages/compiler/src/frontend/lowering/call-signatures.ts b/packages/compiler/src/frontend/lowering/call-signatures.ts
index 9d9c9668c..246cf1de4 100644
--- a/packages/compiler/src/frontend/lowering/call-signatures.ts
+++ b/packages/compiler/src/frontend/lowering/call-signatures.ts
@@ -46,12 +46,15 @@ export type ParamMode = "required" | "omittable" | "rest" | "dynRest" | "argumen
  * otherwise. `bodyType` is present exactly for DEFAULTED program params:
  * the plain T the body sees after the prologue applies the default (see
  * declareParams). `callDefault` is the compile-time default value for a
- * table-backed builtin's omittable slot. */
+ * table-backed builtin's omittable slot. `entryNarrow` marks a dyn ABI slot
+ * inherited from a JavaScript base method whose TypeScript override declares
+ * a typed parameter: the prologue narrows the checked value to that type. */
 export interface ParamShape {
   type: IrType;
   mode: ParamMode;
   bodyType?: IrType;
   callDefault?: IrExpr;
+  entryNarrow?: IrType;
 }
 
 export interface FnSig {
@@ -408,7 +411,15 @@ export function paramShapes(
       return { type: mapped, mode: "rest" };
     }
     if (declParam.initializer) return defaultParameterShape(lowerer, declParam, mapped);
-    if (declParam.questionToken && !lowerer.bareUndefinedArmedUnion(mapped)) {
+    // A checked-value slot holds undefined directly, so an omitted
+    // argument needs no union arm (paramShape's declared-signature rule;
+    // an erased type parameter and a class-implemented interface view
+    // both map here).
+    if (
+      declParam.questionToken &&
+      !lowerer.bareUndefinedArmedUnion(mapped) &&
+      mapped.kind !== "dyn"
+    ) {
       lowerer.unsupported(
         "SC1090",
         declParam,
@@ -732,7 +743,11 @@ function appendArgumentsParameter(
     const classMethod =
       ts.isMethodDeclaration(node) &&
       (ts.isClassDeclaration(node.parent) || ts.isClassExpression(node.parent));
-    if (!classMethod && !isNodeEsmFile(node.getSourceFile(), lowerer.program)) {
+    if (
+      !classMethod &&
+      !isNodeEsmFile(node.getSourceFile(), lowerer.program) &&
+      !unmappedArguments(node)
+    ) {
       lowerer.unsupported(
         "SC1090",
         node,
@@ -743,6 +758,35 @@ function appendArgumentsParameter(
   shapes.push({ type: DYN, mode });
 }
 
+/** Whether `arguments` inside `node` is Node's unmapped object: strict code
+ * (a 'use strict' prologue on the file or an enclosing function, or a class
+ * body) or a non-simple parameter list (defaults, rest, destructuring). Its
+ * elements then never alias the parameters, which is the ES module case. */
+function unmappedArguments(node: ts.SignatureDeclaration): boolean {
+  if (
+    node.parameters.nodes.some(
+      (p) =>
+        p.initializer !== undefined || p.dotDotDotToken !== undefined || !ts.isIdentifier(p.name),
+    )
+  )
+    return true;
+  const useStrict = (statements: readonly ts.Statement[]): boolean => {
+    for (const statement of statements) {
+      if (!ts.isExpressionStatement(statement) || !ts.isStringLiteral(statement.expression))
+        return false;
+      if (statement.expression.text === "use strict") return true;
+    }
+    return false;
+  };
+  for (let n: ts.Node | undefined = node; n; n = n.parent) {
+    if (ts.isClassDeclaration(n) || ts.isClassExpression(n)) return true;
+    if (ts.isFunctionLike(n) && n.body && ts.isBlock(n.body) && useStrict(n.body.statements.nodes))
+      return true;
+    if (ts.isSourceFile(n)) return useStrict(n.statements.nodes);
+  }
+  return false;
+}
+
 /** Signature checks + param shapes + IR func type for any lambda-like
  * node. The func type's params are the ABI types: optional/default params
  * become `T | undefined`, and typed rest becomes one packed-array slot.
@@ -878,8 +922,7 @@ export function lambdaSignature(
     const ctxSigs = ctxType
       ? lowerer.checker.getCallSignatures(lowerer.checker.getNonNullableType(ctxType))
       : [];
-    const ctxDecl =
-      ctxSigs.length === 1 ? lowerer.checker.signatureDeclaration(ctxSigs[0]!) : undefined;
+    const ctxDecl = ctxSigs.length === 1 ? ctxSigs[0]!.declaration : undefined;
     const ctxRetRaw =
       ctxDecl && !ctxDecl.getSourceFile().isDeclarationFile
         ? lowerer.mapTypeOf(lowerer.checker.getReturnTypeOfSignature(ctxSigs[0]!))
diff --git a/packages/compiler/src/frontend/lowering/cjs-exports-object.ts b/packages/compiler/src/frontend/lowering/cjs-exports-object.ts
index 0fb5aadd3..5ea4001fc 100644
--- a/packages/compiler/src/frontend/lowering/cjs-exports-object.ts
+++ b/packages/compiler/src/frontend/lowering/cjs-exports-object.ts
@@ -37,7 +37,7 @@ export function isCjsExportsIdentifier(lowerer: Lowerer, node: ts.Expression): b
   if (!ts.isIdentifier(node) || node.text !== "exports") return false;
   if (!isCjsJsFile(node.getSourceFile(), lowerer.program)) return false;
   const symbol = lowerer.checker.getSymbolAtLocation(node);
-  const decls = symbol ? lowerer.checker.declarationsOf(symbol) : [];
+  const decls = symbol ? symbol.declarations : [];
   return !decls.some(
     (d) =>
       !d.getSourceFile().isDeclarationFile &&
@@ -349,7 +349,7 @@ function functionUsesThis(fn: ts.FunctionLikeDeclaration): boolean {
 /** A function declaration, or a variable initialized with a function or
  * arrow expression, that never reads `this`. */
 function symbolIsThisFreeFunction(lowerer: Lowerer, sym: ts.Symbol | undefined): boolean {
-  const decls = sym ? lowerer.checker.declarationsOf(sym) : [];
+  const decls = sym ? sym.declarations : [];
   const fn = decls.find(ts.isFunctionDeclaration);
   if (fn !== undefined) return !functionUsesThis(fn);
   const v = decls.find(ts.isVariableDeclaration);
diff --git a/packages/compiler/src/frontend/lowering/cjs-inline-require.ts b/packages/compiler/src/frontend/lowering/cjs-inline-require.ts
index 9b41f0012..174f9dc7c 100644
--- a/packages/compiler/src/frontend/lowering/cjs-inline-require.ts
+++ b/packages/compiler/src/frontend/lowering/cjs-inline-require.ts
@@ -353,7 +353,7 @@ export function cjsExportValueByName(
   if (sym.flags & ts.SymbolFlags.Alias) sym = lowerer.checker.getAliasedSymbol(sym);
   const direct = lowerer.globalsBySymbol.get(sym);
   if (direct) return { kind: "varRef", localId: direct.id, type: direct.type, loc: locOf(blame) };
-  for (const d of lowerer.checker.declarationsOf(sym)) {
+  for (const d of sym.declarations) {
     const byDecl = lowerer.globalsByDeclNode.get(d);
     if (byDecl) return { kind: "varRef", localId: byDecl.id, type: byDecl.type, loc: locOf(blame) };
     // Alias plumbing: a shorthand/identifier table entry or a member
diff --git a/packages/compiler/src/frontend/lowering/cjs-tsc-interop.ts b/packages/compiler/src/frontend/lowering/cjs-tsc-interop.ts
index 93a1e3260..cd83c8709 100644
--- a/packages/compiler/src/frontend/lowering/cjs-tsc-interop.ts
+++ b/packages/compiler/src/frontend/lowering/cjs-tsc-interop.ts
@@ -132,7 +132,7 @@ export function tscInteropBindingOf(
 ): TscInteropBinding | null {
   if (!ts.isIdentifier(expr)) return null;
   const sym = lowerer.checker.getSymbolAtLocation(expr);
-  const decl = sym ? lowerer.checker.declarationsOf(sym).find(ts.isVariableDeclaration) : undefined;
+  const decl = sym ? sym.declarations.find(ts.isVariableDeclaration) : undefined;
   return decl ? tscInteropBindingOfDecl(lowerer, decl) : null;
 }
 
diff --git a/packages/compiler/src/frontend/lowering/class-construction.ts b/packages/compiler/src/frontend/lowering/class-construction.ts
index 4dae7ecd0..7f4a003c9 100644
--- a/packages/compiler/src/frontend/lowering/class-construction.ts
+++ b/packages/compiler/src/frontend/lowering/class-construction.ts
@@ -1,4 +1,5 @@
 import { dynUndefinedExpr, varRef } from "../../ir/build.js";
+import { constructedValue } from "./constructor-returns.js";
 import {
   BOOL,
   DYN,
@@ -389,13 +390,13 @@ export class ClassConstructionDispatch {
         if (!args) continue;
         const type: IrType = { kind: "classval", className: name };
         const callee = varRef("p.0", DYN, loc);
-        const value: IrExpr = {
+        const value = constructedValue(lowerer, info, {
           kind: "newValue",
           callee: { kind: "dynCheck", value: callee, type, loc },
           args,
           type: { kind: "object", className: name },
           loc,
-        };
+        });
         const body: IrStmt[] = [
           { kind: "return", value: lowerer.coerceToExpected(value, DYN), loc },
         ];
diff --git a/packages/compiler/src/frontend/lowering/class-dynamic-dispatch.ts b/packages/compiler/src/frontend/lowering/class-dynamic-dispatch.ts
index a0ed496e1..d2ef7f6cd 100644
--- a/packages/compiler/src/frontend/lowering/class-dynamic-dispatch.ts
+++ b/packages/compiler/src/frontend/lowering/class-dynamic-dispatch.ts
@@ -1,4 +1,5 @@
 import { dynUndefinedExpr, helperLoc, nodeThrowExpr, varRef } from "../../ir/build.js";
+import { constructedValue } from "./constructor-returns.js";
 import { eventTargetApiMembers, eventTargetInheritedMember } from "./lower-event-target.js";
 import {
   BOOL,
@@ -43,6 +44,7 @@ import {
   observedPrototypeMethod,
   reflectClassPrototype,
 } from "./class-prototypes.js";
+import { perEvaluationPrivateNames } from "./private-brands.js";
 import {
   errorPropertyRead,
   errorPropertyWrite,
@@ -2883,11 +2885,13 @@ export class ClassDynamicDispatch {
           if (info.symbolMethods)
             for (const [symbol, name] of info.symbolMethods) symbolEntries.push([symbol, name]);
           for (const [symbol, name] of symbolEntries) {
-            const declaration = lowerer.checker.valueDeclarationOf(symbol);
+            const declaration = symbol.valueDeclaration;
+            // Module-scope consts and CommonJS key-table properties
+            // (classSymbolKeyOfSymbol) both hold their key in a global.
             if (
               declaration &&
-              ts.isVariableDeclaration(declaration) &&
-              ts.isIdentifier(declaration.name)
+              ((ts.isVariableDeclaration(declaration) && ts.isIdentifier(declaration.name)) ||
+                ts.isPropertyAssignment(declaration))
             ) {
               const global = lowerer.globalsBySymbol.get(symbol);
               if (global)
@@ -3164,13 +3168,13 @@ export class ClassDynamicDispatch {
         }
         if (!supported || !info.decl) continue;
         const cls = classValueRef(lowerer, info, info.decl);
-        const result: IrExpr = {
+        const result = constructedValue(lowerer, info, {
           kind: "new",
           className: name,
           args,
           type: { kind: "object", className: name },
           loc,
-        };
+        });
         this.constructDispatch.body.unshift({
           kind: "if",
           cond: {
@@ -4310,19 +4314,43 @@ export class ClassDynamicDispatch {
       loc,
     };
     if (accessor && info.decl) {
-      const method = classMethodValue(lowerer, info.decl, info, member, loc);
-      if (method) {
-        const call: IrExpr = {
-          kind: "libCall",
-          fn: "dyn.reflectApply",
-          args: [
-            lowerer.coerceToExpected(method, DYN),
-            actualReceiver,
-            { kind: "dynArrLit", elems: write ? [varRef("p.1", DYN, loc)] : [], type: DYN, loc },
-          ],
-          type: DYN,
-          loc,
-        };
+      // An accessor whose private names belong to one evaluation runs as
+      // the instance's own evaluation's prototype accessor.
+      const declarer = accessor.declarer;
+      const prototype = perEvaluationPrivateNames(declarer)
+        ? classPrototypeData(lowerer, declarer, loc, upcastTo(lowerer, receiver, declarer.def.name))
+        : null;
+      const method = prototype ? null : classMethodValue(lowerer, info.decl, info, member, loc);
+      if (prototype || method) {
+        const call: IrExpr = prototype
+          ? {
+              kind: "libCall",
+              fn: write ? "dyn.reflectSet" : "dyn.reflectGet",
+              args: [
+                prototype,
+                lowerer.coerceToExpected(key, DYN),
+                ...(write ? [varRef("p.1", DYN, loc)] : []),
+                actualReceiver,
+              ],
+              type: write ? BOOL : DYN,
+              loc,
+            }
+          : {
+              kind: "libCall",
+              fn: "dyn.reflectApply",
+              args: [
+                lowerer.coerceToExpected(method!, DYN),
+                actualReceiver,
+                {
+                  kind: "dynArrLit",
+                  elems: write ? [varRef("p.1", DYN, loc)] : [],
+                  type: DYN,
+                  loc,
+                },
+              ],
+              type: DYN,
+              loc,
+            };
         return [
           {
             kind: "if",
diff --git a/packages/compiler/src/frontend/lowering/class-method-mutations.ts b/packages/compiler/src/frontend/lowering/class-method-mutations.ts
index 2a0e3a7eb..c07ec9136 100644
--- a/packages/compiler/src/frontend/lowering/class-method-mutations.ts
+++ b/packages/compiler/src/frontend/lowering/class-method-mutations.ts
@@ -93,7 +93,7 @@ export function collectClassMethodMutations(
     value = unwrap(value);
     if (ts.isIdentifier(value)) {
       const symbol = lowerer.checker.getSymbolAtLocation(value);
-      const decl = symbol && lowerer.checker.declarationsOf(symbol)[0];
+      const decl = symbol && symbol.declarations[0];
       if (
         !decl ||
         !ts.isVariableDeclaration(decl) ||
@@ -162,7 +162,7 @@ export function collectClassMethodMutations(
   const literalLoopKeys = (key: ts.Expression): (string | number)[] | null => {
     if (!ts.isIdentifier(key)) return null;
     const symbol = lowerer.checker.getSymbolAtLocation(key);
-    const decl = symbol && lowerer.checker.declarationsOf(symbol)[0];
+    const decl = symbol && symbol.declarations[0];
     if (!decl || !ts.isVariableDeclaration(decl) || !ts.isIdentifier(decl.name)) return null;
     const list = decl.parent;
     if (!ts.isVariableDeclarationList(list) || !(list.flags & ts.NodeFlags.Const)) return null;
@@ -413,7 +413,7 @@ export function collectClassMethodMutations(
     const symbol = ts.isPropertyAccessExpression(access)
       ? lowerer.checker.getSymbolAtLocation(access.name)
       : lowerer.checker.getPropertyOfType(lowerer.typeOf(access.expression), name);
-    if (symbol && lowerer.checker.declarationsOf(symbol).some(ts.isMethodDeclaration))
+    if (symbol && symbol.declarations.some(ts.isMethodDeclaration))
       lowerer.prototypeMethodAccesses.set(name, access);
   }
   lowerer.checker.prefetchSymbolRoots([...globals, ...reflection]);
@@ -480,8 +480,7 @@ export function collectClassMethodMutations(
       }
       const type = lowerer.checker.getDeclaredTypeOfSymbol(symbol);
       const property = lowerer.checker.getPropertyOfType(type, name);
-      if (!property || !lowerer.checker.declarationsOf(property).some(ts.isMethodDeclaration))
-        continue;
+      if (!property || !property.declarations.some(ts.isMethodDeclaration)) continue;
       if (cls.typeParameters !== undefined && cls.typeParameters.nodes.length > 0) {
         owners = null;
         break;
diff --git a/packages/compiler/src/frontend/lowering/class-method-values.ts b/packages/compiler/src/frontend/lowering/class-method-values.ts
index 10572377e..795307c93 100644
--- a/packages/compiler/src/frontend/lowering/class-method-values.ts
+++ b/packages/compiler/src/frontend/lowering/class-method-values.ts
@@ -27,6 +27,7 @@ import { funcTypeFromParamShapes, type ParamShape } from "./call-signatures.js";
 import { erasedGenericInstance, implicitDefaultInstance } from "./generic-functions.js";
 import { errorToStringMethod } from "./error-methods.js";
 import { classCallbackValue, isClassCallback } from "./class-callbacks.js";
+import { perEvaluationPrivateNames } from "./private-brands.js";
 
 export interface ClassMethodValueSelection {
   expression: ts.PropertyAccessExpression;
@@ -51,18 +52,20 @@ export function lowerClassMethodValue(
   }
   const loc = locOf(expr);
   const receiver = lowerer.lowerExpr(expr.expression);
+  const declared = findMethodOn(lowerer, info, method);
   // A JS checker may name a class while the value is held in checked
   // storage. Read its actual property so own replacements and getters
-  // participate, and never pass a dynamic value to a native selector.
-  if (receiver.type.kind === "dyn")
+  // participate, and never pass a dynamic value to a native selector. A
+  // method whose private names belong to one evaluation is that
+  // evaluation's prototype method as well.
+  if (receiver.type.kind === "dyn" || (!!declared && perEvaluationPrivateNames(declared.declarer)))
     return {
       kind: "dynKeyGet",
-      value: receiver,
+      value: lowerer.coerceToExpected(receiver, DYN),
       key: { kind: "strLit", value: method, type: STRING, loc },
       type: DYN,
       loc,
     };
-  const declared = findMethodOn(lowerer, info, method);
   // Abstract declarations have no prototype function. Concrete descendants
   // provide the extracted value through the same reachability-driven selector.
   let value = declared?.sig.abstract
@@ -537,10 +540,13 @@ export function finalizeClassMethodValues(lowerer: Lowerer, functions: IrFunctio
           !(expr.kind === "closure" && expr.captures.includes(thisParam.localId)),
       });
     if (usesThis) continue;
-    // A method that never uses this remains callable when detached.
+    // A method that never uses this remains callable when detached. Without
+    // class captures it needs no class environment, so the detached copy
+    // drops the (empty) capture list, which requires a receiver.
     const name = `%method.receiverless:${target.name}`;
+    const { classCaptures: _classCaptures, ...detached } = target;
     functions.push({
-      ...target,
+      ...detached,
       name,
       params: target.params.slice(1),
       locals: target.locals.filter((local) => local.id !== thisParam.localId),
diff --git a/packages/compiler/src/frontend/lowering/class-protocol-dispatch.ts b/packages/compiler/src/frontend/lowering/class-protocol-dispatch.ts
index c8e56f3cc..0c9a24f24 100644
--- a/packages/compiler/src/frontend/lowering/class-protocol-dispatch.ts
+++ b/packages/compiler/src/frontend/lowering/class-protocol-dispatch.ts
@@ -99,7 +99,7 @@ function ownedBinding(lowerer: Lowerer, id: ts.Identifier): boolean {
   if (!symbol) return false;
   const cached = lowerer.protocolOwnedBindings.get(symbol);
   if (cached !== undefined) return cached;
-  const decl = lowerer.checker.valueDeclarationOf(symbol);
+  const decl = symbol.valueDeclaration;
   let owned =
     decl !== undefined &&
     decl.getSourceFile() === id.getSourceFile() &&
@@ -191,7 +191,7 @@ function protocolSignature(
   const recvTs = lowerer.typeOf(access.expression);
   const property = lowerer.checker.getPropertyOfType(recvTs, access.name.text);
   if (!property) return null;
-  const declarations = lowerer.checker.declarationsOf(property);
+  const declarations = property.declarations;
   if (
     declarations.length === 0 ||
     !declarations.every(
@@ -200,7 +200,7 @@ function protocolSignature(
   )
     return null;
   const signature = lowerer.checker.getResolvedSignature(call);
-  const declaration = signature && lowerer.checker.signatureDeclaration(signature);
+  const declaration = signature && signature.declaration;
   if (
     !signature ||
     !declaration ||
@@ -490,7 +490,7 @@ export function lowerProtocolPropertyRead(
   if (!lowerer.classImplementedProtocol(receiverType)) return null;
   const name = access.name.text;
   const property = lowerer.checker.getPropertyOfType(receiverType, name);
-  const declarations = property ? lowerer.checker.declarationsOf(property) : [];
+  const declarations = property ? property.declarations : [];
   if (declarations.length === 0 || !declarations.every((decl) => ts.isPropertySignature(decl)))
     return null;
   const result = lowerer.mapTypeOf(lowerer.typeOf(access));
diff --git a/packages/compiler/src/frontend/lowering/class-protocols.ts b/packages/compiler/src/frontend/lowering/class-protocols.ts
index 9e69d08b7..65d74ab9d 100644
--- a/packages/compiler/src/frontend/lowering/class-protocols.ts
+++ b/packages/compiler/src/frontend/lowering/class-protocols.ts
@@ -37,15 +37,13 @@ export class ClassProtocols {
         const instance = symbol ? this.checker.getDeclaredTypeOfSymbol(symbol) : undefined;
         for (const property of instance ? this.checker.getPropertiesOfType(instance) : []) {
           if (
-            !this.checker
-              .declarationsOf(property)
-              .some(
-                (member) =>
-                  ts.isMethodDeclaration(member) &&
-                  !member.modifiers?.nodes.some(
-                    (modifier) => modifier.kind === ts.SyntaxKind.StaticKeyword,
-                  ),
-              )
+            !property.declarations.some(
+              (member) =>
+                ts.isMethodDeclaration(member) &&
+                !member.modifiers?.nodes.some(
+                  (modifier) => modifier.kind === ts.SyntaxKind.StaticKeyword,
+                ),
+            )
           )
             continue;
           const entries = this.methods.get(property.name) ?? [];
@@ -289,7 +287,7 @@ export class ClassProtocols {
       for (const part of parts) {
         if ((part.flags & ts.TypeFlags.TypeParameter) === 0) continue;
         const symbol = part.getSymbol();
-        for (const declaration of symbol ? this.checker.declarationsOf(symbol) : [])
+        for (const declaration of symbol ? symbol.declarations : [])
           if (ts.isTypeParameterDeclaration(declaration) && declaration.parent !== undefined)
             facts.genericObservers.add(declaration.parent);
       }
@@ -501,7 +499,7 @@ export class ClassProtocols {
           if (context !== undefined && this.acceptsAnyValue(context)) return true;
           if (facts.genericObservers.size === 0) return false;
           const signature = this.checker.getResolvedSignature(arg.call);
-          const declaration = signature && this.checker.signatureDeclaration(signature);
+          const declaration = signature && signature.declaration;
           return (
             declaration !== undefined &&
             (facts.genericObservers.has(declaration) ||
@@ -520,13 +518,10 @@ export class ClassProtocols {
       .some(
         (property) =>
           names.has(property.name) &&
-          this.checker
-            .declarationsOf(property)
-            .some(
-              (declaration) =>
-                ts.isGetAccessorDeclaration(declaration) ||
-                ts.isSetAccessorDeclaration(declaration),
-            ),
+          property.declarations.some(
+            (declaration) =>
+              ts.isGetAccessorDeclaration(declaration) || ts.isSetAccessorDeclaration(declaration),
+          ),
       );
   }
 
@@ -580,9 +575,7 @@ export class ClassProtocols {
     return (
       symbol !== undefined &&
       (symbol.flags & ts.SymbolFlags.Class) !== 0 &&
-      this.checker
-        .declarationsOf(symbol)
-        .some((declaration) => !declaration.getSourceFile().isDeclarationFile) &&
+      symbol.declarations.some((declaration) => !declaration.getSourceFile().isDeclarationFile) &&
       // `typeof C` (the class value) shares the class symbol.
       this.checker.getConstructSignatures(type).length === 0
     );
@@ -603,13 +596,10 @@ export class ClassProtocols {
     // A program interface a class matches by its methods (protocol below).
     return (
       this.methods.size > 0 &&
-      this.checker
-        .declarationsOf(symbol)
-        .some(
-          (declaration) =>
-            ts.isInterfaceDeclaration(declaration) &&
-            !declaration.getSourceFile().isDeclarationFile,
-        ) &&
+      symbol.declarations.some(
+        (declaration) =>
+          ts.isInterfaceDeclaration(declaration) && !declaration.getSourceFile().isDeclarationFile,
+      ) &&
       this.protocol(type)
     );
   }
@@ -624,7 +614,7 @@ export class ClassProtocols {
     if (this.checker.getConstructSignatures(type).length > 0) return false;
     const symbol = type.getSymbol();
     if (symbol === undefined || (symbol.flags & ts.SymbolFlags.Class) !== 0) return false;
-    const declarations = this.checker.declarationsOf(symbol);
+    const declarations = symbol.declarations;
     return (
       declarations.length > 0 &&
       declarations.every((declaration) => !declaration.getSourceFile().isDeclarationFile)
@@ -712,13 +702,10 @@ export class ClassProtocols {
     if (symbol && protocols.has(symbol)) return true;
     if (
       !symbol ||
-      !this.checker
-        .declarationsOf(symbol)
-        .some(
-          (declaration) =>
-            ts.isInterfaceDeclaration(declaration) &&
-            !declaration.getSourceFile().isDeclarationFile,
-        )
+      !symbol.declarations.some(
+        (declaration) =>
+          ts.isInterfaceDeclaration(declaration) && !declaration.getSourceFile().isDeclarationFile,
+      )
     )
       return false;
     for (const property of properties) {
@@ -735,6 +722,12 @@ export class ClassProtocols {
           return true;
       }
     }
+    // An interface extending a class-backed protocol holds values of that
+    // protocol (`interface TupleType extends Type`), so an assertion from
+    // the base to it keeps the instance and its methods.
+    const target = type.isTypeReference() ? type.getTarget() : type;
+    if (target?.isClassOrInterface())
+      for (const base of this.checker.getBaseTypes(target)) if (this.protocol(base)) return true;
     return false;
   }
 }
diff --git a/packages/compiler/src/frontend/lowering/class-prototypes.ts b/packages/compiler/src/frontend/lowering/class-prototypes.ts
index 403a4a3b4..d337dc802 100644
--- a/packages/compiler/src/frontend/lowering/class-prototypes.ts
+++ b/packages/compiler/src/frontend/lowering/class-prototypes.ts
@@ -22,7 +22,7 @@ import {
   type ClassInfo,
 } from "./lower-classes.js";
 import type { Lowerer } from "./lowerer.js";
-import { newFnCtx } from "./lowerer.js";
+import { PoisonError, newFnCtx } from "./lowerer.js";
 import { classMethodValue } from "./class-method-values.js";
 
 /** Data added to a top-level class prototype has shared identity and remains
@@ -376,14 +376,37 @@ export function reflectClassPrototype(
       const method = ts.isMethodDeclaration(member)
         ? name
         : `${ts.isGetAccessor(member) ? "get" : "set"}:${name}`;
-      const value = classMethodValue(lowerer, info.decl, info, method, loc);
+      // A member whose value or key has no lowering refuses the reflection
+      // at run time; its own diagnostic must not escape this walk (the
+      // walk runs from emitReachable, after statement fences are placed).
+      let before = lowerer.diags.length;
+      let value: IrExpr | null;
+      try {
+        value = classMethodValue(lowerer, info.decl, info, method, loc);
+      } catch (error) {
+        if (!(error instanceof PoisonError)) throw error;
+        lowerer.diags.splice(before);
+        return refuse(
+          "prototype reflection with a member that has no lowering is not supported yet",
+        );
+      }
       if (!value || !lowerer.dynConvertible(value.type))
         return refuse(
           "prototype reflection with a member that cannot cross a checked value boundary is not supported yet",
         );
-      const key: IrExpr = ts.isComputedPropertyName(member.name)
-        ? lowerer.lowerExpr(member.name.expression)
-        : { kind: "strLit", value: member.name.text, type: STRING, loc };
+      let key: IrExpr;
+      before = lowerer.diags.length;
+      try {
+        key = ts.isComputedPropertyName(member.name)
+          ? lowerer.lowerExpr(member.name.expression)
+          : { kind: "strLit", value: member.name.text, type: STRING, loc };
+      } catch (error) {
+        if (!(error instanceof PoisonError)) throw error;
+        lowerer.diags.splice(before);
+        return refuse(
+          "prototype reflection with a computed member key that has no lowering is not supported yet",
+        );
+      }
       initialization.then.push(
         define(
           key,
@@ -555,7 +578,16 @@ function prototypeProtectedKeys(
       } else if (name.startsWith("%symbol:")) {
         const entries: [ts.Symbol, string][] = owner.symbolMethods ? [...owner.symbolMethods] : [];
         const entry = entries.find(([, field]) => field === name);
-        const declaration = entry ? lowerer.checker.valueDeclarationOf(entry[0]) : undefined;
+        const declaration = entry ? entry[0].valueDeclaration : undefined;
+        // A CommonJS key-table property holds its key in the table's global.
+        const tableKey =
+          declaration && ts.isPropertyAssignment(declaration)
+            ? lowerer.globalsBySymbol.get(entry![0])
+            : undefined;
+        if (tableKey) {
+          keys.push({ kind: "varRef", localId: tableKey.id, type: tableKey.type, loc });
+          continue;
+        }
         if (
           !declaration ||
           !ts.isVariableDeclaration(declaration) ||
diff --git a/packages/compiler/src/frontend/lowering/class-unions.ts b/packages/compiler/src/frontend/lowering/class-unions.ts
index c172b40cf..f52026ba4 100644
--- a/packages/compiler/src/frontend/lowering/class-unions.ts
+++ b/packages/compiler/src/frontend/lowering/class-unions.ts
@@ -1,8 +1,115 @@
-import { BOOL, type IrExpr, type IrStmt, type IrType } from "../../ir/ir.js";
+import * as ts from "../ts7/adapter.js";
+import { BOOL, typeKey, type IrExpr, type IrStmt, type IrType } from "../../ir/ir.js";
 import { nodeThrowExpr, varRef } from "../../ir/build.js";
 import { checkedClassAssertion } from "./class-assertions.js";
 import type { Lowerer } from "./lowerer.js";
 
+/** The classes a narrowed read of a `staticClass` value can hold when the
+ * checker typed it as the subclass `narrowed`, as a class union, or null
+ * when `narrowed` is the only one.
+ *
+ * TypeScript reduces a union of type-parameter intersections by structural
+ * subtyping. With `<T extends Node>`, `node instanceof Identifier || node
+ * instanceof PrivateIdentifier` narrows `node` to `T & PrivateIdentifier`
+ * when Identifier has every member PrivateIdentifier has, so the narrowed
+ * read can hold an Identifier. Class identity is nominal in compiled code:
+ * such a read holds the narrowed class or any class under `staticClass`
+ * that is assignable to it without extending it. A narrowing outside a
+ * type-parameter intersection keeps every class it names. */
+export function structuralNarrowing(
+  lowerer: Lowerer,
+  node: ts.Node,
+  staticClass: string,
+  narrowed: IrType & { kind: "object" },
+): (IrType & { kind: "union" }) | null {
+  if (!intersectsTypeParameter(lowerer.checker.getTypeAtLocation(node))) return null;
+  const key = `${staticClass}:${narrowed.className}`;
+  let peers = lowerer.structuralClassPeers.get(key);
+  if (peers === undefined) {
+    peers = assignableClassPeers(lowerer, staticClass, narrowed.className);
+    lowerer.structuralClassPeers.set(key, peers);
+  }
+  if (peers.length === 0) return null;
+  const arms: IrType[] = [
+    narrowed,
+    ...peers.map((className) => ({ kind: "object" as const, className })),
+  ];
+  arms.sort((a, b) => (typeKey(a) < typeKey(b) ? -1 : 1));
+  return { kind: "union", unionId: lowerer.unions.intern(arms) };
+}
+
+/** The type a member access dispatches on when its receiver `node` is a
+ * narrowed read of a type-parameter intersection, or null to use the
+ * checker's type: the class union structuralNarrowing reads, or the
+ * receiver's own class when this instantiation's class is unrelated to the
+ * narrowed one but assignable to it (with `T = Identifier`, the reduced
+ * `T & PrivateIdentifier` still holds an Identifier). */
+export function structuralReadType(lowerer: Lowerer, node: ts.Expression): IrType | null {
+  if (!ts.isIdentifier(node) && !ts.isPropertyAccessExpression(node)) return null;
+  if (!intersectsTypeParameter(lowerer.checker.getTypeAtLocation(node))) return null;
+  const narrowed = lowerer.mapTypeOf(lowerer.typeOf(node));
+  if (narrowed?.kind !== "object") return null;
+  const stored = ts.isIdentifier(node) ? lowerer.peekLocal(node)?.type : undefined;
+  const symbol = lowerer.checker.getSymbolAtLocation(ts.isIdentifier(node) ? node : node.name);
+  const declared =
+    stored ?? (symbol ? lowerer.mapTypeOf(lowerer.checker.getTypeOfSymbol(symbol)) : null);
+  if (declared?.kind !== "object" || declared.className === narrowed.className) return null;
+  if (lowerer.isSubclassOf(narrowed.className, declared.className))
+    return structuralNarrowing(lowerer, node, declared.className, narrowed);
+  if (lowerer.isSubclassOf(declared.className, narrowed.className)) return null;
+  const declaredType = classInstanceType(lowerer, declared.className);
+  const narrowedType = classInstanceType(lowerer, narrowed.className);
+  return declaredType !== null &&
+    narrowedType !== null &&
+    lowerer.checker.isTypeAssignableTo(declaredType, narrowedType)
+    ? declared
+    : null;
+}
+
+function classInstanceType(lowerer: Lowerer, className: string): ts.Type | null {
+  const decl = lowerer.classes.get(className)?.decl;
+  if (!decl?.name || decl.typeParameters?.nodes.length) return null;
+  const symbol = lowerer.checker.getSymbolAtLocation(decl.name);
+  return symbol ? lowerer.checker.getDeclaredTypeOfSymbol(symbol) : null;
+}
+
+function intersectsTypeParameter(type: ts.Type): boolean {
+  try {
+    if (type.isUnionType()) return ts.constituentTypes(type).some(intersectsTypeParameter);
+    return (
+      (type.flags & ts.TypeFlags.Intersection) !== 0 &&
+      ts.constituentTypes(type).some((part) => (part.flags & ts.TypeFlags.TypeParameter) !== 0)
+    );
+  } catch (e) {
+    if (ts.isUnreadableConstituentsPanic(e)) return false;
+    throw e;
+  }
+}
+
+/** The outermost classes under `staticClass`, other than `target` and its
+ * subclasses, whose instance type is assignable to `target`'s. */
+function assignableClassPeers(lowerer: Lowerer, staticClass: string, target: string): string[] {
+  const targetType = classInstanceType(lowerer, target);
+  if (targetType === null) return [];
+  const assignable: string[] = [];
+  for (const className of lowerer.classes.keys()) {
+    if (
+      className === target ||
+      !lowerer.isSubclassOf(className, staticClass) ||
+      lowerer.isSubclassOf(className, target)
+    )
+      continue;
+    const type = classInstanceType(lowerer, className);
+    if (type !== null && lowerer.checker.isTypeAssignableTo(type, targetType))
+      assignable.push(className);
+  }
+  // A subclass of an assignable class is one of its instances already.
+  return assignable.filter(
+    (className) =>
+      !assignable.some((other) => other !== className && lowerer.isSubclassOf(className, other)),
+  );
+}
+
 /** A base-class slot stays one pointer after a guard selects several
  * subclasses. Recover the tagged view from runtime membership without
  * copying the object or guessing which of the remaining layouts it has. */
diff --git a/packages/compiler/src/frontend/lowering/coercions/structural-plans.ts b/packages/compiler/src/frontend/lowering/coercions/structural-plans.ts
index 78c7cb73d..2bc991c14 100644
--- a/packages/compiler/src/frontend/lowering/coercions/structural-plans.ts
+++ b/packages/compiler/src/frontend/lowering/coercions/structural-plans.ts
@@ -1,4 +1,4 @@
-import { planRecordUnionWrap } from "../union-retag.js";
+import { planRecordUnionLift, planRecordUnionWrap } from "../union-retag.js";
 import type { WidthLift } from "../width-lift.js";
 import type { IrType } from "../../../ir/ir.js";
 import { isUnitType, typeEquals, UNDEFINED_T } from "../../../ir/ir.js";
@@ -78,6 +78,24 @@ export function widthLiftPlan(lowerer: Lowerer, src: IrType, dst: IrType): Width
       });
       if (absentOnly.length === 1) selected = absentOnly;
     }
+    // A record that fits several arms of a discriminated union selects one
+    // by its discriminant at run time. Without this, an arm that a nested
+    // field could reach only ambiguously dropped out of the candidates, and
+    // an arm reached by dropping fields could win alone.
+    if (selected.length !== 1 && src.kind === "record") {
+      const source = lowerer.shapes.get(src.shapeId);
+      if (
+        source &&
+        planRecordUnionLift(
+          source,
+          def,
+          (id) => lowerer.shapes.get(id),
+          (from, to) => lowerer.widthLiftPlan(from, to),
+        )
+      ) {
+        return { how: "discriminantRoute" };
+      }
+    }
     if (selected.length !== 1) return null;
     return { how: "liftWrap", tag: selected[0]!.tag, arm: selected[0]!.arm };
   }
diff --git a/packages/compiler/src/frontend/lowering/coercions/structural.ts b/packages/compiler/src/frontend/lowering/coercions/structural.ts
index 925f59d9b..c85b9868d 100644
--- a/packages/compiler/src/frontend/lowering/coercions/structural.ts
+++ b/packages/compiler/src/frontend/lowering/coercions/structural.ts
@@ -1,3 +1,4 @@
+import { constructedValue } from "../constructor-returns.js";
 import { dynUndefinedExpr, varRef } from "../../../ir/build.js";
 import type { FieldLift } from "./structural-plans.js";
 import { buildArrayConversion } from "./builders.js";
@@ -106,6 +107,16 @@ export function applyWidthLift(
         );
       return { kind: "call", callee: helper, args: [value], type: dst, loc };
     }
+    case "discriminantRoute": {
+      if (dst.kind !== "union" || value.type.kind !== "record")
+        throw new InternalCompilerError("lowerer bug: record discriminant route shape");
+      const helper = lowerer.recordUnionRouteHelper(value.type, dst.unionId, loc);
+      if (!helper)
+        throw new InternalCompilerError(
+          "lowerer bug: planned record discriminant route failed to intern",
+        );
+      return { kind: "call", callee: helper, args: [value], type: dst, loc };
+    }
     case "retag": {
       if (dst.kind !== "union" || value.type.kind !== "union")
         throw new InternalCompilerError("lowerer bug: retag lift shape");
@@ -524,7 +535,13 @@ export function recordClassWidthHelper(
     params: [{ localId: "r.0", name: "r", type: fromT }],
     returnType: toT,
     locals: [{ id: "r.0", name: "r", type: fromT, mutable: true }],
-    body: [{ kind: "return", value: { kind: "new", className, args, type: toT, loc }, loc }],
+    body: [
+      {
+        kind: "return",
+        value: constructedValue(lowerer, info, { kind: "new", className, args, type: toT, loc }),
+        loc,
+      },
+    ],
     loc,
   });
   return name;
@@ -603,6 +620,10 @@ function buildRecordProjection(
   const localId = parameter + ".0";
   const receiver = varRef(localId, source, loc);
   const result: IrType = { kind: "record", shapeId: target.id };
+  // A record source's copy keeps the source's key order; a class
+  // instance's fields keep today's table.
+  const copyOf = (node: IrExpr): IrExpr =>
+    source.kind === "record" ? lowerer.keyOrder.copy(node, source.shapeId) : node;
   return {
     name,
     params: [{ localId, name: parameter, type: source }],
@@ -611,7 +632,7 @@ function buildRecordProjection(
     body: [
       {
         kind: "return",
-        value: {
+        value: copyOf({
           kind: "recordLit",
           fields: target.fields.map((field) => {
             const conversion = plan.get(field.name)!;
@@ -661,7 +682,7 @@ function buildRecordProjection(
           }),
           type: result,
           loc,
-        },
+        }),
         loc,
       },
     ],
diff --git a/packages/compiler/src/frontend/lowering/coercions/unions.ts b/packages/compiler/src/frontend/lowering/coercions/unions.ts
index 0356b714e..06c0af9c6 100644
--- a/packages/compiler/src/frontend/lowering/coercions/unions.ts
+++ b/packages/compiler/src/frontend/lowering/coercions/unions.ts
@@ -4,6 +4,7 @@ import { nodeThrowExpr } from "../../../ir/build.js";
 import {
   planUnionRetag,
   buildUnionRetag,
+  planRecordUnionLift,
   planRecordUnionWrap,
   buildRecordUnionWrap,
 } from "../union-retag.js";
@@ -284,6 +285,38 @@ export function recordUnionWrapHelper(
   return name;
 }
 
+/** Interned `%record.route.<n>(r)`: a record that fits several arms of a
+ * discriminated union, converted into the arm its discriminant names
+ * (planRecordUnionLift). The width plan's `discriminantRoute` lift. */
+export function recordUnionRouteHelper(
+  lowerer: Lowerer,
+  source: IrType & { kind: "record" },
+  toId: string,
+  loc: SrcLoc,
+): string | null {
+  const shape = lowerer.shapes.get(source.shapeId);
+  const to = lowerer.unions.get(toId);
+  if (!shape || !to) return null;
+  const key = `recordRoute:${source.shapeId}:${toId}`;
+  const existing = lowerer.coercions.retags.get(key);
+  if (existing) return existing;
+  const plan = planRecordUnionLift(
+    shape,
+    to,
+    (id) => lowerer.shapes.get(id),
+    (from, dst) => lowerer.widthLiftPlan(from, dst),
+  );
+  if (!plan) return null;
+  const name = `%record.route.${lowerer.coercions.retags.size}`;
+  lowerer.coercions.retags.set(key, name);
+  lowerer.liftedFns.push(
+    buildRecordUnionWrap(name, source, to, plan, loc, (lift, value, dst) =>
+      lowerer.applyWidthLift(lift, value, dst, loc),
+    ),
+  );
+  return name;
+}
+
 export function unionRetagHelper(
   lowerer: Lowerer,
   fromId: string,
diff --git a/packages/compiler/src/frontend/lowering/collection-narrowing.ts b/packages/compiler/src/frontend/lowering/collection-narrowing.ts
index 57b75daf5..29b358e99 100644
--- a/packages/compiler/src/frontend/lowering/collection-narrowing.ts
+++ b/packages/compiler/src/frontend/lowering/collection-narrowing.ts
@@ -13,12 +13,7 @@ export function concreteCollectionNarrow(
   const symbol = narrowed.getSymbol();
   const name = symbol?.name;
   if (name !== "Map" && name !== "Set") return null;
-  if (
-    !symbol ||
-    !lowerer.checker
-      .declarationsOf(symbol)
-      .some((decl) => lowerer.isStdlibFile(decl.getSourceFile()))
-  )
+  if (!symbol || !symbol.declarations.some((decl) => lowerer.isStdlibFile(decl.getSourceFile())))
     return null;
   const args = lowerer.checker.getTypeArguments(narrowed as ts.TypeReference);
   if (args.length === 0 || !args.every((arg) => (arg.flags & ts.TypeFlags.Any) !== 0)) return null;
diff --git a/packages/compiler/src/frontend/lowering/constructor-returns.ts b/packages/compiler/src/frontend/lowering/constructor-returns.ts
new file mode 100644
index 000000000..bee2e7567
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/constructor-returns.ts
@@ -0,0 +1,522 @@
+/** Constructors that `return` a value.
+ *
+ * JavaScript's `new C()` answers the constructor's returned value when it
+ * is an object (functions included) and the constructed `this` otherwise.
+ * A primitive or bare return therefore keeps the ordinary lowering, which
+ * evaluates the operand and drops it.
+ *
+ * A return whose value is an instance of the constructor's own class keeps
+ * the class representation (`if (Single.instance) return
+ * Single.instance;`). The return stores that instance in a per-class
+ * result slot and every direct `new C()` takes it from there. Any other
+ * object has no representation as a `C` instance and refuses at the return
+ * statement, deferred to run time in JavaScript like other statement
+ * fences. A JavaScript value that is an object only at run time (`any`)
+ * is tested when it returns: a primitive answers the constructed
+ * instance, an instance of the class takes the result slot, and any other
+ * object refuses.
+ *
+ * `super()` from a subclass refuses: Node would rebind the subclass's
+ * `this` to the returned instance. In JavaScript the refusal is a run-time
+ * test after the call: an instance other than the subclass's own `this`
+ * refuses, and the constructed instance itself (`return this.set(r, g,
+ * b)`, where `set` answers `this`) continues. */
+import * as ts from "../ts7/adapter.js";
+import { varRef } from "../../ir/build.js";
+import {
+  BOOL,
+  DYN,
+  type IrExpr,
+  type IrGlobal,
+  type IrStmt,
+  type IrType,
+  STRING,
+  typeKey,
+  VOID,
+} from "../../ir/ir.js";
+import { unsupportedDiag } from "../../diagnostics/diagnostic.js";
+import { isJsSourceFile, locOf } from "../program.js";
+import type { ClassInfo } from "./lower-classes.js";
+import type { Lowerer } from "./lowerer.js";
+
+type ReturnKind = "instance" | "object" | "mixed";
+
+export interface ConstructorReturnPlan {
+  /** Returns whose value may be an object, by kind. Primitive and `this`
+   * returns are absent: they keep the ordinary lowering. */
+  returns: Map<ts.ReturnStatement, ReturnKind>;
+  /** The result slot (`C | undefined`), present when some return yields an
+   * instance of the class itself. */
+  slot: IrGlobal | null;
+}
+
+const PRIMITIVE_FLAGS =
+  ts.TypeFlags.Primitive | ts.TypeFlags.EnumLike | ts.TypeFlags.Void | ts.TypeFlags.Never;
+
+/** Types whose values may be primitives or objects: open types, type
+ * variables and intersections (a branded `string & { tag }` is a string). */
+const OPEN_FLAGS =
+  ts.TypeFlags.AnyOrUnknown | ts.TypeFlags.InstantiableNonPrimitive | ts.TypeFlags.Intersection;
+
+function unparenthesized(node: ts.Expression): ts.Expression {
+  let e = node;
+  while (ts.isParenthesizedExpression(e)) e = e.expression;
+  return e;
+}
+
+/** Whether a value of this checker type can be an object: "never",
+ * "always", or "maybe" (open types and primitive/object unions). */
+function objectness(type: ts.Type): "never" | "always" | "maybe" {
+  const parts = type.isUnionType() ? ts.constituentTypes(type) : [type];
+  let primitive = false;
+  let object = false;
+  for (const part of parts) {
+    if ((part.flags & OPEN_FLAGS) !== 0) return "maybe";
+    if ((part.flags & PRIMITIVE_FLAGS) !== 0) primitive = true;
+    else object = true;
+  }
+  if (!object) return "never";
+  return primitive ? "maybe" : "always";
+}
+
+/** The constructor's own `return <expr>` statements: nested functions,
+ * arrows and classes have their own returns. */
+function ownValueReturns(ctor: ts.ConstructorDeclaration): ts.ReturnStatement[] {
+  const out: ts.ReturnStatement[] = [];
+  const visit = (node: ts.Node): void => {
+    if (ts.isFunctionLike(node) || ts.isClassLikeDeclaration(node)) return;
+    if (ts.isReturnStatement(node) && node.expression !== undefined) out.push(node);
+    node.forEachChild(visit);
+  };
+  ctor.body?.forEachChild(visit);
+  return out;
+}
+
+/** A return inside a `try` with a `finally` block: the finally block runs
+ * after the result is stored and may throw past it. */
+function insideFinallyTry(node: ts.Node, ctor: ts.ConstructorDeclaration): boolean {
+  for (let p = node.parent; p !== undefined && p !== ctor; p = p.parent) {
+    if (ts.isTryStatement(p) && p.finallyBlock !== undefined && !nodeWithin(node, p.finallyBlock))
+      return true;
+  }
+  return false;
+}
+
+function nodeWithin(node: ts.Node, ancestor: ts.Node): boolean {
+  return node.pos >= ancestor.pos && node.end <= ancestor.end;
+}
+
+function instanceType(info: ClassInfo): IrType {
+  return { kind: "object", className: info.def.name };
+}
+
+function isInstanceOf(lowerer: Lowerer, info: ClassInfo, type: IrType | null): boolean {
+  if (type === null) return false;
+  if (type.kind === "object") return type.className === info.def.name;
+  if (type.kind !== "union") return false;
+  const arms = lowerer.unions.get(type.unionId)?.arms ?? [];
+  return (
+    arms.length === 2 &&
+    arms.some((arm) => arm.kind === "object" && arm.className === info.def.name) &&
+    arms.some((arm) => arm.kind === "undefinedT")
+  );
+}
+
+/** Whether an expression always yields the receiver itself: `this`, or a
+ * call `this.m(...)` / `super.m(...)` whose every implementation the
+ * receiver can reach (the statically resolved method and, for `this`
+ * calls, each subclass override) returns only `this`, a primitive, or
+ * nothing (`return this.set(r, g, b)` with a chainable setter). Such a
+ * return answers the constructed instance. Methods already being checked
+ * count as returning `this` (their other returns decide). */
+function returnsThis(
+  lowerer: Lowerer,
+  info: ClassInfo,
+  node: ts.Expression,
+  visiting: Set<ts.Node> = new Set(),
+): boolean {
+  let e = node;
+  while (ts.isParenthesizedExpression(e) || ts.isAsExpression(e) || ts.isNonNullExpression(e))
+    e = e.expression;
+  if (e.kind === ts.SyntaxKind.ThisKeyword) return true;
+  if (!ts.isCallExpression(e)) return false;
+  const callee = unparenthesized(e.expression);
+  if (
+    !ts.isPropertyAccessExpression(callee) ||
+    callee.questionDotToken !== undefined ||
+    !ts.isIdentifier(callee.name)
+  )
+    return false;
+  const receiver = unparenthesized(callee.expression).kind;
+  if (receiver !== ts.SyntaxKind.ThisKeyword && receiver !== ts.SyntaxKind.SuperKeyword)
+    return false;
+  const name = callee.name.text;
+  const symbol = lowerer.checker.getSymbolAtLocation(callee.name);
+  if (symbol === undefined) return false;
+  const methods: ts.Node[] = [...symbol.declarations];
+  if (receiver === ts.SyntaxKind.ThisKeyword) {
+    const pending = [...info.subclasses];
+    while (pending.length > 0) {
+      const sub = pending.pop()!;
+      pending.push(...sub.subclasses);
+      for (const member of sub.decl?.members.nodes ?? []) {
+        if (member.name === undefined || !ts.isIdentifier(member.name) || member.name.text !== name)
+          continue;
+        if (!ts.isMethodDeclaration(member)) return false;
+        methods.push(member);
+      }
+    }
+  }
+  if (methods.length === 0) return false;
+  for (const method of methods) {
+    if (!ts.isMethodDeclaration(method) || method.body === undefined) return false;
+    if (visiting.has(method)) continue;
+    visiting.add(method);
+    for (const ret of ownReturns(method.body)) {
+      if (ret.expression === undefined) continue;
+      if (objectness(lowerer.typeOf(ret.expression)) === "never") continue;
+      if (!returnsThis(lowerer, info, ret.expression, visiting)) return false;
+    }
+  }
+  return true;
+}
+
+/** A function body's own return statements (nested functions, arrows and
+ * classes have their own). */
+function ownReturns(body: ts.Node): ts.ReturnStatement[] {
+  const out: ts.ReturnStatement[] = [];
+  const visit = (node: ts.Node): void => {
+    if (ts.isFunctionLike(node) || ts.isClassLikeDeclaration(node)) return;
+    if (ts.isReturnStatement(node)) out.push(node);
+    node.forEachChild(visit);
+  };
+  body.forEachChild(visit);
+  return out;
+}
+
+export function constructorReturnPlan(
+  lowerer: Lowerer,
+  info: ClassInfo,
+): ConstructorReturnPlan | null {
+  const byClass = lowerer.constructorReturnPlans;
+  const known = byClass.get(info.def.name);
+  if (known !== undefined) return known;
+  const ctor = info.ctor;
+  let plan: ConstructorReturnPlan | null = null;
+  if (ctor?.body !== undefined && info.decl !== null) {
+    const returns = new Map<ts.ReturnStatement, ReturnKind>();
+    for (const stmt of ownValueReturns(ctor)) {
+      const value = unparenthesized(stmt.expression!);
+      if (returnsThis(lowerer, info, value)) continue;
+      const type = lowerer.typeOf(value);
+      const shape = objectness(type);
+      if (shape === "never") continue;
+      // Local classes construct through their own environment, which has
+      // no result slot.
+      const instance =
+        info.localClass === undefined &&
+        !insideFinallyTry(stmt, ctor) &&
+        isInstanceOf(lowerer, info, lowerer.mapTypeOf(type));
+      returns.set(stmt, instance ? "instance" : shape === "always" ? "object" : "mixed");
+    }
+    if (returns.size > 0) {
+      let slot: IrGlobal | null = null;
+      // A JavaScript value typed only at run time may hold an instance of
+      // the class too (`if (C.instance) return C.instance;`).
+      const runtimeInstance =
+        info.localClass === undefined &&
+        isJsSourceFile(ctor.getSourceFile()) &&
+        [...returns].some(([stmt, kind]) => kind === "mixed" && !insideFinallyTry(stmt, ctor));
+      if ([...returns.values()].includes("instance") || runtimeInstance) {
+        slot = {
+          id: `%g.${info.def.name}.%constructorResult`,
+          name: `${info.def.name}.%constructorResult`,
+          type: lowerer.withUndefinedArm(instanceType(info)),
+          mutable: true,
+        };
+        lowerer.globalsList.push(slot);
+      }
+      plan = { returns, slot };
+    }
+  }
+  byClass.set(info.def.name, plan);
+  return plan;
+}
+
+function foreignObjectFeature(info: ClassInfo): string {
+  const display = info.def.name.replace(/^%|^%m\d+\./, "");
+  return `returning an object other than an instance of the class from a constructor (Node's 'new ${display}()' answers the returned object, which has no representation as a '${display}' instance)`;
+}
+
+/** `return <expr>` inside a class constructor whose value may be an
+ * object. Null when the statement keeps the ordinary lowering. */
+export function lowerConstructorReturn(lowerer: Lowerer, stmt: ts.ReturnStatement): IrStmt | null {
+  const info = lowerer.currentClass;
+  if (info === null || info.ctor === null || stmt.expression === undefined) return null;
+  let fn: ts.Node | undefined = stmt.parent;
+  while (fn !== undefined && !ts.isFunctionLike(fn) && !ts.isClassLikeDeclaration(fn))
+    fn = fn.parent;
+  if (fn !== info.ctor) return null;
+  const plan = constructorReturnPlan(lowerer, info);
+  const kind = plan?.returns.get(stmt);
+  if (plan === null || kind === undefined) return null;
+  const loc = locOf(stmt);
+  if (kind === "instance") {
+    const value = lowerer.coerceInto(
+      stmt.expression,
+      lowerer.lowerExpr(stmt.expression),
+      plan.slot!.type,
+    );
+    return {
+      kind: "block",
+      body: [
+        { kind: "assign", localId: plan.slot!.id, value, loc },
+        { kind: "return", value: null, loc },
+      ],
+      loc,
+    };
+  }
+  const feature = foreignObjectFeature(info);
+  if (kind === "object" || !isJsSourceFile(stmt.getSourceFile()))
+    lowerer.unsupported("SC1090", stmt, feature);
+  // A JavaScript value that is an object only sometimes: a primitive
+  // still answers the constructed instance, an object refuses.
+  const value = lowerer.coerceToExpected(lowerer.lowerExpr(stmt.expression), DYN);
+  if (value.type.kind !== "dyn") lowerer.unsupported("SC1090", stmt, feature);
+  const held = lowerer.declareHiddenLocal("%returned", DYN);
+  const read = varRef(held.id, DYN, loc);
+  const typeOf: IrExpr = { kind: "libCall", fn: "dyn.typeof", args: [read], type: STRING, loc };
+  const typeIs = (name: string): IrExpr => ({
+    kind: "strEq",
+    negated: false,
+    left: typeOf,
+    right: { kind: "strLit", value: name, type: STRING, loc },
+    type: BOOL,
+    loc,
+  });
+  const diag = unsupportedDiag("SC1090", loc, feature);
+  lowerer.runtimeFences.push(diag);
+  const sf = stmt.getSourceFile();
+  const line = ts.getLineAndCharacterOfPosition(sf, loc.start).line + 1;
+  return {
+    kind: "block",
+    body: [
+      { kind: "varDecl", localId: held.id, init: value, loc },
+      {
+        kind: "if",
+        // null answers "object" and is falsy; every object is truthy.
+        cond: {
+          kind: "logical",
+          op: "||",
+          left: typeIs("function"),
+          right: {
+            kind: "logical",
+            op: "&&",
+            left: typeIs("object"),
+            right: lowerer.ensureBool(read, stmt.expression),
+            type: BOOL,
+            loc,
+          },
+          type: BOOL,
+          loc,
+        },
+        then: [
+          ...(plan.slot !== null && !insideFinallyTry(stmt, info.ctor)
+            ? [
+                {
+                  kind: "if" as const,
+                  cond: {
+                    kind: "libCall" as const,
+                    fn: "dyn.typedRefIs" as const,
+                    args: [
+                      read,
+                      {
+                        kind: "strLit" as const,
+                        value: typeKey(instanceType(info)),
+                        type: STRING,
+                        loc,
+                      },
+                    ],
+                    type: BOOL,
+                    loc,
+                  },
+                  then: [
+                    {
+                      kind: "assign" as const,
+                      localId: plan.slot.id,
+                      value: lowerer.coerceToExpected(
+                        lowerer.coerceToExpected(read, instanceType(info)),
+                        plan.slot.type,
+                      ),
+                      loc,
+                    },
+                    { kind: "return" as const, value: null, loc },
+                  ],
+                  else_: null,
+                  loc,
+                },
+              ]
+            : []),
+          {
+            kind: "runtimeFence",
+            code: diag.code,
+            message: `${diag.message} [${diag.code} at ${loc.file}:${line}]`,
+            loc,
+          },
+        ],
+        else_: null,
+        loc,
+      },
+      { kind: "return", value: null, loc },
+    ],
+    loc,
+  };
+}
+
+/** The value of a construction of exactly class `C`: the constructed
+ * instance, or the instance the constructor returned. Unchanged for
+ * classes without a result slot. The slot is read and cleared by a
+ * per-class helper, so every construction site (direct `new`, class
+ * values, the checked dynamic dispatchers) shares one protocol. */
+export function constructedValue(lowerer: Lowerer, info: ClassInfo, constructed: IrExpr): IrExpr {
+  const slot = constructorReturnPlan(lowerer, info)?.slot;
+  if (slot === null || slot === undefined) return constructed;
+  const loc = constructed.loc;
+  const type = instanceType(info);
+  const name = `%${info.def.name}.%constructed`;
+  if (!lowerer.liftedFns.some((fn) => fn.name === name)) {
+    const instance = { id: "instance.0", name: "instance", type, mutable: false };
+    const returned = { id: "returned.0", name: "returned", type: slot.type, mutable: false };
+    lowerer.liftedFns.push({
+      name,
+      params: [{ localId: instance.id, name: instance.name, type }],
+      returnType: type,
+      locals: [instance, returned],
+      body: [
+        { kind: "varDecl", localId: returned.id, init: varRef(slot.id, slot.type, loc), loc },
+        { kind: "assign", localId: slot.id, value: lowerer.wrappedUndefined(slot.type, loc)!, loc },
+        {
+          kind: "return",
+          value: {
+            kind: "orDefault",
+            left: varRef(returned.id, slot.type, loc),
+            right: varRef(instance.id, type, loc),
+            type,
+            loc,
+          },
+          loc,
+        },
+      ],
+      loc,
+    });
+  }
+  return { kind: "call", callee: name, args: [constructed], type, loc };
+}
+
+/** A construction through a class value whose static class is `info`: the
+ * value holds `info` itself or a descendant. Descendants of a class with a
+ * result slot refuse at their `super()`, so only `info`'s own slot can
+ * apply; a descendant with its own slot has no static home here. */
+export function constructedFromValue(
+  lowerer: Lowerer,
+  info: ClassInfo,
+  constructed: IrExpr,
+  blame: ts.Node,
+): IrExpr {
+  const pending = [...info.subclasses];
+  while (pending.length > 0) {
+    const sub = pending.pop()!;
+    pending.push(...sub.subclasses);
+    const plan = constructorReturnPlan(lowerer, sub);
+    if (plan === null || plan.slot === null) continue;
+    const display = sub.def.name.replace(/^%|^%m\d+\./, "");
+    lowerer.unsupported(
+      "SC1090",
+      blame,
+      `constructing through a class value that may hold '${display}', whose constructor can return an existing instance`,
+    );
+  }
+  return constructedValue(lowerer, info, constructed);
+}
+
+/** `super()` into a class with a result slot, from the constructor of
+ * class `sub`: `call` runs the base constructor over `self` (the
+ * subclass's `this`, upcast to the base). Node rebinds the subclass's
+ * `this` to an instance the base constructor returns, which has no
+ * representation. A TypeScript subclass refuses. In JavaScript the base
+ * stores the instance it returns in its slot, and a per-subclass helper
+ * reads and clears the slot after the call: an instance other than `self`
+ * refuses at run time. Unchanged for bases without a result slot. */
+export function superIntoResultSlot(
+  lowerer: Lowerer,
+  base: ClassInfo,
+  sub: ClassInfo,
+  call: IrStmt,
+  self: IrExpr,
+  blame: ts.Node,
+): IrStmt {
+  const plan = constructorReturnPlan(lowerer, base);
+  if (plan === null || plan.slot === null) return call;
+  const slot = plan.slot;
+  const display = base.def.name.replace(/^%|^%m\d+\./, "");
+  const feature = `extending a class whose constructor can return an existing instance ('super()' would rebind 'this' to the instance '${display}' returns)`;
+  if (!isJsSourceFile(blame.getSourceFile())) {
+    lowerer.unsupported("SC1090", blame, feature);
+    return call;
+  }
+  const loc = locOf(blame);
+  const type = instanceType(base);
+  const name = `%${sub.def.name}.%superResult`;
+  if (!lowerer.liftedFns.some((fn) => fn.name === name)) {
+    const diag = unsupportedDiag("SC1090", loc, feature);
+    lowerer.runtimeFences.push(diag);
+    const line = ts.getLineAndCharacterOfPosition(blame.getSourceFile(), loc.start).line + 1;
+    const instance = { id: "instance.0", name: "instance", type, mutable: false };
+    const returned = { id: "returned.0", name: "returned", type: slot.type, mutable: false };
+    lowerer.liftedFns.push({
+      name,
+      params: [{ localId: instance.id, name: instance.name, type }],
+      returnType: VOID,
+      locals: [instance, returned],
+      body: [
+        { kind: "varDecl", localId: returned.id, init: varRef(slot.id, slot.type, loc), loc },
+        { kind: "assign", localId: slot.id, value: lowerer.wrappedUndefined(slot.type, loc)!, loc },
+        {
+          kind: "if",
+          cond: {
+            kind: "bin",
+            op: "!==",
+            left: {
+              kind: "orDefault",
+              left: varRef(returned.id, slot.type, loc),
+              right: varRef(instance.id, type, loc),
+              type,
+              loc,
+            },
+            right: varRef(instance.id, type, loc),
+            type: BOOL,
+            loc,
+          },
+          then: [
+            {
+              kind: "runtimeFence",
+              code: diag.code,
+              message: `${diag.message} [${diag.code} at ${loc.file}:${line}]`,
+              loc,
+            },
+          ],
+          else_: null,
+          loc,
+        },
+        { kind: "return", value: null, loc },
+      ],
+      loc,
+    });
+  }
+  const check: IrStmt = {
+    kind: "exprStmt",
+    expr: { kind: "call", callee: name, args: [self], type: VOID, loc },
+    loc,
+  };
+  return { kind: "block", body: [call, check], loc };
+}
diff --git a/packages/compiler/src/frontend/lowering/containers/bytes.ts b/packages/compiler/src/frontend/lowering/containers/bytes.ts
index 7f1f758ca..c5a41cf32 100644
--- a/packages/compiler/src/frontend/lowering/containers/bytes.ts
+++ b/packages/compiler/src/frontend/lowering/containers/bytes.ts
@@ -20,6 +20,7 @@ import {
   arrayOf,
   bytesOf,
   funcOf,
+  isUnitType,
   typeEquals,
 } from "../../../ir/ir.js";
 import { isJsSourceFile, locOf } from "../../program.js";
@@ -554,9 +555,9 @@ export function lowerBytesMethodCall(
         const nameSym = lowerer.checker.getSymbolAtLocation(access.name);
         return (
           nameSym !== undefined &&
-          lowerer.checker
-            .declarationsOf(nameSym)
-            .some((d) => ts.isInterfaceDeclaration(d.parent) && d.parent.name.text === "Buffer")
+          nameSym.declarations.some(
+            (d) => ts.isInterfaceDeclaration(d.parent) && d.parent.name.text === "Buffer",
+          )
         );
       })();
     const method = name === "subarray" || declaredOnBuffer ? "subarray" : "slice";
@@ -580,13 +581,11 @@ export function lowerBytesMethodCall(
       const symbol = lowerer.checker.getSymbolAtLocation(access.name);
       return (
         symbol !== undefined &&
-        lowerer.checker
-          .declarationsOf(symbol)
-          .some(
-            (declaration) =>
-              ts.isInterfaceDeclaration(declaration.parent) &&
-              declaration.parent.name.text === "Buffer",
-          )
+        symbol.declarations.some(
+          (declaration) =>
+            ts.isInterfaceDeclaration(declaration.parent) &&
+            declaration.parent.name.text === "Buffer",
+        )
       );
     })()
   ) {
@@ -646,9 +645,9 @@ export function lowerBytesMethodCall(
       const nameSym = lowerer.checker.getSymbolAtLocation(access.name);
       return (
         nameSym !== undefined &&
-        lowerer.checker
-          .declarationsOf(nameSym)
-          .some((d) => ts.isInterfaceDeclaration(d.parent) && d.parent.name.text === "Buffer")
+        nameSym.declarations.some(
+          (d) => ts.isInterfaceDeclaration(d.parent) && d.parent.name.text === "Buffer",
+        )
       );
     })();
     if (receiverIr.elem !== "u8" || !declaredOnBuffer) {
@@ -724,9 +723,9 @@ export function lowerBytesMethodCall(
     const nameSym = lowerer.checker.getSymbolAtLocation(access.name);
     return (
       nameSym !== undefined &&
-      lowerer.checker
-        .declarationsOf(nameSym)
-        .some((d) => ts.isInterfaceDeclaration(d.parent) && d.parent.name.text === "Buffer")
+      nameSym.declarations.some(
+        (d) => ts.isInterfaceDeclaration(d.parent) && d.parent.name.text === "Buffer",
+      )
     );
   })();
   if (declOnBuffer && receiverIr.elem === "u8") {
@@ -1273,16 +1272,14 @@ function knownBufferProducer(
     const symbol = lowerer.checker.getSymbolAtLocation(node);
     if (!symbol || seen.has(symbol)) return false;
     seen.add(symbol);
-    return lowerer.checker
-      .declarationsOf(symbol)
-      .some(
-        (decl) =>
-          ts.isVariableDeclaration(decl) &&
-          ts.isVariableDeclarationList(decl.parent) &&
-          (decl.parent.flags & ts.NodeFlags.Const) !== 0 &&
-          decl.initializer !== undefined &&
-          knownBufferProducer(lowerer, decl.initializer, seen),
-      );
+    return symbol.declarations.some(
+      (decl) =>
+        ts.isVariableDeclaration(decl) &&
+        ts.isVariableDeclarationList(decl.parent) &&
+        (decl.parent.flags & ts.NodeFlags.Const) !== 0 &&
+        decl.initializer !== undefined &&
+        knownBufferProducer(lowerer, decl.initializer, seen),
+    );
   }
   if (!ts.isCallExpression(node)) return false;
   const callee = node.expression;
@@ -1429,7 +1426,14 @@ function lowerBufferStaticValue(
           }
           return { kind: "libCall", fn, args: [s, enc], type: BYTES_U8, loc };
         }
-        if (args.length === 1 && srcIr?.kind === "bytes" && srcIr.elem === "u8") {
+        // A checker type with no mapping (pako's conditional `O extends
+        // { toText: true } ? string : Uint8Array` result) whose lowered
+        // value is a u8 view copies like the typed form.
+        if (
+          args.length === 1 &&
+          ((srcIr?.kind === "bytes" && srcIr.elem === "u8") ||
+            (srcIr === null && value.type.kind === "bytes" && value.type.elem === "u8"))
+        ) {
           return {
             kind: "libCall",
             fn: "buffer.poolFromBytes",
@@ -1447,6 +1451,34 @@ function lowerBufferStaticValue(
             loc,
           };
         }
+        // A union of strings, u8 views and undefined/null (a JS-inferred
+        // npm result such as pako's deflate): the checked form dispatches
+        // on the runtime kind exactly as for an untyped JS value, Node's
+        // TypeError for the unit arms included.
+        if (
+          args.length === 1 &&
+          value.type.kind === "union" &&
+          lowerer.dynConvertible(value.type) &&
+          lowerer.unions
+            .get(value.type.unionId)
+            ?.arms.every(
+              (arm) =>
+                arm.kind === "string" ||
+                (arm.kind === "bytes" && arm.elem === "u8") ||
+                isUnitType(arm),
+            ) === true
+        ) {
+          return {
+            kind: "libCall",
+            fn: "buffer.poolFromDyn",
+            args: [
+              lowerer.coerceToExpected(value, DYN),
+              { kind: "strLit", value: "utf8", type: STRING, loc },
+            ],
+            type: BYTES_U8,
+            loc,
+          };
+        }
       }
     }
     lowerer.noLowering(
@@ -1659,6 +1691,12 @@ function lowerBufferStaticValue(
           };
         }
       }
+      // A typed view of unknown provenance (a Uint8Array parameter,
+      // safe-buffer's Buffer.from result): Buffer is a brand of the view,
+      // which the runtime keeps, so the test reads it.
+      if (v.type.kind === "bytes") {
+        return { kind: "libCall", fn: "buffer.isBranded", args: [v], type: BOOL, loc };
+      }
       lowerer.noLowering(
         `Buffer.isBuffer of '${lowerer.fmt(v.type)}' values`,
         args[0]!,
diff --git a/packages/compiler/src/frontend/lowering/containers/for-of.ts b/packages/compiler/src/frontend/lowering/containers/for-of.ts
index 79f970eb1..2331ee25a 100644
--- a/packages/compiler/src/frontend/lowering/containers/for-of.ts
+++ b/packages/compiler/src/frontend/lowering/containers/for-of.ts
@@ -153,7 +153,7 @@ export function lowerForOfSearchParams(
           }
         : singleRead();
       if (ts.isIdentifier(decl.name)) {
-        const varTarget = forOfVarTarget(lowerer, decl);
+        const varTarget = forOfVarTarget(lowerer, decl, elemT!);
         if (varTarget) {
           // `for (var x of ...)`: one function-scoped binding, assigned
           // per pass — closures made in the loop share it, and the value
@@ -357,7 +357,7 @@ export function lowerForOfArrayIter(
           }
         : keyRead();
       if (ts.isIdentifier(decl.name)) {
-        const varTarget = forOfVarTarget(lowerer, decl);
+        const varTarget = forOfVarTarget(lowerer, decl, declT!);
         if (varTarget) {
           // `for (var x of ...)`: one function-scoped binding, assigned
           // per pass — closures made in the loop share it, and the value
@@ -650,7 +650,7 @@ function lowerForOfMapOrSet(
             }
           : singleRead();
         if (ts.isIdentifier(decl!.name)) {
-          const varTarget = forOfVarTarget(lowerer, decl!);
+          const varTarget = forOfVarTarget(lowerer, decl!, elemT!);
           if (varTarget) {
             // `for (var x of ...)`: one function-scoped binding, assigned
             // per pass — closures made in the loop share it, and the value
diff --git a/packages/compiler/src/frontend/lowering/containers/indexed-objects.ts b/packages/compiler/src/frontend/lowering/containers/indexed-objects.ts
index 38df368ac..450e64142 100644
--- a/packages/compiler/src/frontend/lowering/containers/indexed-objects.ts
+++ b/packages/compiler/src/frontend/lowering/containers/indexed-objects.ts
@@ -810,6 +810,7 @@ export function lowerRecordOvfCaptureHelper(
   // Every source declared field must flow into the keyed-write slot —
   // in DECLARATION order (insertion order below; declaredOrder omits
   // internal '%'-fields, which never enter the copy).
+  lowerer.keyOrder.observed.add(from.id);
   const orderedFields = from.declaredOrder
     ? from.declaredOrder.flatMap((n) => {
         const f = from.fields.find((x) => x.name === n);
@@ -1097,6 +1098,7 @@ export function lowerObjectAssignIndexShape(
     const from = lowerer.shapes.get(srcIr.shapeId);
     if (!from || from.tuple) return null;
     if (from.fields.some((f) => f.name.startsWith("%"))) return null;
+    lowerer.keyOrder.observed.add(from.id);
     const orderedFields = from.declaredOrder
       ? from.declaredOrder.flatMap((n) => {
           const f = from.fields.find((x) => x.name === n);
diff --git a/packages/compiler/src/frontend/lowering/containers/iterator-helpers.ts b/packages/compiler/src/frontend/lowering/containers/iterator-helpers.ts
index aeefffe48..46074573d 100644
--- a/packages/compiler/src/frontend/lowering/containers/iterator-helpers.ts
+++ b/packages/compiler/src/frontend/lowering/containers/iterator-helpers.ts
@@ -298,7 +298,7 @@ function isHelperObject(lowerer: Lowerer, expr: ts.Expression): boolean {
   if (isStageCall(lowerer, expr)) return true;
   if (!ts.isIdentifier(expr)) return false;
   const symbol = lowerer.resolveValueSymbol(expr);
-  const decl = symbol ? lowerer.checker.valueDeclarationOf(symbol) : undefined;
+  const decl = symbol ? symbol.valueDeclaration : undefined;
   if (
     !decl ||
     !ts.isVariableDeclaration(decl) ||
@@ -1800,9 +1800,15 @@ function foldStages(
         ...inner(value),
       ];
     } else {
+      // A take before this stage sets `done` as it delivers its last
+      // value, which still flattens in full: the inner walk runs with the
+      // flag clear, and keeps it set afterwards.
+      const afterTake = slots.slice(0, si).some((slot) => slot.kind === "take");
       emit = (value) => {
         const innerT = s.fnT!.ret;
         const innerId = frame.local("fm", innerT, false);
+        const heldId = afterTake ? frame.local("held", BOOL, false) : undefined;
+        const walk = walkInner(lowerer, frame, innerId, innerT, done(), inner, loc);
         return [
           {
             kind: "varDecl",
@@ -1811,7 +1817,26 @@ function foldStages(
             loc,
           },
           ...(s.cntId !== undefined ? [frame.bump(s.cntId)] : []),
-          ...walkInner(lowerer, frame, innerId, innerT, done(), inner, loc),
+          ...(heldId === undefined
+            ? walk
+            : [
+                { kind: "varDecl", localId: heldId, init: done(), loc } as IrStmt,
+                { kind: "assign", localId: doneId, value: boolLit(false, loc), loc } as IrStmt,
+                ...walk,
+                {
+                  kind: "assign",
+                  localId: doneId,
+                  value: {
+                    kind: "logical",
+                    op: "||",
+                    left: varRef(heldId, BOOL, loc),
+                    right: done(),
+                    type: BOOL,
+                    loc,
+                  },
+                  loc,
+                } as IrStmt,
+              ]),
         ];
       };
     }
diff --git a/packages/compiler/src/frontend/lowering/containers/string-and-regexp.ts b/packages/compiler/src/frontend/lowering/containers/string-and-regexp.ts
index 832dc7def..39154a820 100644
--- a/packages/compiler/src/frontend/lowering/containers/string-and-regexp.ts
+++ b/packages/compiler/src/frontend/lowering/containers/string-and-regexp.ts
@@ -1,5 +1,12 @@
 import { matchAllRowsReadByElements } from "./match-row-uses.js";
-import { dynUndefinedExpr, nodeThrowExpr, numLit, strLit, varRef } from "../../../ir/build.js";
+import {
+  boolLit,
+  dynUndefinedExpr,
+  nodeThrowExpr,
+  numLit,
+  strLit,
+  varRef,
+} from "../../../ir/build.js";
 import * as ts from "../../ts7/adapter.js";
 import {
   BOOL,
@@ -316,6 +323,21 @@ export function lowerStringIndexCall(
   ) {
     index = lowerer.coerceInto(indexNode, index, DYN);
   }
+  return stringIndexHelperCall(lowerer, call, method, receiver, receiverNode, index, indexNode);
+}
+
+/** The relative-index / code-point helper call over an already lowered
+ * index (any type positionNumber converts — dyn indices included). */
+function stringIndexHelperCall(
+  lowerer: Lowerer,
+  call: ts.CallExpression,
+  method: "at" | "codePointAt",
+  receiver: IrExpr,
+  receiverNode: ts.Node,
+  index: IrExpr,
+  indexNode: ts.Expression | undefined,
+): IrExpr {
+  const loc = locOf(call);
   const valueType = method === "at" ? STRING : F64;
   const resultType = lowerer.withUndefinedArmOf(valueType);
   if (!resultType || resultType.kind !== "union")
@@ -1061,7 +1083,8 @@ export function lowerStringMethodCall(
   const replaceMethod = STRING_REPLACE_METHODS.has(access.name.text)
     ? (access.name.text as "replace" | "replaceAll")
     : null;
-  if (!entry && !indexMethod && !replaceMethod) return null;
+  const extraMethod = EXTRA_STRING_METHODS.has(access.name.text);
+  if (!entry && !indexMethod && !replaceMethod && !extraMethod) return null;
   // A validated dyn receiver (`pkg.name.replace(...)` on a JSON.parse
   // value) arrives pre-extracted through `dynReceiver`; its checker type
   // is `any`, so the type/symbol gates don't apply — the dyn value's
@@ -1089,6 +1112,12 @@ export function lowerStringMethodCall(
       return null;
     if (!lowerer.isStdlibMember(access)) return null;
   }
+  if (extraMethod && argumentNodes === call.arguments.nodes) {
+    const receiver = dynReceiver
+      ? dynReceiver()
+      : lowerMethodReceiver(lowerer, access.expression, STRING, access.name.text);
+    return lowerExtraStringMethodCall(lowerer, call, access.name.text, receiver, access.expression);
+  }
   // The lib declares optional parameters beyond some lowered forms; fence
   // those arities instead of passing arguments the runtime doesn't take.
   if (
@@ -1386,3 +1415,393 @@ function lowerLocaleCompareCall(
     lowerer.badType(call.arguments.nodes[0]!, lowerer.typeOf(call.arguments.nodes[0]!));
   return { kind: "libCall", fn: "str.localeCompare", args: [receiver, arg], type: F64, loc };
 }
+
+/* ── String.prototype / Number.prototype members beyond the core tables ──
+ * substr, the locale case pair, the Annex B HTML methods, toPrecision and
+ * toExponential(fractionDigits) on typed receivers, plus the kind dispatch
+ * for every String/Number method a checked-dynamic receiver can name
+ * whose runtime dispatch had no answer (`character.codePointAt(0)` in a
+ * JS package, `n.toPrecision(3)` on a JS-inferred number). Each path
+ * replaces a compile-time refusal, a runtime 'not supported yet' fence or
+ * Node's is-not-a-function answer for a real method, so programs that
+ * never spell these names compile exactly as before. */
+
+/** String.prototype members (Annex B included) whose typed-receiver
+ * lowering lives here. */
+export const EXTRA_STRING_METHODS: ReadonlySet<string> = new Set([
+  "substr",
+  "toLocaleLowerCase",
+  "toLocaleUpperCase",
+  "anchor",
+  "big",
+  "blink",
+  "bold",
+  "fixed",
+  "fontcolor",
+  "fontsize",
+  "italics",
+  "link",
+  "small",
+  "strike",
+  "sub",
+  "sup",
+]);
+
+/** String methods a dyn receiver dispatches by runtime kind here: a string
+ * runs the typed lowering, every other kind takes the runtime dispatch
+ * (an object's own member, Node's is-not-a-function otherwise). Only names
+ * no other dyn kind's prototype declares: the shared ones (at, concat,
+ * slice, ...) already dispatch at run time for arrays, and a kind test in
+ * front of them would change array code that works today. The Annex B
+ * HTML names (bold, italics, link, ...) stay out too: chalk-style builders
+ * call them on functions and objects, whose calls must stay as they are. */
+const DYN_STRING_KIND_METHODS: ReadonlySet<string> = new Set([
+  "substr",
+  "toLocaleLowerCase",
+  "toLocaleUpperCase",
+  "codePointAt",
+  "isWellFormed",
+  "toWellFormed",
+  "trimLeft",
+  "trimRight",
+]);
+
+/** Number methods a dyn receiver dispatches by runtime kind here. */
+const DYN_NUMBER_KIND_METHODS: ReadonlySet<string> = new Set(["toPrecision", "toExponential"]);
+
+/** Annex B CreateHTML: the tag and the attribute (null for none). */
+const HTML_METHODS: Readonly<Record<string, readonly [string, string | null]>> = {
+  anchor: ["a", "name"],
+  big: ["big", null],
+  blink: ["blink", null],
+  bold: ["b", null],
+  fixed: ["tt", null],
+  fontcolor: ["font", "color"],
+  fontsize: ["font", "size"],
+  italics: ["i", null],
+  link: ["a", "href"],
+  small: ["small", null],
+  strike: ["strike", null],
+  sub: ["sub", null],
+  sup: ["sup", null],
+};
+
+export function isDynPrimitiveKindMethod(name: string): boolean {
+  return DYN_STRING_KIND_METHODS.has(name) || DYN_NUMBER_KIND_METHODS.has(name);
+}
+
+/** Evaluate `value` once into a hidden local (effect-free reads stay). */
+function hoist(lowerer: Lowerer, value: IrExpr, stmts: IrStmt[], name: string): IrExpr {
+  if (
+    value.kind === "varRef" ||
+    value.kind === "numLit" ||
+    value.kind === "strLit" ||
+    value.kind === "boolLit" ||
+    value.kind === "unitLit"
+  )
+    return value;
+  const local = lowerer.declareHiddenLocal(name, value.type);
+  stmts.push({ kind: "varDecl", localId: local.id, init: value, loc: value.loc });
+  return varRef(local.id, value.type, value.loc);
+}
+
+function seq(stmts: IrStmt[], result: IrExpr): IrExpr {
+  return stmts.length === 0
+    ? result
+    : { kind: "seqExpr", stmts, result, type: result.type, loc: result.loc };
+}
+
+/** ToString of a method argument: the dyn coercion (symbols throw), the
+ * typed conversions elsewhere. */
+function stringArg(lowerer: Lowerer, value: IrExpr, node: ts.Node): IrExpr {
+  if (value.type.kind === "dyn")
+    return {
+      kind: "libCall",
+      fn: "dyn.toStringCoerce",
+      args: [value],
+      type: STRING,
+      loc: value.loc,
+    };
+  return lowerer.ensureString(value, node);
+}
+
+/** An optional numeric argument: its ToNumber value and whether it was
+ * supplied (undefined counts as absent, as the spec's checks do). */
+function optionalNumber(
+  lowerer: Lowerer,
+  value: IrExpr | undefined,
+  node: ts.Expression,
+  stmts: IrStmt[],
+  subject: string,
+  loc: SrcLoc,
+): { value: IrExpr; has: IrExpr } {
+  if (!value || value.type.kind === "undefinedT" || value.type.kind === "void")
+    return { value: numLit(0, loc), has: boolLit(false, loc) };
+  if (
+    value.type.kind === "f64" ||
+    value.type.kind === "string" ||
+    value.type.kind === "bool" ||
+    value.type.kind === "nullT"
+  )
+    return {
+      value: positionNumber(lowerer, value, numLit(0, loc), node, subject),
+      has: boolLit(true, loc),
+    };
+  const boxed =
+    value.type.kind === "dyn"
+      ? value
+      : hoist(lowerer, lowerer.coerceToExpected(value, DYN), stmts, "%numArg");
+  const absent: IrExpr = { kind: "dynTest", test: "undefined", value: boxed, type: BOOL, loc };
+  return {
+    value: positionNumber(lowerer, boxed, numLit(0, loc), node, subject),
+    has: { kind: "unary", op: "!", operand: absent, type: BOOL, loc },
+  };
+}
+
+/** The typed result of a String.prototype member over a STRING receiver
+ * and already evaluated arguments, or null when the name is not one of
+ * this module's. */
+function buildStringMethod(
+  lowerer: Lowerer,
+  call: ts.CallExpression,
+  name: string,
+  s: IrExpr,
+  args: IrExpr[],
+  receiverNode: ts.Node,
+  stmts: IrStmt[],
+): IrExpr | null {
+  const loc = locOf(call);
+  const node = (i: number): ts.Expression => call.arguments.nodes[i] ?? call;
+  if (name === "substr") {
+    const start = args[0]
+      ? positionNumber(lowerer, args[0], numLit(0, loc), node(0), "substr start")
+      : numLit(0, loc);
+    const length = optionalNumber(lowerer, args[1], node(1), stmts, "substr length", loc);
+    return {
+      kind: "libCall",
+      fn: "str.substr",
+      args: [s, start, length.value, length.has],
+      type: STRING,
+      loc,
+    };
+  }
+  if (name === "toLocaleLowerCase" || name === "toLocaleUpperCase") {
+    const locales = args[0] ? lowerer.coerceToExpected(args[0], DYN) : dynUndefinedExpr(loc);
+    return {
+      kind: "libCall",
+      fn: "str.localeCase",
+      args: [s, locales, boolLit(name === "toLocaleUpperCase", loc)],
+      type: STRING,
+      loc,
+    };
+  }
+  const html = Object.hasOwn(HTML_METHODS, name) ? HTML_METHODS[name] : undefined;
+  if (html) {
+    const [tag, attribute] = html;
+    const subject = hoist(lowerer, s, stmts, "%htmlSubject");
+    const pieces: IrExpr[] = [strLit(`<${tag}`, loc)];
+    if (attribute !== null) {
+      const text = args[0] ? stringArg(lowerer, args[0], node(0)) : strLit("undefined", loc);
+      pieces.push(strLit(` ${attribute}="`, loc));
+      pieces.push({
+        kind: "libCall",
+        fn: "str.replaceLiteral",
+        args: [text, strLit('"', loc), strLit("&quot;", loc), boolLit(true, loc)],
+        type: STRING,
+        loc,
+      });
+      pieces.push(strLit('"', loc));
+    }
+    pieces.push(strLit(">", loc), subject, strLit(`</${tag}>`, loc));
+    return pieces.reduce((left, right) => ({ kind: "strConcat", left, right, type: STRING, loc }));
+  }
+  if (name === "codePointAt")
+    return stringIndexHelperCall(
+      lowerer,
+      call,
+      name,
+      s,
+      receiverNode,
+      args[0] ?? numLit(0, loc),
+      call.arguments.nodes[0],
+    );
+  if (name === "isWellFormed" || name === "toWellFormed")
+    return {
+      kind: "strIntrinsic",
+      method: name,
+      receiver: s,
+      args: [],
+      type: name === "isWellFormed" ? BOOL : STRING,
+      loc,
+    };
+  if (name === "trimLeft" || name === "trimRight")
+    return {
+      kind: "strIntrinsic",
+      method: name === "trimLeft" ? "trimStart" : "trimEnd",
+      receiver: s,
+      args: [],
+      type: STRING,
+      loc,
+    };
+  return null;
+}
+
+/** The typed result of toPrecision/toExponential over an F64 receiver. */
+function buildNumberMethod(
+  lowerer: Lowerer,
+  call: ts.CallExpression,
+  name: string,
+  x: IrExpr,
+  args: IrExpr[],
+  stmts: IrStmt[],
+): IrExpr | null {
+  const loc = locOf(call);
+  if (name !== "toPrecision" && name !== "toExponential") return null;
+  const digits = optionalNumber(
+    lowerer,
+    args[0],
+    call.arguments.nodes[0] ?? call,
+    stmts,
+    `${name} digits`,
+    loc,
+  );
+  if (name === "toPrecision")
+    return {
+      kind: "libCall",
+      fn: "num.toPrecision",
+      args: [x, digits.value, digits.has],
+      type: STRING,
+      loc,
+    };
+  const shortest: IrExpr = {
+    kind: "libCall",
+    fn: "num.toExponential",
+    args: [x],
+    type: STRING,
+    loc,
+  };
+  if (digits.has.kind === "boolLit" && !digits.has.value) return shortest;
+  const fixed: IrExpr = {
+    kind: "libCall",
+    fn: "num.toExponentialDigits",
+    args: [x, digits.value],
+    type: STRING,
+    loc,
+  };
+  if (digits.has.kind === "boolLit") return fixed;
+  return { kind: "ternary", cond: digits.has, then: fixed, else_: shortest, type: STRING, loc };
+}
+
+/** Evaluate the call's arguments, in order, into hidden locals. */
+function evaluatedArgs(
+  lowerer: Lowerer,
+  call: ts.CallExpression,
+  stmts: IrStmt[],
+  expected: IrType | undefined,
+): IrExpr[] {
+  return call.arguments.nodes.map((arg) =>
+    hoist(
+      lowerer,
+      expected ? lowerer.lowerExprExpecting(arg, expected) : lowerer.lowerExpr(arg),
+      stmts,
+      "%methodArg",
+    ),
+  );
+}
+
+/** A typed STRING receiver calling one of EXTRA_STRING_METHODS: receiver,
+ * then arguments, then the method's own conversions — the spec order. */
+export function lowerExtraStringMethodCall(
+  lowerer: Lowerer,
+  call: ts.CallExpression,
+  name: string,
+  receiver: IrExpr,
+  receiverNode: ts.Node,
+): IrExpr | null {
+  if (call.arguments.nodes.some(ts.isSpreadElement)) return null;
+  const stmts: IrStmt[] = [];
+  const s = hoist(lowerer, receiver, stmts, "%stringReceiver");
+  const args = evaluatedArgs(lowerer, call, stmts, undefined);
+  const result = buildStringMethod(lowerer, call, name, s, args, receiverNode, stmts);
+  return result ? seq(stmts, result) : null;
+}
+
+/** A typed F64 receiver calling toPrecision(p) or toExponential(f). */
+export function lowerExtraNumberMethodCall(
+  lowerer: Lowerer,
+  call: ts.CallExpression,
+  name: string,
+  receiver: IrExpr,
+): IrExpr | null {
+  if (call.arguments.nodes.some(ts.isSpreadElement) || call.arguments.nodes.length > 1) return null;
+  if (name !== "toPrecision" && !(name === "toExponential" && call.arguments.nodes.length === 1))
+    return null;
+  const stmts: IrStmt[] = [];
+  const x = hoist(lowerer, receiver, stmts, "%numberReceiver");
+  const args = evaluatedArgs(lowerer, call, stmts, undefined);
+  const result = buildNumberMethod(lowerer, call, name, x, args, stmts);
+  return result ? seq(stmts, result) : null;
+}
+
+/** `recv.m(args)` on a checked-dynamic receiver for a String/Number method
+ * the runtime dispatch cannot answer: the receiver and arguments evaluate
+ * once, a string (or number) receiver runs the typed lowering, and every
+ * other kind keeps the runtime dispatch's answer. Null for other names. */
+export function lowerDynPrimitiveMethodCall(
+  lowerer: Lowerer,
+  call: ts.CallExpression,
+  name: string,
+  calleeName: string,
+  recv: IrExpr,
+): IrExpr | null {
+  const stringMethod = DYN_STRING_KIND_METHODS.has(name);
+  const numberMethod = DYN_NUMBER_KIND_METHODS.has(name);
+  if (!stringMethod && !numberMethod) return null;
+  if (call.arguments.nodes.some(ts.isSpreadElement)) return null;
+  const loc = locOf(call);
+  const stmts: IrStmt[] = [];
+  const local = lowerer.declareHiddenLocal("%primitiveReceiver", DYN);
+  stmts.push({ kind: "varDecl", localId: local.id, init: recv, loc });
+  const r = varRef(local.id, DYN, loc);
+  const args = evaluatedArgs(lowerer, call, stmts, DYN);
+  let result: IrExpr = {
+    kind: "dynInvoke",
+    recv: r,
+    method: name,
+    calleeName,
+    args,
+    type: DYN,
+    loc,
+  };
+  const branch = (
+    test: "string" | "number",
+    build: (value: IrExpr, branchStmts: IrStmt[]) => IrExpr | null,
+  ): void => {
+    const branchStmts: IrStmt[] = [];
+    const value: IrExpr = {
+      kind: "dynCheck",
+      value: r,
+      type: test === "string" ? STRING : F64,
+      loc,
+    };
+    const built = build(value, branchStmts);
+    if (!built) return;
+    result = {
+      kind: "ternary",
+      cond: { kind: "dynTest", test, value: r, type: BOOL, loc },
+      then: { kind: "dynFrom", value: seq(branchStmts, built), type: DYN, loc },
+      else_: result,
+      type: DYN,
+      loc,
+    };
+  };
+  if (numberMethod)
+    branch("number", (x, branchStmts) =>
+      buildNumberMethod(lowerer, call, name, x, args, branchStmts),
+    );
+  if (stringMethod)
+    branch("string", (s, branchStmts) =>
+      buildStringMethod(lowerer, call, name, s, args, call.expression, branchStmts),
+    );
+  return seq(stmts, result);
+}
diff --git a/packages/compiler/src/frontend/lowering/cycle-initialization.ts b/packages/compiler/src/frontend/lowering/cycle-initialization.ts
index 1e8b9e5a5..fb62fb998 100644
--- a/packages/compiler/src/frontend/lowering/cycle-initialization.ts
+++ b/packages/compiler/src/frontend/lowering/cycle-initialization.ts
@@ -41,6 +41,10 @@ export interface CycleInitFlag {
    * own module's early calls is checked opportunistically: whatever cannot
    * be checked keeps the unchecked behavior instead of refusing. */
   cycle: boolean;
+  /** A pointer-guarded binding declared without an initializer: its
+   * declaration initializes it (to undefined, which the pointer cannot
+   * hold), so the flag alone decides its writes (markUninitializedWrites). */
+  uninitialized?: true;
   /** A class binding: its references are the class's own IR forms and its
    * static field storage (`global` is the flag itself). */
   className?: string;
@@ -107,6 +111,30 @@ export function markCycleEarlyBindings(lowerer: Lowerer): void {
       registerInitFlag(lowerer, binding, global, false);
     }
   }
+  // `let f: T;` with a pointer-guarded slot: once the declaration ran the
+  // binding is initialized while the slot is still empty, so a write
+  // checks the flag (where code can run before the declaration) instead of
+  // the empty pointer. `f = () => f(...)` is the shape.
+  for (const [id, entry] of lowerer.uninitializedLexicalGlobals) {
+    const global = lowerer.globalsList.find((g) => g.id === id);
+    if (global === undefined) continue;
+    if (!lowerer.cycleInitFlags.has(id)) {
+      registerInitFlag(
+        lowerer,
+        {
+          symbol: entry.symbol,
+          name: entry.name,
+          kind: "lexical",
+          module: entry.module,
+          reference: entry.name,
+          settled: new Set(),
+        },
+        global,
+        false,
+      );
+    }
+    lowerer.cycleInitFlags.get(id)!.uninitialized = true;
+  }
 }
 
 /** A class that its module's early-running code can reach before the class
@@ -304,6 +332,22 @@ export function checkCycleBindingAccesses(lowerer: Lowerer, mod: IrModule): void
   const fileOfInit = new Map<string, ts.SourceFile>();
   for (const [sf, name] of lowerer.initNameOf) fileOfInit.set(name, sf);
   for (const fn of mod.functions) rewriteFunction(lowerer, fn, fileOfInit.get(fn.name));
+  markUninitializedWrites(lowerer, mod);
+}
+
+/** Writes to a binding declared without an initializer that run after its
+ * declaration store into an initialized binding whose slot may still be
+ * empty: the pointer guard must not refuse them. Writes that can run
+ * earlier carry the flag check rewriteFunction inserted. */
+function markUninitializedWrites(lowerer: Lowerer, mod: IrModule): void {
+  const ids = new Set<string>();
+  for (const [id, flag] of lowerer.cycleInitFlags) if (flag.uninitialized) ids.add(id);
+  if (ids.size === 0) return;
+  const mark = (s: IrStmt): IrStmt =>
+    s.kind === "assign" && !s.initializes && ids.has(s.localId) ? { ...s, initializes: true } : s;
+  const rewriteExpr = (e: IrExpr): IrExpr => mapExprChildren(e, rewriteExpr, rewriteStmt);
+  const rewriteStmt = (s: IrStmt): IrStmt => mark(mapStmtChildren(s, rewriteExpr, rewriteStmt));
+  for (const fn of mod.functions) fn.body = fn.body.map(rewriteStmt);
 }
 
 function rewriteFunction(
@@ -444,6 +488,7 @@ function rewriteFunction(
         kind: "assign",
         localId: s.localId,
         value: { kind: "varRef", localId: t, type: s.value.type, loc: s.loc },
+        ...(flag.uninitialized ? { initializes: true as const } : {}),
         loc: s.loc,
       };
       return {
diff --git a/packages/compiler/src/frontend/lowering/deferred-module-initializers.ts b/packages/compiler/src/frontend/lowering/deferred-module-initializers.ts
index 6b0b54b55..e3ca2270d 100644
--- a/packages/compiler/src/frontend/lowering/deferred-module-initializers.ts
+++ b/packages/compiler/src/frontend/lowering/deferred-module-initializers.ts
@@ -286,7 +286,7 @@ function registryInitializer(
     )
       return true;
     const symbol = lowerer.resolveValueSymbol(callee);
-    const declaration = symbol && lowerer.checker.valueDeclarationOf(symbol);
+    const declaration = symbol && symbol.valueDeclaration;
     if (!symbol || !declaration || !bindingNeverReassigned(lowerer, symbol, declaration))
       return false;
     if (ts.isFunctionDeclaration(declaration)) return true;
@@ -346,7 +346,7 @@ function registryInitializer(
     }
     if (packageSource && ts.isPropertyAccessExpression(node)) {
       const symbol = lowerer.checker.getSymbolAtLocation(node.name);
-      const declaration = symbol && lowerer.checker.valueDeclarationOf(symbol);
+      const declaration = symbol && symbol.valueDeclaration;
       const owner = ts.isIdentifier(node.expression)
         ? lowerer.resolveValueSymbol(node.expression)
         : undefined;
@@ -394,7 +394,7 @@ function registryInitializer(
     )
       return true;
     const symbol = lowerer.resolveValueSymbol(node);
-    const functionDeclaration = symbol && lowerer.checker.valueDeclarationOf(symbol);
+    const functionDeclaration = symbol && symbol.valueDeclaration;
     if (
       functionDeclaration &&
       ts.isFunctionDeclaration(functionDeclaration) &&
@@ -449,7 +449,7 @@ function registryOwnerIsData(
   symbol: ts.Symbol,
   statement: ts.Statement,
 ): boolean {
-  const declaration = lowerer.checker.valueDeclarationOf(symbol);
+  const declaration = symbol.valueDeclaration;
   if (
     !declaration ||
     !ts.isVariableDeclaration(declaration) ||
diff --git a/packages/compiler/src/frontend/lowering/divergences.ts b/packages/compiler/src/frontend/lowering/divergences.ts
index ceea9a3e3..36fbf48b9 100644
--- a/packages/compiler/src/frontend/lowering/divergences.ts
+++ b/packages/compiler/src/frontend/lowering/divergences.ts
@@ -23,6 +23,7 @@ import {
 } from "../../diagnostics/diagnostic.js";
 import { isCollationCovered } from "./collation-repertoire.js";
 import type { Lowerer } from "./lowerer.js";
+import { keptIdentityAssertion } from "./assertion-identity.js";
 
 /** How an identity-sensitive binding is used after a copy could replace it. */
 interface IdentityUse {
@@ -179,7 +180,7 @@ export function scanDivergences(
     if (!candidates.some((fn) => identityUsesOf(fn).some((u) => u !== null))) continue;
     const signature = safely(() => checker.getResolvedSignature(call));
     if (signature === undefined) continue;
-    const decl = safely(() => checker.signatureDeclaration(signature));
+    const decl = safely(() => signature.declaration);
     if (decl === undefined || !candidates.includes(decl as ts.FunctionLikeDeclaration)) continue;
     const fn = decl as ts.FunctionLikeDeclaration;
     const uses = identityUsesOf(fn);
@@ -217,6 +218,8 @@ export function scanDivergences(
   }
 
   for (const { decl, source, type } of castDecls) {
+    // An assertion of the global object keeps that object: no copy.
+    if (keptIdentityAssertion(lowerer, decl.initializer!) !== undefined) continue;
     const name = (decl.name as ts.Identifier).text;
     const scope = enclosingScope(decl);
     if (scope === undefined) continue;
@@ -232,11 +235,9 @@ export function scanDivergences(
     const left = assignment.left as ts.Identifier;
     const symbol = safely(() => checker.getSymbolAtLocation(left));
     if (symbol === undefined) continue;
-    const decl = checker
-      .declarationsOf(symbol)
-      .find(
-        (d): d is ts.VariableDeclaration => ts.isVariableDeclaration(d) && d.type !== undefined,
-      );
+    const decl = symbol.declarations.find(
+      (d): d is ts.VariableDeclaration => ts.isVariableDeclaration(d) && d.type !== undefined,
+    );
     if (decl === undefined) continue;
     const scope = enclosingScope(decl);
     if (scope === undefined) continue;
@@ -287,7 +288,7 @@ export function scanDivergences(
       if (ts.isObjectLiteralExpression(inner)) lit = inner;
       else if (ts.isIdentifier(inner)) {
         const symbol = safely(() => checker.getSymbolAtLocation(inner));
-        const decl = symbol === undefined ? undefined : checker.valueDeclarationOf(symbol);
+        const decl = symbol === undefined ? undefined : symbol.valueDeclaration;
         if (
           decl !== undefined &&
           ts.isVariableDeclaration(decl) &&
@@ -373,8 +374,7 @@ export function scanDivergences(
       const name = calleeName(call);
       if (name === null || !fnsByName.has(name)) continue;
       const signature = safely(() => checker.getResolvedSignature(call));
-      const decl =
-        signature === undefined ? undefined : safely(() => checker.signatureDeclaration(signature));
+      const decl = signature === undefined ? undefined : safely(() => signature.declaration);
       const sites = decl === undefined ? undefined : downcasts.get(decl);
       if (sites === undefined) continue;
       for (const site of sites) {
@@ -423,7 +423,7 @@ function dateStringLiterals(checker: ts.TypeChecker, arg: ts.Expression): ts.Exp
   if (stringLiteralText(arg) !== null) return [arg];
   if (!ts.isIdentifier(arg)) return [];
   const symbol = safely(() => checker.getSymbolAtLocation(arg));
-  const decl = symbol === undefined ? undefined : checker.valueDeclarationOf(symbol);
+  const decl = symbol === undefined ? undefined : symbol.valueDeclaration;
   const list = decl?.parent;
   const loop = list?.parent;
   if (
@@ -438,7 +438,7 @@ function dateStringLiterals(checker: ts.TypeChecker, arg: ts.Expression): ts.Exp
   let iterated: ts.Expression = loop.expression;
   if (ts.isIdentifier(iterated)) {
     const source = safely(() => checker.getSymbolAtLocation(iterated));
-    const init = source === undefined ? undefined : checker.valueDeclarationOf(source);
+    const init = source === undefined ? undefined : source.valueDeclaration;
     if (init === undefined || !ts.isVariableDeclaration(init) || init.initializer === undefined)
       return [];
     if (init.parent === undefined || (init.parent.flags & ts.NodeFlags.Const) === 0) return [];
@@ -743,7 +743,7 @@ function isProgramClassType(checker: ts.TypeChecker, type: ts.Type): boolean {
   return (
     symbol !== undefined &&
     (symbol.flags & ts.SymbolFlags.Class) !== 0 &&
-    checker.declarationsOf(symbol).some((d) => !d.getSourceFile().isDeclarationFile)
+    symbol.declarations.some((d) => !d.getSourceFile().isDeclarationFile)
   );
 }
 
@@ -756,7 +756,7 @@ function isPlainRecordType(checker: ts.TypeChecker, type: ts.Type): boolean {
   const symbol = type.getSymbol();
   if (symbol !== undefined && (symbol.flags & ts.SymbolFlags.Class) !== 0) return false;
   // Library-declared object types (Map, Date, Promise, ...) are not records.
-  const decls = symbol === undefined ? [] : checker.declarationsOf(symbol);
+  const decls = symbol === undefined ? [] : symbol.declarations;
   if (decls.some((d) => d.getSourceFile().isDeclarationFile)) return false;
   return true;
 }
@@ -769,7 +769,7 @@ function namedObjectDeclaration(checker: ts.TypeChecker, type: ts.Type): ts.Node
   const symbol = alias ?? type.getSymbol();
   if (symbol === undefined) return null;
   if ((symbol.flags & ts.SymbolFlags.Class) !== 0) return null;
-  const decl = checker.declarationsOf(symbol)[0];
+  const decl = symbol.declarations[0];
   if (decl === undefined || decl.getSourceFile().isDeclarationFile) return null;
   return decl;
 }
@@ -781,7 +781,11 @@ function keyOrderFinding(
   written: readonly string[],
   assignedNames: ReadonlySet<string>,
 ): { native: string; node: string; detail: "reordered" | "added-later" } | null {
-  const present = declared.filter((name) => written.includes(name));
+  // A shape whose table the witness pass re-chose (key-order-witness.ts)
+  // enumerates that table, not the checker's declaration order.
+  const table = witnessTable(lowerer, contextual);
+  const native = table ?? declared;
+  const present = native.filter((name) => written.includes(name) && declared.includes(name));
   const writtenKnown = written.filter((name) => declared.includes(name));
   if (present.join("\0") !== writtenKnown.join("\0") && writtenKnown.length >= 2) {
     return { native: present.join(", "), node: writtenKnown.join(", "), detail: "reordered" };
@@ -797,12 +801,21 @@ function keyOrderFinding(
     const prop = checker.getPropertyOfType(contextual, name);
     if (prop === undefined || (prop.flags & ts.SymbolFlags.Optional) === 0) continue;
     const nodeOrder = [...writtenKnown, name];
-    const nativeOrder = declared.filter((d) => nodeOrder.includes(d));
+    const nativeOrder = native.filter((d) => nodeOrder.includes(d));
+    if (table !== null && nativeOrder.join("\0") === nodeOrder.join("\0")) continue;
     return { native: nativeOrder.join(", "), node: nodeOrder.join(", "), detail: "added-later" };
   }
   return null;
 }
 
+/** The re-chosen enumeration table of the record shape a contextual type
+ * lowered to, or null when the witness pass kept today's table. */
+function witnessTable(lowerer: Lowerer, contextual: ts.Type): readonly string[] | null {
+  const mapped = safely(() => lowerer.mapTypeOf(contextual));
+  if (mapped?.kind !== "record" || !lowerer.keyOrder.changed.has(mapped.shapeId)) return null;
+  return lowerer.shapes.get(mapped.shapeId)?.declaredOrder ?? null;
+}
+
 function classDeclarationOfTypeNode(
   lowerer: Lowerer,
   node: ts.TypeNode,
@@ -810,9 +823,7 @@ function classDeclarationOfTypeNode(
   if (!ts.isTypeReferenceNode(node) || !ts.isIdentifier(node.typeName)) return null;
   const symbol = lowerer.checker.getSymbolAtLocation(node.typeName);
   if (symbol === undefined || (symbol.flags & ts.SymbolFlags.Class) === 0) return null;
-  const decl = lowerer.checker
-    .declarationsOf(symbol)
-    .find((d) => ts.isClassDeclaration(d) || ts.isClassExpression(d));
+  const decl = symbol.declarations.find((d) => ts.isClassDeclaration(d) || ts.isClassExpression(d));
   if (decl === undefined || decl.getSourceFile().isDeclarationFile) return null;
   return decl as ts.ClassLikeDeclaration;
 }
@@ -823,9 +834,7 @@ function classDeclarationOfType(
 ): ts.ClassLikeDeclaration | null {
   const symbol = type.getSymbol();
   if (symbol === undefined || (symbol.flags & ts.SymbolFlags.Class) === 0) return null;
-  const decl = checker
-    .declarationsOf(symbol)
-    .find((d) => ts.isClassDeclaration(d) || ts.isClassExpression(d));
+  const decl = symbol.declarations.find((d) => ts.isClassDeclaration(d) || ts.isClassExpression(d));
   if (decl === undefined || decl.getSourceFile().isDeclarationFile) return null;
   return decl as ts.ClassLikeDeclaration;
 }
@@ -850,9 +859,9 @@ function classExtends(
       (symbol.flags & ts.SymbolFlags.Alias) !== 0
         ? lowerer.checker.getAliasedSymbol(symbol)
         : symbol;
-    const decl = lowerer.checker
-      .declarationsOf(resolved)
-      .find((d) => ts.isClassDeclaration(d) || ts.isClassExpression(d));
+    const decl = resolved.declarations.find(
+      (d) => ts.isClassDeclaration(d) || ts.isClassExpression(d),
+    );
     cur = decl === undefined ? null : (decl as ts.ClassLikeDeclaration);
   }
   return false;
diff --git a/packages/compiler/src/frontend/lowering/expressions/array-literals.ts b/packages/compiler/src/frontend/lowering/expressions/array-literals.ts
new file mode 100644
index 000000000..ef2aa9778
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/expressions/array-literals.ts
@@ -0,0 +1,767 @@
+/* Array literals. */
+import * as ts from "../../ts7/adapter.js";
+import { type Lowerer, neverTaintedJsType } from "../lowerer.js";
+import {
+  BOOL,
+  DYN,
+  F64,
+  type IrExpr,
+  type IrRecordShape,
+  type IrStmt,
+  type IrType,
+  STRING,
+  type SrcLoc,
+  UNDEFINED_T,
+  VOID,
+  arrayOf,
+  isSupportedArrayElem,
+  typeEquals,
+} from "../../../ir/ir.js";
+import { isJsSourceFile, locOf } from "../../program.js";
+import { underConstAssertion, unitOnlyUnion } from "../../type-mapper.js";
+import { dateJsonType, isDateJsonSource } from "../builtins/dates.js";
+import { npmStaticPackageOfPath } from "../../npm-static.js";
+import { tryLowerExpression } from "./try-lower-expression.js";
+import { maybePromiseUnionOf } from "../maybe-promise.js";
+import { lowerTernary } from "./narrowing.js";
+import { lowerCollectionSpread } from "../containers/collection-methods.js";
+import { strCharsCall } from "../containers/array-construction.js";
+import { generatorDrain } from "../iterator-adapters.js";
+import { isSearchParamsIterable } from "../builtins/url.js";
+import { varRef } from "../../../ir/build.js";
+import { arrayValueStore } from "../array-values.js";
+
+/** JavaScript: whether `expr` is or holds an existing checked-dynamic
+ * object — a binding stored as a dyn value whose checker type is an
+ * object, or an array or object literal with such an element. Building
+ * the enclosing literal with a static element type would copy it. */
+export function jsHoldsDynObject(lowerer: Lowerer, expr: ts.Expression): boolean {
+  while (ts.isParenthesizedExpression(expr)) expr = expr.expression;
+  if (ts.isIdentifier(expr)) {
+    const stored = lowerer.peekLocal(expr)?.type ?? lowerer.globalOf(expr)?.type;
+    return stored?.kind === "dyn" && (lowerer.typeOf(expr).flags & ts.TypeFlags.Object) !== 0;
+  }
+  if (ts.isArrayLiteralExpression(expr))
+    return expr.elements.nodes.some(
+      (element) => !ts.isSpreadElement(element) && jsHoldsDynObject(lowerer, element),
+    );
+  if (ts.isObjectLiteralExpression(expr))
+    return expr.properties.nodes.some(
+      (property) =>
+        (ts.isPropertyAssignment(property) && jsHoldsDynObject(lowerer, property.initializer)) ||
+        (ts.isShorthandPropertyAssignment(property) &&
+          ts.isIdentifier(property.name) &&
+          jsHoldsDynObject(lowerer, property.name)),
+    );
+  return false;
+}
+
+/** `[a, b, c]`. The element type comes from the contextual type when tsc
+ * has one (`const a: number[] = []`, arguments, nested literals) and from
+ * the literal's own inferred type otherwise. A bare `[]` with no context
+ * is `never[]` — unmappable, rejected with the component fence (SC2009). `expected` overrides
+ * the contextual lookup where the caller knows the slot's array type and
+ * tsc's API doesn't surface it (ternary arms under an array context —
+ * tsc accepts the arm covariantly, but a tagged element representation
+ * must be BUILT as the slot's element type). */
+export function lowerArrayLiteral(
+  lowerer: Lowerer,
+  expr: ts.ArrayLiteralExpression,
+  expected?: (IrType & { kind: "array" }) | (IrType & { kind: "record" }),
+): IrExpr {
+  const loc = locOf(expr);
+  const ctxType = lowerer.checker.getContextualType(expr);
+  // `as const satisfies readonly T[]` checks against an array but keeps
+  // the literal's inferred tuple type. Build that shape; an actual array
+  // destination can use the ordinary tuple-to-array coercion afterward.
+  const tsType = underConstAssertion(expr)
+    ? lowerer.typeOf(expr)
+    : (ctxType ?? lowerer.typeOf(expr));
+  let mapped = expected ?? lowerer.mapTypeOf(tsType);
+  // Inferred JavaScript arrays can contain unrelated constructors with
+  // structurally equal checker types. Their native class ABIs still differ.
+  if (
+    !expected &&
+    isJsSourceFile(expr.getSourceFile()) &&
+    mapped?.kind === "array" &&
+    mapped.elem.kind === "classval"
+  )
+    mapped = DYN;
+  // An inferred destructuring pattern supplies a contextual [any, ...]
+  // tuple. Its positions do not erase the literal's inferred element
+  // types; explicit destinations already arrive through expected.
+  if (
+    expected === undefined &&
+    ctxType &&
+    lowerer.checker.isTupleType(ctxType) &&
+    lowerer.checker
+      .getTypeArguments(ctxType as ts.TypeReference)
+      .some((type) => (type.flags & ts.TypeFlags.Any) !== 0)
+  ) {
+    const inferred = lowerer.mapTypeOf(lowerer.typeOf(expr));
+    if (
+      inferred?.kind === "array" ||
+      (inferred?.kind === "record" && lowerer.shapes.get(inferred.shapeId)?.tuple)
+    )
+      mapped = inferred;
+  }
+  // A JS literal whose OWN inferred type is never-tainted
+  // (neverTaintedJsType — the evolving `const gb = []`, the mixed
+  // command tuple `['pwd', []]`) carries no element information: route
+  // it to the checked-dynamic tree fallback below rather than letting never's f64
+  // representation build a static number array (a later dyn push would
+  // throw "expected number at $, got string"; the tuple's union arm
+  // would re-tag as number[] and fence). A REAL slot still wins:
+  // `expected`, a contextual array/tuple, or a contextual union's
+  // single array arm all provide element information first.
+  // (The contextual lookup can answer the binding's own tainted
+  // inference back — `const cmd = ['pwd', []]` — so the slot test is a
+  // taint test on whichever type mapped, not a presence test.)
+  const neverTaintedOwnJs =
+    expected === undefined && neverTaintedJsType(lowerer, expr, lowerer.typeOf(expr));
+  if (expected === undefined && neverTaintedJsType(lowerer, expr, tsType)) mapped = null;
+  // A union-typed slot (`const x: string[] | number = [..]`) contextually
+  // types the literal as the union; build the literal as its OWN type and
+  // let the slot's coercion wrap it into the union. An unknown-typed slot
+  // (`JSON.stringify([1, 2])`) likewise: build the literal's own type. An
+  // UNMAPPABLE context falls back the same way — a destructuring pattern
+  // without annotations contextually types its initializer `[any]`, while
+  // the literal's own inferred type is the real tuple.
+  if (!mapped || mapped.kind === "union" || mapped.kind === "dyn") {
+    const ctxUnion = mapped?.kind === "union" ? mapped : null;
+    mapped = lowerer.mapTypeOf(lowerer.typeOf(expr));
+    // The never-tainted own type carries no element information here
+    // either (the JS story above) — only a contextual union's single
+    // array arm below may still supply a static home.
+    if (neverTaintedOwnJs) mapped = null;
+    // An EMPTY literal in a union slot (`const t: string[] | undefined =
+    // []`, the `[]` default argument against `string[] | undefined`) has
+    // no useful own type — tsc infers `never[]`, whose f64-element
+    // mapping is a representation for the uninhabited, not the slot's
+    // arm. When the contextual union has exactly ONE array arm there is
+    // no ambiguity: build the literal as that arm and let the slot's
+    // coercion wrap it. Two array arms would need tsc's own best-fit
+    // choice — none arises in practice; the fence stands.
+    if (ctxUnion && expr.elements.nodes.length === 0) {
+      const def = lowerer.unions.get(ctxUnion.unionId);
+      const arrayArms = def?.arms.filter((a) => a.kind === "array") ?? [];
+      if (arrayArms.length === 1) mapped = arrayArms[0]!;
+    }
+    // A NON-EMPTY literal whose own type has no static home (the JS dyn
+    // fallback — a null/dyn mapping, or an inference that degraded to a
+    // unit-only-element array over non-unit elements) under a union
+    // with exactly ONE array-family arm — an array, or an
+    // arity-matching tuple (the option-table `default: [{ value: [] }]`
+    // shape): build AS that arm, exactly the empty-literal rule above;
+    // the slot's coercion wraps it.
+    if (ctxUnion && expr.elements.nodes.length > 0) {
+      // A unit-only-element array (`(null | undefined)[]`) cannot hold
+      // non-unit elements — neither as the literal's own mapping nor as
+      // a competing union arm.
+      const nonUnitElems = expr.elements.nodes.some(
+        (el) =>
+          !ts.isOmittedExpression(el) &&
+          el.kind !== ts.SyntaxKind.NullKeyword &&
+          !(ts.isIdentifier(el) && el.text === "undefined"),
+      );
+      const ownUnhelpful =
+        mapped === null ||
+        mapped.kind === "dyn" ||
+        // The checker may echo the context union rather than infer this literal.
+        mapped.kind === "union" ||
+        (mapped.kind === "array" && nonUnitElems && lowerer.unitOnlyElem(mapped.elem));
+      if (ownUnhelpful) {
+        const def = lowerer.unions.get(ctxUnion.unionId);
+        const arms = (def?.arms ?? []).filter(
+          (a) =>
+            (a.kind === "array" && !(nonUnitElems && lowerer.unitOnlyElem(a.elem))) ||
+            (a.kind === "record" &&
+              !!lowerer.shapes.get(a.shapeId)?.tuple &&
+              lowerer.shapes.get(a.shapeId)!.fields.length === expr.elements.nodes.length),
+        );
+        if (arms.length === 1) mapped = arms[0]!;
+      }
+    }
+  }
+  // A Date's toJSON() element keeps its null in a literal with no declared
+  // destination: the lib types say string.
+  if (
+    !expected &&
+    mapped?.kind === "array" &&
+    mapped.elem.kind === "string" &&
+    expr.elements.nodes.some((element) => isDateJsonSource(lowerer, element))
+  )
+    mapped = { kind: "array", elem: dateJsonType(lowerer) };
+  // An array literal inside an npm-static implicit-any instance can
+  // inherit the checker's poisoned any[] context even after the
+  // active binding gives every element one concrete lowering. Recover a
+  // static array only when every spelled element lowers to the same
+  // supported type. An explicit checked-dynamic destination still owns
+  // the later slot coercion; heterogeneous literals, holes, and spreads
+  // keep the checked-dynamic fallback below.
+  if (
+    lowerer.implicitParamTypes !== null &&
+    npmStaticPackageOfPath(expr.getSourceFile().fileName) !== null &&
+    (mapped === null ||
+      mapped.kind === "dyn" ||
+      (mapped.kind === "array" && mapped.elem.kind === "dyn")) &&
+    expr.elements.nodes.length > 0 &&
+    expr.elements.nodes.every(
+      (element) => !ts.isSpreadElement(element) && !ts.isOmittedExpression(element),
+    )
+  ) {
+    const elements = expr.elements.nodes.map((element) => tryLowerExpression(lowerer, element));
+    const first = elements[0];
+    if (
+      first !== undefined &&
+      first !== null &&
+      isSupportedArrayElem(first.type) &&
+      elements.every((element) => element !== null && typeEquals(element.type, first.type))
+    ) {
+      mapped = arrayOf(first.type);
+    }
+  }
+  if (!expected && isJsSourceFile(expr.getSourceFile()) && mapped?.kind === "array") {
+    const elem = mapped.elem;
+    const arms = elem.kind === "union" ? lowerer.unions.get(elem.unionId)?.arms : [elem];
+    if (arms?.length && arms.every((arm) => arm.kind === "classval")) mapped = DYN;
+    // Inferred JavaScript literals mixing promises and plain values
+    // (`[Promise.resolve(1), 2]`) keep the checked-dynamic array: their
+    // consumers (Readable.from, Promise.all over iterators) inspect each
+    // element at run time.
+    if (maybePromiseUnionOf(lowerer, elem)) mapped = DYN;
+  }
+  if (
+    !expected &&
+    isJsSourceFile(expr.getSourceFile()) &&
+    expr.elements.nodes.some(
+      (element) =>
+        ts.isSpreadElement(element) &&
+        tryLowerExpression(lowerer, element.expression)?.type.kind === "dyn",
+    )
+  )
+    mapped = DYN;
+  // An element that is an existing checked-dynamic object (a file-scope
+  // object literal binding, or a literal holding one) keeps its identity
+  // only in a checked-dynamic array: a static element type would copy it.
+  if (
+    !expected &&
+    isJsSourceFile(expr.getSourceFile()) &&
+    mapped?.kind !== "dyn" &&
+    expr.elements.nodes.some(
+      (element) => !ts.isSpreadElement(element) && jsHoldsDynObject(lowerer, element),
+    )
+  )
+    mapped = DYN;
+  // An EMPTY literal under a CONST ASSERTION whose type queries panicked
+  // (tsgo's readonly-[] TupleType conversion) uses a unit-element array,
+  // mapType's own `[] as const` rule.
+  if (
+    mapped === null &&
+    expr.elements.nodes.length === 0 &&
+    (tsType.flags & ts.TypeFlags.Any) !== 0 &&
+    underConstAssertion(expr)
+  ) {
+    mapped = arrayOf(unitOnlyUnion(lowerer.unions));
+  }
+  // Heterogeneous JavaScript object arrays must retain each literal's
+  // real keys. A structural union can otherwise drop descriptor fields.
+  if (
+    !expected &&
+    isJsSourceFile(expr.getSourceFile()) &&
+    mapped?.kind === "array" &&
+    mapped.elem.kind === "union" &&
+    expr.elements.nodes.some(ts.isObjectLiteralExpression)
+  )
+    mapped = DYN;
+
+  // A TUPLE-typed slot (`const t: [string, number] = ["a", 1]`): the
+  // literal constructs the tuple's record shape — one positional field
+  // per element, source order (which IS index order, so evaluation order
+  // is JS-exact). tsc has already checked the arity; the recount below
+  // backstops `as` smuggling. Fixed tuple spreads have known positions.
+  if (mapped?.kind === "record") {
+    const shape = lowerer.shapes.get(mapped.shapeId);
+    if (shape?.tuple) {
+      const spread = expr.elements.nodes.find(ts.isSpreadElement);
+      if (spread) {
+        return lowerTupleSpreadLiteral(lowerer, expr, mapped, shape);
+      }
+      if (expr.elements.nodes.length !== shape.fields.length) {
+        // tsc padded an UNDER-LENGTH literal against an optional-element
+        // tuple context (`options || []` with `options?: [string?,
+        // number?]` — the instantiated type spells every position, the
+        // literal spells fewer): no fixed shape holds it.
+        lowerer.badType(expr, tsType);
+      }
+      const byName = new Map(shape.fields.map((f) => [f.name, f.type]));
+      const fields = expr.elements.nodes.map((el, i) => {
+        const fieldType = byName.get(String(i));
+        if (!fieldType) lowerer.badType(el, lowerer.typeOf(el));
+        return { name: String(i), value: lowerer.lowerExprExpecting(el, fieldType) };
+      });
+      return { kind: "recordLit", fields, type: mapped, loc };
+    }
+  }
+  if (!mapped || mapped.kind !== "array") {
+    // The JS declaration fallback, literal-side: an element type with no
+    // static home (a string | string[] mixed command tuple, an evolving
+    // []) builds as a dyn ARRAY — one dyn value whose elements each
+    // convert through the usual boundary (dynFrom's JSON-safe domain);
+    // an element that cannot convert fences per element. length/index
+    // reads and dynamic consumers ride the keyed-dyn paths. TS literals
+    // take the same build when the slot ITSELF is checked-dynamic — an
+    // `unknown[]` annotation or a collapsed `(string | object)[]` maps
+    // to DYN wholesale now (mapType's dyn-element array rule), so the
+    // literal IS the dyn array.
+    if (
+      isJsSourceFile(expr.getSourceFile()) ||
+      mapped?.kind === "dyn" ||
+      lowerer.checkerAnyArray(expr)
+    ) {
+      if (expr.elements.nodes.some(ts.isSpreadElement)) {
+        // Native collection drains return vectors of retained dyn
+        // elements. Reuse the ordinary spread builder, then expose the
+        // resulting array through the established unknown[] representation.
+        const vector = lowerArrayLiteral(lowerer, expr, arrayOf(DYN) as IrType & { kind: "array" });
+        return lowerer.coerceInto(expr, vector, DYN);
+      }
+      const elems = expr.elements.nodes.map((el): IrExpr => {
+        if (ts.isSpreadElement(el)) {
+          lowerer.unsupported(
+            "SC1090",
+            el,
+            "spread elements in a dynamic (unknown[]) array literal",
+          );
+        }
+        const v = lowerer.coerceToExpected(lowerer.lowerExpr(el), DYN);
+        if (v.type.kind !== "dyn") {
+          lowerer.unsupported(
+            "SC1101",
+            el,
+            `holding '${lowerer.fmt(v.type)}' values in a dynamic (unknown[]) array literal`,
+          );
+        }
+        return v;
+      });
+      return { kind: "dynArrLit", elems, type: DYN, loc };
+    }
+    lowerer.badType(expr, tsType);
+  }
+  let type = mapped as IrType & { kind: "array" };
+  // An inferred array of records takes the layout of an element literal
+  // whose fields widened for missing-element reads; the other elements
+  // build that layout directly. An explicit destination keeps its own.
+  if (!expected && type.elem.kind === "record") {
+    let variant: IrType | null = null;
+    for (const candidate of expr.elements.nodes) {
+      let x: ts.Expression = candidate;
+      while (ts.isParenthesizedExpression(x)) x = x.expression;
+      if (!ts.isObjectLiteralExpression(x)) continue;
+      const probe = tryLowerExpression(lowerer, x);
+      if (!probe || !lowerer.isRuntimeOptionalRecordVariant(probe.type, type.elem)) continue;
+      if (variant !== null && !typeEquals(variant, probe.type)) {
+        variant = null;
+        break;
+      }
+      variant = probe.type;
+    }
+    if (variant !== null) type = arrayOf(variant) as IrType & { kind: "array" };
+  }
+  // Keep the array payload type fixed. Optional reads are stored through
+  // arrayValueStore, which records UNDEFINED in the state byte while the
+  // payload remains number/string/etc.; widening the array element here
+  // would force boxed union storage and change aliases.
+  const spreads: number[] = [];
+  const holes = new Set<number>();
+  const runtimeOptionalElements = new Set<number>();
+  let needsStateBuild = false;
+  for (let i = 0; i < expr.elements.nodes.length; i++) {
+    const candidate = expr.elements.nodes[i]!;
+    if (ts.isSpreadElement(candidate) || ts.isOmittedExpression(candidate)) continue;
+    const probe = tryLowerExpression(lowerer, candidate);
+    if (probe && lowerer.runtimeOptionalWidening(probe.type, type.elem) !== null) {
+      runtimeOptionalElements.add(i);
+      needsStateBuild = true;
+    }
+  }
+  const elems: IrExpr[] = expr.elements.nodes.map((el, i): IrExpr => {
+    if (ts.isSpreadElement(el)) {
+      // `[...xs, b]`: xs must be an array of the literal's own element
+      // type — its elements copy in at construction (a fresh array,
+      // JS-exact). Iterables that aren't arrays (strings, Sets, Maps)
+      // and mismatched element types stay fenced. A TERNARY source gets
+      // the literal's own type as its expected type (the conditional-
+      // spread idiom — tsc surfaces no contextual type through spreads,
+      // and the arm literals must BUILD as this element type).
+      let srcNode: ts.Expression = el.expression;
+      while (ts.isParenthesizedExpression(srcNode)) srcNode = srcNode.expression;
+      lowerer.fenceStaticHeadersIteration(el.expression);
+      let src = ts.isConditionalExpression(srcNode)
+        ? lowerTernary(lowerer, srcNode, type)
+        : lowerer.lowerExpr(el.expression);
+      src = lowerCollectionSpread(lowerer, src, el.expression) ?? src;
+      // `[...new SymbolIterator]`: a CLASS ITERABLE drains through its
+      // own protocol into a fresh element array (classIteratorDrainCall
+      // — an infinite iterator loops forever, exactly Node), and the
+      // spread machinery copies like any array source.
+      if (src.type.kind === "object") {
+        const drained = lowerer.classIteratorDrainCall(src, locOf(el), type.elem);
+        if (drained) src = drained;
+      }
+      // `[...s]` on a STRING spreads its code-point characters (the
+      // string iterator's walk — astral chars whole) through the same
+      // interned helper as Array.from(s); the result rides the array
+      // machinery below like any string[] source.
+      if (src.type.kind === "string") {
+        src = strCharsCall(lowerer, src, locOf(el));
+      }
+      // `[...typedArray]`: represented typed arrays are dense numeric
+      // iterables, so drain their elements into the fresh number[] that
+      // the surrounding array literal will copy. In particular this is
+      // the Uint8Array-to-Array bridge (`[...u8]`), with element values
+      // read rather than backing bytes for the wider typed-array kinds.
+      if (src.type.kind === "bytes") {
+        src = {
+          kind: "bytesIntrinsic",
+          method: "toArray",
+          receiver: src,
+          args: [],
+          type: arrayOf(F64),
+          loc: locOf(el),
+        };
+      }
+      // `[...it]` over a generator (or an iterator adapted into one):
+      // drain it once, in order, into a fresh element array.
+      if (src.type.kind === "generator") {
+        const drained = generatorDrain(lowerer, src, type.elem, locOf(el));
+        if (drained) src = drained;
+      }
+      // `[...sp]` and `[...sp.entries()]` over a URLSearchParams: its
+      // checked-dynamic view iterates the live pair list, and the drained
+      // [name, value] pairs convert to the literal's tuple elements.
+      const searchParamsSource = isSearchParamsIterable(lowerer, el.expression);
+      if (src.type.kind === "searchParams") src = lowerer.coerceInto(el.expression, src, DYN);
+      // A native checked iterable can supply scalar elements even when
+      // the checker inferred a typed array from its producer. Drain once
+      // and validate the elements before the ordinary spread copy.
+      if (
+        src.type.kind === "dyn" &&
+        (type.elem.kind === "dyn" ||
+          type.elem.kind === "f64" ||
+          type.elem.kind === "string" ||
+          type.elem.kind === "bool" ||
+          searchParamsSource)
+      ) {
+        src = lowerer.coerceInto(el.expression, checkedIteratorPack(lowerer, src, locOf(el)), type);
+      }
+      // A same-family array whose ELEMENT lifts (string[] into a
+      // (string | symbol)[] literal — per-element wrap/width copy):
+      // the interned width helper reshapes before the spread copies.
+      if (src.type.kind === "array" && !typeEquals(src.type, type)) {
+        const w = lowerer.widthCoerce(src, type);
+        if (w) src = w;
+      }
+      if (!typeEquals(src.type, type)) {
+        lowerer.unsupported(
+          "SC1090",
+          el,
+          `spreading '${lowerer.fmt(src.type)}' into a '${lowerer.fmt(type)}' literal (only a same-element-type array spreads)`,
+        );
+      }
+      spreads.push(i);
+      return src;
+    }
+    // A HOLE (`[,]` — an elision) remains absent. Ordinary reads still
+    // answer undefined, while presence-sensitive methods and concat keep
+    // the hole. The state-building path below advances length without
+    // writing a value into this slot.
+    if (ts.isOmittedExpression(el)) {
+      needsStateBuild = true;
+      holes.add(i);
+      return { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc: locOf(el) };
+    }
+    // An ARRAY-LITERAL element under a UNION element slot whose own type
+    // has no lift into the slot builds against the union's single array
+    // arm instead (`['pwd', []]` as (string | string[])[] — tsc pushes no
+    // contextual type through the unannotated chain, so the empty nested
+    // literal types never[], whose f64-element representation re-tags
+    // into nothing). One array arm is unambiguous — the union-slot rule's
+    // stance; several keep the fence.
+    if (type.elem.kind === "union" || type.elem.kind === "array") {
+      let x: ts.Expression = el;
+      while (ts.isParenthesizedExpression(x)) x = x.expression;
+      if (ts.isArrayLiteralExpression(x)) {
+        const ownT = lowerer.mapTypeOf(lowerer.checker.getContextualType(x) ?? lowerer.typeOf(x));
+        if (ownT === null || lowerer.widthLiftPlan(ownT, type.elem) === null) {
+          // An ARRAY-typed slot takes the literal directly; a union slot
+          // routes through its single array arm and wraps.
+          if (type.elem.kind === "array") {
+            return lowerer.lowerArrayLiteral(x, type.elem);
+          }
+          const def = lowerer.unions.get(type.elem.unionId);
+          const arrayArms = def?.arms.filter((a) => a.kind === "array") ?? [];
+          if (arrayArms.length === 1) {
+            const built = lowerer.lowerArrayLiteral(x, arrayArms[0] as IrType & { kind: "array" });
+            return lowerer.coerceInto(el, built, type.elem);
+          }
+        }
+      }
+    }
+    // Elements flow into the element slot like an assignment: union
+    // elements wrap plain arm values (`[1, "a"]` as (number | string)[]),
+    // holes reject inside lowerExpr.
+    let lowered: IrExpr;
+    const directOptionalCandidate =
+      runtimeOptionalElements.has(i) ||
+      ts.isElementAccessExpression(el) ||
+      (ts.isCallExpression(el) &&
+        ts.isPropertyAccessExpression(el.expression) &&
+        (el.expression.name.text === "pop" || el.expression.name.text === "shift"));
+    if (directOptionalCandidate) {
+      const raw = lowerer.lowerExpr(el);
+      if (!typeEquals(raw.type, type.elem)) {
+        needsStateBuild = true;
+        return raw;
+      }
+      lowered = raw;
+    } else {
+      lowered = lowerer.lowerExprExpecting(el, type.elem);
+    }
+    if (!typeEquals(lowered.type, type.elem)) lowerer.badType(el, lowerer.typeOf(el));
+    return lowered;
+  });
+  if (!needsStateBuild) {
+    return { kind: "arrayLit", elems, ...(spreads.length > 0 ? { spreads } : {}), type, loc };
+  }
+  const out = lowerer.declareHiddenLocal("%arrayLit", type);
+  const outRef = varRef(out.id, type, loc);
+  // Dense capacity for the elements the statements below store.
+  const capacity = Math.min(elems.length - spreads.length, 1024);
+  const body: IrStmt[] = [
+    {
+      kind: "varDecl",
+      localId: out.id,
+      init: {
+        kind: "arrayLit",
+        elems: [],
+        ...(capacity > 0 ? { capacity } : {}),
+        type,
+        loc,
+      },
+      loc,
+    },
+  ];
+  const spreadSet = new Set(spreads);
+  const currentLength = (): IrExpr => ({
+    kind: "arrIntrinsic",
+    method: "length",
+    receiver: outRef,
+    args: [],
+    type: F64,
+    loc,
+  });
+  const nextLength = (): IrExpr => ({
+    kind: "bin",
+    op: "+",
+    left: currentLength(),
+    right: { kind: "numLit", value: 1, type: F64, loc },
+    type: F64,
+    loc,
+  });
+  for (let i = 0; i < elems.length; i++) {
+    const el = elems[i]!;
+    if (spreadSet.has(i)) {
+      body.push({
+        kind: "exprStmt",
+        expr: {
+          kind: "arrIntrinsic",
+          method: "pushSpread",
+          receiver: outRef,
+          args: [el],
+          type: F64,
+          loc,
+        },
+        loc,
+      });
+      continue;
+    }
+    if (holes.has(i)) {
+      body.push({ kind: "arraySetLength", arr: outRef, length: nextLength(), loc });
+      continue;
+    }
+    let value = el;
+    if (!typeEquals(value.type, type.elem)) {
+      const temp = lowerer.declareHiddenLocal("%arrayValue", value.type);
+      body.push({ kind: "varDecl", localId: temp.id, init: value, loc });
+      value = varRef(temp.id, temp.type, loc);
+    }
+    body.push(arrayValueStore(lowerer, outRef, currentLength(), value, type.elem, loc));
+  }
+  return {
+    kind: "seqExpr",
+    stmts: body,
+    result: outRef,
+    type,
+    loc,
+  };
+}
+
+/** Build a fixed tuple from positional elements and fixed tuple spreads.
+ * Capture each value in source order: deferring the reads until recordLit
+ * would observe a later element's mutations of the spread source. */
+function lowerTupleSpreadLiteral(
+  lowerer: Lowerer,
+  expr: ts.ArrayLiteralExpression,
+  type: IrType & { kind: "record" },
+  shape: IrRecordShape,
+): IrExpr {
+  const loc = locOf(expr);
+  const byName = new Map(shape.fields.map((field) => [field.name, field.type]));
+  const stmts: IrStmt[] = [];
+  const fields: { name: string; value: IrExpr }[] = [];
+  const append = (node: ts.Expression, value: IrExpr): void => {
+    const name = String(fields.length);
+    const expected = byName.get(name);
+    if (!expected) lowerer.badType(expr, lowerer.typeOf(expr));
+    const coerced = lowerer.coerceInto(node, value, expected);
+    const temp = lowerer.declareHiddenLocal("%tupleElement", expected);
+    const at = locOf(node);
+    stmts.push({ kind: "varDecl", localId: temp.id, init: coerced, loc: at });
+    fields.push({ name, value: varRef(temp.id, expected, at) });
+  };
+  for (const element of expr.elements.nodes) {
+    if (!ts.isSpreadElement(element)) {
+      const expected = byName.get(String(fields.length));
+      if (!expected) lowerer.badType(element, lowerer.typeOf(element));
+      append(element, lowerer.lowerExprExpecting(element, expected));
+      continue;
+    }
+    const source = lowerer.lowerExpr(element.expression);
+    const sourceShape =
+      source.type.kind === "record" ? lowerer.shapes.get(source.type.shapeId) : undefined;
+    if (!sourceShape?.tuple) {
+      // Empty tuples use a zero-length array representation. Preserve a
+      // producing call's effects even though there are no positions to copy.
+      const sourceTs = lowerer.typeOf(element.expression);
+      if (
+        source.type.kind === "array" &&
+        lowerer.checker.isTupleType(sourceTs) &&
+        lowerer.checker.getTypeArguments(sourceTs as ts.TypeReference).length === 0
+      ) {
+        stmts.push({ kind: "exprStmt", expr: source, loc: locOf(element) });
+        continue;
+      }
+      lowerer.unsupported(
+        "SC1090",
+        element,
+        "spreading a variable-length value into a fixed tuple literal",
+      );
+    }
+    const temp = lowerer.declareHiddenLocal("%tupleSpread", source.type);
+    const at = locOf(element);
+    stmts.push({ kind: "varDecl", localId: temp.id, init: source, loc: at });
+    const receiver = varRef(temp.id, source.type, at);
+    const positions = [...sourceShape.fields].sort((a, b) => Number(a.name) - Number(b.name));
+    for (const field of positions) {
+      append(element.expression, {
+        kind: "recordGet",
+        obj: receiver,
+        shapeId: sourceShape.id,
+        field: field.name,
+        type: field.type,
+        loc: at,
+      });
+    }
+  }
+  if (fields.length !== shape.fields.length) lowerer.badType(expr, lowerer.typeOf(expr));
+  return { kind: "seqExpr", stmts, result: { kind: "recordLit", fields, type, loc }, type, loc };
+}
+
+/** Drain using checked dispatch so native class and generator iterators keep their methods. */
+function checkedIteratorPack(lowerer: Lowerer, source: IrExpr, loc: SrcLoc): IrExpr {
+  const name = "%iterator.pack.checked";
+  if (!lowerer.liftedFns.some((fn) => fn.name === name)) {
+    const ref = (id: string): IrExpr => ({ kind: "varRef", localId: id, type: DYN, loc });
+    const property = (key: string): IrExpr => ({
+      kind: "dynKeyGet",
+      value: ref("step"),
+      key: { kind: "strLit", value: key, type: STRING, loc },
+      type: DYN,
+      loc,
+    });
+    lowerer.liftedFns.push({
+      name,
+      params: [{ localId: "source", name: "source", type: DYN }],
+      returnType: DYN,
+      locals: ["source", "iterator", "step", "result"].map((id) => ({
+        id,
+        name: id,
+        type: DYN,
+        mutable: id !== "source",
+      })),
+      body: [
+        {
+          kind: "varDecl",
+          localId: "iterator",
+          init: {
+            kind: "libCall",
+            fn: "dyn.iterator",
+            args: [ref("source"), { kind: "strLit", value: "value", type: STRING, loc }],
+            type: DYN,
+            loc,
+          },
+          loc,
+        },
+        {
+          kind: "varDecl",
+          localId: "result",
+          init: { kind: "dynArrLit", elems: [], type: DYN, loc },
+          loc,
+        },
+        {
+          kind: "while",
+          cond: { kind: "boolLit", value: true, type: BOOL, loc },
+          body: [
+            {
+              kind: "varDecl",
+              localId: "step",
+              init: {
+                kind: "dynInvoke",
+                recv: ref("iterator"),
+                method: "next",
+                calleeName: "iterator.next",
+                args: [],
+                type: DYN,
+                loc,
+              },
+              loc,
+            },
+            {
+              kind: "if",
+              cond: { kind: "dynTest", test: "truthy", value: property("done"), type: BOOL, loc },
+              then: [{ kind: "return", value: ref("result"), loc }],
+              else_: null,
+              loc,
+            },
+            {
+              kind: "exprStmt",
+              expr: {
+                kind: "libCall",
+                fn: "dyn.packPush",
+                args: [ref("result"), property("value")],
+                type: VOID,
+                loc,
+              },
+              loc,
+            },
+          ],
+          loc,
+        },
+        { kind: "return", value: ref("result"), loc },
+      ],
+      loc,
+    });
+  }
+  return { kind: "call", callee: name, args: [source], type: DYN, loc };
+}
diff --git a/packages/compiler/src/frontend/lowering/expressions/binary.ts b/packages/compiler/src/frontend/lowering/expressions/binary.ts
new file mode 100644
index 000000000..2a8de78b9
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/expressions/binary.ts
@@ -0,0 +1,2791 @@
+/* Binary operators: arithmetic, comparisons and equality, logical and nullish pairs, and string conversion for concatenation. */
+import * as ts from "../../ts7/adapter.js";
+import { type Lowerer, jsFuncNameOf } from "../lowerer.js";
+import {
+  BIGINT_T,
+  BOOL,
+  DYN,
+  DYN_HANDLE_KINDS,
+  F64,
+  type IrExpr,
+  type IrStmt,
+  type IrType,
+  REF_TRUTHY_KINDS,
+  STRING,
+  type SrcLoc,
+  UNDEFINED_T,
+  VOID,
+  canBoxFuncIntoDyn,
+  isUnitType,
+  typeEquals,
+  typeKey,
+} from "../../../ir/ir.js";
+import { isSafeToDiscard, isSafeToRepeat } from "./evaluation-safety.js";
+import {
+  bigintCompoundValue,
+  compoundUnsupported,
+  concatOperand,
+  constructorGlobalTypeof,
+  deferredSlotOr,
+  dynCompoundValue,
+  lowerAbsenceProbe,
+  lowerDynMemberAssignment,
+  lowerOptionalNumber,
+  lowerPresenceOperand,
+  nullishBranches,
+  operandPairs,
+  operatorUnsupported,
+  runtimeOptionalStorageOperand,
+  symbolFieldInfo,
+  typeofAnswer,
+} from "../lower-exprs.js";
+import { COMPOUND_ASSIGN_OPS, type CompoundOp, NARROW_FIRST } from "../surfaces.js";
+import { lowerElementCompoundParts } from "./element-access.js";
+import { InternalCompilerError } from "../../../errors.js";
+import { isJsSourceFile, locOf } from "../../program.js";
+import { storedClassValueType } from "../lower-classes.js";
+import { hasRuntimeStatics } from "../class-runtime-statics.js";
+import { tryLowerExpression } from "./try-lower-expression.js";
+import { fenceNodeModuleMutation, lowerRequireCacheHas } from "../lower-node-module.js";
+import { errorToStringCall } from "../error-methods.js";
+import { classToStringConversion, classUnionToString } from "../class-to-primitive.js";
+import { isPerfEntryType, perfEntryTag } from "../builtins/performance.js";
+import { guardNullProto, nullProtoRecordShape } from "../null-prototype.js";
+import { numLit, varRef } from "../../../ir/build.js";
+import { lowerUrlAssignment } from "../builtins/url.js";
+import { lowerClassPrototypeComputedAssignment } from "../class-prototypes.js";
+import { lowerShortCircuitAssignment } from "./nullish-assignment.js";
+import { lowerEventObjectPropertyWrite } from "../lower-event-target.js";
+import { lowerFieldCompoundValue } from "./updates.js";
+import { expandoWritableTarget } from "../lower-expando.js";
+import { nsWritableTarget } from "../lower-namespaces.js";
+import { arrayValueStore, tryLowerBytesReadNumberEquality } from "../array-values.js";
+import { cjsExportMemberWriteGlobalOf, cjsInFileExportGlobalOf } from "../cjs-exports-object.js";
+import { lowerUnionFieldWrite } from "./union-fields.js";
+import { lowerAbstractEquality } from "../abstract-equality.js";
+import { lowerInExpression } from "./relational.js";
+import { lowerDynTypeofTest, lowerErrorCodeTypeofTest } from "./typeof.js";
+import { builtinClassRefOf, sameBuiltinClass } from "../builtins/class-values.js";
+import { tryLowerIndexedComparison } from "../indexed-comparison.js";
+import { lowerUnionEquality, tagEqualityMayMissAlias } from "../strict-equality.js";
+import { withUnitArm } from "../../type-mapper.js";
+import { npmStaticPackageOfPath } from "../../npm-static.js";
+import { lowerWebAssemblyTypeof } from "../builtins/webassembly.js";
+
+/** `v === undefined` / `v !== null` — the narrowing tests for unit-armed
+ * unions. A union operand compared with a unit literal lowers to a
+ * runtime TAG test (unionIsTag); afterwards tsc's control-flow narrowing
+ * types the branches and reads bridge through maybeNarrow as usual. When
+ * the checker already narrowed the non-literal side PAST the union
+ * (`w = 5; if (w !== null)`), the comparison is statically decided and
+ * folds to a bool literal — that drops only a side-effect-free read
+ * (flow narrowing applies to references, never to calls), and soundness
+ * rests on the same narrowing proof unionNarrow relies on. Null when
+ * neither side is a unit literal (not a unit comparison). */
+export function lowerUnitComparison(
+  lowerer: Lowerer,
+  left: IrExpr,
+  right: IrExpr,
+  negated: boolean,
+  loc: SrcLoc,
+): IrExpr | null {
+  const unit = left.kind === "unitLit" ? left : right.kind === "unitLit" ? right : null;
+  if (!unit) return null;
+  const other = unit === left ? right : left;
+  if (other.kind === "unitLit") {
+    // Two unit literals (`undefined === undefined`): statically decided.
+    return { kind: "boolLit", value: (other.unit === unit.unit) !== negated, type: BOOL, loc };
+  }
+  const slot = lowerer.deferredFieldSlot(other);
+  if (slot) return lowerUnitComparison(lowerer, slot, unit, negated, loc);
+  // A binding the checker narrowed past the unit can still hold it at
+  // runtime when its value came from an unassigned deferred-init field;
+  // the stored tag answers either way.
+  if (
+    other.kind === "unionNarrow" &&
+    other.value.kind === "varRef" &&
+    other.value.type.kind === "union" &&
+    lowerer.armTag(other.value.type.unionId, unit.type) >= 0
+  )
+    return lowerUnitComparison(lowerer, other.value, unit, negated, loc);
+  if (other.type.kind === "union") {
+    const tag = lowerer.armTag(other.type.unionId, unit.type);
+    if (tag < 0) {
+      // A union WITHOUT that unit arm: legal TS (`miss === null` on a
+      // `number | undefined` — null/undefined guard comparisons are
+      // permitted against nullable-adjacent types), and === never
+      // coerces, so the answer is the constant `negated`. The literal
+      // must NOT flow into the union representation (the unionEq
+      // fallback would coerce it through the stranded-arm trap and
+      // throw where Node answers false). JS still evaluates the
+      // operand, so a non-droppable one (`xs.find(f) === null` — the
+      // callback's effects are observable) rides one throwaway tag
+      // test; droppable reads fold to the bare literal.
+      const answer: IrExpr = { kind: "boolLit", value: negated, type: BOOL, loc };
+      if (isSafeToDiscard(other)) return answer;
+      const evalOnce: IrExpr = {
+        kind: "unionIsTag",
+        unionId: other.type.unionId,
+        tag: 0,
+        negated: false,
+        value: other,
+        type: BOOL,
+        loc,
+      };
+      return {
+        kind: "logical",
+        op: negated ? "||" : "&&",
+        left: evalOnce,
+        right: answer,
+        type: BOOL,
+        loc,
+      };
+    }
+    return {
+      kind: "unionIsTag",
+      unionId: other.type.unionId,
+      tag,
+      negated,
+      value: other,
+      type: BOOL,
+      loc,
+    };
+  }
+  // A process.env read tsc narrowed past its union (an earlier write to
+  // the same key): the environment is VOLATILE — `delete process.env.K`
+  // undoes the write the narrowing rode on — so folding would bake a
+  // stale answer. Compare the fresh read's union tag instead.
+  const envRead = volatileEnvRead(other);
+  if (envRead && envRead.type.kind === "union") {
+    const tag = lowerer.armTag(envRead.type.unionId, unit.type);
+    if (tag >= 0) {
+      return {
+        kind: "unionIsTag",
+        unionId: envRead.type.unionId,
+        tag,
+        negated,
+        value: envRead,
+        type: BOOL,
+        loc,
+      };
+    }
+  }
+  // A VOID-typed operand (`foo() === undefined` where foo's declared
+  // return is undefined/void — the mapping folds both to void): JS
+  // yields undefined from such a call, so the compare is TRUE-when-equal
+  // — the opposite of the never-holds-units fold below — and the IR has
+  // no value (nor a sequence form to keep the call's effects). Fall
+  // through to the caller's comparison fence instead of folding a lie.
+  if (other.type.kind === "void") return null;
+  // Non-union operand: it can never hold undefined/null at runtime (the
+  // checker narrowed it to a concrete arm), so `=== unit` is false and
+  // `!== unit` is true.
+  return { kind: "boolLit", value: negated, type: BOOL, loc };
+}
+
+/** The union-typed process.envGet read inside a checker-narrowed operand,
+ * or null — the volatility escape above (and lowerLooseNullCompare's). */
+function volatileEnvRead(e: IrExpr): IrExpr | null {
+  if (e.kind === "libCall" && e.fn === "process.envGet") return e;
+  if (e.kind === "unionNarrow" && e.value.kind === "libCall" && e.value.fn === "process.envGet") {
+    return e.value;
+  }
+  return null;
+}
+
+function lowerLooseNullCompare(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+  loc: SrcLoc,
+): IrExpr | null {
+  const negated = expr.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsToken;
+  const unwrap = (e: ts.Expression): ts.Expression =>
+    ts.isParenthesizedExpression(e) ? unwrap(e.expression) : e;
+  const left = unwrap(expr.left);
+  const right = unwrap(expr.right);
+  const leftIsNull = left.kind === ts.SyntaxKind.NullKeyword;
+  if (!leftIsNull && right.kind !== ts.SyntaxKind.NullKeyword) return null;
+  const otherNode = leftIsNull ? right : left;
+  const other = lowerPresenceOperand(lowerer, otherNode);
+  if (isUnitType(other.type)) {
+    // `null == null`, `undefined == null`: units are mutually loose-equal.
+    return { kind: "boolLit", value: !negated, type: BOOL, loc };
+  }
+  if (other.type.kind === "dyn") {
+    // `v != null` on unknown: one dyn kind test covers both units.
+    return {
+      kind: "dynTest",
+      test: "nullish",
+      ...(negated ? { negated: true as const } : {}),
+      value: other,
+      type: BOOL,
+      loc,
+    };
+  }
+  if (other.type.kind === "union") {
+    const ut = other.type;
+    const def = lowerer.unions.get(ut.unionId);
+    if (!def) lowerer.badType(otherNode, lowerer.typeOf(otherNode));
+    const tags = def.arms.flatMap((a, i) => (isUnitType(a) ? [i] : []));
+    if (tags.length === 0) {
+      // No unit arms: never null-ish (defensive — the fold below).
+      return { kind: "boolLit", value: negated, type: BOOL, loc };
+    }
+    const isTag = (tag: number): IrExpr => ({
+      kind: "unionIsTag",
+      unionId: ut.unionId,
+      tag,
+      negated,
+      value: other,
+      type: BOOL,
+      loc,
+    });
+    if (tags.length === 1) return isTag(tags[0]!);
+    // Both null AND undefined arms: tag-in-set as a short-circuit pair
+    // (De Morgan for `!=`). The operand IrExpr rides both tests, so the
+    // backend emits it per test — restricted to re-emittable pure reads;
+    // anything effectful gets its own actionable fence (the generic
+    // SC1040 hint would wrongly suggest `== null` as the fix).
+    if (!isSafeToRepeat(other)) {
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        `'== null' / '!= null' on a '${lowerer.fmt(ut)}' value that isn't a plain read ` +
+          `(both unit arms need the operand twice — bind it to a const first)`,
+      );
+    }
+    return {
+      kind: "logical",
+      op: negated ? "&&" : "||",
+      left: isTag(tags[0]!),
+      right: isTag(tags[1]!),
+      type: BOOL,
+      loc,
+    };
+  }
+  if (other.type.kind === "void") {
+    return null; // no static tag to test — keep the fence
+  }
+  // The env-volatility escape (see lowerUnitComparison): a narrowed
+  // process.env read compares its FRESH union tag instead of folding.
+  const envRead = volatileEnvRead(other);
+  if (envRead && envRead.type.kind === "union") {
+    const def = lowerer.unions.get(envRead.type.unionId);
+    const tag = def ? def.arms.findIndex((a) => isUnitType(a)) : -1;
+    if (tag >= 0) {
+      return {
+        kind: "unionIsTag",
+        unionId: envRead.type.unionId,
+        tag,
+        negated,
+        value: envRead,
+        type: BOOL,
+        loc,
+      };
+    }
+  }
+  // A non-nullable operand (tsc allows the comparison as a guard):
+  // `== null` is statically false, `!= null` statically true.
+  return { kind: "boolLit", value: negated, type: BOOL, loc };
+}
+
+/** A plain value read that may be runtime-optional: an unchecked element
+ * read, or a binding, member or call that carries one. Lowering these
+ * without a destination type is the same as lowering them into one. */
+function isPlainValueRead(node: ts.Expression): boolean {
+  while (ts.isParenthesizedExpression(node)) node = node.expression;
+  return (
+    ts.isElementAccessExpression(node) ||
+    ts.isIdentifier(node) ||
+    ts.isPropertyAccessExpression(node) ||
+    ts.isCallExpression(node)
+  );
+}
+
+/** A member access or call receiver needs the present value itself (JS
+ * throws a TypeError reading a member of undefined). */
+function isMemberReceiver(node: ts.Expression): boolean {
+  let child: ts.Node = node;
+  let parent = node.parent;
+  while (ts.isParenthesizedExpression(parent)) {
+    child = parent;
+    parent = parent.parent;
+  }
+  return (
+    ((ts.isPropertyAccessExpression(parent) ||
+      ts.isElementAccessExpression(parent) ||
+      ts.isCallExpression(parent)) &&
+      parent.expression === child) ||
+    (ts.isTaggedTemplateExpression(parent) && parent.tag === child)
+  );
+}
+
+export function lowerNullishPair(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+  loc: SrcLoc,
+  left: IrExpr,
+): IrExpr {
+  if (left.type.kind === "dyn") {
+    // `a ?? b` on a CHECKED-DYNAMIC left: the deciding test is the
+    // runtime kind (scr_dyn_is_nullish — UNDEF/NULL take the default).
+    // Both sides live in the checked-dynamic tree — the right converts through
+    // the usual boundary and evaluates lazily in its branch; a default
+    // with no dyn representation keeps the fence.
+    const right = lowerer.coerceToExpected(lowerer.lowerExpr(expr.right), DYN);
+    if (right.type.kind !== "dyn") {
+      lowerer.unsupported(
+        "SC1100",
+        expr,
+        "nullish coalescing on 'unknown' values against defaults with no dynamic representation",
+      );
+    }
+    return { kind: "nullish", left, right, type: DYN, loc };
+  }
+
+  if (left.type.kind !== "union") return left;
+  const def = lowerer.unions.get(left.type.unionId);
+  if (!def) lowerer.badType(expr.left, lowerer.typeOf(expr.left));
+  if (!def.arms.some(isUnitType)) return left;
+  const rest = def.arms.filter((a) => !isUnitType(a));
+  // `optionalMap ?? new Map()` carries its element contract on the left;
+  // the empty fallback may use it without constructing a Map<any, any>
+  // arm that has no first-class union representation.
+  const fresh = rest.length === 1 ? lowerer.emptyCollectionFor(expr.right, rest[0]!) : null;
+  if (fresh) return { kind: "nullish", left, right: fresh, type: fresh.type, loc };
+  let type = lowerer.irTypeOf(expr);
+  // A runtime-optional read can reach the default even when declarations
+  // call the left side present. Preserve a differently typed primitive
+  // fallback rather than checking it against that incomplete result type.
+  const rightType = lowerer.mapTypeOf(lowerer.typeOf(expr.right));
+  const primitive = (t: IrType): boolean =>
+    t.kind === "f64" || t.kind === "string" || t.kind === "bool";
+  if (
+    rightType &&
+    primitive(type) &&
+    primitive(rightType) &&
+    !typeEquals(type, rightType) &&
+    rest.every(primitive)
+  ) {
+    const arms = [...rest];
+    if (!arms.some((arm) => typeEquals(arm, rightType))) arms.push(rightType);
+    arms.sort((a, b) => (typeKey(a) < typeKey(b) ? -1 : 1));
+    type = { kind: "union", unionId: lowerer.unions.intern(arms) };
+    lowerer.runtimeOptionalArithmeticTypes.set(expr, type);
+  }
+  if (type.kind === "dyn" && lowerer.dynConvertible(left.type)) {
+    return {
+      kind: "nullish",
+      left: lowerer.coerceToExpected(left, DYN),
+      right: lowerer.lowerExprExpecting(expr.right, DYN),
+      type: DYN,
+      loc,
+    };
+  }
+  // A runtime-optional default (`name ?? names[0]`): the checker types an
+  // unchecked element read as the bare element type, but an out-of-range
+  // read is undefined at runtime. When the default shares the left's
+  // optional union, that union is the result, so the undefined state
+  // reaches the consumer (an optional return or parameter takes it as its
+  // undefined arm; a plain slot still extracts the element with its
+  // checked narrow).
+  if (
+    rest.length === 1 &&
+    typeEquals(type, rest[0]!) &&
+    isPlainValueRead(expr.right) &&
+    !isMemberReceiver(expr)
+  ) {
+    const raw = lowerer.lowerExpr(expr.right);
+    if (typeEquals(raw.type, left.type))
+      return { kind: "nullish", left, right: raw, type: left.type, loc };
+    // `names[0] ?? undefined`: an explicit unit default stays the left's arm.
+    if (isUnitType(raw.type) && lowerer.armTag(left.type.unionId, raw.type) >= 0) {
+      const right = lowerer.coerceInto(expr.right, raw, left.type);
+      return { kind: "nullish", left, right, type: left.type, loc };
+    }
+    return { kind: "nullish", left, right: lowerer.coerceInto(expr.right, raw, type), type, loc };
+  }
+  if (typeEquals(type, left.type) || (rest.length === 1 && typeEquals(type, rest[0]!))) {
+    const right = lowerer.lowerExprExpecting(expr.right, type);
+    return { kind: "nullish", left, right, type, loc };
+  }
+  if (type.kind !== "union" && rest.length > 1 && rest.some((arm) => typeEquals(arm, type))) {
+    const helper = lowerer.narrowedArmHelper(left.type.unionId, type, loc);
+    if (helper !== null) {
+      return nullishBranches(
+        lowerer,
+        left,
+        left.type,
+        def.arms,
+        type,
+        loc,
+        () => lowerer.lowerExprExpecting(expr.right, type),
+        (stable) => ({ kind: "call", callee: helper, args: [stable], type, loc }),
+      );
+    }
+  }
+  // A subclass value defaulted to a base-class value (`circle ?? shape`):
+  // the present arm upcasts after the original nullish test, and the
+  // default lowers lazily into the base-class result.
+  const present = rest.length === 1 ? rest[0]! : null;
+  if (
+    present?.kind === "object" &&
+    type.kind === "object" &&
+    present.className !== type.className &&
+    lowerer.isSubclassOf(present.className, type.className)
+  ) {
+    const helper = lowerer.narrowedArmHelper(left.type.unionId, present, loc);
+    if (helper !== null) {
+      return nullishBranches(
+        lowerer,
+        left,
+        left.type,
+        def.arms,
+        type,
+        loc,
+        () => lowerer.lowerExprExpecting(expr.right, type),
+        (stable) => ({
+          kind: "upcast",
+          value: { kind: "call", callee: helper, args: [stable], type: present, loc },
+          type,
+          loc,
+        }),
+      );
+    }
+  }
+  // A default may change the union or widen its records. Test the
+  // original tag before coercing: converting the whole left first can
+  // lose nullish arms, and evaluating the default eagerly loses laziness.
+  if (type.kind === "union") {
+    const retag =
+      lowerer.unionRetagHelper(left.type.unionId, type.unionId, loc) ??
+      lowerer.narrowedRetagHelper(expr.left, left.type.unionId, type.unionId, loc);
+    if (retag !== null) {
+      // Narrowing may exclude a record/class arm while storage retains
+      // it. The checked retag traps that impossible arm, but only AFTER
+      // the original nullish test: null/undefined must reach the lazy
+      // default even when neither is representable in the result.
+      return nullishBranches(
+        lowerer,
+        left,
+        left.type,
+        def.arms,
+        type,
+        loc,
+        () => lowerer.lowerExprExpecting(expr.right, type),
+        (stable) => ({ kind: "call", callee: retag, args: [stable], type, loc }),
+      );
+    }
+  }
+  lowerer.unsupported(
+    "SC1090",
+    expr,
+    rest.length !== 1
+      ? `'??' on '${lowerer.fmt(left.type)}' (the non-nullish result is a sub-union; check a discriminant field first)`
+      : `'??' where the default changes the result type (left is '${lowerer.fmt(left.type)}' but the whole expression is '${lowerer.fmt(type)}' — give both sides one type)`,
+  );
+}
+
+/** `a[i] op= rhs` over native arrays and byte views. A compound assignment
+ * evaluates the receiver and index, reads the old element, evaluates rhs,
+ * then writes. Capture each stage so a call in the index or rhs cannot
+ * change the target or the value used by the operator. The expression yields
+ * the computed value before a typed array or Buffer coerces it for storage. */
+export function lowerElementCompound(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+  op: CompoundOp,
+): IrExpr {
+  const lowered = lowerElementCompoundParts(lowerer, expr, op, false);
+  if (!lowered.expr)
+    throw new InternalCompilerError("a compound element value lowered to statements");
+  return lowered.expr;
+}
+
+/** JavaScript callable members live on the closure, so aliases and chained
+ * writes share the same storage as Object.defineProperties. */
+export function lowerNativeFunctionAssignment(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+): IrExpr | null {
+  const target = expr.left;
+  if (
+    !isJsSourceFile(expr.getSourceFile()) ||
+    (!ts.isPropertyAccessExpression(target) && !ts.isElementAccessExpression(target)) ||
+    target.questionDotToken
+  )
+    return null;
+  // Checked constructors share the callable's live property descriptors.
+  const classType = storedClassValueType(lowerer, target.expression);
+  const staticClass =
+    classType?.kind === "classval" ? lowerer.classes.get(classType.className) : undefined;
+  if (staticClass && hasRuntimeStatics(staticClass)) {
+    return lowerDynMemberAssignment(
+      lowerer,
+      expr,
+      lowerer.lowerExprExpecting(target.expression, DYN),
+    );
+  }
+  // Other class statics and prototype tables have their own paths.
+  // Probing them as ordinary functions could materialize unused methods.
+  if (
+    lowerer.exactClassOfReceiver(target.expression) ||
+    (ts.isPropertyAccessExpression(target.expression) &&
+      target.expression.name.text === "prototype" &&
+      lowerer.exactClassOfReceiver(target.expression.expression))
+  )
+    return null;
+  const receiver = tryLowerExpression(lowerer, target.expression);
+  if (
+    receiver?.type.kind !== "func" ||
+    !canBoxFuncIntoDyn(
+      receiver.type,
+      (id) => lowerer.shapes.get(id),
+      (id) => lowerer.unions.get(id),
+    )
+  )
+    return null;
+  fenceNodeModuleMutation(lowerer, target, "assignment");
+  const fnName = jsFuncNameOf(target.expression);
+  const boxed: IrExpr = {
+    kind: "dynFrom",
+    value: receiver,
+    type: DYN,
+    loc: locOf(target.expression),
+    ...(fnName !== null ? { fnName } : {}),
+  };
+  return lowerDynMemberAssignment(lowerer, expr, boxed);
+}
+
+/** `typeof globalThis.AbortSignal.any === "function"`: the comparison
+ * folds with constructorGlobalTypeof's answer. */
+function lowerConstructorGlobalTypeofTest(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+  loc: SrcLoc,
+): IrExpr | null {
+  const negated = expr.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken;
+  for (const [a, b] of operandPairs(expr)) {
+    if (!ts.isTypeOfExpression(a) || !ts.isStringLiteral(b)) continue;
+    const answer = constructorGlobalTypeof(lowerer, a.expression);
+    if (answer !== null)
+      return { kind: "boolLit", value: (answer === b.text) !== negated, type: BOOL, loc };
+  }
+  return null;
+}
+
+export function ensureString(lowerer: Lowerer, e: IrExpr, node: ts.Node): IrExpr {
+  if (e.type.kind === "string") return e;
+  if (e.type.kind === "url")
+    return { kind: "libCall", fn: "url.href", args: [e], type: STRING, loc: e.loc };
+  // String(date) / `${date}` / "" + date: Date's ToPrimitive prefers
+  // toString().
+  if (e.type.kind === "date")
+    return { kind: "libCall", fn: "date.toString", args: [e], type: STRING, loc: e.loc };
+  if (e.type.kind === "regex") {
+    return {
+      kind: "regexIntrinsic",
+      method: "toString",
+      receiver: e,
+      args: [],
+      type: STRING,
+      loc: e.loc,
+    };
+  }
+  if (e.type.kind === "bigint") {
+    return {
+      kind: "libCall",
+      fn: "bigint.toString",
+      args: [e, { kind: "numLit", value: 10, type: F64, loc: e.loc }],
+      type: STRING,
+      loc: e.loc,
+    };
+  }
+  if (e.type.kind === "dyn") {
+    // String(u) / `${u}`: a runtime dispatch over the dyn kind — Node's
+    // String() exactly (undefined/null texts, JS number formatting,
+    // strings verbatim, arrays via join, objects as "[object Object]").
+    return { kind: "toString", operand: e, type: STRING, loc: e.loc };
+  }
+  if (e.type.kind === "bytes") {
+    // Preserve the runtime brand: typed arrays join numeric elements,
+    // while a Buffer stored in a Uint8Array slot decodes its bytes.
+    const boxed: IrExpr = { kind: "dynFrom", value: e, type: DYN, loc: e.loc };
+    return { kind: "toString", operand: boxed, type: STRING, loc: e.loc };
+  }
+
+  if (e.type.kind === "object") {
+    // String(err) / `${err}` uses the same dispatch as err.toString().
+    for (let c = lowerer.classes.get(e.type.className) ?? null; c; c = c.base) {
+      if (c.builtinError) {
+        return errorToStringCall(lowerer, e);
+      }
+    }
+    // A program class instance converts through its own methods.
+    const converted = classToStringConversion(lowerer, e, "string", node);
+    if (converted) return converted;
+  }
+  if (e.type.kind === "union") {
+    // `${u}` — the arm's ToString via a per-union interned helper
+    // (sc_us_*), Node-exact per arm kind: unit arms are the known texts
+    // "undefined"/"null", string arms pass through, f64/bool arms use the
+    // JS-exact formatters. Ref arms (records, arrays, ...) stay fenced:
+    // JS would print "[object Object]" and friends — narrow first.
+    const def = lowerer.unions.get(e.type.unionId);
+    const stringable = def?.arms.every(
+      (a) =>
+        a.kind === "undefinedT" ||
+        a.kind === "nullT" ||
+        a.kind === "string" ||
+        a.kind === "f64" ||
+        a.kind === "bigint" ||
+        a.kind === "bool",
+    );
+    if (stringable) {
+      return { kind: "toString", operand: e, type: STRING, loc: e.loc };
+    }
+    // Runtime-optional locals can retain their stored union after the
+    // checker has narrowed this use to a primitive arm. Validate that
+    // arm before converting it; an unguarded object arm stays fenced.
+    const narrowed = lowerer.mapTypeOf(lowerer.typeOf(node));
+    if (
+      narrowed &&
+      (narrowed.kind === "string" ||
+        narrowed.kind === "f64" ||
+        narrowed.kind === "bool" ||
+        narrowed.kind === "bigint")
+    ) {
+      const helper = lowerer.narrowedArmHelper(e.type.unionId, narrowed, e.loc);
+      if (helper) {
+        return ensureString(lowerer, lowerer.checkedNarrowCall(helper, e, narrowed, e.loc), node);
+      }
+    }
+    if (
+      narrowed?.kind === "union" &&
+      !typeEquals(narrowed, e.type) &&
+      lowerer.unions
+        .get(narrowed.unionId)
+        ?.arms.every(
+          (arm) =>
+            isUnitType(arm) ||
+            arm.kind === "string" ||
+            arm.kind === "f64" ||
+            arm.kind === "bool" ||
+            arm.kind === "bigint",
+        )
+    ) {
+      const helper = lowerer.narrowedRetagHelper(node, e.type.unionId, narrowed.unionId, e.loc);
+      if (helper)
+        return ensureString(
+          lowerer,
+          { kind: "call", callee: helper, args: [e], type: narrowed, loc: e.loc },
+          node,
+        );
+    }
+    const viaClasses = classUnionToString(lowerer, e, "string", node);
+    if (viaClasses) return viaClasses;
+    lowerer.unsupported(
+      "SC1090",
+      node,
+      `string conversions of unions with object arms (${NARROW_FIRST})`,
+    );
+  }
+  if (e.type.kind === "symbol") {
+    // JS splits here: `${sym}` and concatenation THROW a TypeError,
+    // String(sym) answers "Symbol(desc)". One shared lowering cannot
+    // honor both — fence with the sanctioned spelling instead of
+    // guessing the context.
+    lowerer.unsupported(
+      "SC1090",
+      node,
+      "string conversions of symbol values (template literals throw in JS — call .toString() explicitly)",
+    );
+  }
+  if (isUnitType(e.type)) {
+    if (e.kind === "unitLit") {
+      return { kind: "strLit", value: e.unit, type: STRING, loc: e.loc };
+    }
+    // Keep sequencing and branch effects even though the final unit's
+    // spelling is constant. Never turn an unknown producer into a literal.
+    if (e.kind === "seqExpr") {
+      return { ...e, result: lowerer.ensureString(e.result, node), type: STRING };
+    }
+    if (e.kind === "ternary") {
+      return {
+        ...e,
+        then: lowerer.ensureString(e.then, node),
+        else_: lowerer.ensureString(e.else_, node),
+        type: STRING,
+      };
+    }
+    lowerer.unsupported(
+      "SC1090",
+      node,
+      `string conversions of '${e.type.kind === "undefinedT" ? "undefined" : "null"}' values`,
+    );
+  }
+  if (e.type.kind === "array") {
+    // `${[1,2,3]}` / String(arr): Array.prototype.toString IS join(",")
+    // — the SAME intrinsic the .join() lowering emits, fenced to the
+    // same element kinds (f64/string/bool, unions of those with unit
+    // arms printing empty). Nested arrays would need JS's recursive
+    // dispatch — the join fence already tells that story.
+    const elem = e.type.elem;
+    const joinableUnion =
+      elem.kind === "union" &&
+      (lowerer.unions
+        .get(elem.unionId)
+        ?.arms.every(
+          (a) => a.kind === "f64" || a.kind === "string" || a.kind === "bool" || isUnitType(a),
+        ) ??
+        false);
+    if (elem.kind === "f64" || elem.kind === "string" || elem.kind === "bool" || joinableUnion) {
+      const sep: IrExpr = { kind: "strLit", value: ",", type: STRING, loc: e.loc };
+      return {
+        kind: "arrIntrinsic",
+        method: "join",
+        receiver: e,
+        args: [sep],
+        type: STRING,
+        loc: e.loc,
+      };
+    }
+  }
+  if (e.type.kind === "record") {
+    // `${obj}` / String(obj): a plain data record has no toString of its
+    // own (a func-typed `toString` FIELD would shadow the prototype's —
+    // JS would call it, so that shape keeps the fence), and a TUPLE
+    // prints its elements like an array (not lowered — fenced) — every
+    // other record is Object.prototype.toString's constant.
+    const shape = lowerer.shapes.get(e.type.shapeId);
+    if (isPerfEntryType(lowerer, e.type)) return perfEntryTag(lowerer, e, e.type, e.loc);
+    if (shape && !shape.tuple && !shape.fields.some((f) => f.name === "toString")) {
+      // A null-prototype record (Object.groupBy) has no toString or
+      // valueOf: ToPrimitive throws Node's TypeError.
+      const nullProtoT = nullProtoRecordShape(lowerer, e.type);
+      if (nullProtoT) return nullProtoToString(lowerer, e, nullProtoT);
+      return { kind: "toString", operand: e, type: STRING, loc: e.loc };
+    }
+  }
+  if (e.type.kind !== "f64" && e.type.kind !== "bool") lowerer.badType(node, lowerer.typeOf(node));
+  return { kind: "toString", operand: e, type: STRING, loc: e.loc };
+}
+
+/** String(r) over a record that may have a null prototype: an interned
+ * helper that throws Node's TypeError for a null-prototype record and
+ * answers "[object Object]" otherwise. */
+function nullProtoToString(lowerer: Lowerer, e: IrExpr, t: IrType & { kind: "record" }): IrExpr {
+  const loc = e.loc;
+  const key = `nullProtoToString:${t.shapeId}`;
+  let helper = lowerer.valueHelpers.get(key);
+  if (!helper) {
+    helper = `%rec.tostr.${lowerer.valueHelpers.size}`;
+    lowerer.valueHelpers.set(key, helper);
+    const r = varRef("r.0", t, loc);
+    lowerer.liftedFns.push({
+      name: helper,
+      params: [{ localId: "r.0", name: "r", type: t }],
+      returnType: STRING,
+      locals: [{ id: "r.0", name: "r", type: t, mutable: false }],
+      body: [
+        {
+          kind: "return",
+          value: guardNullProto(
+            r,
+            t.shapeId,
+            "Cannot convert object to primitive value",
+            { kind: "toString", operand: r, type: STRING, loc },
+            loc,
+          ),
+          loc,
+        },
+      ],
+      loc,
+    });
+  }
+  return { kind: "call", callee: helper, args: [e], type: STRING, loc };
+}
+
+/** Whether a lowered statement can live inside a seqExpr. These statements
+ * do not leave the expression through a jump; the native emitters can place
+ * their writes and local state branches before evaluating the final result.
+ * Blocks check their bodies recursively. */
+function seqExprSafeStmt(s: IrStmt): boolean {
+  switch (s.kind) {
+    case "varDecl":
+    case "assign":
+    case "exprStmt":
+    case "fieldSet":
+    case "recordSet":
+    case "recordKeySet":
+    case "arraySet":
+    case "arraySetLength":
+    case "bytesSet":
+    case "arraySetUndefined":
+    case "arrayDelete":
+      return true;
+    case "if":
+      return s.then.every(seqExprSafeStmt) && (s.else_?.every(seqExprSafeStmt) ?? true);
+    case "block":
+      return s.body.every(seqExprSafeStmt);
+    default:
+      return false;
+  }
+}
+
+export function lowerCompoundValueToTarget(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+  compound: CompoundOp,
+  target: { id: string; type: IrType },
+): IrExpr {
+  const loc = locOf(expr);
+  const read: IrExpr = {
+    kind: "varRef",
+    localId: target.id,
+    type: target.type,
+    loc: locOf(expr.left),
+  };
+  const rhs = lowerer.lowerExpr(expr.right);
+  const numericRead = lowerOptionalNumber(lowerer, read, loc);
+  const numericRhs = lowerOptionalNumber(lowerer, rhs, loc);
+
+  if (
+    compound === "+" &&
+    (target.type.kind === "string" ||
+      (target.type.kind === "union" &&
+        lowerer.stripUndefinedArm(target.type).kind === "string" &&
+        rhs.type.kind === "string"))
+  ) {
+    return lowerer.coerceInto(
+      expr,
+      {
+        kind: "strConcat",
+        left: lowerer.ensureString(read, expr.left),
+        right: concatOperand(lowerer, rhs, expr.right),
+        type: STRING,
+        loc,
+      },
+      target.type,
+    );
+  }
+  if (numericRead.type.kind === "f64" && numericRhs.type.kind === "f64") {
+    return lowerer.coerceInto(
+      expr,
+      { kind: "bin", op: compound, left: numericRead, right: numericRhs, type: F64, loc },
+      target.type,
+    );
+  }
+  // An untyped operand: exactly the expanded `x = x op rhs` — the runtime
+  // operator on both values, then the checked conversion into the
+  // target's declared type (a string result for a number target throws the
+  // catchable TypeError, as the expanded assignment does).
+  if (
+    (target.type.kind === "dyn" || rhs.type.kind === "dyn") &&
+    (isJsSourceFile(expr.getSourceFile()) ||
+      (lowerer.dynConvertible(read.type) && lowerer.dynConvertible(rhs.type)))
+  ) {
+    const left = lowerer.coerceInto(expr.left, read, DYN);
+    const right = lowerer.coerceInto(expr.right, rhs, DYN);
+    return lowerer.coerceInto(expr, dynCompoundValue(compound, left, right, loc), target.type);
+  }
+  const bigint = bigintCompoundValue(compound, read, rhs, loc);
+  if (bigint) return bigint;
+  compoundUnsupported(lowerer, expr, compound, read.type, rhs.type);
+}
+
+/** Equality of two NaN-coded values (nan-coded-reads.ts), each of which may
+ * stand for undefined and never holds a genuine NaN: Node's undefined equals
+ * undefined, so two NaNs compare equal here. Operands evaluate once, in
+ * order. */
+function lowerNanCodedEquality(lowerer: Lowerer, expr: ts.BinaryExpression): IrExpr | null {
+  const loc = locOf(expr);
+  const left = lowerer.lowerExpr(expr.left);
+  const right = lowerer.lowerExpr(expr.right);
+  if (left.type.kind !== "f64" || right.type.kind !== "f64") {
+    throw new InternalCompilerError("NaN-coded equality operand is not a plain number");
+  }
+  const stmts: IrStmt[] = [];
+  const stable = (value: IrExpr, name: string): IrExpr => {
+    if (value.kind === "varRef" || value.kind === "numLit") return value;
+    const tmp = lowerer.declareHiddenLocal(name, F64);
+    stmts.push({ kind: "varDecl", localId: tmp.id, init: value, loc });
+    return varRef(tmp.id, F64, loc);
+  };
+  const a = stable(left, "%eqLeft");
+  const b = stable(right, "%eqRight");
+  const isNaN = (value: IrExpr): IrExpr => ({
+    kind: "libCall",
+    fn: "num.isNaN",
+    args: [value],
+    type: BOOL,
+    loc,
+  });
+  const bothUndefined: IrExpr = {
+    kind: "logical",
+    op: "&&",
+    left: isNaN(a),
+    right: isNaN(b),
+    type: BOOL,
+    loc,
+  };
+  const op = expr.operatorToken.kind;
+  const negated =
+    op === ts.SyntaxKind.ExclamationEqualsEqualsToken ||
+    op === ts.SyntaxKind.ExclamationEqualsToken;
+  const result: IrExpr = negated
+    ? {
+        kind: "logical",
+        op: "&&",
+        left: { kind: "bin", op: "!==", left: a, right: b, type: BOOL, loc },
+        right: { kind: "unary", op: "!", operand: bothUndefined, type: BOOL, loc },
+        type: BOOL,
+        loc,
+      }
+    : {
+        kind: "logical",
+        op: "||",
+        left: { kind: "bin", op: "===", left: a, right: b, type: BOOL, loc },
+        right: bothUndefined,
+        type: BOOL,
+        loc,
+      };
+  return stmts.length === 0 ? result : { kind: "seqExpr", stmts, result, type: BOOL, loc };
+}
+
+export function lowerBinary(lowerer: Lowerer, expr: ts.BinaryExpression): IrExpr {
+  const loc = locOf(expr);
+  const op = expr.operatorToken.kind;
+
+  const cacheHas = lowerRequireCacheHas(lowerer, expr);
+  if (cacheHas) return cacheHas;
+
+  if (lowerer.nanCodedReads?.needsUndefinedEquality(expr)) {
+    const undefinedEquality = lowerNanCodedEquality(lowerer, expr);
+    if (undefinedEquality) return undefinedEquality;
+  }
+
+  if (
+    op === ts.SyntaxKind.EqualsToken ||
+    (op >= ts.SyntaxKind.FirstCompoundAssignment && op <= ts.SyntaxKind.LastCompoundAssignment)
+  ) {
+    const urlWrite = lowerUrlAssignment(lowerer, expr);
+    if (urlWrite) return urlWrite;
+    if (op === ts.SyntaxKind.EqualsToken) {
+      const prototypeWrite = lowerClassPrototypeComputedAssignment(lowerer, expr);
+      if (prototypeWrite) return prototypeWrite;
+      const callableWrite = lowerNativeFunctionAssignment(lowerer, expr);
+      if (callableWrite) return callableWrite;
+    }
+    if (
+      op === ts.SyntaxKind.QuestionQuestionEqualsToken ||
+      op === ts.SyntaxKind.AmpersandAmpersandEqualsToken ||
+      op === ts.SyntaxKind.BarBarEqualsToken
+    ) {
+      return lowerShortCircuitAssignment(lowerer, expr);
+    }
+    if (ts.isPropertyAccessExpression(expr.left) || ts.isElementAccessExpression(expr.left)) {
+      fenceNodeModuleMutation(lowerer, expr.left, "assignment");
+    }
+    // The writable Event accessors on Event subclass instances, in value
+    // position (`const r = (event.returnValue = false)`).
+    if (op === ts.SyntaxKind.EqualsToken && ts.isPropertyAccessExpression(expr.left)) {
+      const eventWrite = lowerEventObjectPropertyWrite(lowerer, expr.left, expr.right);
+      if (eventWrite) return eventWrite;
+    }
+    // `x = e` in EXPRESSION position (`while ((idx = s.indexOf("\n")) !== -1)`,
+    // `f(x = v)`): evaluate e once, write the binding, yield the assigned
+    // value — JS evaluation order. Variable targets only (locals and module
+    // globals, captured/boxed included); the RHS coerces into the binding's
+    // type exactly like statement position, and the expression's value is
+    // the coerced binding-typed value (representation change only — never
+    // observably different from JS's raw-RHS yield). Indexed compounds
+    // use a sequenced read/modify/write; other member targets and
+    // destructuring targets stay fenced.
+    if (op === ts.SyntaxKind.EqualsToken && ts.isIdentifier(expr.left)) {
+      const target = lowerer.resolveWritable(expr.left);
+      if (!target) {
+        lowerer.rejectUnresolved(
+          expr.left,
+          `assignment to '${expr.left.text}' (not a writable local or module global)`,
+        );
+      }
+      const value = lowerer.lowerExprExpecting(expr.right, target.type);
+      const runtimeOptionalRoot = lowerer.runtimeOptionalRootOf(target);
+      if (lowerer.runtimeOptionalStorageLocals.has(runtimeOptionalRoot))
+        lowerer.runtimeOptionalLocals.add(runtimeOptionalRoot);
+      return { kind: "assignExpr", localId: target.id, value, type: target.type, loc };
+    }
+    const indexedCompound = COMPOUND_ASSIGN_OPS[op];
+    if (indexedCompound !== undefined && ts.isElementAccessExpression(expr.left)) {
+      if (symbolFieldInfo(lowerer, expr.left))
+        return lowerFieldCompoundValue(lowerer, expr.left, indexedCompound, expr.right, loc);
+      return lowerElementCompound(lowerer, expr, indexedCompound);
+    }
+    if (indexedCompound !== undefined && ts.isIdentifier(expr.left)) {
+      const target = lowerer.resolveWritable(expr.left);
+      if (!target) {
+        lowerer.rejectUnresolved(expr.left, "assignment to an unresolved variable");
+      }
+      const value = lowerCompoundValueToTarget(lowerer, expr, indexedCompound, target);
+      return { kind: "assignExpr", localId: target.id, value, type: target.type, loc };
+    }
+    if (
+      indexedCompound !== undefined &&
+      (ts.isPropertyAccessExpression(expr.left) || ts.isElementAccessExpression(expr.left)) &&
+      !(ts.isPropertyAccessExpression(expr.left) && expr.left.questionDotToken)
+    ) {
+      const target =
+        expandoWritableTarget(lowerer, expr.left) ??
+        (ts.isPropertyAccessExpression(expr.left) ? nsWritableTarget(lowerer, expr.left) : null);
+      if (target) {
+        const value = lowerCompoundValueToTarget(lowerer, expr, indexedCompound, target);
+        return { kind: "assignExpr", localId: target.id, value, type: target.type, loc };
+      }
+      return lowerFieldCompoundValue(lowerer, expr.left, indexedCompound, expr.right, loc);
+    }
+    // `events.defaultMaxListeners = v` — the module-property write
+    // Node validates (validateNumber(n, 'defaultMaxListeners', 0)):
+    // the value crosses into the checked-dynamic tree and the runtime ladder throws
+    // ERR_INVALID_ARG_TYPE / ERR_OUT_OF_RANGE with Node's exact slot
+    // name; valid numbers apply. The expression's value is the RHS
+    // (JS's assignment yield).
+    if (
+      op === ts.SyntaxKind.EqualsToken &&
+      ts.isPropertyAccessExpression(expr.left) &&
+      !expr.left.questionDotToken &&
+      expr.left.name.text === "defaultMaxListeners"
+    ) {
+      const bi = lowerer.builtinMemberOf(expr.left);
+      if (bi && bi.module === "events" && bi.member === "defaultMaxListeners") {
+        const rhs = lowerer.lowerExpr(expr.right);
+        if (rhs.type.kind === "dyn" || rhs.kind === "unitLit" || lowerer.dynConvertible(rhs.type)) {
+          const valTmp = lowerer.declareHiddenLocal("%setVal", rhs.type);
+          const valRef = (): IrExpr => ({
+            kind: "varRef",
+            localId: valTmp.id,
+            type: rhs.type,
+            loc,
+          });
+          const dynVal: IrExpr =
+            rhs.type.kind === "dyn"
+              ? valRef()
+              : { kind: "dynFrom", value: valRef(), type: DYN, loc };
+          return {
+            kind: "seqExpr",
+            stmts: [
+              { kind: "varDecl", localId: valTmp.id, init: rhs, loc },
+              {
+                kind: "exprStmt",
+                expr: {
+                  kind: "libCall",
+                  fn: "emitter.setDefaultMaxChk",
+                  args: [
+                    dynVal,
+                    { kind: "strLit", value: "defaultMaxListeners", type: STRING, loc },
+                  ],
+                  type: VOID,
+                  loc,
+                },
+                loc,
+              },
+            ],
+            result: valRef(),
+            type: rhs.type,
+            loc,
+          };
+        }
+      }
+    }
+    // Member targets whose storage IS a module global — namespace
+    // members (`N.x`) and expando function members (`Foo.baz`): the
+    // same assignExpr, since the "member" is a variable.
+    if (
+      op === ts.SyntaxKind.EqualsToken &&
+      (ts.isPropertyAccessExpression(expr.left) || ts.isElementAccessExpression(expr.left)) &&
+      !(ts.isPropertyAccessExpression(expr.left) && expr.left.questionDotToken)
+    ) {
+      const target =
+        expandoWritableTarget(lowerer, expr.left) ??
+        (ts.isPropertyAccessExpression(expr.left) ? nsWritableTarget(lowerer, expr.left) : null);
+      if (target) {
+        const value = lowerer.lowerExprExpecting(expr.right, target.type);
+        return { kind: "assignExpr", localId: target.id, value, type: target.type, loc };
+      }
+      // Bundled numeric enums use e[e["name"] = value] = "name".
+      // Capture the receiver and key before the RHS. PutValue coerces the
+      // key afterward, then yields the RHS without rereading the property.
+      if (ts.isElementAccessExpression(expr.left) && !expr.left.questionDotToken) {
+        const recv = tryLowerExpression(lowerer, expr.left.expression);
+        if (
+          recv &&
+          (recv.type.kind === "dyn" ||
+            (recv.type.kind === "array" &&
+              isJsSourceFile(expr.getSourceFile()) &&
+              lowerer.dynConvertible(recv.type)))
+        ) {
+          return lowerDynMemberAssignment(
+            lowerer,
+            expr,
+            lowerer.coerceInto(expr.left.expression, recv, DYN),
+          );
+        }
+        if (recv?.type.kind === "array" || recv?.type.kind === "bytes") {
+          const receiver = lowerer.declareHiddenLocal("%setArray", recv.type);
+          const index = lowerer.lowerExpr(expr.left.argumentExpression);
+          if (index.type.kind !== "f64")
+            lowerer.unsupported(
+              "SC1090",
+              expr.left.argumentExpression,
+              "indexing with non-number keys",
+            );
+          const key = lowerer.declareHiddenLocal("%setIndex", F64);
+          const raw = lowerer.lowerExpr(expr.right);
+          const value = lowerer.declareHiddenLocal("%setValue", raw.type);
+          const result = varRef(value.id, raw.type, loc);
+          const arr = varRef(receiver.id, recv.type, loc);
+          const idx = varRef(key.id, F64, loc);
+          const write: IrStmt =
+            recv.type.kind === "array"
+              ? arrayValueStore(lowerer, arr, idx, result, recv.type.elem, loc)
+              : {
+                  kind: "bytesSet",
+                  arr,
+                  index: idx,
+                  value: lowerer.coerceInto(expr.right, result, F64),
+                  loc,
+                };
+          return {
+            kind: "seqExpr",
+            stmts: [
+              { kind: "varDecl", localId: receiver.id, init: recv, loc },
+              { kind: "varDecl", localId: key.id, init: index, loc },
+              { kind: "varDecl", localId: value.id, init: raw, loc },
+              write,
+            ],
+            result,
+            type: result.type,
+            loc,
+          };
+        }
+      }
+
+      // `h.k = v` on a CHECKED-DYNAMIC receiver in VALUE position
+      // (`var _ = module.exports = foo`): receiver first, then RHS
+      // (JS's reference-before-value order), the keyed write, and the
+      // RHS value is the expression's value — its OWN type, so the
+      // consumer sees exactly what the checker typed.
+      if (ts.isPropertyAccessExpression(expr.left) && !expr.left.questionDotToken) {
+        // `const src = exports.src = []`: an export member assigned in
+        // value position writes its export global and yields the value.
+        {
+          let inFunction = false;
+          for (let p: ts.Node | undefined = expr.parent; p !== undefined; p = p.parent) {
+            if (ts.isFunctionLike(p) || ts.isClassDeclaration(p) || ts.isClassExpression(p)) {
+              inFunction = true;
+              break;
+            }
+          }
+          const g = inFunction
+            ? cjsExportMemberWriteGlobalOf(lowerer, expr.left)
+            : cjsInFileExportGlobalOf(lowerer, expr.left);
+          if (g) {
+            const value = lowerer.lowerExprExpecting(expr.right, g.type);
+            const tmp = lowerer.declareHiddenLocal("%exportValue", value.type);
+            const result = varRef(tmp.id, value.type, loc);
+            return {
+              kind: "seqExpr",
+              stmts: [
+                { kind: "varDecl", localId: tmp.id, init: value, loc },
+                { kind: "assign", localId: g.id, value: result, loc },
+              ],
+              result,
+              type: value.type,
+              loc,
+            };
+          }
+        }
+        const recv = tryLowerExpression(lowerer, expr.left.expression);
+        if (recv && recv.type.kind === "dyn") return lowerDynMemberAssignment(lowerer, expr, recv);
+        const unionWrite = lowerUnionFieldWrite(lowerer, expr.left, expr.right);
+        if (unionWrite) return unionWrite;
+        const field = lowerer.fieldTarget(expr.left);
+        if (field) {
+          const recvTmp = lowerer.declareHiddenLocal("%setReceiver", field.obj.type);
+          const receiver = field.obj;
+          field.obj = varRef(recvTmp.id, receiver.type, loc);
+          const value = lowerer.lowerExprExpecting(expr.right, field.fieldType);
+          const valTmp = lowerer.declareHiddenLocal("%setValue", value.type);
+          const result = varRef(valTmp.id, value.type, loc);
+          return {
+            kind: "seqExpr",
+            stmts: [
+              { kind: "varDecl", localId: recvTmp.id, init: receiver, loc },
+              { kind: "varDecl", localId: valTmp.id, init: value, loc },
+              lowerer.fieldSetStmt(field, result, loc, expr.left),
+            ],
+            result,
+            type: result.type,
+            loc,
+          };
+        }
+      }
+    }
+    // Destructuring assignment in VALUE position (`(() => [i] = [i+1])()`,
+    // `({} = {x} = a)`, `var d = ([] = src)`): the statement machinery's
+    // parts under a seqExpr — the expression's value is the RHS value
+    // (JS's GetValue of the right reference), which is exactly the
+    // parts' hidden temp.
+    if (
+      op === ts.SyntaxKind.EqualsToken &&
+      (ts.isObjectLiteralExpression(expr.left) || ts.isArrayLiteralExpression(expr.left))
+    ) {
+      const parts = lowerer.lowerDestructuringAssignParts(expr.left, expr.right, loc);
+      return {
+        kind: "seqExpr",
+        stmts: parts.stmts,
+        result: parts.value,
+        type: parts.value.type,
+        loc,
+      };
+    }
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      op === ts.SyntaxKind.EqualsToken
+        ? "assignment to non-variables as an expression (only `x = e` over a variable yields a value; write property/destructuring assignments as statements)"
+        : "compound assignment as an expression (write `x op= e` as a statement, or spell out `x = x op e`)",
+    );
+  }
+  if (op === ts.SyntaxKind.EqualsEqualsToken || op === ts.SyntaxKind.ExclamationEqualsToken) {
+    const nullTest = lowerLooseNullCompare(lowerer, expr, loc);
+    if (nullTest) return nullTest;
+    const loose = lowerAbstractEquality(
+      lowerer,
+      deferredSlotOr(lowerer, lowerer.lowerExpr(expr.left)),
+      deferredSlotOr(lowerer, lowerer.lowerExpr(expr.right)),
+      op === ts.SyntaxKind.ExclamationEqualsToken,
+      loc,
+    );
+    if (loose) return loose;
+    lowerer.unsupported(
+      "SC1040",
+      expr,
+      undefined,
+      "object-to-primitive loose equality can call user-defined valueOf/toString methods — compare explicit primitive conversions instead",
+    );
+  }
+  if (op === ts.SyntaxKind.AmpersandAmpersandToken || op === ts.SyntaxKind.BarBarToken) {
+    return lowerLogicalChain(lowerer, expr);
+  }
+  if (op === ts.SyntaxKind.QuestionQuestionToken) {
+    return lowerer.lowerNullishCoalesce(expr, loc);
+  }
+  if (op === ts.SyntaxKind.CommaToken) {
+    // Comma expression in VALUE position (`r = ({} = a, [] = a)` — the
+    // conformance corpus's paired-destructuring idiom): the left operand
+    // runs for EFFECT exactly as its statement lowering (JS discards its
+    // value), the right operand is the expression's value — a seqExpr.
+    // The validator restricts seqExpr statements to straight-line writes
+    // (the lowering point is mid-expression), so a left operand whose
+    // statement lowering needs real control flow keeps a pointed fence
+    // instead of tripping the validator downstream.
+    const effect = lowerer.lowerExprStatement(expr.left);
+    if (!seqExprSafeStmt(effect)) {
+      lowerer.unsupported(
+        "SC1090",
+        expr.left,
+        "comma expressions whose left operand needs control flow (run it as its own statement first)",
+      );
+    }
+    const result = lowerer.lowerExpr(expr.right);
+    return { kind: "seqExpr", stmts: [effect], result, type: result.type, loc };
+  }
+  if (op === ts.SyntaxKind.InstanceOfKeyword) return lowerer.lowerInstanceOf(expr, loc);
+  if (op === ts.SyntaxKind.InKeyword) {
+    return lowerInExpression(lowerer, expr, loc);
+  }
+  // `typeof e === "string"` on a catch binding or an `unknown` value: a
+  // runtime kind test — intercepted BEFORE the operands lower (a raw
+  // read of the binding is the narrowness fence, and bare `typeof e`
+  // has no lowering).
+  if (
+    op === ts.SyntaxKind.EqualsEqualsEqualsToken ||
+    op === ts.SyntaxKind.ExclamationEqualsEqualsToken
+  ) {
+    const test =
+      lowerConstructorGlobalTypeofTest(lowerer, expr, loc) ??
+      lowerWebAssemblyTypeofTest(lowerer, expr, loc) ??
+      lowerErrorCodeTypeofTest(lowerer, expr, loc) ??
+      lowerer.lowerCaughtTypeofTest(expr, loc) ??
+      lowerDynTypeofTest(lowerer, expr, loc) ??
+      lowerUnionTypeofTest(lowerer, expr, loc);
+    if (test) return test;
+  }
+  // `C === EventEmitter` between two builtin class references: the
+  // classes are compile-time values, so the answer folds.
+  if (
+    op === ts.SyntaxKind.EqualsEqualsEqualsToken ||
+    op === ts.SyntaxKind.ExclamationEqualsEqualsToken
+  ) {
+    const leftClass = builtinClassRefOf(lowerer, expr.left);
+    const rightClass = leftClass === null ? null : builtinClassRefOf(lowerer, expr.right);
+    if (leftClass !== null && rightClass !== null) {
+      const negated = op === ts.SyntaxKind.ExclamationEqualsEqualsToken;
+      const same = sameBuiltinClass(leftClass, rightClass);
+      return { kind: "boolLit", value: same !== negated, type: BOOL, loc };
+    }
+  }
+
+  const strictEquality =
+    op === ts.SyntaxKind.EqualsEqualsEqualsToken ||
+    op === ts.SyntaxKind.ExclamationEqualsEqualsToken;
+  // An identifier whose storage is runtime-optional is compared by its
+  // stored value: the checker's narrowing to the present arm is not a
+  // runtime proof. Identifier reads are pure, so taking the stored value
+  // after both operands lowered keeps the evaluation order. A union on
+  // the other side keeps the narrowed read (union-to-union comparison
+  // has no lowering).
+  let left = strictEquality
+    ? (lowerAbsenceProbe(lowerer, expr.left) ?? lowerer.lowerExpr(expr.left))
+    : lowerer.lowerExpr(expr.left);
+  let right = strictEquality
+    ? (lowerAbsenceProbe(lowerer, expr.right) ?? lowerer.lowerExpr(expr.right))
+    : lowerer.lowerExpr(expr.right);
+  if (strictEquality) {
+    const storedLeft = runtimeOptionalStorageOperand(lowerer, expr.left);
+    const storedRight = runtimeOptionalStorageOperand(lowerer, expr.right);
+    if (storedLeft !== null && right.type.kind !== "union") left = storedLeft;
+    if (storedRight !== null && left.type.kind !== "union") right = storedRight;
+    // A typed-array read compared with a plain number needs no
+    // `number | undefined` box.
+    const fusedLeft = tryLowerBytesReadNumberEquality(lowerer, left, right, expr.right);
+    if (fusedLeft) left = fusedLeft;
+    else {
+      const fusedRight = tryLowerBytesReadNumberEquality(lowerer, right, left, expr.left);
+      if (fusedRight) right = fusedRight;
+    }
+  }
+  if (strictEquality && (left.type.kind === "caught" || right.type.kind === "caught")) {
+    if (left.type.kind === "caught")
+      left = { kind: "caughtToDyn", value: left, type: DYN, loc: left.loc };
+    if (right.type.kind === "caught")
+      right = { kind: "caughtToDyn", value: right, type: DYN, loc: right.loc };
+  }
+  if (left.type.kind === "dyn" || right.type.kind === "dyn") {
+    // The narrowing unit comparisons ARE answerable on unknown: `v ===
+    // undefined` / `v !== null` test the dyn node's kind directly, and
+    // tsc's control flow narrows the branches (reads then bridge through
+    // maybeNarrow's validated extraction).
+    if (
+      op === ts.SyntaxKind.EqualsEqualsEqualsToken ||
+      op === ts.SyntaxKind.ExclamationEqualsEqualsToken
+    ) {
+      const negated = op === ts.SyntaxKind.ExclamationEqualsEqualsToken;
+      const unit = left.kind === "unitLit" ? left : right.kind === "unitLit" ? right : null;
+      const other = left.kind === "unitLit" ? right : left;
+      if (unit && other.type.kind === "dyn") {
+        return {
+          kind: "dynTest",
+          test: unit.unit,
+          ...(negated ? { negated: true as const } : {}),
+          value: other,
+          type: BOOL,
+          loc,
+        };
+      }
+      // dyn vs SCALAR strict equality (`value !== ""`, `u === 5` — the
+      // normalizePricing filter): a guarded kind test + payload compare,
+      // JS-exact (strict equality never coerces; a non-matching dyn kind
+      // answers false). dyn vs dyn keeps the fence below.
+      const dynSide = left.type.kind === "dyn" ? left : right;
+      const scalarSide = dynSide === left ? right : left;
+      const reference = scalarSide.type;
+      if (
+        (reference.kind === "object" ||
+          reference.kind === "record" ||
+          reference.kind === "array" ||
+          reference.kind === "bytes" ||
+          reference.kind === "func" ||
+          reference.kind === "classval" ||
+          reference.kind === "regex" ||
+          reference.kind === "url" ||
+          reference.kind === "bigint" ||
+          reference.kind === "symbol" ||
+          reference.kind === "map" ||
+          reference.kind === "set" ||
+          reference.kind === "union" ||
+          DYN_HANDLE_KINDS.has(reference.kind)) &&
+        lowerer.dynConvertible(reference)
+      ) {
+        // Records, arrays and byte views compare by the capsule identity
+        // their dyn reads produce, including when they arrive through a
+        // union (an optional array field read from a typed record).
+        const liveArm = (type: IrType): boolean => {
+          if (type.kind === "array" || type.kind === "bytes") return true;
+          const shape = type.kind === "record" ? lowerer.shapes.get(type.shapeId) : undefined;
+          return !!shape && (shape.fields.length > 0 || shape.indexValue !== undefined);
+        };
+        const boxed: IrExpr = {
+          kind: "dynFrom",
+          value: scalarSide,
+          type: DYN,
+          loc: scalarSide.loc,
+          ...(reference.kind === "record" ||
+          liveArm(reference) ||
+          (reference.kind === "union" &&
+            (lowerer.unions.get(reference.unionId)?.arms.some(liveArm) ?? false))
+            ? { liveRef: true as const }
+            : {}),
+        };
+        return {
+          kind: "dynScalarEq",
+          left: scalarSide === left ? boxed : left,
+          right: scalarSide === right ? boxed : right,
+          ...(negated ? { negated: true as const } : {}),
+          type: BOOL,
+          loc,
+        };
+      }
+      if (
+        dynSide.type.kind === "dyn" &&
+        (scalarSide.type.kind === "f64" ||
+          scalarSide.type.kind === "string" ||
+          scalarSide.type.kind === "bool" ||
+          // dyn vs dyn (`context.actual !== context.exact` —
+          // test/common's exit accounting): the runtime's whole-dyn
+          // strict equality — scalars by value, units by kind,
+          // reference kinds by identity (scr_dyn_strict_eq).
+          scalarSide.type.kind === "dyn")
+      ) {
+        return {
+          kind: "dynScalarEq",
+          left,
+          right,
+          ...(negated ? { negated: true as const } : {}),
+          type: BOOL,
+          loc,
+        };
+      }
+    }
+    const bitwise: Partial<Record<ts.SyntaxKind, string>> = {
+      [ts.SyntaxKind.AmpersandToken]: "&",
+      [ts.SyntaxKind.BarToken]: "|",
+      [ts.SyntaxKind.CaretToken]: "^",
+      [ts.SyntaxKind.LessThanLessThanToken]: "<<",
+      [ts.SyntaxKind.GreaterThanGreaterThanToken]: ">>",
+      [ts.SyntaxKind.GreaterThanGreaterThanGreaterThanToken]: ">>>",
+    };
+    if (bitwise[op]) {
+      const l = lowerer.coerceToExpected(left, DYN);
+      const r = lowerer.coerceToExpected(right, DYN);
+      if (l.type.kind === "dyn" && r.type.kind === "dyn") {
+        const value: IrExpr = {
+          kind: "libCall",
+          fn: "dyn.bitwise",
+          args: [l, r, { kind: "strLit", value: bitwise[op]!, type: STRING, loc }],
+          type: DYN,
+          loc,
+        };
+        return left.type.kind === "f64" || right.type.kind === "f64"
+          ? { kind: "dynCheck", value, type: F64, loc }
+          : value;
+      }
+    }
+    // Numeric operators dispatch on ToNumeric's actual Number/BigInt
+    // result, including values flowing through native callable properties.
+    if (
+      isJsSourceFile(expr.getSourceFile()) ||
+      op === ts.SyntaxKind.PlusToken ||
+      [
+        ts.SyntaxKind.LessThanToken,
+        ts.SyntaxKind.LessThanEqualsToken,
+        ts.SyntaxKind.GreaterThanToken,
+        ts.SyntaxKind.GreaterThanEqualsToken,
+      ].includes(op) ||
+      [
+        ts.SyntaxKind.MinusToken,
+        ts.SyntaxKind.AsteriskToken,
+        ts.SyntaxKind.SlashToken,
+        ts.SyntaxKind.PercentToken,
+        ts.SyntaxKind.AsteriskAsteriskToken,
+      ].includes(op)
+    ) {
+      const other = left.type.kind === "dyn" ? right : left;
+      const NUM_BIN: Partial<Record<ts.SyntaxKind, "-" | "*" | "/" | "%" | "**">> = {
+        [ts.SyntaxKind.MinusToken]: "-",
+        [ts.SyntaxKind.AsteriskToken]: "*",
+        [ts.SyntaxKind.SlashToken]: "/",
+        [ts.SyntaxKind.PercentToken]: "%",
+        [ts.SyntaxKind.AsteriskAsteriskToken]: "**",
+      };
+      const NUM_CMP: Partial<Record<ts.SyntaxKind, "<" | "<=" | ">" | ">=">> = {
+        [ts.SyntaxKind.LessThanToken]: "<",
+        [ts.SyntaxKind.LessThanEqualsToken]: "<=",
+        [ts.SyntaxKind.GreaterThanToken]: ">",
+        [ts.SyntaxKind.GreaterThanEqualsToken]: ">=",
+      };
+      const arith = NUM_BIN[op];
+      const cmp = NUM_CMP[op];
+      if (arith) {
+        const l = lowerer.coerceToExpected(left, DYN);
+        const r = lowerer.coerceToExpected(right, DYN);
+        if (l.type.kind === "dyn" && r.type.kind === "dyn") {
+          const value: IrExpr = {
+            kind: "libCall",
+            fn: "dyn.arithmetic",
+            args: [l, r, { kind: "strLit", value: arith, type: STRING, loc }],
+            type: DYN,
+            loc,
+          };
+          const numeric =
+            left.type.kind === "bigint" || right.type.kind === "bigint"
+              ? BIGINT_T
+              : left.type.kind === "f64" || right.type.kind === "f64"
+                ? F64
+                : null;
+          return numeric ? { kind: "dynCheck", value, type: numeric, loc } : value;
+        }
+      }
+      if (cmp && lowerer.dynConvertible(left.type) && lowerer.dynConvertible(right.type)) {
+        return {
+          kind: "libCall",
+          fn: "dyn.compare",
+          args: [
+            lowerer.coerceToExpected(left, DYN),
+            lowerer.coerceToExpected(right, DYN),
+            { kind: "strLit", value: cmp, type: STRING, loc },
+          ],
+          type: BOOL,
+          loc,
+        };
+      }
+      // Untyped addition chooses concatenation or numeric addition only
+      // after both operands have undergone ToPrimitive at runtime.
+      if (op === ts.SyntaxKind.PlusToken) {
+        const l = lowerer.coerceToExpected(left, DYN);
+        const r = lowerer.coerceToExpected(right, DYN);
+        if (l.type.kind === "dyn" && r.type.kind === "dyn") {
+          const value: IrExpr = { kind: "libCall", fn: "dyn.add", args: [l, r], type: DYN, loc };
+          // A statically known string operand guarantees a string result.
+          return other.type.kind === "string"
+            ? { kind: "dynCheck", value, type: STRING, loc }
+            : value;
+        }
+      }
+    }
+    // Unsupported `any`-origin operations get their specific diagnostic;
+    // unknown retains the narrowing diagnostic below.
+    if (
+      (left.type.kind === "dyn" && lowerer.anyOrigin(expr.left)) ||
+      (right.type.kind === "dyn" && lowerer.anyOrigin(expr.right))
+    ) {
+      // `JSON.parse` and other checked-dynamic producers deliberately
+      // remain dyn when assigned to an `any` local: eagerly converting
+      // the binding would deep-copy its data and sever aliases. At an
+      // unsupported operator, require an explicit represented type.
+      lowerer.anyOpFence(`the '${ts.tokenToString(op) ?? ts.syntaxKindName(op)}' operator`, expr);
+    }
+    // tsc allows ===/!== on unknown (arithmetic/comparisons it rejects
+    // itself); a dynamic equality would need a dyn walk — validate first.
+    lowerer.unsupported("SC1100", expr, "operators on 'unknown' values");
+  }
+
+  if (left.type.kind === "bigint" && right.type.kind === "bigint") {
+    const binary: Partial<
+      Record<
+        ts.SyntaxKind,
+        | "bigint.add"
+        | "bigint.sub"
+        | "bigint.mul"
+        | "bigint.div"
+        | "bigint.mod"
+        | "bigint.pow"
+        | "bigint.and"
+        | "bigint.or"
+        | "bigint.xor"
+        | "bigint.shl"
+        | "bigint.shr"
+      >
+    > = {
+      [ts.SyntaxKind.PlusToken]: "bigint.add",
+      [ts.SyntaxKind.MinusToken]: "bigint.sub",
+      [ts.SyntaxKind.AsteriskToken]: "bigint.mul",
+      [ts.SyntaxKind.SlashToken]: "bigint.div",
+      [ts.SyntaxKind.PercentToken]: "bigint.mod",
+      [ts.SyntaxKind.AsteriskAsteriskToken]: "bigint.pow",
+      [ts.SyntaxKind.AmpersandToken]: "bigint.and",
+      [ts.SyntaxKind.BarToken]: "bigint.or",
+      [ts.SyntaxKind.CaretToken]: "bigint.xor",
+      [ts.SyntaxKind.LessThanLessThanToken]: "bigint.shl",
+      [ts.SyntaxKind.GreaterThanGreaterThanToken]: "bigint.shr",
+    };
+    const fn = binary[op];
+    if (fn) return { kind: "libCall", fn, args: [left, right], type: BIGINT_T, loc };
+    if (
+      op === ts.SyntaxKind.EqualsEqualsEqualsToken ||
+      op === ts.SyntaxKind.ExclamationEqualsEqualsToken
+    ) {
+      const equal: IrExpr = {
+        kind: "libCall",
+        fn: "bigint.eq",
+        args: [left, right],
+        type: BOOL,
+        loc,
+      };
+      return op === ts.SyntaxKind.ExclamationEqualsEqualsToken
+        ? { kind: "unary", op: "!", operand: equal, type: BOOL, loc }
+        : equal;
+    }
+    if (
+      op === ts.SyntaxKind.LessThanToken ||
+      op === ts.SyntaxKind.LessThanEqualsToken ||
+      op === ts.SyntaxKind.GreaterThanToken ||
+      op === ts.SyntaxKind.GreaterThanEqualsToken
+    ) {
+      const cmp: IrExpr = {
+        kind: "libCall",
+        fn: "bigint.cmp",
+        args: [left, right],
+        type: F64,
+        loc,
+      };
+      const zero: IrExpr = { kind: "numLit", value: 0, type: F64, loc };
+      const cmpOp =
+        op === ts.SyntaxKind.LessThanToken
+          ? "<"
+          : op === ts.SyntaxKind.LessThanEqualsToken
+            ? "<="
+            : op === ts.SyntaxKind.GreaterThanToken
+              ? ">"
+              : ">=";
+      return { kind: "bin", op: cmpOp, left: cmp, right: zero, type: BOOL, loc };
+    }
+  }
+  if (
+    (left.type.kind === "bigint" && right.type.kind === "f64") ||
+    (left.type.kind === "f64" && right.type.kind === "bigint")
+  ) {
+    if (
+      op === ts.SyntaxKind.LessThanToken ||
+      op === ts.SyntaxKind.LessThanEqualsToken ||
+      op === ts.SyntaxKind.GreaterThanToken ||
+      op === ts.SyntaxKind.GreaterThanEqualsToken
+    ) {
+      const big = left.type.kind === "bigint" ? left : right;
+      const num = left.type.kind === "f64" ? left : right;
+      const cmp: IrExpr = {
+        kind: "libCall",
+        fn: "bigint.cmpNumber",
+        args: [big, num],
+        type: F64,
+        loc,
+      };
+      const cmpLocal = lowerer.declareHiddenLocal("%bigcmp", F64);
+      const cmpRef: IrExpr = { kind: "varRef", localId: cmpLocal.id, type: F64, loc };
+      const unordered: IrExpr = {
+        kind: "bin",
+        op: "===",
+        left: cmpRef,
+        right: { kind: "numLit", value: 2, type: F64, loc },
+        type: BOOL,
+        loc,
+      };
+      const zero: IrExpr = { kind: "numLit", value: 0, type: F64, loc };
+      const leftBig = left.type.kind === "bigint";
+      const cmpOp = leftBig
+        ? op === ts.SyntaxKind.LessThanToken
+          ? "<"
+          : op === ts.SyntaxKind.LessThanEqualsToken
+            ? "<="
+            : op === ts.SyntaxKind.GreaterThanToken
+              ? ">"
+              : ">="
+        : op === ts.SyntaxKind.LessThanToken
+          ? ">"
+          : op === ts.SyntaxKind.LessThanEqualsToken
+            ? ">="
+            : op === ts.SyntaxKind.GreaterThanToken
+              ? "<"
+              : "<=";
+      const result: IrExpr = {
+        kind: "logical",
+        op: "&&",
+        left: { kind: "unary", op: "!", operand: unordered, type: BOOL, loc },
+        right: { kind: "bin", op: cmpOp, left: cmpRef, right: zero, type: BOOL, loc },
+        type: BOOL,
+        loc,
+      };
+      return {
+        kind: "seqExpr",
+        stmts: [{ kind: "varDecl", localId: cmpLocal.id, init: cmp, loc }],
+        result,
+        type: BOOL,
+        loc,
+      };
+    }
+  }
+  // An unchecked array read keeps its undefined arm in the IR even when
+  // the checker typed the binding as `string`. An optional string is not
+  // itself a string operand for `+`: `undefined + 1` and
+  // `undefined + undefined` are NaN, while a present string concatenates.
+  // Keep this predicate exact so a nullable string does not take the
+  // string path either.
+  const optionalStringType = (type: IrType): boolean => {
+    if (type.kind !== "union") return false;
+    const arms = lowerer.unions.get(type.unionId)?.arms;
+    return (
+      !!arms &&
+      arms.length === 2 &&
+      arms.some((arm) => arm.kind === "string") &&
+      arms.some((arm) => arm.kind === "undefinedT")
+    );
+  };
+  const arithmeticNumber = (operand: IrExpr, node: ts.Expression): IrExpr =>
+    lowerOptionalNumber(lowerer, operand, loc, node);
+  const arithmeticLeft = strictEquality ? left : arithmeticNumber(left, expr.left);
+  const arithmeticRight = strictEquality ? right : arithmeticNumber(right, expr.right);
+  const bothNum = arithmeticLeft.type.kind === "f64" && arithmeticRight.type.kind === "f64";
+  const bothStr = left.type.kind === "string" && right.type.kind === "string";
+
+  const lowerOptionalStringPlus = (): IrExpr | null => {
+    const leftOptional = optionalStringType(left.type);
+    const rightOptional = optionalStringType(right.type);
+    if (!leftOptional && !rightOptional) return null;
+    const allowed = (type: IrType): boolean =>
+      type.kind === "f64" || type.kind === "string" || optionalStringType(type);
+    if (!allowed(left.type) || !allowed(right.type)) return null;
+
+    // The tag tests and the chosen concatenation branch must see the same
+    // operand values. This matters for `take()[0] + 1` and for two reads
+    // with observable getters/calls.
+    const prefix: IrStmt[] = [];
+    const stable = (operand: IrExpr): IrExpr => {
+      if (isSafeToRepeat(operand) || isSafeToDiscard(operand)) return operand;
+      const tmp = lowerer.declareHiddenLocal("%plus", operand.type);
+      prefix.push({ kind: "varDecl", localId: tmp.id, init: operand, loc });
+      return varRef(tmp.id, operand.type, loc);
+    };
+    const stableLeft = stable(left);
+    const stableRight = stable(right);
+    const leftString = lowerer.ensureString(stableLeft, expr.left);
+    const rightString = lowerer.ensureString(stableRight, expr.right);
+    const concat: IrExpr = {
+      kind: "strConcat",
+      left: leftString,
+      right: rightString,
+      type: STRING,
+      loc,
+    };
+    const nan: IrExpr = {
+      kind: "bin",
+      op: "/",
+      left: numLit(0, loc),
+      right: numLit(0, loc),
+      type: F64,
+      loc,
+    };
+    const resultT: IrType = { kind: "union", unionId: lowerer.unions.intern([F64, STRING]) };
+    lowerer.runtimeOptionalArithmeticTypes.set(expr, resultT);
+    const numberTag = lowerer.armTag(resultT.unionId, F64);
+    const stringTag = lowerer.armTag(resultT.unionId, STRING);
+    if (numberTag < 0 || stringTag < 0)
+      throw new InternalCompilerError("lowerer bug: optional string plus result union");
+    const number = (): IrExpr => ({
+      kind: "unionWrap",
+      unionId: resultT.unionId,
+      tag: numberTag,
+      value: nan,
+      type: resultT,
+      loc,
+    });
+    const string = (): IrExpr => ({
+      kind: "unionWrap",
+      unionId: resultT.unionId,
+      tag: stringTag,
+      value: concat,
+      type: resultT,
+      loc,
+    });
+    const undefinedTest = (operand: IrExpr): IrExpr => ({
+      kind: "unionIsTag",
+      unionId: operand.type.kind === "union" ? operand.type.unionId : "",
+      tag: operand.type.kind === "union" ? lowerer.armTag(operand.type.unionId, UNDEFINED_T) : -1,
+      negated: false,
+      value: operand,
+      type: BOOL,
+      loc,
+    });
+    let result: IrExpr;
+    if (leftOptional && rightOptional) {
+      const rightMissing = undefinedTest(stableRight);
+      const bothMissing: IrExpr = {
+        kind: "ternary",
+        cond: rightMissing,
+        then: number(),
+        else_: string(),
+        type: resultT,
+        loc,
+      };
+      result = {
+        kind: "ternary",
+        cond: undefinedTest(stableLeft),
+        then: bothMissing,
+        else_: string(),
+        type: resultT,
+        loc,
+      };
+    } else if (leftOptional) {
+      result = {
+        kind: "ternary",
+        cond: undefinedTest(stableLeft),
+        then: number(),
+        else_: string(),
+        type: resultT,
+        loc,
+      };
+    } else {
+      result = {
+        kind: "ternary",
+        cond: undefinedTest(stableRight),
+        then: number(),
+        else_: string(),
+        type: resultT,
+        loc,
+      };
+    }
+    return prefix.length === 0
+      ? result
+      : { kind: "seqExpr", stmts: prefix, result, type: resultT, loc };
+  };
+
+  switch (op) {
+    case ts.SyntaxKind.PlusToken:
+      if (bothNum)
+        return {
+          kind: "bin",
+          op: "+",
+          left: arithmeticLeft,
+          right: arithmeticRight,
+          type: F64,
+          loc,
+        };
+      if (left.type.kind === "string" || right.type.kind === "string") {
+        return {
+          kind: "strConcat",
+          left: concatOperand(lowerer, left, expr.left),
+          right: concatOperand(lowerer, right, expr.right),
+          type: STRING,
+          loc,
+        };
+      }
+      const optionalStringPlus = lowerOptionalStringPlus();
+      if (optionalStringPlus) return optionalStringPlus;
+      {
+        const primitive = (type: IrType): boolean =>
+          type.kind === "f64" ||
+          type.kind === "string" ||
+          type.kind === "bool" ||
+          isUnitType(type) ||
+          (type.kind === "union" &&
+            (lowerer.unions.get(type.unionId)?.arms.every(primitive) ?? false));
+        if (
+          (left.type.kind === "union" || right.type.kind === "union") &&
+          primitive(left.type) &&
+          primitive(right.type)
+        ) {
+          lowerer.runtimeOptionalArithmeticTypes.set(expr, DYN);
+          return {
+            kind: "libCall",
+            fn: "dyn.add",
+            args: [lowerer.coerceToExpected(left, DYN), lowerer.coerceToExpected(right, DYN)],
+            type: DYN,
+            loc,
+          };
+        }
+      }
+      operatorUnsupported(lowerer, expr, "+", [left.type, right.type]);
+      break;
+    case ts.SyntaxKind.MinusToken:
+    case ts.SyntaxKind.AsteriskToken:
+    case ts.SyntaxKind.SlashToken:
+    case ts.SyntaxKind.PercentToken:
+    case ts.SyntaxKind.AsteriskAsteriskToken: {
+      if (!bothNum)
+        operatorUnsupported(lowerer, expr, ts.tokenToString(op) ?? "?", [left.type, right.type]);
+      const binOp =
+        op === ts.SyntaxKind.MinusToken
+          ? "-"
+          : op === ts.SyntaxKind.AsteriskToken
+            ? "*"
+            : op === ts.SyntaxKind.SlashToken
+              ? "/"
+              : op === ts.SyntaxKind.PercentToken
+                ? "%"
+                : "**";
+      return {
+        kind: "bin",
+        op: binOp,
+        left: arithmeticLeft,
+        right: arithmeticRight,
+        type: F64,
+        loc,
+      };
+    }
+    // The bitwise six, JS-exact: operands through ToInt32/ToUint32
+    // (NaN/±Infinity → 0, truncate, wrap mod 2^32), the operation in
+    // 32-bit space (shift counts masked to 5 bits), the result back to
+    // f64 — `>>>` as Uint32, the rest as Int32 (runtime scr_bit_*).
+    case ts.SyntaxKind.AmpersandToken:
+    case ts.SyntaxKind.BarToken:
+    case ts.SyntaxKind.CaretToken:
+    case ts.SyntaxKind.LessThanLessThanToken:
+    case ts.SyntaxKind.GreaterThanGreaterThanToken:
+    case ts.SyntaxKind.GreaterThanGreaterThanGreaterThanToken: {
+      if (!bothNum)
+        operatorUnsupported(lowerer, expr, ts.tokenToString(op) ?? "?", [left.type, right.type]);
+      const bitOp =
+        op === ts.SyntaxKind.AmpersandToken
+          ? "&"
+          : op === ts.SyntaxKind.BarToken
+            ? "|"
+            : op === ts.SyntaxKind.CaretToken
+              ? "^"
+              : op === ts.SyntaxKind.LessThanLessThanToken
+                ? "<<"
+                : op === ts.SyntaxKind.GreaterThanGreaterThanToken
+                  ? ">>"
+                  : ">>>";
+      return {
+        kind: "bin",
+        op: bitOp,
+        left: arithmeticLeft,
+        right: arithmeticRight,
+        type: F64,
+        loc,
+      };
+    }
+    case ts.SyntaxKind.EqualsEqualsEqualsToken:
+    case ts.SyntaxKind.ExclamationEqualsEqualsToken:
+      return lowerStrictEquality(
+        lowerer,
+        expr,
+        expr.left,
+        expr.right,
+        left,
+        right,
+        op === ts.SyntaxKind.ExclamationEqualsEqualsToken,
+        loc,
+      );
+    case ts.SyntaxKind.LessThanToken:
+    case ts.SyntaxKind.LessThanEqualsToken:
+    case ts.SyntaxKind.GreaterThanToken:
+    case ts.SyntaxKind.GreaterThanEqualsToken: {
+      const cmpOp =
+        op === ts.SyntaxKind.LessThanToken
+          ? "<"
+          : op === ts.SyntaxKind.LessThanEqualsToken
+            ? "<="
+            : op === ts.SyntaxKind.GreaterThanToken
+              ? ">"
+              : ">=";
+      if (bothNum)
+        return {
+          kind: "bin",
+          op: cmpOp,
+          left: arithmeticLeft,
+          right: arithmeticRight,
+          type: BOOL,
+          loc,
+        };
+      if (bothStr) return { kind: "strCmp", op: cmpOp, left, right, type: BOOL, loc };
+      // A Date converts to a new checked-dynamic Date on each crossing, so
+      // comparisons keep their Date fence instead of comparing copies.
+      if (
+        left.type.kind !== "date" &&
+        right.type.kind !== "date" &&
+        lowerer.dynConvertible(left.type) &&
+        lowerer.dynConvertible(right.type)
+      ) {
+        return {
+          kind: "libCall",
+          fn: "dyn.compare",
+          args: [
+            lowerer.coerceToExpected(left, DYN),
+            lowerer.coerceToExpected(right, DYN),
+            { kind: "strLit", value: cmpOp, type: STRING, loc },
+          ],
+          type: BOOL,
+          loc,
+        };
+      }
+      lowerer.unsupported("SC1043", expr);
+      break;
+    }
+    default:
+      break;
+  }
+  lowerer.unsupported(
+    "SC1090",
+    expr,
+    `operator '${ts.tokenToString(op) ?? ts.syntaxKindName(op)}'`,
+  );
+}
+
+/** `left === right` (`!==` when negated) over lowered operands: JS strict
+ * equality for every pair of static kinds the program can compare.
+ * `node` anchors diagnostics, and `leftNode`/`rightNode` the coercions. */
+export function lowerStrictEquality(
+  lowerer: Lowerer,
+  node: ts.Node,
+  leftNode: ts.Node,
+  rightNode: ts.Node,
+  left: IrExpr,
+  right: IrExpr,
+  negated: boolean,
+  loc: SrcLoc,
+): IrExpr {
+  const plainBothNum = left.type.kind === "f64" && right.type.kind === "f64";
+  const bothStr = left.type.kind === "string" && right.type.kind === "string";
+  const indexed = tryLowerIndexedComparison(lowerer, left, right, negated, loc);
+  if (indexed) return indexed;
+  if (plainBothNum)
+    return { kind: "bin", op: negated ? "!==" : "===", left, right, type: BOOL, loc };
+  if (bothStr) {
+    if (left.kind === "strLit" && right.kind === "strLit")
+      return {
+        kind: "boolLit",
+        value: (left.value === right.value) !== negated,
+        type: BOOL,
+        loc,
+      };
+    return { kind: "strEq", negated, left, right, type: BOOL, loc };
+  }
+  // bool === bool: a plain value compare (the config-drift checks'
+  // `desired.lanMode !== actual.lanMode` shape).
+  if (left.type.kind === "bool" && right.type.kind === "bool") {
+    return { kind: "bin", op: negated ? "!==" : "===", left, right, type: BOOL, loc };
+  }
+  const unitTest = lowerer.lowerUnitComparison(left, right, negated, loc);
+  if (unitTest) return unitTest;
+  if (left.type.kind === "union" || right.type.kind === "union") {
+    const compared = lowerUnionEquality(lowerer, left, right, negated, false, loc);
+    if (compared) return compared;
+    const aliasRefusal = (type: IrType): void => {
+      if (tagEqualityMayMissAlias(lowerer, type))
+        lowerer.unsupported(
+          "SC1090",
+          node,
+          `comparisons of related class values beside structural union members (${NARROW_FIRST})`,
+        );
+    };
+
+    // JS strict equality of the ARM values, per union tag (a
+    // per-union helper): equal tags compare payloads (f64 ==, string
+    // bytes, bool ==, ref-arm POINTER identity), different tags are
+    // never equal. Two shapes lower: same union on both sides, and
+    // union vs plain arm value (`u === "text"` where the checker
+    // didn't narrow) — the plain side wraps into the union, which
+    // preserves payload identity. Different unions (tsc admits
+    // partially-overlapping ones) still need narrowing first.
+    const ut = left.type.kind === "union" ? left.type : (right.type as IrType & { kind: "union" });
+    const bothUnion = left.type.kind === "union" && right.type.kind === "union";
+    const sameUnion = bothUnion && typeEquals(left.type, right.type);
+    const plainFunc = left.type.kind === "func" ? left : right.type.kind === "func" ? right : null;
+    const unionArms = lowerer.unions.get(ut.unionId)?.arms ?? [];
+    const funcArm = unionArms.find((arm) => arm.kind === "func");
+    // `listeners()` reports original prefix callbacks, but the
+    // checker views an indexed result as function | undefined. For
+    // identity comparison, retain the original closure pointer rather
+    // than adapting it to the tuple signature.
+    if (
+      !bothUnion &&
+      plainFunc !== null &&
+      funcArm?.kind === "func" &&
+      unionArms.filter((arm) => arm.kind === "func").length === 1 &&
+      unionArms.some(isUnitType)
+    ) {
+      return {
+        kind: "unionFuncEq",
+        unionId: ut.unionId,
+        tag: lowerer.armTag(ut.unionId, funcArm),
+        union: left.type.kind === "union" ? left : right,
+        func: plainFunc,
+        negated,
+        type: BOOL,
+        loc,
+      };
+    }
+    if ((sameUnion || !bothUnion) && lowerer.eqComparableUnion(ut.unionId)) {
+      aliasRefusal(ut);
+      return {
+        kind: "unionEq",
+        unionId: ut.unionId,
+        negated,
+        sameValue: false,
+        left: lowerer.coerceInto(leftNode, left, ut),
+        right: lowerer.coerceInto(rightNode, right, ut),
+        type: BOOL,
+        loc,
+      };
+    }
+    if (left.type.kind === "union" && right.type.kind === "union") {
+      const leftDef = lowerer.unions.get(left.type.unionId);
+      const rightDef = lowerer.unions.get(right.type.unionId);
+      if (leftDef && rightDef) {
+        const leftValues = leftDef.arms.filter((arm) => !isUnitType(arm));
+        const rightValues = rightDef.arms.filter((arm) => !isUnitType(arm));
+        const sameValueArms =
+          leftValues.length === rightValues.length &&
+          leftValues.every((arm) => rightValues.some((candidate) => typeEquals(candidate, arm)));
+        if (sameValueArms) {
+          const arms = [...leftDef.arms];
+          for (const arm of rightDef.arms) {
+            if (!arms.some((candidate) => typeEquals(candidate, arm))) arms.push(arm);
+          }
+          arms.sort((a, b) => (typeKey(a) < typeKey(b) ? -1 : 1));
+          const common: IrType & { kind: "union" } = {
+            kind: "union",
+            unionId: lowerer.unions.intern(arms),
+          };
+          aliasRefusal(common);
+          return {
+            kind: "unionEq",
+            unionId: common.unionId,
+            negated,
+            sameValue: false,
+            left: lowerer.coerceInto(leftNode, left, common),
+            right: lowerer.coerceInto(rightNode, right, common),
+            type: BOOL,
+            loc,
+          };
+        }
+      }
+    }
+    lowerer.unsupported("SC1090", node, `comparisons of union-typed values (${NARROW_FIRST})`);
+  }
+  // Arrays, maps, functions, class instances and records compare by
+  // reference identity (pointer compare) — JS-exact object equality.
+  // Hierarchy-related classes compare after widening the derived side
+  // (same pointer either way — prefix layout).
+  let idLeft = left;
+  let idRight = right;
+  if (left.type.kind === "object" && right.type.kind === "object") {
+    if (lowerer.isSubclassOf(left.type.className, right.type.className)) {
+      idLeft = lowerer.upcastTo(left, right.type.className);
+    } else if (lowerer.isSubclassOf(right.type.className, left.type.className)) {
+      idRight = lowerer.upcastTo(right, left.type.className);
+    }
+  }
+  // Two function values compare by identity whatever their STATIC
+  // signatures (tsc admits the comparison when one side is
+  // assignable to the other — a tuple-typed listeners() element
+  // against a prefix-declared handler): the pointer answers it.
+  if (idLeft.type.kind === "func" && idRight.type.kind === "func") {
+    return {
+      kind: "bin",
+      op: negated ? "!==" : "===",
+      left: idLeft,
+      right: idRight,
+      type: BOOL,
+      loc,
+    };
+  }
+  // Two CLASS values compare by identity whatever their static
+  // classes — one immortal object per class, one pointer compare
+  // (the function-identity rule verbatim; `X === D` through a
+  // base-typed slot answers exactly JS).
+  if (idLeft.type.kind === "classval" && idRight.type.kind === "classval") {
+    return {
+      kind: "bin",
+      op: negated ? "!==" : "===",
+      left: idLeft,
+      right: idRight,
+      type: BOOL,
+      loc,
+    };
+  }
+  if (idLeft.type.kind === "moduleNs" && idRight.type.kind === "moduleNs") {
+    return {
+      kind: "bin",
+      op: negated ? "!==" : "===",
+      left: idLeft,
+      right: idRight,
+      type: BOOL,
+      loc,
+    };
+  }
+  if (
+    (idLeft.type.kind === "array" ||
+      idLeft.type.kind === "map" ||
+      idLeft.type.kind === "set" ||
+      idLeft.type.kind === "regex" ||
+      idLeft.type.kind === "url" ||
+      idLeft.type.kind === "object" ||
+      idLeft.type.kind === "record" ||
+      // Symbols ARE identity: `Symbol('a') === Symbol('a')` is false,
+      // a symbol equals exactly itself, and Symbol.for's interned
+      // values compare equal across call sites — all one pointer
+      // compare, JS's spec without approximation.
+      idLeft.type.kind === "symbol" ||
+      // Typed arrays / Buffers ARE objects to ===: pointer identity
+      // (buf === buf.swap16() — the in-place mutators return this).
+      idLeft.type.kind === "bytes" ||
+      idLeft.type.kind === "promise") &&
+    typeEquals(idLeft.type, idRight.type)
+  ) {
+    return {
+      kind: "bin",
+      op: negated ? "!==" : "===",
+      left: idLeft,
+      right: idRight,
+      type: BOOL,
+      loc,
+    };
+  }
+  // Runtime HANDLES are objects to === too: one handle per socket/
+  // request/response, so pointer identity IS JS's object equality
+  // (`c.pause() === c` — Node's chaining assertions). */
+  if (DYN_HANDLE_KINDS.has(idLeft.type.kind) && typeEquals(idLeft.type, idRight.type)) {
+    return {
+      kind: "bin",
+      op: negated ? "!==" : "===",
+      left: idLeft,
+      right: idRight,
+      type: BOOL,
+      loc,
+    };
+  }
+  // A Date converts to a new checked-dynamic Date on each crossing; its
+  // identity has no representation, so equality keeps the fence.
+  if (
+    idLeft.type.kind !== "date" &&
+    idRight.type.kind !== "date" &&
+    lowerer.dynConvertible(idLeft.type) &&
+    lowerer.dynConvertible(idRight.type)
+  ) {
+    return {
+      kind: "dynScalarEq",
+      left: lowerer.coerceToExpected(idLeft, DYN),
+      right: lowerer.coerceToExpected(idRight, DYN),
+      ...(negated ? { negated: true as const } : {}),
+      type: BOOL,
+      loc,
+    };
+  }
+  return lowerer.unsupported("SC1043", node);
+}
+
+function lowerLogicalChain(lowerer: Lowerer, expr: ts.BinaryExpression): IrExpr {
+  // Logical chains have a left-nested AST. Keep the native stack bounded
+  // while retaining each pair's checker type and lazy operand evaluation.
+  const parents: ts.BinaryExpression[] = [];
+  let current = expr;
+  let result: IrExpr;
+  while (true) {
+    if (current.operatorToken.kind === ts.SyntaxKind.BarBarToken) {
+      const fallback = lowerAbsenceAwareOrChain(lowerer, current);
+      if (fallback !== null) {
+        result = fallback;
+        break;
+      }
+    }
+    const left = current.left;
+    if (
+      ts.isBinaryExpression(left) &&
+      (left.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken ||
+        left.operatorToken.kind === ts.SyntaxKind.BarBarToken) &&
+      !lowerer.chainRecvByNode.has(left)
+    ) {
+      parents.push(current);
+      current = left;
+      continue;
+    }
+    result = lowerLogicalPair(
+      lowerer,
+      current,
+      current.operatorToken.kind === ts.SyntaxKind.BarBarToken
+        ? lowerPresenceOperand(lowerer, left)
+        : (lowerAbsenceProbe(lowerer, left) ?? lowerer.lowerExpr(left)),
+    );
+    break;
+  }
+  for (let i = parents.length - 1; i >= 0; i--) {
+    result = lowerLogicalPair(lowerer, parents[i]!, result);
+  }
+  return result;
+}
+
+function lowerLogicalPair(lowerer: Lowerer, expr: ts.BinaryExpression, left: IrExpr): IrExpr {
+  const op = expr.operatorToken.kind;
+  const loc = locOf(expr);
+  // Preserve short-circuiting during lowering too: an unreachable member
+  // on a specialized value must not poison the surrounding JS statement.
+  if (left.kind === "boolLit") {
+    const takeRight = op === ts.SyntaxKind.AmpersandAmpersandToken ? left.value : !left.value;
+    return takeRight ? lowerer.lowerExpr(expr.right) : left;
+  }
+  if (left.kind === "unitLit" && op === ts.SyntaxKind.AmpersandAmpersandToken) return left;
+  if (op === ts.SyntaxKind.BarBarToken && REF_TRUTHY_KINDS.has(left.type.kind)) return left;
+  const right = lowerer.lowerExpr(expr.right);
+  // A LITERAL-unit left operand (a compile-time undefined/null — the
+  // capability-probe members: `process.features.inspector ||
+  // !flag.startsWith('--inspect')` reads undefined in a compiled
+  // binary): statically falsy, so the operator folds JS-exactly —
+  // `unit || X` IS X, `unit && X` IS the unit (X's side effects never
+  // run in JS either; the lowered right is simply dropped). Literal
+  // units only — computed unit-typed values keep the fences below.
+  if (left.kind === "unitLit") {
+    return op === ts.SyntaxKind.BarBarToken ? right : left;
+  }
+  // JS objects and symbols are always truthy. In `ref || fallback`
+  // the fallback is therefore unreachable and the result is the
+  // already-evaluated left value — the browser-fallback idiom used by
+  // packages for `process.argv || []` and `process.env || {}`. The
+  // operand itself remains in the IR, preserving reads/calls that
+  // produce the reference; only the unreachable right lowering drops.
+  if (op === ts.SyntaxKind.BarBarToken && REF_TRUTHY_KINDS.has(left.type.kind)) {
+    return left;
+  }
+  if (left.type.kind === "dyn" || right.type.kind === "dyn") {
+    // A checked-dynamic operand (`fn.name || '<anonymous>'` —
+    // test/common's _mustCallInner): both sides live in the checked-dynamic tree and
+    // the deciding test is ToBoolean over the dyn kind
+    // (scr_dyn_truthy) — JS value semantics exactly, result dyn. The
+    // non-dyn side converts through the usual boundary; a value with
+    // no dyn representation keeps the fence.
+    const l = lowerer.coerceToExpected(left, DYN);
+    const r = lowerer.coerceToExpected(right, DYN);
+    if (l.type.kind !== "dyn" || r.type.kind !== "dyn") {
+      lowerer.unsupported("SC1100", expr, "logical operators on 'unknown' values");
+    }
+    return {
+      kind: "logical",
+      op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
+      left: l,
+      right: r,
+      type: DYN,
+      loc,
+    };
+  }
+
+  if (
+    isJsSourceFile(expr.getSourceFile()) &&
+    op === ts.SyntaxKind.AmpersandAmpersandToken &&
+    left.type.kind === "union" &&
+    lowerer.unions.get(left.type.unionId)?.arms.some((arm) => arm.kind === "bool") &&
+    !typeEquals(left.type, right.type) &&
+    lowerer.dynConvertible(left.type) &&
+    lowerer.dynConvertible(right.type)
+  ) {
+    return {
+      kind: "logical",
+      op: "&&",
+      left: lowerer.coerceToExpected(left, DYN),
+      right: lowerer.coerceToExpected(right, DYN),
+      type: DYN,
+      loc,
+    };
+  }
+  if (left.type.kind === "union" || right.type.kind === "union") {
+    // Test the deciding operand in its own representation. The result
+    // contains only the values that can survive short-circuit evaluation.
+    let target = lowerer.mapTypeOf(lowerer.typeOf(expr));
+    // Index reads can be absent without noUncheckedIndexedAccess. Their
+    // explicit nullish fallback still runs, even if the checker discarded it.
+    if (target !== null) {
+      const returned = [
+        right.type,
+        ...(op === ts.SyntaxKind.AmpersandAmpersandToken ? [left.type] : []),
+      ];
+      for (const type of returned) {
+        const arms =
+          type.kind === "union" ? (lowerer.unions.get(type.unionId)?.arms ?? []) : [type];
+        for (const arm of arms) {
+          if (arm.kind === "undefinedT" && !isUnitType(target))
+            target = lowerer.runtimeOptionalType(target);
+          if (arm.kind === "nullT")
+            target = withUnitArm(target, arm.kind, lowerer.unions) ?? target;
+        }
+      }
+    }
+    // A broad-JSDoc npm-static body can leave the CHECKER result `any`
+    // even after declaration-backed specialization has recovered both
+    // operands (`helpOption && args.find(...)` in commander). When the
+    // left consists only of always-truthy references and falsy units,
+    // the static result is exactly the right operand plus those units.
+    if (
+      op === ts.SyntaxKind.AmpersandAmpersandToken &&
+      target === null &&
+      lowerer.implicitParamTypes !== null &&
+      npmStaticPackageOfPath(expr.getSourceFile().fileName) !== null &&
+      (lowerer.typeOf(expr).flags & ts.TypeFlags.Any) !== 0 &&
+      left.type.kind === "union"
+    ) {
+      const leftArms = lowerer.unions.get(left.type.unionId)?.arms;
+      const rightArms =
+        right.type.kind === "union" ? lowerer.unions.get(right.type.unionId)?.arms : [right.type];
+      const rightIsStatic =
+        rightArms?.every(
+          (arm) => arm.kind !== "dyn" && arm.kind !== "caught" && arm.kind !== "void",
+        ) ?? false;
+      if (
+        leftArms &&
+        rightArms &&
+        rightIsStatic &&
+        leftArms.some(isUnitType) &&
+        leftArms.every((arm) => isUnitType(arm) || REF_TRUTHY_KINDS.has(arm.kind))
+      ) {
+        const byKey = new Map<string, IrType>();
+        for (const arm of [...rightArms, ...leftArms.filter(isUnitType)]) {
+          byKey.set(typeKey(arm), arm);
+        }
+        const arms = [...byKey.values()].sort((a, b) => (typeKey(a) < typeKey(b) ? -1 : 1));
+        if (arms.length > 1) {
+          const source =
+            right.type.kind === "union" ? lowerer.unions.get(right.type.unionId) : undefined;
+          target = {
+            kind: "union",
+            unionId: source ? lowerer.unions.transform(source, arms) : lowerer.unions.intern(arms),
+          };
+        }
+      }
+    }
+    // `&&` over an always-truthy plain left operand (an array, object or
+    // function value) whose result union has no arm for it: every JS
+    // object is truthy, so `list && list[0]` evaluates the left for its
+    // effects and answers the right. Coercing the left into that union
+    // would trap at run time where Node answers the right operand.
+    if (
+      op === ts.SyntaxKind.AmpersandAmpersandToken &&
+      target?.kind === "union" &&
+      REF_TRUTHY_KINDS.has(left.type.kind) &&
+      lowerer.armTag(target.unionId, left.type) < 0
+    ) {
+      return {
+        kind: "seqExpr",
+        stmts: [{ kind: "exprStmt", expr: left, loc }],
+        result: lowerer.coerceInto(expr.right, right, target),
+        type: target,
+        loc,
+      };
+    }
+    if (target?.kind === "union") {
+      // `&&` whose left does NOT fit the result union: the checker
+      // built that result by DROPPING left arms which are always
+      // truthy (`Option | undefined && string | undefined` answers
+      // `string | undefined`, not `Option | string | undefined`).
+      // Evaluate the left once, test it in its own union, and retag it
+      // only on the falsy path. Any stranded reference arms are
+      // unreachable there because every JS object is truthy.
+      if (
+        op === ts.SyntaxKind.AmpersandAmpersandToken &&
+        left.type.kind === "union" &&
+        !typeEquals(left.type, target)
+      ) {
+        const def = lowerer.unions.get(left.type.unionId);
+        const trappable = new Set<number>();
+        def?.arms.forEach((arm, tag) => {
+          if (lowerer.armTag(target.unionId, arm) < 0 && REF_TRUTHY_KINDS.has(arm.kind)) {
+            trappable.add(tag);
+          }
+        });
+        const retag =
+          trappable.size === 0
+            ? null
+            : lowerer.unionRetagHelper(left.type.unionId, target.unionId, loc, trappable);
+        if (retag) {
+          lowerer.requireTruthyUnion(left.type.unionId, expr);
+          const stmts: IrStmt[] = [];
+          let stable: IrExpr = left;
+          if (!isSafeToRepeat(left)) {
+            const local = lowerer.declareHiddenLocal("%and", left.type);
+            stmts.push({ kind: "varDecl", localId: local.id, init: left, loc });
+            stable = varRef(local.id, left.type, loc);
+          }
+          const result: IrExpr = {
+            kind: "ternary",
+            cond: lowerer.ensureBool(stable, expr.left),
+            then: lowerer.coerceInto(expr.right, right, target),
+            else_: { kind: "call", callee: retag, args: [stable], type: target, loc },
+            type: target,
+            loc,
+          };
+          return stmts.length === 0
+            ? result
+            : { kind: "seqExpr", stmts, result, type: target, loc };
+        }
+      }
+      // `||` whose left does NOT fit the result union: the checker built
+      // that result by DROPPING the left's falsy arms (`process.env.X ||
+      // null` is `string | null`, `|| 3000` is `string | number` — the
+      // `undefined` is gone from both), so coercing the left eagerly, as
+      // the shared shape below does, retags an arm the test is about to
+      // rule out and throws where Node yields the default. Single-eval
+      // instead: test the left in its OWN union and retag only on the
+      // truthy side, where the dropped arms are unreachable.
+      if (
+        op === ts.SyntaxKind.BarBarToken &&
+        left.type.kind === "union" &&
+        !typeEquals(left.type, target)
+      ) {
+        const retag = lowerer.unionRetagHelper(left.type.unionId, target.unionId, loc);
+        if (retag) {
+          lowerer.requireTruthyUnion(left.type.unionId, expr);
+          return {
+            kind: "orDefault",
+            left,
+            right: lowerer.coerceInto(expr.right, right, target),
+            retag,
+            type: target,
+            loc,
+          };
+        }
+      }
+      lowerer.requireTruthyUnion(target.unionId, expr);
+      return {
+        kind: "logical",
+        op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
+        left: lowerer.coerceInto(expr.left, left, target),
+        right: lowerer.coerceInto(expr.right, right, target),
+        type: target,
+        loc,
+      };
+    }
+    // `u || d` NARROWED by the default: the checker types the result
+    // as u's single non-unit arm (`marker() || "default"`) — evaluate
+    // u once, truthy extracts the arm, falsy takes d lazily (the
+    // orDefault node, nullish's truthiness sibling). An UNMAPPABLE
+    // checker result takes the same rule (`options.runner ||
+    // defaultRunner` — tsc's union of two structurally-compatible
+    // function types has no representation, while the left's one
+    // non-unit arm is the only representable answer): the default
+    // must coerce into the arm or fence on its own.
+    if (op === ts.SyntaxKind.BarBarToken && left.type.kind === "union") {
+      const def = lowerer.unions.get(left.type.unionId);
+      const rest = def ? def.arms.filter((a) => !isUnitType(a)) : [];
+      const funcArmDefault =
+        rest[0]?.kind === "func" && (target === null || target.kind === "func");
+      if (
+        rest.length === 1 &&
+        ((target !== null && typeEquals(target, rest[0]!)) || funcArmDefault)
+      ) {
+        lowerer.requireTruthyUnion(left.type.unionId, expr);
+        const dflt = lowerer.lowerExprExpecting(expr.right, rest[0]!);
+        return { kind: "orDefault", left, right: dflt, type: rest[0]!, loc };
+      }
+    }
+    // JavaScript defaults can join differently inferred object layouts.
+    // When both operands have native checked representations, preserve
+    // the deciding value and short-circuit evaluation in that domain.
+    if (
+      isJsSourceFile(expr.getSourceFile()) &&
+      lowerer.dynConvertible(left.type) &&
+      lowerer.dynConvertible(right.type)
+    ) {
+      return {
+        kind: "logical",
+        op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
+        left: lowerer.coerceInto(expr.left, left, DYN),
+        right: lowerer.coerceInto(expr.right, right, DYN),
+        type: DYN,
+        loc,
+      };
+    }
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      `logical operators on union-typed values outside conditions (${NARROW_FIRST})`,
+    );
+  }
+  const kind = left.type.kind;
+  if (kind !== right.type.kind || (kind !== "f64" && kind !== "string" && kind !== "bool")) {
+    // Mixed PLAIN operands (`value || null`, `flag || undefined`,
+    // `s || 0`): JS value semantics still compile when the checker
+    // types the RESULT as one union both operands coerce into — the
+    // same lift the union-operand path above takes, arriving here
+    // with two plain arm values instead.
+    const target = lowerer.mapTypeOf(lowerer.typeOf(expr));
+    // An always-truthy left operand (a record, object, array or function
+    // value: every JS object is truthy): `o && x` evaluates `o` for its
+    // effects and answers `x`; `o || x` answers `o` and never evaluates
+    // `x`. supports-color's `stream && stream.isTTY` is the shape. Ahead
+    // of the union lift below exactly where that lift would store the
+    // object in a result union with no arm for it; a union holding the
+    // operand keeps the lift.
+    if (
+      REF_TRUTHY_KINDS.has(kind) &&
+      (target?.kind !== "union" ||
+        (op === ts.SyntaxKind.AmpersandAmpersandToken &&
+          lowerer.armTag(target.unionId, left.type) < 0))
+    ) {
+      const and = op === ts.SyntaxKind.AmpersandAmpersandToken;
+      const answer = and ? right : left;
+      const answerT = target ?? answer.type;
+      if (answerT.kind !== "void") {
+        const value = lowerer.coerceInto(and ? expr.right : expr.left, answer, answerT);
+        if (!and) return value;
+        return {
+          kind: "seqExpr",
+          stmts: [{ kind: "exprStmt", expr: left, loc }],
+          result: value,
+          type: answerT,
+          loc,
+        };
+      }
+    }
+    if (target?.kind === "union") {
+      lowerer.requireTruthyUnion(target.unionId, expr);
+      return {
+        kind: "logical",
+        op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
+        left: lowerer.coerceInto(expr.left, left, target),
+        right: lowerer.coerceInto(expr.right, right, target),
+        type: target,
+        loc,
+      };
+    }
+    lowerer.unsupported("SC1042", expr);
+  }
+  return {
+    kind: "logical",
+    op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
+    left,
+    right,
+    type: left.type,
+    loc,
+  };
+}
+
+function lowerAbsenceAwareOrChain(lowerer: Lowerer, expr: ts.BinaryExpression): IrExpr | null {
+  const nodes: ts.Expression[] = [];
+  const pending: ts.Expression[] = [expr];
+  while (pending.length !== 0) {
+    const node = pending.pop()!;
+    if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.BarBarToken) {
+      pending.push(node.right, node.left);
+    } else {
+      nodes.push(node);
+    }
+  }
+  if (nodes.length < 3) return null;
+  const lowered = nodes.map((node) => lowerAbsenceProbe(lowerer, node) ?? lowerer.lowerExpr(node));
+  if (
+    !lowered.some(
+      (value) =>
+        value.type.kind === "union" && lowerer.armTag(value.type.unionId, UNDEFINED_T) >= 0,
+    )
+  ) {
+    return null;
+  }
+  let result = lowered[lowered.length - 1]!;
+  for (let i = lowered.length - 2; i >= 0; i--) {
+    const left = lowered[i]!;
+    const loc = locOf(nodes[i]!);
+    if (left.type.kind === "union") {
+      const def = lowerer.unions.get(left.type.unionId);
+      const nonUnit = def?.arms.filter((arm) => !isUnitType(arm)) ?? [];
+      if (nonUnit.length !== 1 || !typeEquals(nonUnit[0]!, result.type)) return null;
+      lowerer.requireTruthyUnion(left.type.unionId, expr);
+      result = { kind: "orDefault", left, right: result, type: result.type, loc };
+      continue;
+    }
+    if (!typeEquals(left.type, result.type)) return null;
+    result = { kind: "logical", op: "||", left, right: result, type: result.type, loc };
+  }
+  return result;
+}
+
+/** `typeof WebAssembly === "object"` and `typeof WebAssembly.<member> ===
+ * "function"`: the operand needs no value, so the test folds as bare typeof
+ * does (builtins/webassembly.ts) before any dyn-typed operand lowers. */
+function lowerWebAssemblyTypeofTest(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+  loc: SrcLoc,
+): IrExpr | null {
+  const negated = expr.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken;
+  for (const [a, b] of operandPairs(expr)) {
+    if (!ts.isTypeOfExpression(a) || !ts.isStringLiteral(b)) continue;
+    const folded = lowerWebAssemblyTypeof(lowerer, a.expression);
+    if (folded?.kind !== "strLit") continue;
+    return { kind: "boolLit", value: (folded.value === b.text) !== negated, type: BOOL, loc };
+  }
+  return null;
+}
+
+/** `typeof v === "lit"` / `typeof v !== "lit"` where v is UNION-typed: the
+ * arms whose static typeof answer equals the literal form a tag set, and
+ * the test is a runtime tag test — one `unionIsTag` for a single matching
+ * arm (the operand embeds once, so even effectful operands compose), a
+ * short-circuit chain for several (pure reads only — the operand rides
+ * every test, exactly the `== null` composition rule). When every arm
+ * answers the same way the comparison is statically decided and folds to
+ * a bool literal — dropping only a side-effect-free read, the same
+ * trust-the-checker bet as lowerUnitComparison. tsc's control-flow
+ * narrowing then types the branches, and reads bridge through
+ * maybeNarrow's unionNarrow as usual. Null when neither side is a typeof
+ * over a union-typed operand or the literal side isn't a literal (the
+ * bare-typeof value form then composes with strEq for pure operands). */
+function lowerUnionTypeofTest(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+  loc: SrcLoc,
+): IrExpr | null {
+  const negated = expr.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken;
+  for (const [a, b] of operandPairs(expr)) {
+    if (!ts.isTypeOfExpression(a)) continue;
+    const stored = runtimeOptionalStorageOperand(lowerer, a.expression);
+    if (stored === null && lowerer.mapTypeOf(lowerer.typeOf(a.expression))?.kind !== "union")
+      continue;
+    if (!ts.isStringLiteral(b)) continue; // bare-typeof + strEq handles pure operands
+    const value = stored ?? lowerer.lowerExpr(a.expression);
+    if (value.type.kind !== "union") continue; // defensive: an already-narrowed use
+    const unionId = value.type.unionId;
+    const def = lowerer.unions.get(unionId);
+    const answers = def?.arms.map(typeofAnswer);
+    if (!def || !answers || !answers.every((s): s is string => s !== null)) continue;
+    const tags = answers.flatMap((s, i) => (s === b.text ? [i] : []));
+    if (tags.length === 0 || tags.length === def.arms.length) {
+      if (!isSafeToRepeat(value)) {
+        lowerer.unsupported(
+          "SC1090",
+          expr,
+          "statically-decided 'typeof' tests over effectful operands (bind the value to a const first)",
+        );
+      }
+      return { kind: "boolLit", value: (tags.length !== 0) !== negated, type: BOOL, loc };
+    }
+    const isTag = (tag: number): IrExpr => ({
+      kind: "unionIsTag",
+      unionId,
+      tag,
+      negated,
+      value,
+      type: BOOL,
+      loc,
+    });
+    if (tags.length === 1) return isTag(tags[0]!);
+    if (!isSafeToRepeat(value)) {
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        "'typeof' tests matching several union arms over operands that aren't plain reads (bind the value to a const first)",
+      );
+    }
+    // Tag-in-set as a short-circuit chain (De Morgan for `!==`).
+    let acc = isTag(tags[0]!);
+    for (const t of tags.slice(1)) {
+      acc = {
+        kind: "logical",
+        op: negated ? "&&" : "||",
+        left: acc,
+        right: isTag(t),
+        type: BOOL,
+        loc,
+      };
+    }
+    return acc;
+  }
+  return null;
+}
diff --git a/packages/compiler/src/frontend/lowering/expressions/element-access.ts b/packages/compiler/src/frontend/lowering/expressions/element-access.ts
new file mode 100644
index 000000000..144742257
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/expressions/element-access.ts
@@ -0,0 +1,2189 @@
+/* Element reads and writes (`a[i]`, `a[i] = v`), compound element updates, and keyed record reads. */
+import * as ts from "../../ts7/adapter.js";
+import { type Lowerer, jsFuncNameOf, neverTaintedJsType } from "../lowerer.js";
+import {
+  BOOL,
+  DYN,
+  F64,
+  type IrExpr,
+  type IrRecordShape,
+  type IrStmt,
+  type IrType,
+  NULL_T,
+  STRING,
+  type SrcLoc,
+  UNDEFINED_T,
+  VOID,
+  canBoxFuncIntoDyn,
+  canDynCheckTo,
+  isDynTypedRefType,
+  isUnitType,
+  shapeHasAccessorSlots,
+  typeEquals,
+} from "../../../ir/ir.js";
+import { importMetaField, isImportMeta } from "../import-meta.js";
+import { hasOptionalChainGuard, isOptionalChainTail } from "./optional-chains.js";
+import { lowerEnumAccess } from "../lower-enums.js";
+import { fenceNodeModuleMutation, lowerRequireCacheElement } from "../lower-node-module.js";
+import { lowerModuleNamespaceElement } from "../module-namespace-elements.js";
+import { type CompoundOp, stdlibGlobalNameOf } from "../surfaces.js";
+import { globalSymbolKey } from "./global-symbols.js";
+import { isJsSourceFile, locOf } from "../../program.js";
+import { lowerGlobalValue } from "../lower-global-value.js";
+import { expandoMemberRead } from "../lower-expando.js";
+import {
+  assertedElementKeepsUndefined,
+  compoundUnsupported,
+  concatOperand,
+  dynCompoundValue,
+  hasClassPayload,
+  lowerDynMemberAssignment,
+  lowerOptionalArrayIndexRead,
+  lowerOptionalNumber,
+  recordKeyResultOk,
+  representedClassFieldTarget,
+  runtimeOptionalElementKey,
+  symbolFieldTarget,
+} from "../lower-exprs.js";
+import { hasRuntimeStatics } from "../class-runtime-statics.js";
+import { tryLowerExpression } from "./try-lower-expression.js";
+import { classFieldTarget, lowerUnionKeyedRead } from "./property-access.js";
+import {
+  arrayNumberRead,
+  arrayValueRead,
+  arrayValueStore,
+  arrayValueType,
+  lowerSafeBytesRead,
+  lowerSafeIndexRead,
+} from "../array-values.js";
+import { lowerOptionalStringIndex, lowerUnionStringIndex } from "../string-index.js";
+import { InternalCompilerError } from "../../../errors.js";
+import { dynUndefinedExpr, nodeThrowExpr, numLit, strLit, varRef } from "../../../ir/build.js";
+import { npmStaticPackageOfPath } from "../../npm-static.js";
+import { isSafeToRepeat } from "./evaluation-safety.js";
+import { lowerClassPrototypeComputedAssignment } from "../class-prototypes.js";
+import { isClassCallback } from "../class-callbacks.js";
+
+/** `a[i]` reads. Only f64 indices into array receivers are modeled; JS
+ * string-key element access (`a["length"]`) and string indexing (`s[0]`
+ * typechecks against the lib's index signature; use .charAt) stay out. */
+export function lowerElementAccess(lowerer: Lowerer, expr: ts.ElementAccessExpression): IrExpr {
+  if (isImportMeta(expr.expression)) {
+    const name = lowerer.foldedStringKeyOf(expr.argumentExpression);
+    if (name === null)
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        "import.meta with a runtime-computed key (use a statically-known metadata field)",
+      );
+    return importMetaField(lowerer, expr, name);
+  }
+
+  // `a?.[i]`: the guard lowers as an optional-chain step around the
+  // plain element read below.
+  if (expr.questionDotToken && !lowerer.chainHandled.has(expr)) {
+    return lowerer.lowerOptionalChain(expr);
+  }
+  // `a?.b[i]` — the tail of a chain whose token sits deeper: the whole
+  // tail short-circuits with the guard.
+  if (!expr.questionDotToken && isOptionalChainTail(lowerer, expr)) {
+    return lowerer.lowerOptionalChain(expr);
+  }
+  // Enum accesses in element clothing — `E["A"]` forward reads and
+  // `E[0]` reverse-mapping reads — fold to constants (lower-enums.ts),
+  // claimed before any receiver-kind dispatch can see the enum object.
+  {
+    const en = lowerEnumAccess(lowerer, expr);
+    if (en) return en;
+  }
+  const cachedModule = lowerRequireCacheElement(lowerer, expr);
+  if (cachedModule) return cachedModule;
+  const namespaceElement = lowerModuleNamespaceElement(lowerer, expr);
+  if (namespaceElement) return namespaceElement;
+  // Native Web handles use the same supported surface for bracket and dot
+  // spellings. Fence a statically-known unsupported key before the generic
+  // checked-dynamic element-read path can turn it into a runtime missing
+  // member.
+  lowerer.fenceStaticAbortControllerMemberRead(expr);
+  lowerer.fenceStaticResponseMember(expr, "read");
+  lowerer.fenceStaticHeadersMember(expr, "read");
+  lowerer.fenceStaticReadableStreamMember(expr, "read");
+  // Computed global reads share the stored global object's custom
+  // properties. Symbol keys retain their identity-indexed store.
+  if (!expr.questionDotToken && stdlibGlobalNameOf(lowerer, expr.expression) === "globalThis") {
+    const symbol = globalSymbolKey(lowerer, expr.expression, expr.argumentExpression);
+    if (symbol)
+      return {
+        kind: "libCall",
+        fn: "dyn.globalSymbolGet",
+        args: [symbol],
+        type: DYN,
+        loc: locOf(expr),
+      };
+    const key = lowerer.lowerExpr(expr.argumentExpression);
+    const name: IrExpr =
+      key.type.kind === "string"
+        ? key
+        : {
+            kind: "libCall",
+            fn: "dyn.toStringCoerce",
+            args: [lowerer.coerceInto(expr.argumentExpression, key, DYN)],
+            type: STRING,
+            loc: locOf(expr),
+          };
+    return {
+      kind: "dynKeyGet",
+      value: lowerGlobalValue(lowerer, expr.expression),
+      key: name,
+      type: DYN,
+      loc: locOf(expr),
+    };
+  }
+  // `req.headers["x-name"]` — the computed twin of `req.headers.host`
+  // (the server spoke owns both; the envGet precedent).
+  {
+    const header = lowerer.lowerHttpHeadersElement(expr);
+    if (header) return lowerer.maybeNarrow(header, expr);
+  }
+  // `process.env[expr]` — the computed twin of `process.env.NAME`; both
+  // lower to the ONE process.envGet intrinsic. The read narrows like any
+  // union-typed expression when the checker narrowed this occurrence.
+  if (lowerer.isProcessEnv(expr.expression)) {
+    const key = lowerEnvironmentKey(lowerer, expr.argumentExpression);
+    if (key.type.kind !== "string") {
+      lowerer.unsupported(
+        "SC1090",
+        expr.argumentExpression,
+        "indexing process.env with non-string keys",
+      );
+    }
+    const get: IrExpr = {
+      kind: "libCall",
+      fn: "process.envGet",
+      args: [key],
+      type: lowerer.envValueType(),
+      loc: locOf(expr),
+    };
+    return lowerer.maybeNarrow(get, expr);
+  }
+  // Expando function members in element clothing (`foo[strMem]`,
+  // `foo[_private]` where foo is a module-level function/callable const
+  // and the key folds or is a unique-symbol const): the member's module
+  // global — the dotted read's twin (lower-expando.ts).
+  {
+    const ex = expandoMemberRead(lowerer, expr);
+    if (ex) return lowerer.maybeNarrow(ex, expr);
+  }
+  // Symbol-keyed property READS (`this[kLimit]`): when the key is a
+  // statically-resolvable symbol declared as a field of the receiver's
+  // class (classSymbolKeyOf — the countdown.js/OpenTUI idioms), the
+  // read IS an ordinary field read of the hidden slot. Every other
+  // symbol key stays fenced: record shapes, runtime-identity keys
+  // (symbol parameters, reassigned bindings), and keys no class declares
+  // — the layouts are compile-time field lists.
+  if (lowerer.mapTypeOf(lowerer.typeOf(expr.argumentExpression))?.kind === "symbol") {
+    const target = symbolFieldTarget(lowerer, expr);
+    if (target) return lowerer.maybeNarrow(lowerer.fieldGetExpr(target, locOf(expr), expr), expr);
+    let receiver = lowerer.lowerExpr(expr.expression);
+    const classInfo =
+      receiver.type.kind === "classval" ? lowerer.classes.get(receiver.type.className) : undefined;
+    if (
+      receiver.type.kind === "func" ||
+      receiver.type.kind === "generator" ||
+      ((receiver.type.kind === "array" ||
+        receiver.type.kind === "string" ||
+        receiver.type.kind === "bytes") &&
+        lowerer.dynConvertible(receiver.type)) ||
+      (receiver.type.kind === "object" && lowerer.dynConvertible(receiver.type)) ||
+      isDynTypedRefType(receiver.type) ||
+      (classInfo && (classInfo.callableBase || hasRuntimeStatics(classInfo))) ||
+      ((receiver.type.kind === "map" || receiver.type.kind === "set") &&
+        lowerer.dynConvertible(receiver.type))
+    ) {
+      const fnName = jsFuncNameOf(expr.expression);
+      receiver = {
+        kind: "dynFrom",
+        value: receiver,
+        type: DYN,
+        loc: locOf(expr),
+        ...(fnName !== null ? { fnName } : {}),
+      };
+    }
+    if (receiver.type.kind === "dyn") {
+      const key = lowerer.lowerExprExpecting(expr.argumentExpression, DYN);
+      return lowerer.maybeNarrow(
+        { kind: "dynKeyGet", value: receiver, key, type: DYN, loc: locOf(expr) },
+        expr,
+      );
+    }
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      "symbol-keyed property access outside class fields keyed by a stable module-level literal Symbol()/Symbol.for() (other static shapes have no symbol-keyed storage)",
+    );
+  }
+  // A never-tainted JS receiver type (neverTaintedJsType — `cmd[1]` on
+  // `const cmd = ['pwd', []]`, whose binding lowered checked-dynamic)
+  // dispatches as unmapped so the dyn-receiver branch below reads
+  // through the checked-dynamic tree instead of dynChecking into never's f64 residue.
+  let receiverIr = neverTaintedJsType(lowerer, expr.expression, lowerer.typeOf(expr.expression))
+    ? null
+    : lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+  if (isJsSourceFile(expr.getSourceFile())) {
+    const receiver = tryLowerExpression(lowerer, expr.expression);
+    if (receiver?.type.kind === "dyn") {
+      const key = lowerer.lowerExprExpecting(expr.argumentExpression, DYN);
+      const optional = hasOptionalChainGuard(expr.expression);
+      return lowerer.maybeNarrow(
+        {
+          kind: "dynKeyGet",
+          value: receiver,
+          key,
+          ...(optional ? { optional: true as const } : {}),
+          type: DYN,
+          loc: locOf(expr),
+        },
+        expr,
+      );
+    }
+    if (receiver?.type.kind === "func" && lowerer.dynConvertible(receiver.type)) {
+      const loc = locOf(expr);
+      const fnName = jsFuncNameOf(expr.expression);
+      const boxed: IrExpr = {
+        kind: "dynFrom",
+        value: receiver,
+        type: DYN,
+        loc,
+        ...(fnName !== null ? { fnName } : {}),
+      };
+      const key = lowerer.lowerExprExpecting(expr.argumentExpression, DYN);
+      return lowerer.maybeNarrow({ kind: "dynKeyGet", key, value: boxed, type: DYN, loc }, expr);
+    }
+    if (receiver?.type.kind === "array" || receiver?.type.kind === "bytes")
+      receiverIr = receiver.type;
+    if (receiver?.type.kind === "union") {
+      const present = lowerer.stripUndefinedArm(receiver.type);
+      if (present.kind === "array" || present.kind === "bytes") receiverIr = present;
+    }
+  }
+  // A readonly tuple union under Array.isArray is checker-typed as an
+  // intersection with any[], whose structural mapping is not the tuple
+  // shape. maybeNarrow on the receiver uses the runtime tag proof to
+  // extract the one array-valued arm; dispatch element access from that
+  // lowered representation, like the existing any[] array-method path.
+  const checkerArray = lowerer.checkerArrayValue(expr.expression);
+  if (checkerArray) receiverIr = checkerArray.type;
+  if (receiverIr?.kind === "object") {
+    const key =
+      recordKeyLiteralText(expr.argumentExpression) ??
+      recordKeyTypeLiteralText(lowerer, expr.argumentExpression);
+    if (key !== null) {
+      const target = classFieldTarget(lowerer, expr.expression, receiverIr, key);
+      if (target) return lowerer.maybeNarrow(lowerer.fieldGetExpr(target, locOf(expr), expr), expr);
+    }
+    if (receiverIr.className === "%Error" || isDynTypedRefType(receiverIr)) {
+      const receiver = lowerer.coerceToExpected(lowerer.lowerExpr(expr.expression), DYN);
+      const key = lowerer.lowerExprExpecting(expr.argumentExpression, DYN);
+      return lowerer.maybeNarrow(
+        { kind: "dynKeyGet", value: receiver, key, type: DYN, loc: locOf(expr) },
+        expr,
+      );
+    }
+  }
+
+  // Typed-array element read `b[i]` — like arrayGet with a scalar
+  // result; any invalid index traps (the array discipline; JS would
+  // read undefined — divergence 4's policy).
+  if (receiverIr?.kind === "bytes") {
+    let recv = lowerer.lowerExpr(expr.expression);
+    if (recv.type.kind === "dyn") recv = lowerer.coerceInto(expr.expression, recv, receiverIr);
+    if (recv.type.kind === "union" && lowerer.armTag(recv.type.unionId, UNDEFINED_T) >= 0) {
+      const present = lowerer.stripUndefinedArm(recv.type);
+      const helper =
+        present.kind === "bytes"
+          ? lowerer.narrowedArmHelper(recv.type.unionId, present, locOf(expr.expression))
+          : null;
+      recv = helper
+        ? lowerer.checkedNarrowCall(helper, recv, present, locOf(expr.expression))
+        : lowerer.maybeNarrow(recv, expr.expression);
+    }
+
+    const index = lowerOptionalNumber(
+      lowerer,
+      lowerer.lowerExpr(expr.argumentExpression),
+      locOf(expr.argumentExpression),
+      expr.argumentExpression,
+    );
+    if (isJsSourceFile(expr.getSourceFile()) && recv.type.kind === "bytes") {
+      return {
+        kind: "dynKeyGet",
+        value: lowerer.coerceInto(expr.expression, recv, DYN),
+        key:
+          index.type.kind === "f64"
+            ? { kind: "toString", operand: index, type: STRING, loc: locOf(expr) }
+            : index,
+        type: DYN,
+        loc: locOf(expr),
+      };
+    }
+    if (index.type.kind === "dyn" && recv.type.kind === "bytes") {
+      return {
+        kind: "dynKeyGet",
+        value: lowerer.coerceInto(expr.expression, recv, DYN),
+        key: index,
+        type: DYN,
+        loc: locOf(expr),
+      };
+    }
+    if (index.type.kind !== "f64") {
+      lowerer.unsupported("SC1090", expr.argumentExpression, "indexing with non-number keys");
+    }
+    // `t[i]!` asserts presence: the numeric element read (NaN when
+    // invalid). Every other read answers undefined for an invalid index,
+    // like Node.
+    // A read whose every consumer treats undefined like NaN (see
+    // nan-coded-reads.ts) is the same plain numeric read.
+    if (
+      (ts.isNonNullExpression(expr.parent) && expr.parent.expression === expr) ||
+      lowerer.nanCodedReads?.isNumericRead(expr) === true
+    ) {
+      return {
+        kind: "bytesIntrinsic",
+        method: "get",
+        receiver: recv,
+        args: [index],
+        type: F64,
+        loc: locOf(expr),
+        invalidNaN: true,
+      };
+    }
+    return lowerSafeBytesRead(lowerer, recv, index, locOf(expr));
+  }
+  // Tuple element read `t[0]`: a positional-field read of the tuple's
+  // record shape — LITERAL indices only (the checker's per-index types
+  // are what make the read honest; a dynamic index over a heterogeneous
+  // shape has no single element type). Narrows like any field read.
+  if (receiverIr?.kind === "record") {
+    const shape = lowerer.shapes.get(receiverIr.shapeId);
+    if (shape?.tuple) {
+      let obj = lowerer.lowerExpr(expr.expression);
+
+      if (obj.type.kind === "dyn") {
+        // Object.entries over a checked value stores each pair in the
+        // dynamic tree even when the checker names a tuple type.
+        const key = lowerRecordPropertyKey(
+          lowerer,
+          lowerer.lowerExpr(expr.argumentExpression),
+          expr.argumentExpression,
+        );
+        const optional = hasOptionalChainGuard(expr.expression);
+        return lowerer.maybeNarrow(
+          {
+            kind: "dynKeyGet",
+            value: obj,
+            key,
+            ...(optional ? { optional: true as const } : {}),
+            type: DYN,
+            loc: locOf(expr),
+          },
+          expr,
+        );
+      }
+      if (obj.type.kind === "union" && lowerer.armTag(obj.type.unionId, UNDEFINED_T) >= 0) {
+        // The checker sees the outer `arrays[i]` as a tuple when
+        // noUncheckedIndexedAccess is disabled, but the lowered read is
+        // still tuple | undefined. A nested tuple field must validate the
+        // outer tag before recordGet; an unchecked unionNarrow would let a
+        // missing outer element reach the record backend as a bad pointer.
+        const present = lowerer.stripUndefinedArm(obj.type);
+        const helper =
+          present.kind === "record"
+            ? lowerer.narrowedArmHelper(obj.type.unionId, present, locOf(expr.expression))
+            : null;
+        obj = helper
+          ? lowerer.checkedNarrowCall(helper, obj, present, locOf(expr.expression))
+          : lowerer.maybeNarrow(obj, expr.expression);
+      }
+      const idx = tupleLiteralIndex(expr.argumentExpression);
+      if (idx === null) {
+        lowerer.unsupported(
+          "SC1090",
+          expr.argumentExpression,
+          "tuple indexing with a non-literal index (tuples are fixed-shape — use t[0], t[1], ...)",
+        );
+      }
+      const shapeId = obj.type.kind === "record" ? obj.type.shapeId : receiverIr.shapeId;
+      const actualShape = lowerer.shapes.get(shapeId) ?? shape;
+      const fieldType = actualShape.fields.find((f) => f.name === String(idx))?.type;
+      if (fieldType === undefined) lowerer.badType(expr, lowerer.typeOf(expr)); // OOB smuggled past tsc
+      const get: IrExpr = {
+        kind: "recordGet",
+        obj,
+        shapeId,
+        field: String(idx),
+        type: fieldType,
+        loc: locOf(expr),
+      };
+      return lowerer.isRuntimeOptionalField(shapeId, String(idx))
+        ? get
+        : lowerer.maybeNarrow(get, expr);
+    }
+    if (shape && !shape.tuple) {
+      return lowerer.lowerRecordKeyRead(expr, receiverIr.shapeId, shape);
+    }
+  }
+  // `pkg["k"]` / `scripts[name]` / `scopeMatch[1]` on a dyn receiver (a
+  // JSON.parse result): the dyn keyed read, exactly the dot form.
+  // NUMBER-typed indices convert through ToString first — JS property
+  // keys are strings, and the canonical number text answers array
+  // indices in the helper (fractions, negatives, and NaN read as
+  // absent keys, exactly JS). An UNMAPPABLE checker type takes the
+  // same path when the receiver LOWERS dyn
+  // (`pkg.workspaces.packages["0"]` — the lowering world types the
+  // unknown-rooted chain `any`); a non-dyn lowering falls through to
+  // the fences below (re-lowering is pure IR construction).
+  if (receiverIr?.kind === "dyn" || receiverIr?.kind === "union" || receiverIr === null) {
+    const obj = lowerer.lowerExpr(expr.expression);
+    // A generic mapped type can stay unresolved at this body use even
+    // though its instantiated parameter has a concrete record ABI.
+    // Dispatch from that stored shape, as the array fallback below does.
+    if (receiverIr === null && obj.type.kind === "record") {
+      const shape = lowerer.shapes.get(obj.type.shapeId);
+      const index = tupleLiteralIndex(expr.argumentExpression);
+      const field =
+        shape?.tuple && index !== null
+          ? shape.fields.find((field) => field.name === String(index))
+          : null;
+      if (field)
+        return lowerer.maybeNarrow(
+          {
+            kind: "recordGet",
+            obj,
+            shapeId: obj.type.shapeId,
+            field: field.name,
+            type: field.type,
+            loc: locOf(expr),
+          },
+          expr,
+        );
+      if (shape && !shape.tuple) {
+        return lowerer.lowerRecordKeyRead(expr, obj.type.shapeId, shape);
+      }
+    }
+    if (
+      obj.type.kind === "dyn" ||
+      (obj.type.kind === "object" && obj.type.className === "%Error") ||
+      isDynTypedRefType(obj.type)
+    ) {
+      const rawKey = lowerer.lowerExpr(expr.argumentExpression);
+      // Number, bool, and DYN keys stringify (ToPropertyKey) — the
+      // dyn-keyed read `catchWarning[warning.name]` where the property
+      // chain itself lowered dyn.
+      const key =
+        rawKey.type.kind === "dyn" ||
+        rawKey.type.kind === "symbol" ||
+        (rawKey.type.kind === "union" && lowerer.dynConvertible(rawKey.type))
+          ? lowerer.coerceToExpected(rawKey, DYN)
+          : lowerRecordPropertyKey(lowerer, rawKey, expr.argumentExpression);
+      if (key.type.kind === "string" || key.type.kind === "dyn") {
+        const opt = hasOptionalChainGuard(expr.expression);
+        return lowerer.maybeNarrow(
+          {
+            kind: "dynKeyGet",
+            key,
+            ...(opt ? { optional: true as const } : {}),
+            value: lowerer.coerceToExpected(obj, DYN),
+            type: DYN,
+            loc: locOf(expr),
+          },
+          expr,
+        );
+      }
+    }
+    // A checker-`any` receiver that LOWERS to a static ARRAY
+    // (`pm.split("@")[0]` — the dyn-receiver string machinery answers
+    // string[]): the element read rides the ordinary array path on the
+    // lowered value (invalid indices trap, divergence 4's policy).
+    if (obj.type.kind === "array") {
+      const index = lowerer.lowerExpr(expr.argumentExpression);
+      if (index.type.kind === "f64") {
+        const safe = lowerSafeIndexRead(lowerer, obj, index, locOf(expr));
+        if (safe) return safe;
+        return lowerer.maybeNarrow(
+          { kind: "arrayGet", arr: obj, index, type: obj.type.elem, loc: locOf(expr) },
+          expr,
+        );
+      }
+    }
+  }
+  // `env[key]` on a UNION of record shapes (`ProcessEnv | Record<string,
+  // string>` — the env-bag parameter pattern): the per-arm keyed read,
+  // joined exactly like the dot form (lowerUnionProperty's keyed path).
+  if (receiverIr?.kind === "union") {
+    const value = lowerer.lowerExpr(expr.expression);
+    if (value.type.kind === "union") {
+      const key = lowerer.lowerExpr(expr.argumentExpression);
+      if (key.type.kind === "f64") {
+        const def = lowerer.unions.get(value.type.unionId);
+        const presentArms = def?.arms.filter((arm) => !isUnitType(arm)) ?? [];
+        if (presentArms.length === 1 && presentArms[0]?.kind === "string") {
+          const property = runtimeOptionalElementKey(expr.argumentExpression);
+          const receiver =
+            property === null
+              ? null
+              : lowerer.runtimeOptionalPropertyReceiver(expr.expression, value, STRING, property);
+          if (receiver !== null) {
+            return {
+              kind: "strIntrinsic",
+              method: "charAt",
+              receiver,
+              args: [key],
+              type: STRING,
+              loc: locOf(expr),
+            };
+          }
+        }
+      }
+      if (key.type.kind === "f64") {
+        const safe = lowerOptionalArrayIndexRead(lowerer, expr, value, key);
+        if (safe) return safe;
+      }
+      if (key.type.kind === "string" || key.type.kind === "f64") {
+        const lit = ts.isStringLiteral(expr.argumentExpression)
+          ? expr.argumentExpression.text
+          : null;
+        const keyed = lowerUnionKeyedRead(lowerer, expr, value.type.unionId, value, key, lit);
+        if (keyed) return lowerer.maybeNarrow(keyed, expr);
+      }
+    }
+  }
+  if (receiverIr?.kind !== "array") {
+    {
+      const receiver = tryLowerExpression(lowerer, expr.expression);
+      if (
+        receiver?.type.kind === "dyn" ||
+        (receiver &&
+          isJsSourceFile(expr.getSourceFile()) &&
+          (receiver.type.kind === "union" || receiver.type.kind === "bytes") &&
+          lowerer.dynConvertible(receiver.type))
+      ) {
+        const key = lowerRecordPropertyKey(
+          lowerer,
+          lowerer.lowerExpr(expr.argumentExpression),
+          expr.argumentExpression,
+        );
+        return lowerer.maybeNarrow(
+          {
+            kind: "dynKeyGet",
+            value: lowerer.coerceInto(expr.expression, receiver, DYN),
+            key,
+            type: DYN,
+            loc: locOf(expr),
+          },
+          expr,
+        );
+      }
+      if (
+        receiver?.type.kind === "func" &&
+        canBoxFuncIntoDyn(
+          receiver.type,
+          (id) => lowerer.shapes.get(id),
+          (id) => lowerer.unions.get(id),
+        )
+      ) {
+        const key = lowerRecordPropertyKey(
+          lowerer,
+          lowerer.lowerExpr(expr.argumentExpression),
+          expr.argumentExpression,
+        );
+        if (key.type.kind === "string") {
+          const boxed: IrExpr = {
+            kind: "dynFrom",
+            value: receiver,
+            type: DYN,
+            loc: locOf(expr.expression),
+          };
+          return lowerer.maybeNarrow(
+            { kind: "dynKeyGet", key, value: boxed, type: DYN, loc: locOf(expr) },
+            expr,
+          );
+        }
+      }
+    }
+    if (receiverIr?.kind === "string") {
+      // An indexed string property is absent for non-integer and missing
+      // indexes. charAt has different coercion and out-of-range semantics.
+      const recv = lowerer.lowerExpr(expr.expression);
+      const index = lowerOptionalNumber(
+        lowerer,
+        lowerer.lowerExpr(expr.argumentExpression),
+        locOf(expr.argumentExpression),
+        expr.argumentExpression,
+      );
+      if (index.type.kind === "f64" && recv.type.kind === "string") {
+        // A proven in-bounds integer index always names a code unit, where
+        // charAt and the property read agree.
+        if (lowerer.stringIndexBounds.inBounds(expr))
+          return {
+            kind: "strIntrinsic",
+            method: "charAt",
+            receiver: recv,
+            args: [index],
+            type: STRING,
+            loc: locOf(expr),
+          };
+        return lowerOptionalStringIndex(
+          lowerer,
+          recv,
+          index,
+          lowerer.withUndefinedArm(STRING),
+          locOf(expr),
+        );
+      }
+      // The checker narrowed the receiver to string, but its stored value
+      // is still the union (an array-derived binding, a typeof guard).
+      if (index.type.kind === "f64") {
+        const read = lowerUnionStringIndex(
+          lowerer,
+          recv,
+          index,
+          expr.argumentExpression,
+          lowerer.withUndefinedArm(STRING),
+          locOf(expr),
+        );
+        if (read) return read;
+      }
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        "string indexing with this index/result shape (expected a number index and a string or string | undefined result)",
+      );
+    }
+    lowerer.unsupported("SC1090", expr, "element access on non-array values");
+  }
+  let arr = lowerer.lowerExpr(expr.expression);
+  const runtimeOptionalSource = lowerer.runtimeOptionalSourceValue(expr.expression, arr);
+  if (
+    runtimeOptionalSource?.kind === "varRef" &&
+    runtimeOptionalSource.type.kind === "union" &&
+    arr.type.kind === "array"
+  ) {
+    // lowerer.lowerElementAccess has already recognized a captured
+    // array | undefined receiver and supplied its checked extraction as
+    // the expression override. Rebuild that check here so a missing
+    // receiver throws the member-access error Node exposes, rather than
+    // the generic target-union narrowing error. The stored receiver is a
+    // varRef, so both the tag test and extraction read the same value
+    // without repeating an effect.
+    const stored = runtimeOptionalSource;
+    if (stored.type.kind !== "union")
+      throw new InternalCompilerError("runtime-optional array source lost its union storage");
+    const unionId = stored.type.unionId;
+    const undefTag = lowerer.armTag(unionId, UNDEFINED_T);
+    const valueTag = lowerer.armTag(unionId, arr.type);
+    const property = runtimeOptionalElementKey(expr.argumentExpression);
+    if (undefTag >= 0 && valueTag >= 0 && property !== null) {
+      arr = {
+        kind: "ternary",
+        cond: {
+          kind: "unionIsTag",
+          unionId,
+          tag: undefTag,
+          negated: false,
+          value: stored,
+          type: BOOL,
+          loc: locOf(expr.expression),
+        },
+        then: nodeThrowExpr(
+          1,
+          "",
+          `Cannot read properties of undefined (reading '${property}')`,
+          arr.type,
+          locOf(expr.expression),
+        ),
+        else_: {
+          kind: "unionNarrow",
+          unionId,
+          tag: valueTag,
+          value: stored,
+          type: arr.type,
+          loc: locOf(expr.expression),
+        },
+        type: arr.type,
+        loc: locOf(expr.expression),
+      };
+    }
+  }
+  if (
+    arr.type.kind === "union" &&
+    lowerer.armTag(arr.type.unionId, UNDEFINED_T) >= 0 &&
+    receiverIr.kind === "array"
+  ) {
+    // As with tuple receivers above, an unchecked outer read can be
+    // undefined even when the checker reports an array. Extract the
+    // present array arm with a runtime tag check before arrayGet or the
+    // safe indexed-read helper runs.
+    const present = lowerer.stripUndefinedArm(arr.type);
+    const helper =
+      present.kind === "array"
+        ? lowerer.narrowedArmHelper(arr.type.unionId, present, locOf(expr.expression))
+        : null;
+    arr = helper
+      ? lowerer.checkedNarrowCall(helper, arr, present, locOf(expr.expression))
+      : lowerer.maybeNarrow(arr, expr.expression);
+  }
+
+  // The checker sees an array but the VALUE lowered checked-dynamic (a
+  // jsdoc-typed default export from a .js module — signature 14): the
+  // read rides the dynCheck boundary when the array shape is one the checked-dynamic tree
+  // can validate, and fences by name when it is not — an arrayGet over a
+  // dyn receiver is never emitted (the validator ICE).
+  if (arr.type.kind === "dyn") {
+    if (
+      canDynCheckTo(
+        receiverIr,
+        (id) => lowerer.shapes.get(id),
+        (id) => lowerer.unions.get(id),
+      )
+    ) {
+      arr = { kind: "dynCheck", value: arr, type: receiverIr, loc: locOf(expr) };
+    } else {
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        `element access on checked-dynamic values with '${lowerer.fmt(receiverIr)}' elements`,
+      );
+    }
+  }
+  // Array reads can themselves supply an index. A missing numeric value
+  // is undefined, whose property lookup misses just like NaN; keep that
+  // value instead of rejecting a checker-number index with optional IR.
+  const index = lowerOptionalNumber(
+    lowerer,
+    lowerer.lowerExpr(expr.argumentExpression),
+    locOf(expr.argumentExpression),
+    expr.argumentExpression,
+  );
+  if (
+    arr.type.kind === "array" &&
+    (index.type.kind === "dyn" ||
+      (isJsSourceFile(expr.getSourceFile()) &&
+        index.type.kind !== "f64" &&
+        lowerer.dynConvertible(index.type)))
+  ) {
+    return {
+      kind: "dynKeyGet",
+      value: lowerer.coerceToExpected(arr, DYN),
+      key: index,
+      type: DYN,
+      loc: locOf(expr),
+    };
+  }
+  if (index.type.kind !== "f64") {
+    lowerer.unsupported("SC1090", expr.argumentExpression, "indexing with non-number keys");
+  }
+  // The LOWERED receiver's element type wins over the checker's when
+  // both are arrays: a spoke result can be more precise than the
+  // declared surface (emitter.listeners() answers the event's tuple
+  // signature where the .d.ts says Function[], which would flatten the
+  // element to a zero-parameter closure).
+  const elemT = arr.type.kind === "array" ? arr.type.elem : receiverIr.elem;
+  // Every ordinary array read is a JavaScript property read: an invalid
+  // index answers undefined, even when the checker was built without
+  // noUncheckedIndexedAccess. Keep the explicit optional union in the IR
+  // so it can flow through templates, locals, calls, returns, operators,
+  // and narrowing. The helper performs one length/proof check and then
+  // uses the dense getter for the proven-present path, so this does not
+  // change the storage representation or the low-level getter itself.
+  if (arr.type.kind === "array") {
+    // A non-null assertion is the explicit proven-present form. Preserve
+    // the dense getter's established bounds trap where the asserted value
+    // must be the element type (library ABI checks and the catchable
+    // RangeError contract for an out-of-bounds assert). Where undefined is
+    // representable, the assertion keeps JavaScript's unchecked read.
+    const provenPresent =
+      ts.isNonNullExpression(expr.parent) &&
+      expr.parent.expression === expr &&
+      !assertedElementKeepsUndefined(lowerer, expr.parent);
+    if (provenPresent) {
+      return lowerer.maybeNarrow(
+        { kind: "arrayGet", arr, index, type: elemT, loc: locOf(expr) },
+        expr,
+      );
+    }
+    const safe = lowerSafeIndexRead(lowerer, arr, index, locOf(expr));
+    if (safe) return safe;
+  }
+  // --npm-static package files retain the original slice-specific route
+  // for compatibility with package-source inference.
+  if (
+    arr.type.kind === "array" &&
+    arr.kind === "arrIntrinsic" &&
+    arr.method === "slice" &&
+    npmStaticPackageOfPath(expr.getSourceFile().fileName) !== null
+  ) {
+    const safe = lowerSafeIndexRead(lowerer, arr, index, locOf(expr));
+    if (safe) return safe;
+  }
+  // A union-element read narrows like an identifier when the checker has
+  // narrowed THIS occurrence (`if (a[0] !== undefined) use(a[0])` — tsc
+  // narrows literal-index element accesses).
+  return lowerer.maybeNarrow({ kind: "arrayGet", arr, index, type: elemT, loc: locOf(expr) }, expr);
+}
+
+/** A record receiver that an outer keyed read left optional
+ * (`nested[a][b]`, where `nested[a]` can miss). The receiver evaluates
+ * once into `stmts`; `present` is its record arm, valid only once the
+ * access has tested `stable` against the undefined (or, for reads, null)
+ * arm. */
+interface OptionalRecordReceiver {
+  stmts: IrStmt[];
+  stable: IrExpr;
+  present: IrExpr;
+  unionId: string;
+  undefTag: number;
+  nullish: "undefined" | "null";
+}
+
+function optionalRecordReceiver(
+  lowerer: Lowerer,
+  value: IrExpr,
+  loc: SrcLoc,
+  allowNull = false,
+): OptionalRecordReceiver | null {
+  if (value.type.kind !== "union") return null;
+  const unionId = value.type.unionId;
+  const arms = lowerer.unions.get(unionId)?.arms;
+  if (arms?.length !== 2) return null;
+  let undefTag = lowerer.armTag(unionId, UNDEFINED_T);
+  let nullish: OptionalRecordReceiver["nullish"] = "undefined";
+  // A null-initialized slot assigned a record later (iconv-lite's
+  // `encodings = null` table, filled on first use): the checker narrows
+  // the read to the record, the storage keeps the null arm.
+  if (undefTag < 0 && allowNull) {
+    undefTag = lowerer.armTag(unionId, NULL_T);
+    nullish = "null";
+  }
+  if (undefTag < 0) return null;
+  const record = arms[1 - undefTag]!;
+  if (record.kind !== "record") return null;
+  const stmts: IrStmt[] = [];
+  const stable = stabilized(lowerer, value, "%recordReceiver", stmts);
+  const present: IrExpr = {
+    kind: "unionNarrow",
+    unionId,
+    tag: lowerer.armTag(unionId, record),
+    value: stable,
+    type: record,
+    loc,
+  };
+  return { stmts, stable, present, unionId, undefTag, nullish };
+}
+
+/** `value`, evaluated once at this point of `out`. */
+function stabilized(lowerer: Lowerer, value: IrExpr, name: string, out: IrStmt[]): IrExpr {
+  if (isSafeToRepeat(value)) return value;
+  const tmp = lowerer.declareHiddenLocal(name, value.type);
+  out.push({ kind: "varDecl", localId: tmp.id, init: value, loc: value.loc });
+  return varRef(tmp.id, value.type, value.loc);
+}
+
+function undefinedReceiver(receiver: OptionalRecordReceiver, loc: SrcLoc): IrExpr {
+  return {
+    kind: "unionIsTag",
+    unionId: receiver.unionId,
+    tag: receiver.undefTag,
+    negated: false,
+    value: receiver.stable,
+    type: BOOL,
+    loc,
+  };
+}
+
+/** Node's TypeError for a keyed read or write on an undefined (or null)
+ * receiver. */
+function undefinedReceiverThrow(
+  key: IrExpr,
+  action: "read" | "set",
+  type: IrType,
+  loc: SrcLoc,
+  nullish: OptionalRecordReceiver["nullish"] = "undefined",
+): IrExpr {
+  const head = `Cannot ${action} properties of ${nullish} (${action === "read" ? "reading" : "setting"} '`;
+  const message: IrExpr = {
+    kind: "strConcat",
+    left: {
+      kind: "strConcat",
+      left: { kind: "strLit", value: head, type: STRING, loc },
+      right: key,
+      type: STRING,
+      loc,
+    },
+    right: { kind: "strLit", value: "')", type: STRING, loc },
+    type: STRING,
+    loc,
+  };
+  return {
+    kind: "libCall",
+    fn: "error.nodeThrow",
+    args: [numLit(1, loc), { kind: "strLit", value: "", type: STRING, loc }, message],
+    type,
+    loc,
+  };
+}
+
+/** The receiver and key of a keyed access whose receiver can be undefined,
+ * evaluated in order into `stmts`, with the receiver's record arm and the
+ * key's property-name string. Null when the receiver is not optional. */
+function guardedRecordAccess(
+  lowerer: Lowerer,
+  access: ts.ElementAccessExpression,
+  rawObj: IrExpr,
+  allowNull = false,
+): { receiver: OptionalRecordReceiver; key: IrExpr; name: IrExpr } | null {
+  const receiver = optionalRecordReceiver(lowerer, rawObj, locOf(access.expression), allowNull);
+  if (!receiver) return null;
+  const keyNode = access.argumentExpression;
+  const litKey = recordKeyLiteralText(keyNode) ?? recordKeyTypeLiteralText(lowerer, keyNode);
+  const key =
+    litKey !== null
+      ? ({ kind: "strLit", value: litKey, type: STRING, loc: locOf(keyNode) } satisfies IrExpr)
+      : stabilized(lowerer, lowerer.lowerExpr(keyNode), "%recordKey", receiver.stmts);
+  // A symbol key names no string property; its message spelling is not
+  // modeled.
+  const name =
+    key.type.kind === "symbol"
+      ? ({ kind: "strLit", value: "Symbol()", type: STRING, loc: locOf(keyNode) } satisfies IrExpr)
+      : lowerRecordPropertyKey(lowerer, key, keyNode);
+  return { receiver, key, name };
+}
+
+/** `nested[a][b] = v` where `nested[a]` can miss: the receiver, the key and
+ * the value evaluate in order, then an undefined receiver throws Node's
+ * TypeError and a present one takes the write. Only member and identifier
+ * receivers are probed, since a probe that finds no optional receiver
+ * lowers the receiver again. */
+function lowerGuardedRecordWrite(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+  target: ts.ElementAccessExpression,
+): IrStmt | null {
+  let receiverNode: ts.Expression = target.expression;
+  while (ts.isParenthesizedExpression(receiverNode)) receiverNode = receiverNode.expression;
+  if (
+    lowerer.chainRecvByNode.has(target.expression) ||
+    !(
+      ts.isElementAccessExpression(receiverNode) ||
+      ts.isPropertyAccessExpression(receiverNode) ||
+      ts.isIdentifier(receiverNode)
+    )
+  )
+    return null;
+  const guarded = guardedRecordAccess(lowerer, target, lowerer.lowerExpr(target.expression));
+  if (!guarded) return null;
+  const { receiver, key, name } = guarded;
+  const loc = locOf(expr);
+  const value = stabilized(lowerer, lowerer.lowerExpr(expr.right), "%recordValue", receiver.stmts);
+  const write = lowerer.withExpressionOverride(target.expression, receiver.present, () =>
+    lowerer.withExpressionOverride(target.argumentExpression, key, () =>
+      lowerer.withExpressionOverride(expr.right, value, () => lowerElementWrite(lowerer, expr)),
+    ),
+  );
+  return {
+    kind: "block",
+    body: [
+      ...receiver.stmts,
+      {
+        kind: "if",
+        cond: undefinedReceiver(receiver, loc),
+        then: [{ kind: "exprStmt", expr: undefinedReceiverThrow(name, "set", VOID, loc), loc }],
+        else_: [write],
+        loc,
+      },
+    ],
+    loc,
+  };
+}
+
+/** `b[i] = v` where the checker's flow type of `b` is a typed array but
+ * its storage is wider. A hoisted JavaScript `var` (or a field written
+ * after construction) holds `bytes | undefined`: the receiver, index and
+ * value evaluate in order, then an undefined receiver throws Node's
+ * TypeError and a present one takes the typed store. Any other storage (a
+ * `var` later reassigned a string, a checked-dynamic value) takes the
+ * checked-dynamic store, which applies whatever value the receiver holds. */
+function lowerWiderBytesWrite(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+  target: ts.ElementAccessExpression,
+  recv: IrExpr,
+): IrStmt {
+  const loc = locOf(expr);
+  if (recv.type.kind === "union") {
+    const unionId = recv.type.unionId;
+    const arms = lowerer.unions.get(unionId)?.arms;
+    const undefTag = lowerer.armTag(unionId, UNDEFINED_T);
+    const bytes = arms?.length === 2 && undefTag >= 0 ? arms[1 - undefTag]! : null;
+    const keyType = lowerer.mapTypeOf(lowerer.typeOf(target.argumentExpression));
+    const index =
+      bytes?.kind === "bytes" && keyType?.kind === "f64"
+        ? lowerer.lowerExpr(target.argumentExpression)
+        : null;
+    // An index stored wider than a number (a hoisted `var` counter) keeps
+    // the checked-dynamic store below, which converts the key exactly.
+    if (bytes?.kind === "bytes" && index?.type.kind === "f64") {
+      const stmts: IrStmt[] = [];
+      const stable = stabilized(lowerer, recv, "%bytesReceiver", stmts);
+      const key = stabilized(lowerer, index, "%bytesIndex", stmts);
+      const value = stabilized(
+        lowerer,
+        lowerer.lowerExprExpecting(expr.right, F64),
+        "%bytesValue",
+        stmts,
+      );
+      const name = lowerRecordPropertyKey(lowerer, key, target.argumentExpression);
+      const present: IrExpr = {
+        kind: "unionNarrow",
+        unionId,
+        tag: 1 - undefTag,
+        value: stable,
+        type: bytes,
+        loc,
+      };
+      return {
+        kind: "block",
+        body: [
+          ...stmts,
+          {
+            kind: "if",
+            cond: {
+              kind: "unionIsTag",
+              unionId,
+              tag: undefTag,
+              negated: false,
+              value: stable,
+              type: BOOL,
+              loc,
+            },
+            then: [{ kind: "exprStmt", expr: undefinedReceiverThrow(name, "set", VOID, loc), loc }],
+            else_: [{ kind: "bytesSet", arr: present, index: key, value, loc }],
+            loc,
+          },
+        ],
+        loc,
+      };
+    }
+  }
+  if (!lowerer.dynConvertible(recv.type)) {
+    lowerer.unsupported(
+      "SC1090",
+      target.expression,
+      `typed-array element writes through '${lowerer.fmt(recv.type)}' storage`,
+    );
+  }
+  return {
+    kind: "exprStmt",
+    expr: lowerDynMemberAssignment(lowerer, expr, lowerer.coerceInto(target.expression, recv, DYN)),
+    loc,
+  };
+}
+
+/** `r[k]` over a (non-tuple) record shape. A LITERAL key naming a declared
+ * field is the bracket spelling of field access (the ONLY spelling tsc
+ * permits for signature-declared fields under
+ * noPropertyAccessFromIndexSignature) — an ordinary recordGet. Everything
+ * else is a runtime-keyed read (recordKeyGet): declared fields answer
+ * first via an emitted string-switch, index-signature shapes fall through
+ * to the overflow map. The result type is the index signature's value type
+ * armed with undefined (dyn for `unknown`): a missing key reads undefined,
+ * as in JavaScript, whatever noUncheckedIndexedAccess says. Every declared
+ * field must be able to SURFACE as that type (equal, an arm of it, or —
+ * for dyn results — JSON-safe for the dyn conversion); shapes mixing in
+ * fields outside that stay fenced. Declared-only shapes support reads
+ * whose key type proves membership (tsc's keyof check): all fields must
+ * share the result type, and a smuggled miss traps. */
+export function lowerRecordKeyRead(
+  lowerer: Lowerer,
+  expr: ts.ElementAccessExpression,
+  shapeId: string,
+  shape: IrRecordShape,
+  includeUndefined = false,
+): IrExpr {
+  const loc = locOf(expr);
+  const keyNode = expr.argumentExpression;
+  // Literal declared keys are plain field reads (narrowing included).
+  // NUMERIC literals are their canonical string spelling — JS object keys
+  // ARE strings (`r[1]` reads `r["1"]`), so `b[1]` hits a declared field
+  // named "1" (a mapped type over a numeric enum) exactly like `b["1"]`.
+  // A key IDENTIFIER whose type proves one literal (a literal-typed
+  // const, a keyof-constrained type parameter bound to a literal inside
+  // a generic instance) is the same static read — identifier evaluation
+  // is pure, so skipping it matches JS exactly.
+  const litKey = recordKeyLiteralText(keyNode) ?? recordKeyTypeLiteralText(lowerer, keyNode);
+  // An outer keyed read can leave the receiver undefined: evaluate the
+  // receiver and the key, then throw Node's TypeError or read the present
+  // record.
+  // The receiver lowers FIRST (both branches below read it, and JS
+  // evaluates the receiver before the key).
+  const obj = lowerer.lowerExpr(expr.expression);
+  {
+    // A null arm is guarded only for string and number keys: other keys
+    // already take the checked-dynamic read, which handles null itself.
+    // Only a receiver with a null arm asks about the key.
+    let allowNull = false;
+    if (obj.type.kind === "union" && lowerer.armTag(obj.type.unionId, NULL_T) >= 0) {
+      const keyType = litKey !== null ? STRING : lowerer.mapTypeOf(lowerer.typeOf(keyNode));
+      allowNull = keyType?.kind === "string" || keyType?.kind === "f64";
+    }
+    const guarded = guardedRecordAccess(lowerer, expr, obj, allowNull);
+    if (guarded) {
+      const { receiver, key, name } = guarded;
+      const read = lowerer.withExpressionOverride(expr.expression, receiver.present, () =>
+        litKey !== null
+          ? lowerRecordKeyRead(lowerer, expr, shapeId, shape, includeUndefined)
+          : lowerer.withExpressionOverride(keyNode, key, () =>
+              lowerRecordKeyRead(lowerer, expr, shapeId, shape, includeUndefined),
+            ),
+      );
+      return {
+        kind: "seqExpr",
+        stmts: receiver.stmts,
+        result: {
+          kind: "ternary",
+          cond: undefinedReceiver(receiver, loc),
+          then: undefinedReceiverThrow(name, "read", read.type, loc, receiver.nullish),
+          else_: read,
+          type: read.type,
+          loc,
+        },
+        type: read.type,
+        loc,
+      };
+    }
+  }
+  // A record-mapped CHECKER type over a VALUE living in the checked-dynamic tree (a JS
+  // file-scope object-literal global): the checked-dynamic keyed read —
+  // dynKeyGet against the runtime keys (a missing key answers the checked-dynamic tree
+  // undefined, exactly JS); consumers validate (dynCheck) where a
+  // static type is required, the member-read discipline.
+  if (obj.type.kind === "dyn") {
+    let dk =
+      litKey !== null
+        ? ({ kind: "strLit", value: litKey, type: STRING, loc: locOf(keyNode) } satisfies IrExpr)
+        : lowerer.lowerExpr(keyNode);
+    // Number AND checked-dynamic keys ride the JS-exact formatter —
+    // property keys ARE strings (o[k] is o[String(k)] in JS), and a dyn
+    // key (agent.sockets[agent.getName(...)]) stringifies the same way.
+    if (dk.type.kind === "union" && lowerer.dynConvertible(dk.type))
+      dk = lowerer.coerceToExpected(dk, DYN);
+    if (dk.type.kind !== "symbol" && dk.type.kind !== "dyn")
+      dk = lowerRecordPropertyKey(lowerer, dk, keyNode);
+    if (dk.type.kind !== "string" && dk.type.kind !== "symbol" && dk.type.kind !== "dyn") {
+      lowerer.unsupported("SC1090", keyNode, "indexing records with non-string or non-number keys");
+    }
+    const read: IrExpr = { kind: "dynKeyGet", key: dk, value: obj, type: DYN, loc };
+    // Absence probes must keep the checked-dynamic undefined produced by
+    // a missing key. The ordinary read narrows to the checker's declared
+    // index value (and therefore validates it); ===/!==, ||, and ?? need
+    // to observe the missing value instead of throwing during that check.
+    return includeUndefined ? read : lowerer.maybeNarrow(read, expr);
+  }
+  if (litKey !== null) {
+    const nominal = representedClassFieldTarget(lowerer, expr.expression, litKey, obj);
+    if (nominal) {
+      const read = lowerer.fieldGetExpr(nominal, loc, expr);
+      return includeUndefined ? read : lowerer.maybeNarrow(read, expr);
+    }
+  }
+  if (hasClassPayload(lowerer, obj.type)) {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      "computed property reads through structural views of class instances (use a declared literal key)",
+    );
+  }
+  // Predicates can strengthen optional fields without changing the
+  // receiver's stored layout. Use that layout for bracket reads just as
+  // fieldTarget does for the corresponding dot reads.
+  if (obj.type.kind === "record") {
+    const actualShape = lowerer.shapes.get(obj.type.shapeId);
+    if (!actualShape)
+      throw new InternalCompilerError("record receiver is missing its stored shape");
+    shapeId = obj.type.shapeId;
+    shape = actualShape;
+  }
+  if (litKey !== null) {
+    const field = shape.fields.find((f) => f.name === litKey);
+    if (field) {
+      const get: IrExpr = {
+        kind: "recordGet",
+        obj,
+        shapeId,
+        field: field.name,
+        type: field.type,
+        loc,
+      };
+      return lowerer.maybeNarrow(get, expr);
+    }
+  }
+  let key =
+    litKey !== null
+      ? ({ kind: "strLit", value: litKey, type: STRING, loc: locOf(keyNode) } satisfies IrExpr)
+      : lowerer.lowerExpr(keyNode);
+  // Optional string/number keys need ToPropertyKey, not a boxed copy of
+  // the receiver. Keep record reads on their native storage so nested
+  // references retain identity across index-signature reads.
+  if (
+    key.type.kind === "union" &&
+    !lowerer.unions
+      .get(key.type.unionId)
+      ?.arms.some((arm) => arm.kind === "symbol" || arm.kind === "dyn")
+  ) {
+    key = lowerRecordPropertyKey(lowerer, key, keyNode);
+  }
+  if (
+    (key.type.kind === "symbol" || key.type.kind === "dyn" || key.type.kind === "union") &&
+    lowerer.dynConvertible(key.type) &&
+    lowerer.dynConvertible(obj.type)
+  ) {
+    const read: IrExpr = {
+      kind: "dynKeyGet",
+      value: lowerer.coerceToExpected(obj, DYN),
+      key: lowerer.coerceToExpected(key, DYN),
+      type: DYN,
+      loc,
+    };
+    return includeUndefined ? read : lowerer.maybeNarrow(read, expr);
+  }
+  // Runtime NUMBER keys ride the JS-exact formatter (o[n] is o[String(n)]
+  // in JS — the number-keyed-signature access path).
+  key = lowerRecordPropertyKey(lowerer, key, keyNode);
+  if (key.type.kind !== "string") {
+    lowerer.unsupported("SC1090", keyNode, "indexing records with non-string or non-number keys");
+  }
+  if (shape.fields.length === 0 && shape.indexValue === undefined) {
+    const result = dynUndefinedExpr(loc);
+    return {
+      kind: "seqExpr",
+      stmts: [
+        { kind: "exprStmt", expr: obj, loc },
+        { kind: "exprStmt", expr: key, loc },
+      ],
+      result,
+      type: DYN,
+      loc,
+    };
+  }
+  // The result type of the access — the index signature's value type
+  // armed with undefined, or the declared fields' one common type on
+  // signature-free shapes (tsc's keyof check proved membership; a
+  // smuggled miss traps). On signature-free shapes the checker may have
+  // NARROWED this occurrence (assignment CFA on literal keys) — maybeNarrow
+  // bridges to the narrowed arm exactly like a field read.
+  let declared: IrType | null = null;
+  // An index-signature read is a JavaScript property read: a missing key
+  // answers undefined even without noUncheckedIndexedAccess. The read keeps
+  // that explicit optional union, as an ordinary array read does.
+  let optionalRead = false;
+  // A read whose every consumer treats undefined like NaN (see
+  // nan-coded-reads.ts) is a plain number that is NaN for a missing key.
+  const nanCoded =
+    !includeUndefined &&
+    shape.indexValue?.kind === "f64" &&
+    lowerer.nanCodedReads?.isNumericRead(expr) === true;
+  if (shape.indexValue) {
+    declared = shape.indexValue;
+    if (declared.kind !== "dyn" && !nanCoded) {
+      declared = lowerer.withUndefinedArmOf(declared);
+      if (!declared) lowerer.badType(expr, lowerer.typeOf(expr));
+      optionalRead = true;
+    }
+  } else if (
+    shape.fields.length > 0 &&
+    shape.fields.every((f) => typeEquals(f.type, shape.fields[0]!.type))
+  ) {
+    declared = shape.fields[0]!.type;
+  }
+  if (!declared && isJsSourceFile(expr.getSourceFile()) && recordKeyResultOk(lowerer, shape, DYN))
+    declared = DYN;
+  if (!declared) {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      `dynamic keyed reads of '${lowerer.fmt({ kind: "record", shapeId })}' (the declared fields have no one common type)`,
+    );
+  }
+  // A LITERAL key naming no declared field can only hit the overflow:
+  // the declared-field surfacing constraint doesn't apply.
+  const overflowOnly = litKey !== null && !!shape.indexValue;
+  if (!recordKeyResultOk(lowerer, overflowOnly ? { ...shape, fields: [] } : shape, declared)) {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      `dynamic keyed reads of '${lowerer.fmt({ kind: "record", shapeId })}' as '${lowerer.fmt(declared)}' (every declared field must be readable at that type)`,
+    );
+  }
+  const read: IrExpr = {
+    kind: "recordKeyGet",
+    obj,
+    shapeId,
+    key,
+    ...(overflowOnly ? { overflowOnly: true as const } : {}),
+    ...(nanCoded ? { missNaN: true as const } : {}),
+    type: declared,
+    loc,
+  };
+  if (nanCoded) return read;
+  return includeUndefined || optionalRead ? read : lowerer.maybeNarrow(read, expr);
+}
+
+/** ToPropertyKey for represented record keys. Missing array-derived string
+ * values remain real undefined values, whose JavaScript property spelling
+ * is the string "undefined". */
+function lowerRecordPropertyKey(lowerer: Lowerer, key: IrExpr, node: ts.Expression): IrExpr {
+  if (key.type.kind === "union" && lowerer.dynConvertible(key.type)) {
+    return {
+      kind: "libCall",
+      fn: "dyn.toStringCoerce",
+      args: [lowerer.coerceInto(node, key, DYN)],
+      type: STRING,
+      loc: key.loc,
+    };
+  }
+  if (
+    key.type.kind === "f64" ||
+    key.type.kind === "bool" ||
+    key.type.kind === "dyn" ||
+    lowerer.runtimeOptionalWidening(key.type, STRING) !== null
+  ) {
+    return lowerer.ensureString(key, node);
+  }
+  return key;
+}
+
+/** The compile-time string spelling of a record key literal: a string
+ * literal's text, or a NON-NEGATIVE numeric literal's canonical JS
+ * spelling (`1` → "1", `1e21` → "1e+21" — String(Number(text)), which is
+ * exactly the key JS derives; negative/computed keys stay runtime
+ * expressions and canonicalize through ensureString instead). Null for
+ * everything else. */
+function recordKeyLiteralText(node: ts.Expression): string | null {
+  if (ts.isStringLiteral(node)) return node.text;
+  if (ts.isNumericLiteral(node)) return String(Number(node.text));
+  return null;
+}
+
+/** The compile-time key an IDENTIFIER's TYPE proves: a key variable whose
+ * (narrowed) type is one string/number literal — `const k: "a" = …; o[k]`,
+ * and the generic-body form where k's type is a keyof-constrained
+ * parameter bound to a literal (`pick(o, "a")`'s instance reads `o[k]`
+ * with K = "a", resolved through typeParamTsBindings). Identifier reads
+ * are pure, so the static field read may skip evaluating the key exactly
+ * like a syntactic literal. Null anywhere the type keeps more than one
+ * key. */
+function recordKeyTypeLiteralText(lowerer: Lowerer, node: ts.Expression): string | null {
+  if (!ts.isIdentifier(node)) return null;
+  let t: ts.Type = lowerer.typeOf(node);
+  if (t.flags & ts.TypeFlags.TypeParameter) {
+    const bound = lowerer.typeParamTsResolver(t);
+    if (!bound) return null;
+    t = bound;
+  }
+  if (t.isStringLiteralType()) return t.value;
+  if (t.isNumberLiteralType()) {
+    const n = t.value;
+    return Number.isFinite(n) && n >= 0 ? String(n) : null;
+  }
+  return null;
+}
+
+/** The literal index of a tuple access, or null when the expression isn't
+ * a non-negative integer literal (parentheses tolerated — tsc's own
+ * literal-index typing accepts them). */
+function tupleLiteralIndex(node: ts.Expression): number | null {
+  let e: ts.Expression = node;
+  while (ts.isParenthesizedExpression(e)) e = e.expression;
+  if (!ts.isNumericLiteral(e)) return null;
+  const n = Number(e.text);
+  return Number.isInteger(n) && n >= 0 ? n : null;
+}
+
+export function lowerElementCompoundParts(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+  op: CompoundOp,
+  statement: boolean,
+): { expr: IrExpr | null; stmts: IrStmt[] | null } {
+  const target = expr.left as ts.ElementAccessExpression;
+  fenceNodeModuleMutation(lowerer, target, "assignment");
+  const loc = locOf(expr);
+  const checked = lowerer.lowerExpr(target.expression);
+  if (checked?.type.kind === "dyn" && isJsSourceFile(expr.getSourceFile())) {
+    const stmts: IrStmt[] = [];
+    const save = (value: IrExpr, name: string): IrExpr => {
+      const local = lowerer.declareHiddenLocal(name, value.type);
+      stmts.push({ kind: "varDecl", localId: local.id, init: value, loc });
+      return varRef(local.id, value.type, loc);
+    };
+    const receiver = save(checked, "%compoundReceiver");
+    const key = save(lowerer.lowerExprExpecting(target.argumentExpression, DYN), "%compoundKey");
+    const old = save({ kind: "dynKeyGet", value: receiver, key, type: DYN, loc }, "%compoundOld");
+    const rhs = lowerer.lowerExprExpecting(expr.right, DYN);
+    const numeric = ["-", "*", "/", "%", "**"].includes(op);
+    const value = save(
+      {
+        kind: "libCall",
+        fn: op === "+" ? "dyn.add" : numeric ? "dyn.arithmetic" : "dyn.bitwise",
+        args: op === "+" ? [old, rhs] : [old, rhs, strLit(op, loc)],
+        type: DYN,
+        loc,
+      },
+      "%compoundResult",
+    );
+    stmts.push({
+      kind: "exprStmt",
+      expr: {
+        kind: "libCall",
+        fn: "dyn.keySetComputed",
+        args: [receiver, key, value],
+        type: VOID,
+        loc,
+      },
+      loc,
+    });
+    return { expr: { kind: "seqExpr", stmts, result: value, type: DYN, loc }, stmts: null };
+  }
+  const receiverType =
+    checked.type.kind === "array" || checked.type.kind === "bytes"
+      ? checked.type
+      : lowerer.mapTypeOf(lowerer.typeOf(target.expression));
+  if (receiverType?.kind !== "array" && receiverType?.kind !== "bytes") {
+    lowerer.unsupported("SC1090", target, "compound assignment to non-array elements");
+  }
+  let receiver = checked;
+  if (receiver.type.kind === "union" && lowerer.armTag(receiver.type.unionId, UNDEFINED_T) >= 0) {
+    const present = lowerer.stripUndefinedArm(receiver.type);
+    const helper =
+      present.kind === receiverType.kind
+        ? lowerer.narrowedArmHelper(receiver.type.unionId, present, locOf(target.expression))
+        : null;
+    if (helper)
+      receiver = lowerer.checkedNarrowCall(helper, receiver, present, locOf(target.expression));
+  }
+  if (receiver.type.kind !== receiverType.kind) {
+    lowerer.unsupported(
+      "SC1090",
+      target.expression,
+      "compound assignment through a non-native array or byte view",
+    );
+  }
+  const index = lowerer.lowerExpr(target.argumentExpression);
+  if (index.type.kind !== "f64")
+    lowerer.unsupported("SC1090", target.argumentExpression, "indexing with non-number keys");
+  const receiverLocal = lowerer.declareHiddenLocal("%compoundArray", receiver.type);
+  const indexLocal = lowerer.declareHiddenLocal("%compoundIndex", F64);
+  const receiverRef = (): IrExpr => varRef(receiverLocal.id, receiver.type, loc);
+  const indexRef = (): IrExpr => varRef(indexLocal.id, F64, loc);
+  const oldValue: IrExpr =
+    receiver.type.kind === "array"
+      ? receiver.type.elem.kind === "f64"
+        ? // Every numeric operator applies ToNumber to the old value, so a
+          // missing element is NaN without materializing `number | undefined`.
+          arrayNumberRead(receiverRef(), indexRef(), locOf(target))
+        : receiver.type.elem.kind === "string" && op === "+"
+          ? arrayStringOperand(receiverRef(), indexRef(), locOf(target))
+          : arrayValueRead(lowerer, receiverRef(), indexRef(), receiver.type.elem, locOf(target))
+      : {
+          // An invalid index reads undefined in Node, which every numeric
+          // compound operator turns into NaN; the write is then ignored.
+          kind: "bytesIntrinsic",
+          method: "get",
+          receiver: receiverRef(),
+          args: [indexRef()],
+          type: F64,
+          loc: locOf(target),
+          invalidNaN: true,
+        };
+  const oldLocal = lowerer.declareHiddenLocal("%compoundOld", oldValue.type);
+  const oldRef = (): IrExpr => varRef(oldLocal.id, oldValue.type, loc);
+  const rhs = lowerer.lowerExpr(expr.right);
+  const numericRhs =
+    rhs.type.kind === "dyn" &&
+    isJsSourceFile(expr.getSourceFile()) &&
+    receiver.type.kind === "bytes"
+      ? { kind: "libCall" as const, fn: "dyn.toNumberCoerce" as const, args: [rhs], type: F64, loc }
+      : lowerOptionalNumber(lowerer, rhs, loc);
+  const elementType = receiver.type.kind === "array" ? receiver.type.elem : F64;
+  const valueType =
+    elementType.kind === "union" && lowerer.armTag(elementType.unionId, UNDEFINED_T) >= 0
+      ? lowerer.stripUndefinedArm(elementType)
+      : elementType;
+  if (
+    statement &&
+    op === "+" &&
+    receiver.type.kind === "array" &&
+    receiver.type.elem.kind === "string"
+  ) {
+    // Receiver, index, old element (read inside the concat), rhs, write.
+    const appended: IrExpr = {
+      kind: "strConcat",
+      left: oldValue,
+      right: concatOperand(lowerer, rhs, expr.right),
+      type: STRING,
+      loc,
+    };
+    return {
+      expr: null,
+      stmts: [
+        { kind: "varDecl", localId: receiverLocal.id, init: receiver, loc },
+        { kind: "varDecl", localId: indexLocal.id, init: index, loc },
+        { kind: "arraySet", arr: receiverRef(), index: indexRef(), value: appended, loc },
+      ],
+    };
+  }
+  let computed: IrExpr;
+  if (op === "+" && valueType.kind === "string") {
+    computed = {
+      kind: "strConcat",
+      left: lowerer.ensureString(oldRef(), target),
+      right: concatOperand(lowerer, rhs, expr.right),
+      type: STRING,
+      loc,
+    };
+  } else if (valueType.kind === "f64" && numericRhs.type.kind === "f64") {
+    computed = {
+      kind: "bin",
+      op,
+      left: lowerOptionalNumber(lowerer, oldRef(), loc),
+      right: numericRhs,
+      type: F64,
+      loc,
+    };
+  } else if (valueType.kind === "dyn" && isJsSourceFile(expr.getSourceFile())) {
+    const left = lowerer.coerceToExpected(oldRef(), DYN),
+      right = lowerer.coerceToExpected(rhs, DYN);
+    computed = dynCompoundValue(op, left, right, loc);
+  } else if (
+    rhs.type.kind === "dyn" &&
+    receiver.type.kind === "array" &&
+    lowerer.dynConvertible(oldValue.type) &&
+    lowerer.dynConvertible(valueType)
+  ) {
+    // An untyped right operand: the expanded `a[i] = a[i] op rhs`, checked
+    // back into the element type.
+    computed = lowerer.coerceInto(
+      expr,
+      dynCompoundValue(
+        op,
+        lowerer.coerceToExpected(oldRef(), DYN),
+        lowerer.coerceToExpected(rhs, DYN),
+        loc,
+      ),
+      valueType,
+    );
+  } else {
+    compoundUnsupported(lowerer, expr, op, oldValue.type, rhs.type);
+  }
+  const resultLocal = lowerer.declareHiddenLocal("%compoundResult", computed.type);
+  const resultRef = (): IrExpr => varRef(resultLocal.id, computed.type, loc);
+  const write: IrStmt =
+    receiver.type.kind === "array"
+      ? arrayValueStore(lowerer, receiverRef(), indexRef(), resultRef(), receiver.type.elem, loc)
+      : { kind: "bytesSet", arr: receiverRef(), index: indexRef(), value: resultRef(), loc };
+  return {
+    expr: {
+      kind: "seqExpr",
+      stmts: [
+        { kind: "varDecl", localId: receiverLocal.id, init: receiver, loc },
+        { kind: "varDecl", localId: indexLocal.id, init: index, loc },
+        { kind: "varDecl", localId: oldLocal.id, init: oldValue, loc },
+        { kind: "varDecl", localId: resultLocal.id, init: computed, loc },
+        write,
+      ],
+      result: resultRef(),
+      type: computed.type,
+      loc,
+    },
+    stmts: null,
+  };
+}
+
+/** ToString of one stabilized `string[]` element read for `+=`: a missing
+ * element concatenates as "undefined". */
+function arrayStringOperand(arr: IrExpr, index: IrExpr, loc: SrcLoc): IrExpr {
+  return {
+    kind: "ternary",
+    cond: {
+      kind: "bin",
+      op: "===",
+      left: { kind: "arrayState", arr, index, type: F64, loc },
+      right: { kind: "numLit", value: 1, type: F64, loc },
+      type: BOOL,
+      loc,
+    },
+    then: { kind: "arrayGet", arr, index, type: STRING, loc },
+    else_: strLit("undefined", loc),
+    type: STRING,
+    loc,
+  };
+}
+
+export function lowerElementWrite(lowerer: Lowerer, expr: ts.BinaryExpression): IrStmt {
+  const prototype = lowerClassPrototypeComputedAssignment(lowerer, expr);
+  if (prototype) return { kind: "exprStmt", expr: prototype, loc: locOf(expr) };
+  const target = expr.left as ts.ElementAccessExpression;
+  fenceNodeModuleMutation(lowerer, target, "assignment");
+  const globalKey = globalSymbolKey(lowerer, target.expression, target.argumentExpression);
+  if (globalKey) {
+    const value = lowerer.lowerExprExpecting(expr.right, DYN);
+    const loc = locOf(expr);
+    return {
+      kind: "exprStmt",
+      expr: {
+        kind: "libCall",
+        fn: "dyn.globalSymbolSet",
+        args: [globalKey, value],
+        type: VOID,
+        loc,
+      },
+      loc,
+    };
+  }
+  // `process.env[key] = v` — the computed twin of the dotted env write:
+  // setenv(3), string keys and string values only.
+  if (lowerer.isProcessEnv(target.expression) && !target.questionDotToken) {
+    const loc = locOf(expr);
+    const key = lowerEnvironmentKey(lowerer, target.argumentExpression);
+    if (key.type.kind !== "string") {
+      lowerer.unsupported(
+        "SC1090",
+        target.argumentExpression,
+        "indexing process.env with non-string keys",
+      );
+    }
+    const value = lowerer.lowerExpr(expr.right);
+    if (value.type.kind !== "string") {
+      lowerer.unsupported(
+        "SC1090",
+        expr.right,
+        `assigning '${lowerer.fmt(value.type)}' values to process.env (env values are strings — convert first: \`\${v}\`)`,
+      );
+    }
+    return {
+      kind: "exprStmt",
+      expr: { kind: "libCall", fn: "process.envSet", args: [key, value], type: VOID, loc },
+      loc,
+    };
+  }
+  // Symbol-keyed property WRITES (`this[kLimit] = v`): the read path's
+  // twin — a statically-resolvable unique-symbol key declared on the
+  // receiver's class writes the hidden field slot; everything else keeps
+  // the fence (static shapes have no symbol-keyed storage).
+  if (lowerer.mapTypeOf(lowerer.typeOf(target.argumentExpression))?.kind === "symbol") {
+    const fieldT = symbolFieldTarget(lowerer, target);
+    if (fieldT) {
+      const value = lowerer.lowerExprExpecting(expr.right, fieldT.fieldType);
+      return lowerer.fieldSetStmt(fieldT, value, locOf(expr), target);
+    }
+    const receiver = lowerer.lowerExpr(target.expression);
+    if (receiver.type.kind === "dyn")
+      return {
+        kind: "exprStmt",
+        expr: lowerDynMemberAssignment(lowerer, expr, receiver),
+        loc: locOf(expr),
+      };
+    if (
+      isJsSourceFile(expr.getSourceFile()) &&
+      receiver.type.kind === "object" &&
+      lowerer.dynConvertible(receiver.type)
+    ) {
+      return {
+        kind: "exprStmt",
+        expr: lowerDynMemberAssignment(lowerer, expr, lowerer.coerceToExpected(receiver, DYN)),
+        loc: locOf(expr),
+      };
+    }
+    lowerer.unsupported(
+      "SC1090",
+      target,
+      "symbol-keyed property writes outside class fields keyed by a stable module-level literal Symbol()/Symbol.for() (other static shapes have no symbol-keyed storage)",
+    );
+  }
+  const checkedReceiver = tryLowerExpression(lowerer, target.expression);
+  if (checkedReceiver?.type.kind === "dyn") {
+    return {
+      kind: "exprStmt",
+      expr: lowerDynMemberAssignment(lowerer, expr, checkedReceiver),
+      loc: locOf(expr),
+    };
+  }
+  if (checkedReceiver?.type.kind === "object" && isJsSourceFile(expr.getSourceFile())) {
+    const info = lowerer.classes.get(checkedReceiver.type.className);
+    const key =
+      recordKeyLiteralText(target.argumentExpression) ??
+      recordKeyTypeLiteralText(lowerer, target.argumentExpression);
+    if (info && key !== null && isClassCallback(lowerer, info, key)) {
+      const receiver = lowerer.coerceInto(target.expression, checkedReceiver, DYN);
+      return {
+        kind: "exprStmt",
+        expr: lowerDynMemberAssignment(lowerer, expr, receiver),
+        loc: locOf(expr),
+      };
+    }
+  }
+  let receiverIr = lowerer.mapTypeOf(lowerer.typeOf(target.expression));
+  if (isJsSourceFile(expr.getSourceFile()) && checkedReceiver) {
+    const represented =
+      checkedReceiver.type.kind === "union"
+        ? lowerer.stripUndefinedArm(checkedReceiver.type)
+        : checkedReceiver.type;
+    if (represented.kind === "array" || represented.kind === "bytes") receiverIr = represented;
+  }
+  if (receiverIr === null || receiverIr.kind === "dyn") {
+    const receiver = tryLowerExpression(lowerer, target.expression);
+    if (receiver?.type.kind === "array") receiverIr = receiver.type;
+  }
+
+  // A checked-dynamic receiver TYPE (`unknown[]` and the collapsed
+  // `(string | object)[]` map to DYN wholesale now): the dyn keyed
+  // write — dyn.keySet. Number keys canonicalize through the JS-exact
+  // formatter; ARR receivers take canonical index keys as element
+  // set/extend (undefined-hole padding, JS's length growth exactly),
+  // OBJ receivers set the member, and the runtime throws Node's
+  // TypeErrors on every other kind. Values convert into the checked-dynamic tree;
+  // unconvertible ones fence per site (the dynFrom stance).
+  if (receiverIr?.kind === "dyn") {
+    const obj = lowerer.lowerExpr(target.expression);
+    if (obj.type.kind === "dyn") {
+      const loc = locOf(expr);
+      const key = lowerRecordPropertyKey(
+        lowerer,
+        lowerer.lowerExpr(target.argumentExpression),
+        target.argumentExpression,
+      );
+      if (key.type.kind !== "string") {
+        lowerer.unsupported(
+          "SC1090",
+          target.argumentExpression,
+          "indexing with non-string or non-number keys",
+        );
+      }
+      const value = lowerer.coerceToExpected(lowerer.lowerExpr(expr.right), DYN);
+      if (value.type.kind !== "dyn") {
+        lowerer.unsupported(
+          "SC1101",
+          expr.right,
+          `storing '${lowerer.fmt(value.type)}' values in a checked-dynamic array (the value cannot convert into the checked-dynamic tree)`,
+        );
+      }
+      return {
+        kind: "exprStmt",
+        expr: { kind: "libCall", fn: "dyn.keySet", args: [obj, key, value], type: VOID, loc },
+        loc,
+      };
+    }
+  }
+  if (receiverIr?.kind === "object" || receiverIr?.kind === "record") {
+    const key =
+      recordKeyLiteralText(target.argumentExpression) ??
+      recordKeyTypeLiteralText(lowerer, target.argumentExpression);
+    if (key !== null) {
+      const receiver = lowerer.lowerExpr(target.expression);
+      const field = representedClassFieldTarget(lowerer, target.expression, key, receiver);
+      if (field) {
+        const value = lowerer.lowerExprExpecting(expr.right, field.fieldType);
+        return lowerer.fieldSetStmt(field, value, locOf(expr), target);
+      }
+      if (hasClassPayload(lowerer, receiver.type)) {
+        if (receiver.type.kind === "object" && receiver.type.className === "%Error") {
+          return {
+            kind: "exprStmt",
+            expr: lowerDynMemberAssignment(
+              lowerer,
+              expr,
+              lowerer.coerceInto(target.expression, receiver, DYN),
+            ),
+            loc: locOf(expr),
+          };
+        }
+        lowerer.unsupported(
+          "SC1090",
+          target,
+          "writing undeclared properties through structural views of class instances",
+        );
+      }
+    }
+  }
+  // Typed-array element write `b[i] = v` — bytesSet: the value is an f64
+  // the runtime coerces JS-exactly; invalid indices are ignored.
+  if (receiverIr?.kind === "bytes") {
+    const recv = lowerer.lowerExpr(target.expression);
+    // The checker's flow type is a typed array, but the storage is wider.
+    if (recv.type.kind !== "bytes") return lowerWiderBytesWrite(lowerer, expr, target, recv);
+    const index = lowerer.lowerExpr(target.argumentExpression);
+    if (index.type.kind === "dyn" && recv.type.kind === "bytes") {
+      return {
+        kind: "exprStmt",
+        expr: lowerDynMemberAssignment(
+          lowerer,
+          expr,
+          lowerer.coerceInto(target.expression, recv, DYN),
+        ),
+        loc: locOf(expr),
+      };
+    }
+    if (index.type.kind !== "f64") {
+      lowerer.unsupported("SC1090", target.argumentExpression, "indexing with non-number keys");
+    }
+    const value = lowerer.lowerExprExpecting(expr.right, F64);
+    return { kind: "bytesSet", arr: recv, index, value, loc: locOf(expr) };
+  }
+  // Tuple element write `t[0] = v`: a positional-field write (recordSet)
+  // — literal indices only, like the read.
+  if (receiverIr?.kind === "record") {
+    const shape = lowerer.shapes.get(receiverIr.shapeId);
+
+    if (shape) {
+      const obj = lowerer.lowerExpr(target.expression);
+      if (hasClassPayload(lowerer, obj.type)) {
+        lowerer.unsupported(
+          "SC1090",
+          target,
+          "computed property writes through structural views of class instances (use a declared literal key)",
+        );
+      }
+
+      // A record-mapped CHECKER type over a VALUE living in the checked-dynamic tree (a
+      // JS file-scope object-literal global): the checked-dynamic keyed
+      // write — dyn.keySet (later writes win, insertion order; Node's
+      // TypeErrors on non-object receivers), the value converting into
+      // the checked-dynamic tree. Literal and runtime keys alike: the checked-dynamic tree's key set is
+      // open, so no declared-field collision analysis applies.
+      if (obj.type.kind === "dyn") {
+        const loc = locOf(expr);
+        const litKey = recordKeyLiteralText(target.argumentExpression);
+        let key: IrExpr =
+          litKey !== null
+            ? { kind: "strLit", value: litKey, type: STRING, loc: locOf(target.argumentExpression) }
+            : lowerer.lowerExpr(target.argumentExpression);
+        key = lowerRecordPropertyKey(lowerer, key, target.argumentExpression);
+        if (key.type.kind !== "string") {
+          lowerer.unsupported(
+            "SC1090",
+            target.argumentExpression,
+            "indexing records with non-string or non-number keys",
+          );
+        }
+        const value = lowerer.coerceToExpected(lowerer.lowerExpr(expr.right), DYN);
+        if (value.type.kind !== "dyn") {
+          lowerer.unsupported(
+            "SC1101",
+            expr.right,
+            `storing '${lowerer.fmt(value.type)}' values in a checked-dynamic object (the value cannot convert into the checked-dynamic tree)`,
+          );
+        }
+        return {
+          kind: "exprStmt",
+          expr: { kind: "libCall", fn: "dyn.keySet", args: [obj, key, value], type: VOID, loc },
+          loc,
+        };
+      }
+    }
+    if (shape?.tuple) {
+      const idx = tupleLiteralIndex(target.argumentExpression);
+      if (idx === null) {
+        lowerer.unsupported(
+          "SC1090",
+          target.argumentExpression,
+          "tuple indexing with a non-literal index (tuples are fixed-shape — use t[0], t[1], ...)",
+        );
+      }
+      const fieldType = shape.fields.find((f) => f.name === String(idx))?.type;
+      if (fieldType === undefined) lowerer.badType(target, lowerer.typeOf(target));
+      const obj = lowerer.lowerExpr(target.expression);
+      const value = lowerer.lowerExprExpecting(expr.right, fieldType);
+      return {
+        kind: "recordSet",
+        obj,
+        shapeId: receiverIr.shapeId,
+        field: String(idx),
+        value,
+        loc: locOf(expr),
+      };
+    }
+    // Dynamic keyed write `r[k] = v` — index-signature shapes only (a
+    // declared-only shape's writable key set is closed; spell the field).
+    // A LITERAL declared key is the bracket spelling of a field write.
+    // Values flow into the index-value slot (dyn slots convert, typed
+    // slots coerce); declared-key collisions at runtime validate against
+    // the field's type through the emitted helper (a mismatch throws the
+    // catchable TypeError — SEMANTICS.md).
+    if (shape && !shape.tuple) {
+      const guarded = lowerGuardedRecordWrite(lowerer, expr, target);
+      if (guarded) return guarded;
+      // Literal keys — string literals AND numeric literals in their
+      // canonical string spelling (`b[1] = v` writes field/key "1", JS's
+      // own key derivation) — name declared fields directly. A key
+      // IDENTIFIER whose TYPE proves one literal (a literal-typed const,
+      // a keyof-constrained type parameter bound to a literal inside a
+      // generic instance — `set(o, "a", v)`'s body writing `o[k] = v`)
+      // is the same static field write.
+      const litKey =
+        recordKeyLiteralText(target.argumentExpression) ??
+        recordKeyTypeLiteralText(lowerer, target.argumentExpression);
+      if (litKey !== null) {
+        const field = shape.fields.find((f) => f.name === litKey);
+        if (field) {
+          const obj = lowerer.lowerExpr(target.expression);
+          const value = lowerer.lowerExprExpecting(expr.right, field.type);
+          return {
+            kind: "recordSet",
+            obj,
+            shapeId: receiverIr.shapeId,
+            field: litKey,
+            value,
+            loc: locOf(expr),
+          };
+        }
+      }
+      if (!shape.indexValue) {
+        // A SIGNATURE-FREE shape whose declared fields share ONE type
+        // writes through the same per-shape dispatch (the mockable-clock
+        // module shape: `mocked[functionality] = implementation` over a
+        // table of same-signature closures). A key naming no declared
+        // field throws the catchable TypeError — JS would ADD the
+        // property, which a monomorphic struct cannot (the SEMANTICS.md
+        // keyed-write-miss divergence). Mixed-type and accessor-carrying
+        // shapes keep the fence.
+        const common =
+          shape.fields.length > 0 &&
+          !shapeHasAccessorSlots(shape) &&
+          shape.fields.every((f) => typeEquals(f.type, shape.fields[0]!.type))
+            ? shape.fields[0]!.type
+            : null;
+        if (!common) {
+          lowerer.unsupported(
+            "SC1090",
+            target,
+            "dynamic keyed writes to records without an index signature (declared fields of ONE shared type dispatch by key — spell the field name otherwise)",
+          );
+        }
+        const obj = lowerer.lowerExpr(target.expression);
+        let key: IrExpr =
+          litKey !== null
+            ? { kind: "strLit", value: litKey, type: STRING, loc: locOf(target.argumentExpression) }
+            : lowerer.lowerExpr(target.argumentExpression);
+        // Runtime number/boolean/dyn keys stringify — ToPropertyKey,
+        // exactly the index-signature path's rule.
+        key = lowerRecordPropertyKey(lowerer, key, target.argumentExpression);
+        if (key.type.kind !== "string") {
+          lowerer.unsupported(
+            "SC1090",
+            target.argumentExpression,
+            "indexing records with non-string or non-number keys",
+          );
+        }
+        const value = lowerer.coerceInto(expr.right, lowerer.lowerExpr(expr.right), common);
+        if (!typeEquals(value.type, common))
+          lowerer.badType(expr.right, lowerer.typeOf(expr.right));
+        return {
+          kind: "recordKeySet",
+          obj,
+          shapeId: receiverIr.shapeId,
+          key,
+          value,
+          loc: locOf(expr),
+        };
+      }
+      // A LITERAL key naming no declared field is a pure overflow insert
+      // — no collision to validate. Runtime keys must be able to collide
+      // with every declared field: dyn slots validate through the
+      // dynCheck walker (fields must be dyn-convertible — the same
+      // convertibility the read needs); typed slots write through
+      // directly, so every field must BE the index-value type.
+      const overflowOnly = litKey !== null;
+      const writable =
+        overflowOnly ||
+        (shape.indexValue.kind === "dyn"
+          ? shape.fields.every((f) => lowerer.dynConvertible(f.type))
+          : shape.fields.every((f) => typeEquals(f.type, shape.indexValue!)));
+      if (!writable) {
+        lowerer.unsupported(
+          "SC1090",
+          target,
+          `dynamic keyed writes to '${lowerer.fmt(receiverIr)}' (a declared field's type cannot take the index signature's value at runtime)`,
+        );
+      }
+      const obj = lowerer.lowerExpr(target.expression);
+      let key =
+        litKey !== null
+          ? ({
+              kind: "strLit",
+              value: litKey,
+              type: STRING,
+              loc: locOf(target.argumentExpression),
+            } satisfies IrExpr)
+          : lowerer.lowerExpr(target.argumentExpression);
+      // Runtime NUMBER keys canonicalize through the JS-exact formatter
+      // (o[n] = v writes o[String(n)] — the number-keyed-signature path).
+      key = lowerRecordPropertyKey(lowerer, key, target.argumentExpression);
+      if (key.type.kind !== "string") {
+        lowerer.unsupported(
+          "SC1090",
+          target.argumentExpression,
+          "indexing records with non-string or non-number keys",
+        );
+      }
+      const value = lowerer.intoIndexValueSlot(
+        lowerer.lowerExpr(expr.right),
+        shape.indexValue,
+        expr.right,
+      );
+      return {
+        kind: "recordKeySet",
+        obj,
+        shapeId: receiverIr.shapeId,
+        key,
+        value,
+        ...(overflowOnly ? { overflowOnly: true as const } : {}),
+        loc: locOf(expr),
+      };
+    }
+  }
+  // Keyed write `d[k] = v` on a CHECKED-DYNAMIC receiver (a JS `any`
+  // dictionary — the Object.create(null) memo-table idiom writes
+  // `result[key] = value`): dyn.keySet, exactly the record-mapped dyn
+  // arm above — later writes win in insertion order, number keys
+  // canonicalize through the JS-exact formatter (ToPropertyKey's string
+  // side), index keys on dyn arrays set/extend elements, and non-object
+  // receivers throw Node's TypeErrors at runtime. An unmapped checker type
+  // probes the receiver's lowered representation: a dyn value takes the same
+  // write, anything else falls through to the fences.
+  if (receiverIr?.kind === "dyn" || receiverIr?.kind === "object" || receiverIr === null) {
+    const obj =
+      receiverIr !== null
+        ? lowerer.lowerExpr(target.expression)
+        : tryLowerExpression(lowerer, target.expression);
+    if (
+      obj !== null &&
+      (obj.type.kind === "dyn" ||
+        (obj.type.kind === "object" && obj.type.className === "%Error") ||
+        isDynTypedRefType(obj.type))
+    ) {
+      const loc = locOf(expr);
+      const litKey = recordKeyLiteralText(target.argumentExpression);
+      let key: IrExpr =
+        litKey !== null
+          ? { kind: "strLit", value: litKey, type: STRING, loc: locOf(target.argumentExpression) }
+          : lowerer.lowerExpr(target.argumentExpression);
+      key = lowerRecordPropertyKey(lowerer, key, target.argumentExpression);
+      if (key.type.kind !== "string") {
+        lowerer.unsupported(
+          "SC1090",
+          target.argumentExpression,
+          "indexing checked-dynamic values with non-string or non-number keys",
+        );
+      }
+      const value = lowerer.coerceToExpected(lowerer.lowerExpr(expr.right), DYN);
+      if (value.type.kind !== "dyn") {
+        lowerer.unsupported(
+          "SC1101",
+          expr.right,
+          `storing '${lowerer.fmt(value.type)}' values in a checked-dynamic object (the value cannot convert into the checked-dynamic tree)`,
+        );
+      }
+      return {
+        kind: "exprStmt",
+        expr: {
+          kind: "libCall",
+          fn: "dyn.keySet",
+          args: [lowerer.coerceToExpected(obj, DYN), key, value],
+          type: VOID,
+          loc,
+        },
+        loc,
+      };
+    }
+  }
+  if (receiverIr?.kind !== "array") {
+    lowerer.unsupported("SC1090", target, "assignment to non-array elements");
+  }
+  let arr = lowerer.lowerExpr(target.expression);
+
+  if (
+    arr.type.kind === "union" &&
+    lowerer.armTag(arr.type.unionId, UNDEFINED_T) >= 0 &&
+    receiverIr.kind === "array"
+  ) {
+    const present = lowerer.stripUndefinedArm(arr.type);
+    const helper =
+      present.kind === "array"
+        ? lowerer.narrowedArmHelper(arr.type.unionId, present, locOf(target.expression))
+        : null;
+    if (helper) {
+      arr = lowerer.checkedNarrowCall(helper, arr, present, locOf(target.expression));
+    }
+  }
+  if (arr.type.kind !== "array") {
+    lowerer.unsupported(
+      "SC1090",
+      target.expression,
+      "assignment through a possibly missing nested array receiver",
+    );
+  }
+  const index = lowerOptionalNumber(
+    lowerer,
+    lowerer.lowerExpr(target.argumentExpression),
+    locOf(target.argumentExpression),
+    target.argumentExpression,
+  );
+  if (index.type.kind === "dyn" && lowerer.dynConvertible(arr.type)) {
+    return {
+      kind: "exprStmt",
+      expr: lowerDynMemberAssignment(
+        lowerer,
+        expr,
+        lowerer.coerceInto(target.expression, arr, DYN),
+      ),
+      loc: locOf(expr),
+    };
+  }
+  if (index.type.kind !== "f64") {
+    lowerer.unsupported("SC1090", target.argumentExpression, "indexing with non-number keys");
+  }
+  // Optional array reads carry the source array's payload type plus an
+  // undefined arm. arrayValueStore turns that arm into the runtime's
+  // UNDEFINED state while keeping number[]/string[] payload storage scalar.
+  let literal = expr.right;
+  while (ts.isParenthesizedExpression(literal) || ts.isSatisfiesExpression(literal))
+    literal = literal.expression;
+  const value =
+    ts.isObjectLiteralExpression(literal) || ts.isArrayLiteralExpression(literal)
+      ? lowerer.lowerExprExpecting(literal, arr.type.elem)
+      : lowerer.lowerExpr(expr.right);
+  // Validate the payload before emitting a native store. A dormant JS
+  // method can contradict its JSDoc element type; retain its call-time
+  // refusal instead of leaving invalid IR in a newly reachable method.
+  const expected =
+    value.type.kind === "undefinedT" ||
+    (value.type.kind === "union" && lowerer.armTag(value.type.unionId, UNDEFINED_T) >= 0)
+      ? arrayValueType(lowerer, arr.type.elem)
+      : arr.type.elem;
+  return arrayValueStore(
+    lowerer,
+    arr,
+    index,
+    lowerer.coerceInto(expr.right, value, expected),
+    arr.type.elem,
+    locOf(expr),
+  );
+}
+
+/** Environment property names use ToPrimitive with the string hint, so
+ * checked objects must execute their own conversion hooks. */
+export function lowerEnvironmentKey(lowerer: Lowerer, node: ts.Expression): IrExpr {
+  const key = lowerer.lowerExpr(node);
+  if (key.type.kind === "dyn")
+    return { kind: "libCall", fn: "dyn.toStringCoerce", args: [key], type: STRING, loc: key.loc };
+  return lowerRecordPropertyKey(lowerer, key, node);
+}
diff --git a/packages/compiler/src/frontend/lowering/expressions/identifiers.ts b/packages/compiler/src/frontend/lowering/expressions/identifiers.ts
new file mode 100644
index 000000000..5a8169300
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/expressions/identifiers.ts
@@ -0,0 +1,922 @@
+/* Identifier references in expression position: lowerExprInner's identifier branch and its helpers. */
+import * as ts from "../../ts7/adapter.js";
+import * as posix from "node:path/posix";
+import { type Lowerer, PoisonError } from "../lowerer.js";
+import {
+  BOOL,
+  BYTES_ELEMENT_NAME,
+  DYN,
+  F64,
+  type IrExpr,
+  type IrType,
+  STRING,
+  type SrcLoc,
+  UNDEFINED_T,
+  arrayOf,
+  funcOf,
+  isUnitType,
+  recordTextCodecClass,
+} from "../../../ir/ir.js";
+import { lowerNodeModuleIdentifier } from "../lower-node-module.js";
+import { lowerCjsExportsObjectValue } from "../cjs-exports-object.js";
+import { captureContextArguments } from "../function-context.js";
+import { isCjsExportTableLiteral, isJsSourceFile, isNodeEsmFile, locOf } from "../../program.js";
+import { builtinClassAliasOwnsNoSlot, runtimeClassValueOf } from "../builtins/class-values.js";
+import {
+  cjsAccessorCall,
+  primitiveCtorClosure,
+  runtimeOptionalElementKey,
+  runtimeOptionalUseOf,
+} from "../lower-exprs.js";
+import { runtimeOptionalReceiverRead } from "./narrowing.js";
+import { varRef } from "../../../ir/build.js";
+import {
+  ambientUndefReadType,
+  ambientUndefinedFnSymbolOf,
+  contextualUndefReadType,
+  fenceEarlyAliasUse,
+  lowerNsIdentifierValue,
+  nsUndefRead,
+} from "../lower-namespaces.js";
+import {
+  blockedBindingUseDiag,
+  unsupportedDiag,
+  unsupportedPackageValueDiag,
+} from "../../../diagnostics/diagnostic.js";
+import { dirname } from "node:path";
+import { funcTypeFromParamShapes } from "../call-signatures.js";
+import { threadsImportOf } from "../../threads-import.js";
+import { experimentalImportOf } from "../../experimental-import.js";
+import { lowerWorkerMetadata } from "../builtins/workers.js";
+import { esmImportBindingKind } from "../builtins/module-bindings.js";
+import {
+  builtinConstLit,
+  builtinFenceHintOf,
+  builtinModuleConstOf,
+  builtinModuleFnOf,
+  builtinModulesArrayLit,
+  stdlibGlobalNameOf,
+} from "../surfaces.js";
+import { builtinConstantsObject } from "../lower-builtin-values.js";
+import { lowerTlsRootCertificates } from "../lower-server.js";
+import { builtinFunctionFenceValue } from "../builtin-function-fences.js";
+import { unsupportedModuleFeatureOf } from "../../builtin-modules.js";
+import { lowerGlobalValue } from "../lower-global-value.js";
+import { fenceEnumObjectValue } from "../lower-enums.js";
+import { mixinFnOfCallee } from "../lower-mixins.js";
+import { isNavigatorGlobal, refuseNavigator } from "../builtins/navigator.js";
+import { wasiGuestPath } from "../../../wasi-paths.js";
+
+export function lowerIdentifierExpr(lowerer: Lowerer, expr: ts.Identifier, loc: SrcLoc): IrExpr {
+  if (lowerer.isStdlibGlobal(expr, "console")) {
+    return { kind: "libCall", fn: "console.native", args: [], type: DYN, loc };
+  }
+
+  const moduleValue = lowerNodeModuleIdentifier(lowerer, expr);
+  if (moduleValue) return moduleValue;
+  if (expr.text === "exports") {
+    const exportsValue = lowerCjsExportsObjectValue(lowerer, expr);
+    if (exportsValue) return exportsValue;
+  }
+  if (lowerer.isSelfReference(expr)) {
+    return { kind: "selfRef", type: lowerer.ctx.selfType!, loc };
+  }
+  // `arguments` in a variadic JS function (the rest-marked form): the
+  // synthetic trailing dyn-array param — lambdaSignature marked the
+  // type and lowerLambda declared the local.
+  if (expr.text === "arguments") {
+    const binding = captureContextArguments(lowerer.fnStack);
+    if (binding) return { kind: "varRef", localId: binding.id, type: DYN, loc };
+  }
+  // A compiler-projected adapter as a VALUE: the adapter has no
+  // runtime function object (its calls rewrite directly) — call it
+  // through its immutable binding instead.
+  {
+    const sym = lowerer.resolveValueSymbol(expr);
+    const projection = sym ? lowerer.staticCallables.get(sym) : undefined;
+    if (
+      projection?.kind === "promisified-exec-file" ||
+      projection?.kind === "promisified-exec" ||
+      projection?.kind === "promisified-builtin" ||
+      projection?.kind === "promisified-zlib" ||
+      projection?.kind === "promisified-crypto" ||
+      projection?.kind === "promisified-dns"
+    ) {
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        `a promisified builtin as a value (call '${expr.text}' directly)`,
+      );
+    }
+    if (projection?.kind === "builtin-function") {
+      if (!isJsSourceFile(expr.getSourceFile())) {
+        const callable = lowerer.lowerBuiltinCallableValue(
+          { module: projection.module, member: projection.member },
+          loc,
+        );
+        if (callable) return callable;
+      }
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        `a builtin function alias as an escaping value (call '${expr.text}' directly)`,
+      );
+    }
+    // `EventEmitter`, `Readable` or `TypeError` (or a const alias of
+    // one) as a value in a TypeScript file: the runtime class's class
+    // object. JavaScript files keep the identity token.
+    if (!isJsSourceFile(expr.getSourceFile())) {
+      const runtimeClass = runtimeClassValueOf(lowerer, expr);
+      if (runtimeClass) return lowerer.classValueRef(runtimeClass, expr);
+    }
+    // `const E = EventEmitter` owns no runtime slot: construction,
+    // instanceof, typeof and .name lower at their use sites.
+    if (sym && builtinClassAliasOwnsNoSlot(lowerer, sym)) {
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        `a builtin class alias as an escaping value (use '${expr.text}' with new, instanceof, typeof or .name)`,
+      );
+    }
+  }
+  // Union-typed bindings read through tsc's control-flow narrowing:
+  // when the checker types this USE as a single arm, maybeNarrow
+  // bridges the tagged representation with a unionNarrow.
+  const local = lowerer.resolveLocal(expr);
+  if (local) {
+    // A switch can dispatch past a lexical declaration. Keep this
+    // previously refused codec form out until switch-scope TDZ boxes
+    // model that skipped initialization, including value aliases.
+    if (
+      local.type.kind === "record" &&
+      recordTextCodecClass(lowerer.shapes.get(local.type.shapeId)!) !== null
+    ) {
+      const symbol = lowerer.resolveValueSymbol(expr);
+      const decl = symbol ? symbol.valueDeclaration : undefined;
+      if (
+        decl &&
+        ts.isVariableDeclaration(decl) &&
+        ts.isVariableDeclarationList(decl.parent) &&
+        (decl.parent.flags & ts.NodeFlags.BlockScoped) !== 0 &&
+        ts.isVariableStatement(decl.parent.parent)
+      ) {
+        const clause = decl.parent.parent.parent;
+        if (
+          (ts.isCaseClause(clause) || ts.isDefaultClause(clause)) &&
+          !(expr.getStart() >= clause.getStart() && expr.end <= clause.end)
+        ) {
+          lowerer.unsupported(
+            "SC1090",
+            expr,
+            "codec bindings read from another switch clause before initialization is proven",
+          );
+        }
+      }
+    }
+    if (local.type.kind === "caught") return lowerer.caughtRead(expr, local, loc);
+    const symbol = lowerer.resolveValueSymbol(expr);
+    const runtimeOptionalRoot = lowerer.runtimeOptionalRootOf(local);
+    const active = lowerer.runtimeOptionalLocals.has(runtimeOptionalRoot);
+    const arithmetic = lowerer.runtimeOptionalArithmeticLocals.has(runtimeOptionalRoot);
+    const captured =
+      !!symbol &&
+      lowerer.runtimeOptionalStorageLocals.has(runtimeOptionalRoot) &&
+      (local.boxed === true ||
+        lowerer.ctx.captureBySymbol.get(symbol) === local ||
+        runtimeOptionalRoot !== local);
+    if (arithmetic && !runtimeOptionalUseOf(expr)) {
+      return { kind: "varRef", localId: local.id, type: local.type, loc };
+    }
+    if (active || captured) {
+      const use = runtimeOptionalUseOf(expr);
+      if (use?.complex) {
+        lowerer.unsupported(
+          "SC1090",
+          expr,
+          "a logical or conditional receiver containing a runtime-optional capture",
+        );
+      }
+      if (use?.optional) return { kind: "varRef", localId: local.id, type: local.type, loc };
+      if (use?.kind === "property")
+        return runtimeOptionalReceiverRead(lowerer, expr, local, use.access.name.text, loc);
+      if (use?.kind === "element") {
+        const key = runtimeOptionalElementKey(use.access.argumentExpression);
+        if (key === null) {
+          return varRef(local.id, local.type, loc);
+        }
+        return runtimeOptionalReceiverRead(lowerer, expr, local, key, loc);
+      }
+      if (use?.kind === "call") {
+        if (use.comma && !use.optional) {
+          lowerer.unsupported(
+            "SC1090",
+            use.access,
+            "a direct call through a comma-wrapped runtime-optional capture",
+          );
+        }
+        return runtimeOptionalReceiverRead(lowerer, expr, local, null, loc);
+      }
+      if (runtimeOptionalObjectWalkerArg(lowerer, expr)) {
+        const narrowed = lowerer.mapTypeOf(lowerer.typeOf(expr));
+        if (local.type.kind === "union" && narrowed) {
+          const helper =
+            narrowed.kind === "union"
+              ? lowerer.narrowedRetagHelper(expr, local.type.unionId, narrowed.unionId, loc)
+              : !isUnitType(narrowed)
+                ? lowerer.narrowedArmHelper(local.type.unionId, narrowed, loc)
+                : null;
+          if (helper) {
+            return lowerer.checkedNarrowCall(
+              helper,
+              varRef(local.id, local.type, loc),
+              narrowed,
+              loc,
+            );
+          }
+        }
+      }
+      return { kind: "varRef", localId: local.id, type: local.type, loc };
+    }
+    const narrowed = lowerer.maybeNarrow(
+      { kind: "varRef", localId: local.id, type: local.type, loc },
+      expr,
+    );
+    if (
+      narrowed.type.kind === "union" &&
+      lowerer.runtimeOptionalStorageLocals.has(runtimeOptionalRoot) &&
+      lowerer.mapTypeOf(lowerer.typeOf(expr))?.kind === "record"
+    ) {
+      // A presence guard can be followed by a predicate strengthening
+      // the record's fields. Its refined shape is not a stored union
+      // arm: extract the original layout before reading a member.
+      const use = runtimeOptionalUseOf(expr);
+      if (use && !use.complex && !use.optional) {
+        if (use.kind === "property")
+          return runtimeOptionalReceiverRead(lowerer, expr, local, use.access.name.text, loc);
+        if (use.kind === "element") {
+          const key = runtimeOptionalElementKey(use.access.argumentExpression);
+          if (key !== null) return runtimeOptionalReceiverRead(lowerer, expr, local, key, loc);
+        }
+      }
+    }
+    return narrowed;
+  }
+  // `import x = N.y` aliases resolve transparently through globalOf/
+  // fnSigOf below; their source-order guards live here (a no-op for
+  // every non-import= binding — see lower-namespaces.ts).
+  fenceEarlyAliasUse(lowerer, expr, expr);
+  const g = lowerer.globalOf(expr);
+  if (g) {
+    // A global typed by a class that never REGISTERED (its collection
+    // fenced): the initializing assignment never lowered, so the read
+    // can only observe garbage — and the emitter would name a struct
+    // that does not exist. The blocked-binding cascade names the use;
+    // without this the validator's registration check ICEs on the live
+    // reference (`@this {T}` inference — signature 07).
+    const unregistered = lowerer.unregisteredClassOf(g.type, new Set());
+    if (unregistered !== null) {
+      // The class's own rejection is the root cause the cascade names.
+      lowerer.flushDeferredClass(unregistered);
+      lowerer.pushDiag(blockedBindingUseDiag(expr.text, loc));
+      throw new PoisonError();
+    }
+    const ref: IrExpr = { kind: "varRef", localId: g.id, type: g.type, loc };
+    if (lowerer.isRuntimeOptionalArithmeticGlobal(g) && !runtimeOptionalUseOf(expr)) {
+      return ref;
+    }
+    const storageHasUndefined =
+      g.type.kind === "union" && lowerer.armTag(g.type.unionId, UNDEFINED_T) >= 0;
+    if (lowerer.isRuntimeOptionalGlobal(g) || storageHasUndefined) {
+      // A checker-narrowed global receiver (`if (tags !== undefined)
+      // tags[tags.length] = ...`, or `a ? Object.keys(a) : ...`) is
+      // still stored as the runtime optional union. Extract the proven
+      // value arm before routing the member/element operation so dynamic
+      // keys and builtin record walkers do not see a union receiver.
+      const narrowed = lowerer.mapTypeOf(lowerer.typeOf(expr));
+      const arithmeticUnion =
+        g.type.kind === "union" &&
+        lowerer.unions.get(g.type.unionId)?.arms.length === 2 &&
+        lowerer.unions.get(g.type.unionId)!.arms.some((a) => a.kind === "f64") &&
+        lowerer.unions.get(g.type.unionId)!.arms.some((a) => a.kind === "string");
+      const symbol = lowerer.resolveValueSymbol(expr);
+      if (
+        !arithmeticUnion &&
+        !(symbol !== null && lowerer.earlyReadVars.has(symbol)) &&
+        g.type.kind === "union" &&
+        narrowed &&
+        narrowed.kind !== "union" &&
+        !isUnitType(narrowed) &&
+        !(
+          narrowed.kind === "record" &&
+          recordTextCodecClass(lowerer.shapes.get(narrowed.shapeId)!) !== null
+        ) &&
+        narrowed.kind !== "f64" &&
+        narrowed.kind !== "string" &&
+        narrowed.kind !== "bool" &&
+        lowerer.armTag(g.type.unionId, narrowed) >= 0
+      ) {
+        const helper = lowerer.narrowedArmHelper(g.type.unionId, narrowed, loc);
+        if (helper) return lowerer.checkedNarrowCall(helper, ref, narrowed, loc);
+      }
+      const use = runtimeOptionalUseOf(expr);
+      // The enclosing logical/conditional expression consumes the union
+      // before any member operation runs (`(value ?? fallback).length`).
+      // Keep the tagged value intact and let that lazy expression decide
+      // its branch; extracting here would evaluate or throw too early.
+      if (use?.complex) return ref;
+      if (use?.optional) return ref;
+      if (use?.kind === "property")
+        return runtimeOptionalReceiverRead(lowerer, expr, g, use.access.name.text, loc);
+      if (use?.kind === "element") {
+        const key = runtimeOptionalElementKey(use.access.argumentExpression);
+        if (key === null)
+          lowerer.unsupported(
+            "SC1090",
+            use.access,
+            "a computed read from a runtime-optional global (use a literal key)",
+          );
+        return runtimeOptionalReceiverRead(lowerer, expr, g, key, loc);
+      }
+      if (use?.kind === "call") return runtimeOptionalReceiverRead(lowerer, expr, g, null, loc);
+      return ref;
+    }
+    return lowerer.maybeNarrow(ref, expr);
+  }
+  // `undefined` — tsc's intrinsic global (a local shadowing the name
+  // resolved above): a unit literal, exactly like the `null` keyword.
+  if (expr.text === "undefined" && lowerer.typeOf(expr).flags & ts.TypeFlags.Undefined) {
+    return { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc };
+  }
+  // `__dirname` / `__filename` — the CommonJS module globals: per-
+  // MODULE compile-time constants, the containing file's location
+  // (Node's exact values when the same tree runs in place; WASI uses
+  // the equivalent guest-visible path; locals shadowing the names
+  // resolved above). In a file with ESM syntax Node never defines them
+  // (ReferenceError) — fence rather than invent a value there.
+  if (
+    (expr.text === "__dirname" || expr.text === "__filename") &&
+    lowerer.isStdlibGlobal(expr, expr.text)
+  ) {
+    const sf = expr.getSourceFile();
+    if (isNodeEsmFile(sf, lowerer.program)) {
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        `'${expr.text}' in an ES module (Node defines the CJS module globals only in CommonJS modules)`,
+      );
+    }
+    // The WASI runner mounts the host cwd at guest `/` and the host temp
+    // directory at `/tmp`. Bake the matching GUEST spelling so resource
+    // lookups relative to these CommonJS globals stay inside the exposed
+    // capability instead of naming an unreachable host-absolute path.
+    const fileName = moduleFileName(lowerer, sf);
+    const value =
+      expr.text === "__dirname"
+        ? lowerer.targetPlatform === "wasi"
+          ? posix.dirname(fileName)
+          : dirname(fileName)
+        : fileName;
+    return { kind: "strLit", value, type: STRING, loc };
+  }
+  const sig = lowerer.fnSigOf(expr);
+  if (sig && lowerer.isTopLevelFnSymbol(expr)) {
+    // A declared function used as a value: a zero-capture closure. The
+    // backend interns one per function so `f === f` holds (JS identity).
+    // The value's type is the completed ABI signature; optional/default
+    // slots and typed rest arrays pass the value fence first.
+    lowerer.noteEdge(sig.name);
+    // dynRest slots stay out of the VALUE type's param list (fn.length
+    // semantics); the rest marker carries the trailing dyn-array ABI.
+    const funcType: IrType = funcTypeFromParamShapes(sig.params, sig.returnType);
+    lowerer.requireExactArityValue(expr, expr, sig.params, funcType);
+    return { kind: "closure", fnName: sig.name, captures: [], type: funcType, loc };
+  }
+  {
+    // A generic function as a VALUE: monomorphized by flow — the
+    // reference's pinned concrete signature (contextual type or an
+    // instantiation expression) names the instance; unpinned
+    // references fence inside (lowerGenericFnValue).
+    const gfn = lowerer.genericFnOf(expr);
+    if (gfn) return lowerer.lowerGenericFnValue(expr, gfn);
+  }
+  // A CJS export-table ACCESSOR read (`tmpdir.path`, or a destructured
+  // binding aliasing one): the getter is a real function of module
+  // scope — its body reads module globals, so it lifts like a lambda
+  // (interned per declaration) and every read is a call. Node runs the
+  // getter per read; so does this.
+  {
+    const acc = cjsExportAccessorRead(lowerer, expr);
+    if (acc) return acc;
+  }
+  // A binding destructured from a baked constants object
+  // (http2.constants / crypto.constants): the literal — the
+  // declaration emitted nothing (builtinConstantsDestructureDecl).
+  {
+    const h2c = lowerer.builtinConstantBindingOf(expr);
+    if (h2c) return h2c;
+  }
+  // Builtin-module import bindings: constants (path.sep, os.EOL) read
+  // as interned string literals; functions have no closure
+  // representation (they lower to libCall at call sites only); members
+  // with no lowering at all fence with the module-qualified name.
+  {
+    const member = threadsImportOf(lowerer.program, expr);
+    // scriptc delivers published graphs by reference.
+    if (member === "sharesPublishedGraphs")
+      return { kind: "boolLit", value: true, type: BOOL, loc };
+    if (member === "publish")
+      lowerer.noLowering(
+        "publish (@scriptc/threads) as a value",
+        expr,
+        "call publish(value) directly",
+      );
+    if (experimentalImportOf(lowerer.program, expr) === "LifetimeRegion")
+      lowerer.noLowering(
+        "LifetimeRegion (@scriptc/experimental) as a value",
+        expr,
+        "construct regions with new LifetimeRegion()",
+      );
+    if (experimentalImportOf(lowerer.program, expr) === "InternTable")
+      lowerer.noLowering(
+        "InternTable (@scriptc/experimental) as a value",
+        expr,
+        'open tables with new InternTable("name")',
+      );
+    if (experimentalImportOf(lowerer.program, expr) === "ThreadSlots")
+      lowerer.noLowering(
+        "ThreadSlots (@scriptc/experimental) as a value",
+        expr,
+        'open slots with new ThreadSlots("name")',
+      );
+  }
+  {
+    const bi = lowerer.builtinImportOf(expr);
+    if (bi) {
+      if (bi.module === "worker_threads") {
+        const value = lowerWorkerMetadata(bi.member, loc);
+        if (value) return value;
+      }
+      // A named import of defaultMaxListeners reads the ES module
+      // namespace's copy. A CommonJS destructured or member binding holds
+      // the value read when its declaration ran, which these bindings do
+      // not store.
+      if (bi.module === "events" && bi.member === "defaultMaxListeners") {
+        if (esmImportBindingKind(lowerer, expr) === "named") {
+          return { kind: "libCall", fn: "emitter.esmDefaultMax", args: [], type: F64, loc };
+        }
+        lowerer.noLowering(
+          "events.defaultMaxListeners through a CommonJS destructured or member binding",
+          expr,
+          "read require('events').defaultMaxListeners or EventEmitter.defaultMaxListeners where the value is needed",
+        );
+      }
+      const c = builtinModuleConstOf(lowerer, bi.module, bi.member);
+      if (c !== undefined) return builtinConstLit(c, loc);
+      // module.builtinModules — the baked Node v24 list, a fresh
+      // string[] per read.
+      if (bi.module === "module" && bi.member === "builtinModules") {
+        return builtinModulesArrayLit(loc);
+      }
+      if (bi.module === "http" && bi.member === "METHODS") {
+        return { kind: "libCall", fn: "http.methods", args: [], type: arrayOf(STRING), loc };
+      }
+      if ((bi.module === "http" || bi.module === "https") && bi.member === "globalAgent") {
+        return {
+          kind: "libCall",
+          fn: "http.globalAgent",
+          args: [{ kind: "boolLit", value: bi.module === "https", type: BOOL, loc }],
+          type: DYN,
+          loc,
+        };
+      }
+      if (bi.module === "http" && bi.member === "STATUS_CODES") {
+        return { kind: "libCall", fn: "http.statusCodes", args: [], type: DYN, loc };
+      }
+      if (bi.module === "os" && bi.member === "constants") {
+        return { kind: "libCall", fn: "os.constants", args: [], type: DYN, loc };
+      }
+      if (bi.module === "fs" && bi.member === "constants")
+        return { kind: "libCall", fn: "fs.constants", args: [], type: DYN, loc };
+      // `import { O_RDONLY } from "constants"`: the member of the frozen
+      // module object.
+      if (bi.module === "constants") {
+        return {
+          kind: "dynKeyGet",
+          value: builtinConstantsObject(lowerer, loc),
+          key: { kind: "strLit", value: bi.member, type: STRING, loc },
+          type: DYN,
+          loc,
+        };
+      }
+      // tls.rootCertificates: a runtime-valued module constant (the
+      // cached bundled-CA array) — the one member read that lowers
+      // to a libCall instead of a baked literal.
+      {
+        const roots = lowerTlsRootCertificates(lowerer, bi, loc);
+        if (roots) return roots;
+      }
+      {
+        const callable = lowerer.lowerBuiltinCallableValue(bi, loc);
+        if (callable) return callable;
+      }
+      // JavaScript sources: an otherwise unsupported builtin VALUE is
+      // the same identity-token story as stdlib globals above (the
+      // harness adds worker_threads.Worker to its identity Set).
+      if (isJsSourceFile(expr.getSourceFile())) {
+        // A function member is a function value that fences when called.
+        if (builtinModuleFnOf(lowerer, bi.module, bi.member))
+          return builtinFunctionFenceValue(lowerer, bi, expr, loc);
+        return {
+          kind: "strLit",
+          value: `[builtin ${bi.module}.${bi.member}]`,
+          type: STRING,
+          loc,
+        };
+      }
+      if (builtinModuleFnOf(lowerer, bi.module, bi.member)) {
+        lowerer.unsupported(
+          "SC1090",
+          expr,
+          `library functions as values (call '${expr.text}' directly)`,
+        );
+      }
+      lowerer.noLowering(
+        `${bi.module}.${bi.member}`,
+        expr,
+        builtinFenceHintOf(bi.module, bi.member),
+        lowerer.resolveValueSymbol(expr),
+      );
+    }
+  }
+  // A builtin namespace import used as a bare VALUE (`const f = fs`):
+  // the namespace object has no representation — members lower at
+  // their access sites only. The CommonJS namespace binding
+  // (`const lib = require("./lib.js")`) gets the same fence.
+  const builtinNamespace = lowerer.builtinNamespaceModuleOf(expr);
+  if (builtinNamespace === "constants") return builtinConstantsObject(lowerer, loc);
+  if (builtinNamespace !== null) {
+    const type: IrType = { kind: "moduleNs", moduleId: `builtin:${builtinNamespace}` };
+    return { kind: "moduleNsRef", moduleId: type.moduleId, type, loc };
+  }
+  if (lowerer.cjsLocalModuleBindingOf(expr)) {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      `module namespace objects as values (access '${expr.text}' members directly)`,
+    );
+  }
+  if (lowerer.stdlibGlobalFnOf(expr)) {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      `library functions as values (call '${expr.text}' directly)`,
+    );
+  }
+  // A declaration-only npm binding has no compiled runtime value.
+  {
+    const pkg = lowerer.npmPackageOfSymbol(lowerer.resolveValueSymbol(expr) ?? undefined);
+    if (pkg) {
+      lowerer.pushDiag(unsupportedPackageValueDiag(pkg, loc));
+      throw new PoisonError();
+    }
+  }
+  // Bindings imported from an UNSUPPORTED builtin module: coverage
+  // analyzes past import fences, so uses of `spawn` from
+  // child_process reach lowering — the use site reports the same
+  // "the '<module>' module" diagnostic as the import line, and the
+  // report groups them into one blocker. (Builds never get here: the
+  // import already failed preflight.)
+  {
+    const spec = lowerer.fencedBuiltinImportOf(expr);
+    if (spec !== null) {
+      lowerer.pushDiag(unsupportedDiag("SC1010", loc, unsupportedModuleFeatureOf(spec)));
+      throw new PoisonError();
+    }
+  }
+  // The globals `Infinity` and `NaN` (lib-declared, provenance-checked
+  // like every stdlib name): non-finite numLits — `-Infinity` arrives
+  // through the unary-minus literal fold. Arithmetic, comparisons, and
+  // formatting are IEEE-exact in C (String(Infinity) is "Infinity" and
+  // String(NaN) is "NaN" in the number formatter; `NaN !== NaN` holds
+  // because f64 compares are IEEE compares).
+  if (expr.text === "Infinity" || expr.text === "NaN") {
+    const sym = lowerer.checker.getSymbolAtLocation(expr);
+    if (lowerer.isStdlibSymbol(sym)) {
+      return { kind: "numLit", value: expr.text === "NaN" ? NaN : Infinity, type: F64, loc };
+    }
+  }
+  // The primitive constructors as VALUES (`const f = String`, an
+  // option table's `type: Boolean` field, `opt.type === Number`): the
+  // interned coercion closure — one synthesized module function per
+  // constructor per program, so every reference is the SAME zero-
+  // capture closure and `===` is JS identity (the type mapping in
+  // type-mapper.ts pins the one concrete signature `(value: string) =>
+  // primitive`; direct calls `String(x)` never reach here — the call
+  // lowering intercepts them with the wider static coercions).
+  const jsPrimitiveCtorSelector = isJsSourceFile(expr.getSourceFile());
+  const primitiveName = stdlibGlobalNameOf(lowerer, expr);
+  if (
+    primitiveName === "String" ||
+    primitiveName === "Number" ||
+    primitiveName === "Boolean" ||
+    primitiveName === "BigInt"
+  ) {
+    return primitiveCtorClosure(lowerer, primitiveName, loc, jsPrimitiveCtorSelector);
+  }
+  if (lowerer.isStdlibGlobal(expr, "ArrayBuffer"))
+    return { kind: "libCall", fn: "arrayBuffer.constructor", args: [], type: DYN, loc };
+  if (isJsSourceFile(expr.getSourceFile()) && lowerer.isStdlibGlobal(expr, "Array"))
+    return { kind: "libCall", fn: "dyn.arrayConstructor", args: [], type: DYN, loc };
+  if (
+    Object.values(BYTES_ELEMENT_NAME).includes(expr.text) &&
+    lowerer.isStdlibSymbol(lowerer.checker.getSymbolAtLocation(expr))
+  ) {
+    return {
+      kind: "libCall",
+      fn: "bytes.constructor",
+      args: [{ kind: "strLit", value: expr.text, type: STRING, loc }],
+      type: DYN,
+      loc,
+    };
+  }
+  if (
+    (expr.text === "encodeURIComponent" ||
+      expr.text === "encodeURI" ||
+      expr.text === "decodeURIComponent" ||
+      expr.text === "decodeURI") &&
+    lowerer.isStdlibGlobal(expr, expr.text)
+  ) {
+    const name = `%builtin.${expr.text}`;
+    const type = funcOf([DYN], STRING);
+    if (!lowerer.liftedFns.some((fn) => fn.name === name)) {
+      const value: IrExpr = {
+        kind: "libCall",
+        fn: "dyn.toStringCoerce",
+        args: [varRef("value", DYN, loc)],
+        type: STRING,
+        loc,
+      };
+      const fn =
+        expr.text === "encodeURIComponent"
+          ? "str.encodeUriComponent"
+          : expr.text === "encodeURI"
+            ? "str.encodeUri"
+            : expr.text === "decodeURI"
+              ? "str.decodeUri"
+              : "str.decodeUriComponent";
+      lowerer.liftedFns.push({
+        name,
+        params: [{ localId: "value", name: "value", type: DYN }],
+        locals: [{ id: "value", name: "value", type: DYN, mutable: false }],
+        returnType: STRING,
+        body: [
+          {
+            kind: "return",
+            value: { kind: "libCall", fn, args: [value], type: STRING, loc },
+            loc,
+          },
+        ],
+        loc,
+      });
+    }
+    return { kind: "closure", fnName: name, captures: [], type, loc };
+  }
+  if (lowerer.isStdlibGlobal(expr, "crypto"))
+    return { kind: "libCall", fn: "crypto.native", args: [], type: DYN, loc };
+  const nativeAlias = stdlibGlobalNameOf(lowerer, expr);
+  if (nativeAlias === "Buffer" && expr.text !== "Buffer") {
+    return { kind: "strLit", value: "[builtin Buffer]", type: STRING, loc };
+  }
+  if (lowerer.isStdlibGlobal(expr, "fetch")) {
+    return { kind: "libCall", fn: "fetch.function", args: [], type: DYN, loc };
+  }
+  // The lib fence's IDENTIFIER chokepoint: the real standard library
+  // resolves names the old minimal ambient world never declared
+  // (Symbol, Reflect, Infinity, Date, ...) — and the adopted
+  // @types/node resolves its whole global surface (Buffer, fetch,
+  // setInterval, URL, ...). Reaching one that no lowering above
+  // claimed is SC2020, never an ICE — EXCEPT in JavaScript sources,
+  // where a stdlib global taken as a VALUE (never called through this
+  // path — call sites lower earlier) becomes an opaque IDENTITY TOKEN:
+  // an interned string naming the global. Identity flows (the
+  // harness's knownGlobals Set, === comparisons) are exact — one
+  // global, one token; what a token cannot do (be called, answer
+  // typeof "function") meets per-site fences/divergences, and
+  // SEMANTICS.md documents the stance.
+  if (stdlibGlobalNameOf(lowerer, expr) === "globalThis") {
+    return lowerGlobalValue(lowerer, expr);
+  }
+  {
+    const sym = lowerer.checker.getSymbolAtLocation(expr);
+    if (lowerer.isStdlibSymbol(sym) || expr.text === "globalThis") {
+      if (isJsSourceFile(expr.getSourceFile())) {
+        const canonical = stdlibGlobalNameOf(lowerer, expr) ?? expr.text;
+        return { kind: "strLit", value: `[builtin ${canonical}]`, type: STRING, loc };
+      }
+      // The families with a WHY: each hint states what makes the
+      // surface genuinely non-static (or what to use instead).
+      const globalHints: Record<string, string | undefined> = {
+        Proxy:
+          "Proxy constructor values have no native lowering; use a direct new Proxy with checked-native plain objects",
+        Reflect:
+          "reflective property access has no static lowering — read and call members directly",
+        Intl: 'native Intl supports default Unicode grapheme segmentation and the composed new Intl.NumberFormat("en-US").format(x); locale negotiation and other ICU-backed operations remain unsupported',
+        SharedArrayBuffer: "use direct new SharedArrayBuffer(length) for fixed shared storage",
+        ArrayBuffer:
+          "ArrayBuffer constructor values have no native lowering; use new ArrayBuffer(length) for fixed-length shared storage",
+        WeakRef:
+          "deref()-after-collect exposes GC timing — genuinely dynamic; hold a strong reference instead",
+        FinalizationRegistry:
+          "finalization callbacks expose GC timing — genuinely dynamic; release resources explicitly instead",
+        eval: "runtime code evaluation cannot be compiled ahead of time",
+      };
+      lowerer.noLowering(expr.text, expr, globalHints[expr.text], sym ?? undefined);
+    }
+  }
+  // An ambient global nothing defines compiles to exactly what Node does
+  // at the access: the catchable ReferenceError "<name> is not defined".
+  // Stdlib/@types/node ambients never reach here (their chokepoint
+  // is above); only user-file declares do.
+  {
+    const sym = lowerer.resolveValueSymbol(expr);
+    const decl = sym ? sym.declarations[0] : undefined;
+    if (
+      decl !== undefined &&
+      ts.isVariableDeclaration(decl) &&
+      decl.initializer === undefined &&
+      ts.getCombinedModifierFlags(decl) & ts.ModifierFlags.Ambient
+    ) {
+      const declared = lowerer.mapTypeOf(lowerer.typeOf(expr));
+      if (declared && declared.kind !== "void") {
+        return {
+          kind: "libCall",
+          fn: "global.undefRead",
+          args: [{ kind: "strLit", value: expr.text, type: STRING, loc }],
+          type: declared,
+          loc,
+        };
+      }
+    }
+  }
+  // An ambient `declare function` nothing defines, taken as a VALUE
+  // (call sites lower earlier, in lowerCall): the same story as the
+  // ambient `declare const` above — Node erases the declaration and
+  // the read throws the catchable ReferenceError at the access.
+  {
+    if (ambientUndefinedFnSymbolOf(lowerer, expr)) {
+      const t = ambientUndefReadType(lowerer, expr);
+      if (t) return nsUndefRead(lowerer, expr.text, expr, t);
+    }
+  }
+  // A read of a TRAP binding — a declaration whose own initializer
+  // provably threw (module init unwound there), so this reference can
+  // never execute: any lowering is sound, and the trap keeps the
+  // shape honest. Typed by the use site when it maps, the F64 dummy
+  // otherwise (never observed — never even reached).
+  {
+    const sym = lowerer.resolveValueSymbol(expr);
+    if (sym !== null && lowerer.trapBindings.has(sym)) {
+      const t =
+        ambientUndefReadType(lowerer, expr) ?? contextualUndefReadType(lowerer, expr) ?? F64;
+      return nsUndefRead(lowerer, expr.text, expr, t);
+    }
+  }
+  // A program CLASS NAME as a value: the classRef over the class's
+  // immortal class object (member accesses and construction never
+  // reach here — their hooks claim the property/new forms first).
+  {
+    const sym = lowerer.resolveValueSymbol(expr);
+    const classInfo = sym ? lowerer.classBySymbol.get(sym) : undefined;
+    // A GENERIC class name whose CONTEXTUAL type pins one instantiation
+    // (`const B: new (v: string) => Counter<string> = Counter`): the
+    // value is that instantiation's class object — the generic-fn
+    // pinning rule on the static side. Unpinned references fall
+    // through to classValueRef's family fence.
+    if (classInfo?.generic) {
+      const ctxT = lowerer.checker.getContextualType(expr);
+      const mapped = ctxT ? lowerer.mapTypeOf(ctxT) : null;
+      const instInfo =
+        mapped?.kind === "classval" ? lowerer.classes.get(mapped.className) : undefined;
+      if (instInfo && instInfo.genericInstance?.family === classInfo) {
+        return lowerer.classValueRef(instInfo, expr);
+      }
+    }
+    if (classInfo) {
+      // A decorated name a replacing decorator can REBIND: the value
+      // is the decoration result — the mutable classval global %init
+      // assigned at the class statement (TC39's name binding), never
+      // the declaration's own class object.
+      const decoratedGlobal = classInfo.classDecorators?.valueGlobalId;
+      if (decoratedGlobal !== undefined) {
+        return {
+          kind: "varRef",
+          localId: decoratedGlobal,
+          type: { kind: "classval", className: classInfo.def.name },
+          loc,
+        };
+      }
+      return lowerer.classValueRef(classInfo, expr);
+    }
+    // The enum OBJECT as a value (member reads never reach here — the
+    // access hooks fold them): iteration, storage, reverse lookups
+    // through variables all land on this pointed fence.
+    if (sym) fenceEnumObjectValue(lowerer, expr, sym);
+    // A MIXIN function as a first-class value: no runtime function
+    // exists — calls instantiate a class per call site
+    // (lower-mixins.ts). Generic mixins took the generic-fn value
+    // fence above; this names the non-generic spelling.
+    if (mixinFnOfCallee(lowerer, expr)) {
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        `the mixin function '${expr.text}' as a value (mixin calls compile per call site — call it directly)`,
+      );
+    }
+  }
+  // A NAMESPACE object as a first-class value: members lower at their
+  // qualified access sites; the object itself has no runtime
+  // representation (ambient namespaces compile to Node's
+  // ReferenceError instead — the object never exists at runtime).
+  {
+    const moduleNs = lowerer.mapTypeOf(lowerer.typeOf(expr));
+    if (moduleNs?.kind === "moduleNs") {
+      return { kind: "moduleNsRef", moduleId: moduleNs.moduleId, type: moduleNs, loc };
+    }
+    const builtinNs = lowerer.builtinNamespaceModuleOf(expr);
+    if (builtinNs === "constants") return builtinConstantsObject(lowerer, loc);
+    if (builtinNs !== null) {
+      const type: IrType = { kind: "moduleNs", moduleId: `builtin:${builtinNs}` };
+      return { kind: "moduleNsRef", moduleId: type.moduleId, type, loc };
+    }
+    const ns = lowerNsIdentifierValue(lowerer, expr);
+    if (ns) return ns;
+  }
+  if (isNavigatorGlobal(lowerer, expr)) {
+    refuseNavigator(
+      lowerer,
+      expr,
+      "the navigator object as a value",
+      lowerer.checker.getSymbolAtLocation(expr),
+    );
+  }
+  // Preflight guarantees no unresolved identifiers; anything else here
+  // is a blocked declaration's binding (the SC2004 cascade) or a
+  // binding form we don't model yet.
+  lowerer.rejectUnresolved(
+    expr,
+    `the reference to '${expr.text}' (a binding form with no lowering)`,
+  );
+}
+
+function moduleFileName(lowerer: Lowerer, sf: ts.SourceFile): string {
+  return lowerer.targetPlatform === "wasi"
+    ? (wasiGuestPath(sf.fileName) ?? sf.fileName.replace(/\\/g, "/"))
+    : sf.fileName;
+}
+
+/** Object.keys/Object.entries require an object receiver, but their first
+ * argument is not syntactically a member receiver. Recognize that one
+ * standard-library position so a runtime-optional loop element can be
+ * checked against the checker-narrowed record arm before builtin lowering. */
+function runtimeOptionalObjectWalkerArg(lowerer: Lowerer, expr: ts.Expression): boolean {
+  let arg = expr;
+  while (
+    (ts.isParenthesizedExpression(arg.parent) ||
+      ts.isAssertionExpression(arg.parent) ||
+      ts.isSatisfiesExpression(arg.parent) ||
+      ts.isNonNullExpression(arg.parent)) &&
+    arg.parent.expression === arg
+  ) {
+    arg = arg.parent;
+  }
+  const call = arg.parent;
+  if (
+    !ts.isCallExpression(call) ||
+    call.arguments.nodes[0] !== arg ||
+    !ts.isPropertyAccessExpression(call.expression)
+  )
+    return false;
+  const access = call.expression;
+  return (
+    (access.name.text === "keys" || access.name.text === "entries") &&
+    lowerer.isStdlibMember(access)
+  );
+}
+
+/** A read that resolves to a CJS export-table ACCESSOR property
+ * (`module.exports = { get path() {...}, set path(v) {...} }`): the
+ * getter lifts as a module-level function (module globals need no
+ * captures) — interned per declaration so every read site calls ONE
+ * function — and the read IS the call, Node's per-read evaluation
+ * exactly. Null when the identifier doesn't resolve to such a property
+ * (or it has no getter: a setter-only read answers undefined in Node —
+ * rare enough to keep fenced). */
+function cjsExportAccessorRead(lowerer: Lowerer, ident: ts.Identifier): IrExpr | null {
+  const symbol = lowerer.resolveValueSymbol(ident);
+  const getter = symbol ? symbol.declarations.find(ts.isGetAccessorDeclaration) : undefined;
+  if (!getter) return null;
+  if (!ts.isObjectLiteralExpression(getter.parent) || !isCjsExportTableLiteral(getter.parent)) {
+    return null;
+  }
+  return cjsAccessorCall(lowerer, getter, locOf(ident));
+}
diff --git a/packages/compiler/src/frontend/lowering/expressions/narrowing.ts b/packages/compiler/src/frontend/lowering/expressions/narrowing.ts
new file mode 100644
index 000000000..207000717
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/expressions/narrowing.ts
@@ -0,0 +1,1413 @@
+/* Type narrowing of lowered values, conditional and as-expressions, and runtime-optional receiver reads. */
+import * as ts from "../../ts7/adapter.js";
+import { type Lowerer, dynFallbackType } from "../lowerer.js";
+import {
+  BOOL,
+  CAUGHT,
+  DYN,
+  DYN_HANDLE_KINDS,
+  type IrExpr,
+  type IrLocal,
+  type IrType,
+  NULL_T,
+  type SrcLoc,
+  UNDEFINED_T,
+  arrayOf,
+  canAdaptDynFuncTo,
+  canDynCheckTo,
+  isDynTypedRefType,
+  isUnitType,
+  shapeHasAccessorSlots,
+  typeEquals,
+} from "../../../ir/ir.js";
+import { isJsSourceFile, locOf } from "../../program.js";
+import { hasRuntimeStatics } from "../class-runtime-statics.js";
+import { jsBindingHasOpenWrites } from "../lower-stmts.js";
+import { narrowClassUnion, narrowStoredClassValue, structuralNarrowing } from "../class-unions.js";
+import { checkedClassAssertion, checkedClassUnionAssertion } from "../class-assertions.js";
+import { isOptionalProcessStreamProperty } from "../builtins/process.js";
+import { literalValues } from "../../literal-values.js";
+import { literalUnionArm } from "../../union-discriminants.js";
+import { checkedArmExtraction } from "../coercions/unions.js";
+import { nodeThrowExpr, varRef } from "../../../ir/build.js";
+import { InternalCompilerError } from "../../../errors.js";
+import {
+  hasClassPayload,
+  runtimeOptionalAssertionErases,
+  runtimeOptionalLocalOf,
+  runtimeOptionalUseOf,
+} from "../lower-exprs.js";
+import { isConstAssertionTypeNode, unitOnlyUnion } from "../../type-mapper.js";
+import { assertsGlobalObject, extractionCopiesReference } from "../assertion-identity.js";
+
+/** `c ? a : b`. An explicit destination constructs each branch at that
+ * layout before joining it. Without one, retain the expression's inferred
+ * type and the contextual/sibling rules below. */
+export function lowerTernary(
+  lowerer: Lowerer,
+  expr: ts.ConditionalExpression,
+  expected?: IrType,
+): IrExpr {
+  const loc = locOf(expr);
+  // `Array.isArray(x) ? x : [x]` over a `T | readonly T[]` union: tsc
+  // narrows the TRUE branch to `any[]` (maybeNarrow's isArray bridge
+  // rides that) but leaves the FALSE branch wide — a readonly array
+  // is not assignable to `any[]`, so the arm never subtracts. The
+  // RUNTIME tag test proves the remaining arm exactly, so the false
+  // arm's reads of x narrow to the union's one non-array checker
+  // constituent (the certs configuredTlds shape). Nested functions
+  // stay out (they run later, when the proof is stale — tsc's own
+  // invalidation rule).
+  const falseArmNarrows: ts.Identifier[] = [];
+  let falseArmNarrowType: ts.Type | null = null;
+  {
+    let c: ts.Expression = expr.condition;
+    while (ts.isParenthesizedExpression(c)) c = c.expression;
+    if (
+      ts.isCallExpression(c) &&
+      ts.isPropertyAccessExpression(c.expression) &&
+      c.arguments.nodes.length === 1 &&
+      ts.isIdentifier(c.arguments.nodes[0]!) &&
+      lowerer.stdlibGlobalMember(c.expression, "Array") === "isArray"
+    ) {
+      const argIdent = c.arguments.nodes[0] as ts.Identifier;
+      const sym = lowerer.resolveValueSymbol(argIdent);
+      const t = lowerer.checker.getTypeAtLocation(argIdent);
+      const constituents = t.isUnionType() ? ts.constituentTypes(t) : [];
+      const nonArray = constituents.filter(
+        (a) => !lowerer.checker.isArrayType(a) && !lowerer.checker.isTupleType(a),
+      );
+      const mapped = lowerer.mapTypeOf(t);
+      const armCount = mapped?.kind === "union" ? lowerer.arrayValueTags(mapped.unionId).length : 0;
+      if (sym && nonArray.length === 1 && armCount === 1) {
+        falseArmNarrowType = nonArray[0]!;
+        const collect = (n: ts.Node): void => {
+          if (ts.isFunctionLike(n)) return;
+          if (
+            ts.isIdentifier(n) &&
+            lowerer.resolveValueSymbol(n) === sym &&
+            !lowerer.chainNarrowedType.has(n)
+          ) {
+            falseArmNarrows.push(n);
+          }
+          n.forEachChild(collect);
+        };
+        collect(expr.whenFalse);
+      }
+    }
+  }
+  for (const n of falseArmNarrows) lowerer.chainNarrowedType.set(n, falseArmNarrowType!);
+  try {
+    const cond = lowerer.lowerCondition(expr.condition);
+    // A condition the LOWERING proved constant (typeof-dyn against a
+    // kind no dyn box can hold — the bigint/symbol/function fold): only
+    // the taken arm exists at runtime, so only it lowers — which is
+    // exactly what lets a dual-mode arm with no static lowering (bigint
+    // literals) sit untaken in compiled JS. A boolLit carries no
+    // effects, so dropping the condition read loses nothing.
+    if (cond.kind === "boolLit") {
+      return lowerer.lowerExprExpecting(cond.value ? expr.whenTrue : expr.whenFalse, expected);
+    }
+    if (expected) {
+      // Construct fresh literals in their actual destination. Joining
+      // inferred layouts first can erase the literal discriminator or
+      // choose an empty array's uninhabited element representation.
+      // Runtime-optional proofs apply only within the selected true arm.
+      const then = withRuntimeOptionalNarrowed(
+        lowerer,
+        runtimeOptionalTrueIds(lowerer, expr.condition),
+        () => lowerer.lowerExprExpecting(expr.whenTrue, expected),
+      );
+      const else_ = lowerer.lowerExprExpecting(expr.whenFalse, expected);
+      return { kind: "ternary", cond, then, else_, type: expected, loc };
+    }
+    const ctxTs = lowerer.checker.getContextualType(expr);
+    const ctxMapped = ctxTs ? lowerer.mapTypeOf(ctxTs) : null;
+    // Array-literal arms build directly as the slot's array type when
+    // the ternary sits under an ARRAY context (tsc accepts each arm
+    // covariantly — `[stdin]` types string[] against an
+    // (Uint8Array | string)[] slot — but a tagged element representation
+    // must be BUILT as the slot's element type, the same rule element
+    // expressions follow inside every array literal). And an EMPTY
+    // array-literal arm with no usable type of its own (tsc infers
+    // `never[]`; no mappable contextual type reaches into the arm — the
+    // conditional-spread idiom `[...(c ? [x] : [])]`) adopts the SIBLING
+    // arm's array type: the ternary twin of the union-slot rule in
+    // lowerArrayLiteral, and just as unambiguous — tsc already typed the
+    // whole ternary by the filled arm alone. Both arms empty stays
+    // fenced (no element type exists anywhere).
+    const ctxArray = ctxMapped?.kind === "array" ? ctxMapped : null;
+    const armLiteral = (e: ts.Expression): ts.ArrayLiteralExpression | null => {
+      let x = e;
+      while (ts.isParenthesizedExpression(x)) x = x.expression;
+      return ts.isArrayLiteralExpression(x) ? x : null;
+    };
+    const emptyUntypedArrayArm = (e: ts.Expression): boolean => {
+      const lit = armLiteral(e);
+      if (!lit || lit.elements.nodes.length !== 0) return false;
+      const t = lowerer.checker.getContextualType(lit) ?? lowerer.typeOf(lit);
+      if (!lowerer.mapTypeOf(t)) return true;
+      // never[] MAPS (the f64 representation for the uninhabited) but
+      // carries no element information — an empty literal typed that way
+      // still adopts the sibling arm's array type, tsc's own reading.
+      if (lowerer.checker.isArrayType(t)) {
+        const elem = lowerer.checker.getTypeArguments(t as ts.TypeReference)[0];
+        if (elem !== undefined && elem.flags & ts.TypeFlags.Never) return true;
+      }
+      return false;
+    };
+    // Inferred signature tables often join a populated argument array
+    // with nested empty-array branches. Carry the whole record layout
+    // through those branches before constructing their fresh fields.
+    const ownJoin = lowerer.mapTypeOf(lowerer.typeOf(expr));
+    const recordJoin =
+      ctxMapped?.kind === "record" ? ctxMapped : ownJoin?.kind === "record" ? ownJoin : undefined;
+    const lowerArm = (e: ts.Expression, siblingType?: IrType): IrExpr => {
+      let fresh = e;
+      while (ts.isParenthesizedExpression(fresh)) fresh = fresh.expression;
+      if (recordJoin && ts.isConditionalExpression(fresh))
+        return lowerTernary(lowerer, fresh, recordJoin);
+      if (recordJoin && ts.isObjectLiteralExpression(fresh)) {
+        return lowerer.lowerObjectLiteral(fresh, recordJoin);
+      }
+      const lit = armLiteral(e);
+      if (lit && ctxArray) return lowerer.lowerArrayLiteral(lit, ctxArray);
+      if (lit && siblingType?.kind === "array") {
+        if (emptyUntypedArrayArm(e)) {
+          return { kind: "arrayLit", elems: [], type: siblingType, loc: locOf(lit) };
+        }
+        // A FILLED literal arm whose own element type is a UNION
+        // carrying the sibling's element as an arm (`Array.isArray(x) ?
+        // x : [x]` — the false arm's x checker-types as the whole union
+        // even though the runtime tag proved the non-array arm): build
+        // as the sibling's array type — each element coerces into the
+        // sibling element or fences on its own.
+        const ownT = lowerer.mapTypeOf(lowerer.typeOf(lit));
+        if (
+          ownT?.kind === "array" &&
+          ownT.elem.kind === "union" &&
+          siblingType.elem.kind !== "union" &&
+          lowerer.armTag(ownT.elem.unionId, siblingType.elem) >= 0
+        ) {
+          return lowerer.lowerArrayLiteral(lit, siblingType);
+        }
+        // A FILLED literal arm whose own array type has NO lift into the
+        // sibling's (`isWindows ? ['cmd.exe', ['/d']] : ['pwd', []]` —
+        // the empty nested literal types never[], whose f64-element
+        // representation re-tags into nothing): the generic path could
+        // only fence the whole ternary, so build AS the sibling type —
+        // each element coerces into the sibling's element slot or fences
+        // on its own, and a nested empty literal adopts the slot's array
+        // arm (the union-slot rule). tsc already accepted the arm
+        // covariantly against the join, so a fitting literal is exactly
+        // the value the checker typed.
+        if (
+          ownT?.kind === "array" &&
+          !typeEquals(ownT, siblingType) &&
+          lowerer.widthLiftPlan(ownT, siblingType) === null
+        ) {
+          return lowerer.lowerArrayLiteral(lit, siblingType);
+        }
+      }
+      return lowerer.lowerExpr(e);
+    };
+    // Lower the filled arm first so an empty arm can adopt its type.
+    // When the checker's OWN join for the ternary maps to an ARRAY,
+    // literal arms build against it directly (tsc collapses the arms'
+    // covariant array types into one — `c ? ['sh', []] : ['cmd', ['/d']]`
+    // joins as (string | string[])[] whichever arm nests the empty
+    // literal), so neither arm's uninhabited never[] reading decides.
+    const ownArrayJoin = (() => {
+      const m = lowerer.mapTypeOf(lowerer.typeOf(expr));
+      return m?.kind === "array" ? m : null;
+    })();
+    let thenRaw: IrExpr;
+    let elseRaw: IrExpr;
+    const runtimeTrueIds = runtimeOptionalTrueIds(lowerer, expr.condition);
+    const lowerTrueArm = (): IrExpr =>
+      withRuntimeOptionalNarrowed(lowerer, runtimeTrueIds, () =>
+        lowerArm(expr.whenTrue, ownArrayJoin ?? undefined),
+      );
+    if (!ctxArray && emptyUntypedArrayArm(expr.whenTrue) && !emptyUntypedArrayArm(expr.whenFalse)) {
+      elseRaw = lowerer.lowerExpr(expr.whenFalse);
+      thenRaw = withRuntimeOptionalNarrowed(lowerer, runtimeTrueIds, () =>
+        lowerArm(
+          expr.whenTrue,
+          elseRaw.type.kind === "dyn" && ownArrayJoin ? ownArrayJoin : elseRaw.type,
+        ),
+      );
+    } else {
+      thenRaw = lowerTrueArm();
+      // A checked-dynamic producer (Object.entries(...).filter(...))
+      // can still have a precise checker array type. Empty literal arms
+      // must adopt that element layout before the checked array boundary.
+      elseRaw = lowerArm(
+        expr.whenFalse,
+        thenRaw.type.kind === "dyn" && ownArrayJoin ? ownArrayJoin : thenRaw.type,
+      );
+    }
+    // The ternary's IR type is normally the checker's own: it collapses
+    // same-kind literal unions ("a" | "b" → string) and forms tagged
+    // unions for mixed arms that map (`c ? okRec : errRec`); anything
+    // left unmappable gets the type fence (badType) here. A record/union CONTEXTUAL type
+    // takes over exactly when the own type can't carry the value —
+    // unmappable, or a DIFFERENT union (branch literals omitting
+    // DIFFERENT optional subsets make the own type a union of the
+    // narrower fresh shapes, and a union-typed slot can sub-union the
+    // same way; neither has a runtime re-tag, while tsc guarantees each
+    // branch is assignable to the context). A base-CLASS context absorbs
+    // the same case: branches producing different subclasses make the
+    // own type a class union (`c ? new Dog() : new Bird()` against an
+    // Animal slot), while each branch upcasts into the context fine. A
+    // collapsed own type must WIN over a wider contextual union
+    // (`console.log(c ? "yes" : "no")` stays string against the ambient
+    // string | number | boolean parameter), and an 'unknown'/'any'
+    // context never absorbs the ternary (`JSON.stringify(c ? 1 : 2)`
+    // stays f64-typed). Arms that AGREE on an array type decide it
+    // themselves (a context- or sibling-built literal arm can carry a
+    // tagged element type the checker's own type doesn't spell).
+    const own = lowerer.mapTypeOf(lowerer.typeOf(expr));
+    const useCtx =
+      (ctxMapped?.kind === "record" ||
+        ctxMapped?.kind === "union" ||
+        ctxMapped?.kind === "object") &&
+      (own === null ||
+        (own.kind === "union" &&
+          !typeEquals(own, ctxMapped) &&
+          !lowerer.inLogicalLeftPosition(expr)));
+    // Mixed dyn/unit arms under an unmappable own type (`typeof pkg.name
+    // === "string" ? pkg.name : null` — the lowering world types the
+    // unknown-receiver read `any`, which a static build cannot hold):
+    // dyn represents null and undefined directly, so the ternary stays
+    // dyn — a unit arm converts to the dyn unit value (the dynFrom form
+    // the index-signature lowerings already use). A FRESH literal arm
+    // (`... ? pkg.scripts : {}` — the default-object idiom) converts the
+    // same way when it is JSON-safe: nothing else aliases a literal, so
+    // the dyn copy is unobservable.
+    const dynish = (e: IrExpr): boolean =>
+      e.type.kind === "dyn" ||
+      e.kind === "unitLit" ||
+      ((e.kind === "recordLit" || e.kind === "arrayLit") && lowerer.dynConvertible(e.type));
+    const dynJoin =
+      own === null &&
+      !(useCtx && ctxMapped) &&
+      dynish(thenRaw) &&
+      dynish(elseRaw) &&
+      (thenRaw.type.kind === "dyn" || elseRaw.type.kind === "dyn");
+    // A checker-`any` ternary whose lowered arms are STATIC (`rawName ?
+    // rawName.replace(...) : null` — the dyn-receiver string machinery
+    // answers a static string): the checker's `any` carries no shape,
+    // but the arms do — equal arms take their shared type, a unit arm
+    // joins the other arm as its null/undefined-armed union. Gated on
+    // genuine `any` so every other unmappable keeps its own diagnostic.
+    let anyJoin: IrType | null = null;
+    if (
+      own === null &&
+      !dynJoin &&
+      !(useCtx && ctxMapped) &&
+      (lowerer.typeOf(expr).flags & ts.TypeFlags.Any) !== 0
+    ) {
+      const a = thenRaw.type;
+      const b = elseRaw.type;
+      const staticArm = (t: IrType): boolean =>
+        t.kind !== "dyn" && t.kind !== "caught" && t.kind !== "void";
+      if (staticArm(a) && staticArm(b)) {
+        if (typeEquals(a, b)) {
+          anyJoin = a;
+        } else if (isUnitType(a) !== isUnitType(b)) {
+          const unit = isUnitType(a) ? a : b;
+          const val = isUnitType(a) ? b : a;
+          const arms =
+            val.kind === "union" ? (lowerer.unions.get(val.unionId)?.arms ?? null) : [val];
+          if (arms && !arms.some((x) => typeEquals(x, unit))) {
+            anyJoin = { kind: "union", unionId: lowerer.unions.intern([...arms, unit]) };
+          } else if (arms) {
+            anyJoin = val; // the unit is already an arm
+          }
+        }
+      }
+    }
+    // JavaScript function selection preserves the chosen closure's full
+    // call ABI. A checker join can erase a rest/arguments pack even though
+    // a later call supplies additional observable arguments.
+    const callableJoin =
+      isJsSourceFile(expr.getSourceFile()) &&
+      thenRaw.type.kind === "func" &&
+      elseRaw.type.kind === "func" &&
+      !typeEquals(thenRaw.type, elseRaw.type) &&
+      lowerer.dynConvertible(thenRaw.type) &&
+      lowerer.dynConvertible(elseRaw.type);
+    // JavaScript inference can discard an initially-undefined field from
+    // a conditional's type even after that field acquired other values.
+    // A checked arm must retain its actual representation at the join.
+    const checkedJsJoin =
+      isJsSourceFile(expr.getSourceFile()) &&
+      (thenRaw.type.kind === "dyn" || elseRaw.type.kind === "dyn") &&
+      lowerer.dynConvertible(thenRaw.type) &&
+      lowerer.dynConvertible(elseRaw.type);
+    const type =
+      callableJoin || checkedJsJoin
+        ? DYN
+        : thenRaw.type.kind === "array" && typeEquals(thenRaw.type, elseRaw.type)
+          ? thenRaw.type
+          : dynJoin
+            ? DYN
+            : (anyJoin ?? (useCtx && ctxMapped ? ctxMapped : lowerer.irTypeOf(expr)));
+    // Each arm flows into the ternary's type through the slot-coercion
+    // path: union arms wrap, dyn slots reject the non-dyn arm with
+    // SC1101, mismatched record shapes get SC2002; coerceInto is
+    // inert when the types already agree.
+    const intoDyn = (e: IrExpr): IrExpr =>
+      e.type.kind === "dyn" ? e : { kind: "dynFrom", value: e, type: DYN, loc: e.loc };
+    const then = dynJoin ? intoDyn(thenRaw) : lowerer.coerceInto(expr.whenTrue, thenRaw, type);
+    const else_ = dynJoin ? intoDyn(elseRaw) : lowerer.coerceInto(expr.whenFalse, elseRaw, type);
+    if (then.type.kind !== type.kind || else_.type.kind !== type.kind) {
+      lowerer.badType(expr, lowerer.typeOf(expr));
+    }
+    return { kind: "ternary", cond, then, else_, type, loc };
+  } finally {
+    for (const n of falseArmNarrows) lowerer.chainNarrowedType.delete(n);
+  }
+}
+
+/** Checker-driven union narrowing. tsc's control-flow analysis narrows a
+ * union-typed reference at use sites (`if (r.kind === "ok") { ...r... }`
+ * types `r` as the ok-arm inside the branch); the IR value is still the
+ * tagged union, so the read is bridged with a `unionNarrow` extracting
+ * the arm's payload. The extraction relies on tsc having proven the tag;
+ * backends verify it once and trap on a mismatch, so a wrong proof stops
+ * the program instead of reading another arm. A checker type that maps to
+ * the same union (unnarrowed use), to a SUB-union (partial narrowing —
+ * unrepresentable without a re-tag), or to nothing (`never` in an
+ * exhaustive default) leaves the expression union-typed. */
+export function maybeNarrow(lowerer: Lowerer, expr: IrExpr, node: ts.Node): IrExpr {
+  if (
+    (expr.type.kind === "union" || expr.type.kind === "dyn") &&
+    isJsSourceFile(node.getSourceFile()) &&
+    ts.isPropertyAccessExpression(node)
+  ) {
+    const symbol = lowerer.checker.getSymbolAtLocation(node.name);
+    if (
+      symbol &&
+      symbol.declarations.some(
+        (decl) =>
+          ts.isPropertyDeclaration(decl) &&
+          !decl.initializer &&
+          !decl.type &&
+          isJsSourceFile(decl.getSourceFile()),
+      )
+    ) {
+      // Inference describes later writes, not the initial undefined.
+      // A use that requires the inferred type must validate the value.
+      return expr.type.kind === "dyn"
+        ? expr
+        : { kind: "dynFrom", value: expr, type: DYN, loc: expr.loc };
+    }
+  }
+  // A dyn read tsc narrowed to a SCALAR (a typeof test proved the kind):
+  // bridge with a VALIDATED extraction — dynCheck, the checked-cast
+  // machinery — rather than a trusted one. After the guard the check
+  // never fires; a read smuggled past it throws a catchable TypeError
+  // instead of misreading the payload (the dyn boundary's usual stance).
+  // Object/array narrowings stay dyn-typed and keep their fences.
+  if (expr.type.kind === "dyn") {
+    // An inferred JS member's storage may be deliberately wider than its
+    // declaration (prototype-selected buffers, null-initialized scratch
+    // objects). Extract at the consuming operation, not at the read.
+    if (isJsSourceFile(node.getSourceFile()) && ts.isPropertyAccessExpression(node)) {
+      const receiver = lowerer.mapTypeOf(lowerer.typeOf(node.expression));
+      if (receiver?.kind === "object") {
+        const info = lowerer.classes.get(receiver.className);
+        if (
+          info?.fields.get(node.name.text)?.kind === "dyn" ||
+          lowerer.findMethodOn(info ?? null, `get:${node.name.text}`)?.sig.ret.kind === "dyn"
+        )
+          return expr;
+      }
+      if (receiver?.kind === "classval") {
+        const info = lowerer.classes.get(receiver.className);
+        if (info && hasRuntimeStatics(info)) return expr;
+      }
+    }
+    if (
+      isJsSourceFile(node.getSourceFile()) &&
+      (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node))
+    ) {
+      let receiver = node.expression;
+      while (
+        ts.isPropertyAccessExpression(receiver) ||
+        ts.isElementAccessExpression(receiver) ||
+        ts.isParenthesizedExpression(receiver)
+      ) {
+        if (ts.isPropertyAccessExpression(receiver)) {
+          const owner = lowerer.mapTypeOf(lowerer.typeOf(receiver.expression));
+          if (
+            owner?.kind === "object" &&
+            lowerer.classes.get(owner.className)?.fields.get(receiver.name.text)?.kind === "dyn"
+          )
+            return expr;
+        }
+        receiver = receiver.expression;
+      }
+      if (receiver.kind === ts.SyntaxKind.ThisKeyword && lowerer.resolveThis()?.type.kind === "dyn")
+        return expr;
+      if (ts.isIdentifier(receiver)) {
+        const stored = lowerer.peekLocal(receiver)?.type ?? lowerer.globalOf(receiver)?.type;
+        if (stored?.kind === "dyn") return expr;
+        const symbol = lowerer.resolveValueSymbol(receiver);
+        const bound = symbol && lowerer.implicitParamTypes?.get(symbol);
+        if (bound && lowerer.mapTypeOf(bound)?.kind === "dyn") return expr;
+      }
+    }
+    if (isJsSourceFile(node.getSourceFile()) && ts.isIdentifier(node)) {
+      const symbol = lowerer.resolveValueSymbol(node);
+      if (
+        symbol &&
+        symbol.declarations.some(
+          (decl) =>
+            ts.isParameter(decl) &&
+            ts.isMethodDeclaration(decl.parent) &&
+            lowerer.checkedVirtualJsMethods.has(decl.parent),
+        )
+      )
+        return expr;
+      if (
+        symbol &&
+        symbol.declarations.some(
+          (decl) => ts.isParameter(decl) && ts.isConstructorDeclaration(decl.parent),
+        )
+      )
+        return expr;
+      if (
+        symbol &&
+        symbol.declarations.some(
+          (decl) => ts.isVariableDeclaration(decl) && jsBindingHasOpenWrites(lowerer, decl),
+        )
+      )
+        return expr;
+      if (
+        symbol &&
+        symbol.declarations.some(
+          (decl) =>
+            ts.isParameter(decl) &&
+            decl.initializer &&
+            !decl.type &&
+            !/@(?:param|type)\b/.test(
+              decl.getSourceFile().text.slice(decl.parent?.pos ?? decl.pos, decl.getStart()),
+            ),
+        )
+      )
+        return expr;
+      if (
+        symbol &&
+        symbol.declarations.some((decl) => {
+          if (!ts.isParameter(decl) || decl.type) return false;
+          const fn = decl.parent;
+          if (!ts.isFunctionExpression(fn) && !ts.isArrowFunction(fn)) return false;
+          const assignment = fn.parent;
+          return (
+            ts.isBinaryExpression(assignment) &&
+            assignment.right === fn &&
+            ts.isPropertyAccessExpression(assignment.left) &&
+            assignment.left.name.text === "write" &&
+            lowerer.isStdlibMember(assignment.left)
+          );
+        })
+      )
+        return expr;
+    }
+    // Node's TTY declarations promise booleans/numbers even when a pipe
+    // has no such property. Preserve the checked read for JS capability
+    // probes instead of treating a declaration as a runtime type guard.
+    if (
+      isJsSourceFile(node.getSourceFile()) &&
+      ts.isPropertyAccessExpression(node) &&
+      ["isTTY", "columns", "rows"].includes(node.name.text) &&
+      lowerer.isStdlibMember(node)
+    )
+      return expr;
+    // A null-initialized JS field can later receive an object even when
+    // checker flow calls its non-null branch never. The live checked
+    // value remains authoritative; never is not a numeric guard.
+    if (
+      isJsSourceFile(node.getSourceFile()) &&
+      (lowerer.typeOf(node).flags & ts.TypeFlags.Never) !== 0
+    )
+      return expr;
+    const narrowed = lowerer.mapTypeOf(lowerer.typeOf(node));
+    if (
+      narrowed &&
+      (narrowed.kind === "f64" ||
+        narrowed.kind === "bool" ||
+        narrowed.kind === "string" ||
+        narrowed.kind === "bigint")
+    ) {
+      return { kind: "dynCheck", value: expr, type: narrowed, loc: expr.loc };
+    }
+    // An instanceof narrow retains the native view after validating its
+    // exact element kind. Buffer also matches Uint8Array.
+    if (narrowed?.kind === "bytes" || narrowed?.kind === "url") {
+      return { kind: "dynCheck", value: expr, type: narrowed, loc: expr.loc };
+    }
+    // An `instanceof Error` narrow: the checked-dynamic tree's error encoding rebuilds a
+    // fresh %Error (name/message/code from the marker object — a COPY,
+    // the unknown boundary's stance; SEMANTICS.md 67), validated like
+    // every dyn extraction.
+    if (narrowed?.kind === "object" && narrowed.className === "%Error") {
+      return { kind: "dynCheck", value: expr, type: narrowed, loc: expr.loc };
+    }
+    return expr;
+  }
+  // instanceof narrowing for classes: tsc types this USE as a subclass of
+  // the IR value's class (only a dynamic instanceof test narrows a class
+  // type), so the read bridges with a static downcast that backends verify
+  // at run time, like the union bridge below.
+  if (expr.type.kind === "object") {
+    const narrowed = lowerer.mapTypeOf(lowerer.typeOf(node));
+    if (narrowed?.kind === "union") {
+      const union = narrowClassUnion(lowerer, expr, narrowed);
+      if (union) return union;
+    }
+    if (
+      narrowed?.kind === "object" &&
+      narrowed.className !== expr.type.className &&
+      lowerer.isSubclassOf(narrowed.className, expr.type.className)
+    ) {
+      const reduced = structuralNarrowing(lowerer, node, expr.type.className, narrowed);
+      const union = reduced ? narrowClassUnion(lowerer, expr, reduced) : null;
+      if (union) return union;
+      if (lowerer.narrowing.untrusted(node, narrowed)) {
+        const checked = checkedClassAssertion(lowerer, expr, narrowed, expr.loc);
+        if (checked) return checked;
+      }
+      return { kind: "downcast", value: expr, type: narrowed, loc: expr.loc };
+    }
+    return expr;
+  }
+  if (expr.type.kind !== "union") return expr;
+  if (ts.isPropertyAccessExpression(node) && isOptionalProcessStreamProperty(lowerer, node))
+    return expr;
+
+  // Represented fields and index values can include undefined even when
+  // checker inference or lib.d.ts declares strings (RegExp captures).
+  // Only a declaration that represents the optional arm can provide a
+  // trustworthy flow narrowing; otherwise consumers must check it.
+  if (
+    (expr.kind === "recordGet" || expr.kind === "recordKeyGet") &&
+    (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node))
+  ) {
+    // The read itself rules out a null or undefined receiver, which a
+    // JavaScript receiver such as `m.groups` still declares.
+    const receiver = lowerer.mapTypeOf(
+      lowerer.checker.getNonNullableType(lowerer.typeOf(node.expression)),
+    );
+    const shape = receiver?.kind === "record" ? lowerer.shapes.get(receiver.shapeId) : undefined;
+    const declared =
+      expr.kind === "recordGet"
+        ? shape?.fields.find((field) => field.name === expr.field)?.type
+        : shape?.indexValue;
+    if (
+      lowerer.armTag(expr.type.unionId, UNDEFINED_T) >= 0 &&
+      declared &&
+      !(declared.kind === "union" && lowerer.armTag(declared.unionId, UNDEFINED_T) >= 0)
+    )
+      return expr;
+    // The same for a field holding a Date's toJSON() result, whose null
+    // the declared string does not represent.
+    if (
+      expr.kind === "recordGet" &&
+      lowerer.isRuntimeOptionalField(expr.shapeId, expr.field) &&
+      lowerer.armTag(expr.type.unionId, NULL_T) >= 0 &&
+      declared &&
+      !(declared.kind === "union" && lowerer.armTag(declared.unionId, NULL_T) >= 0)
+    )
+      return expr;
+  }
+  if (ts.isIdentifier(node)) {
+    const symbol = lowerer.resolveValueSymbol(node);
+    if (symbol && lowerer.unstableSwitchBindings.has(symbol)) return expr;
+    // A binding initialized by a Date's toJSON() can hold null where the
+    // checker says string; consumers check it.
+    if (symbol && lowerer.dateJsonBindings.has(symbol)) return expr;
+  }
+  if (
+    ts.isPropertyAccessExpression(node) &&
+    getterResultHoldsUndeclaredUndefined(lowerer, node, expr)
+  )
+    return expr;
+  const narrowedTs = lowerer.typeOf(node);
+  const narrowed = lowerer.mapTypeOf(narrowedTs);
+  // `Array.isArray(u)` on a union with one readonly array/tuple arm: the
+  // lib predicate narrows to `any[]`, possibly intersected with another
+  // type. That mapping may be a checked value or a synthetic record, but
+  // the tag test proved the union's one array-valued arm, so bridge to it
+  // with the same trusted unionNarrow the mapped case below builds.
+  if (lowerer.checkerAnyArrayType(narrowedTs)) {
+    const def = lowerer.unions.get(expr.type.unionId);
+    const arrayTags = lowerer.arrayValueTags(expr.type.unionId);
+    if (arrayTags.length === 1) {
+      const arm = def!.arms[arrayTags[0]!]!;
+      const checked = checkedStaleArm(lowerer, node, expr, arrayTags[0]!, arm);
+      if (checked) return checked;
+      return {
+        kind: "unionNarrow",
+        unionId: expr.type.unionId,
+        tag: arrayTags[0]!,
+        value: expr,
+        type: arm,
+        loc: expr.loc,
+      };
+    }
+  }
+  // A checker type narrowed to a UNIT arm (the `=== undefined` branch)
+  // also stays union-typed: a unit arm has no payload to extract, and
+  // nothing useful reads such a value anyway. (Standalone undefined maps
+  // to void and standalone null to nothing, so the isUnitType guard is
+  // defensive.)
+  if (!narrowed || narrowed.kind === "union" || narrowed.kind === "void" || isUnitType(narrowed)) {
+    return expr;
+  }
+  const tag = lowerer.armTag(expr.type.unionId, narrowed);
+  if (tag < 0) {
+    // The checker may refine fields inside a discriminated record too.
+    // That creates a different mapped shape, but does not change the
+    // stored payload layout. A required literal discriminator proves
+    // which original arm to read; retain all of that arm's field types.
+    const def = lowerer.unions.get(expr.type.unionId);
+    if (narrowed.kind === "record" && def?.discriminant) {
+      const property = lowerer.checker.getPropertyOfType(narrowedTs, def.discriminant.field);
+      if (
+        property &&
+        !(
+          property.flags &
+          (ts.SymbolFlags.Optional | ts.SymbolFlags.GetAccessor | ts.SymbolFlags.SetAccessor)
+        )
+      ) {
+        const values = literalValues(lowerer.checker.getTypeOfSymbol(property));
+        const arm = values && literalUnionArm(def, values, (id) => lowerer.shapes.get(id));
+        if (arm) {
+          const checked = checkedStaleArm(
+            lowerer,
+            node,
+            expr,
+            lowerer.armTag(expr.type.unionId, arm),
+            arm,
+          );
+          if (checked) return checked;
+          return {
+            kind: "unionNarrow",
+            unionId: expr.type.unionId,
+            tag: lowerer.armTag(expr.type.unionId, arm),
+            value: expr,
+            type: arm,
+            loc: expr.loc,
+          };
+        }
+      }
+    }
+    // A base-class arm can narrow to a subclass after instanceof. The
+    // payload retains its base-class tag even when the union also has
+    // records or other classes. Require one unambiguous containing arm.
+    const arms = lowerer.unions.get(expr.type.unionId)?.arms ?? [];
+    const valueTag =
+      narrowed.kind === "object"
+        ? arms.findIndex(
+            (arm) =>
+              arm.kind === "object" && lowerer.isSubclassOf(narrowed.className, arm.className),
+          )
+        : -1;
+    const valueType = arms[valueTag];
+    if (
+      narrowed.kind === "object" &&
+      valueType?.kind === "object" &&
+      arms.every(
+        (arm, i) =>
+          i === valueTag ||
+          arm.kind !== "object" ||
+          !lowerer.isSubclassOf(narrowed.className, arm.className),
+      ) &&
+      lowerer.isSubclassOf(narrowed.className, valueType.className)
+    ) {
+      const checked = checkedStaleArm(lowerer, node, expr, valueTag, valueType, narrowed);
+      if (checked) {
+        return checkedClassAssertion(lowerer, checked, narrowed, expr.loc) ?? checked;
+      }
+      return {
+        kind: "downcast",
+        value: {
+          kind: "unionNarrow",
+          unionId: expr.type.unionId,
+          tag: valueTag,
+          value: expr,
+          type: valueType,
+          loc: expr.loc,
+        },
+        type: narrowed,
+        loc: expr.loc,
+      };
+    }
+    return expr;
+  }
+  const checked = checkedStaleArm(lowerer, node, expr, tag, narrowed);
+  if (checked) return checked;
+  return {
+    kind: "unionNarrow",
+    unionId: expr.type.unionId,
+    tag,
+    value: expr,
+    type: narrowed,
+    loc: expr.loc,
+  };
+}
+
+/** A getter read whose runtime result can be undefined (an unchecked
+ * element read in its body, or in another member of its override family)
+ * although its declared type cannot. The checker's type for the read is
+ * then no narrowing proof, so the read keeps the getter's result. */
+function getterResultHoldsUndeclaredUndefined(
+  lowerer: Lowerer,
+  node: ts.PropertyAccessExpression,
+  expr: IrExpr,
+): boolean {
+  if (expr.type.kind !== "union" || lowerer.armTag(expr.type.unionId, UNDEFINED_T) < 0)
+    return false;
+  const getter =
+    (expr.kind === "virtualCall" && expr.method.startsWith("get:")) ||
+    (expr.kind === "call" && expr.callee.includes(".get:"));
+  if (!getter) return false;
+  const symbol = lowerer.checker.getSymbolAtLocation(node.name);
+  if (!symbol || (symbol.flags & ts.SymbolFlags.GetAccessor) === 0) return false;
+  const declared = lowerer.checker.getTypeOfSymbol(symbol);
+  const holdsUndefined = (type: ts.Type): boolean =>
+    (type.flags &
+      (ts.TypeFlags.Undefined | ts.TypeFlags.Void | ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !==
+    0;
+  return !(
+    holdsUndefined(declared) ||
+    (declared.isUnionType() && ts.constituentTypes(declared).some(holdsUndefined))
+  );
+}
+
+/** The checked form of maybeNarrow's arm extraction for a narrowing the
+ * checker may hold past code that replaced the value (a call clearing the
+ * property; see NarrowingStability). Every other arm throws the TypeError
+ * Node raises for the operation consuming the read (`Cannot read
+ * properties of undefined (reading 'x')`, `o.f is not a function`), or the
+ * stranded-value TypeError where Node would carry the value on. Null when
+ * the narrowing is provably current. `narrowed` is the checker's type when
+ * it refines the arm (a subclass view). */
+function checkedStaleArm(
+  lowerer: Lowerer,
+  node: ts.Node,
+  value: IrExpr,
+  tag: number,
+  arm: IrType,
+  narrowed: IrType = arm,
+): IrExpr | null {
+  if (value.type.kind !== "union" || tag < 0) return null;
+  if (!lowerer.narrowing.untrusted(node, narrowed)) return null;
+  const inPlace = checkedArmExtraction(lowerer, value, tag, arm, (found) =>
+    staleReadMessage(node, found),
+  );
+  if (inPlace) return inPlace;
+  const helper = lowerer.narrowedArmHelper(value.type.unionId, arm, value.loc);
+  return helper ? lowerer.checkedNarrowCall(helper, value, arm, value.loc) : null;
+}
+
+/** V8's spelling of a callee in "is not a function": a string-literal
+ * element key reads as a property name (`o["a"]` is `o.a`), other keys
+ * keep their brackets. */
+export function v8CalleeText(node: ts.Node): string {
+  if (ts.isElementAccessExpression(node)) {
+    const key = node.argumentExpression;
+    const object = v8CalleeText(node.expression);
+    return ts.isStringLiteral(key) || ts.isNoSubstitutionTemplateLiteral(key)
+      ? `${object}.${key.text}`
+      : `${object}[${key.getText()}]`;
+  }
+  if (ts.isPropertyAccessExpression(node) && !node.questionDotToken)
+    return `${v8CalleeText(node.expression)}.${node.name.text}`;
+  return node.getText();
+}
+
+/** Node's TypeError for the operation consuming `node` when it holds a
+ * value of type `found`, or null where Node would not throw. */
+function staleReadMessage(node: ts.Node, found: IrType): string | null {
+  let child: ts.Node = node;
+  let parent = node.parent;
+  while (ts.isParenthesizedExpression(parent)) {
+    child = parent;
+    parent = parent.parent;
+  }
+  if (ts.isCallExpression(parent) && parent.expression === child && !parent.questionDotToken) {
+    return found.kind === "func" ? null : `${v8CalleeText(node)} is not a function`;
+  }
+  const unit = found.kind === "undefinedT" ? "undefined" : found.kind === "nullT" ? "null" : null;
+  if (unit === null) return null;
+  if (
+    !(ts.isPropertyAccessExpression(parent) || ts.isElementAccessExpression(parent)) ||
+    parent.expression !== child ||
+    parent.questionDotToken
+  )
+    return null;
+  let key: string | null = null;
+  if (ts.isPropertyAccessExpression(parent)) key = parent.name.text;
+  else if (ts.isStringLiteral(parent.argumentExpression)) key = parent.argumentExpression.text;
+  else if (ts.isNumericLiteral(parent.argumentExpression))
+    key = String(Number(parent.argumentExpression.text));
+  if (key === null) return null;
+  const store = parent.parent;
+  return ts.isBinaryExpression(store) &&
+    store.left === parent &&
+    store.operatorToken.kind === ts.SyntaxKind.EqualsToken
+    ? `Cannot set properties of ${unit} (setting '${key}')`
+    : `Cannot read properties of ${unit} (reading '${key}')`;
+}
+
+/** A runtime-optional slot can be assigned while a truthy guard is in
+ * force. TypeScript then types a direct member receiver as the plain arm,
+ * even though an OOB-safe assignment may have restored undefined. Check
+ * that hidden arm and throw the member-read TypeError Node would produce. */
+export function runtimeOptionalReceiverRead(
+  lowerer: Lowerer,
+  expr: ts.Identifier,
+  local: IrLocal,
+  property: string | null,
+  loc: SrcLoc,
+): IrExpr {
+  if (local.type.kind !== "union") {
+    lowerer.runtimeOptionalLocals.delete(local);
+    lowerer.runtimeOptionalStorageLocals.delete(local);
+    return varRef(local.id, local.type, loc);
+  }
+  // A non-null/type assertion around the receiver carries the useful
+  // checker narrowing on the wrapper rather than on the identifier token
+  // itself (`gg!.day`). Follow only erased wrappers; the member/call node
+  // still receives the checked extraction built below.
+  let narrowedNode: ts.Expression = expr;
+  while (
+    (ts.isParenthesizedExpression(narrowedNode.parent) ||
+      ts.isAssertionExpression(narrowedNode.parent) ||
+      ts.isSatisfiesExpression(narrowedNode.parent) ||
+      ts.isNonNullExpression(narrowedNode.parent)) &&
+    narrowedNode.parent.expression === narrowedNode
+  ) {
+    narrowedNode = narrowedNode.parent;
+  }
+  const narrowed = lowerer.mapTypeOf(lowerer.typeOf(narrowedNode));
+  if (!narrowed || isUnitType(narrowed)) {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      "a runtime-optional capture whose narrowed value type is not representable",
+    );
+  }
+  if (narrowed.kind === "union") {
+    const classView = narrowStoredClassValue(lowerer, varRef(local.id, local.type, loc), narrowed);
+    if (classView) return classView;
+    // The checker may keep the receiver at the storage union unchanged
+    // (`string | undefined` on a JS `.match()` call). There is no
+    // sub-union to re-tag: preserve the value for the downstream
+    // nullable-receiver lowering, which performs the member-specific
+    // checked extraction. Refusing here deferred the whole statement to
+    // a runtime fence before that lowering could run.
+    if (typeEquals(local.type, narrowed)) {
+      return varRef(local.id, local.type, loc);
+    }
+    // A captured array element can itself be a union of records (for
+    // example Circle | Square). The optional storage union has one extra
+    // undefined arm; re-tag it to the checker-narrowed value union with a
+    // checked trap for that arm, then let union property lowering inspect
+    // the surviving record arms.
+    const helper = lowerer.narrowedRetagHelper(
+      narrowedNode,
+      local.type.unionId,
+      narrowed.unionId,
+      loc,
+    );
+    if (!helper) {
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        "a runtime-optional capture whose narrowed union is not representable",
+      );
+    }
+    return {
+      kind: "call",
+      callee: helper,
+      args: [varRef(local.id, local.type, loc)],
+      type: narrowed,
+      loc,
+    };
+  }
+  if (narrowed.kind === "object") {
+    const view = checkedClassAssertion(lowerer, varRef(local.id, local.type, loc), narrowed, loc);
+    // Preserve the member-specific missing-value error on the two-arm
+    // path below; mixed storage also needs to validate its concrete class.
+    if (view && (lowerer.unions.get(local.type.unionId)?.arms.length ?? 0) > 2) return view;
+  }
+  const undefTag = lowerer.armTag(local.type.unionId, UNDEFINED_T);
+  const def = lowerer.unions.get(local.type.unionId);
+  if (!def || undefTag < 0)
+    throw new InternalCompilerError("runtime-optional local is missing its undefined arm");
+  if (def.arms.length !== 2) {
+    // The checker may narrow a runtime-optional capture to one arm of a
+    // value union (`Circle | Square | undefined` -> `Circle`). The
+    // two-arm fast path below cannot extract that arm safely: a later
+    // array mutation can leave any of the stored tags in the slot. Use
+    // the checked helper so every other arm, including undefined, remains
+    // a catchable TypeError rather than an unchecked payload read.
+    const helper = lowerer.narrowedArmHelper(local.type.unionId, narrowed, loc);
+    if (!helper) {
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        "a direct read from a runtime-optional capture with multiple value arms",
+      );
+    }
+    return lowerer.checkedNarrowCall(helper, varRef(local.id, local.type, loc), narrowed, loc);
+  }
+  // A predicate can strengthen a record's fields or narrow a base class
+  // to a subclass without changing the slot's stored value arm. Extract
+  // that actual arm first: record reads need its original field layout,
+  // and class reads apply the ordinary downcast bridge afterward.
+  const valueTag = undefTag === 0 ? 1 : 0;
+  const valueType = def.arms[valueTag];
+  if (!valueType || isUnitType(valueType)) {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      "a runtime-optional receiver without a representable value arm",
+    );
+  }
+  const message =
+    property === null
+      ? `${expr.text} is not a function`
+      : `Cannot read properties of undefined (reading '${property}')`;
+  return lowerer.maybeNarrow(
+    {
+      kind: "ternary",
+      cond: {
+        kind: "unionIsTag",
+        unionId: local.type.unionId,
+        tag: undefTag,
+        negated: false,
+        value: varRef(local.id, local.type, loc),
+        type: BOOL,
+        loc,
+      },
+      then: nodeThrowExpr(1, "", message, valueType, loc),
+      else_: {
+        kind: "unionNarrow",
+        unionId: local.type.unionId,
+        tag: valueTag,
+        value: varRef(local.id, local.type, loc),
+        type: valueType,
+        loc,
+      },
+      type: valueType,
+      loc,
+    },
+    narrowedNode,
+  );
+}
+
+export function runtimeOptionalTrueIds(lowerer: Lowerer, node: ts.Expression): IrLocal[] {
+  return runtimeOptionalGuardIds(lowerer, node, true);
+}
+
+/** Presence proved by one outcome of a boolean guard. Negation flips
+ * the outcome; all operands of a true AND or false OR have that outcome.
+ * Assignments invalidate a syntactic proof even when checker types hide
+ * the undefined produced by an out-of-bounds read. */
+export function runtimeOptionalGuardIds(
+  lowerer: Lowerer,
+  node: ts.Expression,
+  truthy: boolean | null,
+): IrLocal[] {
+  const candidates: IrLocal[] = [];
+  const collect = (expr: ts.Expression, outcome: boolean | null): void => {
+    if (ts.isParenthesizedExpression(expr)) return collect(expr.expression, outcome);
+    if (ts.isPrefixUnaryExpression(expr) && expr.operator === ts.SyntaxKind.ExclamationToken) {
+      return collect(expr.operand, outcome === null ? null : !outcome);
+    }
+    if (
+      ts.isBinaryExpression(expr) &&
+      ((outcome === true && expr.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken) ||
+        (outcome === false && expr.operatorToken.kind === ts.SyntaxKind.BarBarToken))
+    ) {
+      collect(expr.left, outcome);
+      collect(expr.right, outcome);
+    } else if (ts.isPropertyAccessExpression(expr) && !expr.questionDotToken) {
+      // A completed ordinary member read checked its receiver even if
+      // the property's value was falsy. Optional chains make no such
+      // promise, and calls/captures retain their separate checked ABI.
+      const local = runtimeOptionalLocalOf(lowerer, expr.expression);
+      if (local !== null) candidates.push(local);
+      else if (ts.isPropertyAccessExpression(expr.expression)) collect(expr.expression, outcome);
+    } else if (
+      ts.isBinaryExpression(expr) &&
+      expr.operatorToken.kind !== ts.SyntaxKind.AmpersandAmpersandToken &&
+      expr.operatorToken.kind !== ts.SyntaxKind.BarBarToken &&
+      expr.operatorToken.kind !== ts.SyntaxKind.QuestionQuestionToken
+    ) {
+      // Both operands of a comparison/arithmetic operator are evaluated.
+      // Only member reads prove presence; bare identifiers need truth.
+      const member = (operand: ts.Expression): void => {
+        while (ts.isParenthesizedExpression(operand)) operand = operand.expression;
+        if (ts.isPropertyAccessExpression(operand)) collect(operand, outcome);
+      };
+      member(expr.left);
+      member(expr.right);
+      const op = expr.operatorToken.kind;
+      const equal =
+        op === ts.SyntaxKind.EqualsEqualsEqualsToken || op === ts.SyntaxKind.EqualsEqualsToken;
+      const unequal =
+        op === ts.SyntaxKind.ExclamationEqualsEqualsToken ||
+        op === ts.SyntaxKind.ExclamationEqualsToken;
+      if ((equal && outcome === false) || (unequal && outcome === true)) {
+        const present = (value: ts.Expression, unit: ts.Expression): void => {
+          while (ts.isParenthesizedExpression(unit)) unit = unit.expression;
+          const excludesUndefined =
+            (ts.isIdentifier(unit) &&
+              unit.text === "undefined" &&
+              (lowerer.typeOf(unit).flags & ts.TypeFlags.Undefined) !== 0) ||
+            (unit.kind === ts.SyntaxKind.NullKeyword &&
+              (op === ts.SyntaxKind.EqualsEqualsToken ||
+                op === ts.SyntaxKind.ExclamationEqualsToken));
+          if (excludesUndefined) {
+            const local = runtimeOptionalLocalOf(lowerer, value);
+            if (local !== null) candidates.push(local);
+          }
+        };
+        present(expr.left, expr.right);
+        present(expr.right, expr.left);
+      }
+    } else if (outcome) {
+      const local = runtimeOptionalLocalOf(lowerer, expr);
+      if (local !== null) candidates.push(local);
+    }
+  };
+  collect(node, truthy);
+  if (candidates.length === 0) return candidates;
+  const assigned = new Set<IrLocal>();
+  const visit = (part: ts.Node): void => {
+    if (ts.isFunctionLike(part)) return;
+    let target: ts.Node | null = null;
+    if (
+      ts.isBinaryExpression(part) &&
+      part.operatorToken.kind >= ts.SyntaxKind.FirstAssignment &&
+      part.operatorToken.kind <= ts.SyntaxKind.LastAssignment
+    )
+      target = part.left;
+    if (
+      (ts.isPrefixUnaryExpression(part) || ts.isPostfixUnaryExpression(part)) &&
+      (part.operator === ts.SyntaxKind.PlusPlusToken ||
+        part.operator === ts.SyntaxKind.MinusMinusToken)
+    )
+      target = part.operand;
+    if (target !== null) {
+      // Destructuring assignments can contain several identifiers.
+      const mark = (name: ts.Node): void => {
+        if (ts.isIdentifier(name)) {
+          const local = lowerer.resolveLocal(name);
+          if (local) assigned.add(lowerer.runtimeOptionalRootOf(local));
+        }
+        ts.forEachChild(name, mark);
+      };
+      mark(target);
+    }
+    ts.forEachChild(part, visit);
+  };
+  visit(node);
+  return candidates.filter((local) => !assigned.has(lowerer.runtimeOptionalRootOf(local)));
+}
+
+export function withRuntimeOptionalNarrowed<T>(
+  lowerer: Lowerer,
+  locals: readonly IrLocal[],
+  fn: () => T,
+): T {
+  if (locals.length === 0) return fn();
+  for (const local of locals)
+    lowerer.runtimeOptionalLocals.delete(lowerer.runtimeOptionalRootOf(local));
+  try {
+    return fn();
+  } finally {
+    for (const local of locals)
+      lowerer.runtimeOptionalLocals.add(lowerer.runtimeOptionalRootOf(local));
+  }
+}
+
+/** `x as T`. Non-dyn inner values ordinarily erase; a record assertion
+ * changing monomorphic shape rebuilds through the established width-copy
+ * path so its represented value agrees with its asserted type.
+ * A dyn ('unknown') inner value makes this THE dynamic boundary:
+ * - `as unknown` (dyn → dyn) stays erasure;
+ * - dyn → a JSON-representable target type T compiles to `dynCheck`, a
+ *   runtime validation that builds the typed value or THROWS a catchable
+ *   TypeError-flavored error (JS `as` never checks — the headline
+ *   documented divergence: a lying cast throws instead of corrupting
+ *   memory);
+ * - dyn → anything else (closures, class instances, void) is rejected:
+ *   those types cannot be found inside a JSON dyn. */
+/** `e as T` and the old-style assertion `<T>e` — one node shape (both
+ * carry `.type` and `.expression`), one lowering. */
+export function lowerAsExpression(
+  lowerer: Lowerer,
+  expr: ts.AsExpression | ts.TypeAssertion,
+): IrExpr {
+  // `[] as const` — tsgo panics computing the expression's `readonly []`
+  // type (the facade's fence answers `any`), but the syntax pins the
+  // value exactly: the empty tuple, ridden as the unit-element array
+  // (mapType's empty-tuple rule). Lower it directly; enclosing slots
+  // coerce like any other empty-array source.
+  if (
+    ts.isAsExpression(expr) &&
+    isConstAssertionTypeNode(expr.type) &&
+    ts.isArrayLiteralExpression(expr.expression) &&
+    expr.expression.elements.nodes.length === 0
+  ) {
+    return {
+      kind: "arrayLit",
+      elems: [],
+      type: arrayOf(unitOnlyUnion(lowerer.unions)),
+      loc: locOf(expr),
+    };
+  }
+  // `e as C` on a CATCH BINDING (`(err as Error).message`): the checked
+  // extraction — an instanceof match extracts the payload, anything else
+  // throws the catchable TypeError (dynCheck's trust-but-verify stance,
+  // extended to exception payloads). Intercepts BEFORE lowerExpr — the
+  // raw read would hit caughtRead's narrowness fence.
+  const caughtLocal = lowerer.caughtLocalOf(expr.expression);
+  if (caughtLocal) {
+    const loc = locOf(expr);
+    const targetTs = lowerer.checker.getTypeFromTypeNode(expr.type);
+    const target = lowerer.mapTypeOf(targetTs);
+    if (target?.kind === "object") {
+      const info = lowerer.classes.get(target.className);
+      if (info && lowerer.inHierarchy(info)) {
+        return {
+          kind: "caughtCheck",
+          value: { kind: "varRef", localId: caughtLocal.id, type: CAUGHT, loc },
+          className: target.className,
+          type: target,
+          loc,
+        };
+      }
+    }
+    // Structural assertions use the ordinary checked dynamic bridge. It
+    // retains primitive values and native class identity before validating
+    // the requested shape; an assertion does not bypass runtime checks.
+    const narrowed = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+    const bridged =
+      narrowed &&
+      (narrowed.kind === "f64" ||
+        narrowed.kind === "bool" ||
+        narrowed.kind === "string" ||
+        narrowed.kind === "object" ||
+        narrowed.kind === "dyn");
+    if (!bridged) lowerer.unsupported("SC1063", expr);
+  }
+  const inner = lowerer.lowerExpr(expr.expression);
+  const use = runtimeOptionalUseOf(expr);
+  if (inner.type.kind === "union" && runtimeOptionalAssertionErases(lowerer, expr, inner, use))
+    return inner;
+  if (inner.type.kind !== "dyn") {
+    const targetTs0 = lowerer.checker.getTypeFromTypeNode(expr.type);
+    const target = lowerer.mapTypeOf(targetTs0);
+    if (target?.kind === "object") {
+      const asserted = checkedClassAssertion(lowerer, inner, target, locOf(expr));
+      if (asserted) return asserted;
+    }
+    // Unknown-only record views use the checked-dynamic representation.
+    // A native record asserted to such a view still denotes the original
+    // object. Box a live reference instead of erasing the assertion and
+    // handing native storage to a checked-dynamic property operation.
+    if (target?.kind === "dyn" && (targetTs0.flags & ts.TypeFlags.Object) !== 0) {
+      // A class instance asserted to a class-backed protocol view (a type
+      // class instances flow into): the same identity-keeping box an
+      // implicit flow into the view uses.
+      if (inner.type.kind === "object" && lowerer.classImplementedProtocol(targetTs0))
+        return lowerer.coerceInto(expr, inner, DYN);
+      const sourceShape =
+        inner.type.kind === "record" ? lowerer.shapes.get(inner.type.shapeId) : undefined;
+      if (
+        hasClassPayload(lowerer, inner.type) ||
+        (sourceShape && shapeHasAccessorSlots(sourceShape))
+      ) {
+        lowerer.unsupported(
+          "SC1090",
+          expr,
+          "opaque structural views of classes or accessor records (name the property's concrete type to retain native accessor dispatch)",
+        );
+      }
+      const boxed = lowerer.coerceInto(expr, inner, DYN);
+      // Only references box live; a scalar or unit source (`value as
+      // unknown as View`) is an ordinary snapshot.
+      const seen = new Set<string>();
+      const live = (type: IrType): boolean => {
+        if (
+          type.kind === "record" ||
+          type.kind === "array" ||
+          type.kind === "bytes" ||
+          isDynTypedRefType(type)
+        )
+          return true;
+        if (type.kind !== "union" || seen.has(type.unionId)) return false;
+        seen.add(type.unionId);
+        return lowerer.unions.get(type.unionId)?.arms.some(live) ?? false;
+      };
+      return boxed.kind === "dynFrom" && live(boxed.value.type)
+        ? { ...boxed, liveRef: true }
+        : boxed;
+    }
+    // Collection assertions are interface views only: their backing
+    // value must already have the same native key/element/value layout.
+    // Erasing a mock or a different instantiation here would let member
+    // lowering interpret a record (or another ABI) as a native handle.
+    if (target?.kind === "map" || target?.kind === "set") {
+      return lowerer.coerceInto(expr, inner, target);
+    }
+    // A class-derived interface still names the class's native layout.
+    // An assertion must not let a structural mock acquire that layout;
+    // unions retain their checked extraction below, and real instances
+    // keep the ordinary class narrowing path.
+    if (target?.kind === "object" && inner.type.kind !== "object" && inner.type.kind !== "union") {
+      return lowerer.coerceInto(expr, inner, target);
+    }
+    if (
+      target?.kind === "object" &&
+      inner.type.kind === "object" &&
+      !typeEquals(target, inner.type) &&
+      !lowerer.isSubclassOf(inner.type.className, target.className) &&
+      !lowerer.isSubclassOf(target.className, inner.type.className)
+    ) {
+      return lowerer.coerceInto(expr, inner, target);
+    }
+    // Static assertions normally erase, but record layouts are
+    // monomorphic: a consumer selected from the asserted shape must see
+    // that shape physically. Reuse the ordinary slot coercion so plain
+    // widths and index-signature captures share their established copy
+    // semantics (and unsupported pairs report SC2002 at this assertion).
+    if (
+      inner.type.kind === "record" &&
+      target?.kind === "record" &&
+      inner.type.shapeId !== target.shapeId
+    ) {
+      return lowerer.coerceInto(expr, inner, target);
+    }
+    // `u as Arm` on a UNION value is `u!`'s spelling with a named arm
+    // (`req.headers[h] as string`): the CHECKED single-arm extraction —
+    // the asserted arm's payload comes out, any other arm throws the
+    // catchable TypeError (divergence 38's lying-assertion stance; an
+    // erasure would just move the failure to the next typed slot as an
+    // opaque union-mismatch fence). Sub-union targets and same-type
+    // casts keep the historic erasure.
+    if (inner.type.kind === "union") {
+      if (target && target.kind !== "union" && !typeEquals(target, inner.type)) {
+        const helper = lowerer.narrowedArmHelper(inner.type.unionId, target, locOf(expr));
+        if (helper) {
+          return lowerer.checkedNarrowCall(helper, inner, target, locOf(expr));
+        }
+      }
+    }
+    // `node.parent as Sub | undefined`: a union target whose class arm is
+    // narrower than the stored class gets the same checked class view as
+    // `node.parent as Sub`; the other arms keep their identical tags.
+    if (
+      target?.kind === "union" &&
+      (inner.type.kind === "union" || inner.type.kind === "object") &&
+      !typeEquals(target, inner.type)
+    ) {
+      const asserted = checkedClassUnionAssertion(lowerer, inner, target, locOf(expr));
+      if (asserted) return asserted;
+    }
+    return inner; // erasure, unchanged
+  }
+
+  const targetTs = lowerer.checker.getTypeFromTypeNode(expr.type);
+  const target = lowerer.mapTypeOf(targetTs) ?? dynFallbackType(lowerer, expr.type, targetTs);
+  if (!target) lowerer.badType(expr.type, targetTs);
+  if (target.kind === "dyn") return inner; // `as unknown`: erasure
+  // An all-`unknown`-fields record target (`err as { code?: unknown }`
+  // — the errno-probing idiom): there is nothing to validate (every
+  // field is unknown, exactly what the dyn value already answers) and
+  // nothing to build — the cast is pure typing, so it ERASES and the
+  // reads ride the dyn keyed read.
+  if (target.kind === "record") {
+    const shape = lowerer.shapes.get(target.shapeId);
+    if (
+      shape &&
+      !shape.tuple &&
+      shape.fields.every((f) => f.type.kind === "dyn") &&
+      (!shape.indexValue || shape.indexValue.kind === "dyn")
+    ) {
+      return inner;
+    }
+  }
+  // The global object: the checked extraction would build a separate
+  // value, so the assertion keeps the object and its member operations
+  // reach it (assertion-identity.ts).
+  if (extractionCopiesReference(lowerer, target) && assertsGlobalObject(lowerer, expr))
+    return inner;
+  if (
+    target.kind === "void" ||
+    !canDynCheckTo(
+      target,
+      (id) => lowerer.shapes.get(id),
+      (id) => lowerer.unions.get(id),
+    )
+  ) {
+    // Bare undefined-armed targets pass when every OTHER arm is
+    // JSON-safe: the checked-dynamic tree holds a first-class undefined value now
+    // (index-signature overflow reads produce it for missing keys), and
+    // the undefined arm matches exactly it — `p[key] as string |
+    // undefined` is the missing-key idiom. Parsed JSON still never
+    // contains undefined, so casts over parse results keep failing on
+    // non-string values with the usual path-annotated TypeError.
+    if (target.kind === "union" && lowerer.dynConvertible(target)) {
+      return { kind: "dynCheck", value: inner, type: target, loc: locOf(expr) };
+    }
+    // Uint8Array targets: the checked-dynamic tree carries a bytes kind now (converted
+    // stdin chunks) — the extraction validates the kind and copies out.
+    if (target.kind === "bytes" && target.elem === "u8") {
+      return { kind: "dynCheck", value: inner, type: target, loc: locOf(expr) };
+    }
+    // Class instances round-trip only through compiler-owned typed
+    // references. Plain JSON objects fail the runtime class-brand check;
+    // exact capsules unwrap the original object by identity.
+    if (isDynTypedRefType(target)) {
+      return { kind: "dynCheck", value: inner, type: target, loc: locOf(expr) };
+    }
+    // ADAPTABLE function targets (`u as (x: number) => number` — the
+    // checked-dynamic function boundary): kind check, then exact unwrap
+    // or the per-target adapter shim. Non-adaptable signatures keep the
+    // fence below.
+    if (
+      target.kind === "func" &&
+      canAdaptDynFuncTo(
+        target,
+        (id) => lowerer.shapes.get(id),
+        (id) => lowerer.unions.get(id),
+      )
+    ) {
+      return { kind: "dynCheck", value: inner, type: target, loc: locOf(expr) };
+    }
+    // Runtime HANDLE targets (`u as IncomingMessage` — a boxed handle
+    // coming back out of an untyped wrapper): a tag-checked reference
+    // unwrap, identity preserved (DYN_HANDLE_KINDS).
+    if (DYN_HANDLE_KINDS.has(target.kind)) {
+      return { kind: "dynCheck", value: inner, type: target, loc: locOf(expr) };
+    }
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      `a checked cast of 'unknown' to '${target.kind === "void" ? "void" : lowerer.fmt(target)}' ` +
+        `(a dynamic value can only be validated against JSON-representable types: ` +
+        `number, string, boolean, records, arrays, and unions of those)`,
+    );
+  }
+  return { kind: "dynCheck", value: inner, type: target, loc: locOf(expr) };
+}
diff --git a/packages/compiler/src/frontend/lowering/expressions/nullish-assignment.ts b/packages/compiler/src/frontend/lowering/expressions/nullish-assignment.ts
index 5ef3991da..4366b8d6b 100644
--- a/packages/compiler/src/frontend/lowering/expressions/nullish-assignment.ts
+++ b/packages/compiler/src/frontend/lowering/expressions/nullish-assignment.ts
@@ -214,6 +214,37 @@ export function lowerShortCircuitAssignment(lowerer: Lowerer, expr: ts.BinaryExp
           !nullish && !and && element.kind === "f64"
             ? arrayNumberRead(receiver, key, elementLoc)
             : arrayValueRead(lowerer, receiver, key, element, elementLoc);
+      } else if (
+        receiver.type.kind === "record" &&
+        key.type.kind === "string" &&
+        pureIndexShapeOf(lowerer, receiver.type.shapeId) !== null
+      ) {
+        // `timings[phase] ??= v` over a pure index-signature record
+        // (`Record<string, number>`): the keyed read answers the value or
+        // undefined for a missing key, and the write inserts or replaces
+        // the key, exactly the two halves `o[k]` and `o[k] = v` lower to.
+        const shapeId = receiver.type.shapeId;
+        const indexValue = pureIndexShapeOf(lowerer, shapeId)!;
+        key = save(key, "%shortCircuitKey");
+        const readType =
+          indexValue.kind === "dyn" ? indexValue : lowerer.withUndefinedArmOf(indexValue);
+        if (!readType) {
+          lowerer.unsupported(
+            "SC1090",
+            target,
+            "short-circuit assignment through this indexed receiver",
+          );
+        }
+        storage = indexValue;
+        read = { kind: "recordKeyGet", obj: receiver, shapeId, key, type: readType, loc };
+        write = (value) => ({
+          kind: "recordKeySet",
+          obj: receiver,
+          shapeId,
+          key,
+          value: lowerer.coerceToExpected(value, indexValue),
+          loc,
+        });
       } else {
         lowerer.unsupported(
           "SC1090",
@@ -265,3 +296,11 @@ export function lowerShortCircuitAssignment(lowerer: Lowerer, expr: ts.BinaryExp
   }
   return finish({ kind: "nullish", left: read, right, type: read.type, loc });
 }
+
+/** The value type of a pure index-signature record shape (no declared
+ * fields, not a tuple), or null. */
+function pureIndexShapeOf(lowerer: Lowerer, shapeId: string): IrType | null {
+  const shape = lowerer.shapes.get(shapeId);
+  if (!shape || shape.tuple || shape.fields.length > 0 || !shape.indexValue) return null;
+  return shape.indexValue;
+}
diff --git a/packages/compiler/src/frontend/lowering/expressions/object-literals.ts b/packages/compiler/src/frontend/lowering/expressions/object-literals.ts
index 216069362..6238479e0 100644
--- a/packages/compiler/src/frontend/lowering/expressions/object-literals.ts
+++ b/packages/compiler/src/frontend/lowering/expressions/object-literals.ts
@@ -24,6 +24,7 @@ import { PoisonError, neverTaintedJsType } from "../lowerer.js";
 import type { Lowerer } from "../lowerer.js";
 import { lowerIndexMergeHelper } from "../containers/indexed-objects.js";
 import type { IndexMergeContributor } from "../containers/indexed-objects.js";
+import type { KeyOrderSegment } from "../key-order-witness.js";
 import {
   PERF_ENTRY_MARKER,
   isGenericCallableMemberType,
@@ -1596,6 +1597,8 @@ export function lowerObjectLiteral(
   // Member names DROPPED from the shape (JS deferral — unlowerable pure
   // member reads narrow away; see the catch in the property loop).
   const droppedNames = new Set<string>();
+  // The order this literal creates its keys in (key-order-witness.ts).
+  const orderSegments: KeyOrderSegment[] = [];
   for (const prop of expr.properties.nodes) {
     // A later contributor can mutate an earlier source or overwrite a
     // value with effects. Snapshot pending fields at their source position,
@@ -1651,6 +1654,7 @@ export function lowerObjectLiteral(
         v = lowerer.coerceInto(valueNode, v, fieldType);
         if (!typeEquals(v.type, fieldType)) lowerer.badType(valueNode, lowerer.typeOf(valueNode));
         conditionalNames.add(name);
+        orderSegments.push({ kind: "key", name, definite: false });
         fields.push({
           name,
           value: {
@@ -1758,6 +1762,7 @@ export function lowerObjectLiteral(
           }
         }
         const srcRef = (): IrExpr => srcLowered ?? lowerer.lowerExpr(srcNode);
+        orderSegments.push({ kind: "spread", shapeId: recArm.shapeId, maybeAbsent: true });
         for (const f of srcShape.fields) {
           if (laterNames.has(f.name)) continue;
           const targetType = fieldTypes.get(f.name);
@@ -1993,6 +1998,12 @@ export function lowerObjectLiteral(
           laterNames.add(propNameText(lowerer, later.name));
         }
       }
+      // A checked-dynamic source's keys are a run-time fact.
+      orderSegments.push(
+        srcLowered.type.kind === "dyn"
+          ? { kind: "opaque" }
+          : { kind: "spread", shapeId: srcType.shapeId, maybeAbsent: false },
+      );
       for (const f of srcShape.fields) {
         if (laterNames.has(f.name)) continue;
         let targetType = fieldTypes.get(f.name);
@@ -2307,6 +2318,7 @@ export function lowerObjectLiteral(
     const at = fields.findIndex((x) => x.name === name);
     if (at >= 0) fields.splice(at, 1);
     fields.push({ name, value });
+    orderSegments.push({ kind: "key", name, definite: true });
   }
   // Optional fields may be omitted: the field holds its absent state.
   // tsc rejects omission of required fields before lowering.
@@ -2335,7 +2347,10 @@ export function lowerObjectLiteral(
       fields.push({ name: f.name, value: absent });
     }
   }
-  const result: IrExpr = { kind: "recordLit", fields, type, loc };
+  const result: IrExpr = lowerer.keyOrder.literal(
+    { kind: "recordLit", fields, type, loc },
+    orderSegments,
+  );
   return spreadStmts.length === 0
     ? result
     : { kind: "seqExpr", stmts: spreadStmts, result, type, loc };
@@ -3047,7 +3062,7 @@ export function lowerShorthandValue(
       return lowerer.maybeNarrow({ kind: "varRef", localId: g.id, type: g.type, loc }, propName);
     }
     const sig = lowerer.fnSigsBySymbol.get(resolved);
-    const decl = lowerer.checker.declarationsOf(resolved)[0];
+    const decl = resolved.declarations[0];
     if (
       sig &&
       decl &&
diff --git a/packages/compiler/src/frontend/lowering/expressions/property-access.ts b/packages/compiler/src/frontend/lowering/expressions/property-access.ts
new file mode 100644
index 000000000..dbbb701df
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/expressions/property-access.ts
@@ -0,0 +1,3568 @@
+/* Property reads (`a.b`): lowerExprInner's property-access branch, intrinsic and union properties, field reads and targets, and match-group reads. */
+import * as ts from "../../ts7/adapter.js";
+import { localPrivateBrandClass } from "../private-brands.js";
+import { type Lowerer, PoisonError, jsFuncNameOf, neverTaintedJsType, own } from "../lowerer.js";
+import {
+  ARRAY_METHODS,
+  MAP_METHODS,
+  NARROW_FIRST,
+  OBJECT_CALLABLE_VALUES,
+  SET_METHODS,
+  STDLIB_SURFACE,
+  STRING_INDEX_METHODS,
+  STR_METHODS,
+  isChildSurfaceMember,
+  stdlibGlobalNameOf,
+} from "../surfaces.js";
+import {
+  isGenericCallableMemberType,
+  isLegacyUrlSymbol,
+  isOsConstantsType,
+  isParseArgsDynTypeName,
+} from "../../type-mapper.js";
+import {
+  BOOL,
+  BYTES_ELEMENT_NAME,
+  DYN,
+  F64,
+  type IrExpr,
+  type IrLocal,
+  type IrRecordShape,
+  type IrStmt,
+  type IrType,
+  NULL_T,
+  SEARCH_PARAMS_T,
+  STRING,
+  SYMBOL_T,
+  type SrcLoc,
+  UNDEFINED_T,
+  arrayOf,
+  canBoxFuncIntoDyn,
+  funcOf,
+  isDynTypedRefType,
+  isUnitType,
+  typeEquals,
+  typeKey,
+  unionContainerArmsOk,
+} from "../../../ir/ir.js";
+import { lowerNavigatorMember } from "../builtins/navigator.js";
+import { NODE_COMPAT_VERSION } from "../builtins/process.js";
+import {
+  inlineNamespaceRequireOf,
+  lowerWithInlineRequireInit,
+  wholeExportValue,
+} from "../cjs-inline-require.js";
+import {
+  type FieldTarget,
+  cjsAccessorCall,
+  constInitializerOf,
+  exactUnionWidening,
+  hasClassPayload,
+  lowerExpr,
+  matchAllCallbackRegexOf,
+  matchAllRegexOf,
+  namedCaptureGroupsOfPattern,
+  primitiveCtorClosure,
+  recordKeyResultOk,
+  representedClassFieldTarget,
+  staticRegexPatternOf,
+} from "../lower-exprs.js";
+import {
+  cjsInFileExportGlobalOf,
+  isCjsExportsIdentifier,
+  lowerCjsExportsObjectValue,
+} from "../cjs-exports-object.js";
+import { tscInteropDefaultValueOf } from "../cjs-tsc-interop.js";
+import { lifetimeRegionMemberOf } from "../../experimental-import.js";
+import { lowerInternTableProperty } from "../intern-tables.js";
+import { lowerThreadSlotsProperty } from "../thread-slots.js";
+import { builtinClassRefOf, runtimeClassValueOfType } from "../builtins/class-values.js";
+import { findGenericMethodOn, lowerStaticFieldRead } from "../lower-classes.js";
+import { lowerClassPrototypeData } from "../class-prototypes.js";
+import { lowerEnumAccess } from "../lower-enums.js";
+import {
+  hasOptionalChainGuard,
+  isOptionalChainTail,
+  isRequireMainFilename,
+} from "./optional-chains.js";
+import {
+  isCjsModuleGlobal,
+  lowerNodeModuleProperty,
+  lowerRequireMainProperty,
+} from "../lower-node-module.js";
+import { dynUndefinedExpr, nodeThrowExpr, numLit, strLit, varRef } from "../../../ir/build.js";
+import { tryLowerExpression } from "./try-lower-expression.js";
+import {
+  cjsClassExprWholeExportOf,
+  cjsExportAssignmentOf,
+  cjsExportDiscardReason,
+  isCjsExportTableLiteral,
+  isCjsJsFile,
+  isJsSourceFile,
+  isModuleExportsAccess,
+  isNodeEsmFile,
+  locOf,
+} from "../../program.js";
+import {
+  ambientNsRootOf,
+  ambientUndefReadType,
+  ambientUndefVarRootOf,
+  contextualUndefReadType,
+  fenceEarlyNsMemberRef,
+  nsMemberIdentOf,
+  nsUndefRead,
+} from "../lower-namespaces.js";
+import { expandoMemberRead } from "../lower-expando.js";
+import { lowerProtocolPropertyRead } from "../class-protocol-dispatch.js";
+import { lowerReadlineProperty } from "../builtins/readline.js";
+import { lowerEventStaticProperty } from "../builtins/numbers.js";
+import { lowerStreamProperty, lowerStreamStateProperty, streamSidesOf } from "../lower-stream.js";
+import { lowerEventObjectProperty } from "../lower-event-target.js";
+import { iteratorResultValueRead } from "../lower-generators.js";
+import { lowerGlobalValue } from "../lower-global-value.js";
+import { nullishGenericBindingUnitOf } from "../binding-analysis.js";
+import { blockedBindingUseDiag } from "../../../diagnostics/diagnostic.js";
+import { npmStaticPackageOfPath } from "../../npm-static.js";
+import { importMetaField, isImportMeta } from "../import-meta.js";
+import {
+  builtinPrototypeMethod,
+  lowerArrayIsArrayValue,
+  lowerCheckedPredicateValue,
+  lowerNumberParserValue,
+  lowerObjectAssignValue,
+  lowerStringCodesValue,
+} from "../lower-builtin-values.js";
+import { lowerArrayFromValue } from "../containers/array-construction.js";
+import { lowerNetAddressStaticRead } from "../builtins/net-address.js";
+import { STATS_TYPE_TESTS } from "../builtins/filesystem.js";
+import { arrayValueRead, arrayValueType } from "../array-values.js";
+import { lowerClassMethodValue } from "../class-method-values.js";
+import {
+  objLitGenericFnInfoOf,
+  objLitGenericFnNodeOf,
+  requireObjLitGenericReceiver,
+} from "../generic-functions.js";
+import { narrowStoredClassValue, structuralReadType } from "../class-unions.js";
+import { InternalCompilerError } from "../../../errors.js";
+import { lowerUnionFieldRead } from "./union-fields.js";
+import { errorPropertyRead } from "../error-methods.js";
+import { isSafeToRepeat } from "./evaluation-safety.js";
+import { isZlibStreamMember, lowerZlibStreamBytesWritten } from "../builtins/compression.js";
+import { isFsStreamMember, lowerFsStreamProperty } from "../builtins/fs-streams.js";
+
+/** True when a property access names an ABSTRACT property declaration
+ * (`abstract p: number` — a PropertyDeclaration, not an accessor).
+ * These uses need concrete property dispatch because the base has no slot. */
+export function abstractPropertyDeclOf(
+  lowerer: Lowerer,
+  expr: ts.PropertyAccessExpression,
+): boolean {
+  const sym = lowerer.checker.getSymbolAtLocation(expr.name);
+  if (!sym) return false;
+  return sym.declarations.some(
+    (d) =>
+      ts.isPropertyDeclaration(d) &&
+      ts.getModifiers(d)?.some((m) => m.kind === ts.SyntaxKind.AbstractKeyword) === true,
+  );
+}
+
+/** A field declared by node:util's parseArgs checked-dynamic type family.
+ * Narrowing a ParseArgsToken exposes one anonymous union arm, so its alias
+ * identity no longer reaches mapType; declaration ancestry is the stable
+ * provenance check. */
+/** The Uint8Array base64/hex prototype methods (ES2026) Node 24 lacks. */
+const UINT8ARRAY_BASE64_METHODS: ReadonlySet<string> = new Set([
+  "toBase64",
+  "toHex",
+  "setFromBase64",
+  "setFromHex",
+]);
+
+/** `Uint8Array.prototype.<base64/hex method>` read off the global. */
+function isUint8ArrayBase64Probe(lowerer: Lowerer, expr: ts.PropertyAccessExpression): boolean {
+  if (!UINT8ARRAY_BASE64_METHODS.has(expr.name.text)) return false;
+  const proto = expr.expression;
+  return (
+    ts.isPropertyAccessExpression(proto) &&
+    !proto.questionDotToken &&
+    proto.name.text === "prototype" &&
+    stdlibGlobalNameOf(lowerer, proto.expression) === "Uint8Array"
+  );
+}
+
+function isParseArgsDynProperty(lowerer: Lowerer, expr: ts.PropertyAccessExpression): boolean {
+  const sym = lowerer.checker.getSymbolAtLocation(expr.name);
+  if (!sym) return false;
+  return sym.declarations.some((d) => {
+    if (!lowerer.isStdlibFile(d.getSourceFile())) return false;
+    let inParseArgsType = false;
+    for (let node: ts.Node | undefined = d.parent; node; node = node.parent) {
+      if (
+        (ts.isTypeAliasDeclaration(node) || ts.isInterfaceDeclaration(node)) &&
+        isParseArgsDynTypeName(node.name.text)
+      ) {
+        inParseArgsType = true;
+      }
+      if (ts.isModuleDeclaration(node) && ts.isStringLiteral(node.name)) {
+        return inParseArgsType && (node.name.text === "util" || node.name.text === "node:util");
+      }
+    }
+    return false;
+  });
+}
+
+function isStatFsDynProperty(lowerer: Lowerer, expr: ts.PropertyAccessExpression): boolean {
+  if (
+    !["type", "bsize", "blocks", "bfree", "bavail", "files", "ffree", "bigint"].includes(
+      expr.name.text,
+    )
+  )
+    return false;
+  const symbol = lowerer.checker.getSymbolAtLocation(expr.name);
+  return (
+    !!symbol &&
+    symbol.declarations.some((declaration) => {
+      if (!lowerer.isStdlibFile(declaration.getSourceFile())) return false;
+      const parent = declaration.parent;
+      if (!ts.isInterfaceDeclaration(parent)) return false;
+      if (
+        expr.name.text === "bigint"
+          ? parent.name.text !== "StatFsOptions"
+          : !["StatsFsBase", "StatsFs", "BigIntStatsFs"].includes(parent.name.text)
+      )
+        return false;
+      for (let node: ts.Node | undefined = parent.parent; node; node = node.parent) {
+        if (ts.isModuleDeclaration(node) && ts.isStringLiteral(node.name))
+          return node.name.text === "fs" || node.name.text === "node:fs";
+      }
+      return false;
+    })
+  );
+}
+
+export function lowerPropertyAccessExpr(
+  lowerer: Lowerer,
+  expr: ts.PropertyAccessExpression,
+  loc: SrcLoc,
+): IrExpr {
+  if (!expr.questionDotToken) {
+    const navigator = lowerNavigatorMember(lowerer, expr, NODE_COMPAT_VERSION);
+    if (navigator) return navigator;
+  }
+  // `require("./x").member` over a program module's export table: the
+  // module's %init at this position, then the member read exactly like
+  // a `const m = require("./x")` binding's (cjs-inline-require.ts).
+  if (!expr.questionDotToken) {
+    const req = inlineNamespaceRequireOf(lowerer, expr.expression);
+    if (req !== null && !lowerer.inlineRequireInitDone.has(req.call)) {
+      return lowerWithInlineRequireInit(lowerer, req, () => lowerExpr(lowerer, expr));
+    }
+    // `module.exports` compared by identity inside its own module, or
+    // refused by name as any other value (cjs-exports-object.ts).
+    if (expr.name.text === "exports") {
+      const exportsValue = lowerCjsExportsObjectValue(lowerer, expr);
+      if (exportsValue) return exportsValue;
+    }
+    // tsc's `x_1.default` over a dependency whose whole export is one
+    // value: that value (cjs-tsc-interop.ts).
+    const interop = tscInteropDefaultValueOf(lowerer, expr);
+    if (interop !== null) {
+      const value = wholeExportValue(lowerer, interop.dep, expr);
+      if (value !== null) return value;
+    }
+  }
+  {
+    const member = lifetimeRegionMemberOf(lowerer.program, expr, lowerer.experimentalFiles);
+    if (member !== null)
+      lowerer.noLowering(
+        `LifetimeRegion.${member} (@scriptc/experimental) as a value`,
+        expr,
+        `call region.${member}(${member === "run" ? "fn" : ""}) directly`,
+      );
+  }
+  {
+    const table = lowerInternTableProperty(lowerer, expr);
+    if (table) return table;
+  }
+  lowerThreadSlotsProperty(lowerer, expr);
+  // `EventEmitter.name`, `zlib.Gzip.name`, `C.name` over a builtin
+  // class alias.
+  if (expr.name.text === "name" && !expr.questionDotToken) {
+    const ref = builtinClassRefOf(lowerer, expr.expression);
+    if (ref !== null) return { kind: "strLit", value: ref.name, type: STRING, loc };
+  }
+  // `C.name` through a runtime-provided class VALUE (a `typeof Readable`
+  // parameter): the class object's stored name.
+  if (
+    expr.name.text === "name" &&
+    !expr.questionDotToken &&
+    runtimeClassValueOfType(lowerer, lowerer.typeOf(expr.expression)) !== null
+  ) {
+    const read = lowerer.lowerFieldRead(expr);
+    if (read) return read;
+  }
+  // Expando statics may still be absent even when JS inference sees
+  // the eventual assignment's scalar type. Preserve the checked value.
+  const staticField = lowerStaticFieldRead(lowerer, expr);
+  if (staticField) return staticField;
+  const prototypeData = lowerClassPrototypeData(lowerer, expr);
+  if (prototypeData) return prototypeData;
+  if (ts.isPropertyAccessExpression(expr.expression) && expr.expression.name.text === "prototype") {
+    const prototype = lowerClassPrototypeData(lowerer, expr.expression);
+    if (prototype)
+      return {
+        kind: "dynKeyGet",
+        value: prototype,
+        key: { kind: "strLit", value: expr.name.text, type: STRING, loc },
+        type: DYN,
+        loc,
+      };
+  }
+  // `super.x`: the base chain's GETTER, called directly (super
+  // dispatch is static in JS — never through the dynamic class).
+  // super.method() calls are routed at the call site; a bare super
+  // property read lands here.
+  if (expr.expression.kind === ts.SyntaxKind.SuperKeyword) {
+    return lowerer.lowerSuperAccessorRead(expr);
+  }
+  // Enum member reads (`E.A`) fold to their compile-time constants —
+  // claimed FIRST so no receiver-shaped path (records, the
+  // identifier fence on the enum object) sees them. lower-enums.ts.
+  {
+    const en = lowerEnumAccess(lowerer, expr);
+    if (en) return en;
+  }
+  // `import.meta.<field>` — the file-backed ESM metadata that survives
+  // compilation as a constant. Only direct, identifier-named reads are
+  // claimed here; the bare meta object, computed access, writes, and
+  // unsupported members continue through the generic module-loader fence
+  // below. The source file is the module identity, so imported modules
+  // receive their own filename/dirname and only the entry receives main.
+  const importMeta = importMetaProperty(lowerer, expr);
+  if (importMeta) return importMeta;
+  // `require.main.filename` / `require.main?.filename` — CommonJS
+  // entry-module identity: in a compiled binary require.main IS the
+  // entry module (never undefined in a CJS graph, so the chain's guard
+  // folds away), and its filename is the ENTRY file's real path —
+  // Node's exact value when the same tree runs in place, exactly the
+  // __filename stance. Checked BEFORE the optional-chain gate: the
+  // checker types the chain `string | undefined`, but the value is a
+  // compile-time string.
+  if (isRequireMainFilename(lowerer, expr)) {
+    return { kind: "strLit", value: lowerer.entry.fileName, type: STRING, loc };
+  }
+  const requireMain = lowerRequireMainProperty(lowerer, expr);
+  if (requireMain) return requireMain;
+  const moduleProperty = lowerNodeModuleProperty(lowerer, expr);
+  if (moduleProperty) return moduleProperty;
+  if (
+    stdlibGlobalNameOf(lowerer, expr.expression) === "Symbol" &&
+    [
+      "iterator",
+      "asyncIterator",
+      "toStringTag",
+      "toPrimitive",
+      "hasInstance",
+      "isConcatSpreadable",
+      "match",
+      "matchAll",
+      "replace",
+      "search",
+      "split",
+      "species",
+      "unscopables",
+      "dispose",
+      "asyncDispose",
+    ].includes(expr.name.text)
+  ) {
+    return {
+      kind: "libCall",
+      fn: "sym.wellKnown",
+      args: [{ kind: "strLit", value: expr.name.text, type: STRING, loc }],
+      type: { kind: "symbol" },
+      loc,
+    };
+  }
+  if (lowerer.stdlibGlobalMember(expr, "Object") === "freeze") {
+    const name = "%builtin.Object.freeze";
+    if (!lowerer.liftedFns.some((fn) => fn.name === name))
+      lowerer.liftedFns.push({
+        name,
+        params: [{ localId: "value", name: "value", type: DYN }],
+        locals: [{ id: "value", name: "value", type: DYN, mutable: false }],
+        returnType: DYN,
+        body: [
+          {
+            kind: "return",
+            value: {
+              kind: "libCall",
+              fn: "dyn.freeze",
+              args: [varRef("value", DYN, loc)],
+              type: DYN,
+              loc,
+            },
+            loc,
+          },
+        ],
+        loc,
+      });
+    return { kind: "closure", fnName: name, captures: [], type: funcOf([DYN], DYN), loc };
+  }
+  // An Hmac has no copy() (Hash does): Node answers undefined, which
+  // `typeof mac.copy` feature checks read. TypeScript rejects the read.
+  if (
+    expr.name.text === "copy" &&
+    lowerer.mapTypeOf(lowerer.typeOf(expr.expression))?.kind === "cryptoHmac"
+  ) {
+    return {
+      kind: "seqExpr",
+      stmts: [{ kind: "exprStmt", expr: lowerer.lowerExpr(expr.expression), loc }],
+      result: dynUndefinedExpr(loc),
+      type: DYN,
+      loc,
+    };
+  }
+  if (lowerer.stdlibGlobalMember(expr, "globalThis") === "console") {
+    return { kind: "libCall", fn: "console.native", args: [], type: DYN, loc };
+  }
+  if (lowerer.stdlibGlobalMember(expr, "console") !== null) {
+    return {
+      kind: "dynKeyGet",
+      value: { kind: "libCall", fn: "console.native", args: [], type: DYN, loc },
+      key: { kind: "strLit", value: expr.name.text, type: STRING, loc },
+      type: DYN,
+      loc,
+    };
+  }
+  // Missing host globals (Bun/Deno capability probes) have no binding
+  // in a native program. Declared globals retain their own lowering;
+  // arbitrary global-object mutation remains fenced. Preserve a dyn
+  // undefined value so stored probes compose with optional calls.
+  if (
+    stdlibGlobalNameOf(lowerer, expr.expression) === "globalThis" &&
+    !lowerer.checker.getPropertyOfType(lowerer.typeOf(expr.expression), expr.name.text)
+  ) {
+    return dynUndefinedExpr(loc);
+  }
+  // `Uint8Array.prototype.toBase64` and its siblings, the base64/hex
+  // feature probes libraries such as jose make: the methods are newer
+  // than Node 24, whose Uint8Array prototype answers undefined for them.
+  if (isUint8ArrayBase64Probe(lowerer, expr)) return dynUndefinedExpr(loc);
+  if (expr.questionDotToken && expr.name.text === "electron") {
+    const processProperty = lowerer.lowerProcessProperty(expr);
+    if (processProperty) return processProperty;
+  }
+  // Optional chaining `a?.b`: the guard lowers here (a tag test around
+  // the plain property lowering below); the handled marker keeps this
+  // re-entrant dispatch from looping.
+  if (expr.questionDotToken && !lowerer.chainHandled.has(expr)) {
+    return lowerer.lowerOptionalChain(expr);
+  }
+  // `a?.b.c` — the tail of a chain whose token sits deeper: the whole
+  // tail short-circuits with the guard.
+  if (!expr.questionDotToken && isOptionalChainTail(lowerer, expr)) {
+    return lowerer.lowerOptionalChain(expr);
+  }
+  // Known Web handles retain their declared surface even when their
+  // storage uses checked values. Apply this before generic reads.
+  lowerer.fenceStaticAbortControllerMemberRead(expr);
+  lowerer.fenceStaticResponseMember(expr, "read");
+  lowerer.fenceStaticHeadersMember(expr, "read");
+  lowerer.fenceStaticReadableStreamMember(expr, "read");
+
+  // — reading off null/undefined — bridged catchably like everything
+  // at the boundary). `o?.x` arrives here too, through the chain
+  // lowering's re-dispatch (a questionDotToken past the gate above is
+  // always chain-handled; the receiver reads back as the chain's
+  // bound handle).
+
+  // `m.index` on a for-of-over-matchAll binding reads the companion-
+  // index array at this iteration's cursor — always a number: every
+  // drained row matched, so the lib's `.index` is never undefined
+  // here (lowerForOfMatchAll).
+  if (expr.name.text === "index" && !expr.questionDotToken && ts.isIdentifier(expr.expression)) {
+    const sym = lowerer.checker.getSymbolAtLocation(expr.expression);
+    const companion = sym !== undefined ? lowerer.matchAllIndexBindings.get(sym) : undefined;
+    if (companion !== undefined) {
+      return {
+        kind: "arrayGet",
+        arr: { kind: "varRef", localId: companion.idxsLocalId, type: arrayOf(F64), loc },
+        index: { kind: "varRef", localId: companion.curLocalId, type: F64, loc },
+        type: F64,
+        loc,
+      };
+    }
+  }
+  if ((expr.name.text === "index" || expr.name.text === "input") && !expr.questionDotToken) {
+    const represented = tryLowerExpression(lowerer, expr.expression);
+    if (
+      represented &&
+      isMatchSliceType(lowerer, represented.type) &&
+      (lowerer.isStdlibMember(expr) || isJsSourceFile(expr.getSourceFile()))
+    ) {
+      const recv = represented;
+      const key: IrExpr = { kind: "strLit", value: expr.name.text, type: STRING, loc };
+      // A plain slice answers from its match source without a dynamic copy.
+      const read: IrExpr = typeEquals(recv.type, arrayOf(STRING))
+        ? { kind: "libCall", fn: "regex.resultProp", args: [recv, key], type: DYN, loc }
+        : { kind: "dynKeyGet", value: lowerer.coerceToExpected(recv, DYN), key, type: DYN, loc };
+      return lowerer.maybeNarrow(read, expr);
+    }
+  }
+  // `m.groups` on a match result whose regex is statically known:
+  // the compile-time record projection over the honest slice (or
+  // Node's undefined when the pattern has no named groups) — see
+  // lowerMatchGroupsRead.
+  {
+    const g = lowerMatchGroupsRead(lowerer, expr);
+    if (g !== null) return g;
+  }
+  // `arguments.length` in a TYPED function whose signature is
+  // FIXED-ARITY (no optional/default/rest parameters): tsc enforces
+  // exact arity at every call site and call/apply/bind indirection is
+  // fenced, so the actual count IS the declared count — a compile-time
+  // constant. Arrows don't bind `arguments` (the walk skips them,
+  // exactly JS's scoping); variable-arity signatures keep the fence
+  // (the count would need a hidden argc). The JS-source variadic
+  // `arguments` object (dynRest) was claimed at identifier lowering.
+  if (
+    expr.name.text === "length" &&
+    !expr.questionDotToken &&
+    ts.isIdentifier(expr.expression) &&
+    expr.expression.text === "arguments" &&
+    !lowerer.ctx.argumentsLocal &&
+    lowerer.typeOf(expr.expression).getSymbol()?.name === "IArguments" &&
+    lowerer.isStdlibSymbol(lowerer.typeOf(expr.expression).getSymbol())
+  ) {
+    let fn: ts.Node | undefined = expr.parent;
+    while (
+      fn !== undefined &&
+      !ts.isFunctionDeclaration(fn) &&
+      !ts.isFunctionExpression(fn) &&
+      !ts.isMethodDeclaration(fn) &&
+      !ts.isConstructorDeclaration(fn) &&
+      !ts.isGetAccessorDeclaration(fn) &&
+      !ts.isSetAccessorDeclaration(fn)
+    ) {
+      fn = ts.isSourceFile(fn) ? undefined : fn.parent;
+    }
+    if (fn !== undefined) {
+      const fixedArity = (fn as ts.FunctionLikeDeclaration).parameters.nodes.every(
+        (p) =>
+          p.questionToken === undefined &&
+          p.initializer === undefined &&
+          p.dotDotDotToken === undefined,
+      );
+      if (fixedArity) {
+        return {
+          kind: "numLit",
+          value: (fn as ts.FunctionLikeDeclaration).parameters.nodes.length,
+          type: F64,
+          loc,
+        };
+      }
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        "'arguments.length' in functions with optional, default, or rest parameters (the count varies per call — a fixed-arity signature folds to a constant)",
+      );
+    }
+  }
+  // CommonJS namespace binding (`const lib = require("./lib.js")`):
+  // `lib.member` IS the member — the export table is alias plumbing,
+  // so the NAME resolves exactly like a bare identifier reference
+  // (resolveValueSymbol lands on the exporter's declaration and every
+  // existing path — globals, function values, classes — applies).
+  if (!expr.questionDotToken && lowerer.cjsLocalModuleBindingOf(expr.expression)) {
+    // A binding whose dep is a class-expression WHOLE export
+    // (`module.exports = class {…}`): the member surface is the
+    // CLASS's — `C.name` folds to NamedEvaluation's answer and own
+    // statics read their globals (lowerStaticFieldRead resolves the
+    // binding through the expression's own symbol). The plain
+    // member-name delegation below would resolve `name` against the
+    // stdlib var instead — a wrong VALUE, not a fence. Unknown
+    // members fall through to the delegation (expando statics ride
+    // their pre-registered export globals).
+    const viaClass = lowerStaticFieldRead(lowerer, expr);
+    if (viaClass) return viaClass;
+    return lowerExpr(lowerer, expr.name);
+  }
+  // `module.exports` READ in a CommonJS file whose whole export IS a
+  // class expression (`module.exports = class …{}`): the read answers
+  // the class VALUE — `new module.exports()` inside the module is the
+  // requirer's `new C()` spelled locally. Top-level reads ABOVE the
+  // assignment fall through to their existing fences (Node still
+  // answers the original export object there); function bodies
+  // resolve unconditionally — they run after the module evaluated,
+  // the same approximation identifier exports already make. Every
+  // other module.exports read keeps its existing story.
+  if (
+    !expr.questionDotToken &&
+    isModuleExportsAccess(expr) &&
+    isCjsJsFile(expr.getSourceFile(), lowerer.program)
+  ) {
+    const whole = cjsClassExprWholeExportOf(expr.getSourceFile());
+    if (whole) {
+      let inBody = false;
+      for (
+        let p: ts.Node | undefined = expr.parent;
+        p !== undefined && !ts.isSourceFile(p);
+        p = p.parent
+      ) {
+        if (ts.isFunctionLike(p) || ts.isClassDeclaration(p) || ts.isClassExpression(p)) {
+          inBody = true;
+          break;
+        }
+      }
+      if (inBody || expr.getStart() > whole.stmt.getEnd()) {
+        return lowerer.classValueRef(lowerer.lowerClassExpressionInfo(whole.classExpr), expr);
+      }
+    }
+  }
+  // `module.exports.Sub` / `exports.Sub` READ in the same module: an
+  // EXPRESSION-valued member rides its pre-registered export global —
+  // exactly what requirers see through `require('./x').Sub`, and the
+  // global IS the storage every `exports.Sub =` statement assigns, so
+  // the read is Node's live member. Identifier-valued members have no
+  // global (pure alias plumbing) and fall through unchanged; write
+  // positions belong to the export-assignment machinery.
+  {
+    const writePos =
+      ts.isBinaryExpression(expr.parent) &&
+      expr.parent.left === expr &&
+      expr.parent.operatorToken.kind === ts.SyntaxKind.EqualsToken;
+    const g = cjsInFileExportGlobalOf(lowerer, expr);
+    if (g && !writePos) return { kind: "varRef", localId: g.id, type: g.type, loc };
+  }
+  // Namespace-qualified reads (`N.x`, `A.B.C.f`, import= alias
+  // chains): the member is a compile-time-known declaration of a
+  // lowered namespace block — it resolves exactly like a bare
+  // identifier reference (globals, function values, classes), guarded
+  // by the namespace source-order fences (lower-namespaces.ts).
+  if (!expr.questionDotToken) {
+    const nsMember = nsMemberIdentOf(lowerer, expr);
+    if (nsMember) {
+      const memberSym = lowerer.checker.getSymbolAtLocation(nsMember);
+      if (memberSym) fenceEarlyNsMemberRef(lowerer, expr, memberSym);
+      return lowerExpr(lowerer, nsMember);
+    }
+    // Expando function members (`foo.bar` after `foo.bar = 12`): the
+    // member's module global (lower-expando.ts), before the ambient-
+    // namespace fence — a declare-namespace merge over a real function
+    // (`declare namespace Foo { var baz: number }` + `function Foo`)
+    // reads its assigned members, not the ambient ReferenceError.
+    {
+      const ex = expandoMemberRead(lowerer, expr);
+      if (ex) return lowerer.maybeNarrow(ex, expr);
+    }
+    // An AMBIENT namespace receiver (`M.x` where only `declare
+    // namespace M` exists): the namespace object never exists at
+    // runtime — Node's exact catchable ReferenceError at the access,
+    // the ambient `declare const` stance.
+    const ambientRoot = ambientNsRootOf(lowerer, expr.expression);
+    if (ambientRoot !== null) {
+      const t = ambientUndefReadType(lowerer, expr);
+      if (t) return nsUndefRead(lowerer, ambientRoot.text, expr, t);
+    }
+  }
+  // `exports.<name>` READS in a module whose export object was
+  // REPLACED (`module.exports = ...`): `exports` still references the
+  // ORIGINAL object — Node's aliasing rule — so when nothing ever
+  // attached this name to it (`exports.<name> =` nowhere in the
+  // file), the honest answer is undefined. tsc types the read off the
+  // REPLACEMENT (its CJS model is identity-blind), which is exactly
+  // the undiagnosed divergence this lowering closes. Reads in modules with
+  // real `exports.<name> =` attachments keep their fences.
+  {
+    const ex = lowerReplacedExportsRead(lowerer, expr);
+    if (ex) return ex;
+  }
+  // `this.<name>` inside a CJS export-table getter: Node binds the
+  // receiver to module.exports — the read is the sibling getter's
+  // lifted call.
+  {
+    const tm = lowerCjsExportTableThisMember(lowerer, expr);
+    if (tm) return tm;
+  }
+  // Property signatures of class-backed protocols read implementing
+  // classes' fields directly.
+  if (!hasOptionalChainGuard(expr.expression)) {
+    const typed = lowerProtocolPropertyRead(lowerer, expr);
+    if (typed) return typed;
+  }
+  const handled =
+    lowerer.lowerProcessEnvGet(expr) ??
+    lowerer.lowerServerProperty(expr) ??
+    // diagnostics_channel Channel receivers — name/hasSubscribers
+    // over the f64 channel handle.
+    lowerer.lowerDiagnosticsChannelProperty(expr) ??
+    // readline Interface receivers — the history and option members
+    // over the f64 interface handle.
+    lowerReadlineProperty(lowerer, expr) ??
+    // TracingChannel receivers — the five event channels and
+    // hasSubscribers over the f64 tracing handle.
+    lowerer.lowerTracingChannelProperty(expr) ??
+    lowerer.lowerTestCtxProperty(expr) ??
+    lowerer.lowerProcessProperty(expr) ??
+    lowerer.lowerProcessStreamProperty(expr) ??
+    lowerer.lowerFsConstantsProperty(expr) ??
+    // http2.constants.NGHTTP2_CANCEL (any constants-object spelling):
+    // the baked-literal table.
+    lowerer.lowerBuiltinConstantsProperty(expr) ??
+    // Builtin namespace imports (`path.sep`, `os.EOL`,
+    // `fs.constants.R_OK` where the root is `import * as ...`): the
+    // same constants and per-member fences as named builtin imports.
+    lowerer.lowerNamespaceBuiltinProperty(expr) ??
+    lowerer.lowerJsonProperty(expr) ??
+    lowerer.lowerErrorCodeProperty(expr) ??
+    lowerer.lowerNumberStaticProperty(expr) ??
+    lowerEventStaticProperty(lowerer, expr) ??
+    lowerer.lowerMathProperty(expr) ??
+    lowerer.lowerIntrinsicProperty(expr) ??
+    // The _readableState/_writableState scalar READS (the suite's
+    // asserts) — checked before the generic stream property surface:
+    // the inner access maps no type of its own.
+    lowerStreamStateProperty(lowerer, expr) ??
+    lowerStreamObjectProperty(lowerer, expr) ??
+    lowerEventObjectProperty(lowerer, expr) ??
+    lowerer.lowerUnionProperty(expr) ??
+    lowerer.lowerFieldRead(expr);
+  // A union-typed field read narrows like an identifier when the
+  // checker has narrowed this use to one arm.
+  if (handled) {
+    if (
+      handled.type.kind === "union" &&
+      lowerer.armTag(handled.type.unionId, UNDEFINED_T) >= 0 &&
+      handled.kind === "recordGet" &&
+      lowerer.isRuntimeOptionalField(handled.shapeId, handled.field)
+    )
+      return handled;
+    // A class field assigned a missing read: the checker narrows this
+    // read to the assigned value's bare type, but the stored undefined
+    // arm is real (`obj.n = bytes[i]; obj.n` is undefined in Node).
+    if (runtimeOptionalClassField(lowerer, handled, expr)) return handled;
+    return iteratorResultValueRead(lowerer, handled, expr) ?? lowerer.maybeNarrow(handled, expr);
+  }
+  // `globalThis.<name>` that no lowering above claimed
+  // (globalThis.crypto, globalThis.SubtleCrypto, globalThis.localStorage
+  // — the harness's capability-conditional knownGlobals adds): the
+  // PROPERTY spelling of the identifier chokepoint's JS rule — a stdlib
+  // global taken as a VALUE in a JavaScript source is the same opaque
+  // IDENTITY TOKEN the bare spelling answers (`globalThis.crypto` IS
+  // `crypto` — one global, one token, or identity flows through Sets
+  // and === would disagree between the two spellings). TypeScript
+  // sources keep the SC2020 member fence below, like the bare form.
+  if (
+    !expr.questionDotToken &&
+    stdlibGlobalNameOf(lowerer, expr.expression) === "globalThis" &&
+    isJsSourceFile(expr.getSourceFile())
+  ) {
+    const canonical = stdlibGlobalNameOf(lowerer, expr);
+    if (canonical !== null) {
+      if (canonical === "globalThis") return lowerGlobalValue(lowerer, expr);
+      if (canonical === "ArrayBuffer")
+        return { kind: "libCall", fn: "arrayBuffer.constructor", args: [], type: DYN, loc };
+      if (canonical === "fetch")
+        return { kind: "libCall", fn: "fetch.function", args: [], type: DYN, loc };
+      if (Object.values(BYTES_ELEMENT_NAME).includes(canonical))
+        return {
+          kind: "libCall",
+          fn: "bytes.constructor",
+          args: [{ kind: "strLit", value: canonical, type: STRING, loc }],
+          type: DYN,
+          loc,
+        };
+      return { kind: "strLit", value: `[builtin ${canonical}]`, type: STRING, loc };
+    }
+  }
+  // A JS receiver whose CHECKER type has no mapping (`mustCallChecks
+  // .length` where the binding is an evolving any[] living as a
+  // checked-dynamic global): the stdlib member fence below would blame
+  // the unmappable checker type (`any[].length`), but the VALUE is a
+  // dyn node — lower the receiver first and read through the dyn keyed
+  // read (ARR answers length; everything else JS's own-property
+  // answer). Mapped receivers keep the fence-first order: their
+  // members' gaps are real surface gaps ([1,2].entries), not
+  // representation artifacts. `.length` on a receiver whose checker
+  // ARRAY type lowers to the checked-dynamic representation —
+  // `unknown[]`, the collapsed `(string | object)[]`, and the `any[]`
+  // an Array.isArray guard narrows a collapsed union to — is the checked-dynamic tree
+  // array's OWN length (a keyed read the ARR kind answers exactly),
+  // never an `Array.prototype` surface gap; both source languages.
+  // Prototype-method VALUE reads (`ps.map` unparenthesized) keep the
+  // fence-first order: a stored-member undefined would mis-answer
+  // them, and calls dispatch through the dyn method machinery
+  // instead.
+  if (
+    (isJsSourceFile(expr.getSourceFile()) &&
+      (lowerer.mapTypeOf(lowerer.typeOf(expr.expression)) === null ||
+        (lowerer.typeOf(expr.expression).flags & ts.TypeFlags.Never) !== 0 ||
+        // A never-tainted receiver type maps (never rides as f64) but
+        // its VALUE lowered checked-dynamic — same dyn read.
+        neverTaintedJsType(lowerer, expr.expression, lowerer.typeOf(expr.expression)))) ||
+    (expr.name.text === "length" &&
+      (lowerer.checkerAnyArray(expr.expression) ||
+        (lowerer.checker.isArrayType(lowerer.typeOf(expr.expression)) &&
+          lowerer.mapTypeOf(lowerer.typeOf(expr.expression))?.kind === "dyn")))
+  ) {
+    const recv = lowerer.lowerExpr(expr.expression);
+    if (recv.type.kind === "dyn") {
+      const key: IrExpr = {
+        kind: "strLit",
+        value: expr.name.text,
+        type: STRING,
+        loc: locOf(expr.name),
+      };
+      const opt = hasOptionalChainGuard(expr.expression);
+      return lowerer.maybeNarrow(
+        {
+          kind: "dynKeyGet",
+          key,
+          ...(opt ? { optional: true as const } : {}),
+          value: recv,
+          type: DYN,
+          loc,
+        },
+        expr,
+      );
+    }
+    if (
+      expr.name.text === "length" &&
+      (recv.type.kind === "array" || recv.type.kind === "string")
+    ) {
+      return recv.type.kind === "array"
+        ? { kind: "arrIntrinsic", method: "length", receiver: recv, args: [], type: F64, loc }
+        : { kind: "strIntrinsic", method: "length", receiver: recv, args: [], type: F64, loc };
+    }
+  }
+  if (isJsSourceFile(expr.getSourceFile()) && expr.name.text === "constructor") {
+    const receiver = tryLowerExpression(lowerer, expr.expression);
+    if (
+      receiver?.type.kind === "dyn" ||
+      (receiver?.type.kind === "object" &&
+        !lowerer.classes.get(receiver.type.className)?.fields.has("constructor"))
+    ) {
+      return {
+        kind: "dynKeyGet",
+        value: lowerer.coerceToExpected(receiver, DYN),
+        key: { kind: "strLit", value: "constructor", type: STRING, loc },
+        type: DYN,
+        loc,
+      };
+    }
+  }
+  // `f.name` / `f.length` / own properties on a FUNCTION-typed JS
+  // value (the mustCall wrapper's function-instance members): read
+  // through the dyn box — the closure's own-property table answers
+  // first (defineProperties writes land there), then the box's
+  // best-effort static name and the declared arity; anything else is
+  // the own-property answer, undefined. Function.prototype METHOD
+  // names stay fenced (a stored-member undefined would mis-answer
+  // `f.call` as a value). Static callable values keep the existing TS fence; checked callable
+  // storage can expose its own name and length in both source languages.
+  if (
+    !["apply", "bind", "call", "toString", "caller", "arguments"].includes(expr.name.text) &&
+    (isJsSourceFile(expr.getSourceFile()) ||
+      expr.name.text === "name" ||
+      expr.name.text === "length" ||
+      expr.name.text === "constructor")
+  ) {
+    const probed = tryLowerExpression(lowerer, expr.expression);
+    // Inferred callable returns can use checked storage even when the
+    // checker still describes a function. Read its actual dyn value;
+    // the ambient Function member must not hide its own properties.
+    const receiverType = lowerer.typeOf(expr.expression);
+    const receiverSymbol = receiverType.getSymbol();
+    const checkedFunction =
+      lowerer.checker.getCallSignatures(receiverType).length > 0 ||
+      (receiverSymbol?.name === "Function" && lowerer.isStdlibSymbol(receiverSymbol));
+    if (probed?.type.kind === "dyn" && checkedFunction) {
+      const key: IrExpr = {
+        kind: "strLit",
+        value: expr.name.text,
+        type: STRING,
+        loc: locOf(expr.name),
+      };
+      const opt = hasOptionalChainGuard(expr.expression);
+      return lowerer.maybeNarrow(
+        {
+          kind: "dynKeyGet",
+          key,
+          value: probed,
+          ...(opt ? { optional: true as const } : {}),
+          type: DYN,
+          loc,
+        },
+        expr,
+      );
+    }
+    if (
+      (isJsSourceFile(expr.getSourceFile()) || expr.name.text === "constructor") &&
+      probed?.type.kind === "func" &&
+      canBoxFuncIntoDyn(
+        probed.type,
+        (id) => lowerer.shapes.get(id),
+        (id) => lowerer.unions.get(id),
+      )
+    ) {
+      const fnName = jsFuncNameOf(expr.expression);
+      const boxed: IrExpr = {
+        kind: "dynFrom",
+        value: probed,
+        type: DYN,
+        ...(fnName !== null ? { fnName } : {}),
+        loc,
+      };
+      const key: IrExpr = {
+        kind: "strLit",
+        value: expr.name.text,
+        type: STRING,
+        loc: locOf(expr.name),
+      };
+      return lowerer.maybeNarrow({ kind: "dynKeyGet", key, value: boxed, type: DYN, loc }, expr);
+    }
+  }
+  // A NARROWED IteratorResult receiver (`if (!r.done) r.value` — the
+  // checker narrows to IteratorYieldResult/IteratorReturnResult, whose
+  // own type cannot map: the shared record shape needs BOTH channels):
+  // the receiver's LOWERED record still carries the field, so the read
+  // is an ordinary recordGet — maybeNarrow then bridges the union slot
+  // to the checker's narrowed arm, exactly like a union field read.
+  if (expr.name.text === "done" || expr.name.text === "value") {
+    const receiverType = lowerer.typeOf(expr.expression);
+    const recvSym =
+      receiverType.getAliasSymbol()?.name === "IteratorResult"
+        ? receiverType.getAliasSymbol()
+        : receiverType.getSymbol();
+    if (
+      (recvSym?.name === "IteratorResult" ||
+        recvSym?.name === "IteratorYieldResult" ||
+        recvSym?.name === "IteratorReturnResult") &&
+      recvSym.declarations.some(
+        (d) =>
+          (ts.isInterfaceDeclaration(d) || ts.isTypeAliasDeclaration(d)) &&
+          lowerer.isStdlibFile(d.getSourceFile()),
+      )
+    ) {
+      const recv = lowerer.lowerExpr(expr.expression);
+      if (recv.type.kind === "dyn")
+        return lowerer.maybeNarrow(
+          {
+            kind: "dynKeyGet",
+            value: recv,
+            key: { kind: "strLit", value: expr.name.text, type: STRING, loc },
+            type: DYN,
+            loc,
+          },
+          expr,
+        );
+      if (recv.type.kind === "record") {
+        const shape = lowerer.shapes.get(recv.type.shapeId);
+        const field = shape?.fields.find((f) => f.name === expr.name.text);
+        if (field) {
+          const read: IrExpr = {
+            kind: "recordGet",
+            obj: recv,
+            shapeId: recv.type.shapeId,
+            field: field.name,
+            type: field.type,
+            loc,
+          };
+          return iteratorResultValueRead(lowerer, read, expr) ?? lowerer.maybeNarrow(read, expr);
+        }
+      }
+    }
+  }
+  // A chain rooted at an initializer-less ambient `declare const/var`
+  // whose declared type has NO mapping (mappable roots compose through
+  // the bare-read undefRead and never reach here): Node throws the
+  // catchable ReferenceError at the ROOT read before any member
+  // matters, so the whole access lowers to that throw — typed by the
+  // use site, or by the context it flows into (the throw never
+  // returns, so the dummy is never observed).
+  {
+    const ambientRoot = ambientUndefVarRootOf(lowerer, expr);
+    if (ambientRoot !== null) {
+      const t = ambientUndefReadType(lowerer, expr) ?? contextualUndefReadType(lowerer, expr);
+      if (t) return nsUndefRead(lowerer, ambientRoot.text, expr, t);
+    }
+  }
+  // Checked-dynamic stdlib results retain ambient property symbols,
+  // including parseArgs tokens narrowed to anonymous union arms. Only
+  // members owned by these implemented families bypass the stdlib fence.
+  const segmentDataSymbol = lowerer.typeOf(expr.expression).getSymbol();
+  const segmentDataProperty =
+    segmentDataSymbol?.name === "SegmentData" &&
+    lowerer.isStdlibSymbol(segmentDataSymbol) &&
+    ["segment", "index", "input", "isWordLike"].includes(expr.name.text);
+  // os.constants members vary by platform (the declared groups list
+  // every platform's names): a number member reads as `number |
+  // undefined`, like an array element, and a group stays checked.
+  const osConstants = isOsConstantsType(lowerer.typeOf(expr.expression), lowerer);
+  if (
+    isParseArgsDynProperty(lowerer, expr) ||
+    isStatFsDynProperty(lowerer, expr) ||
+    segmentDataProperty ||
+    osConstants ||
+    isLegacyUrlSymbol(lowerer.checker.getSymbolAtLocation(expr.name), lowerer)
+  ) {
+    const recv = lowerer.lowerExpr(expr.expression);
+    if (recv.type.kind === "dyn") {
+      const key: IrExpr = {
+        kind: "strLit",
+        value: expr.name.text,
+        type: STRING,
+        loc: locOf(expr.name),
+      };
+      const opt = hasOptionalChainGuard(expr.expression);
+      const read: IrExpr = {
+        kind: "dynKeyGet",
+        key,
+        ...(opt ? { optional: true as const } : {}),
+        value: recv,
+        type: DYN,
+        loc,
+      };
+      if (osConstants) {
+        return lowerer.mapTypeOf(lowerer.typeOf(expr))?.kind === "f64"
+          ? lowerer.coerceToExpected(read, lowerer.withUndefinedArm(F64))
+          : read;
+      }
+      return lowerer.maybeNarrow(read, expr);
+    }
+  }
+  // A member read through a NULLISH generic binding (`const i: I<A &
+  // B> = null as any; const _i: I<A> = i.something` — the receiver
+  // provably holds null/undefined forever): the read throws Node's
+  // exact TypeError at the access.
+  if (ts.isIdentifier(expr.expression) && expr.questionDotToken === undefined) {
+    const unit = nullishGenericBindingUnitOf(lowerer, lowerer.resolveValueSymbol(expr.expression));
+    if (unit !== null) {
+      const t =
+        ambientUndefReadType(lowerer, expr) ?? contextualUndefReadType(lowerer, expr) ?? F64;
+      return nodeThrowExpr(
+        1,
+        "",
+        `Cannot read properties of ${unit} (reading '${expr.name.text}')`,
+        t,
+        loc,
+      );
+    }
+  }
+  // The lib fence's PROPERTY chokepoint: a stdlib-declared member that
+  // no lowering above claimed ([1,2].entries, Math.SQRT2, Promise.all,
+  // re.exec as a value, ...) reports SC2020 here.
+  lowerer.stdlibMemberFence(expr);
+  // The npm chokepoint: a member on a package-typed receiver in a
+  // static build — attributed to the package, like every other site.
+  lowerer.npmMemberFence(expr);
+  // A property read rooted at a BLOCKED binding: the declaration
+  // carries the real diagnostic — the SC2004 cascade, not a generic
+  // "property access" rejection.
+  {
+    let root: ts.Expression = expr.expression;
+    while (ts.isPropertyAccessExpression(root)) root = root.expression;
+    if (ts.isIdentifier(root) && lowerer.isBlockedBinding(lowerer.resolveValueSymbol(root))) {
+      lowerer.pushDiag(blockedBindingUseDiag(root.text, loc));
+      throw new PoisonError();
+    }
+  }
+  // Nothing claimed the member. Lower the RECEIVER before rejecting:
+  // when the receiver itself is the blocker (`(await import(x)).y` —
+  // the dynamic import is the unsupported part), ITS diagnostic is the
+  // honest one, not a generic recitation about the outer dot. A
+  // receiver that lowers cleanly means the MEMBER is the gap — name
+  // the property and the receiver's type instead of "property access".
+  const recvLowered = lowerer.lowerExpr(expr.expression);
+  // A dyn receiver — JSON.parse's `any`, or `unknown` the checker
+  // narrowed to `object` — reads through the dyn keyed read: member
+  // or undefined (JS's own-property answer), throwing JS's TypeError
+  // on undefined/null receivers unless an earlier `?.` guards the
+  // chain. Scalar-narrowed occurrences bridge via maybeNarrow's
+  // validated dynCheck as usual.
+  if (
+    recvLowered.type.kind === "dyn" ||
+    (isJsSourceFile(expr.getSourceFile()) &&
+      (["f64", "bool", "bigint", "string", "symbol"].includes(recvLowered.type.kind) ||
+        (recvLowered.type.kind === "union" && lowerer.dynConvertible(recvLowered.type))))
+  ) {
+    const key: IrExpr = {
+      kind: "strLit",
+      value: expr.name.text,
+      type: STRING,
+      loc: locOf(expr.name),
+    };
+    const opt = hasOptionalChainGuard(expr.expression);
+    return lowerer.maybeNarrow(
+      {
+        kind: "dynKeyGet",
+        key,
+        ...(opt ? { optional: true as const } : {}),
+        value: lowerer.coerceToExpected(recvLowered, DYN),
+        type: DYN,
+        loc,
+      },
+      expr,
+    );
+  }
+  // The lowered receiver is a RECORD the checker spelled wider —
+  // `s.match(re).groups.key` in a JS file: the checker says
+  // `{ [key: string]: string } | undefined`, but the groups
+  // projection already answered the record arm (its null trap
+  // included). Declared fields read directly; an index-signature
+  // shape serves undeclared keys through the overflow read, exactly
+  // the dot-access rule on checker-spelled hybrids.
+  if (recvLowered.type.kind === "record") {
+    const recvShape = lowerer.shapes.get(recvLowered.type.shapeId);
+    const field = recvShape?.fields.find((f) => f.name === expr.name.text);
+    if (field) {
+      return lowerer.maybeNarrow(
+        {
+          kind: "recordGet",
+          obj: recvLowered,
+          shapeId: recvLowered.type.shapeId,
+          field: field.name,
+          type: field.type,
+          loc,
+        },
+        expr,
+      );
+    }
+    if (recvShape?.indexValue !== undefined && !recvShape.tuple) {
+      return lowerer.maybeNarrow(
+        {
+          kind: "recordKeyGet",
+          obj: recvLowered,
+          shapeId: recvLowered.type.shapeId,
+          key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
+          overflowOnly: true,
+          type: recvShape.indexValue,
+          loc,
+        },
+        expr,
+      );
+    }
+    // An inferred package-JS call specializes a parameter to the
+    // caller's own record shape. Optional option names omitted by that
+    // caller read undefined; the missing field is not a failed type
+    // assertion. Known prototype members were handled/fenced above.
+    if (
+      recvShape &&
+      !recvShape.tuple &&
+      lowerer.implicitParamTypes !== null &&
+      isJsSourceFile(expr.getSourceFile()) &&
+      npmStaticPackageOfPath(expr.getSourceFile().fileName) !== null
+    ) {
+      return {
+        kind: "seqExpr",
+        stmts: [{ kind: "exprStmt", expr: recvLowered, loc }],
+        result: dynUndefinedExpr(loc),
+        type: DYN,
+        loc,
+      };
+    }
+  }
+  // An ABSTRACT property through an abstract-typed receiver: the
+  // declaration is erased at runtime — Node defines no field for it,
+  // each concrete subclass declares its OWN (at its own layout
+  // position), so no shared base slot exists to read. Abstract
+  // ACCESSORS are the supported spelling: they declare a vtable slot.
+  if (recvLowered.type.kind === "object" && abstractPropertyDeclOf(lowerer, expr)) {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      `reading the abstract property '${expr.name.text}' through a '${lowerer.checker.typeToString(lowerer.typeOf(expr.expression))}'-typed receiver (abstract property declarations are erased at runtime, so no shared slot exists — type the receiver as the concrete class, or declare an abstract getter instead)`,
+    );
+  }
+  // Array reads may add an undefined arm even when the checker still
+  // reports a class. Its property bag must remain reachable, while
+  // an absent element takes the normal checked-value TypeError.
+  const nativeReceiver = lowerer.stripUndefinedArm(recvLowered.type);
+  if (ts.isPrivateIdentifier(expr.name) && recvLowered.type.kind === "object") {
+    const field = lowerer.classes.get(recvLowered.type.className)?.fields.get(expr.name.text);
+    if (field)
+      return {
+        kind: "fieldGet",
+        obj: recvLowered,
+        className: recvLowered.type.className,
+        field: expr.name.text,
+        type: field,
+        loc,
+      };
+  }
+  if (nativeReceiver.kind === "object" && nativeReceiver.className === "%Error") {
+    return lowerer.maybeNarrow(
+      {
+        kind: "dynKeyGet",
+        value: lowerer.coerceToExpected(recvLowered, DYN),
+        key: { kind: "strLit", value: expr.name.text, type: STRING, loc },
+        type: DYN,
+        loc,
+      },
+      expr,
+    );
+  }
+  if (isDynTypedRefType(nativeReceiver)) {
+    const info = lowerer.classes.get(nativeReceiver.className);
+    if (
+      info &&
+      !info.def.runtime &&
+      !info.builtinError &&
+      !info.builtinEmitter &&
+      !info.builtinStream
+    ) {
+      return lowerer.maybeNarrow(
+        {
+          kind: "dynKeyGet",
+          value: lowerer.coerceToExpected(recvLowered, DYN),
+          key: { kind: "strLit", value: expr.name.text, type: STRING, loc },
+          type: DYN,
+          loc,
+        },
+        expr,
+      );
+    }
+  }
+  // A member a JavaScript module attached to one of its functions
+  // (`status.message = codes; module.exports = status`), read from
+  // TypeScript: JavaScript stores such members on the function's own
+  // property table (`fn.member = v` writes through the function's
+  // checked-dynamic face), so the read takes the same path and enters
+  // the static code at the type inference gave the member.
+  if (recvLowered.type.kind === "func" && jsFunctionExpandoMember(lowerer, expr)) {
+    const read: IrExpr = {
+      kind: "dynKeyGet",
+      value: lowerer.coerceToExpected(recvLowered, DYN),
+      key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
+      type: DYN,
+      loc,
+    };
+    const mapped = lowerer.mapTypeOf(lowerer.typeOf(expr));
+    return mapped && mapped.kind !== "void" ? lowerer.coerceInto(expr, read, mapped) : read;
+  }
+  lowerer.unsupported(
+    "SC1090",
+    expr,
+    `reading '${expr.name.text}' from a value of type '${lowerer.checker.typeToString(lowerer.typeOf(expr.expression))}'`,
+  );
+}
+
+function importMetaProperty(lowerer: Lowerer, expr: ts.PropertyAccessExpression): IrExpr | null {
+  return isImportMeta(expr.expression) ? importMetaField(lowerer, expr, expr.name.text) : null;
+}
+
+/** The TypeError of a deferred-init field read that finds the field
+ * unassigned where its declared type cannot hold undefined. */
+export const DEFERRED_READ_MESSAGE =
+  "undefined is not representable in the target union (a value narrowed or asserted past it still held it)";
+
+/** Property access on a string or array receiver: `.length` lowers to the
+ * matching intrinsic; a bare method reference (`const f = s.slice` — a
+ * function value) is rejected with a specific message. Returns null for
+ * other receivers (the generic property-access rejection applies). Both
+ * the receiver type AND the ambient-file provenance of the member are
+ * verified — the name alone proves nothing. */
+export function lowerIntrinsicProperty(
+  lowerer: Lowerer,
+  expr: ts.PropertyAccessExpression,
+): IrExpr | null {
+  for (const name of ["String", "Number", "Boolean", "BigInt"] as (
+    | "String"
+    | "Number"
+    | "Boolean"
+    | "BigInt"
+  )[]) {
+    if (!lowerer.chainBlocked(expr) && lowerer.isStdlibGlobal(expr, name)) {
+      return primitiveCtorClosure(lowerer, name, locOf(expr), isJsSourceFile(expr.getSourceFile()));
+    }
+  }
+  if (lowerer.stdlibGlobalMember(expr, "Reflect") === "ownKeys") {
+    const value = lowerer.lowerNativeCallableValue(
+      {
+        fn: "dyn.ownKeys",
+        params: [DYN],
+        result: DYN,
+        valueParams: [{ mode: "required", type: DYN }],
+      },
+      "Reflect.ownKeys",
+      locOf(expr),
+    )!;
+    return { kind: "dynFrom", value, fnName: "ownKeys", type: DYN, loc: locOf(expr) };
+  }
+  if (lowerer.chainBlocked(expr)) return null;
+  const builtinPrototype = builtinPrototypeMethod(lowerer, expr);
+  if (builtinPrototype)
+    return {
+      kind: "libCall",
+      fn: "dyn.builtinMethod",
+      args: [
+        { kind: "strLit", value: builtinPrototype, type: STRING, loc: locOf(expr) },
+        { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
+      ],
+      type: DYN,
+      loc: locOf(expr),
+    };
+  if (
+    ts.isPropertyAccessExpression(expr.expression) &&
+    lowerer.stdlibGlobalMember(expr.expression, "Array") === "prototype"
+  ) {
+    return {
+      kind: "dynKeyGet",
+      value: {
+        kind: "libCall",
+        fn: "dyn.arrayPrototype",
+        args: [],
+        type: DYN,
+        loc: locOf(expr.expression),
+      },
+      key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
+      type: DYN,
+      loc: locOf(expr),
+    };
+  }
+  if (
+    expr.name.text === "apply" &&
+    ts.isPropertyAccessExpression(expr.expression) &&
+    lowerer.stdlibGlobalMember(expr.expression, "Function") === "prototype"
+  )
+    return { kind: "libCall", fn: "dyn.functionApply", args: [], type: DYN, loc: locOf(expr) };
+  if (lowerer.stdlibGlobalMember(expr, "Array") === "prototype")
+    return { kind: "libCall", fn: "dyn.arrayPrototype", args: [], type: DYN, loc: locOf(expr) };
+  if (lowerer.stdlibGlobalMember(expr, "Object") === "prototype")
+    return { kind: "libCall", fn: "dyn.objectPrototype", args: [], type: DYN, loc: locOf(expr) };
+  // Function.prototype as a VALUE (a prototype-chain link:
+  // `Object.setPrototypeOf(F.prototype, Function.prototype)`): one
+  // anonymous function answering undefined, length 0 — a zero-capture
+  // closure of a compiler helper, so every read is the same function
+  // (closure identity) and shares its property table. Reads through it
+  // find the function members the checked runtime models for every
+  // function (apply, constructor, name, length). Member forms keep their
+  // own lowerings.
+  if (lowerer.stdlibGlobalMember(expr, "Function") === "prototype") {
+    const loc = locOf(expr);
+    const name = "%dyn.functionPrototype";
+    if (!lowerer.liftedFns.some((fn) => fn.name === name))
+      lowerer.liftedFns.push({
+        name,
+        params: [],
+        locals: [],
+        returnType: DYN,
+        body: [{ kind: "return", value: dynUndefinedExpr(loc), loc }],
+        loc,
+      });
+    return {
+      kind: "dynFrom",
+      value: { kind: "closure", fnName: name, captures: [], type: funcOf([], DYN), loc },
+      fnName: "",
+      type: DYN,
+      loc,
+    };
+  }
+  if (lowerer.stdlibGlobalMember(expr, "Array") === "isArray")
+    return lowerArrayIsArrayValue(lowerer, locOf(expr));
+  if (lowerer.stdlibGlobalMember(expr, "Array") === "from")
+    return lowerArrayFromValue(lowerer, locOf(expr));
+  const stringMember = lowerer.stdlibGlobalMember(expr, "String");
+  if (stringMember === "fromCharCode" || stringMember === "fromCodePoint")
+    return lowerStringCodesValue(lowerer, stringMember, locOf(expr));
+  const numberMember = lowerer.stdlibGlobalMember(expr, "Number");
+  if (numberMember === "parseInt" || numberMember === "parseFloat")
+    return lowerNumberParserValue(lowerer, numberMember, locOf(expr));
+  if (lowerer.stdlibGlobalMember(expr, "Buffer") === "poolSize")
+    return { kind: "libCall", fn: "buffer.poolSize", args: [], type: F64, loc: locOf(expr) };
+  const netAddressStatic = lowerNetAddressStaticRead(lowerer, expr);
+  if (netAddressStatic) return netAddressStatic;
+  if (lowerer.stdlibGlobalMember(expr, "Buffer") === "isBuffer")
+    return lowerCheckedPredicateValue(lowerer, "Buffer.isBuffer", "buffer", locOf(expr));
+  if (lowerer.stdlibGlobalMember(expr, "Date") === "now")
+    return lowerer.lowerNativeCallableValue(
+      {
+        fn: "date.now",
+        params: [],
+        result: F64,
+        valueParams: [],
+      },
+      "Date.now",
+      locOf(expr),
+    );
+  if (stdlibGlobalNameOf(lowerer, expr.expression) === "Object") {
+    if (expr.name.text === "assign") return lowerObjectAssignValue(lowerer, locOf(expr));
+    const fn = own(OBJECT_CALLABLE_VALUES, expr.name.text);
+    if (fn) return lowerer.lowerNativeCallableValue(fn, `Object.${expr.name.text}`, locOf(expr));
+  }
+  // A never-tainted JS receiver type lowered checked-dynamic
+  // (neverTaintedJsType — `cmd.length` on `const cmd = ['pwd', []]`):
+  // stand down so the dyn keyed read below the chain answers, instead
+  // of an array libCall over a dyn receiver hitting the boundary fence.
+  let kind = neverTaintedJsType(lowerer, expr.expression, lowerer.typeOf(expr.expression))
+    ? undefined
+    : lowerer.mapTypeOf(lowerer.typeOf(expr.expression))?.kind;
+  // A checker-`any[]` receiver (the readonly-array Array.isArray quirk)
+  // whose VALUE lowers to a real static array (maybeNarrow's isArray
+  // bridge): `.length` and friends ride the array path on the lowered
+  // value (re-lowering is pure IR construction).
+  if (kind === undefined && lowerer.checkerAnyArray(expr.expression)) {
+    const probe = lowerer.lowerExpr(expr.expression);
+    if (probe.type.kind === "array") kind = "array";
+  }
+  if (
+    kind !== "string" &&
+    kind !== "array" &&
+    kind !== "map" &&
+    kind !== "set" &&
+    kind !== "f64" &&
+    kind !== "date" &&
+    kind !== "regex" &&
+    kind !== "url" &&
+    kind !== "searchParams" &&
+    kind !== "stats" &&
+    kind !== "spawnRes" &&
+    kind !== "child" &&
+    kind !== "bytes" &&
+    kind !== "symbol"
+  ) {
+    return null;
+  }
+  // child receivers also admit the user's own child-shaped interface
+  // members (the NgrokChildProcess duck rule — see isChildSurfaceMember).
+  // The EMPTY tuple `[]` rides the array REPRESENTATION (type-mapper.ts), but
+  // its `length` member is the tuple's own synthesized property, not
+  // Array.prototype's — provenance alone would refuse it. It reads the
+  // runtime length (always 0) through the array intrinsic like any other
+  // array; non-empty tuples never reach here (they map to records and
+  // fold their arity constant on the record path).
+  const tupleLengthOnArray =
+    kind === "array" &&
+    expr.name.text === "length" &&
+    lowerer.checker.isTupleType(
+      lowerer.checker.getBaseTypeOfLiteralType(lowerer.typeOf(expr.expression)),
+    );
+  if (
+    kind === "child"
+      ? !isChildSurfaceMember(lowerer, expr)
+      : !tupleLengthOnArray && !lowerer.isStdlibMember(expr)
+  )
+    return null;
+  const name = expr.name.text;
+  if (kind === "array" && name === "constructor" && isJsSourceFile(expr.getSourceFile())) {
+    const receiver = lowerer.lowerExpr(expr.expression);
+    if (receiver.type.kind === "dyn")
+      return {
+        kind: "dynKeyGet",
+        value: receiver,
+        key: { kind: "strLit", value: name, type: STRING, loc: locOf(expr) },
+        type: DYN,
+        loc: locOf(expr),
+      };
+    const result: IrExpr = {
+      kind: "libCall",
+      fn: "dyn.arrayConstructor",
+      args: [],
+      type: DYN,
+      loc: locOf(expr),
+    };
+    return {
+      kind: "seqExpr",
+      stmts: [{ kind: "exprStmt", expr: receiver, loc: locOf(expr) }],
+      result,
+      type: DYN,
+      loc: locOf(expr),
+    };
+  }
+  const strictReceiver = (expected: IrType): IrExpr => {
+    const value = lowerer.lowerExpr(expr.expression);
+    if (value.type.kind === "dyn") {
+      if (isJsSourceFile(expr.getSourceFile()) && name === "length") return value;
+      return lowerer.coerceInto(expr.expression, value, expected);
+    }
+    return lowerer.runtimeOptionalPropertyReceiver(expr.expression, value, expected, name) ?? value;
+  };
+  if (kind === "child") {
+    const loc = locOf(expr);
+    // The lifecycle reads, Node's exact shapes (SEMANTICS.md pins the
+    // matrix): pid is `number | undefined` (undefined = spawn failure),
+    // exitCode `number | null` (null while running and after a signal
+    // death; -errno once a spawn failure settled), killed the
+    // sent-a-signal flag. The unions build type-directedly in the
+    // backend (the spawnRes.status pattern); a checker-narrowed read
+    // extracts through maybeNarrow like any union member.
+    if (name === "pid") {
+      const receiver = lowerer.lowerExpr(expr.expression);
+      const type: IrType = { kind: "union", unionId: lowerer.unions.intern([F64, UNDEFINED_T]) };
+      return { kind: "libCall", fn: "child.pid", args: [receiver], type, loc };
+    }
+    if (name === "exitCode") {
+      const receiver = lowerer.lowerExpr(expr.expression);
+      const type: IrType = { kind: "union", unionId: lowerer.unions.intern([F64, NULL_T]) };
+      return { kind: "libCall", fn: "child.exitCode", args: [receiver], type, loc };
+    }
+    if (name === "killed") {
+      const receiver = lowerer.lowerExpr(expr.expression);
+      return { kind: "libCall", fn: "child.killed", args: [receiver], type: BOOL, loc };
+    }
+    if (name === "on" || name === "once" || name === "kill" || name === "unref") {
+      lowerer.unsupported("SC1090", expr, `child methods as values (call '${name}' directly)`);
+    }
+    lowerer.noLowering(
+      `ChildProcess.${name}`,
+      expr,
+      'on/once("exit" | "close" | "error", cb), pid, exitCode, killed, kill(signal?), and unref() are the supported ChildProcess members',
+      lowerer.checker.getSymbolAtLocation(expr.name),
+    );
+  }
+  if (kind === "spawnRes") {
+    // The spawnSync-result reads. status is the interned `number | null`
+    // union (null = signal death or spawn failure); stdout/stderr are
+    // the captured utf8 strings — under @types/node WITHOUT the
+    // {encoding: "utf8"} options argument the checker types them Buffer,
+    // which is re-fenced here (the call site already said so).
+    const loc = locOf(expr);
+    if (name === "status") {
+      // Always the interned `number | null` union; a checker-NARROWED
+      // read (`missing.status === null ? ... : ${missing.status}`)
+      // bridges through maybeNarrow like any union read.
+      const receiver = lowerer.lowerExpr(expr.expression);
+      const type: IrType = { kind: "union", unionId: lowerer.unions.intern([F64, NULL_T]) };
+      const read: IrExpr = { kind: "libCall", fn: "spawnRes.status", args: [receiver], type, loc };
+      return lowerer.maybeNarrow(read, expr);
+    }
+    if (name === "stdout" || name === "stderr") {
+      if (lowerer.mapTypeOf(lowerer.typeOf(expr))?.kind !== "string") {
+        lowerer.noLowering(
+          `spawnSync's ${name} without the "utf8" encoding`,
+          expr,
+          'Buffer captures are not representable — call spawnSync(cmd, args, { encoding: "utf8" }) so the outputs are strings',
+        );
+      }
+      const receiver = lowerer.lowerExpr(expr.expression);
+      const fn = name === "stdout" ? "spawnRes.stdout" : "spawnRes.stderr";
+      return { kind: "libCall", fn, args: [receiver], type: STRING, loc };
+    }
+    if (name === "error") {
+      // Node's spawn-failure carrier: `Error | undefined` — a fresh
+      // %Error ("spawnSync <file> ENOENT", `code` stamped) when the
+      // spawn itself failed, the undefined arm otherwise. The libCall
+      // always carries the interned union (the declared `error?: Error`),
+      // and a checker-NARROWED read (`if (r.error) r.error.message`)
+      // bridges through maybeNarrow like any union read.
+      const receiver = lowerer.lowerExpr(expr.expression);
+      const type = lowerer.withUndefinedArmOf({ kind: "object", className: "%Error" });
+      if (!type) lowerer.badType(expr, lowerer.typeOf(expr));
+      const read: IrExpr = { kind: "libCall", fn: "spawnRes.error", args: [receiver], type, loc };
+      return lowerer.maybeNarrow(read, expr);
+    }
+    lowerer.noLowering(
+      `SpawnSyncReturns.${name}`,
+      expr,
+      "status, stdout, stderr, and error are the supported spawnSync-result members",
+      lowerer.checker.getSymbolAtLocation(expr.name),
+    );
+  }
+  if (kind === "stats") {
+    if (name === "size") {
+      const receiver = lowerer.lowerExpr(expr.expression);
+      return { kind: "libCall", fn: "stats.size", args: [receiver], type: F64, loc: locOf(expr) };
+    }
+    if (Object.hasOwn(STATS_TYPE_TESTS, name)) {
+      lowerer.unsupported("SC1090", expr, `Stats methods as values (call '${name}' directly)`);
+    }
+    lowerer.noLowering(
+      `Stats.${name}`,
+      expr,
+      "isFile(), isDirectory(), isSymbolicLink(), isBlockDevice(), isCharacterDevice(), isFIFO(), isSocket(), dev, mode, nlink, uid, gid, rdev, blksize, ino, size, blocks, atimeMs, mtimeMs, ctimeMs, birthtimeMs, atime, mtime, ctime, and birthtime are the supported Stats members",
+      lowerer.checker.getSymbolAtLocation(expr.name),
+    );
+  }
+  if (kind === "date") {
+    const methods = new Set([
+      "getTime",
+      "valueOf",
+      "toISOString",
+      "getFullYear",
+      "getUTCFullYear",
+      "getMonth",
+      "getUTCMonth",
+      "getDate",
+      "getUTCDate",
+      "getDay",
+      "getUTCDay",
+      "getHours",
+      "getUTCHours",
+      "getMinutes",
+      "getUTCMinutes",
+      "getSeconds",
+      "getUTCSeconds",
+      "getMilliseconds",
+      "getUTCMilliseconds",
+      "getTimezoneOffset",
+    ]);
+    if (methods.has(name)) {
+      lowerer.unsupported("SC1090", expr, `Date methods as values (call '${name}' directly)`);
+    }
+    lowerer.noLowering(
+      `Date.prototype.${name}`,
+      expr,
+      "getTime(), valueOf(), toISOString(), the local/UTC calendar getters, and getTimezoneOffset() are supported; Date setters and locale/string formatters have no lowering",
+      lowerer.checker.getSymbolAtLocation(expr.name),
+    );
+  }
+  if (kind === "symbol") {
+    const loc = locOf(expr);
+    // `.description`: the checker's `string | undefined` — undefined
+    // exactly for the description-less Symbol()/Symbol(undefined) forms
+    // (Symbol("") answers the EMPTY STRING arm, like Node). The interned
+    // union builds in the backend from the runtime's +1-or-NULL answer
+    // (the child.stdout pattern); a checker-narrowed read extracts
+    // through maybeNarrow like any union member.
+    if (name === "description") {
+      const receiver = lowerer.coerceToExpected(lowerer.lowerExpr(expr.expression), SYMBOL_T);
+      const type: IrType = { kind: "union", unionId: lowerer.unions.intern([STRING, UNDEFINED_T]) };
+      return { kind: "libCall", fn: "sym.desc", args: [receiver], type, loc };
+    }
+    if (name === "toString" || name === "valueOf") {
+      lowerer.unsupported("SC1090", expr, `symbol methods as values (call '${name}' directly)`);
+    }
+    lowerer.noLowering(
+      `Symbol.prototype.${name}`,
+      expr,
+      "description and toString() are the supported symbol members",
+      lowerer.checker.getSymbolAtLocation(expr.name),
+    );
+  }
+  if (kind === "url") {
+    // The supported URL getters. Everything else the lib declares
+    // (searchParams, setters-as-reads, ...) fences with the
+    // member-qualified name and the supported list. `host` is the WHATWG
+    // serialization: lowercased hostname, `:port` appended exactly when
+    // a non-default port is present (scr_url_host — Node-exact,
+    // opaque-path URLs answer ""); `hostname` is the stored port-less
+    // host field verbatim, including IPv6 brackets.
+    if (
+      name === "protocol" ||
+      name === "origin" ||
+      name === "username" ||
+      name === "password" ||
+      name === "pathname" ||
+      name === "href" ||
+      name === "host" ||
+      name === "hostname" ||
+      name === "port" ||
+      name === "search" ||
+      name === "hash"
+    ) {
+      const receiver = lowerer.lowerExpr(expr.expression);
+      const fn =
+        name === "protocol"
+          ? "url.protocol"
+          : name === "origin"
+            ? "url.origin"
+            : name === "username"
+              ? "url.username"
+              : name === "password"
+                ? "url.password"
+                : name === "pathname"
+                  ? "url.pathname"
+                  : name === "host"
+                    ? "url.host"
+                    : name === "hostname"
+                      ? "url.hostname"
+                      : name === "port"
+                        ? "url.port"
+                        : name === "search"
+                          ? "url.search"
+                          : name === "hash"
+                            ? "url.hash"
+                            : "url.href";
+      return { kind: "libCall", fn, args: [receiver], type: STRING, loc: locOf(expr) };
+    }
+    // `u.searchParams`: the LIVE cached view (one identity per URL —
+    // mutations through it re-serialize into the URL's query, so href
+    // reflects immediately; Node's binding exactly).
+    if (name === "searchParams") {
+      const receiver = lowerer.lowerExpr(expr.expression);
+      return {
+        kind: "libCall",
+        fn: "url.searchParams",
+        args: [receiver],
+        type: SEARCH_PARAMS_T,
+        loc: locOf(expr),
+      };
+    }
+    if (name === "toString" || name === "toJSON") {
+      lowerer.unsupported("SC1090", expr, `URL methods as values (call '${name}' directly)`);
+    }
+    lowerer.noLowering(
+      `URL.${name}`,
+      expr,
+      "protocol, origin, username, password, pathname, href, host, hostname, port, search, hash, searchParams, and toString() are the supported URL members",
+      lowerer.checker.getSymbolAtLocation(expr.name),
+    );
+  }
+  if (kind === "searchParams") {
+    const SEARCH_PARAMS_METHODS = new Set([
+      "get",
+      "getAll",
+      "set",
+      "append",
+      "delete",
+      "has",
+      "sort",
+      "toString",
+      "forEach",
+      "keys",
+      "values",
+      "entries",
+    ]);
+    // The one data property; every method lowers at its CALL
+    // (lowerSearchParamsMethodCall) — bare method references fence.
+    if (name === "size") {
+      const receiver = lowerer.lowerExpr(expr.expression);
+      return { kind: "libCall", fn: "sp.size", args: [receiver], type: F64, loc: locOf(expr) };
+    }
+    if (SEARCH_PARAMS_METHODS.has(name)) {
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        `URLSearchParams methods as values (call '${name}' directly)`,
+      );
+    }
+    lowerer.noLowering(
+      `URLSearchParams.${name}`,
+      expr,
+      "get, getAll, set, append, delete, has, sort, size, toString(), forEach, and for-of iteration are the supported URLSearchParams members",
+      lowerer.checker.getSymbolAtLocation(expr.name),
+    );
+  }
+  if (kind === "regex") {
+    if (name === "lastIndex") {
+      return {
+        kind: "regexIntrinsic",
+        method: "lastIndex",
+        receiver: strictReceiver({ kind: "regex" }),
+        args: [],
+        type: F64,
+        loc: locOf(expr),
+      };
+    }
+    if (name === "source" || name === "flags") {
+      const receiver = strictReceiver({ kind: "regex" });
+      return {
+        kind: "regexIntrinsic",
+        method: name,
+        receiver,
+        args: [],
+        type: STRING,
+        loc: locOf(expr),
+      };
+    }
+    // The flag getters answer whether `flags` holds the flag's letter.
+    const flag = REGEX_FLAG_GETTERS.get(name);
+    if (flag !== undefined) {
+      const loc = locOf(expr);
+      const flags: IrExpr = {
+        kind: "regexIntrinsic",
+        method: "flags",
+        receiver: strictReceiver({ kind: "regex" }),
+        args: [],
+        type: STRING,
+        loc,
+      };
+      return {
+        kind: "strIntrinsic",
+        method: "includes",
+        receiver: flags,
+        args: [{ kind: "strLit", value: flag, type: STRING, loc }],
+        type: BOOL,
+        loc,
+      };
+    }
+    if (name === "test") {
+      lowerer.unsupported("SC1090", expr, "regex methods as values (call 'test' directly)");
+    }
+    return null;
+  }
+  if (kind === "f64") {
+    if (own(STDLIB_SURFACE.number, name) !== undefined) {
+      lowerer.unsupported("SC1090", expr, `number methods as values (call '${name}' directly)`);
+    }
+    return null;
+  }
+  if (kind === "bytes") {
+    const loc = locOf(expr);
+    if (name === "constructor") {
+      const expected = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+      const receiver =
+        expected?.kind === "bytes" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
+      return {
+        kind: "dynKeyGet",
+        value: lowerer.coerceInto(expr.expression, receiver, DYN),
+        key: { kind: "strLit", value: name, type: STRING, loc },
+        type: DYN,
+        loc,
+      };
+    }
+    if (name === "length" || name === "byteLength") {
+      const expected = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+      let receiver =
+        expected?.kind === "bytes" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
+      if (receiver.type.kind === "dyn")
+        return {
+          kind: "dynCheck",
+          value: {
+            kind: "dynKeyGet",
+            value: receiver,
+            key: { kind: "strLit", value: name, type: STRING, loc: locOf(expr) },
+            type: DYN,
+            loc: locOf(expr),
+          },
+          type: F64,
+          loc: locOf(expr),
+        };
+      if (
+        receiver.type.kind === "union" &&
+        lowerer.armTag(receiver.type.unionId, UNDEFINED_T) >= 0
+      ) {
+        const present = lowerer.stripUndefinedArm(receiver.type);
+        const helper =
+          present.kind === "bytes"
+            ? lowerer.narrowedArmHelper(receiver.type.unionId, present, locOf(expr.expression))
+            : null;
+        receiver = helper
+          ? lowerer.checkedNarrowCall(helper, receiver, present, locOf(expr.expression))
+          : lowerer.maybeNarrow(receiver, expr.expression);
+      }
+
+      // property read, exiting at the declared number type (the array
+
+      return { kind: "bytesIntrinsic", method: name, receiver, args: [], type: F64, loc };
+    }
+    if (name === "byteOffset") {
+      // 0 for owners (scriptc typed arrays own their whole storage —
+      // SEMANTICS.md notes the divergence from Node's Buffer pooling),
+      // the view's real offset for a DataView. A runtime read, so the
+      // receiver's evaluation is never discarded.
+      const expected = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+      const receiver =
+        expected?.kind === "bytes" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
+      return { kind: "bytesIntrinsic", method: "byteOffset", receiver, args: [], type: F64, loc };
+    }
+    if (name === "buffer") {
+      const expected = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+      const receiver =
+        expected?.kind === "bytes" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
+      return { kind: "bytesIntrinsic", method: "buffer", receiver, args: [], type: DYN, loc };
+    }
+    if (name === "slice" || name === "subarray" || name === "set" || name === "toString") {
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        `typed-array methods as values (call '${name}' directly)`,
+      );
+    }
+    return null; // fill, reverse, ... → the SC2020 member fence
+  }
+  if (kind === "map") {
+    if (name === "size") {
+      const expected = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+      const receiver =
+        expected?.kind === "map" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
+      return {
+        kind: "mapIntrinsic",
+        method: "size",
+        receiver,
+        args: [],
+        type: F64,
+        loc: locOf(expr),
+      };
+    }
+    if (MAP_METHODS.has(name) || name === "forEach") {
+      lowerer.unsupported("SC1090", expr, `Map methods as values (call '${name}' directly)`);
+    }
+    return null;
+  }
+  if (kind === "set") {
+    if (name === "size") {
+      const expected = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+      const receiver =
+        expected?.kind === "set" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
+      return {
+        kind: "setIntrinsic",
+        method: "size",
+        receiver,
+        args: [],
+        type: F64,
+        loc: locOf(expr),
+      };
+    }
+    if (SET_METHODS.has(name)) {
+      lowerer.unsupported("SC1090", expr, `Set methods as values (call '${name}' directly)`);
+    }
+    return null;
+  }
+  if (name === "length") {
+    const expected =
+      kind === "string" ? STRING : lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+    let receiver = lowerer.lowerExpr(expr.expression);
+    if (
+      receiver.type.kind !== "dyn" &&
+      expected &&
+      (expected.kind === "string" || expected.kind === "array")
+    ) {
+      receiver =
+        lowerer.runtimeOptionalPropertyReceiver(expr.expression, receiver, expected, name) ??
+        receiver;
+    }
+    if (
+      receiver.type.kind === "union" &&
+      lowerer.armTag(receiver.type.unionId, UNDEFINED_T) >= 0 &&
+      kind === "array"
+    ) {
+      const present = lowerer.stripUndefinedArm(receiver.type);
+      const helper =
+        present.kind === "array"
+          ? lowerer.narrowedArmHelper(receiver.type.unionId, present, locOf(expr.expression))
+          : null;
+      receiver = helper
+        ? lowerer.checkedNarrowCall(helper, receiver, present, locOf(expr.expression))
+        : lowerer.maybeNarrow(receiver, expr.expression);
+    }
+
+    // A CHECKED-DYNAMIC value behind an array-typed checker spelling
+    // (`Object.keys(u).length` — the dyn walk answers a dyn array while
+    // tsc spells string[]): the runtime-world dispatch — a dyn keyed
+    // read validated into the declared number (a lying length throws
+    // the catchable TypeError, the dynCheck stance).
+    if (receiver.type.kind === "dyn") {
+      const read: IrExpr = {
+        kind: "dynKeyGet",
+        key: { kind: "strLit", value: "length", type: STRING, loc: locOf(expr) },
+        ...(expr.questionDotToken ? { optional: true as const } : {}),
+        value: receiver,
+        type: DYN,
+        loc: locOf(expr),
+      };
+      if (expr.questionDotToken) return read;
+      return { kind: "dynCheck", value: read, type: F64, loc: locOf(expr) };
+    }
+    return kind === "string"
+      ? { kind: "strIntrinsic", method: "length", receiver, args: [], type: F64, loc: locOf(expr) }
+      : { kind: "arrIntrinsic", method: "length", receiver, args: [], type: F64, loc: locOf(expr) };
+  }
+  if (
+    kind === "string"
+      ? own(STR_METHODS, name) !== undefined ||
+        STRING_INDEX_METHODS.has(name) ||
+        own(STDLIB_SURFACE.string, name) !== undefined
+      : ARRAY_METHODS.has(name)
+  ) {
+    lowerer.unsupported("SC1090", expr, `${kind} methods as values (call '${name}' directly)`);
+  }
+  return null;
+}
+
+/** A `T | undefined` class field read that the checker narrowed to `T`
+ * where the field was assigned a value that may be missing (an unchecked
+ * indexed read). TypeScript's assignment narrowing is not a runtime fact
+ * there, so the read keeps the stored union instead of extracting `T`. */
+function runtimeOptionalClassField(
+  lowerer: Lowerer,
+  value: IrExpr,
+  node: ts.PropertyAccessExpression,
+): boolean {
+  if (value.kind !== "fieldGet" || value.type.kind !== "union") return false;
+  if (lowerer.armTag(value.type.unionId, UNDEFINED_T) < 0) return false;
+  if ((lowerer.unions.get(value.type.unionId)?.arms.length ?? 0) !== 2) return false;
+  const symbol = lowerer.checker.getSymbolAtLocation(node.name);
+  if (!symbol || !lowerer.runtimeOptionalAssignedSymbols.has(symbol)) return false;
+  const narrowed = lowerer.mapTypeOf(lowerer.typeOf(node));
+  return narrowed !== null && typeEquals(narrowed, lowerer.stripUndefinedArm(value.type));
+}
+
+/** `exports.<name>` in a JS module whose `module.exports =` REPLACED the
+ * export object, with no `exports.<name> =` attachment anywhere in the
+ * file: the read observes the ORIGINAL (empty-here) exports object, so
+ * the honest value is undefined (Node's object identity exactly; tsc's
+ * CJS model types the read off the replacement — identity-blind). Null
+ * everywhere else: no replacement, a real attachment of this name, a
+ * shadowing binding named `exports`, or write position. */
+function lowerReplacedExportsRead(
+  lowerer: Lowerer,
+  expr: ts.PropertyAccessExpression,
+): IrExpr | null {
+  if (expr.questionDotToken) return null;
+  const recv = expr.expression;
+  if (!ts.isIdentifier(recv) || recv.text !== "exports") return null;
+  const sf = expr.getSourceFile();
+  if (!isJsSourceFile(sf) || isNodeEsmFile(sf, lowerer.program)) return null;
+  if (lowerer.peekLocal(recv) || lowerer.globalOf(recv)) return null; // a user binding shadows
+  // Write position is the export-assignment machinery's territory.
+  if (
+    ts.isBinaryExpression(expr.parent) &&
+    expr.parent.left === expr &&
+    expr.parent.operatorToken.kind === ts.SyntaxKind.EqualsToken
+  ) {
+    return null;
+  }
+  let replaced = false;
+  for (const stmt of sf.statements.nodes) {
+    const cjs = cjsExportAssignmentOf(stmt);
+    if (!cjs) continue;
+    if (cjs.kind === "table" && cjsExportDiscardReason(stmt) === null) replaced = true;
+    if (cjs.kind === "member" && ts.isIdentifier(cjs.name) && cjs.name.text === expr.name.text) {
+      return null; // a real attachment of this name exists somewhere
+    }
+  }
+  if (!replaced) return null;
+  return { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc: locOf(expr) };
+}
+
+/** `this.<name>` INSIDE a CJS export-table accessor (test/common's
+ * `get localhostIPv4() { if (this.inFreeBSDJail) ... }`): Node binds the
+ * getter's receiver to module.exports, so the read is the SIBLING table
+ * property — a sibling GETTER's lifted call (per-read evaluation, like
+ * any accessor read). Only arrows inherit the binding (a nested function
+ * expression's `this` is its own). Null everywhere else — non-getter
+ * siblings and absent names keep their per-site fences (none of the
+ * probed suite shapes read them). */
+function lowerCjsExportTableThisMember(
+  lowerer: Lowerer,
+  expr: ts.PropertyAccessExpression,
+): IrExpr | null {
+  if (expr.expression.kind !== ts.SyntaxKind.ThisKeyword || expr.questionDotToken) return null;
+  if (!isJsSourceFile(expr.getSourceFile())) return null;
+  // The enclosing accessor, crossing only arrow boundaries (arrows
+  // inherit `this`; any other function form rebinds it).
+  let n: ts.Node | undefined = expr.parent;
+  while (n !== undefined && !ts.isGetAccessorDeclaration(n) && !ts.isSetAccessorDeclaration(n)) {
+    if (ts.isFunctionLike(n) && !ts.isArrowFunction(n)) return null;
+    if (ts.isSourceFile(n)) return null;
+    n = n.parent;
+  }
+  if (
+    n === undefined ||
+    !ts.isObjectLiteralExpression(n.parent) ||
+    !isCjsExportTableLiteral(n.parent)
+  ) {
+    return null;
+  }
+  const sibling = n.parent.properties.nodes.find(
+    (p): p is ts.GetAccessorDeclaration =>
+      ts.isGetAccessorDeclaration(p) && ts.isIdentifier(p.name) && p.name.text === expr.name.text,
+  );
+  if (!sibling) return null;
+  return cjsAccessorCall(lowerer, sibling, locOf(expr));
+}
+
+/** RegExp.prototype's flag getters and the flag each one reads. */
+const REGEX_FLAG_GETTERS: ReadonlyMap<string, string> = new Map([
+  ["hasIndices", "d"],
+  ["global", "g"],
+  ["ignoreCase", "i"],
+  ["multiline", "m"],
+  ["dotAll", "s"],
+  ["unicode", "u"],
+  ["unicodeSets", "v"],
+  ["sticky", "y"],
+]);
+
+/** The named-group table of the regex that PRODUCED a match-result
+ * expression — the `.groups` desugar's provenance question. Traces
+ * (through parens, `!`, and const bindings):
+ *   - `re.exec(s)` / `s.match(re)`   → re's static pattern
+ *   - a matchAll ROW: `rows[i]`, the for-of binding over a direct
+ *     `s.matchAll(re)` or a stored const drain → re's static pattern
+ * Answers null when the producing regex isn't statically known (the
+ * caller keeps its fence), or the groups list (possibly empty — a
+ * traced regex WITHOUT named groups is the Node-undefined case). */
+export function matchResultNamedGroupsOf(
+  lowerer: Lowerer,
+  e: ts.Expression,
+): { name: string; index: number }[] | null {
+  let producer = e;
+  while (ts.isParenthesizedExpression(producer) || ts.isNonNullExpression(producer))
+    producer = producer.expression;
+  if (ts.isIdentifier(producer)) {
+    const init = constInitializerOf(lowerer, producer);
+    if (init !== null) return matchResultNamedGroupsOf(lowerer, init);
+  }
+  const reExpr = matchProducerRegexOf(lowerer, e);
+  if (reExpr === null) return null;
+  if (
+    ts.isCallExpression(producer) &&
+    ts.isPropertyAccessExpression(producer.expression) &&
+    producer.expression.name.text === "match"
+  ) {
+    const flags = staticRegexFlagsOf(lowerer, reExpr);
+    if (flags === null) return null;
+    // Global String.match returns whole matches without a groups
+    // property, even when the pattern contains named captures.
+    if (flags.includes("g")) return [];
+  }
+  const pattern = staticRegexPatternOf(lowerer, reExpr);
+  if (pattern === null) return null;
+  return namedCaptureGroupsOfPattern(pattern);
+}
+
+function staticRegexFlagsOf(lowerer: Lowerer, node: ts.Expression): string | null {
+  let expr = node;
+  while (ts.isParenthesizedExpression(expr) || ts.isNonNullExpression(expr)) expr = expr.expression;
+  if (ts.isRegularExpressionLiteral(expr)) return expr.text.slice(expr.text.lastIndexOf("/") + 1);
+  if (ts.isIdentifier(expr)) {
+    const init = constInitializerOf(lowerer, expr);
+    return init !== null ? staticRegexFlagsOf(lowerer, init) : null;
+  }
+  if (
+    ts.isNewExpression(expr) &&
+    ts.isIdentifier(expr.expression) &&
+    lowerer.isStdlibGlobal(expr.expression, "RegExp")
+  ) {
+    const flags = expr.arguments?.nodes[1];
+    if (!flags) return "";
+    if (ts.isStringLiteral(flags) || ts.isNoSubstitutionTemplateLiteral(flags)) return flags.text;
+  }
+  return null;
+}
+
+/** The regex EXPRESSION whose match produced `e` (see
+ * matchResultNamedGroupsOf for the traced shapes). */
+function matchProducerRegexOf(lowerer: Lowerer, e: ts.Expression): ts.Expression | null {
+  let expr = e;
+  for (;;) {
+    if (ts.isParenthesizedExpression(expr) || ts.isNonNullExpression(expr)) {
+      expr = expr.expression;
+      continue;
+    }
+    break;
+  }
+  // The direct producers: re.exec(s) / s.match(re) — the receiver's
+  // mapped type pins the STDLIB operation (a regex for exec, a string
+  // or its nullable spelling for match — the claim string-and-regexp
+  // makes), so a user method that happens to be named `match` with a
+  // regex argument never traces.
+  if (ts.isCallExpression(expr) && ts.isPropertyAccessExpression(expr.expression)) {
+    const name = expr.expression.name.text;
+    const recvT = lowerer.mapTypeOf(lowerer.typeOf(expr.expression.expression));
+    if (name === "exec" && expr.arguments.nodes.length === 1 && recvT?.kind === "regex") {
+      return expr.expression.expression;
+    }
+    if (
+      name === "match" &&
+      expr.arguments.nodes.length === 1 &&
+      (recvT?.kind === "string" ||
+        (recvT !== null && recvT !== undefined && nullableStringType(lowerer, recvT))) &&
+      lowerer.mapTypeOf(lowerer.typeOf(expr.arguments.nodes[0]!))?.kind === "regex"
+    ) {
+      return expr.arguments.nodes[0]!;
+    }
+  }
+  // A matchAll ROW by element access: rows[i] with rows tracing to the
+  // drain call — or the direct s.matchAll(re)[i] spelling.
+  if (ts.isElementAccessExpression(expr)) {
+    return matchAllRegexOf(lowerer, expr.expression);
+  }
+  // A row picked by `rows.find(cb)`, `rows.findLast(cb)` or `rows.at(i)`.
+  if (
+    ts.isCallExpression(expr) &&
+    ts.isPropertyAccessExpression(expr.expression) &&
+    MATCH_ROW_PICK_METHODS.has(expr.expression.name.text) &&
+    lowerer.isStdlibMember(expr.expression)
+  ) {
+    return matchAllRegexOf(lowerer, expr.expression.expression);
+  }
+  if (ts.isIdentifier(expr)) {
+    // The for-of binding over a matchAll drain: `for (const m of
+    // s.matchAll(re))` (or over a stored const rows).
+    const sym = lowerer.resolveValueSymbol(expr);
+    const decl = sym ? sym.valueDeclaration : undefined;
+    if (
+      decl !== undefined &&
+      ts.isVariableDeclaration(decl) &&
+      ts.isVariableDeclarationList(decl.parent) &&
+      ts.isForOfStatement(decl.parent.parent)
+    ) {
+      return matchAllRegexOf(lowerer, decl.parent.parent.expression);
+    }
+    // A stored const match result: `const m = re.exec(s)`.
+    const init = constInitializerOf(lowerer, expr);
+    if (init !== null) return matchProducerRegexOf(lowerer, init);
+    // The element parameter of an array callback over matchAll rows:
+    // `[...s.matchAll(re)].map((m) => m.groups)`, and Array.from's
+    // mapping function over `s.matchAll(re)`.
+    if (decl !== undefined && ts.isParameter(decl)) return matchAllCallbackRegexOf(lowerer, decl);
+  }
+  return null;
+}
+
+/** Array methods that return one row of the receiver. */
+const MATCH_ROW_PICK_METHODS = new Set(["find", "findLast", "at"]);
+
+/** `m.groups` on a match result whose producing regex is statically
+ * known: the honest slice already HOLDS every named group's value at
+ * its capture index, so the groups object is a compile-time record
+ * projection — `{ year: m[1], month: m[2] }` — built by one interned
+ * helper per (shape, index list, receiver type). Node's exact shape
+ * decisions:
+ *   - no named groups → `undefined` (the identifier-receiver shapes —
+ *     a call receiver would lose its own null trap, so those keep the
+ *     member fence);
+ *   - a nullable receiver (the JS `s.match(re).groups` idiom) throws
+ *     Node's exact TypeError on the unit arms;
+ *   - every declared name is a key (nonparticipating groups hold undefined,
+ *     exactly the slice elements they project);
+ *   - ES2025 duplicate names (distinct alternatives) project the first
+ *     participating occurrence, including a participating empty string;
+ *   - key order is group declaration order (declaredOrder), Node's own.
+ * The record has a null prototype, like Node's groups object. A
+ * JavaScript callback parameter holds the row as a dynamic array; the
+ * projection reads its elements through dynamic reads. Null when the
+ * receiver isn't a match slice or the regex isn't traceable — the
+ * caller's member fence (with the groups hint) names the gap. */
+function lowerMatchGroupsRead(lowerer: Lowerer, expr: ts.PropertyAccessExpression): IrExpr | null {
+  if (expr.name.text !== "groups") return null;
+  // `m?.groups` re-dispatches through the optional-chain machinery, which
+  // narrows the receiver to its match arm first.
+  if (expr.questionDotToken !== undefined && !lowerer.chainHandled.has(expr)) return null;
+  const loc = locOf(expr);
+  const strArr = arrayOf(STRING);
+  const recvT = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+  if (!recvT || !isMatchSliceType(lowerer, recvT) || !lowerer.isStdlibMember(expr)) return null;
+  const groups = matchResultNamedGroupsOf(lowerer, expr.expression);
+  // An untraced regex: TypeScript reaches the member fence; JavaScript
+  // would otherwise read the slice's absent expando as undefined.
+  if (groups === null && isJsSourceFile(expr.getSourceFile())) lowerer.stdlibMemberFence(expr);
+  if (groups === null) return null;
+  if (groups.length === 0) {
+    // Node: a match result of a group-less regex answers undefined —
+    // the unit literal, exactly the `undefined` identifier's lowering.
+    // Identifier receivers only (evaluation-free): a CALL receiver's
+    // exec/match must still run and null-trap, which a folded unit
+    // cannot carry — those keep the fence.
+    let r: ts.Expression = expr.expression;
+    while (ts.isParenthesizedExpression(r) || ts.isNonNullExpression(r)) r = r.expression;
+    if (ts.isIdentifier(r) && typeEquals(recvT, strArr)) {
+      return { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc };
+    }
+    return null;
+  }
+  const recv = lowerer.lowerExpr(expr.expression);
+  // A JavaScript callback parameter holds the row as a dynamic array.
+  const dynRow = recv.type.kind === "dyn" && isJsSourceFile(expr.getSourceFile());
+  if (!dynRow && !isMatchSliceType(lowerer, recv.type)) return null;
+  return lowerGroupsProjection(lowerer, recv, groups, loc);
+}
+
+/** True when the IR type is a string-or-units union — the Dict<string>
+ * member spelling (`process.versions.openssl`), match's nullable
+ * receiver claim. */
+function nullableStringType(lowerer: Lowerer, t: IrType): boolean {
+  if (t.kind !== "union") return false;
+  const arms = lowerer.unions.get(t.unionId)?.arms ?? [];
+  return (
+    arms.some((a) => a.kind === "string") && arms.every((a) => a.kind === "string" || isUnitType(a))
+  );
+}
+
+/** True when the IR type is the honest match slice — `string[]`, or a
+ * union of it with unit arms only (`string[] | null`). The groups
+ * projection's receiver gate, shared with the destructure interception. */
+export function isMatchSliceType(lowerer: Lowerer, t: IrType): boolean {
+  if (typeEquals(t, arrayOf(STRING))) return true;
+  return t.kind === "union" && matchSliceUnionArms(lowerer, t.unionId) !== null;
+}
+
+/** The union-arm layout of a nullable match slice (`string[] | null`,
+ * matchAll's checker spellings with undefined arms included): the
+ * string[] arm's tag plus each unit arm's tag and spelling. Null when
+ * the union holds anything else. */
+function matchSliceUnionArms(
+  lowerer: Lowerer,
+  unionId: string,
+): { arrTag: number; units: { tag: number; unit: "null" | "undefined" }[] } | null {
+  const def = lowerer.unions.get(unionId);
+  if (!def) return null;
+  const strArr = arrayOf(STRING);
+  const arrTag = def.arms.findIndex((a) => typeEquals(a, strArr));
+  if (arrTag < 0) return null;
+  const units: { tag: number; unit: "null" | "undefined" }[] = [];
+  for (let i = 0; i < def.arms.length; i++) {
+    if (i === arrTag) continue;
+    const a = def.arms[i]!;
+    if (!isUnitType(a)) return null;
+    units.push({ tag: i, unit: a.kind === "nullT" ? "null" : "undefined" });
+  }
+  return { arrTag, units };
+}
+
+/** Node's TypeError for `.groups` read off null or undefined. */
+function groupsReadTypeError(unit: "null" | "undefined", loc: SrcLoc): IrStmt {
+  return {
+    kind: "throw",
+    value: {
+      kind: "libCall",
+      fn: "error.new",
+      args: [strLit(`Cannot read properties of ${unit} (reading 'groups')`, loc)],
+      type: { kind: "object", className: "%TypeError" },
+      loc,
+    },
+    loc,
+  };
+}
+
+/** The groups-record projection holds string | undefined values, including
+ * an own overflow entry for every nonparticipating capture. One lifted helper per
+ * (index list, receiver representation) builds it; see
+ * lowerMatchGroupsRead for the semantics the body encodes. */
+export function lowerGroupsProjection(
+  lowerer: Lowerer,
+  recv: IrExpr,
+  groups: { name: string; index: number }[],
+  loc: SrcLoc,
+): IrExpr {
+  // Name → its capture indices, in declaration order (duplicates keep
+  // every occurrence — the projection picks the participating one).
+  const order: string[] = [];
+  const indicesByName = new Map<string, number[]>();
+  for (const g of groups) {
+    const got = indicesByName.get(g.name);
+    if (got) {
+      got.push(g.index);
+    } else {
+      indicesByName.set(g.name, [g.index]);
+      order.push(g.name);
+    }
+  }
+  const valueType = arrayValueType(lowerer, STRING);
+  const shapeId = lowerer.shapes.intern([], false, valueType);
+  const recordT: IrType = { kind: "record", shapeId };
+  const recvKey =
+    recv.type.kind === "union" ? recv.type.unionId : recv.type.kind === "dyn" ? "dyn" : "arr";
+  const key = `regexgroups:${shapeId}:${groups.map((g) => `${g.name}=${g.index}`).join(",")}:${recvKey}`;
+  let helper = lowerer.valueHelpers.get(key);
+  if (!helper) {
+    helper = `%regex.groups.${lowerer.valueHelpers.size}`;
+    lowerer.valueHelpers.set(key, helper);
+    const body: IrStmt[] = [];
+    const locals: IrLocal[] = [{ id: "m.0", name: "m", type: recv.type, mutable: true }];
+    let mRef: IrExpr = { kind: "varRef", localId: "m.0", type: recv.type, loc };
+    if (recv.type.kind === "union") {
+      // Node's exact TypeError per unit arm, then the checked narrow.
+      const arms = matchSliceUnionArms(lowerer, recv.type.unionId)!;
+      for (const u of arms.units) {
+        body.push({
+          kind: "if",
+          cond: {
+            kind: "unionIsTag",
+            unionId: recv.type.unionId,
+            tag: u.tag,
+            negated: false,
+            value: mRef,
+            type: BOOL,
+            loc,
+          },
+          then: [groupsReadTypeError(u.unit, loc)],
+          else_: null,
+          loc,
+        });
+      }
+      const narrowed: IrExpr = {
+        kind: "unionNarrow",
+        unionId: recv.type.unionId,
+        tag: arms.arrTag,
+        value: mRef,
+        type: arrayOf(STRING),
+        loc,
+      };
+      locals.push({ id: "arr.0", name: "arr", type: arrayOf(STRING), mutable: false });
+      body.push({ kind: "varDecl", localId: "arr.0", init: narrowed, loc });
+      mRef = { kind: "varRef", localId: "arr.0", type: arrayOf(STRING), loc };
+    } else if (recv.type.kind === "dyn") {
+      // A JavaScript callback parameter holds the row as a dynamic array:
+      // Node's TypeError for null and undefined, then dynamic element reads.
+      for (const unit of ["null", "undefined"] as const) {
+        body.push({
+          kind: "if",
+          cond: { kind: "dynTest", test: unit, value: mRef, type: BOOL, loc },
+          then: [groupsReadTypeError(unit, loc)],
+          else_: null,
+          loc,
+        });
+      }
+    }
+
+    const elem = (index: number): IrExpr =>
+      mRef.type.kind === "dyn"
+        ? lowerer.coerceToExpected(
+            {
+              kind: "dynKeyGet",
+              value: mRef,
+              key: strLit(String(index), loc),
+              type: DYN,
+              loc,
+            },
+            valueType,
+          )
+        : arrayValueRead(lowerer, mRef, numLit(index, loc), STRING, loc);
+    const values = new Map<string, IrExpr>();
+    order.forEach((name, i) => {
+      const idxs = indicesByName.get(name)!;
+      if (idxs.length === 1) {
+        values.set(name, elem(idxs[0]!));
+        return;
+      }
+      // Duplicates: the first participating occurrence. Empty strings
+      // participate; undefined means this alternative did not match.
+      const id = `g${i}.0`;
+      locals.push({ id, name: `g${i}`, type: valueType, mutable: true });
+      body.push({ kind: "varDecl", localId: id, init: elem(idxs[0]!), loc });
+      const gRef: IrExpr = { kind: "varRef", localId: id, type: valueType, loc };
+      for (const idx of idxs.slice(1)) {
+        body.push({
+          kind: "if",
+          cond: {
+            kind: "unionIsTag",
+            unionId: valueType.kind === "union" ? valueType.unionId : "",
+            tag: valueType.kind === "union" ? lowerer.armTag(valueType.unionId, UNDEFINED_T) : -1,
+            negated: false,
+            value: gRef,
+            type: BOOL,
+            loc,
+          },
+          then: [{ kind: "assign", localId: id, value: elem(idx), loc }],
+          else_: null,
+          loc,
+        });
+      }
+      values.set(name, gRef);
+    });
+    body.push({
+      kind: "return",
+      value: {
+        kind: "recordLit",
+        fields: order.map((name) => ({ name, value: values.get(name)!, overflow: true as const })),
+        nullProto: true,
+        type: recordT,
+        loc,
+      },
+      loc,
+    });
+    lowerer.liftedFns.push({
+      name: helper,
+      params: [{ localId: "m.0", name: "m", type: recv.type }],
+      returnType: recordT,
+      locals,
+      body,
+      loc,
+    });
+  }
+  return { kind: "call", callee: helper, args: [recv], type: recordT, loc };
+}
+
+/** Field reads use the shared FieldTarget union. Native method reads select
+ * an interned unbound callable; invocation supplies its receiver separately. */
+export function lowerFieldRead(lowerer: Lowerer, expr: ts.PropertyAccessExpression): IrExpr | null {
+  // A checked receiver already owns its property table. An ambient
+  // generic method signature must not divert its value into native
+  // object-literal specialization (Array.prototype.map is one example).
+  if (ts.isIdentifier(expr.expression)) {
+    const stored = lowerer.peekLocal(expr.expression) ?? lowerer.globalOf(expr.expression);
+    if (stored?.type.kind === "dyn") {
+      const value = lowerer.lowerExpr(expr.expression);
+      if (value.type.kind === "dyn")
+        return {
+          kind: "dynKeyGet",
+          value,
+          key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
+          ...(expr.questionDotToken || hasOptionalChainGuard(expr.expression)
+            ? { optional: true as const }
+            : {}),
+          type: DYN,
+          loc: locOf(expr),
+        };
+    }
+  }
+  const target = lowerer.fieldTarget(expr);
+  if (target) return lowerer.fieldGetExpr(target, locOf(expr), expr);
+  if (expr.questionDotToken) return null;
+  let receiverIr = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+  // The readonly-tuple Array.isArray narrow has no directly mappable
+  // checker type (`Result & any[]`), but maybeNarrow extracted the tuple
+  // record behind it. Route tuple properties such as `.length` from that
+  // lowered value, the element-access bridge's twin.
+  const checkerArray = lowerer.checkerArrayValue(expr.expression);
+  if (checkerArray?.type.kind === "record") receiverIr = checkerArray.type;
+  if (
+    receiverIr?.kind === "object" &&
+    (lowerer.findMethodOn(lowerer.classes.get(receiverIr.className) ?? null, expr.name.text) ||
+      findGenericMethodOn(
+        lowerer,
+        lowerer.classes.get(receiverIr.className) ?? null,
+        expr.name.text,
+      ))
+  ) {
+    const info = lowerer.classes.get(receiverIr.className);
+    if (info) return lowerClassMethodValue(lowerer, expr, info);
+  }
+  // An object-literal GENERIC method as a VALUE (`o.m` — the member is
+  // excluded from the record shape): the pinned-value rule verbatim when
+  // the receiver is the defining literal's own const binding (the value
+  // is the pinned instance's closure — no `this` exists); anything else
+  // fences by name inside the helpers.
+  {
+    const propSym = lowerer.checker.getPropertyOfType(
+      lowerer.typeOf(expr.expression),
+      expr.name.text,
+    );
+    if (
+      receiverIr?.kind !== "object" &&
+      propSym &&
+      isGenericCallableMemberType(lowerer.checker.getTypeOfSymbol(propSym), lowerer.checker) &&
+      // CLASS members keep the class-path fences (a poisoned class's own
+      // diagnostics, the bound-method fence above).
+      !propSym.declarations.some(
+        (d) =>
+          d.parent !== undefined &&
+          (ts.isClassDeclaration(d.parent) || ts.isClassExpression(d.parent)),
+      )
+    ) {
+      const found = objLitGenericFnNodeOf(lowerer, propSym);
+      if (!found) {
+        lowerer.unsupported(
+          "SC1090",
+          expr,
+          `the generic method '${expr.name.text}' as a value with no defining object literal (only methods declared with a body in an object literal compile)`,
+        );
+      }
+      requireObjLitGenericReceiver(lowerer, expr, expr.expression, found.literal, expr.name.text);
+      return lowerer.lowerGenericFnValue(
+        expr,
+        objLitGenericFnInfoOf(lowerer, expr, expr.name.text, found),
+      );
+    }
+  }
+  // Dot access to an UNDECLARED key of an index-signature shape
+  // (`bag.count` on `Record<string, number>`): tsc allows it without
+  // noPropertyAccessFromIndexSignature, but the bracket spelling is the
+  // canonical index-signature form here — point at it.
+  if (receiverIr?.kind === "record") {
+    const shape = lowerer.shapes.get(receiverIr.shapeId);
+    if (shape?.indexValue && !shape.fields.some((f) => f.name === expr.name.text)) {
+      const actual = tryLowerExpression(lowerer, expr.expression);
+      if (actual?.type.kind === "dyn")
+        return {
+          kind: "dynKeyGet",
+          value: actual,
+          key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
+          type: DYN,
+          loc: locOf(expr),
+        };
+      if (actual?.type.kind === "record") {
+        const field = lowerer.shapes
+          .get(actual.type.shapeId)
+          ?.fields.find((field) => field.name === expr.name.text);
+        if (field)
+          return {
+            kind: "recordGet",
+            obj: actual,
+            shapeId: actual.type.shapeId,
+            field: field.name,
+            type: field.type,
+            loc: locOf(expr),
+          };
+      }
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        `dot access to index-signature keys (spell it r["${expr.name.text}"] — brackets are the index-signature form)`,
+      );
+    }
+  }
+  // `t.length` on a tuple: the arity CONSTANT (tuples are fixed-shape —
+  // the checker types it as the literal arity too). Folding discards the
+  // receiver's evaluation, so only side-effect-free receivers fold;
+  // anything else (a call result) binds to a const first.
+  if (receiverIr?.kind === "record" && expr.name.text === "length") {
+    const shape = lowerer.shapes.get(receiverIr.shapeId);
+    if (shape?.tuple) {
+      let root: ts.Expression = expr.expression;
+      while (ts.isPropertyAccessExpression(root)) root = root.expression;
+      if (!ts.isIdentifier(root) && root.kind !== ts.SyntaxKind.ThisKeyword) {
+        lowerer.unsupported(
+          "SC1090",
+          expr,
+          "'.length' of a computed tuple expression (the arity is a constant — bind the tuple to a const first)",
+        );
+      }
+      return { kind: "numLit", value: shape.fields.length, type: F64, loc: locOf(expr) };
+    }
+  }
+  return null;
+}
+
+/** Shared-field read `r.f` on a UNION receiver: supported exactly when
+ * every arm is a record/class possessing the field with ONE shared IR
+ * type — the discriminant pattern (`r.kind`, primitive) and the
+ * shared-payload pattern (`spec.config` where every ServiceSpec arm
+ * carries the same record). Lowers to `unionDisc` (the backend switches
+ * on the runtime tag and reads the field from the concrete arm), which
+ * composes with existing strEq/bin/switch nodes, so `r.kind === "ok"`
+ * and `switch (r.kind)` work without dedicated test nodes. Anything else
+ * on a union receiver is rejected specifically (narrow first). */
+export function lowerUnionProperty(
+  lowerer: Lowerer,
+  expr: ts.PropertyAccessExpression,
+): IrExpr | null {
+  if (lowerer.chainBlocked(expr)) return null;
+  const receiverIr =
+    structuralReadType(lowerer, expr.expression) ??
+    lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+  if (receiverIr?.kind !== "union") return null;
+  // Lower the receiver first: its runtime value can still carry the full
+  // binding union even when the checker has removed several variants.
+  let value = lowerer.lowerExpr(expr.expression);
+  // A guard can remove several variants without selecting one record.
+  // Materialize that sub-union before looking for common fields; arms
+  // ruled out by the guard must not veto a field shared by the survivors.
+  if (value.type.kind === "union" && !typeEquals(value.type, receiverIr)) {
+    const helper = lowerer.narrowedRetagHelper(
+      expr.expression,
+      value.type.unionId,
+      receiverIr.unionId,
+      locOf(expr),
+    );
+    if (helper)
+      value = { kind: "call", callee: helper, args: [value], type: receiverIr, loc: locOf(expr) };
+    // Optional storage of a base class (a runtime-optional binding holding
+    // `Base | undefined`) that `instanceof` narrowed to several subclasses:
+    // extract the instance and test its class, as typed slots do.
+    else value = narrowStoredClassValue(lowerer, value, receiverIr) ?? value;
+  }
+  // A checker-union receiver whose VALUE lowered to a plain RECORD (the
+  // merged-signature fiction — `runner(cmd, args)` where runner joined
+  // a structural runner type with spawnSync's, and the local adopted
+  // the record arm): read the record field directly, the dyn-receiver
+  // fallback's discipline.
+  // A checker-union receiver whose VALUE lowered checked-dynamic (a
+  // never-tainted JS chain — `cmd[1].length` on `const cmd = ['pwd',
+  // []]`, where the element read stayed a dyn node): read through the
+  // dyn keyed read like the unmappable-receiver path below the chain.
+  if (value.type.kind === "dyn") {
+    const key: IrExpr = {
+      kind: "strLit",
+      value: expr.name.text,
+      type: STRING,
+      loc: locOf(expr.name),
+    };
+    return { kind: "dynKeyGet", key, value, type: DYN, loc: locOf(expr) };
+  }
+  if (value.type.kind === "record") {
+    const shape = lowerer.shapes.get(value.type.shapeId);
+    const f = shape?.fields.find((x) => x.name === expr.name.text);
+    if (f) {
+      return {
+        kind: "recordGet",
+        obj: value,
+        shapeId: value.type.shapeId,
+        field: f.name,
+        type: f.type,
+        loc: locOf(expr),
+      };
+    }
+    return null;
+  }
+  // A class instance the checker sees through a wider union (`(concrete
+  // as A | B).value`): the value is that class's instance, so read its
+  // field directly.
+  if (value.type.kind === "object") {
+    const className = value.type.className;
+    const info = lowerer.classes.get(className) ?? null;
+    const field = expr.name.text;
+    const fieldType = info?.fields.get(field);
+    if (fieldType !== undefined)
+      return lowerer.fieldGetExpr(
+        { container: "class", obj: value, className, field, fieldType },
+        locOf(expr),
+        expr,
+      );
+    const getter = lowerer.findMethodOn(info, `get:${field}`);
+    if (getter)
+      return lowerer.fieldGetExpr(
+        { container: "accessor", obj: value, className, field, fieldType: getter.sig.ret },
+        locOf(expr),
+        expr,
+      );
+  }
+  if (value.type.kind !== "union") {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      "shared property access without a represented union receiver",
+    );
+  }
+  const def = lowerer.unions.get(value.type.unionId);
+  if (!def) throw new InternalCompilerError(`lowerer bug: unknown union ${value.type.unionId}`);
+  const field = expr.name.text;
+  if (field === "length") {
+    const presentArms = def.arms.filter((arm) => !isUnitType(arm));
+    const present = presentArms.length === 1 ? presentArms[0]! : null;
+    if (present?.kind === "string" || present?.kind === "array") {
+      const receiver = lowerer.runtimeOptionalPropertyReceiver(
+        expr.expression,
+        value,
+        present,
+        field,
+      );
+      if (receiver !== null) {
+        return present.kind === "string"
+          ? {
+              kind: "strIntrinsic",
+              method: "length",
+              receiver,
+              args: [],
+              type: F64,
+              loc: locOf(expr),
+            }
+          : {
+              kind: "arrIntrinsic",
+              method: "length",
+              receiver,
+              args: [],
+              type: F64,
+              loc: locOf(expr),
+            };
+      }
+    }
+  }
+  const nonUnitArms = def.arms.filter((arm) => !isUnitType(arm));
+  if (nonUnitArms.length === 1 && nonUnitArms[0]?.kind === "object") {
+    const objectType = nonUnitArms[0];
+    const fieldType = lowerer.classes.get(objectType.className)?.fields.get(field);
+    if (fieldType !== undefined) {
+      let receiver = lowerer.runtimeOptionalPropertyReceiver(
+        expr.expression,
+        value,
+        objectType,
+        field,
+      );
+      if (receiver === null) {
+        const helper = lowerer.narrowedArmHelper(
+          value.type.unionId,
+          objectType,
+          locOf(expr.expression),
+        );
+        if (helper !== null)
+          receiver = lowerer.checkedNarrowCall(helper, value, objectType, locOf(expr.expression));
+      }
+      if (receiver !== null) {
+        return {
+          kind: "fieldGet",
+          obj: receiver,
+          className: objectType.className,
+          field,
+          type: fieldType,
+          loc: locOf(expr),
+        };
+      }
+    }
+  }
+  let common: IrType | null = null;
+  for (const arm of def.arms) {
+    let ft: IrType | undefined;
+    if (arm.kind === "record") {
+      ft = lowerer.shapes.get(arm.shapeId)?.fields.find((f) => f.name === field)?.type;
+    } else if (arm.kind === "object") {
+      ft = lowerer.classes.get(arm.className)?.fields.get(field);
+    }
+    if (!ft || ft.kind === "void" || isUnitType(ft) || (common && !typeEquals(common, ft))) {
+      common = null;
+      break;
+    }
+    common = ft;
+  }
+  if (common) {
+    return {
+      kind: "unionDisc",
+      unionId: value.type.unionId,
+      field,
+      value,
+      type: common,
+      loc: locOf(expr),
+    };
+  }
+  // The arms answer DIFFERENT types (or through index signatures / unit
+  // arms): the JOIN path — `env.PORTLESS_PORT` on `ProcessEnv |
+  // Record<string, string>`, the tail read of `loaded?.config.script`.
+  const key: IrExpr = { kind: "strLit", value: field, type: STRING, loc: locOf(expr.name) };
+  const keyed = lowerUnionKeyedRead(lowerer, expr, value.type.unionId, value, key, field);
+  if (keyed) return keyed;
+  // Class arms declaring the field with compatible but different types
+  // (`T | undefined` beside `T`): per-arm slot reads widened to one type.
+  const widened = lowerUnionFieldRead(lowerer, expr, value);
+  if (widened) return widened;
+  // JavaScript overloads commonly inspect a class brand on a scalar-or-
+  // instance argument (e.g. Matrix4.makeTranslation). Preserve primitive
+  // missing-property semantics and dispatch class data through its native
+  // capsule instead of demanding a field shared by every union arm.
+  if (isJsSourceFile(expr.getSourceFile()) && lowerer.dynConvertible(value.type)) {
+    return {
+      kind: "dynKeyGet",
+      value: lowerer.coerceToExpected(value, DYN),
+      key,
+      ...(hasOptionalChainGuard(expr.expression) ? { optional: true as const } : {}),
+      type: DYN,
+      loc: locOf(expr),
+    };
+  }
+  lowerer.unsupported(
+    "SC1090",
+    expr,
+    `reading '${field}' on a union-typed value (every arm must be an object/record ` +
+      `with a same-typed field '${field}'; ` +
+      `${NARROW_FIRST})`,
+  );
+}
+
+/** The unionDisc generalization: a keyed read on a union receiver whose
+ * arms answer DIFFERENT (but joinable) types. Each arm contributes its
+ * declared answer — an array element's type (number keys), a declared field's type (literal keys), an
+ * index-signature arm's value type (plus its declared fields' types for
+ * runtime keys, which reach them through the keyed-read helper), and
+ * UNDEFINED for unit arms (reachable only through optional-chain tails,
+ * where JS short-circuits to undefined; a unit arm the checker narrowed
+ * away is simply unreachable). The result type is the JOIN of those
+ * answers; every arm's answer must be the join itself, one of its
+ * arms, or a sub-union whose payload representations are unchanged.
+ * Array reads retain the ordinary invalid-index trap policy.
+ * Returns null when any arm cannot answer — the caller owns the fence
+ * message. The caller (the property/element dispatch) maybeNarrows. */
+export function lowerUnionKeyedRead(
+  lowerer: Lowerer,
+  expr: ts.Expression,
+  unionId: string,
+  value: IrExpr,
+  key: IrExpr,
+  literalField: string | null,
+): IrExpr | null {
+  const def = lowerer.unions.get(unionId);
+  if (!def) return null;
+  // Pass 1: per-arm declared answers, joined into the result type.
+  const joinArms: IrType[] = [];
+  const seen = new Set<string>();
+  const push = (t: IrType): void => {
+    const k = typeKey(t);
+    if (!seen.has(k)) {
+      seen.add(k);
+      joinArms.push(t);
+    }
+  };
+  const pushAnswer = (t: IrType): boolean => {
+    if (t.kind === "void") return false;
+    if (t.kind === "union") {
+      const inner = lowerer.unions.get(t.unionId);
+      if (!inner) return false;
+      for (const a of inner.arms) push(a);
+      return true;
+    }
+    push(t);
+    return true;
+  };
+  for (const arm of def.arms) {
+    if (isUnitType(arm)) {
+      push(UNDEFINED_T);
+      continue;
+    }
+    if (key.type.kind === "f64") {
+      if (arm.kind !== "array" || !pushAnswer(arm.elem)) return null;
+      continue;
+    }
+    if (arm.kind !== "record") return null;
+    const shape = lowerer.shapes.get(arm.shapeId);
+    if (!shape || shape.tuple) return null;
+    const declared =
+      literalField !== null ? shape.fields.find((f) => f.name === literalField)?.type : undefined;
+    if (declared) {
+      if (!pushAnswer(declared)) return null;
+      continue;
+    }
+    // Runtime keys can reach the declared fields through the keyed-read
+    // helper's string switch — every one joins.
+    if (literalField === null) {
+      for (const f of shape.fields) if (!pushAnswer(f.type)) return null;
+    }
+    if (!shape.indexValue) {
+      if (literalField === null && shape.fields.length > 0) continue;
+      return null;
+    }
+    if (!pushAnswer(shape.indexValue)) return null;
+  }
+  if (joinArms.length === 0) return null;
+  // The join must satisfy native union invariants. The caller owns the
+  // diagnostic when a container or opaque arm prevents that join.
+  if (
+    joinArms.length > 1 &&
+    (!unionContainerArmsOk(joinArms) ||
+      joinArms.some((a) => a.kind === "dyn" || a.kind === "generator" || a.kind === "caught"))
+  ) {
+    return null;
+  }
+  joinArms.sort((a, b) => (typeKey(a) < typeKey(b) ? -1 : 1));
+  const type: IrType =
+    joinArms.length === 1
+      ? joinArms[0]!
+      : { kind: "union", unionId: lowerer.unions.intern(joinArms) };
+  // Pass 2: every arm's answer must SURFACE as the join, and index arms
+  // must pass the single-record keyed-read constraints (the helper is
+  // shared with recordKeyGet, its missing-key policy included).
+  const surfaces = (t: IrType): boolean =>
+    typeEquals(t, type) ||
+    (type.kind === "union" && lowerer.armTag(type.unionId, t) >= 0) ||
+    exactUnionWidening(lowerer, t, type);
+  for (const arm of def.arms) {
+    if (isUnitType(arm)) {
+      if (!(type.kind === "union" && lowerer.armTag(type.unionId, UNDEFINED_T) >= 0)) return null;
+      continue;
+    }
+    if (key.type.kind === "f64") {
+      if (arm.kind !== "array" || !surfaces(arm.elem)) return null;
+      continue;
+    }
+    if (arm.kind !== "record") return null;
+    const shape = lowerer.shapes.get(arm.shapeId);
+    if (!shape) return null;
+    const declared =
+      literalField !== null ? shape.fields.find((f) => f.name === literalField)?.type : undefined;
+    if (declared) {
+      if (!surfaces(declared)) return null;
+      continue;
+    }
+    const ovfShape: IrRecordShape =
+      literalField !== null && shape.indexValue ? { ...shape, fields: [] } : shape;
+    if (!recordKeyResultOk(lowerer, ovfShape, type)) return null;
+  }
+  return { kind: "unionKeyGet", unionId, key, value, type, loc: locOf(expr) };
+}
+
+/** A structural TypeScript view does not change a nominal object's layout
+ * or accessor dispatch. Resolve the property from the represented class;
+ * the optional checker view must not turn its getter into a record read. */
+export function classFieldTarget(
+  lowerer: Lowerer,
+  receiverNode: ts.Expression,
+  receiverType: IrType & { kind: "object" },
+  fieldName: string,
+  saved?: IrExpr,
+): FieldTarget | null {
+  const represented = saved ?? lowerer.lowerExpr(receiverNode);
+  if (
+    represented.type.kind === "dyn" &&
+    isJsSourceFile(receiverNode.getSourceFile()) &&
+    !fieldName.startsWith("#")
+  ) {
+    return { container: "dynamic", obj: represented, field: fieldName, fieldType: DYN };
+  }
+  const info = lowerer.classes.get(receiverType.className);
+  if (!info) {
+    // A receiver typed as a class whose collection deferred: the
+    // deferred diagnostics are what explains the miss.
+    lowerer.flushDeferredClass(receiverType.className);
+    return null;
+  }
+  const fieldType = info.fields.get(fieldName);
+  const lowerObjectReceiver = (): IrExpr => {
+    let obj = represented;
+    if (obj.type.kind === "union") {
+      // A receiver that may hold a missing value (a field assigned an
+      // unchecked read): Node's member-read TypeError for the unit arm.
+      const present = lowerer.runtimeOptionalPropertyReceiver(
+        receiverNode,
+        obj,
+        receiverType,
+        fieldName,
+      );
+      if (present) return present;
+      const helper = lowerer.narrowedArmHelper(obj.type.unionId, receiverType, locOf(receiverNode));
+      obj = helper
+        ? lowerer.checkedNarrowCall(helper, obj, receiverType, locOf(receiverNode))
+        : lowerer.maybeNarrow(obj, receiverNode);
+    }
+    return lowerer.coerceInto(receiverNode, obj, receiverType);
+  };
+  if (fieldName === "cause" && receiverType.className !== "%DOMException") {
+    let root = info;
+    while (root.base) root = root.base;
+    if (root.def.name === "%Error") {
+      return {
+        container: "errorCause",
+        obj: lowerObjectReceiver(),
+        field: "cause",
+        fieldType: DYN,
+      };
+    }
+  }
+  if (fieldType) {
+    const obj = lowerObjectReceiver();
+    if (
+      isJsSourceFile(receiverNode.getSourceFile()) &&
+      !fieldName.startsWith("#") &&
+      [...lowerer.classes.values()].some(
+        (candidate) =>
+          lowerer.isSubclassOf(candidate.def.name, receiverType.className) &&
+          (candidate.methods.has(`get:${fieldName}`) || candidate.methods.has(`set:${fieldName}`)),
+      )
+    ) {
+      return {
+        container: "dynamic",
+        obj: lowerer.coerceToExpected(obj, DYN),
+        field: fieldName,
+        fieldType: DYN,
+      };
+    }
+    return {
+      container: "class",
+      obj,
+      className: receiverType.className,
+      field: fieldName,
+      fieldType,
+    };
+  }
+  // Accessor property: either half declared anywhere on the chain
+  // makes the name an accessor target (fields and accessors share a
+  // namespace — tsc rejects mixing them, so the halves agree on kind).
+  const getF = lowerer.findMethodOn(info, `get:${fieldName}`);
+  const setF = lowerer.findMethodOn(info, `set:${fieldName}`);
+  if (getF || setF) {
+    const obj = lowerObjectReceiver();
+    return {
+      container: "accessor",
+      obj,
+      className: receiverType.className,
+      field: fieldName,
+      fieldType: getF ? getF.sig.ret : setF!.sig.params[0]!.type,
+    };
+  }
+  if (info.decl && isJsSourceFile(info.decl.getSourceFile())) {
+    const property = lowerer.checker.getPropertyOfType(
+      lowerer.checker.getTypeAtLocation(receiverNode),
+      fieldName,
+    );
+    if (
+      property &&
+      property.declarations.some(
+        (declaration) =>
+          ts.isPropertyAccessExpression(declaration) ||
+          ts.isBinaryExpression(declaration) ||
+          ts.isElementAccessExpression(declaration),
+      )
+    ) {
+      return {
+        container: "dynamic",
+        obj: lowerer.coerceToExpected(lowerObjectReceiver(), DYN),
+        field: fieldName,
+        fieldType: DYN,
+      };
+    }
+  }
+  return null;
+}
+
+/** Recognizes `obj.field` as an assignable field target: receiver is a
+ * known class instance OR a record, and the member is a field or (class
+ * receivers) a declared accessor property. Returns the pieces of a
+ * fieldSet/recordSet/accessor-call (minus value/kind) or null. */
+export function fieldTarget(
+  lowerer: Lowerer,
+  access: ts.PropertyAccessExpression,
+): FieldTarget | null {
+  if (lowerer.cjsLocalModuleBindingOf(access.expression)) return null;
+  // `module.exports` / `module.id`: CommonJS module surface, never a field.
+  if (isCjsModuleGlobal(lowerer, access.expression)) return null;
+  if (isCjsExportsIdentifier(lowerer, access.expression)) return null;
+  if (lowerer.chainBlocked(access)) return null;
+  if (
+    access.name.text === "stackTraceLimit" &&
+    lowerer.isStdlibGlobal(access.expression, "Error")
+  ) {
+    return {
+      container: "errorStackLimit",
+      obj: { kind: "numLit", value: 0, type: F64, loc: locOf(access) },
+      field: "stackTraceLimit",
+      fieldType: F64,
+    };
+  }
+  // `this.#x` in a function-local class's prototype method: the field of
+  // the brand-checked receiver (checkedPrivateReceiver).
+  if (
+    ts.isPrivateIdentifier(access.name) &&
+    access.expression.kind === ts.SyntaxKind.ThisKeyword &&
+    lowerer.resolveThis()?.type.kind === "dyn"
+  ) {
+    const owner = localPrivateBrandClass(lowerer, access.name);
+    if (owner) {
+      const ownerType: IrType & { kind: "object" } = {
+        kind: "object",
+        className: owner.info.def.name,
+      };
+      return classFieldTarget(lowerer, access.expression, ownerType, access.name.text);
+    }
+  }
+  const stored = ts.isIdentifier(access.expression)
+    ? (lowerer.peekLocal(access.expression)?.type ?? lowerer.globalOf(access.expression)?.type)
+    : undefined;
+  const narrowed = lowerer.mapTypeOf(lowerer.typeOf(access.expression));
+  // Structural record views retain their storage layout, while a nominal
+  // subclass guard proves a more specific layout of the same object.
+  const receiverIr =
+    stored?.kind === "record"
+      ? stored
+      : stored?.kind === "object" &&
+          !(
+            narrowed?.kind === "object" &&
+            lowerer.isSubclassOf(narrowed.className, stored.className)
+          )
+        ? stored
+        : narrowed;
+  if (receiverIr?.kind === "object") {
+    const target = classFieldTarget(lowerer, access.expression, receiverIr, access.name.text);
+    if (target) return target;
+    // Abstract properties declare no base storage. Resolve the concrete
+    // instance's live field or accessor through the existing class bridge;
+    // inventing a shared field offset would misread subclass layouts.
+    if (abstractPropertyDeclOf(lowerer, access)) {
+      return {
+        container: "dynamic",
+        obj: lowerer.coerceInto(access.expression, lowerer.lowerExpr(access.expression), DYN),
+        field: access.name.text,
+        fieldType: lowerer.irTypeOf(access),
+      };
+    }
+    return null;
+  }
+  if (receiverIr?.kind === "union" && hasClassPayload(lowerer, receiverIr)) {
+    return representedClassFieldTarget(
+      lowerer,
+      access.expression,
+      access.name.text,
+      lowerer.lowerExpr(access.expression),
+    );
+  }
+  if (receiverIr?.kind === "record") {
+    const shape = lowerer.shapes.get(receiverIr.shapeId);
+    const fieldType = shape?.fields.find((f) => f.name === access.name.text)?.type;
+    if (fieldType) {
+      let obj = lowerer.lowerExpr(access.expression);
+      const nominal = representedClassFieldTarget(
+        lowerer,
+        access.expression,
+        access.name.text,
+        obj,
+      );
+      if (nominal) return nominal;
+      // A checker-record receiver whose VALUE stayed dyn (the erased
+      // all-unknown-fields cast — `(err as { code?: unknown }).code`):
+      // decline, and the dyn keyed-read fallback answers.
+      if (obj.type.kind === "union" && lowerer.armTag(obj.type.unionId, UNDEFINED_T) >= 0) {
+        // A nested property read such as `rows[i].value` or
+        // `table[k].value`: the outer read can miss. Validate the record
+        // arm before fieldGet/recordGet so a missing outer value raises
+        // Node's TypeError rather than reaching the backend with a union
+        // receiver.
+        const present = lowerer.stripUndefinedArm(obj.type);
+        const parent = access.parent;
+        const written =
+          parent !== undefined &&
+          ts.isBinaryExpression(parent) &&
+          parent.left === access &&
+          parent.operatorToken.kind === ts.SyntaxKind.EqualsToken;
+        const helper =
+          present.kind === "record"
+            ? lowerer.narrowedArmHelper(obj.type.unionId, present, locOf(access.expression))
+            : null;
+        obj =
+          (present.kind === "record"
+            ? lowerer.runtimeOptionalPropertyReceiver(
+                access.expression,
+                obj,
+                present,
+                access.name.text,
+                written ? "set" : "read",
+              )
+            : null) ??
+          (helper
+            ? lowerer.checkedNarrowCall(helper, obj, present, locOf(access.expression))
+            : lowerer.maybeNarrow(obj, access.expression));
+      }
+      if (obj.type.kind !== "record") return null;
+      const actualShape = lowerer.shapes.get(obj.type.shapeId);
+      const actualField = actualShape?.fields.find((f) => f.name === access.name.text);
+      return {
+        container: "record",
+        obj,
+        shapeId: obj.type.shapeId,
+        field: access.name.text,
+        fieldType: actualField?.type ?? fieldType,
+      };
+    }
+    // A RECORD accessor property: either slot present makes the name an
+    // accessor target (get/set share the property namespace — tsc
+    // rejects mixing an accessor with a data property, so the halves
+    // agree). Reads dispatch the %get: closure, writes the %set: one.
+    {
+      const getSlot = shape?.fields.find((f) => f.name === `%get:${access.name.text}`)?.type;
+      const setSlot = shape?.fields.find((f) => f.name === `%set:${access.name.text}`)?.type;
+      if (getSlot?.kind === "func" || setSlot?.kind === "func") {
+        const obj = lowerer.lowerExpr(access.expression);
+        if (obj.type.kind !== "record") return null; // dyn-valued receiver: the keyed fallback answers
+        const getType = getSlot?.kind === "func" ? getSlot : undefined;
+        const setType = setSlot?.kind === "func" ? setSlot : undefined;
+        return {
+          container: "recordAccessor",
+          obj,
+          shapeId: receiverIr.shapeId,
+          field: access.name.text,
+          fieldType: getType ? getType.ret : setType!.params[0]!,
+          ...(getType ? { getType } : {}),
+          ...(setType ? { setType } : {}),
+        };
+      }
+    }
+    // Dot access to an UNDECLARED key of an index-signature shape: tsc
+    // types it through the signature — the access resolves to NO property
+    // symbol (mapped types like Record<string, T>) or to the signature's
+    // own `__index` symbol (interface-declared signatures). A real member
+    // symbol means a lib member like `toString` — not an index access;
+    // those keep their fences below. It IS the bracket access in dot
+    // spelling — the same overflow path.
+    const nameSym = lowerer.checker.getSymbolAtLocation(access.name);
+    if (shape?.indexValue && !shape.tuple) {
+      // A member the shape CANONICALIZATION dropped into the overflow
+      // (the header family: @types declares `host?: string` on
+      // IncomingHttpHeaders while the canonical shape is a pure index
+      // record) is the bracket access in dot spelling too: a PROPERTY
+      // declaration whose own type fits within the index value. METHOD
+      // members (`toString` — the lib's inherited surface) keep their
+      // fences: JS finds the prototype function, never an overflow miss.
+      const canonicalized = (): boolean => {
+        if (!nameSym) return false;
+        const nameDecls = nameSym.declarations;
+        if (!nameDecls.length) return false;
+        if (!nameDecls.every((d) => ts.isPropertySignature(d))) return false;
+        const declared = lowerer.mapTypeOf(lowerer.typeOf(access));
+        if (!declared) return false;
+        const iv = shape.indexValue!;
+        if (typeEquals(declared, iv)) return true;
+        if (iv.kind !== "union") return false;
+        const ivArms = lowerer.unions.get(iv.unionId)?.arms;
+        if (!ivArms) return false;
+        const declaredArms =
+          declared.kind === "union"
+            ? (lowerer.unions.get(declared.unionId)?.arms ?? [declared])
+            : [declared];
+        return declaredArms.every((a) => ivArms.some((b) => typeEquals(a, b)));
+      };
+      if (!nameSym || nameSym.name === ts.InternalSymbolName.Index || canonicalized()) {
+        let obj = lowerer.lowerExpr(access.expression);
+        if (obj.type.kind === "union" && lowerer.armTag(obj.type.unionId, UNDEFINED_T) >= 0) {
+          const present = lowerer.stripUndefinedArm(obj.type);
+          obj =
+            present.kind === "record"
+              ? (lowerer.runtimeOptionalPropertyReceiver(
+                  access.expression,
+                  obj,
+                  present,
+                  access.name.text,
+                ) ?? obj)
+              : lowerer.maybeNarrow(obj, access.expression);
+        }
+        if (obj.type.kind !== "record") return null;
+        const actualShape = lowerer.shapes.get(obj.type.shapeId);
+        if (!actualShape?.indexValue) return null;
+        return {
+          container: "recordOvf",
+          obj,
+          shapeId: obj.type.shapeId,
+          field: access.name.text,
+          fieldType: actualShape.indexValue,
+        };
+      }
+    }
+    return null;
+  }
+  return null;
+}
+
+/** The read expression for a field target (fieldGet / recordGet /
+ * getter call). `blame` locates the rejection of a setter-only read —
+ * tsc-clean (the property types as the setter's param), but Node yields
+ * undefined, which these property types cannot represent. */
+export function fieldGetExpr(
+  lowerer: Lowerer,
+  target: FieldTarget,
+  loc: SrcLoc,
+  blame: ts.Node,
+): IrExpr {
+  // A member read through an unassigned deferred-init field throws Node's
+  // member-read TypeError instead of the generic checked extraction.
+  if (
+    target.container === "class" &&
+    ts.isPropertyAccessExpression(blame) &&
+    target.obj.type.kind === "object" &&
+    lowerer.deferredFieldSlot(target.obj) !== null
+  ) {
+    const checked = lowerer.runtimeOptionalPropertyReceiver(
+      blame.expression,
+      target.obj,
+      target.obj.type,
+      target.field,
+    );
+    if (checked) target = { ...target, obj: checked };
+  }
+  if (target.container === "dynamic")
+    return lowerer.coerceInto(
+      blame,
+      {
+        kind: "dynKeyGet",
+        value: target.obj,
+        key: { kind: "strLit", value: target.field, type: STRING, loc },
+        type: DYN,
+        loc,
+      },
+      target.fieldType,
+    );
+  if (
+    target.container === "class" &&
+    (target.field === "message" || target.field === "name") &&
+    (target.className === "%Error" || lowerer.isSubclassOf(target.className, "%Error"))
+  )
+    return errorPropertyRead(lowerer, target.obj, target.field);
+  if (target.container === "errorStackLimit") {
+    return { kind: "libCall", fn: "error.stackLimitGet", args: [], type: F64, loc };
+  }
+  if (target.container === "errorCause") {
+    return { kind: "libCall", fn: "error.cause", args: [target.obj], type: DYN, loc };
+  }
+  // A record-shaped CHECKER target whose receiver VALUE lives in the checked-dynamic tree
+  // (a JS file-scope object-literal global): the checked-dynamic keyed
+  // read — dynKeyGet (a missing key answers the dyn undefined, exactly
+  // JS); consumers validate (dynCheck) where a static type is required.
+  if (
+    (target.container === "record" || target.container === "recordOvf") &&
+    target.obj.type.kind === "dyn"
+  ) {
+    return {
+      kind: "dynKeyGet",
+      key: { kind: "strLit", value: target.field, type: STRING, loc },
+      value: target.obj,
+      type: DYN,
+      loc,
+    };
+  }
+  if (target.container === "accessor") {
+    const getF = lowerer.findMethodOn(
+      lowerer.classes.get(target.className) ?? null,
+      `get:${target.field}`,
+    );
+    if (!getF) {
+      lowerer.unsupported(
+        "SC1090",
+        blame,
+        `reading a property that has only a setter ('${target.field}' — Node would yield undefined)`,
+      );
+    }
+    if (
+      !target.field.startsWith("#") &&
+      isJsSourceFile(blame.getSourceFile()) &&
+      lowerer.dynConvertible(getF.sig.ret)
+    ) {
+      const value: IrExpr = {
+        kind: "dynKeyGet",
+        value: lowerer.coerceToExpected(target.obj, DYN),
+        key: { kind: "strLit", value: target.field, type: STRING, loc },
+        type: DYN,
+        loc,
+      };
+      return lowerer.coerceToExpected(value, getF.sig.ret);
+    }
+    return lowerer.accessorCall(
+      target.className,
+      `get:${target.field}`,
+      target.obj,
+      [],
+      getF.sig.ret,
+      loc,
+    );
+  }
+  // Record accessor properties: the read IS a call of the %get: closure
+  // — once per read, side effects and all (JS's evaluation). The
+  // setter-only read keeps the class-path fence: the property types as
+  // the setter's param where Node yields undefined.
+  if (target.container === "recordAccessor") {
+    if (!target.getType) {
+      lowerer.unsupported(
+        "SC1090",
+        blame,
+        `reading a property that has only a setter ('${target.field}' — Node would yield undefined)`,
+      );
+    }
+    const closure: IrExpr = {
+      kind: "recordGet",
+      obj: target.obj,
+      shapeId: target.shapeId,
+      field: `%get:${target.field}`,
+      type: target.getType,
+      loc,
+    };
+    return { kind: "callValue", callee: closure, args: [], type: target.getType.ret, loc };
+  }
+  // Overflow dot reads: exactly the bracket read with a literal key —
+  // recordKeyGet, overflowOnly (the name declares no field by
+  // construction), typed as the index value armed with undefined
+  // (mirroring lowerRecordKeyRead).
+  if (target.container === "recordOvf") {
+    let obj = target.obj;
+    if (obj.type.kind === "union" && ts.isPropertyAccessExpression(blame)) {
+      const present = lowerer.stripUndefinedArm(obj.type);
+      if (present.kind === "record") {
+        obj =
+          lowerer.runtimeOptionalPropertyReceiver(blame.expression, obj, present, target.field) ??
+          obj;
+      }
+    }
+    if (obj.type.kind !== "record") {
+      lowerer.unsupported(
+        "SC1090",
+        blame,
+        `reading '${target.field}' on a non-record receiver (narrow first)`,
+      );
+    }
+    const shape = lowerer.shapes.get(obj.type.shapeId);
+    if (!shape?.indexValue)
+      lowerer.unsupported(
+        "SC1090",
+        blame,
+        `reading '${target.field}' on a record without an index signature`,
+      );
+    let t: IrType = shape.indexValue;
+    if (t.kind !== "dyn") {
+      const armed = lowerer.withUndefinedArmOf(t);
+      if (!armed) lowerer.badType(blame, lowerer.typeOf(blame));
+      t = armed;
+    }
+    return {
+      kind: "recordKeyGet",
+      obj,
+      shapeId: obj.type.shapeId,
+      key: { kind: "strLit", value: target.field, type: STRING, loc },
+      overflowOnly: true,
+      type: t,
+      loc,
+    };
+  }
+  if (target.container === "class") {
+    const read: IrExpr = {
+      kind: "fieldGet",
+      obj: target.obj,
+      className: target.className,
+      field: target.field,
+      type: target.fieldType,
+      loc,
+    };
+    // DEFERRED-INIT fields (`stream!: T` assigned past the constructor's
+    // top level — ClassInfo.deferredInitFields): the SLOT is the
+    // undefined-armed union; the read CHECKED-extracts the declared type
+    // — a genuinely unassigned read throws the catchable TypeError
+    // where Node reads an undefined the declared type cannot hold.
+    if (
+      lowerer.classes.get(target.className)?.deferredInitFields?.has(target.field) === true &&
+      target.fieldType.kind === "union"
+    ) {
+      const inner = lowerer.stripUndefinedArm(target.fieldType);
+      // Reference arms over a stable receiver check inline: the present
+      // arm is a plain projection of the slot, so ordinary reads keep their
+      // borrowed form and only an unassigned slot reaches the throw.
+      const unionId = target.fieldType.unionId;
+      const presentTag = lowerer.armTag(unionId, inner);
+      const undefTag = lowerer.armTag(unionId, UNDEFINED_T);
+      if (
+        inner.kind === "object" &&
+        presentTag >= 0 &&
+        undefTag >= 0 &&
+        lowerer.unions.get(unionId)?.arms.length === 2 &&
+        isSafeToRepeat(read)
+      ) {
+        return {
+          kind: "ternary",
+          cond: {
+            kind: "unionIsTag",
+            unionId,
+            tag: undefTag,
+            negated: false,
+            value: read,
+            type: BOOL,
+            loc,
+          },
+          then: nodeThrowExpr(1, "", DEFERRED_READ_MESSAGE, inner, loc),
+          else_: { kind: "unionNarrow", unionId, tag: presentTag, value: read, type: inner, loc },
+          type: inner,
+          loc,
+        };
+      }
+      const helper = lowerer.deferredReadHelper(target.fieldType.unionId, inner, loc);
+      if (helper) return { kind: "call", callee: helper, args: [read], type: inner, loc };
+    }
+    return read;
+  }
+  return {
+    kind: "recordGet",
+    obj: target.obj,
+    shapeId: target.shapeId,
+    field: target.field,
+    type: target.fieldType,
+    loc,
+  };
+}
+
+/** Stream-rooted receivers' property surface (readableEnded, destroyed,
+ * ...): the receiver's mapped class dispatches into lower-stream.ts.
+ * Null off the stream hierarchy or for names the spoke does not own. */
+function lowerStreamObjectProperty(
+  lowerer: Lowerer,
+  expr: ts.PropertyAccessExpression,
+): IrExpr | null {
+  if (expr.questionDotToken && !lowerer.chainHandled.has(expr)) return null;
+  const recvT = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+  if (recvT?.kind !== "object") return null;
+  const info = lowerer.classes.get(recvT.className);
+  if (!info || streamSidesOf(lowerer, info) === null) return null;
+  if (expr.name.text === "bytesWritten" && isZlibStreamMember(lowerer, expr)) {
+    return lowerZlibStreamBytesWritten(lowerer, expr);
+  }
+  if (isFsStreamMember(lowerer, expr)) {
+    const member = lowerFsStreamProperty(lowerer, expr);
+    if (member) return member;
+  }
+  return lowerStreamProperty(lowerer, expr, info);
+}
+
+/** True when `access` reads a member that JavaScript sources attach to a
+ * function by assignment (`fn.member = value`): the receiver's type is
+ * callable and every declaration of the member is such an assignment in a
+ * JS file. */
+function jsFunctionExpandoMember(lowerer: Lowerer, access: ts.PropertyAccessExpression): boolean {
+  if (access.questionDotToken || !ts.isIdentifier(access.name)) return false;
+  const recvType = lowerer.typeOf(access.expression);
+  if (lowerer.checker.getCallSignatures(recvType).length === 0) return false;
+  const member = lowerer.checker.getPropertyOfType(recvType, access.name.text);
+  const decls = member ? member.declarations : [];
+  return (
+    decls.length > 0 &&
+    decls.every((d) => {
+      if (!isJsSourceFile(d.getSourceFile())) return false;
+      const assign = ts.isBinaryExpression(d) ? d : d.parent;
+      return (
+        assign !== undefined &&
+        ts.isBinaryExpression(assign) &&
+        assign.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
+        ts.isPropertyAccessExpression(assign.left)
+      );
+    })
+  );
+}
diff --git a/packages/compiler/src/frontend/lowering/expressions/relational.ts b/packages/compiler/src/frontend/lowering/expressions/relational.ts
new file mode 100644
index 000000000..619c0fe37
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/expressions/relational.ts
@@ -0,0 +1,1729 @@
+/* instanceof and in, including private-name and runtime-key in. */
+import * as ts from "../../ts7/adapter.js";
+import {
+  checkedPrivateIn,
+  localPrivateBrandClass,
+  primitiveOperand,
+  privateInMessage,
+} from "../private-brands.js";
+import type { Lowerer } from "../lowerer.js";
+import {
+  BOOL,
+  BYTES_ELEMENT_NAME,
+  CAUGHT,
+  DYN,
+  F64,
+  type IrBytesElem,
+  type IrExpr,
+  type IrStmt,
+  type IrType,
+  RUNTIME_ERROR_CLASSES,
+  STRING,
+  type SrcLoc,
+  UNDEFINED_T,
+  isUnitType,
+  typeEquals,
+  typeKey,
+} from "../../../ir/ir.js";
+import { refuseWebAssemblyUse } from "../builtins/webassembly.js";
+import { lowerSocketInstanceOf } from "../lower-server.js";
+import { builtinClassRefOf } from "../builtins/class-values.js";
+import { lowerZlibInstanceOf } from "../builtins/compression.js";
+import { numLit, strLit, varRef } from "../../../ir/build.js";
+import { lowerDisposableStackInstanceOf } from "../builtins/disposable-stack.js";
+import { lowerBlobInstanceof } from "../builtins/blob.js";
+import { lowerReadlineInstanceof } from "../builtins/readline.js";
+import { lowerKeyObjectInstanceof } from "../builtins/key-object.js";
+import { lowerCryptoKeyInstanceof } from "../builtins/webcrypto.js";
+import { lowerNetAddressInstanceof } from "../builtins/net-address.js";
+import { fenceEarlyNsMemberRef, nsMemberIdentOf } from "../lower-namespaces.js";
+import { maybePromiseInstanceOf } from "../maybe-promise.js";
+import { isSafeToDiscard } from "./evaluation-safety.js";
+import { type ClassInfo, storedClassValueType } from "../lower-classes.js";
+import { classInstanceOf } from "../class-dynamic-dispatch.js";
+import { InternalCompilerError } from "../../../errors.js";
+import { tryLowerExpression } from "./try-lower-expression.js";
+import { isJsSourceFile, locOf } from "../../program.js";
+import { checkedClassInstanceOf } from "../class-construction.js";
+import { globalSymbolKey } from "./global-symbols.js";
+import { foldedStringKeyOf } from "./object-literals.js";
+import { NARROW_FIRST, sideEffectFreeOptionValue } from "../surfaces.js";
+import { isExecExceptionType, refuseExecExceptionCode } from "../builtins/errors.js";
+import { hasRuntimeStatics } from "../class-runtime-statics.js";
+import { nullProtoRecordShape, recordNullProtoTest } from "../null-prototype.js";
+
+/** `x instanceof C` for a program-declared class C. When x's static
+ * class and C are both in extends-hierarchies the test is dynamic — the
+ * O(1) preorder-interval check against the vtable (`instanceOf` node).
+ * Everything else is decided by the static class graph alone and folds
+ * to the honest constant: `x instanceof C` is always true when x's
+ * static class IS C or descends from it, and always false when the
+ * classes are unrelated (a standalone class has no other relatives).
+ * Folding is limited to side-effect-free operands — dropping a computed
+ * operand would skip its effects, so those are rejected instead. */
+export function lowerInstanceOf(lowerer: Lowerer, expr: ts.BinaryExpression, loc: SrcLoc): IrExpr {
+  refuseWebAssemblyUse(lowerer, expr.right);
+  // `x instanceof net.Socket` over a union with a netSocket arm — the
+  // h2 compat 'connect' narrowing (lower-server.ts): a union tag test.
+  const sockTest = lowerSocketInstanceOf(lowerer, expr, loc);
+  if (sockTest !== null) return sockTest;
+  const rightClass = builtinClassRefOf(lowerer, expr.right);
+  if (rightClass?.kind === "zlib") return lowerZlibInstanceOf(lowerer, expr, rightClass.mode, loc);
+
+  if (rightClass?.kind === "collection") {
+    const collection = rightClass.which === "Map" ? "map" : "set";
+    const value = lowerer.lowerExpr(expr.left);
+    if (value.type.kind === "union") {
+      const union = lowerer.unions.get(value.type.unionId);
+      if (union) {
+        const local = lowerer.declareHiddenLocal("%collectionTest", value.type);
+        const reference = varRef(local.id, value.type, loc);
+        let result: IrExpr = { kind: "boolLit", value: false, type: BOOL, loc };
+        union.arms.forEach((arm, tag) => {
+          if (arm.kind !== collection) return;
+          const test: IrExpr = {
+            kind: "unionIsTag",
+            unionId: union.id,
+            value: reference,
+            tag,
+            negated: false,
+            type: BOOL,
+            loc,
+          };
+          result =
+            result.kind === "boolLit"
+              ? test
+              : { kind: "logical", op: "||", left: result, right: test, type: BOOL, loc };
+        });
+        return {
+          kind: "seqExpr",
+          stmts: [{ kind: "varDecl", localId: local.id, init: value, loc }],
+          result,
+          type: BOOL,
+          loc,
+        };
+      }
+    }
+    if (value.type.kind === "dyn")
+      return {
+        kind: "libCall",
+        fn: collection === "map" ? "dyn.nativeMapIs" : "dyn.nativeSetIs",
+        args: [value],
+        type: BOOL,
+        loc,
+      };
+    if (value.type.kind === collection)
+      return {
+        kind: "seqExpr",
+        stmts: [{ kind: "exprStmt", expr: value, loc }],
+        result: { kind: "boolLit", value: true, type: BOOL, loc },
+        type: BOOL,
+        loc,
+      };
+    return {
+      kind: "libCall",
+      fn: collection === "map" ? "dyn.nativeMapIs" : "dyn.nativeSetIs",
+      args: [lowerer.coerceInto(expr.left, value, DYN)],
+      type: BOOL,
+      loc,
+    };
+  }
+  if (
+    lowerer.isStdlibGlobal(expr.right, "WeakMap") ||
+    lowerer.isStdlibGlobal(expr.right, "WeakSet")
+  ) {
+    const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
+    return {
+      kind: "libCall",
+      fn: lowerer.isStdlibGlobal(expr.right, "WeakMap") ? "weakMap.is" : "weakSet.is",
+      args: [value],
+      type: BOOL,
+      loc,
+    };
+  }
+  const rhsBuiltin = ts.isIdentifier(expr.right)
+    ? lowerer.builtinImportOf(expr.right)
+    : ts.isPropertyAccessExpression(expr.right)
+      ? lowerer.builtinMemberOf(expr.right)
+      : null;
+  if (
+    lowerer.isStdlibGlobal(expr.right, "URL") ||
+    (rhsBuiltin?.module === "url" && rhsBuiltin.member === "URL")
+  ) {
+    const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
+    return { kind: "libCall", fn: "dyn.nativeUrlIs", args: [value], type: BOOL, loc };
+  }
+  {
+    const stack = lowerDisposableStackInstanceOf(lowerer, expr);
+    if (stack) return stack;
+  }
+  if (lowerer.isStdlibGlobal(expr.right, "DataView")) {
+    const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
+    return { kind: "libCall", fn: "dyn.dataViewIs", args: [value], type: BOOL, loc };
+  }
+  {
+    const eventKind = ["Event", "CustomEvent", "EventTarget"].findIndex((name) =>
+      lowerer.isStdlibGlobal(expr.right, name),
+    );
+    if (eventKind >= 0) {
+      const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
+      const kind: IrExpr = { kind: "numLit", value: eventKind, type: F64, loc };
+      return { kind: "libCall", fn: "event.is", args: [value, kind], type: BOOL, loc };
+    }
+  }
+  {
+    const blob = lowerBlobInstanceof(lowerer, expr);
+    if (blob) return blob;
+    const keyObject = lowerKeyObjectInstanceof(lowerer, expr);
+    if (keyObject) return keyObject;
+    const cryptoKey = lowerCryptoKeyInstanceof(lowerer, expr);
+    if (cryptoKey) return cryptoKey;
+    const netAddress = lowerNetAddressInstanceof(lowerer, expr);
+    if (netAddress) return netAddress;
+    const readlineInterface = lowerReadlineInstanceof(lowerer, expr);
+    if (readlineInterface) return readlineInterface;
+  }
+  if (lowerer.isStdlibGlobal(expr.right, "SharedArrayBuffer")) {
+    const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
+    return { kind: "libCall", fn: "sharedArrayBuffer.is", args: [value], type: BOOL, loc };
+  }
+  if (lowerer.isStdlibGlobal(expr.right, "ArrayBuffer")) {
+    const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
+    return { kind: "libCall", fn: "arrayBuffer.is", args: [value], type: BOOL, loc };
+  }
+  const rhsSymbol = ts.isIdentifier(expr.right) ? lowerer.resolveValueSymbol(expr.right) : null;
+  // `x instanceof events.EventEmitter` — the namespace-member spelling
+  // resolves to the same ambient class as the named import.
+  const rhsMemberSymbol = (() => {
+    if (!ts.isPropertyAccessExpression(expr.right) || !ts.isIdentifier(expr.right.name))
+      return null;
+    const sym = lowerer.checker.getSymbolAtLocation(expr.right.name);
+    return sym && sym.flags & ts.SymbolFlags.Alias
+      ? lowerer.checker.getAliasedSymbol(sym)
+      : (sym ?? null);
+  })();
+  // `x instanceof N.C` — the USER-namespace-qualified spelling: the
+  // member resolves to the registered program class, with the
+  // source-order guard (an init-position test above the class's block
+  // would read an uninitialized member in Node).
+  const rhsNsClass = (() => {
+    if (!ts.isPropertyAccessExpression(expr.right)) return undefined;
+    const nsMember = nsMemberIdentOf(lowerer, expr.right);
+    if (!nsMember) return undefined;
+    const memberSym = lowerer.checker.getSymbolAtLocation(nsMember);
+    if (memberSym) fenceEarlyNsMemberRef(lowerer, expr.right, memberSym);
+    const classSym = lowerer.resolveValueSymbol(nsMember);
+    const nsInfo = classSym ? lowerer.classBySymbol.get(classSym) : undefined;
+    // Qualified spellings of a rebindable decorated class (import=
+    // alias chains) must not fold against the declaration — the
+    // decoration result decides at runtime.
+    return nsInfo?.classDecorators?.valueGlobalId !== undefined ? undefined : nsInfo;
+  })();
+  // A rebindable decorated name as the RHS: the runtime target is the
+  // decoration result — fall to the class-VALUE path below, whose
+  // instanceOfValue reads the interval off the bound class object.
+  const directRhs = rhsSymbol ? lowerer.classBySymbol.get(rhsSymbol) : undefined;
+  const target =
+    (directRhs?.localClass || directRhs?.classDecorators?.valueGlobalId !== undefined
+      ? undefined
+      : directRhs) ??
+    rhsNsClass ??
+    lowerer.builtinErrorInfoOf(rhsSymbol) ??
+    lowerer.builtinErrorInfoOf(rhsMemberSymbol) ??
+    lowerer.builtinEmitterInfoOf(rhsSymbol) ??
+    lowerer.builtinEmitterInfoOf(rhsMemberSymbol) ??
+    lowerer.builtinStreamInfoOf(rhsSymbol) ??
+    lowerer.builtinStreamInfoOf(rhsMemberSymbol) ??
+    undefined;
+  if (!target) {
+    const date = lowerer.isStdlibGlobal(expr.right, "Date");
+    const url = lowerer.isStdlibGlobal(expr.right, "URL");
+    if ((date || url) && !lowerer.caughtLocalOf(expr.left)) {
+      const value = lowerer.lowerExpr(expr.left);
+      if (value.type.kind === "dyn")
+        return {
+          kind: "libCall",
+          fn: date ? "dyn.nativeDateIs" : "dyn.nativeUrlIs",
+          args: [value],
+          type: BOOL,
+          loc,
+        };
+      if (value.type.kind === "union")
+        return {
+          kind: "libCall",
+          fn: date ? "dyn.nativeDateIs" : "dyn.nativeUrlIs",
+          args: [lowerer.coerceInto(expr.left, value, DYN)],
+          type: BOOL,
+          loc,
+        };
+      return {
+        kind: "seqExpr",
+        stmts: [{ kind: "exprStmt", expr: value, loc }],
+        result: {
+          kind: "boolLit",
+          value: value.type.kind === (date ? "date" : "url"),
+          type: BOOL,
+          loc,
+        },
+        type: BOOL,
+        loc,
+      };
+    }
+    const webBrand = ["Request", "Response", "Headers"].find((name) =>
+      lowerer.isStdlibGlobal(expr.right, name),
+    );
+    if (webBrand)
+      return {
+        kind: "libCall",
+        fn: "fetch.webIs",
+        args: [
+          lowerer.lowerExprExpecting(expr.left, DYN),
+          { kind: "strLit", value: webBrand, type: STRING, loc },
+        ],
+        type: BOOL,
+        loc,
+      };
+    if (lowerer.isStdlibGlobal(expr.right, "ReadableStream")) {
+      const value = lowerer.lowerExprExpecting(expr.left, DYN);
+      return { kind: "libCall", fn: "fetch.streamIs", args: [value], type: BOOL, loc };
+    }
+    // Unknown storage retains each numeric typed array's exact native brand.
+    if (!lowerer.caughtLocalOf(expr.left)) {
+      const elem = (Object.keys(BYTES_ELEMENT_NAME) as IrBytesElem[]).find((kind) =>
+        lowerer.isStdlibGlobal(expr.right, BYTES_ELEMENT_NAME[kind]),
+      );
+      if (elem !== undefined) {
+        const left = lowerer.lowerExpr(expr.left);
+        if (left.type.kind === "dyn") {
+          return { kind: "dynTest", test: "bytes", bytesElem: elem, value: left, type: BOOL, loc };
+        }
+        return {
+          kind: "dynTest",
+          test: "bytes",
+          bytesElem: elem,
+          value: lowerer.coerceInto(expr.left, left, DYN),
+          type: BOOL,
+          loc,
+        };
+      }
+    }
+    // `x instanceof Promise` over a promise-armed union (the maybe-promise
+    // `T | Promise<T>` dispatch): a union tag test — the data arms are
+    // never promises (scriptc promises are all native, and no data arm
+    // can hold one). A promise-typed operand answers true after its
+    // evaluation; a checked-dynamic one asks the runtime.
+    if (
+      ts.isIdentifier(expr.right) &&
+      lowerer.isStdlibGlobal(expr.right, "Promise") &&
+      !lowerer.caughtLocalOf(expr.left)
+    ) {
+      const left = lowerer.lowerExpr(expr.left);
+      const tagTest = maybePromiseInstanceOf(lowerer, left, loc);
+      if (tagTest) return tagTest;
+      if (left.type.kind === "dyn")
+        return { kind: "dynTest", test: "promise", value: left, type: BOOL, loc };
+      if (left.type.kind === "promise") {
+        const yes: IrExpr = { kind: "boolLit", value: true, type: BOOL, loc };
+        if (isSafeToDiscard(left)) return yes;
+        return {
+          kind: "seqExpr",
+          stmts: [{ kind: "exprStmt", expr: left, loc }],
+          result: yes,
+          type: BOOL,
+          loc,
+        };
+      }
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        `'instanceof Promise' on '${lowerer.fmt(left.type)}' values (only promises, promise-armed unions, and checked-dynamic values have a lowering)`,
+      );
+    }
+    // `x instanceof RegExp` over a union with a regex arm (the
+    // skip-utility `string | RegExp` dispatch): a union tag test — the
+    // socket-narrowing shape; the checker types the branches and
+    // maybeNarrow bridges the reads. A plain regex-typed LHS folds
+    // true; the fold keeps the operand-purity rule of the class folds
+    // (identifier reads only).
+    if (
+      ts.isIdentifier(expr.right) &&
+      lowerer.isStdlibGlobal(expr.right, "RegExp") &&
+      !lowerer.caughtLocalOf(expr.left)
+    ) {
+      const left = lowerer.lowerExpr(expr.left);
+      if (left.type.kind === "dyn")
+        return { kind: "libCall", fn: "dyn.nativeRegexIs", args: [left], type: BOOL, loc };
+      if (left.type.kind === "union") {
+        const def = lowerer.unions.get(left.type.unionId);
+        const tag = def ? def.arms.findIndex((a) => a.kind === "regex") : -1;
+        if (tag >= 0) {
+          return {
+            kind: "unionIsTag",
+            unionId: left.type.unionId,
+            tag,
+            negated: false,
+            value: left,
+            type: BOOL,
+            loc,
+          };
+        }
+      }
+      return {
+        kind: "libCall",
+        fn: "dyn.nativeRegexIs",
+        args: [lowerer.coerceInto(expr.left, left, DYN)],
+        type: BOOL,
+        loc,
+      };
+    }
+    // `x instanceof X` where X is a class VALUE (a classval-typed
+    // binding): the target is DYNAMIC — a hierarchy target reads its
+    // interval from the class object at runtime (instanceOfValue); a
+    // STANDALONE target class has exactly one possible runtime value
+    // (itself — no descendants can flow into the slot), so the answer
+    // folds statically exactly like the named-target folds below.
+    const rhsClassval = storedClassValueType(lowerer, expr.right);
+    if (rhsClassval?.kind === "classval" && !lowerer.caughtLocalOf(expr.left)) {
+      const targetInfo = lowerer.classes.get(rhsClassval.className);
+      if (!targetInfo) {
+        // The type world names a class the lowering never registered
+        // (a fenced class expression, a deferred declaration): flush
+        // its diagnostics and poison the test site, never an ICE.
+        lowerer.flushDeferredClass(rhsClassval.className);
+        lowerer.unsupported(
+          "SC1090",
+          expr,
+          "'instanceof' against a class value whose class has no lowering (the class declaration itself was rejected — see its own diagnostic)",
+        );
+      }
+      const left = lowerer.lowerExpr(expr.left);
+      if (left.type.kind === "dyn") {
+        if (targetInfo.def.runtime) {
+          lowerer.unsupported(
+            "SC1090",
+            expr,
+            "'instanceof' through a runtime-provided class value on an untyped value (give the operand a class type first)",
+          );
+        }
+        const classValue = lowerer.lowerExpr(expr.right);
+        return classInstanceOf(lowerer, left, targetInfo, loc, classValue);
+      }
+      // A union of class instances against a runtime class value (`new K()`
+      // through a widened `[Readable, Writable]` element).
+      if (left.type.kind === "union" && targetInfo.def.runtime) {
+        const tested = unionClassValueInstanceOf(lowerer, left, expr.right, targetInfo, loc);
+        if (tested) return tested;
+      }
+      if (left.type.kind !== "object") {
+        lowerer.unsupported(
+          "SC1090",
+          expr,
+          "'instanceof' on values other than class instances (narrow union-typed values first)",
+        );
+      }
+      const lhsInfo = lowerer.classes.get(left.type.className);
+      if (!lhsInfo)
+        throw new InternalCompilerError(`lowerer bug: unknown class ${left.type.className}`);
+      if (
+        (lowerer.inHierarchy(targetInfo) && lowerer.inHierarchy(lhsInfo)) ||
+        (targetInfo.localClass !== undefined && lhsInfo.localClass !== undefined)
+      ) {
+        const classValue = lowerer.lowerExpr(expr.right);
+        if (classValue.type.kind !== "classval")
+          lowerer.badType(expr.right, lowerer.typeOf(expr.right));
+        const writableTest = writableClassValueTest(
+          lowerer,
+          left,
+          classValue,
+          targetInfo,
+          lhsInfo,
+          loc,
+        );
+        if (writableTest) return writableTest;
+        return { kind: "instanceOfValue", value: left, classValue, type: BOOL, loc };
+      }
+      // A standalone side: the answer is static (the target slot can
+      // only hold the named class; a standalone operand's runtime class
+      // IS its static class). Folding discards the operands' evaluation,
+      // so only side-effect-free shapes fold — the named-target rule.
+      const value =
+        left.type.className === targetInfo.def.name ||
+        lowerer.isSubclassOf(left.type.className, targetInfo.def.name);
+      if (
+        left.kind === "varRef" &&
+        (ts.isIdentifier(expr.right) || expr.right.kind === ts.SyntaxKind.ThisKeyword)
+      ) {
+        return readsClassAfter(lowerer, targetInfo, expr.right, [], {
+          kind: "boolLit",
+          value,
+          type: BOOL,
+          loc,
+        });
+      }
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        "statically-decided 'instanceof' on computed operands (bind the values to variables first)",
+      );
+    }
+    const constructor = tryLowerExpression(lowerer, expr.right);
+    if (constructor?.type.kind === "dyn" && isJsSourceFile(expr.getSourceFile())) {
+      const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
+      return checkedClassInstanceOf(lowerer, value, constructor, loc);
+    }
+    lowerer.unsupported(
+      "SC1090",
+      expr.right,
+      "'instanceof' right-hand sides other than classes declared in the program",
+    );
+  }
+  // `x instanceof Writable`: Node's Writable[Symbol.hasInstance] also
+  // answers true for streams with a writable side that do not inherit from
+  // Writable, which are Duplex and its subclasses (Transform, PassThrough,
+  // the zlib streams). Subclasses of Writable keep the prototype test.
+  const duplex =
+    target.def.name === "%Writable" && target.builtinStream !== undefined
+      ? lowerer.classes.get("%Duplex")
+      : undefined;
+  // The classes whose interval test can answer true for a value of static
+  // class `className`: Writable and Duplex are disjoint, so a value typed
+  // as one side needs only that side's test.
+  const runtimeTests = (className: string): ClassInfo[] => {
+    if (!duplex) return [target];
+    const mayHold = (info: ClassInfo): boolean =>
+      className === info.def.name ||
+      lowerer.isSubclassOf(className, info.def.name) ||
+      lowerer.isSubclassOf(info.def.name, className);
+    const tests = [target, duplex].filter(mayHold);
+    return tests.length > 0 ? tests : [target];
+  };
+  // A catch binding on the left: the runtime test against the class's
+  // preorder interval (false for non-hierarchy-object payloads). tsc's
+  // narrowing then types the branches; reads bridge through caughtRead.
+  const caughtLocal = lowerer.caughtLocalOf(expr.left);
+  if (caughtLocal) {
+    const caughtInstanceOf = (info: ClassInfo): IrExpr => {
+      if (!lowerer.inHierarchy(info)) {
+        const value = varRef(caughtLocal.id, CAUGHT, loc);
+        return {
+          kind: "ternary",
+          cond: {
+            kind: "caughtTest",
+            value,
+            test: "instanceof",
+            className: info.def.name,
+            type: BOOL,
+            loc,
+          },
+          then: { kind: "boolLit", value: true, type: BOOL, loc },
+          else_: classInstanceOf(
+            lowerer,
+            { kind: "caughtToDyn", value, type: DYN, loc },
+            info,
+            loc,
+          ),
+          type: BOOL,
+          loc,
+        };
+      }
+      return {
+        kind: "caughtTest",
+        value: { kind: "varRef", localId: caughtLocal.id, type: CAUGHT, loc },
+        test: "instanceof",
+        className: info.def.name,
+        type: BOOL,
+        loc,
+      };
+    };
+    const test = caughtInstanceOf(target);
+    return duplex
+      ? { kind: "logical", op: "||", left: test, right: caughtInstanceOf(duplex), type: BOOL, loc }
+      : test;
+  }
+  const left = lowerer.lowerExpr(expr.left);
+  // `u instanceof Error` on an `unknown` value: the checked-dynamic tree's error encoding
+  // (the shape caughtToDyn builds for Error payloads — the reserved
+  // "%error" marker) answers the test, so a caught Error passed through
+  // an unknown slot narrows like Node (`error instanceof Error ?
+  // error.message : String(error)` — the LAN-monitor handler). ROOT
+  // only: the marker cannot honestly answer subclass prototype chains
+  // (name strings are user-writable), so `u instanceof TypeError` keeps
+  // the fence. Reads past the narrow bridge through maybeNarrow's
+  // validated %Error extraction. SEMANTICS.md 67.
+  if (
+    left.type.kind === "dyn" &&
+    !target.def.runtime &&
+    !target.builtinError &&
+    !target.builtinEmitter &&
+    !target.builtinStream &&
+    !target.localClass
+  ) {
+    return classInstanceOf(lowerer, left, target, loc);
+  }
+  if (left.type.kind === "dyn" && target.def.name === "%Error") {
+    return { kind: "dynTest", test: "error", value: left, type: BOOL, loc };
+  }
+  // `u instanceof TypeError` (and the other BUILTIN error classes) on a
+  // dyn value: the from_error cache holds the checked-dynamic tree↔error identity edge,
+  // so the runtime resolves the encoding back to its error and asks the
+  // vtable's stamped interval — exact for every error that crossed the
+  // boundary (a hand-built {%error} literal answers false: subclass
+  // identity is unknowable there). User subclasses keep the fence.
+  if (left.type.kind === "dyn" && RUNTIME_ERROR_CLASSES.has(target.def.name)) {
+    const rec = RUNTIME_ERROR_CLASSES.get(target.def.name)!;
+    return {
+      kind: "libCall",
+      fn: "dyn.errInstanceof",
+      args: [left, { kind: "numLit", value: rec.kind, type: F64, loc }],
+      type: BOOL,
+      loc,
+    };
+  }
+  if (left.type.kind === "dyn") {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      `'instanceof ${target.def.name.replace(/^%/, "")}' on 'unknown' values (only the Error classes answer — test 'instanceof Error' and read '.name')`,
+    );
+  }
+  if (left.type.kind === "union") {
+    const unionId = left.type.unionId;
+    const arms = lowerer.unions.get(unionId)?.arms;
+    // Ordinary records, arrays and scalar values do not carry a class
+    // prototype (no program class extends Array). Dynamic/opaque runtime
+    // objects keep their existing instanceof fences.
+    if (
+      arms?.every(
+        (arm) =>
+          arm.kind === "object" ||
+          arm.kind === "record" ||
+          arm.kind === "array" ||
+          arm.kind === "f64" ||
+          arm.kind === "string" ||
+          arm.kind === "bool" ||
+          arm.kind === "bigint" ||
+          arm.kind === "symbol" ||
+          isUnitType(arm),
+      )
+    ) {
+      const key = `instanceof.union:${unionId}:${target.def.name}`;
+      let helper = lowerer.valueHelpers.get(key);
+      if (!helper) {
+        helper = `%instanceof.union.${lowerer.valueHelpers.size}`;
+        lowerer.valueHelpers.set(key, helper);
+        const value: IrExpr = { kind: "varRef", localId: "value.0", type: left.type, loc };
+        const body: IrStmt[] = [];
+        arms.forEach((arm, tag) => {
+          if (arm.kind !== "object") return;
+          const lhsInfo = lowerer.classes.get(arm.className);
+          if (!lhsInfo)
+            throw new InternalCompilerError(`lowerer bug: unknown class ${arm.className}`);
+          const armTest = (info: ClassInfo): IrExpr =>
+            lowerer.inHierarchy(lhsInfo) && lowerer.inHierarchy(info)
+              ? {
+                  kind: "instanceOf",
+                  value: { kind: "unionNarrow", unionId, tag, value, type: arm, loc },
+                  className: info.def.name,
+                  type: BOOL,
+                  loc,
+                }
+              : {
+                  kind: "boolLit",
+                  value:
+                    arm.className === info.def.name ||
+                    lowerer.isSubclassOf(arm.className, info.def.name),
+                  type: BOOL,
+                  loc,
+                };
+          const result = runtimeTests(arm.className)
+            .map(armTest)
+            .reduce((left: IrExpr, right: IrExpr): IrExpr => ({
+              kind: "logical",
+              op: "||",
+              left,
+              right,
+              type: BOOL,
+              loc,
+            }));
+          body.push({
+            kind: "if",
+            cond: { kind: "unionIsTag", unionId, tag, negated: false, value, type: BOOL, loc },
+            then: [{ kind: "return", value: result, loc }],
+            else_: null,
+            loc,
+          });
+        });
+        body.push({
+          kind: "return",
+          value: { kind: "boolLit", value: false, type: BOOL, loc },
+          loc,
+        });
+        lowerer.liftedFns.push({
+          name: helper,
+          params: [{ localId: "value.0", name: "value", type: left.type }],
+          returnType: BOOL,
+          locals: [{ id: "value.0", name: "value", type: left.type, mutable: false }],
+          body,
+          loc,
+        });
+      }
+      return { kind: "call", callee: helper, args: [left], type: BOOL, loc };
+    }
+    // A class arm could hold an instance: the test cannot be decided
+    // statically.
+    if (arms?.some((arm) => arm.kind === "object"))
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        "'instanceof' on a union of class instances and values without a class prototype test",
+      );
+  }
+  if (left.type.kind !== "object") {
+    return readsClassAfter(lowerer, target, expr.right, [{ kind: "exprStmt", expr: left, loc }], {
+      kind: "boolLit",
+      value: false,
+      type: BOOL,
+      loc,
+    });
+  }
+  const lhsInfo = lowerer.classes.get(left.type.className);
+  if (!lhsInfo)
+    throw new InternalCompilerError(`lowerer bug: unknown class ${left.type.className}`);
+  if (lowerer.inHierarchy(lhsInfo) && lowerer.inHierarchy(target)) {
+    const tests = runtimeTests(left.type.className);
+    if (tests.length === 1) {
+      return { kind: "instanceOf", value: left, className: tests[0]!.def.name, type: BOOL, loc };
+    }
+    const local = lowerer.declareHiddenLocal("%writableTest", left.type);
+    const ref = varRef(local.id, left.type, loc);
+    const test = (className: string): IrExpr => ({
+      kind: "instanceOf",
+      value: ref,
+      className,
+      type: BOOL,
+      loc,
+    });
+    return {
+      kind: "seqExpr",
+      stmts: [{ kind: "varDecl", localId: local.id, init: left, loc }],
+      result: {
+        kind: "logical",
+        op: "||",
+        left: test(tests[0]!.def.name),
+        right: test(tests[1]!.def.name),
+        type: BOOL,
+        loc,
+      },
+      type: BOOL,
+      loc,
+    };
+  }
+  const leftClass = left.type.className;
+  const isInstance = (className: string): boolean =>
+    leftClass === className || lowerer.isSubclassOf(leftClass, className);
+  const value =
+    isInstance(target.def.name) || (duplex !== undefined && isInstance(duplex.def.name));
+  if (left.kind === "varRef") {
+    return readsClassAfter(lowerer, target, expr.right, [], {
+      kind: "boolLit",
+      value,
+      type: BOOL,
+      loc,
+    });
+  }
+  lowerer.unsupported(
+    "SC1090",
+    expr,
+    "statically-decided 'instanceof' on computed operands (bind the value to a variable first)",
+  );
+}
+
+/** `x instanceof K` for a union-typed operand whose arms are class
+ * instances or unit values: each instance arm tests against the class
+ * value (with the Writable rule), unit arms answer false. Null when an arm
+ * is anything else. */
+function unionClassValueInstanceOf(
+  lowerer: Lowerer,
+  left: IrExpr,
+  right: ts.Expression,
+  targetInfo: ClassInfo,
+  loc: SrcLoc,
+): IrExpr | null {
+  if (left.type.kind !== "union") return null;
+  const unionId = left.type.unionId;
+  const arms = lowerer.unions.get(unionId)?.arms;
+  if (
+    !arms?.every((arm) => {
+      if (arm.kind !== "object") return isUnitType(arm);
+      const info = lowerer.classes.get(arm.className);
+      return info !== undefined && lowerer.inHierarchy(info);
+    })
+  )
+    return null;
+  const classValue = lowerer.lowerExpr(right);
+  if (classValue.type.kind !== "classval") lowerer.badType(right, lowerer.typeOf(right));
+  const value = lowerer.declareHiddenLocal("%instanceValue", left.type);
+  const cls = lowerer.declareHiddenLocal("%instanceClass", classValue.type);
+  const valueRef = varRef(value.id, left.type, loc);
+  const clsRef = varRef(cls.id, classValue.type, loc);
+  let result: IrExpr = { kind: "boolLit", value: false, type: BOOL, loc };
+  arms.forEach((arm, tag) => {
+    if (arm.kind !== "object") return;
+    const narrowed: IrExpr = { kind: "unionNarrow", unionId, tag, value: valueRef, type: arm, loc };
+    const lhsInfo = lowerer.classes.get(arm.className)!;
+    const test: IrExpr = writableClassValueTest(
+      lowerer,
+      narrowed,
+      clsRef,
+      targetInfo,
+      lhsInfo,
+      loc,
+    ) ?? { kind: "instanceOfValue", value: narrowed, classValue: clsRef, type: BOOL, loc };
+    result = {
+      kind: "ternary",
+      cond: { kind: "unionIsTag", unionId, tag, negated: false, value: valueRef, type: BOOL, loc },
+      then: test,
+      else_: result,
+      type: BOOL,
+      loc,
+    };
+  });
+  return {
+    kind: "seqExpr",
+    stmts: [
+      { kind: "varDecl", localId: value.id, init: left, loc },
+      { kind: "varDecl", localId: cls.id, init: classValue, loc },
+    ],
+    result,
+    type: BOOL,
+    loc,
+  };
+}
+
+/** `x instanceof K` where K is a class value that may hold Writable (a
+ * `typeof Writable` or `typeof EventEmitter` slot): Node's
+ * Writable[Symbol.hasInstance] also answers true for streams with a
+ * writable side that do not inherit from Writable (Duplex and its
+ * subclasses), so when K is Writable the Duplex interval answers too.
+ * Null when the slot cannot hold Writable or the operand cannot be a
+ * Duplex. */
+function writableClassValueTest(
+  lowerer: Lowerer,
+  left: IrExpr,
+  classValue: IrExpr,
+  targetInfo: ClassInfo,
+  lhsInfo: ClassInfo,
+  loc: SrcLoc,
+): IrExpr | null {
+  const writable = lowerer.classes.get("%Writable");
+  const duplex = lowerer.classes.get("%Duplex");
+  if (!writable || !duplex || classValue.type.kind !== "classval" || left.type.kind !== "object")
+    return null;
+  const slotHoldsWritable =
+    targetInfo === writable || lowerer.isSubclassOf("%Writable", targetInfo.def.name);
+  const operandMayBeDuplex =
+    lhsInfo === duplex ||
+    lowerer.isSubclassOf(lhsInfo.def.name, "%Duplex") ||
+    lowerer.isSubclassOf("%Duplex", lhsInfo.def.name);
+  if (!slotHoldsWritable || !operandMayBeDuplex) return null;
+  lowerer.defineClassValueConstruct(writable);
+  const value = lowerer.declareHiddenLocal("%instanceValue", left.type);
+  const cls = lowerer.declareHiddenLocal("%instanceClass", classValue.type);
+  const valueRef = varRef(value.id, left.type, loc);
+  const clsRef = varRef(cls.id, classValue.type, loc);
+  return {
+    kind: "seqExpr",
+    stmts: [
+      { kind: "varDecl", localId: value.id, init: left, loc },
+      { kind: "varDecl", localId: cls.id, init: classValue, loc },
+    ],
+    result: {
+      kind: "logical",
+      op: "||",
+      left: { kind: "instanceOfValue", value: valueRef, classValue: clsRef, type: BOOL, loc },
+      right: {
+        kind: "logical",
+        op: "&&",
+        left: {
+          kind: "bin",
+          op: "===",
+          left: clsRef,
+          right: {
+            kind: "classRef",
+            className: "%Writable",
+            type: { kind: "classval", className: "%Writable" },
+            loc,
+          },
+          type: BOOL,
+          loc,
+        },
+        right: { kind: "instanceOf", value: valueRef, className: "%Duplex", type: BOOL, loc },
+        type: BOOL,
+        loc,
+      },
+      type: BOOL,
+      loc,
+    },
+    type: BOOL,
+    loc,
+  };
+}
+
+/** A statically decided `instanceof` still reads its class after the left
+ * operand: a class with an initialization flag throws there before its
+ * declaration ran. */
+function readsClassAfter(
+  lowerer: Lowerer,
+  target: ClassInfo,
+  right: ts.Expression,
+  stmts: IrStmt[],
+  result: IrExpr,
+): IrExpr {
+  if (!lowerer.classInitFlags.has(target.def.name)) {
+    if (stmts.length === 0) return result;
+    return { kind: "seqExpr", stmts, result, type: result.type, loc: result.loc };
+  }
+  const read = lowerer.lowerExpr(right);
+  return {
+    kind: "seqExpr",
+    stmts: [...stmts, { kind: "exprStmt", expr: read, loc: locOf(right) }],
+    result,
+    type: result.type,
+    loc: result.loc,
+  };
+}
+
+/** `#name in obj` — the ergonomic brand check. In this closed world a
+ * brand is held by exactly the instances of the declaring class
+ * (subclasses included — construction always runs the declaring class's
+ * own initializers), so the test IS `obj instanceof <declaring class>`:
+ * statically decided when the receiver's class sits at/below the
+ * declarer (true) or in a disjoint subtree (false) — both folds under
+ * the instanceof purity rule — and a runtime interval test when the
+ * declarer sits strictly BELOW the receiver's static class (the
+ * narrowing use; tsc types the true branch at the class, and reads
+ * bridge through maybeNarrow's downcast exactly like instanceof). tsc
+ * confines the spelling to the declaring class's body and rejects
+ * primitive/unknown receivers, so Node's in-operator TypeError is
+ * unreachable in compilable programs. Timing residue: JS installs
+ * brands DURING construction, so a check reachable from a base
+ * constructor can observe false mid-construction where this answers
+ * true (SEMANTICS.md). */
+function lowerPrivateIn(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+  priv: ts.PrivateIdentifier,
+  loc: SrcLoc,
+): IrExpr {
+  const pname = priv.text;
+  // The declaring class: the nearest enclosing class declaring the name
+  // (JS scoping — an inner class's spelling shadows an outer one's).
+  let classDecl: ts.ClassLikeDeclaration | null = null;
+  let staticBrand = false;
+  for (let n: ts.Node | undefined = priv.parent; n; n = n.parent) {
+    if (ts.isClassDeclaration(n) || ts.isClassExpression(n)) {
+      const owner = n.members.nodes.find((m) => {
+        const name = (m as { name?: ts.PropertyName }).name;
+        return name !== undefined && ts.isPrivateIdentifier(name) && name.text === pname;
+      });
+      if (owner) {
+        classDecl = n;
+        staticBrand =
+          ts.canHaveModifiers(owner) &&
+          ts.getModifiers(owner)?.some((m) => m.kind === ts.SyntaxKind.StaticKeyword) === true;
+        break;
+      }
+    }
+  }
+  // tsc rejects the spelling outside a declaring class body; defensive.
+  if (!classDecl)
+    lowerer.unsupported("SC1090", expr, `'${pname} in …' outside a class declaring '${pname}'`);
+  if (staticBrand) {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      `'${pname} in …' brand checks for private STATICS (JS brands the declaring class OBJECT, not instances — compare against the class value directly)`,
+    );
+  }
+  const info =
+    lowerer.currentClass?.decl === classDecl
+      ? lowerer.currentClass
+      : (() => {
+          const sym = classDecl.name
+            ? lowerer.checker.getSymbolAtLocation(classDecl.name)
+            : undefined;
+          return sym ? lowerer.classBySymbol.get(sym) : undefined;
+        })();
+  if (!info) {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      `'${pname} in …' where the declaring class has no lowering (see the class declaration's own diagnostic)`,
+    );
+  }
+  // A GENERIC family: JS has ONE runtime class and ONE brand for every
+  // instantiation, while these layouts mint one class per instantiation
+  // — a cross-instantiation check would answer false where Node says
+  // true, so the family reports SC1090 instead of splitting the brand.
+  if (info.generic || info.genericInstance) {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      `'${pname} in …' inside a generic class (JS shares one brand across every instantiation; these layouts mint one class per instantiation)`,
+    );
+  }
+  const recv = lowerer.lowerExpr(expr.right);
+  const declName = info.def.name;
+  // A UNION of class instances (`o: Counter | Helper` — the
+  // discriminating use): every object arm answers membership STATICALLY
+  // (at/below the declarer → true, disjoint subtree → false), so the
+  // whole test collapses to runtime TAG tests — the record-shape 'in'
+  // discrimination, brand form. An arm ABOVE the declarer answers per
+  // VALUE (its slot can hold branded and unbranded instances), and
+  // non-object arms have no brand story — both fence.
+  if (recv.type.kind === "union") {
+    const unionId = recv.type.unionId;
+    const arms = lowerer.unions.get(unionId)?.arms ?? [];
+    const answers: { tag: number; has: boolean }[] = [];
+    let staticAnswers = arms.length > 0;
+    for (const arm of arms) {
+      const tag = lowerer.armTag(unionId, arm);
+      if (tag < 0 || arm.kind !== "object" || lowerer.isSubclassOf(declName, arm.className)) {
+        staticAnswers = false;
+        break;
+      }
+      answers.push({
+        tag,
+        has: arm.className === declName || lowerer.isSubclassOf(arm.className, declName),
+      });
+    }
+    if (staticAnswers) {
+      const pureRecv =
+        recv.kind === "varRef" || recv.kind === "recordGet" || recv.kind === "fieldGet";
+      const isTag = (tag: number, negated: boolean): IrExpr => ({
+        kind: "unionIsTag",
+        unionId,
+        tag,
+        negated,
+        value: recv,
+        type: BOOL,
+        loc,
+      });
+      const trues = answers.filter((a) => a.has);
+      if (trues.length === answers.length || trues.length === 0) {
+        const ans = trues.length !== 0;
+        if (pureRecv) return { kind: "boolLit", value: ans, type: BOOL, loc };
+        // Constant either way, receiver still evaluates once: one tag
+        // test whose branches agree (the record-'in' rule verbatim).
+        return {
+          kind: "ternary",
+          cond: isTag(answers[0]!.tag, false),
+          then: { kind: "boolLit", value: ans, type: BOOL, loc },
+          else_: { kind: "boolLit", value: ans, type: BOOL, loc },
+          type: BOOL,
+          loc,
+        };
+      }
+      if (trues.length === 1) return isTag(trues[0]!.tag, false);
+      const falses = answers.filter((a) => !a.has);
+      if (falses.length === 1) return isTag(falses[0]!.tag, true);
+      if (pureRecv) {
+        let out: IrExpr = isTag(trues[0]!.tag, false);
+        for (const t of trues.slice(1)) {
+          out = {
+            kind: "logical",
+            op: "||",
+            left: out,
+            right: isTag(t.tag, false),
+            type: BOOL,
+            loc,
+          };
+        }
+        return out;
+      }
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        `statically-decided '${pname} in …' on computed receivers (bind the value to a variable first)`,
+      );
+    }
+  }
+  // A checked value in JavaScript (`#x in this` inside a method, whose
+  // receiver is the actual call-site value): the brand is present exactly
+  // when the value is a class instance at or below the declarer. A typed
+  // reference carries the class it was boxed under: the declarer or a
+  // descendant answers true; an ancestor answers per instance.
+  if (recv.type.kind === "dyn" && recv.kind === "varRef" && isJsSourceFile(expr.getSourceFile())) {
+    // A function-local class has one brand per evaluation.
+    if (info.localClass) {
+      const owner = localPrivateBrandClass(lowerer, priv);
+      if (!owner) {
+        lowerer.unsupported(
+          "SC1090",
+          expr,
+          `'${pname} in …' inside a function-local class that is not a named declaration`,
+        );
+      }
+      return checkedPrivateIn(lowerer, owner.info, owner.decl, pname, recv, loc);
+    }
+    const typedRefIs = (className: string): IrExpr => ({
+      kind: "libCall",
+      fn: "dyn.typedRefIs",
+      args: [
+        recv,
+        { kind: "strLit", value: typeKey({ kind: "object", className }), type: STRING, loc },
+      ],
+      type: BOOL,
+      loc,
+    });
+    const or = (left: IrExpr | null, right: IrExpr): IrExpr =>
+      left === null ? right : { kind: "logical", op: "||", left, right, type: BOOL, loc };
+    let test: IrExpr | null = null;
+    const below = (c: ClassInfo): void => {
+      test = or(test, typedRefIs(c.def.name));
+      for (const sub of c.subclasses) below(sub);
+    };
+    below(info);
+    for (let base = info.base; base; base = base.base) {
+      const baseType: IrType = { kind: "object", className: base.def.name };
+      test = or(test, {
+        kind: "logical",
+        op: "&&",
+        left: typedRefIs(base.def.name),
+        right: {
+          kind: "instanceOf",
+          value: { kind: "dynCheck", value: recv, type: baseType, loc },
+          className: declName,
+          type: BOOL,
+          loc,
+        },
+        type: BOOL,
+        loc,
+      });
+    }
+    // Only objects carry private names: a primitive operand throws Node's
+    // TypeError.
+    return {
+      kind: "ternary",
+      cond: primitiveOperand(recv, loc),
+      then: {
+        kind: "libCall",
+        fn: "error.nodeThrow",
+        args: [numLit(1, loc), strLit("", loc), privateInMessage(pname, recv, loc)],
+        type: BOOL,
+        loc,
+      },
+      else_: test!,
+      type: BOOL,
+      loc,
+    };
+  }
+  if (recv.type.kind !== "object") {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      `'${pname} in …' on '${lowerer.fmt(recv.type)}' receivers (only class-instance receivers — and unions of classes below or beside the declarer — have a static brand answer; narrow first)`,
+    );
+  }
+  const lhsName = recv.type.className;
+  const lhsInfo = lowerer.classes.get(lhsName);
+  if (!lhsInfo) throw new InternalCompilerError(`lowerer bug: unknown class ${lhsName}`);
+  if (lowerer.isSubclassOf(declName, lhsName)) {
+    // The narrowing direction: the declarer strictly below the
+    // receiver's static class — a strict subclass relation puts both in
+    // a hierarchy, so the vtable interval test always exists.
+    return { kind: "instanceOf", value: recv, className: declName, type: BOOL, loc };
+  }
+  const value = lhsName === declName || lowerer.isSubclassOf(lhsName, declName);
+  if (recv.kind === "varRef") return { kind: "boolLit", value, type: BOOL, loc };
+  lowerer.unsupported(
+    "SC1090",
+    expr,
+    `statically-decided '${pname} in …' on computed operands (bind the value to a variable first)`,
+  );
+}
+
+/** The string keys every record inherits from Object.prototype. */
+const OBJECT_PROTOTYPE_KEYS: ReadonlySet<string> = new Set([
+  "constructor",
+  "__defineGetter__",
+  "__defineSetter__",
+  "hasOwnProperty",
+  "__lookupGetter__",
+  "__lookupSetter__",
+  "isPrototypeOf",
+  "propertyIsEnumerable",
+  "toString",
+  "valueOf",
+  "__proto__",
+  "toLocaleString",
+]);
+
+/** `"key" in v` — the key-presence test. Three lowered receivers:
+ * process.env (getenv(3) presence — Node-exact, an empty value still
+ * counts as present), and monomorphic record shapes, where the answer is
+ * type-directed: a declared non-optional field is a compile-time `true`,
+ * a missing field (no index signature) a compile-time `false` unless
+ * Object.prototype has it — both
+ * folds limited to side-effect-free receivers, the lowerInstanceOf rule —
+ * and an OPTIONAL field (undefined-armed union) is a runtime presence
+ * test on the slot: an omitted or deleted property is absent, while a
+ * property explicitly holding `undefined` is present, as in JS
+ * (`"a" in {a: undefined}` is true). Union receivers (the `in`-narrowing
+ * idiom over multiple shapes), index-signature keys, class instances,
+ * and dyn/unknown stay fenced. Keys are literal strings — a computed key
+ * over a shape would need the runtime key table. */
+export function lowerInExpression(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+  loc: SrcLoc,
+): IrExpr {
+  if (
+    lowerer.isStdlibGlobal(expr.right, "process") &&
+    lowerer.foldedStringKeyOf(expr.left) === "hrtime"
+  ) {
+    return { kind: "boolLit", value: true, type: BOOL, loc };
+  }
+  const globalKey = globalSymbolKey(lowerer, expr.right, expr.left);
+  if (globalKey)
+    return { kind: "libCall", fn: "dyn.globalSymbolHas", args: [globalKey], type: BOOL, loc };
+  // `#name in obj` — the ergonomic brand check (ES2022) — resolves
+  // before any string-key machinery: the left operand is a private
+  // NAME, not a value.
+  if (ts.isPrivateIdentifier(expr.left)) {
+    return lowerPrivateIn(lowerer, expr, expr.left, loc);
+  }
+  // Compile-time-known STRING keys fold — literals, and the same
+  // const/enum-literal and template folding computed property keys get
+  // (foldedStringKeyOf); runtime-valued keys keep the fence.
+  // NUMERIC literal keys answer on ARRAY receivers through the shared
+  // presence query. Arrays retain holes independently from length, and
+  // noncanonical numeric keys live in their ordinary-property table, so
+  // a length comparison is not an honest `in` answer.
+  {
+    let kNode = expr.left;
+    while (ts.isParenthesizedExpression(kNode)) kNode = kNode.expression;
+    if (
+      ts.isNumericLiteral(kNode) &&
+      lowerer.mapTypeOf(lowerer.typeOf(expr.right))?.kind === "array"
+    ) {
+      const recvArr = lowerer.lowerExpr(expr.right);
+      if (recvArr.type.kind === "array") {
+        const n = Number(kNode.text);
+        return {
+          kind: "arrayHas",
+          arr: recvArr,
+          index: { kind: "numLit", value: n, type: F64, loc },
+          type: BOOL,
+          loc,
+        };
+      }
+    }
+  }
+  // A RUNTIME numeric key over an ARRAY receiver (`if (i in arr)` in a
+  // loop) asks the same slot/property presence query as the literal fold
+  // above and `Object.hasOwn`. The checked-dynamic fallback below would
+  // box the receiver and materialize every element on each evaluation,
+  // which makes such loops quadratic. A Number key never names an
+  // inherited property: neither Array.prototype nor Object.prototype has
+  // index-like or numeric-string keys. JS evaluates the key before the
+  // receiver, so the key is stabilized in a hidden local first.
+  if (
+    lowerer.mapTypeOf(lowerer.typeOf(expr.left))?.kind === "f64" &&
+    lowerer.mapTypeOf(lowerer.typeOf(expr.right))?.kind === "array"
+  ) {
+    const k = lowerer.lowerExpr(expr.left);
+    const recvArr = lowerer.lowerExpr(expr.right);
+    if (k.type.kind === "f64" && recvArr.type.kind === "array") {
+      const keyLocal = lowerer.declareHiddenLocal("%inIndex", F64);
+      return {
+        kind: "seqExpr",
+        stmts: [{ kind: "varDecl", localId: keyLocal.id, init: k, loc }],
+        result: {
+          kind: "arrayHas",
+          arr: recvArr,
+          index: varRef(keyLocal.id, F64, loc),
+          type: BOOL,
+          loc,
+        },
+        type: BOOL,
+        loc,
+      };
+    }
+  }
+  const key = foldedStringKeyOf(lowerer, expr.left);
+  if (key === null) {
+    // A RUNTIME string key over an INDEX-SIGNATURE record receiver (the
+    // `names.filter((k) => k in config)` idiom): the interned key-
+    // presence helper — declared fields answer statically per name
+    // (optional slots by their runtime presence), then the overflow
+    // map's live keys. Other receivers keep the
+    // fence: fixed shapes want the literal folds above, and there is no
+    // runtime key table to ask.
+    const rIn = lowerRuntimeKeyIn(lowerer, expr, loc);
+    if (rIn) return rIn;
+    // A runtime key over a CHECKED-DYNAMIC receiver (`name in
+    // agent.sockets` — both sides computed; the checker may type the
+    // receiver as a Dict while the VALUE lives in the checked-dynamic tree, so the
+    // LOWERED type decides): the dyn presence answer, with the key
+    // stringified like every property key (o[k] is o[String(k)] in JS;
+    // `in` shares the coercion).
+    {
+      const probed = tryLowerExpression(lowerer, expr.right);
+      if (probed && lowerer.dynConvertible(probed.type)) {
+        const k = lowerer.lowerExpr(expr.left); // JS order: the key evaluates first
+        if (lowerer.dynConvertible(k.type)) {
+          const boxed = lowerer.coerceToExpected(k, DYN);
+          const keyLocal = lowerer.declareHiddenLocal("%inKey", DYN);
+          return {
+            kind: "seqExpr",
+            stmts: [{ kind: "varDecl", localId: keyLocal.id, init: boxed, loc }],
+            result: {
+              kind: "libCall",
+              fn: "dyn.hasKeyComputed",
+              args: [
+                lowerer.coerceToExpected(lowerer.lowerExpr(expr.right), DYN),
+                varRef(keyLocal.id, DYN, loc),
+              ],
+              type: BOOL,
+              loc,
+            },
+            type: BOOL,
+            loc,
+          };
+        }
+      }
+    }
+    lowerer.unsupported(
+      "SC1090",
+      expr.left,
+      "'in' with computed (non-literal) keys (a const whose type is one string literal folds; a string-typed key answers over index-signature record receivers)",
+    );
+  }
+  // A receiver re-read (the static folds below) is safe for plain reads
+  // AND for side-effect-free expressions (an object literal of literals
+  // — the `"a" in { a: true }` shape).
+  const pureRecvNode = sideEffectFreeOptionValue(expr.right);
+  if (lowerer.isProcessEnv(expr.right)) {
+    // `"NO_COLOR" in process.env`: presence via the one envGet intrinsic —
+    // getenv(3) returning non-NULL is Node's `in` on process.env exactly.
+    const envType = lowerer.envValueType();
+    if (envType.kind !== "union")
+      throw new InternalCompilerError("lowerer bug: env value type is not a union");
+    const undefTag = lowerer.armTag(envType.unionId, UNDEFINED_T);
+    const read: IrExpr = {
+      kind: "libCall",
+      fn: "process.envGet",
+      args: [{ kind: "strLit", value: key, type: STRING, loc }],
+      type: envType,
+      loc,
+    };
+    return {
+      kind: "unionIsTag",
+      unionId: envType.unionId,
+      tag: undefTag,
+      negated: true,
+      value: read,
+      type: BOOL,
+      loc,
+    };
+  }
+  if (key === "code" && isExecExceptionType(lowerer, lowerer.typeOf(expr.right))) {
+    refuseExecExceptionCode(lowerer, expr);
+  }
+  let recv = lowerer.lowerExpr(expr.right);
+  const classInfo =
+    recv.type.kind === "classval" ? lowerer.classes.get(recv.type.className) : undefined;
+  if (
+    (classInfo && (classInfo.callableBase || hasRuntimeStatics(classInfo))) ||
+    (isJsSourceFile(expr.getSourceFile()) &&
+      recv.type.kind === "func" &&
+      lowerer.dynConvertible(recv.type))
+  ) {
+    recv = lowerer.coerceToExpected(recv, DYN);
+  }
+  const siteType = lowerer.mapTypeOf(lowerer.typeOf(expr.right));
+  if (
+    recv.type.kind === "union" &&
+    siteType?.kind === "union" &&
+    !typeEquals(recv.type, siteType)
+  ) {
+    const helper = lowerer.narrowedRetagHelper(
+      expr.right,
+      recv.type.unionId,
+      siteType.unionId,
+      loc,
+    );
+    if (helper) recv = { kind: "call", callee: helper, args: [recv], type: siteType, loc };
+  }
+  // Error-rooted receivers (builtin or user subclass — the isErrnoException
+  // predicate's `err instanceof Error && "code" in err` shape): `code`
+  // answers from the runtime error's code slot (stamped by fs/system/
+  // event/spawn errors, absent on plain constructions — exactly Node's
+  // own-property answer), and the always-declared members fold true.
+  // Everything else fences: the runtime object carries no other dynamic
+  // properties to ask (`stack` would be a lie — Node has one, we don't).
+  if (recv.type.kind === "object") {
+    // %DOMException first: `'cause' in e` answers the options form's
+    // own-property record (the runtime slot), and code/name/message are
+    // always present.
+    if (recv.type.className === "%DOMException") {
+      if (key === "cause") {
+        return { kind: "libCall", fn: "error.domHasCause", args: [recv], type: BOOL, loc };
+      }
+      if (
+        (key === "code" || key === "message" || key === "name") &&
+        (recv.kind === "varRef" || recv.kind === "caughtNarrow")
+      ) {
+        return { kind: "boolLit", value: true, type: BOOL, loc };
+      }
+    }
+    let info = lowerer.classes.get(recv.type.className) ?? null;
+    while (info && info.base) info = info.base;
+    if (info?.def.name === "%Error") {
+      if (key === "cause") {
+        return { kind: "libCall", fn: "error.hasCause", args: [recv], type: BOOL, loc };
+      }
+      if (key === "code") {
+        const codeType = lowerer.envValueType();
+        if (codeType.kind !== "union")
+          throw new InternalCompilerError("lowerer bug: error code type is not a union");
+        const undefTag = lowerer.armTag(codeType.unionId, UNDEFINED_T);
+        const read: IrExpr = {
+          kind: "libCall",
+          fn: "error.code",
+          args: [recv],
+          type: codeType,
+          loc,
+        };
+        return {
+          kind: "unionIsTag",
+          unionId: codeType.unionId,
+          tag: undefTag,
+          negated: true,
+          value: read,
+          type: BOOL,
+          loc,
+        };
+      }
+      if (
+        (key === "message" || key === "name") &&
+        (recv.kind === "varRef" || recv.kind === "caughtNarrow")
+      ) {
+        return { kind: "boolLit", value: true, type: BOOL, loc };
+      }
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        `'in' with the key '${key}' on Error receivers (code answers from the error's code slot; message and name are always present)`,
+      );
+    }
+  }
+  // A dyn receiver (`"portless" in pkg` after the `typeof pkg ===
+  // "object"` guard): own-member presence on the checked-dynamic tree — tsc admits `in`
+  // only on object-typed operands, so unit receivers are unreachable.
+  if (recv.type.kind === "dyn") {
+    return { kind: "dynHasKey", key, value: recv, type: BOOL, loc };
+  }
+  // `"k" in u` over a UNION whose arms are FIXED record shapes: every
+  // arm answers membership STATICALLY (a declared non-optional field is
+  // always present, an undeclared name never is), so the whole test
+  // collapses to runtime TAG tests — tsc's own narrowing then types the
+  // branches (the discriminating-`in` idiom). Optional (undefined-armed)
+  // fields and tuple/index-signature arms answer per VALUE, not per arm
+  // — those unions keep the fence below.
+  if (recv.type.kind === "union") {
+    const unionId = recv.type.unionId;
+    const arms = lowerer.unions.get(unionId)?.arms ?? [];
+    const answers: { tag: number; has: boolean }[] = [];
+    let staticAnswers = arms.length > 0;
+    for (const arm of arms) {
+      const tag = lowerer.armTag(unionId, arm);
+      const shape = arm.kind === "record" ? lowerer.shapes.get(arm.shapeId) : undefined;
+      if (tag < 0 || !shape || shape.tuple || shape.indexValue) {
+        staticAnswers = false;
+        break;
+      }
+      const f = shape.fields.find((x) => x.name === key);
+      const inherited = OBJECT_PROTOTYPE_KEYS.has(key);
+      if (
+        f &&
+        !inherited &&
+        f.type.kind === "union" &&
+        lowerer.armTag(f.type.unionId, UNDEFINED_T) >= 0
+      ) {
+        staticAnswers = false; // an optional slot: presence is per-value
+        break;
+      }
+      // Accessor properties are own properties to `in` (Node answers
+      // true without invoking the getter) — either slot present makes
+      // the name a member.
+      const acc = shape.fields.some((x) => x.name === `%get:${key}` || x.name === `%set:${key}`);
+      answers.push({ tag, has: f !== undefined || acc || inherited });
+    }
+    if (staticAnswers) {
+      const pureRecv =
+        recv.kind === "varRef" ||
+        recv.kind === "recordGet" ||
+        recv.kind === "fieldGet" ||
+        pureRecvNode;
+      const isTag = (tag: number, negated: boolean): IrExpr => ({
+        kind: "unionIsTag",
+        unionId,
+        tag,
+        negated,
+        value: recv,
+        type: BOOL,
+        loc,
+      });
+      const trues = answers.filter((a) => a.has);
+      if (trues.length === answers.length || trues.length === 0) {
+        // Constant either way — but JS still EVALUATES the operand (it
+        // may throw: an ambient-const read is a ReferenceError). Pure
+        // reads fold; anything else rides one tag test whose branches
+        // agree, evaluating the receiver exactly once.
+        const ans = trues.length !== 0;
+        if (pureRecv) return { kind: "boolLit", value: ans, type: BOOL, loc };
+        return {
+          kind: "ternary",
+          cond: isTag(answers[0]!.tag, false),
+          then: { kind: "boolLit", value: ans, type: BOOL, loc },
+          else_: { kind: "boolLit", value: ans, type: BOOL, loc },
+          type: BOOL,
+          loc,
+        };
+      }
+      // One deciding arm (either polarity): a single tag test, receiver
+      // evaluated once — no purity requirement.
+      if (trues.length === 1) return isTag(trues[0]!.tag, false);
+      const falses = answers.filter((a) => !a.has);
+      if (falses.length === 1) return isTag(falses[0]!.tag, true);
+      // Several arms on each side: the OR chain re-reads the receiver,
+      // so only side-effect-free reads qualify.
+      if (pureRecv) {
+        let out: IrExpr = isTag(trues[0]!.tag, false);
+        for (const t of trues.slice(1)) {
+          out = {
+            kind: "logical",
+            op: "||",
+            left: out,
+            right: isTag(t.tag, false),
+            type: BOOL,
+            loc,
+          };
+        }
+        return out;
+      }
+      lowerer.unsupported(
+        "SC1090",
+        expr,
+        "statically-decided 'in' on computed receivers (bind the value to a variable first)",
+      );
+    }
+  }
+  if (recv.type.kind !== "record") {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      `'in' on '${lowerer.fmt(recv.type)}' receivers (only process.env, Error instances, record-typed values, and unions of fixed record shapes answer; ${NARROW_FIRST})`,
+    );
+  }
+  const shape = lowerer.shapes.get(recv.type.shapeId);
+  if (!shape) throw new InternalCompilerError(`lowerer bug: unknown shape ${recv.type.shapeId}`);
+  const field = shape.fields.find((f) => f.name === key);
+  if (field) {
+    if (
+      !OBJECT_PROTOTYPE_KEYS.has(key) &&
+      field.type.kind === "union" &&
+      lowerer.armTag(field.type.unionId, UNDEFINED_T) >= 0
+    ) {
+      // Optional slot: the key is present unless the field is absent
+      // (omitted or deleted); an explicit undefined is present.
+      return lowerer.recordFieldPresent(recv, recv.type.shapeId, key, loc);
+    }
+    // A declared non-optional field always exists on every value of the
+    // shape — statically true, but folding may only drop a
+    // side-effect-free receiver read.
+    if (
+      recv.kind === "varRef" ||
+      recv.kind === "recordGet" ||
+      recv.kind === "fieldGet" ||
+      pureRecvNode
+    ) {
+      return { kind: "boolLit", value: true, type: BOOL, loc };
+    }
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      "statically-decided 'in' on computed receivers (bind the value to a variable first)",
+    );
+  }
+  // Accessor properties answer `in` as own members (Node: true, getter
+  // NOT invoked) — statically true under the same purity discipline as
+  // declared non-optional fields.
+  if (shape.fields.some((f) => f.name === `%get:${key}` || f.name === `%set:${key}`)) {
+    if (
+      recv.kind === "varRef" ||
+      recv.kind === "recordGet" ||
+      recv.kind === "fieldGet" ||
+      pureRecvNode
+    ) {
+      return { kind: "boolLit", value: true, type: BOOL, loc };
+    }
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      "statically-decided 'in' on computed receivers (bind the value to a variable first)",
+    );
+  }
+  // Records are ordinary objects: Object.prototype's members are in them.
+  const inherited = OBJECT_PROTOTYPE_KEYS.has(key);
+  if (shape.indexValue && !inherited) {
+    lowerer.unsupported(
+      "SC1090",
+      expr,
+      "'in' over index-signature keys (read the key and test '!== undefined' instead)",
+    );
+  }
+  if (
+    recv.kind === "varRef" ||
+    recv.kind === "recordGet" ||
+    recv.kind === "fieldGet" ||
+    pureRecvNode
+  ) {
+    // A null-prototype record (Object.groupBy) has no inherited names.
+    const nullProtoT = inherited ? nullProtoRecordShape(lowerer, recv.type) : null;
+    if (nullProtoT) {
+      return {
+        kind: "unary",
+        op: "!",
+        operand: recordNullProtoTest(recv, nullProtoT.shapeId, loc),
+        type: BOOL,
+        loc,
+      };
+    }
+    return { kind: "boolLit", value: inherited, type: BOOL, loc };
+  }
+  lowerer.unsupported(
+    "SC1090",
+    expr,
+    "statically-decided 'in' on computed receivers (bind the value to a variable first)",
+  );
+}
+
+/** The runtime-key `in` (see lowerInExpression): `k in r` where k is a
+ * runtime string and r an index-signature record — an interned
+ * `%rec.haskey.<n>(k, r)` walks the declared names (a string-equality
+ * chain: non-optional fields and accessor slots answer true, optional
+ * slots answer their per-value tag test) and then probes the overflow
+ * map's hashed key set. Null when the pair is outside that shape (the
+ * caller keeps its fence). */
+function lowerRuntimeKeyIn(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+  loc: SrcLoc,
+): IrExpr | null {
+  if (lowerer.mapTypeOf(lowerer.typeOf(expr.left))?.kind !== "string") return null;
+  const recvT = lowerer.mapTypeOf(lowerer.typeOf(expr.right));
+  if (recvT?.kind !== "record") return null;
+  const shape = lowerer.shapes.get(recvT.shapeId);
+  if (!shape?.indexValue || shape.tuple) return null;
+  const keyIr = lowerer.lowerExprExpecting(expr.left, STRING);
+  const recv = lowerer.lowerExprExpecting(expr.right, recvT);
+  const hkey = `haskey:${recvT.shapeId}`;
+  let helper = lowerer.valueHelpers.get(hkey);
+  if (!helper) {
+    helper = `%rec.haskey.${lowerer.valueHelpers.size}`;
+    lowerer.valueHelpers.set(hkey, helper);
+    const recT: IrType = { kind: "record", shapeId: recvT.shapeId };
+
+    const k = varRef("k.0", STRING, loc);
+    const r = varRef("r.0", recT, loc);
+    const body: IrStmt[] = [];
+    const ret = (value: IrExpr): IrStmt => ({ kind: "return", value, loc });
+    for (const f of shape.fields) {
+      const accessor = f.name.startsWith("%get:") || f.name.startsWith("%set:");
+      if (f.name.startsWith("%") && !accessor) continue;
+      const name = accessor ? f.name.slice(5) : f.name;
+      const eq: IrExpr = {
+        kind: "strEq",
+        negated: false,
+        left: k,
+        right: { kind: "strLit", value: name, type: STRING, loc },
+        type: BOOL,
+        loc,
+      };
+      const answer: IrExpr = accessor
+        ? { kind: "boolLit", value: true, type: BOOL, loc }
+        : lowerer.recordFieldPresent(r, recvT.shapeId, f.name, loc);
+      body.push({ kind: "if", cond: eq, then: [ret(answer)], else_: null, loc });
+    }
+    // Overflow keys answer through the map's hashed presence probe (a
+    // stored undefined value is still present), not a scan over a fresh
+    // key snapshot, which made `k in dict` loops quadratic.
+    const ovfHas: IrExpr = {
+      kind: "recordOvfHas",
+      obj: r,
+      shapeId: recvT.shapeId,
+      key: k,
+      type: BOOL,
+      loc,
+    };
+    // A miss in the record's own keys still finds Object.prototype's,
+    // unless the record has a null prototype (Object.groupBy).
+    let protoName: IrExpr | null = null;
+    for (const name of OBJECT_PROTOTYPE_KEYS) {
+      if (shape.fields.some((f) => f.name === name)) continue;
+      const eq: IrExpr = {
+        kind: "strEq",
+        negated: false,
+        left: k,
+        right: { kind: "strLit", value: name, type: STRING, loc },
+        type: BOOL,
+        loc,
+      };
+      protoName =
+        protoName === null
+          ? eq
+          : { kind: "logical", op: "||", left: protoName, right: eq, type: BOOL, loc };
+    }
+    if (protoName !== null && nullProtoRecordShape(lowerer, recT)) {
+      protoName = {
+        kind: "logical",
+        op: "&&",
+        left: protoName,
+        right: {
+          kind: "unary",
+          op: "!",
+          operand: recordNullProtoTest(r, recvT.shapeId, loc),
+          type: BOOL,
+          loc,
+        },
+        type: BOOL,
+        loc,
+      };
+    }
+    body.push(
+      ret(
+        protoName === null
+          ? ovfHas
+          : { kind: "logical", op: "||", left: ovfHas, right: protoName, type: BOOL, loc },
+      ),
+    );
+    lowerer.liftedFns.push({
+      name: helper,
+      params: [
+        { localId: "k.0", name: "k", type: STRING },
+        { localId: "r.0", name: "r", type: recT },
+      ],
+      returnType: BOOL,
+      locals: [
+        { id: "k.0", name: "k", type: STRING, mutable: true },
+        { id: "r.0", name: "r", type: recT, mutable: true },
+      ],
+      body,
+      loc,
+    });
+  }
+  return { kind: "call", callee: helper, args: [keyIr, recv], type: BOOL, loc };
+}
diff --git a/packages/compiler/src/frontend/lowering/expressions/typeof.ts b/packages/compiler/src/frontend/lowering/expressions/typeof.ts
new file mode 100644
index 000000000..30d24e22a
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/expressions/typeof.ts
@@ -0,0 +1,528 @@
+/* typeof expressions and the typeof tests they lower to. */
+import * as ts from "../../ts7/adapter.js";
+import type { Lowerer } from "../lowerer.js";
+import {
+  BOOL,
+  CAUGHT,
+  DYN,
+  type IrExpr,
+  type IrStmt,
+  STRING,
+  type SrcLoc,
+  UNDEFINED_T,
+} from "../../../ir/ir.js";
+import { lowerWebAssemblyTypeof } from "../builtins/webassembly.js";
+import { isNavigatorGlobal } from "../builtins/navigator.js";
+import { lowerPerfHooksTypeof } from "../builtins/performance.js";
+import { isNodeModuleValue } from "../lower-node-module.js";
+import { builtinClassRefOf } from "../builtins/class-values.js";
+import { STRING_INDEX_METHODS, builtinModuleConstOf, stdlibGlobalNameOf } from "../surfaces.js";
+import {
+  constructorGlobalTypeof,
+  deferredSlotOr,
+  errorRootedObjectOf,
+  lowerPromiseThenPresence,
+  operandPairs,
+  runtimeOptionalStorageOperand,
+  typeofAnswer,
+} from "../lower-exprs.js";
+import { tryLowerExpression } from "./try-lower-expression.js";
+import { isJsSourceFile } from "../../program.js";
+import { isSafeToDiscard, isSafeToRepeat } from "./evaluation-safety.js";
+import { varRef } from "../../../ir/build.js";
+import { isExecExceptionType, refuseExecExceptionCode } from "../builtins/errors.js";
+import { InternalCompilerError } from "../../../errors.js";
+
+export function lowerTypeofExpr(lowerer: Lowerer, expr: ts.TypeOfExpression, loc: SrcLoc): IrExpr {
+  const webAssembly = lowerWebAssemblyTypeof(lowerer, expr.expression);
+  if (webAssembly) return webAssembly;
+  if (lowerer.isStdlibGlobal(expr.expression, "process"))
+    return { kind: "strLit", value: "object", type: STRING, loc };
+  if (lowerer.isStdlibGlobal(expr.expression, "fetch"))
+    return { kind: "strLit", value: "function", type: STRING, loc };
+  if (isNavigatorGlobal(lowerer, expr.expression))
+    return { kind: "strLit", value: "object", type: STRING, loc };
+  const performance = lowerPerfHooksTypeof(lowerer, expr.expression);
+  if (performance) return performance;
+  if (isNodeModuleValue(lowerer, expr.expression)) {
+    return { kind: "strLit", value: "object", type: STRING, loc };
+  }
+  // `typeof EventEmitter`, `typeof zlib.Gzip`, `typeof C` over a
+  // builtin class alias.
+  if (builtinClassRefOf(lowerer, expr.expression) !== null) {
+    return { kind: "strLit", value: "function", type: STRING, loc };
+  }
+  if (ts.isPropertyAccessExpression(expr.expression)) {
+    const member = expr.expression;
+    const prototype = member.expression;
+    if (
+      STRING_INDEX_METHODS.has(member.name.text) &&
+      ts.isPropertyAccessExpression(prototype) &&
+      prototype.name.text === "prototype" &&
+      ts.isIdentifier(prototype.expression) &&
+      lowerer.isStdlibGlobal(prototype.expression, "String") &&
+      lowerer.isStdlibMember(member)
+    ) {
+      return { kind: "strLit", value: "function", type: STRING, loc };
+    }
+    if (
+      member.name.text === "at" &&
+      ts.isPropertyAccessExpression(prototype) &&
+      prototype.name.text === "prototype" &&
+      ts.isIdentifier(prototype.expression) &&
+      lowerer.isStdlibGlobal(prototype.expression, "Array") &&
+      lowerer.isStdlibMember(member)
+    ) {
+      return { kind: "strLit", value: "function", type: STRING, loc };
+    }
+    const presence = lowerPromiseThenPresence(lowerer, expr.expression, {
+      kind: "strLit",
+      value: "function",
+      type: STRING,
+      loc,
+    });
+    if (presence !== null) return presence;
+  }
+  // `typeof queueMicrotask` / `typeof DOMException` on a STDLIB global
+  // whose declared type is callable or constructable: folds to
+  // "function" BEFORE the operand lowers — the identity-token story
+  // (JS files) deliberately represents these values as strings, and
+  // the TS-file fence would name a value the program never needs; an
+  // identifier read has no side effects to preserve. Node's answer for
+  // every function and constructor global is "function" (the harness's
+  // `typeof queueMicrotask === 'function'` probes). Shadowing locals
+  // have non-stdlib symbols and keep the ordinary path.
+  let tested = expr.expression;
+  while (ts.isParenthesizedExpression(tested)) tested = tested.expression;
+  // `typeof zlib.Inflate` / `typeof zlib.createGzip`: an export of a
+  // Node builtin module read through a plain binding (an import or
+  // require result). The read has no side effects, and Node's answer for
+  // every exported function and class is "function".
+  if (
+    ts.isPropertyAccessExpression(tested) &&
+    ts.isIdentifier(tested.expression) &&
+    lowerer.isStdlibMember(tested)
+  ) {
+    const sym = lowerer.checker.getSymbolAtLocation(tested.name);
+    const decls = sym ? sym.declarations : [];
+    if (
+      decls.some(isBuiltinModuleValueDecl) &&
+      decls.every((decl) => builtinModuleExportParent(decl) !== undefined)
+    ) {
+      const t = lowerer.typeOf(tested);
+      if (
+        lowerer.checker.getCallSignatures(t).length > 0 ||
+        lowerer.checker.getConstructSignatures(t).length > 0
+      ) {
+        return { kind: "strLit", value: "function", type: STRING, loc };
+      }
+    }
+  }
+  // `typeof globalThis.AbortSignal` / `typeof Headers`: Node 24's Web
+  // platform constructor globals are functions. JavaScript sources
+  // represent such a value as an identity token, and the fallback
+  // declarations type some (AbortSignal) without a construct signature,
+  // so neither the operand nor the type can answer; the read has no
+  // effects.
+  if (constructorGlobalTypeof(lowerer, tested) !== null)
+    return { kind: "strLit", value: "function", type: STRING, loc };
+  // `typeof globalThis.AbortSignal.any` (ky's feature probe): a static
+  // member of a standard-library global, declared callable, whose value
+  // has no representation. The read has no effects and Node's answer
+  // for every such function is "function"; members that lower as values
+  // keep their own answer.
+  if (ts.isPropertyAccessExpression(tested) && !tested.questionDotToken) {
+    const owner = stdlibGlobalNameOf(lowerer, tested.expression);
+    if (owner !== null && lowerer.isStdlibMember(tested)) {
+      const t = lowerer.typeOf(tested);
+      if (
+        (lowerer.checker.getCallSignatures(t).length > 0 ||
+          lowerer.checker.getConstructSignatures(t).length > 0) &&
+        tryLowerExpression(lowerer, tested) === null
+      )
+        return { kind: "strLit", value: "function", type: STRING, loc };
+    }
+  }
+  if (ts.isIdentifier(tested)) {
+    const sym = lowerer.checker.getSymbolAtLocation(tested);
+    if (!sym) {
+      return { kind: "strLit", value: "undefined", type: STRING, loc };
+    }
+    // `const { inspect } = require("util")` / `import { inspect } from
+    // "node:util"`: a binding of a builtin module's exported function,
+    // class or object. JavaScript sources represent such a value without
+    // its own lowering as an identity token (a string), so the operand's
+    // representation cannot answer. Node's answer follows the export's
+    // kind, and the binding read has no effects.
+    const imported = isJsSourceFile(tested.getSourceFile())
+      ? lowerer.builtinImportOf(tested)
+      : null;
+    if (imported && builtinModuleConstOf(lowerer, imported.module, imported.member) === undefined) {
+      const t = lowerer.typeOf(tested);
+      if (
+        lowerer.checker.getCallSignatures(t).length > 0 ||
+        lowerer.checker.getConstructSignatures(t).length > 0
+      ) {
+        return { kind: "strLit", value: "function", type: STRING, loc };
+      }
+      if ((t.flags & ts.TypeFlags.Object) !== 0) {
+        return { kind: "strLit", value: "object", type: STRING, loc };
+      }
+    }
+    if (lowerer.isStdlibSymbol(sym)) {
+      const t = lowerer.typeOf(expr.expression);
+      if (
+        lowerer.checker.getCallSignatures(t).length > 0 ||
+        lowerer.checker.getConstructSignatures(t).length > 0
+      ) {
+        return { kind: "strLit", value: "function", type: STRING, loc };
+      }
+    }
+  }
+  // A known static result type fixes typeof's answer, but its producer
+  // still evaluates: calls, getters, and checked reads can have effects
+  // or throw. Only trivial operands may disappear.
+  let operand = deferredSlotOr(
+    lowerer,
+    runtimeOptionalStorageOperand(lowerer, expr.expression) ?? lowerer.lowerExpr(expr.expression),
+  );
+
+  // A checker-narrowed dyn read arrives as a VALIDATED extraction
+  // (maybeNarrow's dynCheck bridge). typeof needs no extraction — the
+  // dyn kind table answers the question directly, and answers it even
+  // where the flow type lied (the extraction would throw instead) —
+  // so unwrap back to the dyn value and take the dyn.typeof path.
+  if (operand.kind === "dynCheck" && operand.value.type.kind === "dyn") {
+    operand = operand.value;
+  }
+  const FOLD: Partial<Record<string, string>> = {
+    f64: "number",
+    bigint: "bigint",
+    string: "string",
+    bool: "boolean",
+    func: "function",
+    array: "object",
+    object: "object",
+    record: "object",
+    symbol: "symbol",
+    map: "object",
+    set: "object",
+    promise: "object",
+    bytes: "object",
+    regex: "object",
+    generator: "object",
+    classval: "function",
+    moduleNs: "object",
+    undefinedT: "undefined",
+    nullT: "object",
+  };
+  const folded = FOLD[operand.type.kind];
+  if (folded) {
+    const result: IrExpr = { kind: "strLit", value: folded, type: STRING, loc };
+    return isSafeToDiscard(operand)
+      ? result
+      : {
+          kind: "seqExpr",
+          stmts: [{ kind: "exprStmt", expr: operand, loc }],
+          result,
+          type: STRING,
+          loc,
+        };
+  }
+  // A union operand: every arm's typeof answer is static, so the value
+  // form is a ternary chain over runtime TAG tests (arms grouped by
+  // answer; the last group needs no test). The operand rides several
+  // tests, so only side-effect-free reads compose — and when every arm
+  // agrees the whole expression folds to that one string (dropping only
+  // the pure read, the trust-the-checker bet lowerUnitComparison makes).
+  // An effectful producer (a getter) evaluates once into a hidden local.
+  const prelude: IrStmt[] = [];
+  if (operand.type.kind === "union" && !isSafeToRepeat(operand)) {
+    const local = lowerer.declareHiddenLocal("%typeofOperand", operand.type);
+    prelude.push({ kind: "varDecl", localId: local.id, init: operand, loc });
+    operand = varRef(local.id, operand.type, loc);
+  }
+  if (operand.type.kind === "union" && isSafeToRepeat(operand)) {
+    const def = lowerer.unions.get(operand.type.unionId);
+    const answers = def?.arms.map(typeofAnswer);
+    if (def && answers && answers.every((s): s is string => s !== null)) {
+      const groups = new Map<string, number[]>();
+      answers.forEach((s, i) => groups.set(s, [...(groups.get(s) ?? []), i]));
+      const ordered = [...groups.entries()];
+      let result: IrExpr = {
+        kind: "strLit",
+        value: ordered[ordered.length - 1]![0],
+        type: STRING,
+        loc,
+      };
+      for (const [answer, tags] of ordered.slice(0, -1).reverse()) {
+        let test: IrExpr = {
+          kind: "unionIsTag",
+          unionId: operand.type.unionId,
+          tag: tags[0]!,
+          negated: false,
+          value: operand,
+          type: BOOL,
+          loc,
+        };
+        for (const t of tags.slice(1)) {
+          test = {
+            kind: "logical",
+            op: "||",
+            left: test,
+            right: {
+              kind: "unionIsTag",
+              unionId: operand.type.unionId,
+              tag: t,
+              negated: false,
+              value: operand,
+              type: BOOL,
+              loc,
+            },
+            type: BOOL,
+            loc,
+          };
+        }
+        result = {
+          kind: "ternary",
+          cond: test,
+          then: { kind: "strLit", value: answer, type: STRING, loc },
+          else_: result,
+          type: STRING,
+          loc,
+        };
+      }
+      return prelude.length > 0
+        ? { kind: "seqExpr", stmts: prelude, result, type: STRING, loc }
+        : result;
+    }
+  }
+  if (operand.type.kind === "dyn") {
+    // Bare typeof on a dyn value: the runtime's kind→string table
+    // (null answers "object", boxed closures "function" — JS-exact
+    // for every dyn kind; "bigint"/"symbol" have no producers).
+    return { kind: "libCall", fn: "dyn.typeof", args: [operand], type: STRING, loc };
+  }
+  lowerer.unsupported("SC1090", expr, "typeof expressions on statically-typed values");
+}
+
+/** `typeof e.code === "string"` / `"undefined"` (and the `!==` forms)
+ * where e — through parens and as-casts — is a catch binding or a value
+ * of %Error-rooted type: the runtime error's code slot is a string
+ * exactly when present, so the typeof test IS the presence test (the
+ * isErrnoException predicate's third conjunct,
+ * `typeof (err as Record<string, unknown>).code === "string"`). The
+ * as-cast changes the expression's TYPE, never the value — peeled like
+ * lowerProcessStreamProperty's receiver match. Null for every other
+ * shape, so the sibling typeof lowerings keep trying. */
+export function lowerErrorCodeTypeofTest(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+  loc: SrcLoc,
+): IrExpr | null {
+  const negated = expr.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken;
+  for (const [a, b] of operandPairs(expr)) {
+    if (!ts.isTypeOfExpression(a)) continue;
+    let prop: ts.Expression = a.expression;
+    while (ts.isParenthesizedExpression(prop)) prop = prop.expression;
+    if (!ts.isPropertyAccessExpression(prop) || prop.questionDotToken) continue;
+    if (prop.name.text !== "code") continue;
+    let recv: ts.Expression = prop.expression;
+    while (
+      ts.isParenthesizedExpression(recv) ||
+      ts.isAsExpression(recv) ||
+      ts.isTypeAssertion(recv)
+    )
+      recv = recv.expression;
+    const errT = errorRootedObjectOf(lowerer, lowerer.typeOf(recv));
+    if (!errT) continue;
+    if (isExecExceptionType(lowerer, lowerer.typeOf(recv))) refuseExecExceptionCode(lowerer, prop);
+    const caught = lowerer.caughtLocalOf(recv);
+    let receiver: IrExpr;
+    if (caught) {
+      // The checker proved the Error narrowing (errT above), so the
+      // trusted extraction is sound — caughtRead itself would fence on
+      // the intersection spelling.
+      receiver = {
+        kind: "caughtNarrow",
+        value: { kind: "varRef", localId: caught.id, type: CAUGHT, loc },
+        type: errT,
+        loc,
+      };
+    } else {
+      receiver = lowerer.lowerExpr(recv);
+      if (receiver.type.kind !== "object") continue;
+    }
+    if (!ts.isStringLiteral(b)) continue;
+    if (b.text !== "string" && b.text !== "undefined") continue;
+    const codeType = lowerer.envValueType();
+    if (codeType.kind !== "union")
+      throw new InternalCompilerError("lowerer bug: error code type is not a union");
+    const undefTag = lowerer.armTag(codeType.unionId, UNDEFINED_T);
+    const read: IrExpr = {
+      kind: "libCall",
+      fn: "error.code",
+      args: [receiver],
+      type: codeType,
+      loc,
+    };
+    // typeof === "string" ⇔ the code slot is present (NOT the undefined
+    // arm); === "undefined" ⇔ absent. `!==` flips either.
+    const isNotUndef = b.text === "string" ? !negated : negated;
+    return {
+      kind: "unionIsTag",
+      unionId: codeType.unionId,
+      tag: undefTag,
+      ...(isNotUndef ? { negated: true as const } : {}),
+      value: read,
+      type: BOOL,
+      loc,
+    };
+  }
+  return null;
+}
+
+/** `typeof v === "lit"` / `typeof v !== "lit"` where v is `unknown`-typed
+ * (dyn): the runtime kind test over the dyn node's tag. Only the kinds a
+ * later read can bridge narrow ("string"/"number"/"boolean") plus
+ * "undefined" (no payload to read); "object"/"function" tests keep the
+ * fence — an object-narrowed `unknown` read has no lowering anyway (a
+ * checked cast `v as T` is the supported extraction). Null when neither
+ * side is a typeof over a dyn-typed operand (not this pattern). */
+export function lowerDynTypeofTest(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+  loc: SrcLoc,
+): IrExpr | null {
+  const negated = expr.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken;
+  for (const [a, b] of operandPairs(expr)) {
+    if (!ts.isTypeOfExpression(a)) continue;
+    if (lowerer.isStdlibGlobal(a.expression, "fetch")) continue;
+    // Non-literal comparisons use the ordinary typeof string value,
+    // preserving both operands' evaluation order without a narrowing test.
+    if (!ts.isStringLiteral(b)) continue;
+    const declared = lowerer.mapTypeOf(lowerer.typeOf(a.expression));
+    let value: IrExpr;
+    if (declared?.kind === "dyn") {
+      value = lowerer.lowerExpr(a.expression);
+      if (value.type.kind !== "dyn") continue; // defensive: an already-narrowed use
+    } else if (lowerer.caughtLocalOf(a.expression)) {
+      continue; // the caught lowering's territory (it ran first and declined)
+    } else {
+      // `typeof (value as T).field === "string"` — the raw-object
+      // validation idiom (routes.ts's isValidRoute): the `as` is erasure
+      // in JS, so the READ is the dyn KEYED read of the un-cast value —
+      // a missing key answers undefined and the guard goes false,
+      // Node-exact — never the checked cast (validating T here would
+      // throw on exactly the values the guard exists to reject).
+      const unparen = (e: ts.Expression): ts.Expression => {
+        while (ts.isParenthesizedExpression(e)) e = e.expression;
+        return e;
+      };
+      let keyed: IrExpr | null = null;
+      const pn = unparen(a.expression);
+      if (ts.isPropertyAccessExpression(pn) && !pn.questionDotToken && ts.isIdentifier(pn.name)) {
+        const recv = unparen(pn.expression);
+        if (ts.isAsExpression(recv) || ts.isTypeAssertion(recv)) {
+          const inner = unparen(recv.expression);
+          const obj = tryLowerExpression(lowerer, inner);
+          if (obj?.type.kind === "dyn") {
+            keyed = {
+              kind: "dynKeyGet",
+              key: { kind: "strLit", value: pn.name.text, type: STRING, loc },
+              value: obj,
+              type: DYN,
+              loc,
+            };
+          }
+        }
+      }
+      if (keyed) {
+        value = keyed;
+      } else {
+        // A narrowing residue of `unknown`: a `!== undefined` (or truthy)
+        // guard ahead of the typeof test spells the operand `{}`/`{} |
+        // null` — no useful static mapping, but the READ is still the dyn
+        // value (`if (obj.name !== undefined) { if (typeof obj.name !==
+        // "string") ... }`, the validateConfig idiom). Probe the lowering
+        // and claim exactly the dyn results; anything else keeps its
+        // sibling lowerings and fences untouched.
+        const probed = tryLowerExpression(lowerer, a.expression);
+        if (probed?.type.kind !== "dyn") continue;
+        value = probed;
+      }
+    }
+    if (
+      b.text === "string" ||
+      b.text === "number" ||
+      b.text === "boolean" ||
+      b.text === "undefined" ||
+      b.text === "bigint" ||
+      b.text === "symbol"
+    ) {
+      return {
+        kind: "dynTest",
+        test: b.text,
+        ...(negated ? { negated: true as const } : {}),
+        value,
+        type: BOOL,
+        loc,
+      };
+    }
+    // `typeof v === "object"`: the dyn answers exactly (object, array,
+    // bytes, and null kinds — JS's oldest wart preserved). tsc narrows
+    // the branch to `object | null`; reads past the narrow take the
+    // checked-cast path per site.
+    if (b.text === "object") {
+      return {
+        kind: "dynTest",
+        test: "object",
+        ...(negated ? { negated: true as const } : {}),
+        value,
+        type: BOOL,
+        loc,
+      };
+    }
+    // `typeof v === "function"`: a REAL runtime test since the checked-dynamic tree's
+    // function kind exists (boxed closures — the mustCall guard
+    // `if (typeof fn !== 'function') throw` answers honestly).
+    if (b.text === "function") {
+      return {
+        kind: "dynTest",
+        test: "function",
+        ...(negated ? { negated: true as const } : {}),
+        value,
+        type: BOOL,
+        loc,
+      };
+    }
+    // Native checked values do not yet carry symbols.
+    if (b.text === "symbol") {
+      return { kind: "boolLit", value: negated, type: BOOL, loc };
+    }
+    lowerer.unsupported(
+      "SC1090",
+      b,
+      `'typeof' tests against "${b.text}" on 'unknown' values (only "string"/"number"/` +
+        `"boolean"/"undefined"/"object" narrow; use a checked cast — 'v as T' — to extract)`,
+    );
+  }
+  return null;
+}
+
+/** The `declare module "..."` body (or nested namespace body) a module
+ * export's declaration sits directly in, or undefined. */
+function builtinModuleExportParent(decl: ts.Node): ts.ModuleBlock | undefined {
+  const parent = ts.isVariableDeclaration(decl) ? decl.parent?.parent?.parent : decl.parent;
+  return parent !== undefined && ts.isModuleBlock(parent) ? parent : undefined;
+}
+
+/** A function, class or variable exported by a builtin module's body. */
+function isBuiltinModuleValueDecl(decl: ts.Node): boolean {
+  return (
+    builtinModuleExportParent(decl) !== undefined &&
+    (ts.isFunctionDeclaration(decl) ||
+      ts.isClassDeclaration(decl) ||
+      ts.isVariableDeclaration(decl))
+  );
+}
diff --git a/packages/compiler/src/frontend/lowering/expressions/updates.ts b/packages/compiler/src/frontend/lowering/expressions/updates.ts
new file mode 100644
index 000000000..8b98389b6
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/expressions/updates.ts
@@ -0,0 +1,969 @@
+/* Increment, decrement and prefix unary operators, and compound field updates. */
+import * as ts from "../../ts7/adapter.js";
+import { isPrivateWriteReceiver } from "../private-brands.js";
+import type { Lowerer } from "../lowerer.js";
+import {
+  type FieldTarget,
+  bigintCompoundValue,
+  compoundUnsupported,
+  concatOperand,
+  deferredSlotOr,
+  dynCompoundValue,
+  lowerOptionalNumber,
+  operatorUnsupported,
+  runtimeOptionalStorageOperand,
+  symbolFieldTarget,
+} from "../lower-exprs.js";
+import {
+  BIGINT_T,
+  BOOL,
+  DYN,
+  F64,
+  type IrExpr,
+  type IrStmt,
+  type IrType,
+  STRING,
+  type SrcLoc,
+  UNDEFINED_T,
+  VOID,
+} from "../../../ir/ir.js";
+import { isJsSourceFile, locOf } from "../../program.js";
+import { classToNumberConversion } from "../class-to-primitive.js";
+import { dynUndefinedExpr, nodeThrowExpr, numLit, varRef } from "../../../ir/build.js";
+import { fenceNodeModuleMutation } from "../lower-node-module.js";
+import { staticFieldWriteTarget } from "../lower-classes.js";
+import { expandoWritableTarget } from "../lower-expando.js";
+import { nsWritableTarget } from "../lower-namespaces.js";
+import { arrayNumberRead, arrayValueRead, arrayValueStore } from "../array-values.js";
+import { isSafeToRepeat } from "./evaluation-safety.js";
+import { errorPropertyWrite } from "../error-methods.js";
+import type { CompoundOp } from "../surfaces.js";
+import { tryLowerExpression } from "./try-lower-expression.js";
+import { hasRuntimeStatics } from "../class-runtime-statics.js";
+import { declareContextLocal } from "../function-context.js";
+
+/** Read-modify-write updates read the member first: an unassigned
+ * deferred-init receiver throws Node's member-read TypeError. */
+function checkDeferredMemberReceiver(
+  lowerer: Lowerer,
+  target: FieldTarget,
+  access: ts.Expression,
+): void {
+  if (
+    target.container !== "class" ||
+    !ts.isPropertyAccessExpression(access) ||
+    target.obj.type.kind !== "object" ||
+    lowerer.deferredFieldSlot(target.obj) === null
+  )
+    return;
+  target.obj =
+    lowerer.runtimeOptionalPropertyReceiver(
+      access.expression,
+      target.obj,
+      target.obj.type,
+      target.field,
+    ) ?? target.obj;
+}
+
+/** Whether evaluating `expr` cannot store anything or run other code:
+ * reads, arithmetic, tests and checked extractions (which at most throw). */
+function writeFree(expr: IrExpr): boolean {
+  switch (expr.kind) {
+    case "numLit":
+    case "strLit":
+    case "boolLit":
+    case "unitLit":
+    case "varRef":
+      return true;
+    case "fieldGet":
+    case "recordGet":
+      return writeFree(expr.obj);
+    case "bin":
+    case "logical":
+      return writeFree(expr.left) && writeFree(expr.right);
+    case "unary":
+    case "toBool":
+      return writeFree(expr.operand);
+    case "ternary":
+      return writeFree(expr.cond) && writeFree(expr.then) && writeFree(expr.else_);
+    case "unionIsTag":
+    case "unionNarrow":
+    case "unionWrap":
+      return writeFree(expr.value);
+    case "libCall":
+      return expr.fn === "error.nodeThrow";
+    default:
+      return false;
+  }
+}
+
+export function lowerPrefixUnary(lowerer: Lowerer, expr: ts.PrefixUnaryExpression): IrExpr {
+  const loc = locOf(expr);
+  switch (expr.operator) {
+    case ts.SyntaxKind.MinusToken: {
+      const raw = lowerer.lowerExpr(expr.operand);
+
+      if (raw.type.kind === "bigint") {
+        return { kind: "libCall", fn: "bigint.neg", args: [raw], type: BIGINT_T, loc };
+      }
+      // Match the checked numeric boundary used by JS binary arithmetic.
+      const operand =
+        raw.type.kind === "dyn" && isJsSourceFile(expr.getSourceFile())
+          ? { kind: "dynCheck" as const, value: raw, type: F64, loc }
+          : lowerOptionalNumber(lowerer, raw, loc, expr.operand);
+      if (operand.type.kind !== "f64") operatorUnsupported(lowerer, expr, "-", [raw.type]);
+      if (operand.kind === "numLit") return { ...operand, value: -operand.value, loc };
+      return { kind: "unary", op: "-", operand, type: F64, loc };
+    }
+    case ts.SyntaxKind.PlusToken: {
+      const raw = lowerer.lowerExpr(expr.operand);
+      if (raw.type.kind === "dyn") {
+        return { kind: "libCall", fn: "dyn.toNumberCoerce", args: [raw], type: F64, loc };
+      }
+      // Unary + is ToNumber; on an already-number operand it's identity,
+      // and a STRING operand runs the runtime's ECMA-exact StringToNumber
+      // (num.fromString — Number(aString)'s lowering, scr_string.c).
+
+      if (raw.type.kind === "string") {
+        return { kind: "libCall", fn: "num.fromString", args: [raw], type: F64, loc };
+      }
+      const classNumber = classToNumberConversion(lowerer, raw, expr.operand, "unary plus");
+      if (classNumber) return classNumber;
+      const operand = lowerOptionalNumber(lowerer, raw, loc, expr.operand);
+      if (operand.type.kind !== "f64") operatorUnsupported(lowerer, expr, "+", [raw.type]);
+      return operand;
+    }
+    case ts.SyntaxKind.ExclamationToken: {
+      // `!x` is ToBoolean-then-negate: f64/string operands go through toBool.
+      const operand = lowerer.ensureBool(
+        deferredSlotOr(
+          lowerer,
+          runtimeOptionalStorageOperand(lowerer, expr.operand) ?? lowerer.lowerExpr(expr.operand),
+        ),
+        expr.operand,
+      );
+      return { kind: "unary", op: "!", operand, type: BOOL, loc };
+    }
+    case ts.SyntaxKind.TildeToken: {
+      // `~x`: ToInt32, complement, back to f64 (JS-exact, incl. NaN → -1).
+      const raw = lowerer.lowerExpr(expr.operand);
+      if (raw.type.kind === "bigint") {
+        return { kind: "libCall", fn: "bigint.not", args: [raw], type: BIGINT_T, loc };
+      }
+      if (raw.type.kind === "dyn")
+        return {
+          kind: "libCall",
+          fn: "dyn.bitwise",
+          args: [raw, dynUndefinedExpr(loc), { kind: "strLit", value: "~", type: STRING, loc }],
+          type: DYN,
+          loc,
+        };
+      // A checked-dynamic value retains enough JavaScript structure to
+      // run exact ToNumber, including the object valueOf/toString
+      // protocol. This is the static `any`/JS-lane answer for idioms
+      // such as `while (~index)`, where inference may have widened an
+      // otherwise numeric slot to the checked-dynamic tree.
+      const operand = lowerOptionalNumber(lowerer, raw, loc, expr.operand);
+      if (operand.type.kind !== "f64") operatorUnsupported(lowerer, expr, "~", [raw.type]);
+      return { kind: "unary", op: "~", operand, type: F64, loc };
+    }
+    case ts.SyntaxKind.PlusPlusToken:
+    case ts.SyntaxKind.MinusMinusToken:
+      // `++x` / `--x` in expression position: yields the NEW value.
+      return lowerIncDec(lowerer, expr, true);
+  }
+  lowerer.unsupported("SC1090", expr, `syntax '${ts.syntaxKindName(expr.kind)}'`);
+}
+
+/** Member updates evaluate the reference once, convert its old value with
+ * ToNumeric, store the new value, then yield the old or new numeric value. */
+export function lowerIncDec(
+  lowerer: Lowerer,
+  expr: ts.PrefixUnaryExpression | ts.PostfixUnaryExpression,
+  prefix: boolean,
+): IrExpr {
+  const loc = locOf(expr);
+  const op = expr.operator === ts.SyntaxKind.PlusPlusToken ? "+" : "-";
+  if (!ts.isIdentifier(expr.operand)) {
+    const access = expr.operand;
+    if (
+      (!ts.isPropertyAccessExpression(access) && !ts.isElementAccessExpression(access)) ||
+      access.questionDotToken
+    ) {
+      lowerer.unsupported("SC1045", expr, "increment/decrement of this target");
+    }
+    fenceNodeModuleMutation(lowerer, access, "assignment");
+    if (ts.isPropertyAccessExpression(access)) {
+      const target =
+        staticFieldWriteTarget(lowerer, access) ??
+        expandoWritableTarget(lowerer, access) ??
+        nsWritableTarget(lowerer, access);
+      if (target) {
+        return lowerIncDecTarget(lowerer, expr, target, prefix);
+      }
+    }
+    const stmts: IrStmt[] = [];
+    const save = (value: IrExpr, name: string): IrExpr => {
+      const local = lowerer.declareHiddenLocal(name, value.type);
+      stmts.push({ kind: "varDecl", localId: local.id, init: value, loc });
+      return varRef(local.id, value.type, loc);
+    };
+    const finish = (read: IrExpr, write: (value: IrExpr) => IrStmt): IrExpr => {
+      if (read.type.kind === "bigint") {
+        const old = save(read, "%incrementOld");
+        const next = save(bigintStep(op, old, loc), "%incrementNext");
+        stmts.push(write(next));
+        const result = prefix ? next : old;
+        return { kind: "seqExpr", stmts, result, type: result.type, loc };
+      }
+      const old = save(
+        read.type.kind === "f64"
+          ? read
+          : {
+              kind: "libCall",
+              fn: "dyn.toNumeric",
+              args: [lowerer.coerceInto(access, read, DYN)],
+              type: DYN,
+              loc,
+            },
+        "%incrementOld",
+      );
+      const next = save(
+        old.type.kind === "f64"
+          ? {
+              kind: "bin",
+              op,
+              left: old,
+              right: { kind: "numLit", value: 1, type: F64, loc },
+              type: F64,
+              loc,
+            }
+          : {
+              kind: "libCall",
+              fn: "dyn.increment",
+              args: [old, { kind: "boolLit", value: op === "+", type: BOOL, loc }],
+              type: DYN,
+              loc,
+            },
+        "%incrementNext",
+      );
+      stmts.push(write(next));
+      const result = prefix ? next : old;
+      return { kind: "seqExpr", stmts, result, type: result.type, loc };
+    };
+    const raw = lowerer.lowerExpr(access.expression);
+    // Keep native array/byte storage: boxing a native array can create a
+    // checked view, which is not a substitute for updating its slot.
+    if (
+      ts.isElementAccessExpression(access) &&
+      (raw.type.kind === "array" || raw.type.kind === "bytes")
+    ) {
+      const receiver = save(raw, "%incrementArray");
+      const rawIndex = lowerer.lowerExpr(access.argumentExpression);
+      const index = save(
+        rawIndex.type.kind === "dyn" && isJsSourceFile(expr.getSourceFile())
+          ? { kind: "libCall", fn: "dyn.toNumberCoerce", args: [rawIndex], type: F64, loc }
+          : rawIndex,
+        "%incrementIndex",
+      );
+      if (index.type.kind !== "f64")
+        lowerer.unsupported("SC1090", access, "incrementing non-number array keys");
+      const type = raw.type;
+      const read: IrExpr =
+        type.kind === "array"
+          ? type.elem.kind === "f64"
+            ? arrayNumberRead(receiver, index, loc)
+            : arrayValueRead(lowerer, receiver, index, type.elem, loc)
+          : {
+              kind: "bytesIntrinsic",
+              method: "get",
+              receiver,
+              args: [index],
+              type: F64,
+              loc,
+              invalidNaN: true,
+            };
+      return finish(read, (value) =>
+        type.kind === "array"
+          ? arrayValueStore(
+              lowerer,
+              receiver,
+              index,
+              lowerer.coerceInto(access, value, type.elem),
+              type.elem,
+              loc,
+            )
+          : {
+              kind: "bytesSet",
+              arr: receiver,
+              index,
+              value: lowerer.coerceInto(access, value, F64),
+              loc,
+            },
+      );
+    }
+    // A TS member statically typed number on a checked-dynamic receiver (a
+    // class-backed protocol view): the expanded form `o.v = o.v + 1`, its
+    // read checked into number like any other read of the member.
+    const checkedNumber =
+      !isJsSourceFile(expr.getSourceFile()) &&
+      raw.type.kind === "dyn" &&
+      lowerer.mapTypeOf(lowerer.typeOf(access))?.kind === "f64";
+    if ((isJsSourceFile(expr.getSourceFile()) || checkedNumber) && raw.type.kind === "dyn") {
+      const receiver = save(raw, "%incrementReceiver");
+      const key = save(
+        ts.isElementAccessExpression(access)
+          ? lowerer.lowerExprExpecting(access.argumentExpression, DYN)
+          : lowerer.coerceInto(
+              access,
+              { kind: "strLit", value: access.name.text, type: STRING, loc },
+              DYN,
+            ),
+        "%incrementKey",
+      );
+      const read: IrExpr = { kind: "dynKeyGet", value: receiver, key, type: DYN, loc };
+      return finish(checkedNumber ? lowerer.coerceInto(access, read, F64) : read, (value) => ({
+        kind: "exprStmt",
+        expr: {
+          kind: "libCall",
+          fn: "dyn.keySetComputed",
+          args: [receiver, key, lowerer.coerceInto(access, value, DYN)],
+          type: VOID,
+          loc,
+        },
+        loc,
+      }));
+    }
+    const target = ts.isPropertyAccessExpression(access)
+      ? lowerer.fieldTarget(access)
+      : symbolFieldTarget(lowerer, access);
+    if (target && lowerer.dynConvertible(target.fieldType)) {
+      checkDeferredMemberReceiver(lowerer, target, access);
+      target.obj = save(target.obj, "%incrementReceiver");
+      return finish(lowerer.fieldGetExpr(target, loc, access), (value) =>
+        lowerer.fieldSetStmt(
+          target,
+          lowerer.coerceInto(access, value, target.fieldType),
+          loc,
+          access,
+        ),
+      );
+    }
+    if (isJsSourceFile(expr.getSourceFile()) && lowerer.dynConvertible(raw.type)) {
+      const receiver = save(lowerer.coerceInto(access.expression, raw, DYN), "%incrementReceiver");
+      const key = save(
+        ts.isElementAccessExpression(access)
+          ? lowerer.lowerExprExpecting(access.argumentExpression, DYN)
+          : lowerer.coerceInto(
+              access,
+              { kind: "strLit", value: access.name.text, type: STRING, loc },
+              DYN,
+            ),
+        "%incrementKey",
+      );
+      return finish({ kind: "dynKeyGet", value: receiver, key, type: DYN, loc }, (value) => ({
+        kind: "exprStmt",
+        expr: {
+          kind: "libCall",
+          fn: "dyn.keySetComputed",
+          args: [receiver, key, lowerer.coerceInto(access, value, DYN)],
+          type: VOID,
+          loc,
+        },
+        loc,
+      }));
+    }
+    lowerer.unsupported("SC1045", expr, "increment/decrement of this member target");
+  }
+  const target = lowerer.resolveWritable(expr.operand);
+  if (!target) {
+    lowerer.rejectUnresolved(
+      expr.operand,
+      `increment/decrement of '${expr.operand.text}' (not a writable local or module global)`,
+    );
+  }
+  return lowerIncDecTarget(lowerer, expr, target, prefix);
+}
+
+/** Numeric updates read the represented slot once and write the computed
+ * value back in that same representation. In particular, an unchecked
+ * indexed initializer can leave undefined in an otherwise numeric binding. */
+export function lowerIncDecTarget(
+  lowerer: Lowerer,
+  expr: ts.PrefixUnaryExpression | ts.PostfixUnaryExpression,
+  target: { id: string; type: IrType },
+  prefix: boolean,
+): IrExpr {
+  const loc = locOf(expr);
+  const op = expr.operator === ts.SyntaxKind.PlusPlusToken ? "+" : "-";
+  if (target.type.kind === "dyn") {
+    const old = lowerer.declareHiddenLocal("%numericOld", DYN);
+    const next = lowerer.declareHiddenLocal("%numericNext", DYN);
+    const read = varRef(target.id, target.type, loc);
+    return {
+      kind: "seqExpr",
+      stmts: [
+        {
+          kind: "varDecl",
+          localId: old.id,
+          init: { kind: "libCall", fn: "dyn.toNumeric", args: [read], type: DYN, loc },
+          loc,
+        },
+        {
+          kind: "varDecl",
+          localId: next.id,
+          init: {
+            kind: "libCall",
+            fn: "dyn.increment",
+            args: [
+              varRef(old.id, DYN, loc),
+              { kind: "boolLit", value: op === "+", type: BOOL, loc },
+            ],
+            type: DYN,
+            loc,
+          },
+          loc,
+        },
+        { kind: "assign", localId: target.id, value: varRef(next.id, DYN, loc), loc },
+      ],
+      result: varRef(prefix ? next.id : old.id, DYN, loc),
+      type: DYN,
+      loc,
+    };
+  }
+  if (target.type.kind === "union") {
+    const read = lowerOptionalNumber(
+      lowerer,
+      varRef(target.id, target.type, loc),
+      loc,
+      expr.operand,
+    );
+    if (read.type.kind === "f64") {
+      const old = lowerer.declareHiddenLocal("%numericOld", F64);
+      const next = lowerer.declareHiddenLocal("%numericNext", F64);
+      const result = varRef(prefix ? next.id : old.id, F64, loc);
+      return {
+        kind: "seqExpr",
+        stmts: [
+          { kind: "varDecl", localId: old.id, init: read, loc },
+          {
+            kind: "varDecl",
+            localId: next.id,
+            init: {
+              kind: "bin",
+              op,
+              left: varRef(old.id, F64, loc),
+              right: numLit(1, loc),
+              type: F64,
+              loc,
+            },
+            loc,
+          },
+          {
+            kind: "assign",
+            localId: target.id,
+            value: lowerer.coerceInto(expr.operand, varRef(next.id, F64, loc), target.type),
+            loc,
+          },
+        ],
+        result,
+        type: F64,
+        loc,
+      };
+    }
+  }
+  if (target.type.kind === "bigint") {
+    const old = lowerer.declareHiddenLocal("%bigintOld", BIGINT_T);
+    const next = lowerer.declareHiddenLocal("%bigintNext", BIGINT_T);
+    return {
+      kind: "seqExpr",
+      stmts: [
+        { kind: "varDecl", localId: old.id, init: varRef(target.id, BIGINT_T, loc), loc },
+        {
+          kind: "varDecl",
+          localId: next.id,
+          init: bigintStep(op, varRef(old.id, BIGINT_T, loc), loc),
+          loc,
+        },
+        { kind: "assign", localId: target.id, value: varRef(next.id, BIGINT_T, loc), loc },
+      ],
+      result: varRef(prefix ? next.id : old.id, BIGINT_T, loc),
+      type: BIGINT_T,
+      loc,
+    };
+  }
+  if (target.type.kind !== "f64")
+    operatorUnsupported(lowerer, expr, op === "+" ? "++" : "--", [target.type]);
+  return { kind: "incDec", op, prefix, localId: target.id, type: F64, loc };
+}
+
+/** `++`/`--` on a bigint value: old ± 1n. */
+function bigintStep(op: "+" | "-", old: IrExpr, loc: SrcLoc): IrExpr {
+  const one: IrExpr = {
+    kind: "libCall",
+    fn: "bigint.parse",
+    args: [{ kind: "strLit", value: "1", type: STRING, loc }],
+    type: BIGINT_T,
+    loc,
+  };
+  return {
+    kind: "libCall",
+    fn: op === "+" ? "bigint.add" : "bigint.sub",
+    args: [old, one],
+    type: BIGINT_T,
+    loc,
+  };
+}
+
+/** The write statement for a field target (fieldSet / recordSet / setter
+ * call). A write to a getter-only property never gets here in a clean
+ * program (tsc's TS2540 is the fence); the rejection is the backstop. */
+export function fieldSetStmt(
+  lowerer: Lowerer,
+  target: FieldTarget,
+  value: IrExpr,
+  loc: SrcLoc,
+  blame: ts.Node,
+): IrStmt {
+  // A write through a brand-checked receiver (checkedPrivateReceiver): the
+  // value evaluates first, then the brand check throws, as in Node.
+  if (isPrivateWriteReceiver(target.obj) && value.kind !== "varRef") {
+    const stored = lowerer.declareHiddenLocal("%privateWriteValue", value.type);
+    return {
+      kind: "block",
+      body: [
+        { kind: "varDecl", localId: stored.id, init: value, loc },
+        fieldSetStmt(lowerer, target, varRef(stored.id, stored.type, loc), loc, blame),
+      ],
+      loc,
+    };
+  }
+  // A member write through an unassigned deferred-init field: the value
+  // still evaluates first, then the write throws Node's TypeError.
+  const deferredSlot =
+    target.container === "class" &&
+    !(
+      (target.field === "message" || target.field === "name") &&
+      (target.className === "%Error" || lowerer.isSubclassOf(target.className, "%Error"))
+    )
+      ? lowerer.deferredFieldSlot(target.obj)
+      : null;
+  if (target.container === "class" && deferredSlot?.type.kind === "union") {
+    const unionId = deferredSlot.type.unionId;
+    const undefTag = lowerer.armTag(unionId, UNDEFINED_T);
+    const presentTag = lowerer.armTag(unionId, target.obj.type);
+    if (undefTag >= 0 && presentTag >= 0) {
+      // A value that cannot write anything leaves the field unchanged, so
+      // the field is read after it (no snapshot of the slot).
+      const late = isSafeToRepeat(deferredSlot) && writeFree(value);
+      const receiver = late
+        ? null
+        : lowerer.declareHiddenLocal("%deferredWriteObject", deferredSlot.type);
+      const stored = lowerer.declareHiddenLocal("%deferredWriteValue", value.type);
+      const receiverRef = receiver ? varRef(receiver.id, receiver.type, loc) : deferredSlot;
+      const result = varRef(stored.id, stored.type, loc);
+      const write: IrStmt = {
+        kind: "fieldSet",
+        obj: {
+          kind: "unionNarrow",
+          unionId,
+          tag: presentTag,
+          value: receiverRef,
+          type: target.obj.type,
+          loc,
+        },
+        className: target.className,
+        field: target.field,
+        value: result,
+        loc,
+      };
+      return {
+        kind: "exprStmt",
+        expr: {
+          kind: "seqExpr",
+          stmts: [
+            ...(receiver
+              ? [{ kind: "varDecl" as const, localId: receiver.id, init: deferredSlot, loc }]
+              : []),
+            { kind: "varDecl", localId: stored.id, init: value, loc },
+          ],
+          result: {
+            kind: "ternary",
+            cond: {
+              kind: "unionIsTag",
+              unionId,
+              tag: undefTag,
+              value: receiverRef,
+              negated: false,
+              type: BOOL,
+              loc,
+            },
+            then: nodeThrowExpr(
+              1,
+              "",
+              `Cannot set properties of undefined (setting '${target.field}')`,
+              result.type,
+              loc,
+            ),
+            else_: { kind: "seqExpr", stmts: [write], result, type: result.type, loc },
+            type: result.type,
+            loc,
+          },
+          type: result.type,
+          loc,
+        },
+        loc,
+      };
+    }
+  }
+  if (target.container === "dynamic")
+    return {
+      kind: "exprStmt",
+      expr: {
+        kind: "libCall",
+        fn: "dyn.keySet",
+        args: [
+          target.obj,
+          { kind: "strLit", value: target.field, type: STRING, loc },
+          lowerer.coerceToExpected(value, DYN),
+        ],
+        type: VOID,
+        loc,
+      },
+      loc,
+    };
+  if (
+    target.container === "class" &&
+    (target.field === "message" || target.field === "name") &&
+    (target.className === "%Error" || lowerer.isSubclassOf(target.className, "%Error"))
+  )
+    return errorPropertyWrite(lowerer, target.obj, value, target.field);
+  if (target.container === "errorStackLimit") {
+    return {
+      kind: "exprStmt",
+      expr: { kind: "libCall", fn: "error.stackLimitSet", args: [value], type: VOID, loc },
+      loc,
+    };
+  }
+  if (target.container === "errorCause") {
+    return {
+      kind: "exprStmt",
+      expr: { kind: "libCall", fn: "error.setCause", args: [target.obj, value], type: VOID, loc },
+      loc,
+    };
+  }
+  // A record-shaped CHECKER target whose receiver VALUE lives in the checked-dynamic tree:
+  // the checked-dynamic keyed write — dyn.keySet (later writes win,
+  // insertion order; Node's TypeErrors on non-object receivers), the
+  // value converting into the checked-dynamic tree.
+  if (
+    (target.container === "record" || target.container === "recordOvf") &&
+    target.obj.type.kind === "dyn"
+  ) {
+    const v = lowerer.coerceToExpected(value, DYN);
+    if (v.type.kind !== "dyn") {
+      lowerer.unsupported(
+        "SC1101",
+        blame,
+        `storing '${lowerer.fmt(value.type)}' values in a checked-dynamic object (the value cannot convert into the checked-dynamic tree)`,
+      );
+    }
+    return {
+      kind: "exprStmt",
+      expr: {
+        kind: "libCall",
+        fn: "dyn.keySet",
+        args: [target.obj, { kind: "strLit", value: target.field, type: STRING, loc }, v],
+        type: VOID,
+        loc,
+      },
+      loc,
+    };
+  }
+  if (target.container === "accessor") {
+    const setF = lowerer.findMethodOn(
+      lowerer.classes.get(target.className) ?? null,
+      `set:${target.field}`,
+    );
+    if (!setF)
+      lowerer.unsupported(
+        "SC1090",
+        blame,
+        `assignment to the getter-only property '${target.field}'`,
+      );
+    return {
+      kind: "exprStmt",
+      expr: lowerer.accessorCall(
+        target.className,
+        `set:${target.field}`,
+        target.obj,
+        [value],
+        VOID,
+        loc,
+      ),
+      loc,
+    };
+  }
+  // Record accessor properties: the write calls the %set: closure with
+  // the coerced value. A getter-only write never gets here in a clean
+  // program (tsc's TS2540); the rejection is the backstop.
+  if (target.container === "recordAccessor") {
+    if (!target.setType) {
+      lowerer.unsupported(
+        "SC1090",
+        blame,
+        `assignment to the getter-only property '${target.field}'`,
+      );
+    }
+    const closure: IrExpr = {
+      kind: "recordGet",
+      obj: target.obj,
+      shapeId: target.shapeId,
+      field: `%set:${target.field}`,
+      type: target.setType,
+      loc,
+    };
+    return {
+      kind: "exprStmt",
+      expr: { kind: "callValue", callee: closure, args: [value], type: VOID, loc },
+      loc,
+    };
+  }
+  // Overflow dot writes: the bracket write with a literal key — a pure
+  // overflow insert (recordKeySet, overflowOnly: the name declares no
+  // field, so no declared collision exists to validate). The value was
+  // coerced into the index-value slot type by the caller.
+  if (target.container === "recordOvf") {
+    return {
+      kind: "recordKeySet",
+      obj: target.obj,
+      shapeId: target.shapeId,
+      key: { kind: "strLit", value: target.field, type: STRING, loc },
+      value,
+      overflowOnly: true,
+      loc,
+    };
+  }
+  return target.container === "class"
+    ? {
+        kind: "fieldSet",
+        obj: target.obj,
+        className: target.className,
+        field: target.field,
+        value,
+        loc,
+      }
+    : {
+        kind: "recordSet",
+        obj: target.obj,
+        shapeId: target.shapeId,
+        field: target.field,
+        value,
+        loc,
+      };
+}
+
+export function lowerFieldCompoundValue(
+  lowerer: Lowerer,
+  access: ts.PropertyAccessExpression | ts.ElementAccessExpression,
+  op: CompoundOp,
+  rhsNode: ts.Expression | null,
+  loc: SrcLoc,
+): IrExpr {
+  if (access.expression.kind === ts.SyntaxKind.SuperKeyword) {
+    lowerer.unsupported(
+      "SC1090",
+      access,
+      "compound assignment through 'super' (read and write separately)",
+    );
+  }
+  const body: IrStmt[] = [];
+  const save = (value: IrExpr, name: string): IrExpr => {
+    const local = lowerer.declareHiddenLocal(name, value.type);
+    body.push({ kind: "varDecl", localId: local.id, init: value, loc: value.loc });
+    return varRef(local.id, value.type, value.loc);
+  };
+  // A CHECKED-DYNAMIC receiver (`context.actual++` — test/common's call
+  // accounting; dot spelling only — symbol-keyed element targets are
+  // static fields): read the member (dynKeyGet), VALIDATE it as a
+  // number (dynCheck — a non-number member throws the catchable
+  // TypeError where JS would ToNumber-coerce; it throws instead of
+  // producing NaN — SEMANTICS.md), combine, write back (dyn.keySet). The
+  // receiver and member read are saved before evaluating the RHS.
+  if (ts.isPropertyAccessExpression(access)) {
+    let probed = tryLowerExpression(lowerer, access.expression);
+    const staticClass =
+      probed?.type.kind === "classval" ? lowerer.classes.get(probed.type.className) : undefined;
+    if (probed && staticClass && hasRuntimeStatics(staticClass))
+      probed = lowerer.coerceToExpected(probed, DYN);
+    if (probed?.type.kind === "dyn") {
+      const receiver = save(probed, "%compoundReceiver");
+      const key: IrExpr = {
+        kind: "strLit",
+        value: access.name.text,
+        type: STRING,
+        loc: locOf(access.name),
+      };
+      const read = save(
+        { kind: "dynKeyGet", key, value: receiver, type: DYN, loc },
+        "%compoundOld",
+      );
+      const cur: IrExpr = { kind: "dynCheck", value: read, type: F64, loc };
+      const rhs = save(
+        rhsNode ? lowerer.lowerExpr(rhsNode) : { kind: "numLit", value: 1, type: F64, loc },
+        "%compoundRhs",
+      );
+      if (isJsSourceFile(access.getSourceFile()) && lowerer.dynConvertible(rhs.type)) {
+        const numeric = ["-", "*", "/", "%", "**"].includes(op);
+        const right = lowerer.coerceToExpected(rhs, DYN);
+        const value = save(
+          {
+            kind: "libCall",
+            fn: op === "+" ? "dyn.add" : numeric ? "dyn.arithmetic" : "dyn.bitwise",
+            args:
+              op === "+"
+                ? [read, right]
+                : [read, right, { kind: "strLit", value: op, type: STRING, loc }],
+            type: DYN,
+            loc,
+          },
+          "%compoundResult",
+        );
+        body.push({
+          kind: "exprStmt",
+          expr: {
+            kind: "libCall",
+            fn: "dyn.keySet",
+            args: [receiver, key, value],
+            type: VOID,
+            loc,
+          },
+          loc,
+        });
+        return { kind: "seqExpr", stmts: body, result: value, type: DYN, loc };
+      }
+      const numericRhs: IrExpr =
+        rhs.type.kind === "dyn"
+          ? { kind: "dynCheck", value: rhs, type: F64, loc: rhs.loc }
+          : lowerOptionalNumber(lowerer, rhs, loc);
+      if (numericRhs.type.kind !== "f64")
+        compoundUnsupported(lowerer, access, op, F64, numericRhs.type);
+      const value = save(
+        { kind: "bin", op, left: cur, right: numericRhs, type: F64, loc },
+        "%compoundResult",
+      );
+      const boxed: IrExpr = { kind: "dynFrom", value, type: DYN, loc };
+      body.push({
+        kind: "exprStmt",
+        expr: {
+          kind: "libCall",
+          fn: "dyn.keySet",
+          args: [receiver, { ...key }, boxed],
+          type: VOID,
+          loc,
+        },
+        loc,
+      });
+      return { kind: "seqExpr", stmts: body, result: value, type: value.type, loc };
+    }
+  }
+  const targetOf = (): FieldTarget | null =>
+    ts.isPropertyAccessExpression(access)
+      ? lowerer.fieldTarget(access)
+      : symbolFieldTarget(lowerer, access);
+  const target = targetOf();
+  if (!target)
+    lowerer.unsupported("SC1090", access, "compound assignment to unsupported field targets");
+  checkDeferredMemberReceiver(lowerer, target, access);
+  target.obj = save(target.obj, "%compoundReceiver");
+  // Accessors observe getter, RHS side effects, then setter, all through
+  // the saved receiver.
+  const fieldRead = lowerer.fieldGetExpr(target, locOf(access), access);
+  // `+=` on a stored string field reads it into a mutable local, so the
+  // concat below can append to that local in place.
+  const storedString =
+    op === "+" &&
+    fieldRead.type.kind === "string" &&
+    target.fieldType.kind === "string" &&
+    (target.container === "class" || target.container === "record");
+  let read: IrExpr;
+  if (storedString) {
+    const old = declareContextLocal(
+      lowerer.ctx,
+      "%compoundOld",
+      STRING,
+      true,
+      undefined,
+      undefined,
+    );
+    body.push({ kind: "varDecl", localId: old.id, init: fieldRead, loc: fieldRead.loc });
+    read = varRef(old.id, STRING, fieldRead.loc);
+  } else {
+    read = save(fieldRead, "%compoundOld");
+  }
+  const rhs = save(
+    rhsNode ? lowerer.lowerExpr(rhsNode) : { kind: "numLit", value: 1, type: F64, loc },
+    "%compoundRhs",
+  );
+  const numericRhs: IrExpr =
+    rhs.type.kind === "dyn" && isJsSourceFile(access.getSourceFile())
+      ? { kind: "dynCheck", value: rhs, type: F64, loc: rhs.loc }
+      : lowerOptionalNumber(lowerer, rhs, loc);
+  let value: IrExpr;
+  let appended: IrExpr | null = null;
+  const numericRead = lowerOptionalNumber(lowerer, read, loc, access);
+  const bigintValue = rhsNode ? bigintCompoundValue(op, read, rhs, loc) : null;
+  if (op === "+" && read.type.kind === "string") {
+    appended = concatOperand(lowerer, rhs, rhsNode ?? access);
+    value = { kind: "strConcat", left: read, right: appended, type: STRING, loc };
+  } else if (numericRead.type.kind === "f64" && numericRhs.type.kind === "f64") {
+    value = { kind: "bin", op, left: numericRead, right: numericRhs, type: F64, loc };
+  } else if (bigintValue) {
+    value = bigintValue;
+  } else if (
+    (target.fieldType.kind === "dyn" && isJsSourceFile(access.getSourceFile())) ||
+    // An untyped right operand: the expanded `o.f = o.f op rhs`; the field
+    // write below checks the result into the declared field type.
+    (rhs.type.kind === "dyn" &&
+      lowerer.dynConvertible(read.type) &&
+      lowerer.dynConvertible(target.fieldType))
+  ) {
+    value = dynCompoundValue(
+      op,
+      lowerer.coerceToExpected(read, DYN),
+      lowerer.coerceToExpected(rhs, DYN),
+      loc,
+    );
+  } else {
+    compoundUnsupported(lowerer, access, op, read.type, rhs.type);
+  }
+  if (storedString && rhs.type.kind === "string" && read.kind === "varRef" && appended !== null) {
+    // The field gives up its value before the concat (no code runs in
+    // between: both operands are already strings), and the concat is the
+    // self-append `old = old + rhs`, which hands the local's reference to
+    // the runtime: the old string is then uniquely owned unless something
+    // else holds it, and is appended to in place. Repeated `this.text += s`
+    // is linear rather than a copy per append.
+    const oldId = read.localId;
+    const oldLoc = read.loc;
+    const oldRef = (): IrExpr => varRef(oldId, STRING, oldLoc);
+    const concat: IrExpr = {
+      kind: "strConcat",
+      left: oldRef(),
+      right: appended,
+      type: STRING,
+      loc,
+    };
+    body.push(
+      lowerer.fieldSetStmt(target, { kind: "strLit", value: "", type: STRING, loc }, loc, access),
+      { kind: "assign", localId: oldId, value: concat, loc },
+      lowerer.fieldSetStmt(target, oldRef(), loc, access),
+    );
+    return { kind: "seqExpr", stmts: body, result: oldRef(), type: STRING, loc };
+  }
+  const result = save(value, "%compoundResult");
+  body.push(
+    lowerer.fieldSetStmt(target, lowerer.coerceInto(access, result, target.fieldType), loc, access),
+  );
+  return { kind: "seqExpr", stmts: body, result, type: result.type, loc };
+}
diff --git a/packages/compiler/src/frontend/lowering/function-returns.ts b/packages/compiler/src/frontend/lowering/function-returns.ts
index f413f4680..c0e70013c 100644
--- a/packages/compiler/src/frontend/lowering/function-returns.ts
+++ b/packages/compiler/src/frontend/lowering/function-returns.ts
@@ -1,3 +1,4 @@
+import { mapAsyncGeneratorAnnotation } from "../type-mapper.js";
 import { dynUndefinedExpr } from "../../ir/build.js";
 import * as ts from "../ts7/adapter.js";
 import type { Lowerer } from "./lowerer.js";
@@ -146,6 +147,12 @@ export function declaredReturnType(
   // (`.action(() => { throw ... })`). `never` VALUES stay unmapped.
   if (retTsType.flags & ts.TypeFlags.Never) return VOID;
   let mappedReturn = lowerer.mapTypeOf(retTsType);
+  if (
+    mappedReturn === null &&
+    decl.asteriskToken &&
+    decl.modifiers?.nodes.some((modifier) => modifier.kind === ts.SyntaxKind.AsyncKeyword)
+  )
+    mappedReturn = mapAsyncGeneratorAnnotation(retTsType, lowerer.typeCtx);
   if (
     isJsSourceFile(decl.getSourceFile()) &&
     decl.modifiers?.nodes.some((modifier) => modifier.kind === ts.SyntaxKind.AsyncKeyword) &&
diff --git a/packages/compiler/src/frontend/lowering/generator-dynamic-dispatch.ts b/packages/compiler/src/frontend/lowering/generator-dynamic-dispatch.ts
index 10505e063..ca6a5ecdc 100644
--- a/packages/compiler/src/frontend/lowering/generator-dynamic-dispatch.ts
+++ b/packages/compiler/src/frontend/lowering/generator-dynamic-dispatch.ts
@@ -7,6 +7,7 @@ import {
   funcOf,
   typeEquals,
   typeKey,
+  VOID,
   type IrExpr,
   type IrFunction,
   type IrStmt,
@@ -18,6 +19,22 @@ import type { Lowerer } from "./lowerer.js";
 
 type GeneratorType = Extract<IrType, { kind: "generator" }>;
 type Invoke = Extract<IrExpr, { kind: "dynInvoke" }>;
+type KeyGet = Extract<IrExpr, { kind: "dynKeyGet" }>;
+
+/** The iterator helper methods the runtime answers on checked iterators. */
+const HELPER_METHODS = new Set([
+  "map",
+  "filter",
+  "take",
+  "drop",
+  "flatMap",
+  "reduce",
+  "toArray",
+  "forEach",
+  "some",
+  "every",
+  "find",
+]);
 
 /** An untyped consumer resumes the original native fiber. The capsule's
  * exact type key selects the channel conversions and result layout. */
@@ -29,6 +46,54 @@ export class GeneratorDynamicDispatch {
   >();
   private readonly generated = new Set<IrFunction>();
   private readonly properties = new Map<string, { fn: IrFunction; types: Set<string> }>();
+  /** Whether %main registers the next/return getters with the runtime. */
+  private membersRegistered = false;
+
+  /** The getter for a generator capsule's `method` (next, return, throw or
+   * an iterator helper): a checked function over the capsule's type keys
+   * that answers the method as a function value. `read` is the dyn read
+   * whose fallback it keeps for other receivers. */
+  private ensureProperty(lowerer: Lowerer, method: string, read: KeyGet): IrFunction {
+    const existing = this.properties.get(method);
+    if (existing) return existing.fn;
+    const loc = read.loc;
+    const fn: IrFunction = {
+      name: `%dyn.generator.get.${method}`,
+      params: [{ localId: "value", name: "value", type: DYN }],
+      returnType: DYN,
+      locals: [{ id: "value", name: "value", type: DYN, mutable: false }],
+      body: [{ kind: "return", value: { ...read, value: varRef("value", DYN, loc) }, loc }],
+      loc,
+    };
+    this.properties.set(method, { fn, types: new Set() });
+    this.generated.add(fn);
+    lowerer.liftedFns.push(fn);
+    // The runtime's own helper functions answer the helper methods.
+    if (HELPER_METHODS.has(method)) return fn;
+    lowerer.liftedFns.push({
+      name: `%dyn.generator.method.${method}`,
+      params: [{ localId: "arg", name: "arg", type: DYN }],
+      returnType: DYN,
+      locals: [{ id: "arg", name: "arg", type: DYN, mutable: false }],
+      body: [
+        {
+          kind: "return",
+          value: {
+            kind: "dynInvoke",
+            method,
+            calleeName: `Generator.${method}`,
+            recv: { kind: "libCall", fn: "dyn.this", args: [], type: DYN, loc },
+            args: [varRef("arg", DYN, loc)],
+            type: DYN,
+            loc,
+          },
+          loc,
+        },
+      ],
+      loc,
+    });
+    return fn;
+  }
 
   process(
     lowerer: Lowerer,
@@ -37,6 +102,7 @@ export class GeneratorDynamicDispatch {
   ): boolean {
     const seen = new Set<string>();
     const rewrite = new Set<IrFunction>();
+    let runtimeSteps = false;
     const discover = (type: IrType): void => {
       const key = typeKey(type);
       if (seen.has(key)) return;
@@ -56,10 +122,22 @@ export class GeneratorDynamicDispatch {
           if (expr.kind === "dynFrom") discover(expr.value.type);
           if (expr.kind === "dynInvoke" && ["next", "return", "throw"].includes(expr.method))
             rewrite.add(fn);
+          // The runtime steps the values iterator helpers and destructuring
+          // receive.
+          if (
+            (expr.kind === "dynInvoke" && HELPER_METHODS.has(expr.method)) ||
+            (expr.kind === "dynKeyGet" &&
+              expr.key.kind === "strLit" &&
+              HELPER_METHODS.has(expr.key.value)) ||
+            expr.kind === "dynIterN" ||
+            (expr.kind === "libCall" && expr.fn === "dyn.destructureRest")
+          )
+            runtimeSteps = true;
           if (
             expr.kind === "dynKeyGet" &&
             expr.key.kind === "strLit" &&
-            ["next", "return", "throw"].includes(expr.key.value)
+            (["next", "return", "throw"].includes(expr.key.value) ||
+              HELPER_METHODS.has(expr.key.value))
           )
             rewrite.add(fn);
           return true;
@@ -74,56 +152,20 @@ export class GeneratorDynamicDispatch {
       fn.body = transformStmtList(fn.body, {
         stmt: (stmt) => stmt,
         expr: (expr) => {
+          // A helper method read reaches the runtime's helpers through the
+          // same getters once generators are boxed.
           if (
             expr.kind === "dynKeyGet" &&
             expr.key.kind === "strLit" &&
-            ["next", "return", "throw"].includes(expr.key.value)
+            (["next", "return", "throw"].includes(expr.key.value) ||
+              (HELPER_METHODS.has(expr.key.value) && this.generators.size > 0))
           ) {
             const method = expr.key.value;
-            let property = this.properties.get(method);
-            if (!property) {
-              const loc = expr.loc;
-              const fn: IrFunction = {
-                name: `%dyn.generator.get.${method}`,
-                params: [{ localId: "value", name: "value", type: DYN }],
-                returnType: DYN,
-                locals: [{ id: "value", name: "value", type: DYN, mutable: false }],
-                body: [
-                  { kind: "return", value: { ...expr, value: varRef("value", DYN, loc) }, loc },
-                ],
-                loc,
-              };
-              property = { fn, types: new Set() };
-              this.properties.set(method, property);
-              this.generated.add(fn);
-              lowerer.liftedFns.push(fn);
-              lowerer.liftedFns.push({
-                name: `%dyn.generator.method.${method}`,
-                params: [{ localId: "arg", name: "arg", type: DYN }],
-                returnType: DYN,
-                locals: [{ id: "arg", name: "arg", type: DYN, mutable: false }],
-                body: [
-                  {
-                    kind: "return",
-                    value: {
-                      kind: "dynInvoke",
-                      method,
-                      calleeName: `Generator.${method}`,
-                      recv: { kind: "libCall", fn: "dyn.this", args: [], type: DYN, loc },
-                      args: [varRef("arg", DYN, loc)],
-                      type: DYN,
-                      loc,
-                    },
-                    loc,
-                  },
-                ],
-                loc,
-              });
-              changed = true;
-            }
+            if (!this.properties.has(method)) changed = true;
+            const getter = this.ensureProperty(lowerer, method, expr);
             return {
               kind: "call",
-              callee: property.fn.name,
+              callee: getter.name,
               args: [expr.value],
               type: DYN,
               loc: expr.loc,
@@ -179,6 +221,50 @@ export class GeneratorDynamicDispatch {
         },
       });
     }
+    // Iterator helpers called on untyped values may reach a compiled
+    // generator's capsule; the runtime drives it through these getters,
+    // which %main registers first.
+    const firstFn = functions[0];
+    if (
+      runtimeSteps &&
+      !this.membersRegistered &&
+      firstFn !== undefined &&
+      [...this.generators.values()].some((t) => t.async !== true)
+    ) {
+      const loc = firstFn.loc;
+      const read = (method: string): KeyGet => ({
+        kind: "dynKeyGet",
+        value: varRef("value", DYN, loc),
+        key: { kind: "strLit", value: method, type: STRING, loc },
+        type: DYN,
+        loc,
+      });
+      const getterValue = (method: string): IrExpr => ({
+        kind: "dynFrom",
+        value: {
+          kind: "closure",
+          fnName: this.ensureProperty(lowerer, method, read(method)).name,
+          captures: [],
+          type: funcOf([DYN], DYN),
+          loc,
+        },
+        type: DYN,
+        loc,
+      });
+      lowerer.mainPrelude.push({
+        kind: "exprStmt",
+        expr: {
+          kind: "libCall",
+          fn: "dyn.setGeneratorMembers",
+          args: [getterValue("next"), getterValue("return")],
+          type: VOID,
+          loc,
+        },
+        loc,
+      });
+      this.membersRegistered = true;
+      changed = true;
+    }
     for (const [method, property] of this.properties)
       for (const [key] of this.generators) {
         if (property.types.has(key)) continue;
@@ -196,18 +282,26 @@ export class GeneratorDynamicDispatch {
           then: [
             {
               kind: "return",
-              value: {
-                kind: "dynFrom",
-                value: {
-                  kind: "closure",
-                  fnName: `%dyn.generator.method.${method}`,
-                  captures: [],
-                  type: funcOf([DYN], DYN),
-                  loc,
-                },
-                type: DYN,
-                loc,
-              },
+              value: HELPER_METHODS.has(method)
+                ? {
+                    kind: "libCall",
+                    fn: "dyn.iteratorHelperMethod",
+                    args: [{ kind: "strLit", value: method, type: STRING, loc }],
+                    type: DYN,
+                    loc,
+                  }
+                : {
+                    kind: "dynFrom",
+                    value: {
+                      kind: "closure",
+                      fnName: `%dyn.generator.method.${method}`,
+                      captures: [],
+                      type: funcOf([DYN], DYN),
+                      loc,
+                    },
+                    type: DYN,
+                    loc,
+                  },
               loc,
             },
           ],
@@ -228,10 +322,14 @@ export class GeneratorDynamicDispatch {
         const supplied = dispatch.source.args.length > 0;
         const incoming = supplied ? varRef("p.1", DYN, loc) : dynUndefinedExpr(loc);
         const channel = mode === "next" ? type.nextT : type.retT;
+        // return() with no value completes with undefined, as the typed
+        // .return() does, whatever the return channel's type.
         const arg =
           mode === "throw"
             ? incoming
-            : channel.kind === "undefinedT" || channel.kind === "void"
+            : channel.kind === "undefinedT" ||
+                channel.kind === "void" ||
+                (mode === "return" && !supplied)
               ? null
               : lowerer.coerceToExpected(incoming, channel);
         const convertible = canConvertToDyn(
@@ -263,25 +361,36 @@ export class GeneratorDynamicDispatch {
             else_: null,
             loc,
           });
+        const resume = (sent: IrExpr | null): IrStmt => ({
+          kind: "return",
+          value: {
+            kind: "dynFrom",
+            value: {
+              kind: "genResume",
+              mode,
+              gen: { kind: "dynCheck", value: receiver, type, loc },
+              arg: sent,
+              type: resultType,
+              loc,
+            },
+            type: DYN,
+            loc,
+          },
+          loc,
+        });
+        const valid =
+          convertible && (arg === null || mode === "throw" || typeEquals(arg.type, channel));
+        if (valid && mode === "return" && arg !== null)
+          body.push({
+            kind: "if",
+            cond: { kind: "dynTest", test: "undefined", value: incoming, type: BOOL, loc },
+            then: [resume(null)],
+            else_: null,
+            loc,
+          });
         body.push(
-          convertible && (arg === null || mode === "throw" || typeEquals(arg.type, channel))
-            ? {
-                kind: "return",
-                value: {
-                  kind: "dynFrom",
-                  value: {
-                    kind: "genResume",
-                    mode,
-                    gen: { kind: "dynCheck", value: receiver, type, loc },
-                    arg,
-                    type: resultType,
-                    loc,
-                  },
-                  type: DYN,
-                  loc,
-                },
-                loc,
-              }
+          valid
+            ? resume(arg)
             : {
                 kind: "runtimeFence",
                 code: "SC1071",
diff --git a/packages/compiler/src/frontend/lowering/generic-functions.ts b/packages/compiler/src/frontend/lowering/generic-functions.ts
index bf5f2563d..f588faf6d 100644
--- a/packages/compiler/src/frontend/lowering/generic-functions.ts
+++ b/packages/compiler/src/frontend/lowering/generic-functions.ts
@@ -187,9 +187,9 @@ function requireStableGenericBinding(
   name: string,
 ): void {
   const isConst = (ts.getCombinedNodeFlags(decl) & ts.NodeFlags.Const) !== 0;
-  const redeclared = lowerer.checker
-    .declarationsOf(symbol)
-    .some((d) => d !== decl && ts.isVariableDeclaration(d) && d.initializer !== undefined);
+  const redeclared = symbol.declarations.some(
+    (d) => d !== decl && ts.isVariableDeclaration(d) && d.initializer !== undefined,
+  );
   if (!isConst && (redeclared || !bindingNeverReassigned(lowerer, symbol, decl))) {
     lowerer.unsupported(
       "SC1090",
@@ -266,7 +266,7 @@ export function genericCallInstance(
   // honest story (monomorphize per implementation signature with the
   // reconcile bridge, like the non-generic path).
   {
-    const rdecl = rsig ? lowerer.checker.signatureDeclaration(rsig) : undefined;
+    const rdecl = rsig ? rsig.declaration : undefined;
     if (
       rdecl &&
       (ts.isFunctionDeclaration(rdecl) || ts.isMethodDeclaration(rdecl)) &&
@@ -451,7 +451,7 @@ function localClassOfResult(
 ): ts.ClassLikeDeclaration | null {
   const symbol = type.getSymbol();
   if (!symbol || !(symbol.flags & ts.SymbolFlags.Class)) return null;
-  const decl = lowerer.checker.valueDeclarationOf(symbol);
+  const decl = symbol.valueDeclaration;
   if (!decl || !(ts.isClassExpression(decl) || ts.isClassDeclaration(decl))) return null;
   for (let parent = decl.parent; parent && !ts.isSourceFile(parent); parent = parent.parent)
     if (parent === info.decl) return decl;
@@ -1549,9 +1549,9 @@ function implicitDeclaredReturn(lowerer: Lowerer, info: GenericFnInfo): IrType |
         const symbol = lowerer.resolveValueSymbol(node.expression);
         if (
           symbol &&
-          lowerer.checker
-            .declarationsOf(symbol)
-            .some((decl) => ts.isVariableDeclaration(decl) && jsBindingHasOpenWrites(lowerer, decl))
+          symbol.declarations.some(
+            (decl) => ts.isVariableDeclaration(decl) && jsBindingHasOpenWrites(lowerer, decl),
+          )
         )
           openReturn = true;
         return undefined;
@@ -2041,9 +2041,9 @@ export function implicitLocalFnNodeOf(
     const sym = lowerer.checker.getSymbolAtLocation(decl.name);
     if (!sym) return null;
     const isConst = (ts.getCombinedNodeFlags(decl) & ts.NodeFlags.Const) !== 0;
-    const redeclared = lowerer.checker
-      .declarationsOf(sym)
-      .some((d) => d !== decl && ts.isVariableDeclaration(d) && d.initializer !== undefined);
+    const redeclared = sym.declarations.some(
+      (d) => d !== decl && ts.isVariableDeclaration(d) && d.initializer !== undefined,
+    );
     if (redeclared) return null;
     if (!isConst && !bindingNeverReassigned(lowerer, sym, decl)) return null;
     // The capture scan: instances are module functions with no frame.
@@ -2059,7 +2059,7 @@ export function implicitLocalFnNodeOf(
       }
       if (ts.isIdentifier(n)) {
         const s = lowerer.checker.getSymbolAtLocation(n);
-        const d = s ? lowerer.checker.valueDeclarationOf(s) : undefined;
+        const d = s ? s.valueDeclaration : undefined;
         if (
           d &&
           d.getSourceFile() === decl.getSourceFile() &&
@@ -2146,7 +2146,7 @@ export function objLitGenericFnNodeOf(
   fnNode: ts.MethodDeclaration | ts.FunctionExpression | ts.ArrowFunction;
   literal: ts.ObjectLiteralExpression;
 } | null {
-  const decl = lowerer.checker.valueDeclarationOf(propSym);
+  const decl = propSym.valueDeclaration;
   if (!decl) return null;
   if (ts.isMethodDeclaration(decl) && ts.isObjectLiteralExpression(decl.parent)) {
     return decl.typeParameters !== undefined && decl.body !== undefined
@@ -2420,7 +2420,7 @@ export function requireObjLitGenericReceiver(
     );
   if (!ts.isIdentifier(recv)) fenceReceiver();
   const recvSym = lowerer.resolveValueSymbol(recv);
-  const recvDecl = recvSym ? lowerer.checker.valueDeclarationOf(recvSym) : undefined;
+  const recvDecl = recvSym ? recvSym.valueDeclaration : undefined;
   if (
     !recvDecl ||
     !ts.isVariableDeclaration(recvDecl) ||
diff --git a/packages/compiler/src/frontend/lowering/js-dynamic-objects.ts b/packages/compiler/src/frontend/lowering/js-dynamic-objects.ts
index 8f17a2448..d39e5cceb 100644
--- a/packages/compiler/src/frontend/lowering/js-dynamic-objects.ts
+++ b/packages/compiler/src/frontend/lowering/js-dynamic-objects.ts
@@ -190,9 +190,9 @@ export function lowerValueReturningConstructorNew(
   if (symbol !== null && (symbol.flags & ts.SymbolFlags.Alias) !== 0)
     symbol = lowerer.checker.getAliasedSymbol(symbol);
   const decl = symbol
-    ? lowerer.checker
-        .declarationsOf(symbol)
-        .find((node): node is ts.ClassDeclaration => ts.isClassDeclaration(node) && isDynamic(node))
+    ? symbol.declarations.find(
+        (node): node is ts.ClassDeclaration => ts.isClassDeclaration(node) && isDynamic(node),
+      )
     : undefined;
   if (decl === undefined) return null;
   const loc = locOf(expr);
diff --git a/packages/compiler/src/frontend/lowering/key-order-witness.test.ts b/packages/compiler/src/frontend/lowering/key-order-witness.test.ts
new file mode 100644
index 000000000..01f632cf3
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/key-order-witness.test.ts
@@ -0,0 +1,329 @@
+import { expect, test } from "vitest";
+import { F64, type IrExpr, type IrFunction, type IrStmt, type IrType } from "../../ir/ir.js";
+import { ShapeRegistry } from "../type-mapper.js";
+import {
+  applyKeyOrderWitnesses,
+  KeyOrderNotes,
+  type KeyOrderSegment,
+} from "./key-order-witness.js";
+import type { Lowerer } from "./lowerer.js";
+
+const loc = { file: "order.ts", start: 0, end: 1 };
+/** `number | undefined`: the optional-field slot type. */
+const OPT: IrType = { kind: "union", unionId: "u0" };
+const num = (value: number): IrExpr => ({ kind: "numLit", value, type: F64, loc });
+const absent: IrExpr = { kind: "fieldAbsent", unionId: "u0", type: OPT, loc };
+
+interface Fixture {
+  lowerer: Lowerer;
+  shapes: ShapeRegistry;
+  notes: KeyOrderNotes;
+  record(fields: [string, IrType][], order: string[]): IrType & { kind: "record" };
+  literal(type: IrType, keys: string[], segments?: KeyOrderSegment[]): IrExpr;
+  run(body: IrStmt[]): void;
+  order(type: IrType & { kind: "record" }): string[] | undefined;
+}
+
+function fixture(): Fixture {
+  const shapes = new ShapeRegistry();
+  const notes = new KeyOrderNotes();
+  const lowerer = {
+    shapes,
+    keyOrder: notes,
+    unions: new Map([["u0", { id: "u0", arms: [F64, { kind: "undefinedT" }] }]]),
+    classes: new Map(),
+    armTag: (unionId: string, arm: IrType): number =>
+      unionId === "u0" && arm.kind === "undefinedT" ? 1 : -1,
+  } as unknown as Lowerer;
+  const record = (fields: [string, IrType][], order: string[]): IrType & { kind: "record" } => ({
+    kind: "record",
+    shapeId: shapes.intern(
+      [...fields].sort((a, b) => (a[0] < b[0] ? -1 : 1)).map(([name, type]) => ({ name, type })),
+      false,
+      undefined,
+      order,
+    ),
+  });
+  const literal = (type: IrType, keys: string[], segments?: KeyOrderSegment[]): IrExpr => {
+    const shape = shapes.get((type as IrType & { kind: "record" }).shapeId)!;
+    const fields = keys.map((name) => ({ name, value: num(1) }));
+    for (const f of shape.fields)
+      if (!keys.includes(f.name)) fields.push({ name: f.name, value: absent });
+    return notes.literal(
+      { kind: "recordLit", fields, type, loc },
+      segments ?? keys.map((name) => ({ kind: "key", name, definite: true })),
+    );
+  };
+  const run = (body: IrStmt[]): void => {
+    const fn: IrFunction = { name: "main", params: [], returnType: F64, locals: [], body, loc };
+    applyKeyOrderWitnesses(lowerer, [fn]);
+  };
+  const order = (type: IrType & { kind: "record" }): string[] | undefined =>
+    shapes.get(type.shapeId)?.declaredOrder;
+  return { lowerer, shapes, notes, record, literal, run, order };
+}
+
+const observe = (value: IrExpr): IrStmt => ({
+  kind: "exprStmt",
+  expr: { kind: "jsonStringify", value, type: { kind: "string" }, loc },
+  loc,
+});
+const decl = (localId: string, init: IrExpr): IrStmt => ({ kind: "varDecl", localId, init, loc });
+const ref = (localId: string, type: IrType): IrExpr => ({ kind: "varRef", localId, type, loc });
+const set = (obj: IrExpr, field: string): IrStmt => ({
+  kind: "recordSet",
+  obj,
+  shapeId: (obj.type as IrType & { kind: "record" }).shapeId,
+  field,
+  value: num(2),
+  loc,
+});
+
+test("a shape takes the one order its literals write", () => {
+  const f = fixture();
+  const ab = f.record(
+    [
+      ["a", F64],
+      ["b", F64],
+    ],
+    ["a", "b"],
+  );
+  f.run([observe(f.literal(ab, ["b", "a"])), observe(f.literal(ab, ["b", "a"]))]);
+  expect(f.order(ab)).toEqual(["b", "a"]);
+  expect(f.notes.changed.has(ab.shapeId)).toBe(true);
+});
+
+test("literals that agree with the table leave the same array in place", () => {
+  const f = fixture();
+  const ab = f.record(
+    [
+      ["a", F64],
+      ["b", F64],
+    ],
+    ["a", "b"],
+  );
+  const before = f.order(ab);
+  f.run([observe(f.literal(ab, ["a", "b"]))]);
+  expect(f.order(ab)).toBe(before);
+  expect(f.notes.changed.size).toBe(0);
+});
+
+test("values built in two orders keep today's table", () => {
+  const f = fixture();
+  const ab = f.record(
+    [
+      ["a", F64],
+      ["b", F64],
+    ],
+    ["a", "b"],
+  );
+  f.run([observe(f.literal(ab, ["b", "a"])), observe(f.literal(ab, ["a", "b"]))]);
+  expect(f.order(ab)).toEqual(["a", "b"]);
+});
+
+test("an unobserved shape keeps today's table", () => {
+  const f = fixture();
+  const ab = f.record(
+    [
+      ["a", F64],
+      ["b", F64],
+    ],
+    ["a", "b"],
+  );
+  f.run([decl("x", f.literal(ab, ["b", "a"]))]);
+  expect(f.order(ab)).toEqual(["a", "b"]);
+});
+
+test("a synthesized construction pins today's table", () => {
+  const f = fixture();
+  const ab = f.record(
+    [
+      ["a", F64],
+      ["b", F64],
+    ],
+    ["a", "b"],
+  );
+  const synthesized: IrExpr = {
+    kind: "recordLit",
+    fields: [
+      { name: "a", value: num(1) },
+      { name: "b", value: num(2) },
+    ],
+    type: ab,
+    loc,
+  };
+  f.run([observe(f.literal(ab, ["b", "a"])), observe(synthesized)]);
+  expect(f.order(ab)).toEqual(["a", "b"]);
+});
+
+test("a checked conversion pins today's table", () => {
+  const f = fixture();
+  const ab = f.record(
+    [
+      ["a", F64],
+      ["b", F64],
+    ],
+    ["a", "b"],
+  );
+  const parsed: IrExpr = { kind: "dynCheck", value: ref("j", { kind: "dyn" }), type: ab, loc };
+  f.run([observe(f.literal(ab, ["b", "a"])), observe(parsed)]);
+  expect(f.order(ab)).toEqual(["a", "b"]);
+});
+
+test("a spread contributes its source's order, and an override keeps its position", () => {
+  const f = fixture();
+  const src = f.record(
+    [
+      ["a", F64],
+      ["b", F64],
+    ],
+    ["a", "b"],
+  );
+  const out = f.record(
+    [
+      ["a", F64],
+      ["b", F64],
+      ["c", F64],
+    ],
+    ["a", "b", "c"],
+  );
+  const spread: KeyOrderSegment = { kind: "spread", shapeId: src.shapeId, maybeAbsent: false };
+  f.run([
+    decl("s", f.literal(src, ["b", "a"])),
+    // { ...s, a: 1, c: 2 } — `a` stays where the spread put it.
+    observe(
+      f.literal(
+        out,
+        ["a", "b", "c"],
+        [
+          spread,
+          { kind: "key", name: "a", definite: true },
+          { kind: "key", name: "c", definite: true },
+        ],
+      ),
+    ),
+  ]);
+  expect(f.order(out)).toEqual(["b", "a", "c"]);
+});
+
+test("a spread of a checked-conversion source cannot be ordered statically", () => {
+  const f = fixture();
+  const src = f.record(
+    [
+      ["a", F64],
+      ["b", F64],
+    ],
+    ["a", "b"],
+  );
+  const out = f.record(
+    [
+      ["a", F64],
+      ["b", F64],
+      ["c", F64],
+    ],
+    ["c", "a", "b"],
+  );
+  const parsed: IrExpr = { kind: "dynCheck", value: ref("j", { kind: "dyn" }), type: src, loc };
+  const spread: KeyOrderSegment = { kind: "spread", shapeId: src.shapeId, maybeAbsent: false };
+  f.run([
+    decl("s", parsed),
+    observe(f.literal(out, ["a", "b", "c"], [spread, { kind: "key", name: "c", definite: true }])),
+  ]);
+  expect(f.order(out)).toEqual(["c", "a", "b"]);
+});
+
+test("a late-only optional key follows the keys values are built with", () => {
+  const f = fixture();
+  const o = f.record(
+    [
+      ["a", OPT],
+      ["b", F64],
+    ],
+    ["a", "b"],
+  );
+  f.run([decl("o", f.literal(o, ["b"])), set(ref("o", o), "a"), observe(ref("o", o))]);
+  expect(f.order(o)).toEqual(["b", "a"]);
+});
+
+test("straight-line writes of late-only keys keep program order", () => {
+  const f = fixture();
+  const o = f.record(
+    [
+      ["id", F64],
+      ["x", OPT],
+      ["y", OPT],
+    ],
+    ["id", "x", "y"],
+  );
+  f.run([
+    decl("o", f.literal(o, ["id"])),
+    set(ref("o", o), "y"),
+    set(ref("o", o), "x"),
+    observe(ref("o", o)),
+  ]);
+  expect(f.order(o)).toEqual(["id", "y", "x"]);
+});
+
+test("late-only keys written through different bindings keep today's table", () => {
+  const f = fixture();
+  const o = f.record(
+    [
+      ["id", F64],
+      ["x", OPT],
+      ["y", OPT],
+    ],
+    ["id", "x", "y"],
+  );
+  f.run([
+    decl("o", f.literal(o, ["id"])),
+    set(ref("o", o), "y"),
+    set(ref("p", o), "x"),
+    observe(ref("o", o)),
+  ]);
+  expect(f.order(o)).toEqual(["id", "x", "y"]);
+});
+
+test("a late-only key written in a loop over an outer binding keeps today's table", () => {
+  const f = fixture();
+  const o = f.record(
+    [
+      ["id", F64],
+      ["x", OPT],
+      ["y", OPT],
+    ],
+    ["id", "x", "y"],
+  );
+  f.run([
+    decl("o", f.literal(o, ["id"])),
+    set(ref("o", o), "y"),
+    {
+      kind: "while",
+      cond: { kind: "boolLit", value: false, type: { kind: "bool" }, loc },
+      body: [set(ref("o", o), "x")],
+      loc,
+    },
+    observe(ref("o", o)),
+  ]);
+  expect(f.order(o)).toEqual(["id", "x", "y"]);
+});
+
+test("re-adding a key a literal creates earlier keeps today's table", () => {
+  const f = fixture();
+  const o = f.record(
+    [
+      ["a", OPT],
+      ["b", F64],
+    ],
+    ["a", "b"],
+  );
+  const del: IrStmt = {
+    kind: "recordSet",
+    obj: ref("o", o),
+    shapeId: o.shapeId,
+    field: "a",
+    value: absent,
+    loc,
+  };
+  f.run([decl("o", f.literal(o, ["a", "b"])), del, set(ref("o", o), "a"), observe(ref("o", o))]);
+  expect(f.order(o)).toEqual(["a", "b"]);
+});
diff --git a/packages/compiler/src/frontend/lowering/key-order-witness.ts b/packages/compiler/src/frontend/lowering/key-order-witness.ts
new file mode 100644
index 000000000..ba8001792
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/key-order-witness.ts
@@ -0,0 +1,675 @@
+/* Record enumeration order chosen from the orders values are built in.
+ *
+ * Node enumerates an object's string keys as canonical array indices
+ * ascending, then every other key in creation order. A record stores its
+ * fields name-sorted and enumerates them through one per-shape table,
+ * `IrRecordShape.declaredOrder`, which the type mapper fills with the
+ * checker's property order of the first type interned to the shape. That
+ * table is exact only while every value of the shape is created in that
+ * order. This pass replaces it, after lowering, with the order the
+ * program's construction sites actually create, when that order is one
+ * order. It changes the table's contents only: storage layout, shape
+ * identity and every helper's structure stay as they are, so the generated
+ * code differs only in the constant order the enumeration surfaces walk.
+ *
+ * Witnesses, per shape:
+ *  - an object literal contributes the order it writes its keys in. Spread
+ *    segments contribute their source shape's order (an inheritance edge,
+ *    never the desugar's field list), and a key keeps the position of its
+ *    first occurrence, so an override inside a spread stays where the
+ *    spread put it. A key whose earlier occurrence may be absent at run
+ *    time contributes every position it can take;
+ *  - a width copy or a rest binding contributes its source shape's order;
+ *  - any other construction (synthesized builtin results, opaque runtime
+ *    producers) pins today's table;
+ *  - checked conversions from dynamic values (typed JSON.parse, values
+ *    from JavaScript) pin today's table: the record-source table keeps
+ *    their own key order relative to it, and another table would make
+ *    values parsed in today's order keep a source view. Their order is
+ *    unknown, so a copy out of such a shape cannot be ordered statically;
+ *  - a write to an optional key that may be absent appends it in Node. A
+ *    key no construction creates ("late-only") goes after every key a
+ *    construction can create; any other moving write goes after every key.
+ *    Two late-only keys are ordered only by a straight-line sequence of
+ *    writes through one binding.
+ *
+ * The orders merge into a precedence graph per shape, topologically sorted
+ * with ties broken by today's table, so a shape whose witnesses agree with
+ * the table keeps it untouched. A cycle means the order depends on the
+ * value: that shape, and every shape copied from it, keeps today's table
+ * (and today's SC6002 warnings). Shapes that no order surface observes
+ * keep today's table too. */
+import type { IrExpr, IrFunction, IrRecordShape, IrStmt, IrType } from "../../ir/ir.js";
+import { shapeHasAccessorSlots, typeEquals, UNDEFINED_T } from "../../ir/ir.js";
+import { everyExprChild, everyStmtChild, everyTypeChild } from "../../ir/traverse.js";
+import type { Lowerer } from "./lowerer.js";
+
+/** One property of an object literal, in source order. */
+export type KeyOrderSegment =
+  /** An explicit key (`definite`), or a conditional spread's key, which
+   * exists only when its condition holds. */
+  | { kind: "key"; name: string; definite: boolean }
+  /** `...source` of a record shape; `maybeAbsent` when the whole source
+   * can be undefined (`...options` of `T | undefined`). */
+  | { kind: "spread"; shapeId: string; maybeAbsent: boolean }
+  /** A spread whose keys are only known at run time. */
+  | { kind: "opaque" };
+
+/** Witness notes the lowering attaches to the IR nodes it builds. Keyed by
+ * node identity, so nodes a speculative lowering discards are never walked,
+ * and a node some later pass rebuilds falls back to pinning. */
+export class KeyOrderNotes {
+  private readonly literals = new Map<IrExpr, KeyOrderSegment[]>();
+  private readonly copies = new Map<IrExpr, string>();
+  /** Shapes a frontend order surface (keys, values/entries, inspect,
+   * index-signature merges) walks. */
+  readonly observed = new Set<string>();
+  /** Shapes whose table this pass replaced. */
+  readonly changed = new Set<string>();
+
+  literal(node: IrExpr, segments: KeyOrderSegment[]): IrExpr {
+    this.literals.set(node, segments);
+    return node;
+  }
+
+  copy(node: IrExpr, sourceShapeId: string): IrExpr {
+    this.copies.set(node, sourceShapeId);
+    return node;
+  }
+
+  observe(type: IrType): void {
+    if (type.kind === "record") this.observed.add(type.shapeId);
+  }
+
+  literalOf(node: IrExpr): KeyOrderSegment[] | undefined {
+    return this.literals.get(node);
+  }
+
+  copyOf(node: IrExpr): string | undefined {
+    return this.copies.get(node);
+  }
+}
+
+const isArrayIndex = (name: string): boolean => {
+  const n = Number(name);
+  return Number.isInteger(n) && n >= 0 && n < 4294967295 && String(n) === name;
+};
+
+interface WriteSite {
+  field: string;
+  kind: "write" | "delete" | "clone";
+  fn: string;
+  binding: string | null;
+  loop: string;
+  pos: number;
+}
+
+interface BindingInit {
+  count: number;
+  fn: string;
+  loop: string;
+  pos: number;
+  fresh: boolean;
+}
+
+interface ShapeFacts {
+  literals: KeyOrderSegment[][];
+  copies: { source: string; keys: Set<string> }[];
+  /** A construction in today's order (synthesized literal). */
+  pinned: boolean;
+  /** An opaque runtime producer: today's order, any key may be absent. */
+  opaque: boolean;
+  /** A checked conversion from a dynamic value. */
+  runtime: boolean;
+  clones: boolean;
+  present: Set<string>;
+  absent: Set<string>;
+  deleted: Set<string>;
+  writes: WriteSite[];
+}
+
+type Resolved = { order: string[] } | "unknown";
+
+/** `structuredClone(v)` checked back into v's own type: the copy is built
+ * from v's dyn view, so it creates exactly v's keys in v's order. */
+function orderPreservingClone(node: IrExpr & { kind: "dynCheck" }): boolean {
+  const value = node.value;
+  if (value.kind !== "libCall" || value.fn !== "dyn.structuredClone") return false;
+  const source = value.args[0];
+  return (
+    source !== undefined && source.kind === "dynFrom" && typeEquals(source.value.type, node.type)
+  );
+}
+
+/** Chooses each in-scope record shape's enumeration table from its
+ * witnesses. Runs once retained reachability has settled the historical
+ * tables and derived metadata, before the order-snapshotting helper bodies
+ * rebuild. */
+export function applyKeyOrderWitnesses(lowerer: Lowerer, fns: readonly IrFunction[]): void {
+  const notes = lowerer.keyOrder;
+  const shapes = lowerer.shapes;
+  const facts = new Map<string, ShapeFacts>();
+  const factsOf = (shapeId: string): ShapeFacts => {
+    let f = facts.get(shapeId);
+    if (f === undefined) {
+      f = {
+        literals: [],
+        copies: [],
+        pinned: false,
+        opaque: false,
+        runtime: false,
+        clones: false,
+        present: new Set(),
+        absent: new Set(),
+        deleted: new Set(),
+        writes: [],
+      };
+      facts.set(shapeId, f);
+    }
+    return f;
+  };
+  const observedRoots: IrType[] = [];
+  const inits = new Map<string, BindingInit>();
+  const undefinedArmed = (t: IrType): boolean =>
+    t.kind === "union" && lowerer.armTag(t.unionId, UNDEFINED_T) >= 0;
+  const containsAbsent = (value: IrExpr): boolean =>
+    value.kind === "fieldAbsent" ||
+    (value.kind === "ternary" && (containsAbsent(value.then) || containsAbsent(value.else_)));
+
+  /** Every record shape a type can hold, through fields, arms, elements,
+   * callables, promises and class fields. */
+  /** Each walk shares one `seen` set per result set, so every type graph
+   * is walked once however many roots reach it. */
+  const shapesIn = (type: IrType, out: Set<string>, seen: Set<string>): void => {
+    const visit = (t: IrType): boolean => {
+      if (t.kind === "record") {
+        if (seen.has("r:" + t.shapeId)) return true;
+        seen.add("r:" + t.shapeId);
+        out.add(t.shapeId);
+        const shape = shapes.get(t.shapeId);
+        if (shape) {
+          for (const f of shape.fields) visit(f.type);
+          if (shape.indexValue) visit(shape.indexValue);
+        }
+        return true;
+      }
+      if (t.kind === "union") {
+        if (seen.has("u:" + t.unionId)) return true;
+        seen.add("u:" + t.unionId);
+        for (const arm of lowerer.unions.get(t.unionId)?.arms ?? []) visit(arm);
+        return true;
+      }
+      if (t.kind === "object") {
+        if (seen.has("c:" + t.className)) return true;
+        seen.add("c:" + t.className);
+        for (const f of lowerer.classes.get(t.className)?.def.fields ?? []) visit(f.type);
+        return true;
+      }
+      return everyTypeChild(t, visit);
+    };
+    visit(type);
+  };
+  const opaqueShapes = new Set<string>();
+  const opaqueSeen = new Set<string>();
+  const runtimeShapes = new Set<string>();
+  const runtimeSeen = new Set<string>();
+  const producedBy = (type: IrType, opaque: boolean): void => {
+    if (opaque) shapesIn(type, opaqueShapes, opaqueSeen);
+    else shapesIn(type, runtimeShapes, runtimeSeen);
+  };
+
+  // ── collection ──────────────────────────────────────────────────────
+  let pos = 0;
+  let fnName = "";
+  const loops: number[] = [];
+  let loopIds = 0;
+  const loopKey = (): string => loops.join("/");
+  const noteInit = (id: string, init: IrExpr): void => {
+    const previous = inits.get(id);
+    if (previous !== undefined) {
+      previous.count++;
+      return;
+    }
+    const fresh =
+      init.kind === "recordLit" ||
+      init.kind === "recordClone" ||
+      (init.kind === "seqExpr" && init.result.kind === "recordLit");
+    inits.set(id, { count: 1, fn: fnName, loop: loopKey(), pos, fresh });
+  };
+  const visitExpr = (e: IrExpr): void => {
+    switch (e.kind) {
+      case "recordLit": {
+        if (e.type.kind !== "record") return;
+        const f = factsOf(e.type.shapeId);
+        const presentKeys = new Set<string>();
+        for (const field of e.fields) {
+          if (field.overflow) continue;
+          if (field.value.kind === "fieldAbsent") {
+            f.absent.add(field.name);
+            continue;
+          }
+          presentKeys.add(field.name);
+          f.present.add(field.name);
+          if (containsAbsent(field.value)) f.absent.add(field.name);
+        }
+        const segments = notes.literalOf(e);
+        const copy = notes.copyOf(e);
+        if (segments !== undefined) f.literals.push(segments);
+        else if (copy !== undefined) f.copies.push({ source: copy, keys: presentKeys });
+        else f.pinned = true;
+        return;
+      }
+      case "recordClone": {
+        if (e.type.kind !== "record") return;
+        const f = factsOf(e.type.shapeId);
+        f.clones = true;
+        for (const o of e.overrides)
+          f.writes.push({ field: o.name, kind: "clone", fn: fnName, binding: null, loop: "", pos });
+        return;
+      }
+      case "assignExpr":
+        noteInit(e.localId, e.value);
+        return;
+      case "jsonStringify":
+      case "dynFrom":
+        observedRoots.push(e.value.type);
+        return;
+      case "recordKeyGet":
+        observedRoots.push(e.obj.type);
+        return;
+      case "libCall":
+        // Runtime surfaces (console, util.format, workers) that take a
+        // record may walk its keys; runtime builders make new records.
+        for (const arg of e.args) observedRoots.push(arg.type);
+        producedBy(e.type, true);
+        return;
+      case "intrinsic":
+        // Intrinsics hand back values built elsewhere, except allSettled's
+        // result records; console output renders through the inspect
+        // helpers, which note their shapes.
+        if (e.name === "promise.allSettled") producedBy(e.type, true);
+        return;
+      case "ffiCall":
+      case "strIntrinsic":
+      case "regexIntrinsic":
+      case "bytesIntrinsic":
+        producedBy(e.type, true);
+        return;
+      case "dynCheck":
+        if (!orderPreservingClone(e)) producedBy(e.type, false);
+        return;
+      case "dynDestrCheck":
+      case "caughtCheck":
+      case "caughtNarrow":
+        producedBy(e.type, false);
+        return;
+      default:
+        return;
+    }
+  };
+  const visitStmt = (st: IrStmt): void => {
+    switch (st.kind) {
+      case "recordSet":
+        if (st.value.kind === "fieldAbsent") factsOf(st.shapeId).deleted.add(st.field);
+        factsOf(st.shapeId).writes.push({
+          field: st.field,
+          kind: st.value.kind === "fieldAbsent" ? "delete" : "write",
+          fn: fnName,
+          binding: st.obj.kind === "varRef" ? st.obj.localId : null,
+          loop: loopKey(),
+          pos,
+        });
+        return;
+      case "varDecl":
+        if (st.init !== null) noteInit(st.localId, st.init);
+        return;
+      case "assign":
+        noteInit(st.localId, st.value);
+        return;
+      default:
+        return;
+    }
+  };
+  const expr = (e: IrExpr): boolean => {
+    pos++;
+    visitExpr(e);
+    return everyExprChild(e, expr, stmt);
+  };
+  const stmt = (st: IrStmt): boolean => {
+    pos++;
+    visitStmt(st);
+    if (st.kind === "while" || st.kind === "doWhile" || st.kind === "for" || st.kind === "forOf") {
+      loops.push(++loopIds);
+      everyStmtChild(st, expr, stmt);
+      loops.pop();
+      return true;
+    }
+    return everyStmtChild(st, expr, stmt);
+  };
+  for (const fn of fns) {
+    fnName = fn.name;
+    for (const st of fn.body) stmt(st);
+  }
+  for (const id of opaqueShapes) {
+    const f = factsOf(id);
+    f.pinned = true;
+    f.opaque = true;
+  }
+  for (const id of runtimeShapes) factsOf(id).runtime = true;
+
+  // ── scope ───────────────────────────────────────────────────────────
+  // Only plain declared-field shapes with a table take part.
+  const inScope = (shape: IrRecordShape | undefined): shape is IrRecordShape =>
+    shape !== undefined &&
+    !shape.tuple &&
+    shape.indexValue === undefined &&
+    shape.declaredOrder !== undefined &&
+    !shapeHasAccessorSlots(shape);
+  const tableOf = (shape: IrRecordShape): string[] =>
+    shape.declaredOrder!.filter((k) => !k.startsWith("%") && !isArrayIndex(k));
+  // A checked conversion builds values in their source's own order, which
+  // the record-source table reproduces relative to the shape's table. A new
+  // table would make every value parsed in today's order keep a source
+  // view, so such shapes keep today's table.
+  for (const f of facts.values()) if (f.runtime) f.pinned = true;
+
+  // Nothing to choose: every witness agrees with today's table and no
+  // optional key is written late.
+  const interesting = [...facts].some(([id, f]) => {
+    const shape = shapes.get(id);
+    if (!inScope(shape)) return false;
+    if (f.writes.some((w) => w.kind !== "delete") || f.copies.length > 0) return true;
+    const table = tableOf(shape).join("\0");
+    return f.literals.some((segments) => {
+      const keys: string[] = [];
+      for (const segment of segments) {
+        if (segment.kind !== "key") return true;
+        if (!isArrayIndex(segment.name)) keys.push(segment.name);
+      }
+      return keys.join("\0") !== table;
+    });
+  });
+  if (!interesting) return;
+
+  // ── presence classes and late-write constraints ─────────────────────
+  const maybeAbsent = (id: string, key: string): boolean => {
+    const shape = shapes.get(id);
+    const field = shape?.fields.find((x) => x.name === key);
+    if (!field || !undefinedArmed(field.type)) return false;
+    const f = facts.get(id);
+    if (f === undefined) return true;
+    return f.absent.has(key) || f.runtime || f.opaque || f.deleted.has(key);
+  };
+  /** Edges every value of the shape satisfies whatever its sources'
+   * orders are, or "unknown" when late writes make the order depend on
+   * the value. */
+  const lateEdges = (id: string, keys: readonly string[]): [string, string][] | "unknown" => {
+    const f = facts.get(id);
+    if (f === undefined) return [];
+    const edges: [string, string][] = [];
+    const keySet = new Set(keys);
+    const createdKeys = (k: string): boolean => f.present.has(k) || f.runtime || f.opaque;
+    const required = keys.filter((k) => !maybeAbsent(id, k));
+    const created = keys.filter((k) => maybeAbsent(id, k) && createdKeys(k));
+    const lateOnly = new Set(keys.filter((k) => maybeAbsent(id, k) && !createdKeys(k)));
+    // The constraint depends on the written key only, not on the site.
+    const moving = new Set<string>();
+    for (const w of f.writes)
+      if (w.kind !== "delete" && keySet.has(w.field) && maybeAbsent(id, w.field))
+        moving.add(w.field);
+    for (const field of moving) {
+      const before = lateOnly.has(field) ? [...required, ...created] : keys;
+      for (const k of before) if (k !== field) edges.push([k, field]);
+    }
+    const lateSites = f.writes.filter((w) => lateOnly.has(w.field));
+    const lateWritten = new Set(lateSites.filter((w) => w.kind !== "delete").map((w) => w.field));
+    if (lateWritten.size < 2) return edges;
+    // Two or more late-only keys: each value gains them in the order its
+    // writes run, so every write must belong to one straight-line
+    // sequence through one binding initialized once, in the same function
+    // and loop body as its writes.
+    const groups = new Map<string, WriteSite[]>();
+    for (const w of lateSites) {
+      if (w.kind === "clone" || w.binding === null) return "unknown";
+      const init = inits.get(w.binding);
+      if (
+        init === undefined ||
+        init.count !== 1 ||
+        init.fn !== w.fn ||
+        init.loop !== w.loop ||
+        init.pos > w.pos
+      )
+        return "unknown";
+      const group = groups.get(w.binding) ?? [];
+      group.push(w);
+      groups.set(w.binding, group);
+    }
+    if (groups.size > 1 && [...groups.keys()].some((b) => !inits.get(b)!.fresh)) return "unknown";
+    for (const group of groups.values()) {
+      const seen = new Set<string>();
+      for (const w of group) {
+        if (seen.has(w.field)) return "unknown";
+        seen.add(w.field);
+      }
+      const writes = group.filter((w) => w.kind === "write").sort((a, b) => a.pos - b.pos);
+      for (let i = 0; i + 1 < writes.length; i++)
+        edges.push([writes[i]!.field, writes[i + 1]!.field]);
+    }
+    return edges;
+  };
+
+  // ── witness sequences ───────────────────────────────────────────────
+  /** The key sequences one literal can create, or null when a spread
+   * source's order is unknown. A key sits at its first occurrence that
+   * certainly defines it; each earlier occurrence that may define it is
+   * another possible position. */
+  const literalSequences = (
+    segments: readonly KeyOrderSegment[],
+    keySet: ReadonlySet<string>,
+    resolved: (id: string) => Resolved,
+  ): string[][] | null => {
+    const occurrences: { key: string; definite: boolean }[] = [];
+    for (const s of segments) {
+      if (s.kind === "opaque") return null;
+      if (s.kind === "key") {
+        if (keySet.has(s.name)) occurrences.push({ key: s.name, definite: s.definite });
+        continue;
+      }
+      const source = resolved(s.shapeId);
+      if (source === "unknown") return null;
+      for (const k of source.order) {
+        if (keySet.has(k))
+          occurrences.push({ key: k, definite: !s.maybeAbsent && !maybeAbsent(s.shapeId, k) });
+      }
+    }
+    // Per key, the occurrences that can create it: every one up to and
+    // including the first definite occurrence. The first such position is
+    // the base; each other one is an alternative.
+    const positions = new Map<string, number[]>();
+    const settled = new Set<string>();
+    occurrences.forEach((o, i) => {
+      if (settled.has(o.key)) return;
+      const list = positions.get(o.key) ?? [];
+      list.push(i);
+      positions.set(o.key, list);
+      if (o.definite) settled.add(o.key);
+    });
+    const base = new Map<string, number>();
+    for (const [key, list] of positions) base.set(key, list[0]!);
+    const sequenceWith = (at: Map<string, number>): string[] =>
+      [...at].sort((a, b) => a[1] - b[1]).map(([k]) => k);
+    const out = [sequenceWith(base)];
+    for (const [key, list] of positions) {
+      for (const alternative of list.slice(1)) {
+        const moved = new Map(base);
+        moved.set(key, alternative);
+        out.push(sequenceWith(moved));
+      }
+    }
+    return out;
+  };
+
+  /** Today's table with every witness edge applied, or "unknown". */
+  const merge = (table: readonly string[], edges: readonly [string, string][]): Resolved => {
+    const rank = new Map(table.map((k, i) => [k, i]));
+    const succ = new Map<string, Set<string>>(table.map((k) => [k, new Set<string>()]));
+    const indeg = new Map<string, number>(table.map((k) => [k, 0]));
+    for (const [a, b] of edges) {
+      if (a === b || !rank.has(a) || !rank.has(b)) continue;
+      const s = succ.get(a)!;
+      if (s.has(b)) continue;
+      s.add(b);
+      indeg.set(b, indeg.get(b)! + 1);
+    }
+    const order: string[] = [];
+    const ready = table.filter((k) => indeg.get(k) === 0);
+    while (ready.length > 0) {
+      ready.sort((a, b) => rank.get(a)! - rank.get(b)!);
+      const k = ready.shift()!;
+      order.push(k);
+      for (const next of succ.get(k)!) {
+        indeg.set(next, indeg.get(next)! - 1);
+        if (indeg.get(next) === 0) ready.push(next);
+      }
+    }
+    return order.length === table.length ? { order } : "unknown";
+  };
+
+  const chain = (seq: readonly string[], out: [string, string][]): void => {
+    for (let i = 0; i + 1 < seq.length; i++) out.push([seq[i]!, seq[i + 1]!]);
+  };
+
+  // ── resolution over inheritance edges ───────────────────────────────
+  const result = new Map<string, Resolved>();
+  const late = new Map<string, [string, string][] | "unknown">();
+  const dependencies = (id: string): string[] => {
+    const f = facts.get(id);
+    if (f === undefined) return [];
+    const deps = new Set<string>();
+    for (const segments of f.literals)
+      for (const s of segments) if (s.kind === "spread") deps.add(s.shapeId);
+    for (const c of f.copies) deps.add(c.source);
+    return [...deps];
+  };
+  /** One shape's order given its sources' current orders. */
+  const resolveOne = (id: string, current: (source: string) => Resolved): Resolved => {
+    const shape = shapes.get(id);
+    if (!inScope(shape)) return "unknown";
+    const table = tableOf(shape);
+    const f = facts.get(id);
+    // A shape the program never constructs natively gets its values from
+    // somewhere this pass cannot see.
+    if (f === undefined || !(f.literals.length > 0 || f.copies.length > 0 || f.pinned || f.runtime))
+      return "unknown";
+    // Clones copy their source's own key order, which a checked
+    // conversion leaves unknown.
+    if (f.runtime && f.clones) return "unknown";
+    const keySet = new Set(table);
+    const edges: [string, string][] = [];
+    if (f.pinned) chain(table, edges);
+    for (const segments of f.literals) {
+      const sequences = literalSequences(segments, keySet, current);
+      if (sequences === null) return "unknown";
+      for (const seq of sequences) chain(seq, edges);
+    }
+    for (const c of f.copies) {
+      const source = current(c.source);
+      if (source === "unknown") return "unknown";
+      chain(
+        source.order.filter((k) => keySet.has(k) && c.keys.has(k)),
+        edges,
+      );
+    }
+    const cached = late.get(id);
+    const lateFor = cached !== undefined ? cached : lateEdges(id, table);
+    if (cached === undefined) late.set(id, lateFor);
+    if (lateFor === "unknown") return "unknown";
+    for (const edge of lateFor) edges.push(edge);
+    return merge(table, edges);
+  };
+  /** A source's order as its copies see it: values of a shape built by a
+   * checked conversion keep their source's own order. */
+  const asSource = (id: string, resolved: Resolved): Resolved =>
+    facts.get(id)?.runtime === true ? "unknown" : resolved;
+
+  // Tarjan's SCCs over "depends on" edges: sources finish first.
+  const index = new Map<string, number>();
+  const low = new Map<string, number>();
+  const stack: string[] = [];
+  const onStack = new Set<string>();
+  let counter = 0;
+  const sccs: string[][] = [];
+  const strong = (v: string): void => {
+    index.set(v, counter);
+    low.set(v, counter);
+    counter++;
+    stack.push(v);
+    onStack.add(v);
+    for (const w of dependencies(v)) {
+      if (!index.has(w)) {
+        strong(w);
+        low.set(v, Math.min(low.get(v)!, low.get(w)!));
+      } else if (onStack.has(w)) low.set(v, Math.min(low.get(v)!, index.get(w)!));
+    }
+    if (low.get(v) === index.get(v)) {
+      const scc: string[] = [];
+      let w: string;
+      do {
+        w = stack.pop()!;
+        onStack.delete(w);
+        scc.push(w);
+      } while (w !== v);
+      sccs.push(scc);
+    }
+  };
+  for (const id of facts.keys()) if (!index.has(id)) strong(id);
+  const external = (id: string): Resolved => {
+    const known = result.get(id);
+    return known === undefined ? "unknown" : asSource(id, known);
+  };
+  for (const scc of sccs) {
+    const members = new Set(scc);
+    const guess = new Map<string, Resolved>();
+    for (const id of scc) {
+      const shape = shapes.get(id);
+      guess.set(id, inScope(shape) ? { order: tableOf(shape) } : "unknown");
+    }
+    const lookup = (id: string): Resolved =>
+      members.has(id) ? asSource(id, guess.get(id)!) : external(id);
+    let stable = false;
+    for (let round = 0; round < scc.length + 3 && !stable; round++) {
+      stable = true;
+      for (const id of scc) {
+        const next = resolveOne(id, lookup);
+        const prev = guess.get(id)!;
+        const same =
+          next === "unknown"
+            ? prev === "unknown"
+            : prev !== "unknown" && prev.order.join("\0") === next.order.join("\0");
+        if (!same) {
+          stable = false;
+          guess.set(id, next);
+        }
+      }
+    }
+    for (const id of scc) result.set(id, stable ? guess.get(id)! : "unknown");
+  }
+
+  // ── observation ─────────────────────────────────────────────────────
+  const observed = new Set<string>();
+  const observedSeen = new Set<string>();
+  for (const id of notes.observed)
+    shapesIn({ kind: "record", shapeId: id }, observed, observedSeen);
+  for (const root of observedRoots) shapesIn(root, observed, observedSeen);
+
+  // ── apply ───────────────────────────────────────────────────────────
+  for (const [id, resolved] of result) {
+    if (resolved === "unknown" || !observed.has(id)) continue;
+    const shape = shapes.get(id);
+    if (!inScope(shape)) continue;
+    const table = tableOf(shape);
+    if (resolved.order.join("\0") === table.join("\0")) continue;
+    shape.declaredOrder = [...shape.declaredOrder!.filter(isArrayIndex), ...resolved.order];
+    notes.changed.add(id);
+  }
+}
diff --git a/packages/compiler/src/frontend/lowering/lower-assert.ts b/packages/compiler/src/frontend/lowering/lower-assert.ts
index 8c49db594..cb31ecc79 100644
--- a/packages/compiler/src/frontend/lowering/lower-assert.ts
+++ b/packages/compiler/src/frontend/lowering/lower-assert.ts
@@ -870,7 +870,7 @@ export function lowerAssertDirectCall(
   const module = lowerer.builtinNamespaceModuleOf(callee);
   if (module !== "assert" && module !== "assert/strict") return null;
   const calleeSym = lowerer.checker.getSymbolAtLocation(callee);
-  const decl = calleeSym ? lowerer.checker.declarationsOf(calleeSym)[0] : undefined;
+  const decl = calleeSym ? calleeSym.declarations[0] : undefined;
   if (decl && ts.isNamespaceImport(decl)) {
     lowerer.unsupported(
       "SC1013",
diff --git a/packages/compiler/src/frontend/lowering/lower-async-iteration.ts b/packages/compiler/src/frontend/lowering/lower-async-iteration.ts
index c20f32480..f095c5b9c 100644
--- a/packages/compiler/src/frontend/lowering/lower-async-iteration.ts
+++ b/packages/compiler/src/frontend/lowering/lower-async-iteration.ts
@@ -20,7 +20,7 @@ import {
   VOID,
 } from "../../ir/ir.js";
 import { locOf } from "../program.js";
-import { extractIteratorValue } from "./lower-generators.js";
+import { extractIteratorValue, type GenType } from "./lower-generators.js";
 import { streamSidesOf } from "./lower-stream.js";
 import { staticReadableStreamElementType } from "./lower-stdlib.js";
 import { genResultRecord } from "../type-mapper.js";
@@ -282,6 +282,43 @@ function classAsyncIteratorPlan(
   };
 }
 
+/** `for await (const x of obj)` where obj's class declares (or inherits)
+ * `async *[Symbol.asyncIterator]()`: the loop opens the iterator with that
+ * method call, evaluated once, and then drives the async generator it
+ * returns exactly like `for await (const x of obj[Symbol.asyncIterator]())`
+ * (pi's EventStream). Null for other sources. */
+export function classAsyncGeneratorIterator(
+  lowerer: Lowerer,
+  expression: ts.Expression,
+): (IrExpr & { type: GenType }) | null {
+  const sourceType = lowerer.mapTypeOf(lowerer.typeOf(expression));
+  if (sourceType?.kind !== "object") return null;
+  const info = lowerer.classes.get(sourceType.className);
+  const open = info ? lowerer.findMethodOn(info, "sym:asyncIterator") : null;
+  if (
+    !open ||
+    open.sig.abstract === true ||
+    open.sig.params.length !== 0 ||
+    open.sig.ret.kind !== "generator" ||
+    !open.sig.ret.async
+  )
+    return null;
+  const retT = open.sig.ret;
+  const source = lowerer.lowerExpr(expression);
+  if (source.type.kind !== "object") return null;
+  return {
+    ...lowerer.accessorCall(
+      sourceType.className,
+      "sym:asyncIterator",
+      source,
+      [],
+      retT,
+      locOf(expression),
+    ),
+    type: retT,
+  };
+}
+
 export function checkForAwaitBinding(
   lowerer: Lowerer,
   stmt: ts.ForOfStatement,
diff --git a/packages/compiler/src/frontend/lowering/lower-builtin-values.ts b/packages/compiler/src/frontend/lowering/lower-builtin-values.ts
index c05430ad3..5e04ee83c 100644
--- a/packages/compiler/src/frontend/lowering/lower-builtin-values.ts
+++ b/packages/compiler/src/frontend/lowering/lower-builtin-values.ts
@@ -132,13 +132,11 @@ export function isNativeBuiltinValueInitializer(
   const symbol = lowerer.resolveValueSymbol(expr);
   if (!symbol || seen.has(symbol)) return false;
   seen.add(symbol);
-  return lowerer.checker
-    .declarationsOf(symbol)
-    .some(
-      (decl) =>
-        ts.isVariableDeclaration(decl) &&
-        isNativeBuiltinValueInitializer(lowerer, decl.initializer, seen),
-    );
+  return symbol.declarations.some(
+    (decl) =>
+      ts.isVariableDeclaration(decl) &&
+      isNativeBuiltinValueInitializer(lowerer, decl.initializer, seen),
+  );
 }
 
 /** The stored Array.isArray function shares the direct call's native test. */
diff --git a/packages/compiler/src/frontend/lowering/lower-calls.ts b/packages/compiler/src/frontend/lowering/lower-calls.ts
index 7d538dac0..ed549e4ff 100644
--- a/packages/compiler/src/frontend/lowering/lower-calls.ts
+++ b/packages/compiler/src/frontend/lowering/lower-calls.ts
@@ -1,4 +1,5 @@
 import { guardNullProto, nullProtoRecordShape } from "./null-prototype.js";
+import { refuseModuleMemberThis } from "./module-member-this.js";
 import { lowerUnionEquality, tagEqualityMayMissAlias } from "./strict-equality.js";
 import { lowerHashStreamCall } from "./builtins/hash-stream.js";
 import { lowerResponseStaticJson } from "./lower-stdlib.js";
@@ -115,6 +116,9 @@ import {
   lowerStringMethodCall,
   lowerStringPaddingCall,
   lowerStringSplitCall,
+  isDynPrimitiveKindMethod,
+  lowerDynPrimitiveMethodCall,
+  lowerExtraNumberMethodCall,
 } from "./containers/string-and-regexp.js";
 import { createRequireSpecOf } from "./builtins/module-bindings.js";
 import {
@@ -127,7 +131,9 @@ import {
   lowerRequireResolveCall,
 } from "./builtins/module-resolution.js";
 import {
+  isWebCryptoReceiver,
   lowerCipherMethodCall,
+  lowerCryptoGetRandomValues,
   lowerCryptoHashMethodCall,
   lowerPromisifiedCryptoCall,
 } from "./builtins/crypto.js";
@@ -146,7 +152,10 @@ import {
   lowerPerfHooksCall,
   perfEntryTag,
 } from "./builtins/performance.js";
-import { lowerProcStreamMethodCall } from "./builtins/process.js";
+import {
+  lowerProcStreamMethodCall,
+  lowerProcessBuiltinModuleNamespace,
+} from "./builtins/process.js";
 import { recordMayKeepSource, throughRecordSource } from "./record-sources.js";
 import { lowerReflectCall } from "./builtins/reflection.js";
 import {
@@ -164,6 +173,7 @@ import { isSafeToDiscard } from "./expressions/evaluation-safety.js";
 import { tryLowerExpression } from "./expressions/try-lower-expression.js";
 import { classToNumberConversion } from "./class-to-primitive.js";
 import { hasRuntimeStatics } from "./class-runtime-statics.js";
+import { structuralReadType } from "./class-unions.js";
 import {
   httpClientFnBindingOf,
   lowerCompatReqStreamOptionalCall,
@@ -421,6 +431,15 @@ export function lowerCall(lowerer: Lowerer, expr: ts.CallExpression): IrExpr {
     return { kind: "libCall", fn: "http2.streamNoop", args: [], type: VOID, loc };
   }
 
+  // `process.getBuiltinModule("node:os")` typed as the module namespace,
+  // including pi's cast-and-probe spelling
+  // `(process as P).getBuiltinModule?.("node:os")` (the member always
+  // exists on Node 24's process object).
+  {
+    const namespace = lowerProcessBuiltinModuleNamespace(lowerer, expr);
+    if (namespace) return namespace;
+  }
+
   // Optional-chain call forms: `f?.()` (the token on the call) and
   // `a?.m()` (the token on the member access). The handled markers keep
   // the chain lowering's re-entrant dispatch from looping.
@@ -681,12 +700,23 @@ export function lowerCall(lowerer: Lowerer, expr: ts.CallExpression): IrExpr {
     };
     // The declared result is the value's own type (the generic's T):
     // validate the dyn copy back into it when the type can be checked;
-    // dyn-typed and unmappable results stay dyn values (JS files).
+    // dyn-typed and unmappable results stay dyn values (JS files). An
+    // empty record (`{}` inferred from a JavaScript `payload = {}`
+    // default) is the checker's supertype of whatever arrives, not a
+    // layout: checking into it would drop every member of the copy.
     const resultT = lowerer.mapTypeOf(lowerer.typeOf(expr));
+    const resultShape =
+      resultT?.kind === "record" ? lowerer.shapes.get(resultT.shapeId) : undefined;
+    const emptyRecord =
+      resultShape !== undefined &&
+      !resultShape.tuple &&
+      resultShape.indexValue === undefined &&
+      resultShape.fields.length === 0;
     if (
       resultT !== null &&
       resultT.kind !== "dyn" &&
       resultT.kind !== "void" &&
+      !emptyRecord &&
       canDynCheckTo(
         resultT,
         (id) => lowerer.shapes.get(id),
@@ -1155,7 +1185,7 @@ export function lowerCall(lowerer: Lowerer, expr: ts.CallExpression): IrExpr {
         lowerer.noteEdge(sig.name);
         const args = lowerer.completeArgs(expr.arguments.nodes, sig.params, loc, expr);
         const symbol = lowerer.resolveValueSymbol(expr.expression);
-        const declaration = symbol ? lowerer.checker.valueDeclarationOf(symbol) : undefined;
+        const declaration = symbol ? symbol.valueDeclaration : undefined;
         // A bare call supplies undefined as this, even inside a callback
         // currently carrying a receiver. The value-call ABI saves and
         // restores that ambient receiver around the function invocation.
@@ -1250,6 +1280,7 @@ export function lowerCall(lowerer: Lowerer, expr: ts.CallExpression): IrExpr {
       if (facadeServed) return facadeServed;
       const memberSym = lowerer.checker.getSymbolAtLocation(nsMember);
       if (memberSym) fenceEarlyNsMemberRef(lowerer, expr.expression, memberSym);
+      refuseModuleMemberThis(lowerer, expr, nsMember);
       const generic = lowerer.genericFnOf(nsMember);
       if (generic) return lowerer.lowerGenericCall(expr, generic);
       const sig = lowerer.fnSigOf(nsMember);
@@ -1313,6 +1344,7 @@ export function lowerCall(lowerer: Lowerer, expr: ts.CallExpression): IrExpr {
     if (!ts.isIdentifier(nameId)) {
       lowerer.unsupported("SC1090", nameId, "private-named module members");
     }
+    refuseModuleMemberThis(lowerer, expr, nameId);
     const generic = lowerer.genericFnOf(nameId);
     if (generic) return lowerer.lowerGenericCall(expr, generic);
     const sig = lowerer.fnSigOf(nameId);
@@ -1490,6 +1522,9 @@ export function lowerCall(lowerer: Lowerer, expr: ts.CallExpression): IrExpr {
       lowerer.fenceStaticReadableStreamMember(expr.expression, "call") ??
       lowerDisposableStackUseCall(lowerer, expr, expr.expression) ??
       lowerer.lowerStdlibMethodCall(expr, expr.expression) ??
+      // crypto.getRandomValues on the WebCrypto global (untyped in
+      // fallback builds, so before the dyn receiver path) or webcrypto.
+      lowerWebCryptoGetRandomValues(lowerer, expr, expr.expression) ??
       // Dyn receivers (JSON.parse-derived `unknown`/`any` values) —
 
       lowerDynReceiverMethodCall(lowerer, expr, expr.expression) ??
@@ -3419,6 +3454,23 @@ function lowerDynReceiverMethodCall(
       lowerStringMethodCall(lowerer, call, access, () => recv)
     );
   }
+  // A checker-untyped JS binding holding `string | undefined` (string-
+  // width's `const visibleSegment = baseVisible(segment)` after an
+  // `=== undefined` guard the checker cannot see through): no typed
+  // lowering claims the union, so a String method boxes it and takes the
+  // dyn receiver path, whose undefined/null arms throw Node's read errors.
+  if (
+    checkerUntyped &&
+    recv.type.kind === "union" &&
+    isJsSourceFile(call.getSourceFile()) &&
+    isStringMethodName(access.name.text) &&
+    lowerer.unions
+      .get(recv.type.unionId)
+      ?.arms.every((arm) => arm.kind === "string" || isUnitType(arm)) === true &&
+    lowerer.dynConvertible(recv.type)
+  ) {
+    recv = lowerer.coerceToExpected(recv, DYN);
+  }
   // A native handle read through `as any` (`(hash as any).update(x)`)
   // dispatches through the handle, as the same value held in an
   // 'unknown' slot does.
@@ -3515,9 +3567,9 @@ function lowerDynReceiverMethodCall(
       // Those are not stored members of a checked-dynamic object, so
       // dynKeyGet cannot stand in for JavaScript's prototype lookup. Only
       // an authored declaration can justify the own-member path.
-      const authored = lowerer.checker
-        .declarationsOf(prop)
-        .some((decl) => !lowerer.isStdlibFile(decl.getSourceFile()));
+      const authored = prop.declarations.some(
+        (decl) => !lowerer.isStdlibFile(decl.getSourceFile()),
+      );
       return (
         authored &&
         lowerer.checker.getCallSignatures(lowerer.checker.getTypeOfSymbol(prop)).length > 0
@@ -3543,6 +3595,26 @@ function lowerDynReceiverMethodCall(
       lowerStringMethodCall(lowerer, call, access, checked)
     );
   }
+  // String/Number methods the runtime dispatch has no answer for
+  // (codePointAt, substr, toLocaleLowerCase, toPrecision, ...): a string
+  // or number receiver runs the typed lowering, every other kind keeps the
+  // runtime dispatch.
+  if (
+    !ownCallable &&
+    !call.questionDotToken &&
+    !access.questionDotToken &&
+    isDynPrimitiveKindMethod(access.name.text) &&
+    !lowerer.chainBlocked(access, call)
+  ) {
+    const primitive = lowerDynPrimitiveMethodCall(
+      lowerer,
+      call,
+      access.name.text,
+      access.getText(),
+      recv,
+    );
+    if (primitive) return primitive;
+  }
   // The argument is a radix for bigint and an encoding for Buffer.
   // Preserve its runtime value so receiver dispatch can choose correctly.
   if (access.name.text === "toString" && call.arguments.nodes.length <= 1) {
@@ -3598,9 +3670,9 @@ function lowerDynReceiverMethodCall(
       return true;
     return (
       prop !== undefined &&
-      lowerer.checker
-        .declarationsOf(prop)
-        .some((decl) => ts.isPropertyDeclaration(decl) || ts.isPropertySignature(decl))
+      prop.declarations.some(
+        (decl) => ts.isPropertyDeclaration(decl) || ts.isPropertySignature(decl),
+      )
     );
   })();
   // Protocol methods keep their static signature: instances of the
@@ -3635,8 +3707,14 @@ function lowerDynReceiverMethodCall(
   // own or inherited member exactly like a non-prototype name (chalk's
   // `chalk.red.bold(...)` reads a prototype getter of a function), so
   // only a string receiver keeps the refusal, deferred to run time.
+  // The same holds when only the MEMBER is checker-untyped: TypeScript
+  // importing chalk's JavaScript source types the default export as a
+  // plain function, so `chalk.bold` reads as `any` on a typed receiver.
   const stringOnlyName =
-    checkerUntyped && !ownCallable && DYN_STRING_PROTO_ONLY_NAMES.has(access.name.text);
+    (checkerUntyped ||
+      (lowerer.typeOf(access).flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !== 0) &&
+    !ownCallable &&
+    DYN_STRING_PROTO_ONLY_NAMES.has(access.name.text);
   if (DYN_PROTO_METHOD_NAMES.has(access.name.text) && !ownCallable && !stringOnlyName) return null;
   // Optional forms (`obj.cb?.()`, `obj?.cb()`) belong to the chain
   // machinery's short-circuit semantics — not modeled here yet.
@@ -4120,6 +4198,19 @@ export function lowerDynDispatchMethodCall(
   };
 }
 
+/** Every String.prototype method name a typed or dyn string lowering
+ * answers. */
+function isStringMethodName(name: string): boolean {
+  return (
+    Object.hasOwn(STR_METHODS, name) ||
+    STRING_INDEX_METHODS.has(name) ||
+    DYN_STRING_ONLY_METHODS.has(name) ||
+    isDynPrimitiveKindMethod(name) ||
+    name === "normalize" ||
+    name === "lastIndexOf"
+  );
+}
+
 /** STR_METHODS ∪ the regex-form names, MINUS everything Array (or any
  * other dyn kind's prototype) also declares. */
 const DYN_STRING_ONLY_METHODS = new Set([
@@ -4242,9 +4333,7 @@ function lowerCaughtPredicateCall(
   const callee = call.expression;
   if (!ts.isIdentifier(callee)) return null;
   const symbol = lowerer.resolveValueSymbol(callee);
-  const decl = symbol
-    ? lowerer.checker.declarationsOf(symbol).find(ts.isFunctionDeclaration)
-    : undefined;
+  const decl = symbol ? symbol.declarations.find(ts.isFunctionDeclaration) : undefined;
   if (!symbol || !decl || !decl.body) return null;
   if (!decl.type || !ts.isTypePredicateNode(decl.type)) return null;
   if (decl.parameters.nodes.length !== 1) return null;
@@ -4591,6 +4680,21 @@ function lowerPrimitiveProtoCall(
     isJsSourceFile(call.getSourceFile())
   ) {
     const operand = lowerer.lowerExpr(recv);
+    if (
+      name === "toExponential" &&
+      call.arguments.nodes.length === 1 &&
+      (operand.type.kind === "dyn" ||
+        (operand.type.kind === "union" && lowerer.dynConvertible(operand.type)))
+    ) {
+      const dispatched = lowerDynPrimitiveMethodCall(
+        lowerer,
+        call,
+        name,
+        `${recv.getText()}.${name}`,
+        lowerer.coerceToExpected(operand, DYN),
+      );
+      if (dispatched) return dispatched;
+    }
     if (
       operand.type.kind === "dyn" ||
       (operand.type.kind === "union" && lowerer.dynConvertible(operand.type))
@@ -4605,6 +4709,32 @@ function lowerPrimitiveProtoCall(
         loc: locOf(call),
       };
   }
+  if (
+    name === "toPrecision" &&
+    call.arguments.nodes.length <= 1 &&
+    !call.arguments.nodes.some(ts.isSpreadElement) &&
+    isJsSourceFile(call.getSourceFile()) &&
+    recvKind === "union"
+  ) {
+    const operand = lowerer.lowerExpr(recv);
+    if (operand.type.kind === "union" && lowerer.dynConvertible(operand.type)) {
+      const dispatched = lowerDynPrimitiveMethodCall(
+        lowerer,
+        call,
+        name,
+        `${recv.getText()}.${name}`,
+        lowerer.coerceToExpected(operand, DYN),
+      );
+      if (dispatched) return dispatched;
+    }
+  }
+  if (
+    recvKind === "f64" &&
+    (name === "toPrecision" || (name === "toExponential" && call.arguments.nodes.length === 1))
+  ) {
+    const typed = lowerExtraNumberMethodCall(lowerer, call, name, lowerer.lowerExpr(recv));
+    if (typed) return typed;
+  }
   if (recvKind !== "f64" && recvKind !== "bool" && recvKind !== "string") return null;
   const loc = locOf(call);
   if (name === "toString" && call.arguments.nodes.length === 0) {
@@ -4772,7 +4902,7 @@ function implicitReceiverOverloadReturn(
   if (!member) return null;
   const signatures = lowerer.checker.getCallSignatures(lowerer.checker.getTypeOfSymbol(member));
   const matches = signatures.filter((signature) => {
-    const decl = lowerer.checker.signatureDeclaration(signature);
+    const decl = signature.declaration;
     if (!decl || !(ts.isFunctionDeclaration(decl) || ts.isMethodDeclaration(decl)) || decl.body) {
       return false;
     }
@@ -4824,7 +4954,7 @@ function reconcileOverloadReturn(
   call: IrExpr,
 ): IrExpr {
   const rsig = lowerer.checker.getResolvedSignature(expr);
-  const rdecl = rsig ? lowerer.checker.signatureDeclaration(rsig) : undefined;
+  const rdecl = rsig ? rsig.declaration : undefined;
   // Nominal covariant overrides share the base's return ABI, but retain
   // their declared subclass result at the call site. Unannotated fluent
   // JS overrides use the same bridge for their proven receiver result.
@@ -6523,6 +6653,7 @@ export function recordKeysArrayCall(
   loc: SrcLoc,
 ): IrExpr {
   const resultT = arrayOf(STRING);
+  lowerer.keyOrder.observe(argIr);
   const key = `obj.keys:${argIr.shapeId}:${typeKey(resultT)}`;
   let helper = lowerer.arrHofHelpers.get(key);
   if (!helper) {
@@ -6641,6 +6772,99 @@ function recordHasOwnHelper(lowerer: Lowerer, shapeId: string, loc: SrcLoc): str
   return helper;
 }
 
+/** Whether `Object.assign(instance, record)` can copy every field of the
+ * record shape into a field the class declares with the same type: a plain
+ * record (no tuple, index signature or accessor slots) and a compiled
+ * class whose chain has no builtin or runtime-provided storage and no
+ * accessor for the written names. */
+function classAssignPlan(lowerer: Lowerer, className: string, srcShapeId: string): boolean {
+  const info = lowerer.classes.get(className);
+  const shape = lowerer.shapes.get(srcShapeId);
+  if (!info || !shape || shape.tuple || shape.indexValue || shapeHasAccessorSlots(shape))
+    return false;
+  for (let c: ClassInfo | null = info; c; c = c.base) {
+    if (c.builtinError || c.builtinEmitter || c.builtinStream !== undefined || c.def.runtime)
+      return false;
+  }
+  return shape.fields.every((f) => {
+    const declared = info.fields.get(f.name);
+    return (
+      declared !== undefined &&
+      (typeEquals(declared, f.type) || lowerer.widthLiftPlan(f.type, declared) !== null) &&
+      !lowerer.findMethodOn(info, f.name) &&
+      !lowerer.findMethodOn(info, `get:${f.name}`) &&
+      !lowerer.findMethodOn(info, `set:${f.name}`)
+    );
+  });
+}
+
+/** Interned `%obj.assignClass.<n>(o, s)` — Object.assign's per-field
+ * write of a record into a class instance (classAssignPlan's gate):
+ * optional source fields write only when present, and the instance
+ * returns. */
+function classAssignHelper(
+  lowerer: Lowerer,
+  className: string,
+  srcShapeId: string,
+  loc: SrcLoc,
+): string | null {
+  if (!classAssignPlan(lowerer, className, srcShapeId)) return null;
+  const key = `obj.assignClass:${className}:${srcShapeId}`;
+  const existing = lowerer.arrHofHelpers.get(key);
+  if (existing) return existing;
+  const helper = `%obj.assignClass.${lowerer.arrHofHelpers.size}`;
+  lowerer.arrHofHelpers.set(key, helper);
+  const sShape = lowerer.shapes.get(srcShapeId)!;
+  const oT: IrType = { kind: "object", className };
+  const sT: IrType = { kind: "record", shapeId: srcShapeId };
+  const oRef: IrExpr = { kind: "varRef", localId: "o.0", type: oT, loc };
+  const sRef: IrExpr = { kind: "varRef", localId: "s.0", type: sT, loc };
+  const body: IrStmt[] = [];
+  const info = lowerer.classes.get(className)!;
+  for (const f of sShape.fields) {
+    const declared = info.fields.get(f.name)!;
+    const read: IrExpr = {
+      kind: "recordGet",
+      obj: sRef,
+      shapeId: srcShapeId,
+      field: f.name,
+      type: f.type,
+      loc,
+    };
+    const lift = typeEquals(declared, f.type) ? null : lowerer.widthLiftPlan(f.type, declared);
+    const set: IrStmt = {
+      kind: "fieldSet",
+      obj: oRef,
+      className,
+      field: f.name,
+      value: lift === null ? read : lowerer.applyWidthLift(lift, read, declared, loc),
+      loc,
+    };
+    const present = lowerer.recordFieldPresent(sRef, srcShapeId, f.name, loc);
+    body.push(
+      present.kind === "recordHas"
+        ? { kind: "if", cond: present, then: [set], else_: null, loc }
+        : set,
+    );
+  }
+  body.push({ kind: "return", value: oRef, loc });
+  lowerer.liftedFns.push({
+    name: helper,
+    params: [
+      { localId: "o.0", name: "o", type: oT },
+      { localId: "s.0", name: "s", type: sT },
+    ],
+    returnType: oT,
+    locals: [
+      { id: "o.0", name: "o", type: oT, mutable: true },
+      { id: "s.0", name: "s", type: sT, mutable: true },
+    ],
+    body,
+    loc,
+  });
+  return helper;
+}
+
 /** Interned `%obj.assign.<n>(t, s)` — Object.assign's per-field copy
  * over signature-free records (every source field lands on a same-named,
  * same-typed target field — the caller's gate): optional source fields
@@ -7282,6 +7506,28 @@ function lowerObjectStaticCall(
           return { kind: "libCall", fn: "dyn.assign", args: [target, source], type: DYN, loc };
         }
       }
+      // A CLASS-INSTANCE target and a plain record source whose fields are
+      // all fields the class declares with the same types
+      // (`Object.assign(this, { retries: 3 })`): the per-field write into
+      // the instance, returning it — the instance mutates in place.
+      if (tProbe?.type.kind === "object" && sProbe?.type.kind === "record") {
+        const helper = classAssignPlan(lowerer, tProbe.type.className, sProbe.type.shapeId);
+        if (helper) {
+          const loc = locOf(call);
+          const target = lowerer.lowerExpr(call.arguments.nodes[0]!);
+          const source = lowerer.lowerExpr(call.arguments.nodes[1]!);
+          if (target.type.kind === "object" && source.type.kind === "record") {
+            const name = classAssignHelper(
+              lowerer,
+              target.type.className,
+              source.type.shapeId,
+              loc,
+            );
+            if (name)
+              return { kind: "call", callee: name, args: [target, source], type: target.type, loc };
+          }
+        }
+      }
       if (tProbe?.type.kind === "record" && sProbe?.type.kind === "record") {
         const tShape = lowerer.shapes.get(tProbe.type.shapeId);
         const sShape = lowerer.shapes.get(sProbe.type.shapeId);
@@ -7372,6 +7618,25 @@ function lowerObjectStaticCall(
             const srcNode = spread ? argNode.expression : argNode;
             const rawSource = lowerer.lowerExpr(srcNode);
             fenceSymbolFieldCopy(lowerer, srcNode, rawSource.type, spread);
+            // A class instance copied into a fresh object
+            // (`Object.assign({}, instance)`): the result is a plain
+            // object holding the instance's own fields, never an
+            // instance, so a result the checker types as the class has
+            // no representation (the checked cast would throw).
+            if (
+              rawSource.type.kind === "object" &&
+              freshLiteralTarget &&
+              !ts.isExpressionStatement(call.parent)
+            ) {
+              const resultT = lowerer.mapTypeOf(lowerer.typeOf(call));
+              if (resultT !== null && resultT.kind === "object") {
+                lowerer.unsupported(
+                  "SC1090",
+                  srcNode,
+                  `Object.assign copying a '${lowerer.fmt(rawSource.type)}' instance into a fresh object typed as the class (the copy is a plain object holding the instance's own fields, not an instance — build the object literal from the fields you need)`,
+                );
+              }
+            }
             const src = lowerer.coerceToExpected(rawSource, DYN);
             if (src.type.kind !== "dyn") {
               ok = false;
@@ -7765,7 +8030,7 @@ function lowerObjectStaticCall(
       ? lowerer.checker.getSymbolAtLocation(argNode)
       : undefined;
     const namespace = symbol
-      ? lowerer.checker.declarationsOf(symbol).some((decl) => ts.isNamespaceImport(decl))
+      ? symbol.declarations.some((decl) => ts.isNamespaceImport(decl))
       : false;
     const names = namespace ? [...UTIL_TYPES_KEYS, "default"].sort() : UTIL_TYPES_KEYS;
     const loc = locOf(call);
@@ -8003,6 +8268,7 @@ function lowerObjectStaticCall(
     valueT = tupleShape.fields.find((f) => f.name === "1")!.type;
   }
 
+  lowerer.keyOrder.observe(argIr);
   const key = `obj.${member}:${argIr.shapeId}:${typeKey(resultT)}`;
   let helper = lowerer.arrHofHelpers.get(key);
   if (!helper) {
@@ -8408,7 +8674,7 @@ function isOverloadedMemberAccess(lowerer: Lowerer, access: ts.PropertyAccessExp
 function resolvedOverloadResultType(lowerer: Lowerer, call: ts.CallExpression): IrType {
   const { checker } = lowerer;
   const signature = checker.getResolvedSignature(call);
-  const decl = signature ? checker.signatureDeclaration(signature) : undefined;
+  const decl = signature ? signature.declaration : undefined;
   const declared = decl ? checker.getSignatureFromDeclaration(decl) : undefined;
   const source = declared && declared.getTypeParameters().length === 0 ? declared : signature;
   const result = source ? lowerer.mapTypeOf(checker.getReturnTypeOfSignature(source)) : null;
@@ -8600,7 +8866,7 @@ const SP_BRAND_METHODS = new Set([
 function arrowSignatureOf(lowerer: Lowerer, node: ts.Expression): ts.Signature | null {
   const signatures = lowerer.checker.getCallSignatures(lowerer.typeOf(node));
   if (signatures.length !== 1) return null;
-  const declaration = lowerer.checker.signatureDeclaration(signatures[0]!);
+  const declaration = signatures[0]!.declaration;
   return declaration !== undefined && ts.isArrowFunction(declaration) ? signatures[0]! : null;
 }
 
@@ -8853,7 +9119,7 @@ function lowerObjLitGenericMethodCall(
   const recvT = lowerer.typeOf(access.expression);
   const propSym = lowerer.checker.getPropertyOfType(recvT, name);
   if (!propSym) return null;
-  const propertyDecl = lowerer.checker.valueDeclarationOf(propSym);
+  const propertyDecl = propSym.valueDeclaration;
   if (
     propertyDecl &&
     ts.isShorthandPropertyAssignment(propertyDecl) &&
@@ -8877,13 +9143,11 @@ function lowerObjLitGenericMethodCall(
   // claimed compilable ones; a class that failed collection keeps its
   // own diagnostics and the generic method-call fence downstream).
   if (
-    lowerer.checker
-      .declarationsOf(propSym)
-      .some(
-        (d) =>
-          d.parent !== undefined &&
-          (ts.isClassDeclaration(d.parent) || ts.isClassExpression(d.parent)),
-      )
+    propSym.declarations.some(
+      (d) =>
+        d.parent !== undefined &&
+        (ts.isClassDeclaration(d.parent) || ts.isClassExpression(d.parent)),
+    )
   ) {
     return null;
   }
@@ -8950,9 +9214,9 @@ function lowerObjLitGenericMethodCall(
     // receiver's runtime class must be provable — name that discipline
     // instead of the object-literal wording when the method lives on an
     // interface.
-    const onInterface = lowerer.checker
-      .declarationsOf(propSym)
-      .some((d) => d.parent !== undefined && ts.isInterfaceDeclaration(d.parent));
+    const onInterface = propSym.declarations.some(
+      (d) => d.parent !== undefined && ts.isInterfaceDeclaration(d.parent),
+    );
     // A receiver held as a checked-dynamic value (a class-backed interface)
     // dispatches by name to the runtime object's member, which a generic
     // method answers with its erased instance; the result converts to this
@@ -9006,7 +9270,9 @@ export function lowerObjectMethodCall(
   access: ts.PropertyAccessExpression,
 ): IrExpr | null {
   if (lowerer.chainBlocked(access, call)) return null;
-  let mappedReceiver = lowerer.mapTypeOf(lowerer.typeOf(access.expression));
+  let mappedReceiver =
+    structuralReadType(lowerer, access.expression) ??
+    lowerer.mapTypeOf(lowerer.typeOf(access.expression));
   // EventEmitter's static side (the class, a value of it, or the events
   // module, which is the class) keeps its static surface on the emitter
   // dispatch (`EventEmitter.setMaxListeners(n)`), which tells the statics
@@ -9620,6 +9886,44 @@ function unionObjectMethodHelper(
   if (existing) return existing;
   const name = `%union.call.${lowerer.unionCallHelpers.size}`;
   lowerer.unionCallHelpers.set(key, name);
+  // A probe that catches a refusal while the body lowers must not leave
+  // the name registered for a helper that was never emitted.
+  try {
+    lowerer.liftedFns.push(
+      unionObjectMethodFunction(
+        lowerer,
+        name,
+        sourceCall,
+        receiverT,
+        method,
+        plans,
+        shapes,
+        resultT,
+        loc,
+      ),
+    );
+  } catch (e) {
+    lowerer.unionCallHelpers.delete(key);
+    throw e;
+  }
+  return name;
+}
+
+function unionObjectMethodFunction(
+  lowerer: Lowerer,
+  name: string,
+  sourceCall: ts.CallExpression,
+  receiverT: IrType & { kind: "union" },
+  method: string,
+  plans: {
+    arm: IrType & { kind: "object" };
+    info: ClassInfo;
+    found: NonNullable<ReturnType<Lowerer["findMethodOn"]>>;
+  }[],
+  shapes: readonly ParamShape[],
+  resultT: IrType,
+  loc: SrcLoc,
+): IrFunction {
   const receiver = varRef("this.0", receiverT, loc);
   const argRefs = shapes.map((shape, i) => varRef(`a.${i}`, shape.type, loc));
   const branch = (plan: (typeof plans)[number]): IrStmt[] => {
@@ -9694,8 +9998,7 @@ function unionObjectMethodHelper(
     type: param.type,
     mutable: false,
   }));
-  lowerer.liftedFns.push({ name, params, returnType: resultT, locals, body, loc });
-  return name;
+  return { name, params, returnType: resultT, locals, body, loc };
 }
 
 /** The argument's lowered type for a message (what the static form saw),
@@ -9888,6 +10191,22 @@ export function lowerStaticNumberGlobal(
   return null;
 }
 
+/** `crypto.getRandomValues(view)` on the WebCrypto global or webcrypto. */
+function lowerWebCryptoGetRandomValues(
+  lowerer: Lowerer,
+  call: ts.CallExpression,
+  access: ts.PropertyAccessExpression,
+): IrExpr | null {
+  if (
+    access.name.text !== "getRandomValues" ||
+    call.questionDotToken ||
+    access.questionDotToken ||
+    !isWebCryptoReceiver(lowerer, access.expression)
+  )
+    return null;
+  return lowerCryptoGetRandomValues(lowerer, call);
+}
+
 /** A then handler's promise-armed result (`.then(() => cached ?? load())`
  * typed `T | Promise<T>`, or a `Promise<void> | void` callback's result):
  * the lifted async body adopts the promise arm and fulfills with the
diff --git a/packages/compiler/src/frontend/lowering/lower-classes.ts b/packages/compiler/src/frontend/lowering/lower-classes.ts
index 770c74840..6589d7c04 100644
--- a/packages/compiler/src/frontend/lowering/lower-classes.ts
+++ b/packages/compiler/src/frontend/lowering/lower-classes.ts
@@ -1,5 +1,10 @@
 import { lowerValueReturningConstructorNew } from "./js-dynamic-objects.js";
 import { dynUndefinedExpr, nodeThrowExpr, varRef } from "../../ir/build.js";
+import {
+  constructedFromValue,
+  constructedValue,
+  superIntoResultSlot,
+} from "./constructor-returns.js";
 import { checkedIterableSpread } from "./checked-iterable-spread.js";
 import { lowerReadlineUiNew } from "./builtins/readline.js";
 import { checkedClassUnionAssertion } from "./class-assertions.js";
@@ -86,7 +91,7 @@ import {
   isNodeTypesPath,
   locOf,
 } from "../program.js";
-import { PoisonError, dynFallbackType, newFnCtx, own } from "./lowerer.js";
+import { PoisonError, dynFallbackType, jsFuncNameOf, newFnCtx, own } from "./lowerer.js";
 import { isAssertClassNew } from "./assert-instances.js";
 import { lowerArrayConstructor } from "./containers/array-construction.js";
 import { lowerMapSeedNew, lowerSetSeedNew } from "./containers/collection-methods.js";
@@ -178,6 +183,39 @@ export function returnsOnlyThis(member: ts.MethodDeclaration): boolean {
   return valid;
 }
 
+/** returnsOnlyThis, also accepting a comma expression whose last operand
+ * is `this` (the minifier's `return a(), this.x = v, this`, jose's fluent
+ * claim setters). Used only to narrow a call's result back to the
+ * receiver's class. */
+export function returnsOnlyThisValue(member: ts.MethodDeclaration): boolean {
+  const body = member.body;
+  const last = body?.statements?.nodes.at(-1);
+  if (!body || !last || !ts.isReturnStatement(last)) return false;
+  let valid = true;
+  const visit = (node: ts.Node): void => {
+    if (ts.isFunctionLike(node)) return;
+    if (ts.isReturnStatement(node)) {
+      let value = node.expression;
+      for (;;) {
+        while (value && ts.isParenthesizedExpression(value)) value = value.expression;
+        if (
+          value &&
+          ts.isBinaryExpression(value) &&
+          value.operatorToken.kind === ts.SyntaxKind.CommaToken
+        ) {
+          value = value.right;
+          continue;
+        }
+        break;
+      }
+      if (!value || value.kind !== ts.SyntaxKind.ThisKeyword) valid = false;
+    }
+    node.forEachChild(visit);
+  };
+  body.forEachChild(visit);
+  return valid;
+}
+
 function functionLocalClass(decl: ts.ClassLikeDeclaration): boolean {
   for (
     let parent: ts.Node | undefined = decl.parent;
@@ -221,14 +259,12 @@ export function storedClassValueType(
     const symbol = lowerer.resolveValueSymbol(expression);
     const declaration =
       symbol &&
-      lowerer.checker
-        .declarationsOf(symbol)
-        .find(
-          (decl) =>
-            ts.isVariableDeclaration(decl) &&
-            decl.initializer &&
-            (ts.getCombinedNodeFlags(decl) & ts.NodeFlags.Const) !== 0,
-        );
+      symbol.declarations.find(
+        (decl) =>
+          ts.isVariableDeclaration(decl) &&
+          decl.initializer &&
+          (ts.getCombinedNodeFlags(decl) & ts.NodeFlags.Const) !== 0,
+      );
     if (declaration && ts.isVariableDeclaration(declaration) && declaration.initializer) {
       const value = storedClassValueType(lowerer, declaration.initializer, visiting);
       if (value?.kind === "classval") return value;
@@ -243,7 +279,7 @@ export function storedClassValueType(
   const mapped = lowerer.mapTypeOf(type);
   if (mapped?.kind === "classval" && !lowerer.classes.has(mapped.className)) {
     for (const signature of lowerer.checker.getConstructSignatures(type)) {
-      const constructor = lowerer.checker.signatureDeclaration(signature);
+      const constructor = signature.declaration;
       const declaration =
         constructor && ts.isConstructorDeclaration(constructor) ? constructor.parent : undefined;
       if (
@@ -284,14 +320,12 @@ export function storedClassValueType(
       const symbol = lowerer.resolveValueSymbol(callee);
       const declaration =
         symbol &&
-        lowerer.checker
-          .declarationsOf(symbol)
-          .find(
-            (decl) =>
-              ts.isVariableDeclaration(decl) &&
-              decl.initializer &&
-              (ts.getCombinedNodeFlags(decl) & ts.NodeFlags.Const) !== 0,
-          );
+        symbol.declarations.find(
+          (decl) =>
+            ts.isVariableDeclaration(decl) &&
+            decl.initializer &&
+            (ts.getCombinedNodeFlags(decl) & ts.NodeFlags.Const) !== 0,
+        );
       if (declaration && ts.isVariableDeclaration(declaration) && declaration.initializer) {
         callee = declaration.initializer;
         continue;
@@ -353,7 +387,7 @@ export function storedClassValueType(
   // Cache the module-level closure so its captures and lifted bodies are
   // exactly the ones used when the declaration executes.
   for (const signature of lowerer.checker.getConstructSignatures(type)) {
-    const declaration = lowerer.checker.signatureDeclaration(signature);
+    const declaration = signature.declaration;
     const cls = declaration && ts.isConstructorDeclaration(declaration) ? declaration.parent : null;
     if (!cls || (!ts.isClassExpression(cls) && !ts.isClassDeclaration(cls))) continue;
     let factory: ts.ArrowFunction | ts.FunctionExpression | undefined;
@@ -725,7 +759,7 @@ export interface GenericClassInfo {
  * or the ElementAccessExpression itself). Null when no declaration has
  * that shape (well-known-symbol members like `[Symbol.iterator]`). */
 function lateBoundKeySymOf(lowerer: Lowerer, p: ts.Symbol): ts.Symbol | null {
-  for (const d of lowerer.checker.declarationsOf(p)) {
+  for (const d of p.declarations) {
     const access =
       ts.isBinaryExpression(d) && ts.isElementAccessExpression(d.left)
         ? d.left
@@ -990,7 +1024,7 @@ export function builtinStreamInfoOf(
     // member to the stdlib class symbol. The declaration itself is
     // alias plumbing (streamClassAliasDecl — both declaration walks
     // skip it).
-    const decl = lowerer.checker.valueDeclarationOf(symbol);
+    const decl = symbol.valueDeclaration;
     if (
       decl &&
       ts.isVariableDeclaration(decl) &&
@@ -1012,7 +1046,7 @@ export function builtinStreamInfoOf(
     if (rec.lib === symbol.name) irName = name;
   }
   if (!irName) return null;
-  const declared = lowerer.checker.declarationsOf(symbol).some((d) => {
+  const declared = symbol.declarations.some((d) => {
     if (!ts.isClassDeclaration(d)) return false;
     if (isNodeTypesPath(d.getSourceFile().fileName)) return false;
     let node: ts.Node | undefined = d.parent;
@@ -1034,15 +1068,13 @@ function jsFieldInitializerType(lowerer: Lowerer, type: IrType, expression: ts.E
     const symbol = lowerer.checker.getSymbolAtLocation(expression);
     if (
       symbol &&
-      lowerer.checker
-        .declarationsOf(symbol)
-        .some(
-          (decl) =>
-            ts.isParameter(decl) &&
-            ((ts.isConstructorDeclaration(decl.parent) &&
-              !checkedJsDocumentedParameter(lowerer, decl)) ||
-              (lowerer.typeOf(expression).flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !== 0),
-        )
+      symbol.declarations.some(
+        (decl) =>
+          ts.isParameter(decl) &&
+          ((ts.isConstructorDeclaration(decl.parent) &&
+            !checkedJsDocumentedParameter(lowerer, decl)) ||
+            (lowerer.typeOf(expression).flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !== 0),
+      )
     )
       return DYN;
   }
@@ -1102,7 +1134,7 @@ function jsFieldInitializerType(lowerer: Lowerer, type: IrType, expression: ts.E
         const symbol = lowerer.checker.getSymbolAtLocation(part.name);
         if (
           symbol &&
-          lowerer.checker.declarationsOf(symbol).some((decl) => {
+          symbol.declarations.some((decl) => {
             const member = ts.isBinaryExpression(decl) ? decl.left : decl;
             return (
               ts.isPropertyAccessExpression(member) &&
@@ -1244,13 +1276,10 @@ function returnsWidenedJsField(
           : undefined;
       if (
         symbol &&
-        lowerer.checker
-          .declarationsOf(symbol)
-          .some(
-            (declaration) =>
-              ts.isMethodDeclaration(declaration) &&
-              lowerer.checkedVirtualJsMethods.has(declaration),
-          )
+        symbol.declarations.some(
+          (declaration) =>
+            ts.isMethodDeclaration(declaration) && lowerer.checkedVirtualJsMethods.has(declaration),
+        )
       )
         return true;
     }
@@ -1263,14 +1292,12 @@ function returnsWidenedJsField(
       const symbol = lowerer.checker.getSymbolAtLocation(expression.name);
       if (
         symbol &&
-        lowerer.checker
-          .declarationsOf(symbol)
-          .some(
-            (declaration) =>
-              (ts.isGetAccessorDeclaration(declaration) ||
-                ts.isSetAccessorDeclaration(declaration)) &&
-              lowerer.checkedVirtualJsAccessors.has(declaration),
-          )
+        symbol.declarations.some(
+          (declaration) =>
+            (ts.isGetAccessorDeclaration(declaration) ||
+              ts.isSetAccessorDeclaration(declaration)) &&
+            lowerer.checkedVirtualJsAccessors.has(declaration),
+        )
       )
         return true;
     }
@@ -1303,11 +1330,11 @@ function returnsWidenedJsField(
  * (genResultRecord's list, including scalar-backed Date values). */
 function undefArmedFieldType(lowerer: Lowerer, p: ts.Symbol): IrType | null {
   const t = lowerer.checker.getTypeOfSymbol(p);
-  const site = lowerer.checker.declarationsOf(p)[0];
+  const site = p.declarations[0];
   let mapped = lowerer.mapTypeOf(t) ?? (site ? dynFallbackType(lowerer, site, t) : null);
   if (mapped && site) mapped = jsOpenObjectType(site, mapped, lowerer.shapes, lowerer.unions);
   if (!mapped || mapped.kind === "void") return null;
-  for (const declaration of lowerer.checker.declarationsOf(p)) {
+  for (const declaration of p.declarations) {
     const assignment = ts.isBinaryExpression(declaration) ? declaration : declaration.parent;
     if (
       assignment &&
@@ -1354,7 +1381,7 @@ export function builtinEmitterInfoOf(
     // follow the member off the module namespace. The declaration
     // itself is alias plumbing (builtinMemberRequireDecl — both
     // declaration walks skip it).
-    const decl = lowerer.checker.valueDeclarationOf(symbol);
+    const decl = symbol.valueDeclaration;
     if (
       decl !== undefined &&
       ts.isVariableDeclaration(decl) &&
@@ -1370,7 +1397,7 @@ export function builtinEmitterInfoOf(
     return null;
   }
   if (symbol.name !== "EventEmitter") return null;
-  const declared = lowerer.checker.declarationsOf(symbol).some((d) => {
+  const declared = symbol.declarations.some((d) => {
     if (!ts.isClassDeclaration(d) && !ts.isInterfaceDeclaration(d)) return false;
     let node: ts.Node | undefined = d.parent;
     while (node) {
@@ -1539,7 +1566,7 @@ function collectClassShapeDeferring(lowerer: Lowerer, decl: ts.ClassDeclaration)
       const baseSymbol =
         reference && ts.isIdentifier(reference) ? lowerer.resolveValueSymbol(reference) : undefined;
       const baseDeclaration = baseSymbol
-        ? lowerer.checker.declarationsOf(baseSymbol).find(ts.isClassDeclaration)
+        ? baseSymbol.declarations.find(ts.isClassDeclaration)
         : undefined;
       if (
         baseDeclaration &&
@@ -1886,8 +1913,7 @@ export function collectClassShapeInner(
         return true;
       }
       const signatures = lowerer.checker.getCallSignatures(lowerer.typeOf(expression));
-      const source =
-        signatures.length === 1 ? lowerer.checker.signatureDeclaration(signatures[0]!) : undefined;
+      const source = signatures.length === 1 ? signatures[0]!.declaration : undefined;
       if (
         !source ||
         !isJsSourceFile(source.getSourceFile()) ||
@@ -2023,12 +2049,9 @@ export function collectClassShapeInner(
           // what actually blocks it).
           const rebinds =
             memberSym !== undefined &&
-            lowerer.checker
-              .declarationsOf(memberSym)
-              .filter(
-                (d) =>
-                  ts.isBinaryExpression(d) && d.operatorToken.kind === ts.SyntaxKind.EqualsToken,
-              ).length > 1;
+            memberSym.declarations.filter(
+              (d) => ts.isBinaryExpression(d) && d.operatorToken.kind === ts.SyntaxKind.EqualsToken,
+            ).length > 1;
           if (rebinds) {
             lowerer.unsupported(
               "SC1090",
@@ -3345,6 +3368,56 @@ export function collectClassShapeInner(
               .map((p): ParamShape => ({ type: p.type, mode: "omittable" })),
           );
         }
+        // A TypeScript override of a JavaScript method (`class T extends
+        // Agent` over an npm-static package) keeps the base's checked-value
+        // ABI: each untyped base slot stays dyn, and the override's typed
+        // parameter narrows from it at entry with a checked conversion. An
+        // untyped base return takes the override's value boxed. Calls on
+        // a statically typed receiver see the same ABI.
+        if (
+          overridden &&
+          !isJsSourceFile(member.getSourceFile()) &&
+          overridden.declarer.decl !== null &&
+          isJsSourceFile(overridden.declarer.decl.getSourceFile()) &&
+          member.asteriskToken === undefined &&
+          !overridden.sig.async &&
+          !overridden.sig.gen &&
+          shapes.length <= overridden.sig.params.length &&
+          shapes.every((p, i) => {
+            const inherited = overridden.sig.params[i]!;
+            return (
+              (p.mode === "required" || p.mode === "omittable") &&
+              p.bodyType === undefined &&
+              (inherited.mode === "required" || inherited.mode === "omittable") &&
+              (typeEquals(p.type, inherited.type) ||
+                (inherited.type.kind === "dyn" && lowerer.dynConvertible(p.type)))
+            );
+          }) &&
+          overridden.sig.params
+            .slice(shapes.length)
+            .every(
+              (p) => p.type.kind === "dyn" && (p.mode === "required" || p.mode === "omittable"),
+            )
+        ) {
+          for (let i = 0; i < shapes.length; i++) {
+            const own = shapes[i]!;
+            if (overridden.sig.params[i]!.type.kind === "dyn" && own.type.kind !== "dyn")
+              shapes[i] = { type: DYN, mode: own.mode, entryNarrow: own.type };
+          }
+          shapes.push(
+            ...overridden.sig.params
+              .slice(shapes.length)
+              .map((p): ParamShape => ({ type: p.type, mode: "omittable" })),
+          );
+          if (
+            overridden.sig.ret.kind === "dyn" &&
+            ft.ret.kind !== "dyn" &&
+            ft.ret.kind !== "void" &&
+            lowerer.dynConvertible(ft.ret)
+          )
+            ft.ret = DYN;
+          ft.params = shapes.map((shape) => shape.type);
+        }
         if (
           overridden &&
           member.asteriskToken === undefined &&
@@ -4015,14 +4088,12 @@ export function collectClassShapeInner(
         if (fields.has(p.name) || methods.has(p.name)) continue;
         if (hasAccessor(p.name)) continue;
         if (base && (base.fields.has(p.name) || lowerer.findMethodOn(base, p.name))) continue;
-        const site = lowerer.checker
-          .declarationsOf(p)
-          .find(
-            (d) =>
-              ts.isPropertyAccessExpression(d) ||
-              ts.isBinaryExpression(d) ||
-              ts.isElementAccessExpression(d),
-          );
+        const site = p.declarations.find(
+          (d) =>
+            ts.isPropertyAccessExpression(d) ||
+            ts.isBinaryExpression(d) ||
+            ts.isElementAccessExpression(d),
+        );
         if (!site) continue;
         // Late-bound properties: the ones the scan above collected are
         // real fields under their printable names — skip. The rest keep
@@ -4726,8 +4797,7 @@ export function analyzeClassDecoration(lowerer: Lowerer, info: ClassInfo): void
             : null;
       if (ambientCallee !== null) {
         const sym = lowerer.resolveValueSymbol(ambientCallee);
-        const vdecl =
-          sym && !lowerer.isStdlibSymbol(sym) ? lowerer.checker.declarationsOf(sym)[0] : undefined;
+        const vdecl = sym && !lowerer.isStdlibSymbol(sym) ? sym.declarations[0] : undefined;
         const ambientVar =
           vdecl !== undefined &&
           ts.isVariableDeclaration(vdecl) &&
@@ -5392,6 +5462,75 @@ function namedEvaluationName(expr: ts.ClassLikeDeclaration): string {
   return "";
 }
 
+/** Each evaluation of a function-local class creates fresh private names,
+ * while the compiled class shares one layout across evaluations. A
+ * JavaScript class's prototype methods are closures per evaluation, so the
+ * names agree when every private member is an instance field and every use
+ * is on `this` (privateNamesOnlyOnThis): native methods only run on their
+ * own evaluation's instances, and the closures, which receive any `this`,
+ * check the receiver's evaluation against the class's own binding
+ * (private-brands.ts), so the class must be a named declaration (undici's
+ * webidl FastIterableIterator). The checker rejects writes to that binding. */
+function localPrivateFieldsAgree(expr: ts.ClassLikeDeclaration): boolean {
+  if (!isJsSourceFile(expr.getSourceFile()) || !ts.isClassDeclaration(expr) || !expr.name)
+    return false;
+  if (
+    expr.members.nodes.some(
+      (member) =>
+        member.name !== undefined &&
+        ts.isPrivateIdentifier(member.name) &&
+        !ts.isPropertyDeclaration(member),
+    )
+  )
+    return false;
+  return privateNamesOnlyOnThis(expr);
+}
+
+/** Every private name is used only on `this` inside the class's own instance
+ * members (`this.#x`, `#x in this`), outside nested classes and non-arrow
+ * functions, and the class has no static members that could hand instances
+ * across evaluations. */
+function privateNamesOnlyOnThis(expr: ts.ClassLikeDeclaration): boolean {
+  let ok = true;
+  for (const member of expr.members.nodes) {
+    if (ts.getModifiers(member)?.some((m) => m.kind === ts.SyntaxKind.StaticKeyword)) return false;
+    ts.walkPreorder(member, (node) => {
+      if (!ok) return "stop";
+      // A nested class or non-arrow function rebinds `this`: any private
+      // name inside it disqualifies.
+      if (
+        node !== member &&
+        (ts.isClassDeclaration(node) ||
+          ts.isClassExpression(node) ||
+          ts.isFunctionExpression(node) ||
+          ts.isFunctionDeclaration(node))
+      ) {
+        ts.walkPreorder(node, (inner) => {
+          if (ts.isPrivateIdentifier(inner)) ok = false;
+          return ok ? undefined : "stop";
+        });
+        return "skip";
+      }
+      if (ts.isPrivateIdentifier(node)) {
+        const parent = node.parent;
+        const onThis =
+          parent === member ||
+          (ts.isPropertyAccessExpression(parent) &&
+            parent.name === node &&
+            parent.expression.kind === ts.SyntaxKind.ThisKeyword) ||
+          (ts.isBinaryExpression(parent) &&
+            parent.left === node &&
+            parent.operatorToken.kind === ts.SyntaxKind.InKeyword &&
+            parent.right.kind === ts.SyntaxKind.ThisKeyword);
+        if (!onThis) ok = false;
+      }
+      return undefined;
+    });
+    if (!ok) return false;
+  }
+  return true;
+}
+
 /** Collect a class expression once per enclosing specialization. Function-local
  * evaluations allocate fresh constructor objects; top-level expressions use
  * immortal templates. Static initialization remains limited to whole top-level
@@ -5429,7 +5568,8 @@ export function lowerClassExpressionInfo(
   }
   if (
     local &&
-    expr.members.nodes.some((member) => member.name && ts.isPrivateIdentifier(member.name))
+    expr.members.nodes.some((member) => member.name && ts.isPrivateIdentifier(member.name)) &&
+    !localPrivateFieldsAgree(expr)
   ) {
     lowerer.unsupported("SC1090", expr, "function-local classes with private brands");
   }
@@ -5747,7 +5887,7 @@ export function exactClassOfReceiver(lowerer: Lowerer, expr: ts.Expression): Cla
   // static write would create an own property in JS. The general
   // class-value write fence answers instead.
   if (direct) return direct.classDecorators?.valueGlobalId !== undefined ? null : direct;
-  const decl = lowerer.checker.valueDeclarationOf(symbol);
+  const decl = symbol.valueDeclaration;
   if (
     !decl ||
     !ts.isVariableDeclaration(decl) ||
@@ -5795,7 +5935,7 @@ export function propertyAssignedClassInfoOf(
     symbol.flags & ts.SymbolFlags.Alias ? lowerer.checker.getAliasedSymbol(symbol) : symbol;
   const registered = lowerer.classBySymbol.get(resolved);
   if (registered) return registered;
-  const decls = lowerer.checker.declarationsOf(resolved);
+  const decls = resolved.declarations;
   // The class expression's OWN symbol (tsgo's answer through CJS export
   // aliases): the declaration is the expression itself. Its top-level
   // assignment statement must be the binding's ONLY producer. The
@@ -6259,7 +6399,7 @@ function capturesEnclosingScope(
     if (captured) return;
     if (ts.isIdentifier(node)) {
       const symbol = lowerer.checker.getSymbolAtLocation(node);
-      const decl = symbol ? lowerer.checker.valueDeclarationOf(symbol) : undefined;
+      const decl = symbol ? symbol.valueDeclaration : undefined;
       // The enclosing function's own name is the same binding for every
       // evaluation.
       if (decl && decl !== scope && inside(decl, scope) && !inside(decl, member)) captured = true;
@@ -6665,7 +6805,7 @@ export function collectInheritedJsFieldWrites(
         for (const base of lowerer.checker.getBaseTypes(target)) {
           for (const [name, expressions] of writes) {
             const property = lowerer.checker.getPropertyOfType(base, name);
-            for (const declaration of property ? lowerer.checker.declarationsOf(property) : []) {
+            for (const declaration of property ? property.declarations : []) {
               if (ts.isMethodDeclaration(declaration) || ts.isAccessor(declaration)) continue;
               let owner: ts.Node | undefined = declaration.parent;
               while (owner && !ts.isClassDeclaration(owner) && !ts.isClassExpression(owner))
@@ -6724,7 +6864,7 @@ export function collectVirtualJsMethods(lowerer: Lowerer, files: readonly ts.Sou
             for (const member of accessors) {
               if (!ts.isIdentifier(member.name)) continue;
               const property = lowerer.checker.getPropertyOfType(base, member.name.text);
-              for (const declaration of property ? lowerer.checker.declarationsOf(property) : []) {
+              for (const declaration of property ? property.declarations : []) {
                 if (
                   (ts.isGetAccessorDeclaration(declaration) ||
                     ts.isSetAccessorDeclaration(declaration)) &&
@@ -6767,7 +6907,7 @@ export function collectVirtualJsMethods(lowerer: Lowerer, files: readonly ts.Sou
             for (const member of members) {
               if (!ts.isIdentifier(member.name)) continue;
               const property = lowerer.checker.getPropertyOfType(base, member.name.text);
-              for (const declaration of property ? lowerer.checker.declarationsOf(property) : []) {
+              for (const declaration of property ? property.declarations : []) {
                 if (
                   ts.isMethodDeclaration(declaration) &&
                   isJsSourceFile(declaration.getSourceFile()) &&
@@ -6877,7 +7017,7 @@ export function exactInstanceClassOf(lowerer: Lowerer, expr: ts.Expression): Cla
   if (direct) return direct;
   if (!ts.isIdentifier(e)) return null;
   const symbol = lowerer.resolveValueSymbol(e);
-  const decl = symbol ? lowerer.checker.valueDeclarationOf(symbol) : undefined;
+  const decl = symbol ? symbol.valueDeclaration : undefined;
   if (
     !decl ||
     !ts.isVariableDeclaration(decl) ||
@@ -6988,19 +7128,43 @@ export function lowerClassGenericMethodCall(
         }
       : upcastTo(lowerer, receiver, declarer.def.name);
   const args = lowerer.completeArgs(call.arguments.nodes, instance.params, loc, call);
-  return {
+  const result: IrExpr = {
     kind: "call",
     callee: instance.name,
     args: [thisArg, ...args],
     type: instance.returnType,
     loc,
   };
+  // A fluent JavaScript method (every return ends in `this`, jose's claim
+  // setters) answers the receiver: the instance returns the declarer's
+  // class, a used result's checker type is the receiver's subclass.
+  if (
+    result.type.kind === "object" &&
+    !ts.isExpressionStatement(call.parent) &&
+    ts.isMethodDeclaration(info.decl) &&
+    isJsSourceFile(info.decl.getSourceFile()) &&
+    returnsOnlyThisValue(info.decl)
+  ) {
+    return lowerer.maybeNarrow(result, call);
+  }
+  return result;
 }
 
 /** Wraps a derived-class expression in an upcast when the target base
  * class differs (a no-op reinterpret at runtime; keeps IR types exact). */
 export function upcastTo(lowerer: Lowerer, expr: IrExpr, className: string): IrExpr {
   if (expr.type.kind === "object" && expr.type.className !== className) {
+    // A value lowered at an ANCESTOR of the class the site needs (a
+    // fluent `this` result whose lowering kept the method's declaring
+    // class, the receiver of the next call in a chain): the checker
+    // vouches for the subclass, so the bridge is the verified downcast,
+    // never an upcast the validator rejects (an internal error before).
+    if (
+      !lowerer.isSubclassOf(expr.type.className, className) &&
+      lowerer.isSubclassOf(className, expr.type.className)
+    ) {
+      return { kind: "downcast", value: expr, type: { kind: "object", className }, loc: expr.loc };
+    }
     return { kind: "upcast", value: expr, type: { kind: "object", className }, loc: expr.loc };
   }
   return expr;
@@ -8303,7 +8467,7 @@ export function superCallStmt(
     )[0]!;
   }
   lowerer.noteSuperConstructorEdge(`%${base.def.name}.constructor`);
-  return {
+  const call: IrStmt = {
     kind: "exprStmt",
     expr: {
       kind: "call",
@@ -8314,6 +8478,14 @@ export function superCallStmt(
     },
     loc,
   };
+  return superIntoResultSlot(
+    lowerer,
+    base,
+    info,
+    call,
+    lowerer.upcastTo({ ...thisRef }, base.def.name),
+    info.ctor ?? info.decl!,
+  );
 }
 
 /** `super.method(args)`: the base chain's implementation, called
@@ -8711,21 +8883,21 @@ function lowerProgramClassNew(
     : lowerer.completeArgs(expr.arguments?.nodes ?? [], info.ctorParams, loc, expr);
   for (let current: ClassInfo | null = info; current; current = current.base) {
     if (current.def.baseValueGlobal)
-      return {
+      return constructedValue(lowerer, info, {
         kind: "newValue",
         callee: classValueRef(lowerer, info, expr),
         args,
         type: { kind: "object", className: info.def.name },
         loc,
-      };
+      });
   }
-  return {
+  return constructedValue(lowerer, info, {
     kind: "new",
     className: info.def.name,
     args,
     type: { kind: "object", className: info.def.name },
     loc,
-  };
+  });
 }
 
 function assignedThisFieldType(lowerer: Lowerer, expr: ts.NewExpression): IrType | null {
@@ -8767,7 +8939,7 @@ export function lowerNew(lowerer: Lowerer, expr: ts.NewExpression): IrExpr {
   let intlConstructor = expr.expression;
   if (ts.isIdentifier(intlConstructor)) {
     const symbol = lowerer.resolveValueSymbol(intlConstructor);
-    const declaration = symbol ? lowerer.checker.valueDeclarationOf(symbol) : undefined;
+    const declaration = symbol ? symbol.valueDeclaration : undefined;
     if (declaration && ts.isVariableDeclaration(declaration) && declaration.initializer)
       intlConstructor = declaration.initializer;
   }
@@ -8791,9 +8963,7 @@ export function lowerNew(lowerer: Lowerer, expr: ts.NewExpression): IrExpr {
     const symbol = lowerer.resolveValueSymbol(expr.expression);
     const declaration =
       symbol &&
-      lowerer.checker
-        .declarationsOf(symbol)
-        .find((node) => ts.isFunctionDeclaration(node) && node.body !== undefined);
+      symbol.declarations.find((node) => ts.isFunctionDeclaration(node) && node.body !== undefined);
     if (declaration && ts.isFunctionDeclaration(declaration) && declaration.body) {
       const last = declaration.body.statements.nodes.at(-1);
       if (
@@ -9026,13 +9196,18 @@ export function lowerNew(lowerer: Lowerer, expr: ts.NewExpression): IrExpr {
             loc,
             expr,
           );
-          return {
-            kind: "newValue",
-            callee,
-            args,
-            type: { kind: "object", className: info.def.name },
-            loc,
-          };
+          return constructedFromValue(
+            lowerer,
+            info,
+            {
+              kind: "newValue",
+              callee,
+              args,
+              type: { kind: "object", className: info.def.name },
+              loc,
+            },
+            expr,
+          );
         }
       }
     }
@@ -9659,7 +9834,7 @@ export function lowerNew(lowerer: Lowerer, expr: ts.NewExpression): IrExpr {
         const a0 = args[0]!;
         if (ts.isIdentifier(a0) && a0.text === "setImmediate") {
           const sym = lowerer.checker.getSymbolAtLocation(a0);
-          const decls = sym ? lowerer.checker.declarationsOf(sym) : [];
+          const decls = sym ? sym.declarations : [];
           if (decls.length > 0 && decls.every((d) => lowerer.isStdlibFile(d.getSourceFile()))) {
             // The settled value is the undefined dyn value — the result
             // is promise<dyn> whatever T the checker inferred for the
@@ -9955,13 +10130,18 @@ export function lowerNew(lowerer: Lowerer, expr: ts.NewExpression): IrExpr {
         loc,
         expr,
       );
-      const built: IrExpr = {
-        kind: "newValue",
-        callee,
-        args,
-        type: { kind: "object", className: info.def.name },
-        loc,
-      };
+      const built = constructedFromValue(
+        lowerer,
+        info,
+        {
+          kind: "newValue",
+          callee,
+          args,
+          type: { kind: "object", className: info.def.name },
+          loc,
+        },
+        expr,
+      );
       // A runtime class slot widened from a union (`[Readable, Writable]`'s
       // elements hold EventEmitter values): the checker types the result as
       // the union of the arms' instances, which the checked class view
@@ -10028,7 +10208,15 @@ export function lowerNew(lowerer: Lowerer, expr: ts.NewExpression): IrExpr {
       ((callee.type.kind === "func" || callee.type.kind === "classval") &&
         lowerer.dynConvertible(callee.type)))
   ) {
-    return lowerCheckedConstructor(lowerer, expr, lowerer.coerceToExpected(callee, DYN));
+    let boxed = lowerer.coerceToExpected(callee, DYN);
+    // A plain function's box carries its name: the construction's
+    // prototype records it as `constructor`, which util.inspect prints
+    // (`F { a: 2 }`).
+    if (boxed.kind === "dynFrom" && boxed.fnName === undefined && callee.type.kind === "func") {
+      const name = jsFuncNameOf(expr.expression, lowerer);
+      if (name !== null) boxed = { ...boxed, fnName: name };
+    }
+    return lowerCheckedConstructor(lowerer, expr, boxed);
   }
   lowerer.unsupported(
     "SC1090",
diff --git a/packages/compiler/src/frontend/lowering/lower-comptime.ts b/packages/compiler/src/frontend/lowering/lower-comptime.ts
index f811d13b6..41c6704c5 100644
--- a/packages/compiler/src/frontend/lowering/lower-comptime.ts
+++ b/packages/compiler/src/frontend/lowering/lower-comptime.ts
@@ -162,7 +162,7 @@ export function rejectComptimeCaptures(
         const symbol = ts.isShorthandPropertyAssignment(parent)
           ? lowerer.checker.getShorthandAssignmentValueSymbol(parent)
           : lowerer.checker.getSymbolAtLocation(node);
-        const decls = symbol ? lowerer.checker.declarationsOf(symbol) : undefined;
+        const decls = symbol ? symbol.declarations : undefined;
         if (symbol && decls && decls.length > 0) {
           const ownLocal = decls.every(
             (d) => d.getSourceFile() === sf && d.pos >= cb.pos && d.end <= cb.end,
diff --git a/packages/compiler/src/frontend/lowering/lower-enums.ts b/packages/compiler/src/frontend/lowering/lower-enums.ts
index 03e22e684..159d72f32 100644
--- a/packages/compiler/src/frontend/lowering/lower-enums.ts
+++ b/packages/compiler/src/frontend/lowering/lower-enums.ts
@@ -73,7 +73,7 @@ export function lowerEnumAccess(
   if (ts.isPropertyAccessExpression(expr)) {
     const sym = lowerer.checker.getSymbolAtLocation(expr.name);
     if (sym && sym.flags & ts.SymbolFlags.EnumMember) {
-      const decl = lowerer.checker.valueDeclarationOf(sym);
+      const decl = sym.valueDeclaration;
       if (decl && ts.isEnumMember(decl) && effectFreeReceiver(expr.expression)) {
         return lowerEnumMemberRead(lowerer, expr, decl);
       }
@@ -86,9 +86,9 @@ export function lowerEnumAccess(
   if (!ts.isIdentifier(recv)) return null;
   const recvSym = lowerer.resolveValueSymbol(recv);
   if (!recvSym || !(recvSym.flags & ts.SymbolFlags.Enum)) return null;
-  const decls = lowerer.checker
-    .declarationsOf(recvSym)
-    .filter((d): d is ts.EnumDeclaration => ts.isEnumDeclaration(d));
+  const decls = recvSym.declarations.filter((d): d is ts.EnumDeclaration =>
+    ts.isEnumDeclaration(d),
+  );
   if (decls.length === 0) return null;
   let key = expr.argumentExpression;
   while (ts.isParenthesizedExpression(key)) key = key.expression;
@@ -222,7 +222,7 @@ function foldConstIndex(lowerer: Lowerer, e: ts.Expression): number | null {
   if (ts.isPropertyAccessExpression(x)) {
     const sym = lowerer.checker.getSymbolAtLocation(x.name);
     if (sym && sym.flags & ts.SymbolFlags.EnumMember) {
-      const decl = lowerer.checker.valueDeclarationOf(sym);
+      const decl = sym.valueDeclaration;
       if (decl && ts.isEnumMember(decl)) {
         const v = lowerer.checker.getConstantValue(decl);
         if (typeof v === "number") return v;
diff --git a/packages/compiler/src/frontend/lowering/lower-event-emitter.ts b/packages/compiler/src/frontend/lowering/lower-event-emitter.ts
index b8297fe91..06e9c4ab1 100644
--- a/packages/compiler/src/frontend/lowering/lower-event-emitter.ts
+++ b/packages/compiler/src/frontend/lowering/lower-event-emitter.ts
@@ -420,7 +420,7 @@ function isErrorMonitorRef(lowerer: Lowerer, arg: ts.Expression): boolean {
   // binding's type in JavaScript; its source property still names it.
   if (!ts.isIdentifier(arg)) return false;
   const symbol = lowerer.resolveValueSymbol(arg);
-  const declaration = symbol ? lowerer.checker.valueDeclarationOf(symbol) : undefined;
+  const declaration = symbol ? symbol.valueDeclaration : undefined;
   if (!declaration || !ts.isBindingElement(declaration)) return false;
   const pattern = declaration.parent;
   const variable = pattern?.parent;
@@ -475,7 +475,7 @@ function staticStringPrefixOf(
     const symbol = lowerer.resolveValueSymbol(expression);
     if (!symbol || seen.has(symbol)) return null;
     seen.add(symbol);
-    const declaration = lowerer.checker.valueDeclarationOf(symbol);
+    const declaration = symbol.valueDeclaration;
     if (
       declaration &&
       ts.isVariableDeclaration(declaration) &&
@@ -509,7 +509,7 @@ function staticStringSuffixOf(
     const symbol = lowerer.resolveValueSymbol(expression);
     if (!symbol || seen.has(symbol)) return null;
     seen.add(symbol);
-    const declaration = lowerer.checker.valueDeclarationOf(symbol);
+    const declaration = symbol.valueDeclaration;
     if (
       declaration &&
       ts.isVariableDeclaration(declaration) &&
diff --git a/packages/compiler/src/frontend/lowering/lower-expando.ts b/packages/compiler/src/frontend/lowering/lower-expando.ts
index 5e4c43021..5ed97d4d7 100644
--- a/packages/compiler/src/frontend/lowering/lower-expando.ts
+++ b/packages/compiler/src/frontend/lowering/lower-expando.ts
@@ -97,7 +97,7 @@ function expandoFnSymbolOf(lowerer: Lowerer, recv: ts.Expression): ts.Symbol | n
   // existing member paths stay put.
   const sym = lowerer.resolveValueSymbol(recv);
   if (!sym) return null;
-  const decl = lowerer.checker.valueDeclarationOf(sym);
+  const decl = sym.valueDeclaration;
   if (!decl || decl.getSourceFile().isDeclarationFile) return null;
   if (isJsSourceFile(decl.getSourceFile())) return null;
   if (ts.isFunctionDeclaration(decl)) {
@@ -202,7 +202,7 @@ export function collectExpandoMembers(lowerer: Lowerer, sf: ts.SourceFile): void
           const memberName =
             typeof w.key === "string"
               ? w.key
-              : `sym%${w.key.name}%${lowerer.checker.declarationsOf(w.key)[0]?.getStart() ?? 0}`;
+              : `sym%${w.key.name}%${w.key.declarations[0]?.getStart() ?? 0}`;
           const g: IrGlobal = {
             id: `%g.${tag}${fnName}%.${memberName}`,
             name: `${fnName}.${memberName}`,
@@ -239,7 +239,7 @@ function nsOwnedMember(
   const nameNode = ts.isPropertyAccessExpression(access) ? access.name : access.argumentExpression;
   const sym = lowerer.checker.getSymbolAtLocation(nameNode);
   if (!sym) return false;
-  for (const d of lowerer.checker.declarationsOf(sym)) {
+  for (const d of sym.declarations) {
     for (
       let p: ts.Node | undefined = d.parent;
       p !== undefined && !ts.isSourceFile(p);
diff --git a/packages/compiler/src/frontend/lowering/lower-exprs.ts b/packages/compiler/src/frontend/lowering/lower-exprs.ts
index e7f6ed5d4..6cbe5d7a4 100644
--- a/packages/compiler/src/frontend/lowering/lower-exprs.ts
+++ b/packages/compiler/src/frontend/lowering/lower-exprs.ts
@@ -1,87 +1,24 @@
-import { dateJsonType, isDateJsonSource } from "./builtins/dates.js";
-import { guardNullProto, nullProtoRecordShape, recordNullProtoTest } from "./null-prototype.js";
-import { lowerProtocolPropertyRead } from "./class-protocol-dispatch.js";
-import { generatorDrain } from "./iterator-adapters.js";
-import { lowerEventObjectProperty, lowerEventObjectPropertyWrite } from "./lower-event-target.js";
-import { lowerDisposableStackInstanceOf } from "./builtins/disposable-stack.js";
-import { lowerEventStaticProperty } from "./builtins/numbers.js";
-import { lowerUnionEquality, tagEqualityMayMissAlias } from "./strict-equality.js";
-import { isOptionalProcessStreamProperty } from "./builtins/process.js";
-import { lowerWorkerMetadata } from "./builtins/workers.js";
-import { esmImportBindingKind } from "./builtins/module-bindings.js";
-import { lowerReadlineInstanceof, lowerReadlineProperty } from "./builtins/readline.js";
-import { lowerBlobInstanceof } from "./builtins/blob.js";
-import { lowerWebAssemblyTypeof, refuseWebAssemblyUse } from "./builtins/webassembly.js";
-import { lowerKeyObjectInstanceof } from "./builtins/key-object.js";
-import { lowerNetAddressInstanceof, lowerNetAddressStaticRead } from "./builtins/net-address.js";
-import { isExecExceptionType, refuseExecExceptionCode } from "./builtins/errors.js";
-import { STATS_TYPE_TESTS } from "./builtins/filesystem.js";
-import { threadsImportOf } from "../threads-import.js";
-import { experimentalImportOf, lifetimeRegionMemberOf } from "../experimental-import.js";
-import { lowerInternTableProperty } from "./intern-tables.js";
-import { lowerThreadSlotsProperty } from "./thread-slots.js";
+import { refuseWebAssemblyUse } from "./builtins/webassembly.js";
 import { dynUndefinedExpr, nodeThrowExpr, numLit, strLit, varRef } from "../../ir/build.js";
 import { InternalCompilerError } from "../../errors.js";
-import { SYMBOL_T } from "../../ir/ir.js";
-import { literalValues } from "../literal-values.js";
-import { literalUnionArm } from "../union-discriminants.js";
 /* Expression lowering: the expression dispatch (lowerExpr), literals
  * (array/object/regex/template), operators (binary incl. compound targets,
  * unary, instanceof, caught-typeof tests), union narrowing and unit
  * comparisons, nullish coalescing and optional chains, conditions and
  * ToBoolean/ToString coercion helpers, and field/element reads and writes
  * (FieldTarget). */
-import { isFsStreamMember, lowerFsStreamProperty } from "./builtins/fs-streams.js";
 import * as ts from "../ts7/adapter.js";
-import {
-  isZlibStreamMember,
-  lowerZlibInstanceOf,
-  lowerZlibStreamBytesWritten,
-} from "./builtins/compression.js";
-import {
-  runtimeClassValueOf,
-  runtimeClassValueOfType,
-  builtinClassAliasOwnsNoSlot,
-  builtinClassRefOf,
-  sameBuiltinClass,
-} from "./builtins/class-values.js";
+import { checkedPrivateReceiver, localPrivateBrandClass } from "./private-brands.js";
 import { constituentTypes } from "../ts7/checker.js";
-import { dirname } from "node:path";
-import * as posix from "node:path/posix";
 import type { Lowerer } from "./lowerer.js";
-import {
-  inlineNamespaceRequireOf,
-  lowerWithInlineRequireInit,
-  wholeExportValue,
-} from "./cjs-inline-require.js";
-import { tscInteropDefaultValueOf } from "./cjs-tsc-interop.js";
-import {
-  cjsExportMemberWriteGlobalOf,
-  cjsInFileExportGlobalOf,
-  isCjsExportsIdentifier,
-  lowerCjsExportsObjectValue,
-} from "./cjs-exports-object.js";
-import {
-  lowerMaybePromiseAwait,
-  maybePromiseInstanceOf,
-  maybePromiseUnionOf,
-} from "./maybe-promise.js";
-import { checkedClassAssertion, checkedClassUnionAssertion } from "./class-assertions.js";
-import { checkedArmExtraction } from "./coercions/unions.js";
-import { narrowClassUnion, narrowStoredClassValue } from "./class-unions.js";
-import { lowerUnionFieldRead, lowerUnionFieldWrite } from "./expressions/union-fields.js";
-import { captureContextArguments, declareContextLocal } from "./function-context.js";
-import { OBJECT_CALLABLE_VALUES } from "./surfaces.js";
-import { wasiGuestPath } from "../../wasi-paths.js";
+import { lowerMaybePromiseAwait, maybePromiseUnionOf } from "./maybe-promise.js";
+import { checkedClassUnionAssertion } from "./class-assertions.js";
 import {
   BIGINT_T,
-  BYTES_ELEMENT_NAME,
   BOOL,
   CAUGHT,
   DYN,
-  DYN_HANDLE_KINDS,
   F64,
-  type IrBytesElem,
   type IrExpr,
   type IrFunction,
   type IrLocal,
@@ -91,188 +28,103 @@ import {
   NULL_T,
   REF_TRUTHY_KINDS,
   REGEX,
-  RUNTIME_ERROR_CLASSES,
-  SEARCH_PARAMS_T,
   STRING,
   type SrcLoc,
   UNDEFINED_T,
   VOID,
   arrayOf,
-  canAdaptDynFuncTo,
-  canDynCheckTo,
-  canBoxFuncIntoDyn,
   funcOf,
-  isDynTypedRefType,
-  isSupportedArrayElem,
   isUnitType,
-  shapeHasAccessorSlots,
   typeEquals,
   typeKey,
-  unionContainerArmsOk,
 } from "../../ir/ir.js";
+import { isJsSourceFile, locOf } from "../program.js";
 import {
-  cjsClassExprWholeExportOf,
-  cjsExportAssignmentOf,
-  cjsExportDiscardReason,
-  isCjsExportTableLiteral,
-  isCjsJsFile,
-  isJsSourceFile,
-  isModuleExportsAccess,
-  isNodeEsmFile,
-  locOf,
-} from "../program.js";
-import {
-  ARRAY_METHODS,
-  builtinConstLit,
-  builtinFenceHintOf,
-  builtinModuleConstOf,
-  builtinModulesArrayLit,
-  builtinModuleFnOf,
-  COMPOUND_ASSIGN_OPS,
   type CompoundOp,
-  STDLIB_SURFACE,
-  isChildSurfaceMember,
-  MAP_METHODS,
   NARROW_FIRST,
-  SET_METHODS,
-  STRING_INDEX_METHODS,
-  STR_METHODS,
   UNSUPPORTED_EXPR,
   sideEffectFreeOptionValue,
   stdlibGlobalNameOf,
 } from "./surfaces.js";
-import {
-  UNSUPPORTED,
-  blockedBindingUseDiag,
-  unsupportedPackageValueDiag,
-  unsupportedDiag,
-} from "../../diagnostics/diagnostic.js";
-import { PoisonError, dynFallbackType, jsFuncNameOf, neverTaintedJsType, own } from "./lowerer.js";
-import { lowerCollectionSpread } from "./containers/collection-methods.js";
+import { UNSUPPORTED } from "../../diagnostics/diagnostic.js";
 import { lowerHelperReturnCall } from "./containers/iterator-helpers.js";
 import {
-  arrayNumberRead,
-  arrayValueRead,
-  arrayValueStore,
-  arrayValueType,
   lowerSafeIndexRead,
   tryLowerIndexTruthiness,
   tryLowerNumericIndexRead,
-  tryLowerBytesReadNumberEquality,
-  lowerSafeBytesRead,
 } from "./array-values.js";
-import { strCharsCall } from "./containers/array-construction.js";
-import { lowerOptionalStringIndex, lowerUnionStringIndex } from "./string-index.js";
-import { tryLowerIndexedComparison } from "./indexed-comparison.js";
-import { npmStaticPackageOfPath } from "../npm-static.js";
-import { unsupportedModuleFeatureOf } from "../builtin-modules.js";
-import { fenceEnumObjectValue, lowerEnumAccess } from "./lower-enums.js";
-import {
-  ambientNsRootOf,
-  ambientUndefReadType,
-  ambientUndefVarRootOf,
-  ambientUndefinedFnSymbolOf,
-  contextualUndefReadType,
-  fenceEarlyAliasUse,
-  fenceEarlyNsMemberRef,
-  lowerNsIdentifierValue,
-  nsMemberIdentOf,
-  nsUndefRead,
-  nsWritableTarget,
-} from "./lower-namespaces.js";
-import { expandoMemberRead, expandoWritableTarget } from "./lower-expando.js";
-import { lowerSocketInstanceOf, lowerTlsRootCertificates } from "./lower-server.js";
-import {
-  type ClassInfo,
-  findGenericMethodOn,
-  lowerStaticFieldRead,
-  staticFieldWriteTarget,
-  storedClassValueType,
-} from "./lower-classes.js";
-import { hasRuntimeStatics } from "./class-runtime-statics.js";
-import { bindingNeverReassigned, nullishGenericBindingUnitOf } from "./binding-analysis.js";
-import { funcTypeFromParamShapes } from "./call-signatures.js";
-import {
-  implicitMonoFile,
-  objLitGenericFnInfoOf,
-  objLitGenericFnNodeOf,
-  requireObjLitGenericReceiver,
-} from "./generic-functions.js";
+import { nsMemberIdentOf } from "./lower-namespaces.js";
+import { bindingNeverReassigned } from "./binding-analysis.js";
+import { implicitMonoFile } from "./generic-functions.js";
 import { lowerTaggedTemplate } from "./lower-calls.js";
-import { mixinFnOfCallee } from "./lower-mixins.js";
-import {
-  isConstAssertionTypeNode,
-  isGenericCallableMemberType,
-  isLegacyUrlSymbol,
-  isOsConstantsType,
-  isParseArgsDynTypeName,
-  underConstAssertion,
-  unitOnlyUnion,
-  withUnitArm,
-} from "../type-mapper.js";
-import { iteratorResultValueRead, lowerYield } from "./lower-generators.js";
-import { errorPropertyRead, errorPropertyWrite, errorToStringCall } from "./error-methods.js";
-import { lowerStreamProperty, lowerStreamStateProperty, streamSidesOf } from "./lower-stream.js";
+import { unitOnlyUnion } from "../type-mapper.js";
+import { lowerYield } from "./lower-generators.js";
 import { unionWideningTags } from "../../ir/analysis.js";
 import { isSafeToDiscard, isSafeToRepeat } from "./expressions/evaluation-safety.js";
-import { globalSymbolKey } from "./expressions/global-symbols.js";
-import { lowerShortCircuitAssignment } from "./expressions/nullish-assignment.js";
-import {
-  hasOptionalChainGuard,
-  isOptionalChainTail,
-  isRequireMainFilename,
-} from "./expressions/optional-chains.js";
-import { foldedStringKeyOf } from "./expressions/object-literals.js";
-import { tryLowerExpression } from "./expressions/try-lower-expression.js";
-import {
-  classToNumberConversion,
-  classToStringConversion,
-  classUnionToString,
-} from "./class-to-primitive.js";
-import {
-  fenceNodeModuleMutation,
-  isNodeModuleValue,
-  lowerCjsTopLevelThis,
-  lowerNodeModuleIdentifier,
-  isCjsModuleGlobal,
-  lowerNodeModuleProperty,
-  lowerRequireCacheElement,
-  lowerRequireCacheHas,
-  lowerRequireMainProperty,
-} from "./lower-node-module.js";
-import { lowerAbstractEquality } from "./abstract-equality.js";
+import { hasOptionalChainGuard, isOptionalChainTail } from "./expressions/optional-chains.js";
+import { classToStringConversion, classUnionToString } from "./class-to-primitive.js";
+import { lowerCjsTopLevelThis, lowerRequireCacheElement } from "./lower-node-module.js";
 import {
   coerceStringSearchValue,
   defaultAfterUndefined,
   lowerStaticallyUndefinedArgument,
 } from "./optional-arguments.js";
-import { recordTextCodecClass } from "../../ir/ir.js";
 import { classSymbolKeyOf } from "./symbol-fields.js";
-import { lowerClassMethodValue } from "./class-method-values.js";
-import { classInstanceOf } from "./class-dynamic-dispatch.js";
-import { lowerGlobalValue } from "./lower-global-value.js";
-import { importMetaField, isImportMeta } from "./import-meta.js";
+import { lowerTypeofExpr } from "./expressions/typeof.js";
+import { lowerIdentifierExpr } from "./expressions/identifiers.js";
+import { lowerFieldCompoundValue, lowerIncDec } from "./expressions/updates.js";
+import { lowerTernary } from "./expressions/narrowing.js";
 import {
-  lowerClassPrototypeData,
-  lowerClassPrototypeComputedAssignment,
-} from "./class-prototypes.js";
-import { isClassCallback } from "./class-callbacks.js";
-import {
-  builtinConstantsObject,
-  builtinPrototypeMethod,
-  lowerArrayIsArrayValue,
-  lowerCheckedPredicateValue,
-  lowerNumberParserValue,
-  lowerObjectAssignValue,
-  lowerStringCodesValue,
-} from "./lower-builtin-values.js";
-import { lowerArrayFromValue } from "./containers/array-construction.js";
-import { lowerPerfHooksTypeof } from "./builtins/performance.js";
-import { isSearchParamsIterable, lowerUrlAssignment } from "./builtins/url.js";
-import { jsBindingHasOpenWrites } from "./lower-stmts.js";
-import { checkedClassInstanceOf } from "./class-construction.js";
-import { lowerModuleNamespaceElement } from "./module-namespace-elements.js";
-import { isPerfEntryType, perfEntryTag } from "./builtins/performance.js";
+  classFieldTarget,
+  lowerPropertyAccessExpr,
+  lowerUnionKeyedRead,
+} from "./expressions/property-access.js";
+import { lowerNullishPair } from "./expressions/binary.js";
+import { lowerElementCompoundParts } from "./expressions/element-access.js";
+export {
+  DEFERRED_READ_MESSAGE,
+  abstractPropertyDeclOf,
+  fieldGetExpr,
+  fieldTarget,
+  isMatchSliceType,
+  lowerFieldRead,
+  lowerGroupsProjection,
+  lowerIntrinsicProperty,
+  lowerUnionProperty,
+  matchResultNamedGroupsOf,
+} from "./expressions/property-access.js";
+export {
+  lowerAsExpression,
+  lowerTernary,
+  maybeNarrow,
+  runtimeOptionalGuardIds,
+  runtimeOptionalTrueIds,
+  v8CalleeText,
+  withRuntimeOptionalNarrowed,
+} from "./expressions/narrowing.js";
+export {
+  ensureString,
+  lowerBinary,
+  lowerCompoundValueToTarget,
+  lowerElementCompound,
+  lowerNativeFunctionAssignment,
+  lowerStrictEquality,
+  lowerUnitComparison,
+} from "./expressions/binary.js";
+export { jsHoldsDynObject, lowerArrayLiteral } from "./expressions/array-literals.js";
+export {
+  lowerElementAccess,
+  lowerElementWrite,
+  lowerEnvironmentKey,
+  lowerRecordKeyRead,
+} from "./expressions/element-access.js";
+export {
+  fieldSetStmt,
+  lowerIncDec,
+  lowerIncDecTarget,
+  lowerPrefixUnary,
+} from "./expressions/updates.js";
+export { lowerInstanceOf } from "./expressions/relational.js";
 
 /** An assignable `obj.field` target — a class field, a record field, or a
  * class ACCESSOR property (reads become getter calls, writes setter calls;
@@ -336,78 +188,6 @@ export function templateRawTextOf(
 const LOWER_EXPR_MAX_DEPTH = 200;
 let lowerExprDepth = 0;
 
-/** True when a property access names an ABSTRACT property declaration
- * (`abstract p: number` — a PropertyDeclaration, not an accessor).
- * These uses need concrete property dispatch because the base has no slot. */
-export function abstractPropertyDeclOf(
-  lowerer: Lowerer,
-  expr: ts.PropertyAccessExpression,
-): boolean {
-  const sym = lowerer.checker.getSymbolAtLocation(expr.name);
-  if (!sym) return false;
-  return lowerer.checker
-    .declarationsOf(sym)
-    .some(
-      (d) =>
-        ts.isPropertyDeclaration(d) &&
-        ts.getModifiers(d)?.some((m) => m.kind === ts.SyntaxKind.AbstractKeyword) === true,
-    );
-}
-
-/** A field declared by node:util's parseArgs checked-dynamic type family.
- * Narrowing a ParseArgsToken exposes one anonymous union arm, so its alias
- * identity no longer reaches mapType; declaration ancestry is the stable
- * provenance check. */
-function isParseArgsDynProperty(lowerer: Lowerer, expr: ts.PropertyAccessExpression): boolean {
-  const sym = lowerer.checker.getSymbolAtLocation(expr.name);
-  if (!sym) return false;
-  return lowerer.checker.declarationsOf(sym).some((d) => {
-    if (!lowerer.isStdlibFile(d.getSourceFile())) return false;
-    let inParseArgsType = false;
-    for (let node: ts.Node | undefined = d.parent; node; node = node.parent) {
-      if (
-        (ts.isTypeAliasDeclaration(node) || ts.isInterfaceDeclaration(node)) &&
-        isParseArgsDynTypeName(node.name.text)
-      ) {
-        inParseArgsType = true;
-      }
-      if (ts.isModuleDeclaration(node) && ts.isStringLiteral(node.name)) {
-        return inParseArgsType && (node.name.text === "util" || node.name.text === "node:util");
-      }
-    }
-    return false;
-  });
-}
-
-function isStatFsDynProperty(lowerer: Lowerer, expr: ts.PropertyAccessExpression): boolean {
-  if (
-    !["type", "bsize", "blocks", "bfree", "bavail", "files", "ffree", "bigint"].includes(
-      expr.name.text,
-    )
-  )
-    return false;
-  const symbol = lowerer.checker.getSymbolAtLocation(expr.name);
-  return (
-    !!symbol &&
-    lowerer.checker.declarationsOf(symbol).some((declaration) => {
-      if (!lowerer.isStdlibFile(declaration.getSourceFile())) return false;
-      const parent = declaration.parent;
-      if (!ts.isInterfaceDeclaration(parent)) return false;
-      if (
-        expr.name.text === "bigint"
-          ? parent.name.text !== "StatFsOptions"
-          : !["StatsFsBase", "StatsFs", "BigIntStatsFs"].includes(parent.name.text)
-      )
-        return false;
-      for (let node: ts.Node | undefined = parent.parent; node; node = node.parent) {
-        if (ts.isModuleDeclaration(node) && ts.isStringLiteral(node.name))
-          return node.name.text === "fs" || node.name.text === "node:fs";
-      }
-      return false;
-    })
-  );
-}
-
 export function lowerExpr(lowerer: Lowerer, expr: ts.Expression): IrExpr {
   if (lowerExprDepth >= LOWER_EXPR_MAX_DEPTH) {
     lowerer.unsupported(
@@ -639,1041 +419,8 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
       "'void' with an effectful operand in value position (hoist the operand to its own statement — statement-position 'void e' and void-returning arrow bodies compile)",
     );
   }
-  if (ts.isTypeOfExpression(expr)) {
-    const webAssembly = lowerWebAssemblyTypeof(lowerer, expr.expression);
-    if (webAssembly) return webAssembly;
-    if (lowerer.isStdlibGlobal(expr.expression, "process"))
-      return { kind: "strLit", value: "object", type: STRING, loc };
-    if (lowerer.isStdlibGlobal(expr.expression, "fetch"))
-      return { kind: "strLit", value: "function", type: STRING, loc };
-    const performance = lowerPerfHooksTypeof(lowerer, expr.expression);
-    if (performance) return performance;
-    if (isNodeModuleValue(lowerer, expr.expression)) {
-      return { kind: "strLit", value: "object", type: STRING, loc };
-    }
-    // `typeof EventEmitter`, `typeof zlib.Gzip`, `typeof C` over a
-    // builtin class alias.
-    if (builtinClassRefOf(lowerer, expr.expression) !== null) {
-      return { kind: "strLit", value: "function", type: STRING, loc };
-    }
-    if (ts.isPropertyAccessExpression(expr.expression)) {
-      const member = expr.expression;
-      const prototype = member.expression;
-      if (
-        STRING_INDEX_METHODS.has(member.name.text) &&
-        ts.isPropertyAccessExpression(prototype) &&
-        prototype.name.text === "prototype" &&
-        ts.isIdentifier(prototype.expression) &&
-        lowerer.isStdlibGlobal(prototype.expression, "String") &&
-        lowerer.isStdlibMember(member)
-      ) {
-        return { kind: "strLit", value: "function", type: STRING, loc };
-      }
-      if (
-        member.name.text === "at" &&
-        ts.isPropertyAccessExpression(prototype) &&
-        prototype.name.text === "prototype" &&
-        ts.isIdentifier(prototype.expression) &&
-        lowerer.isStdlibGlobal(prototype.expression, "Array") &&
-        lowerer.isStdlibMember(member)
-      ) {
-        return { kind: "strLit", value: "function", type: STRING, loc };
-      }
-      const presence = lowerPromiseThenPresence(lowerer, expr.expression, {
-        kind: "strLit",
-        value: "function",
-        type: STRING,
-        loc,
-      });
-      if (presence !== null) return presence;
-    }
-    // `typeof queueMicrotask` / `typeof DOMException` on a STDLIB global
-    // whose declared type is callable or constructable: folds to
-    // "function" BEFORE the operand lowers — the identity-token story
-    // (JS files) deliberately represents these values as strings, and
-    // the TS-file fence would name a value the program never needs; an
-    // identifier read has no side effects to preserve. Node's answer for
-    // every function and constructor global is "function" (the harness's
-    // `typeof queueMicrotask === 'function'` probes). Shadowing locals
-    // have non-stdlib symbols and keep the ordinary path.
-    let tested = expr.expression;
-    while (ts.isParenthesizedExpression(tested)) tested = tested.expression;
-    // `typeof zlib.Inflate` / `typeof zlib.createGzip`: an export of a
-    // Node builtin module read through a plain binding (an import or
-    // require result). The read has no side effects, and Node's answer for
-    // every exported function and class is "function".
-    if (
-      ts.isPropertyAccessExpression(tested) &&
-      ts.isIdentifier(tested.expression) &&
-      lowerer.isStdlibMember(tested)
-    ) {
-      const sym = lowerer.checker.getSymbolAtLocation(tested.name);
-      const decls = sym ? lowerer.checker.declarationsOf(sym) : [];
-      if (
-        decls.some(isBuiltinModuleValueDecl) &&
-        decls.every((decl) => builtinModuleExportParent(decl) !== undefined)
-      ) {
-        const t = lowerer.typeOf(tested);
-        if (
-          lowerer.checker.getCallSignatures(t).length > 0 ||
-          lowerer.checker.getConstructSignatures(t).length > 0
-        ) {
-          return { kind: "strLit", value: "function", type: STRING, loc };
-        }
-      }
-    }
-    if (ts.isIdentifier(tested)) {
-      const sym = lowerer.checker.getSymbolAtLocation(tested);
-      if (!sym) {
-        return { kind: "strLit", value: "undefined", type: STRING, loc };
-      }
-      // `const { inspect } = require("util")` / `import { inspect } from
-      // "node:util"`: a binding of a builtin module's exported function,
-      // class or object. JavaScript sources represent such a value without
-      // its own lowering as an identity token (a string), so the operand's
-      // representation cannot answer. Node's answer follows the export's
-      // kind, and the binding read has no effects.
-      const imported = isJsSourceFile(tested.getSourceFile())
-        ? lowerer.builtinImportOf(tested)
-        : null;
-      if (
-        imported &&
-        builtinModuleConstOf(lowerer, imported.module, imported.member) === undefined
-      ) {
-        const t = lowerer.typeOf(tested);
-        if (
-          lowerer.checker.getCallSignatures(t).length > 0 ||
-          lowerer.checker.getConstructSignatures(t).length > 0
-        ) {
-          return { kind: "strLit", value: "function", type: STRING, loc };
-        }
-        if ((t.flags & ts.TypeFlags.Object) !== 0) {
-          return { kind: "strLit", value: "object", type: STRING, loc };
-        }
-      }
-      if (lowerer.isStdlibSymbol(sym)) {
-        const t = lowerer.typeOf(expr.expression);
-        if (
-          lowerer.checker.getCallSignatures(t).length > 0 ||
-          lowerer.checker.getConstructSignatures(t).length > 0
-        ) {
-          return { kind: "strLit", value: "function", type: STRING, loc };
-        }
-      }
-    }
-    // A known static result type fixes typeof's answer, but its producer
-    // still evaluates: calls, getters, and checked reads can have effects
-    // or throw. Only trivial operands may disappear.
-    let operand = deferredSlotOr(
-      lowerer,
-      runtimeOptionalStorageOperand(lowerer, expr.expression) ?? lowerer.lowerExpr(expr.expression),
-    );
-
-    // A checker-narrowed dyn read arrives as a VALIDATED extraction
-    // (maybeNarrow's dynCheck bridge). typeof needs no extraction — the
-    // dyn kind table answers the question directly, and answers it even
-    // where the flow type lied (the extraction would throw instead) —
-    // so unwrap back to the dyn value and take the dyn.typeof path.
-    if (operand.kind === "dynCheck" && operand.value.type.kind === "dyn") {
-      operand = operand.value;
-    }
-    const FOLD: Partial<Record<string, string>> = {
-      f64: "number",
-      bigint: "bigint",
-      string: "string",
-      bool: "boolean",
-      func: "function",
-      array: "object",
-      object: "object",
-      record: "object",
-      symbol: "symbol",
-      map: "object",
-      set: "object",
-      promise: "object",
-      bytes: "object",
-      regex: "object",
-      generator: "object",
-      classval: "function",
-      moduleNs: "object",
-      undefinedT: "undefined",
-      nullT: "object",
-    };
-    const folded = FOLD[operand.type.kind];
-    if (folded) {
-      const result: IrExpr = { kind: "strLit", value: folded, type: STRING, loc };
-      return isSafeToDiscard(operand)
-        ? result
-        : {
-            kind: "seqExpr",
-            stmts: [{ kind: "exprStmt", expr: operand, loc }],
-            result,
-            type: STRING,
-            loc,
-          };
-    }
-    // A union operand: every arm's typeof answer is static, so the value
-    // form is a ternary chain over runtime TAG tests (arms grouped by
-    // answer; the last group needs no test). The operand rides several
-    // tests, so only side-effect-free reads compose — and when every arm
-    // agrees the whole expression folds to that one string (dropping only
-    // the pure read, the trust-the-checker bet lowerUnitComparison makes).
-    // An effectful producer (a getter) evaluates once into a hidden local.
-    const prelude: IrStmt[] = [];
-    if (operand.type.kind === "union" && !isSafeToRepeat(operand)) {
-      const local = lowerer.declareHiddenLocal("%typeofOperand", operand.type);
-      prelude.push({ kind: "varDecl", localId: local.id, init: operand, loc });
-      operand = varRef(local.id, operand.type, loc);
-    }
-    if (operand.type.kind === "union" && isSafeToRepeat(operand)) {
-      const def = lowerer.unions.get(operand.type.unionId);
-      const answers = def?.arms.map(typeofAnswer);
-      if (def && answers && answers.every((s): s is string => s !== null)) {
-        const groups = new Map<string, number[]>();
-        answers.forEach((s, i) => groups.set(s, [...(groups.get(s) ?? []), i]));
-        const ordered = [...groups.entries()];
-        let result: IrExpr = {
-          kind: "strLit",
-          value: ordered[ordered.length - 1]![0],
-          type: STRING,
-          loc,
-        };
-        for (const [answer, tags] of ordered.slice(0, -1).reverse()) {
-          let test: IrExpr = {
-            kind: "unionIsTag",
-            unionId: operand.type.unionId,
-            tag: tags[0]!,
-            negated: false,
-            value: operand,
-            type: BOOL,
-            loc,
-          };
-          for (const t of tags.slice(1)) {
-            test = {
-              kind: "logical",
-              op: "||",
-              left: test,
-              right: {
-                kind: "unionIsTag",
-                unionId: operand.type.unionId,
-                tag: t,
-                negated: false,
-                value: operand,
-                type: BOOL,
-                loc,
-              },
-              type: BOOL,
-              loc,
-            };
-          }
-          result = {
-            kind: "ternary",
-            cond: test,
-            then: { kind: "strLit", value: answer, type: STRING, loc },
-            else_: result,
-            type: STRING,
-            loc,
-          };
-        }
-        return prelude.length > 0
-          ? { kind: "seqExpr", stmts: prelude, result, type: STRING, loc }
-          : result;
-      }
-    }
-    if (operand.type.kind === "dyn") {
-      // Bare typeof on a dyn value: the runtime's kind→string table
-      // (null answers "object", boxed closures "function" — JS-exact
-      // for every dyn kind; "bigint"/"symbol" have no producers).
-      return { kind: "libCall", fn: "dyn.typeof", args: [operand], type: STRING, loc };
-    }
-    lowerer.unsupported("SC1090", expr, "typeof expressions on statically-typed values");
-  }
-  if (ts.isIdentifier(expr)) {
-    if (lowerer.isStdlibGlobal(expr, "console")) {
-      return { kind: "libCall", fn: "console.native", args: [], type: DYN, loc };
-    }
-
-    const moduleValue = lowerNodeModuleIdentifier(lowerer, expr);
-    if (moduleValue) return moduleValue;
-    if (expr.text === "exports") {
-      const exportsValue = lowerCjsExportsObjectValue(lowerer, expr);
-      if (exportsValue) return exportsValue;
-    }
-    if (lowerer.isSelfReference(expr)) {
-      return { kind: "selfRef", type: lowerer.ctx.selfType!, loc };
-    }
-    // `arguments` in a variadic JS function (the rest-marked form): the
-    // synthetic trailing dyn-array param — lambdaSignature marked the
-    // type and lowerLambda declared the local.
-    if (expr.text === "arguments") {
-      const binding = captureContextArguments(lowerer.fnStack);
-      if (binding) return { kind: "varRef", localId: binding.id, type: DYN, loc };
-    }
-    // A compiler-projected adapter as a VALUE: the adapter has no
-    // runtime function object (its calls rewrite directly) — call it
-    // through its immutable binding instead.
-    {
-      const sym = lowerer.resolveValueSymbol(expr);
-      const projection = sym ? lowerer.staticCallables.get(sym) : undefined;
-      if (
-        projection?.kind === "promisified-exec-file" ||
-        projection?.kind === "promisified-exec" ||
-        projection?.kind === "promisified-builtin" ||
-        projection?.kind === "promisified-zlib" ||
-        projection?.kind === "promisified-crypto" ||
-        projection?.kind === "promisified-dns"
-      ) {
-        lowerer.unsupported(
-          "SC1090",
-          expr,
-          `a promisified builtin as a value (call '${expr.text}' directly)`,
-        );
-      }
-      if (projection?.kind === "builtin-function") {
-        if (!isJsSourceFile(expr.getSourceFile())) {
-          const callable = lowerer.lowerBuiltinCallableValue(
-            { module: projection.module, member: projection.member },
-            loc,
-          );
-          if (callable) return callable;
-        }
-        lowerer.unsupported(
-          "SC1090",
-          expr,
-          `a builtin function alias as an escaping value (call '${expr.text}' directly)`,
-        );
-      }
-      // `EventEmitter`, `Readable` or `TypeError` (or a const alias of
-      // one) as a value in a TypeScript file: the runtime class's class
-      // object. JavaScript files keep the identity token.
-      if (!isJsSourceFile(expr.getSourceFile())) {
-        const runtimeClass = runtimeClassValueOf(lowerer, expr);
-        if (runtimeClass) return lowerer.classValueRef(runtimeClass, expr);
-      }
-      // `const E = EventEmitter` owns no runtime slot: construction,
-      // instanceof, typeof and .name lower at their use sites.
-      if (sym && builtinClassAliasOwnsNoSlot(lowerer, sym)) {
-        lowerer.unsupported(
-          "SC1090",
-          expr,
-          `a builtin class alias as an escaping value (use '${expr.text}' with new, instanceof, typeof or .name)`,
-        );
-      }
-    }
-    // Union-typed bindings read through tsc's control-flow narrowing:
-    // when the checker types this USE as a single arm, maybeNarrow
-    // bridges the tagged representation with a unionNarrow.
-    const local = lowerer.resolveLocal(expr);
-    if (local) {
-      // A switch can dispatch past a lexical declaration. Keep this
-      // previously refused codec form out until switch-scope TDZ boxes
-      // model that skipped initialization, including value aliases.
-      if (
-        local.type.kind === "record" &&
-        recordTextCodecClass(lowerer.shapes.get(local.type.shapeId)!) !== null
-      ) {
-        const symbol = lowerer.resolveValueSymbol(expr);
-        const decl = symbol ? lowerer.checker.valueDeclarationOf(symbol) : undefined;
-        if (
-          decl &&
-          ts.isVariableDeclaration(decl) &&
-          ts.isVariableDeclarationList(decl.parent) &&
-          (decl.parent.flags & ts.NodeFlags.BlockScoped) !== 0 &&
-          ts.isVariableStatement(decl.parent.parent)
-        ) {
-          const clause = decl.parent.parent.parent;
-          if (
-            (ts.isCaseClause(clause) || ts.isDefaultClause(clause)) &&
-            !(expr.getStart() >= clause.getStart() && expr.end <= clause.end)
-          ) {
-            lowerer.unsupported(
-              "SC1090",
-              expr,
-              "codec bindings read from another switch clause before initialization is proven",
-            );
-          }
-        }
-      }
-      if (local.type.kind === "caught") return lowerer.caughtRead(expr, local, loc);
-      const symbol = lowerer.resolveValueSymbol(expr);
-      const runtimeOptionalRoot = lowerer.runtimeOptionalRootOf(local);
-      const active = lowerer.runtimeOptionalLocals.has(runtimeOptionalRoot);
-      const arithmetic = lowerer.runtimeOptionalArithmeticLocals.has(runtimeOptionalRoot);
-      const captured =
-        !!symbol &&
-        lowerer.runtimeOptionalStorageLocals.has(runtimeOptionalRoot) &&
-        (local.boxed === true ||
-          lowerer.ctx.captureBySymbol.get(symbol) === local ||
-          runtimeOptionalRoot !== local);
-      if (arithmetic && !runtimeOptionalUseOf(expr)) {
-        return { kind: "varRef", localId: local.id, type: local.type, loc };
-      }
-      if (active || captured) {
-        const use = runtimeOptionalUseOf(expr);
-        if (use?.complex) {
-          lowerer.unsupported(
-            "SC1090",
-            expr,
-            "a logical or conditional receiver containing a runtime-optional capture",
-          );
-        }
-        if (use?.optional) return { kind: "varRef", localId: local.id, type: local.type, loc };
-        if (use?.kind === "property")
-          return runtimeOptionalReceiverRead(lowerer, expr, local, use.access.name.text, loc);
-        if (use?.kind === "element") {
-          const key = runtimeOptionalElementKey(use.access.argumentExpression);
-          if (key === null) {
-            return varRef(local.id, local.type, loc);
-          }
-          return runtimeOptionalReceiverRead(lowerer, expr, local, key, loc);
-        }
-        if (use?.kind === "call") {
-          if (use.comma && !use.optional) {
-            lowerer.unsupported(
-              "SC1090",
-              use.access,
-              "a direct call through a comma-wrapped runtime-optional capture",
-            );
-          }
-          return runtimeOptionalReceiverRead(lowerer, expr, local, null, loc);
-        }
-        if (runtimeOptionalObjectWalkerArg(lowerer, expr)) {
-          const narrowed = lowerer.mapTypeOf(lowerer.typeOf(expr));
-          if (local.type.kind === "union" && narrowed) {
-            const helper =
-              narrowed.kind === "union"
-                ? lowerer.narrowedRetagHelper(expr, local.type.unionId, narrowed.unionId, loc)
-                : !isUnitType(narrowed)
-                  ? lowerer.narrowedArmHelper(local.type.unionId, narrowed, loc)
-                  : null;
-            if (helper) {
-              return lowerer.checkedNarrowCall(
-                helper,
-                varRef(local.id, local.type, loc),
-                narrowed,
-                loc,
-              );
-            }
-          }
-        }
-        return { kind: "varRef", localId: local.id, type: local.type, loc };
-      }
-      const narrowed = lowerer.maybeNarrow(
-        { kind: "varRef", localId: local.id, type: local.type, loc },
-        expr,
-      );
-      if (
-        narrowed.type.kind === "union" &&
-        lowerer.runtimeOptionalStorageLocals.has(runtimeOptionalRoot) &&
-        lowerer.mapTypeOf(lowerer.typeOf(expr))?.kind === "record"
-      ) {
-        // A presence guard can be followed by a predicate strengthening
-        // the record's fields. Its refined shape is not a stored union
-        // arm: extract the original layout before reading a member.
-        const use = runtimeOptionalUseOf(expr);
-        if (use && !use.complex && !use.optional) {
-          if (use.kind === "property")
-            return runtimeOptionalReceiverRead(lowerer, expr, local, use.access.name.text, loc);
-          if (use.kind === "element") {
-            const key = runtimeOptionalElementKey(use.access.argumentExpression);
-            if (key !== null) return runtimeOptionalReceiverRead(lowerer, expr, local, key, loc);
-          }
-        }
-      }
-      return narrowed;
-    }
-    // `import x = N.y` aliases resolve transparently through globalOf/
-    // fnSigOf below; their source-order guards live here (a no-op for
-    // every non-import= binding — see lower-namespaces.ts).
-    fenceEarlyAliasUse(lowerer, expr, expr);
-    const g = lowerer.globalOf(expr);
-    if (g) {
-      // A global typed by a class that never REGISTERED (its collection
-      // fenced): the initializing assignment never lowered, so the read
-      // can only observe garbage — and the emitter would name a struct
-      // that does not exist. The blocked-binding cascade names the use;
-      // without this the validator's registration check ICEs on the live
-      // reference (`@this {T}` inference — signature 07).
-      const unregistered = lowerer.unregisteredClassOf(g.type, new Set());
-      if (unregistered !== null) {
-        // The class's own rejection is the root cause the cascade names.
-        lowerer.flushDeferredClass(unregistered);
-        lowerer.pushDiag(blockedBindingUseDiag(expr.text, loc));
-        throw new PoisonError();
-      }
-      const ref: IrExpr = { kind: "varRef", localId: g.id, type: g.type, loc };
-      if (lowerer.isRuntimeOptionalArithmeticGlobal(g) && !runtimeOptionalUseOf(expr)) {
-        return ref;
-      }
-      const storageHasUndefined =
-        g.type.kind === "union" && lowerer.armTag(g.type.unionId, UNDEFINED_T) >= 0;
-      if (lowerer.isRuntimeOptionalGlobal(g) || storageHasUndefined) {
-        // A checker-narrowed global receiver (`if (tags !== undefined)
-        // tags[tags.length] = ...`, or `a ? Object.keys(a) : ...`) is
-        // still stored as the runtime optional union. Extract the proven
-        // value arm before routing the member/element operation so dynamic
-        // keys and builtin record walkers do not see a union receiver.
-        const narrowed = lowerer.mapTypeOf(lowerer.typeOf(expr));
-        const arithmeticUnion =
-          g.type.kind === "union" &&
-          lowerer.unions.get(g.type.unionId)?.arms.length === 2 &&
-          lowerer.unions.get(g.type.unionId)!.arms.some((a) => a.kind === "f64") &&
-          lowerer.unions.get(g.type.unionId)!.arms.some((a) => a.kind === "string");
-        const symbol = lowerer.resolveValueSymbol(expr);
-        if (
-          !arithmeticUnion &&
-          !(symbol !== null && lowerer.earlyReadVars.has(symbol)) &&
-          g.type.kind === "union" &&
-          narrowed &&
-          narrowed.kind !== "union" &&
-          !isUnitType(narrowed) &&
-          !(
-            narrowed.kind === "record" &&
-            recordTextCodecClass(lowerer.shapes.get(narrowed.shapeId)!) !== null
-          ) &&
-          narrowed.kind !== "f64" &&
-          narrowed.kind !== "string" &&
-          narrowed.kind !== "bool" &&
-          lowerer.armTag(g.type.unionId, narrowed) >= 0
-        ) {
-          const helper = lowerer.narrowedArmHelper(g.type.unionId, narrowed, loc);
-          if (helper) return lowerer.checkedNarrowCall(helper, ref, narrowed, loc);
-        }
-        const use = runtimeOptionalUseOf(expr);
-        // The enclosing logical/conditional expression consumes the union
-        // before any member operation runs (`(value ?? fallback).length`).
-        // Keep the tagged value intact and let that lazy expression decide
-        // its branch; extracting here would evaluate or throw too early.
-        if (use?.complex) return ref;
-        if (use?.optional) return ref;
-        if (use?.kind === "property")
-          return runtimeOptionalReceiverRead(lowerer, expr, g, use.access.name.text, loc);
-        if (use?.kind === "element") {
-          const key = runtimeOptionalElementKey(use.access.argumentExpression);
-          if (key === null)
-            lowerer.unsupported(
-              "SC1090",
-              use.access,
-              "a computed read from a runtime-optional global (use a literal key)",
-            );
-          return runtimeOptionalReceiverRead(lowerer, expr, g, key, loc);
-        }
-        if (use?.kind === "call") return runtimeOptionalReceiverRead(lowerer, expr, g, null, loc);
-        return ref;
-      }
-      return lowerer.maybeNarrow(ref, expr);
-    }
-    // `undefined` — tsc's intrinsic global (a local shadowing the name
-    // resolved above): a unit literal, exactly like the `null` keyword.
-    if (expr.text === "undefined" && lowerer.typeOf(expr).flags & ts.TypeFlags.Undefined) {
-      return { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc };
-    }
-    // `__dirname` / `__filename` — the CommonJS module globals: per-
-    // MODULE compile-time constants, the containing file's location
-    // (Node's exact values when the same tree runs in place; WASI uses
-    // the equivalent guest-visible path; locals shadowing the names
-    // resolved above). In a file with ESM syntax Node never defines them
-    // (ReferenceError) — fence rather than invent a value there.
-    if (
-      (expr.text === "__dirname" || expr.text === "__filename") &&
-      lowerer.isStdlibGlobal(expr, expr.text)
-    ) {
-      const sf = expr.getSourceFile();
-      if (isNodeEsmFile(sf, lowerer.program)) {
-        lowerer.unsupported(
-          "SC1090",
-          expr,
-          `'${expr.text}' in an ES module (Node defines the CJS module globals only in CommonJS modules)`,
-        );
-      }
-      // The WASI runner mounts the host cwd at guest `/` and the host temp
-      // directory at `/tmp`. Bake the matching GUEST spelling so resource
-      // lookups relative to these CommonJS globals stay inside the exposed
-      // capability instead of naming an unreachable host-absolute path.
-      const fileName = moduleFileName(lowerer, sf);
-      const value =
-        expr.text === "__dirname"
-          ? lowerer.targetPlatform === "wasi"
-            ? posix.dirname(fileName)
-            : dirname(fileName)
-          : fileName;
-      return { kind: "strLit", value, type: STRING, loc };
-    }
-    const sig = lowerer.fnSigOf(expr);
-    if (sig && lowerer.isTopLevelFnSymbol(expr)) {
-      // A declared function used as a value: a zero-capture closure. The
-      // backend interns one per function so `f === f` holds (JS identity).
-      // The value's type is the completed ABI signature; optional/default
-      // slots and typed rest arrays pass the value fence first.
-      lowerer.noteEdge(sig.name);
-      // dynRest slots stay out of the VALUE type's param list (fn.length
-      // semantics); the rest marker carries the trailing dyn-array ABI.
-      const funcType: IrType = funcTypeFromParamShapes(sig.params, sig.returnType);
-      lowerer.requireExactArityValue(expr, expr, sig.params, funcType);
-      return { kind: "closure", fnName: sig.name, captures: [], type: funcType, loc };
-    }
-    {
-      // A generic function as a VALUE: monomorphized by flow — the
-      // reference's pinned concrete signature (contextual type or an
-      // instantiation expression) names the instance; unpinned
-      // references fence inside (lowerGenericFnValue).
-      const gfn = lowerer.genericFnOf(expr);
-      if (gfn) return lowerer.lowerGenericFnValue(expr, gfn);
-    }
-    // A CJS export-table ACCESSOR read (`tmpdir.path`, or a destructured
-    // binding aliasing one): the getter is a real function of module
-    // scope — its body reads module globals, so it lifts like a lambda
-    // (interned per declaration) and every read is a call. Node runs the
-    // getter per read; so does this.
-    {
-      const acc = cjsExportAccessorRead(lowerer, expr);
-      if (acc) return acc;
-    }
-    // A binding destructured from a baked constants object
-    // (http2.constants / crypto.constants): the literal — the
-    // declaration emitted nothing (builtinConstantsDestructureDecl).
-    {
-      const h2c = lowerer.builtinConstantBindingOf(expr);
-      if (h2c) return h2c;
-    }
-    // Builtin-module import bindings: constants (path.sep, os.EOL) read
-    // as interned string literals; functions have no closure
-    // representation (they lower to libCall at call sites only); members
-    // with no lowering at all fence with the module-qualified name.
-    {
-      const member = threadsImportOf(lowerer.program, expr);
-      // scriptc delivers published graphs by reference.
-      if (member === "sharesPublishedGraphs")
-        return { kind: "boolLit", value: true, type: BOOL, loc };
-      if (member === "publish")
-        lowerer.noLowering(
-          "publish (@scriptc/threads) as a value",
-          expr,
-          "call publish(value) directly",
-        );
-      if (experimentalImportOf(lowerer.program, expr) === "LifetimeRegion")
-        lowerer.noLowering(
-          "LifetimeRegion (@scriptc/experimental) as a value",
-          expr,
-          "construct regions with new LifetimeRegion()",
-        );
-      if (experimentalImportOf(lowerer.program, expr) === "InternTable")
-        lowerer.noLowering(
-          "InternTable (@scriptc/experimental) as a value",
-          expr,
-          'open tables with new InternTable("name")',
-        );
-      if (experimentalImportOf(lowerer.program, expr) === "ThreadSlots")
-        lowerer.noLowering(
-          "ThreadSlots (@scriptc/experimental) as a value",
-          expr,
-          'open slots with new ThreadSlots("name")',
-        );
-    }
-    {
-      const bi = lowerer.builtinImportOf(expr);
-      if (bi) {
-        if (bi.module === "worker_threads") {
-          const value = lowerWorkerMetadata(bi.member, loc);
-          if (value) return value;
-        }
-        // A named import of defaultMaxListeners reads the ES module
-        // namespace's copy. A CommonJS destructured or member binding holds
-        // the value read when its declaration ran, which these bindings do
-        // not store.
-        if (bi.module === "events" && bi.member === "defaultMaxListeners") {
-          if (esmImportBindingKind(lowerer, expr) === "named") {
-            return { kind: "libCall", fn: "emitter.esmDefaultMax", args: [], type: F64, loc };
-          }
-          lowerer.noLowering(
-            "events.defaultMaxListeners through a CommonJS destructured or member binding",
-            expr,
-            "read require('events').defaultMaxListeners or EventEmitter.defaultMaxListeners where the value is needed",
-          );
-        }
-        const c = builtinModuleConstOf(lowerer, bi.module, bi.member);
-        if (c !== undefined) return builtinConstLit(c, loc);
-        // module.builtinModules — the baked Node v24 list, a fresh
-        // string[] per read.
-        if (bi.module === "module" && bi.member === "builtinModules") {
-          return builtinModulesArrayLit(loc);
-        }
-        if (bi.module === "http" && bi.member === "METHODS") {
-          return { kind: "libCall", fn: "http.methods", args: [], type: arrayOf(STRING), loc };
-        }
-        if ((bi.module === "http" || bi.module === "https") && bi.member === "globalAgent") {
-          return {
-            kind: "libCall",
-            fn: "http.globalAgent",
-            args: [{ kind: "boolLit", value: bi.module === "https", type: BOOL, loc }],
-            type: DYN,
-            loc,
-          };
-        }
-        if (bi.module === "http" && bi.member === "STATUS_CODES") {
-          return { kind: "libCall", fn: "http.statusCodes", args: [], type: DYN, loc };
-        }
-        if (bi.module === "os" && bi.member === "constants") {
-          return { kind: "libCall", fn: "os.constants", args: [], type: DYN, loc };
-        }
-        // `import { O_RDONLY } from "constants"`: the member of the frozen
-        // module object.
-        if (bi.module === "constants") {
-          return {
-            kind: "dynKeyGet",
-            value: builtinConstantsObject(lowerer, loc),
-            key: { kind: "strLit", value: bi.member, type: STRING, loc },
-            type: DYN,
-            loc,
-          };
-        }
-        // tls.rootCertificates: a runtime-valued module constant (the
-        // cached bundled-CA array) — the one member read that lowers
-        // to a libCall instead of a baked literal.
-        {
-          const roots = lowerTlsRootCertificates(lowerer, bi, loc);
-          if (roots) return roots;
-        }
-        {
-          const callable = lowerer.lowerBuiltinCallableValue(bi, loc);
-          if (callable) return callable;
-        }
-        // JavaScript sources: an otherwise unsupported builtin VALUE is
-        // the same identity-token story as stdlib globals above (the
-        // harness adds worker_threads.Worker to its identity Set).
-        if (isJsSourceFile(expr.getSourceFile())) {
-          return {
-            kind: "strLit",
-            value: `[builtin ${bi.module}.${bi.member}]`,
-            type: STRING,
-            loc,
-          };
-        }
-        if (builtinModuleFnOf(lowerer, bi.module, bi.member)) {
-          lowerer.unsupported(
-            "SC1090",
-            expr,
-            `library functions as values (call '${expr.text}' directly)`,
-          );
-        }
-        lowerer.noLowering(
-          `${bi.module}.${bi.member}`,
-          expr,
-          builtinFenceHintOf(bi.module, bi.member),
-          lowerer.resolveValueSymbol(expr),
-        );
-      }
-    }
-    // A builtin namespace import used as a bare VALUE (`const f = fs`):
-    // the namespace object has no representation — members lower at
-    // their access sites only. The CommonJS namespace binding
-    // (`const lib = require("./lib.js")`) gets the same fence.
-    const builtinNamespace = lowerer.builtinNamespaceModuleOf(expr);
-    if (builtinNamespace === "constants") return builtinConstantsObject(lowerer, loc);
-    if (builtinNamespace !== null) {
-      const type: IrType = { kind: "moduleNs", moduleId: `builtin:${builtinNamespace}` };
-      return { kind: "moduleNsRef", moduleId: type.moduleId, type, loc };
-    }
-    if (lowerer.cjsLocalModuleBindingOf(expr)) {
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        `module namespace objects as values (access '${expr.text}' members directly)`,
-      );
-    }
-    if (lowerer.stdlibGlobalFnOf(expr)) {
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        `library functions as values (call '${expr.text}' directly)`,
-      );
-    }
-    // A declaration-only npm binding has no compiled runtime value.
-    {
-      const pkg = lowerer.npmPackageOfSymbol(lowerer.resolveValueSymbol(expr) ?? undefined);
-      if (pkg) {
-        lowerer.pushDiag(unsupportedPackageValueDiag(pkg, loc));
-        throw new PoisonError();
-      }
-    }
-    // Bindings imported from an UNSUPPORTED builtin module: coverage
-    // analyzes past import fences, so uses of `spawn` from
-    // child_process reach lowering — the use site reports the same
-    // "the '<module>' module" diagnostic as the import line, and the
-    // report groups them into one blocker. (Builds never get here: the
-    // import already failed preflight.)
-    {
-      const spec = lowerer.fencedBuiltinImportOf(expr);
-      if (spec !== null) {
-        lowerer.pushDiag(unsupportedDiag("SC1010", loc, unsupportedModuleFeatureOf(spec)));
-        throw new PoisonError();
-      }
-    }
-    // The globals `Infinity` and `NaN` (lib-declared, provenance-checked
-    // like every stdlib name): non-finite numLits — `-Infinity` arrives
-    // through the unary-minus literal fold. Arithmetic, comparisons, and
-    // formatting are IEEE-exact in C (String(Infinity) is "Infinity" and
-    // String(NaN) is "NaN" in the number formatter; `NaN !== NaN` holds
-    // because f64 compares are IEEE compares).
-    if (expr.text === "Infinity" || expr.text === "NaN") {
-      const sym = lowerer.checker.getSymbolAtLocation(expr);
-      if (lowerer.isStdlibSymbol(sym)) {
-        return { kind: "numLit", value: expr.text === "NaN" ? NaN : Infinity, type: F64, loc };
-      }
-    }
-    // The primitive constructors as VALUES (`const f = String`, an
-    // option table's `type: Boolean` field, `opt.type === Number`): the
-    // interned coercion closure — one synthesized module function per
-    // constructor per program, so every reference is the SAME zero-
-    // capture closure and `===` is JS identity (the type mapping in
-    // type-mapper.ts pins the one concrete signature `(value: string) =>
-    // primitive`; direct calls `String(x)` never reach here — the call
-    // lowering intercepts them with the wider static coercions).
-    const jsPrimitiveCtorSelector = isJsSourceFile(expr.getSourceFile());
-    const primitiveName = stdlibGlobalNameOf(lowerer, expr);
-    if (
-      primitiveName === "String" ||
-      primitiveName === "Number" ||
-      primitiveName === "Boolean" ||
-      primitiveName === "BigInt"
-    ) {
-      return primitiveCtorClosure(lowerer, primitiveName, loc, jsPrimitiveCtorSelector);
-    }
-    if (lowerer.isStdlibGlobal(expr, "ArrayBuffer"))
-      return { kind: "libCall", fn: "arrayBuffer.constructor", args: [], type: DYN, loc };
-    if (isJsSourceFile(expr.getSourceFile()) && lowerer.isStdlibGlobal(expr, "Array"))
-      return { kind: "libCall", fn: "dyn.arrayConstructor", args: [], type: DYN, loc };
-    if (
-      Object.values(BYTES_ELEMENT_NAME).includes(expr.text) &&
-      lowerer.isStdlibSymbol(lowerer.checker.getSymbolAtLocation(expr))
-    ) {
-      return {
-        kind: "libCall",
-        fn: "bytes.constructor",
-        args: [{ kind: "strLit", value: expr.text, type: STRING, loc }],
-        type: DYN,
-        loc,
-      };
-    }
-    if (
-      (expr.text === "encodeURIComponent" ||
-        expr.text === "encodeURI" ||
-        expr.text === "decodeURIComponent" ||
-        expr.text === "decodeURI") &&
-      lowerer.isStdlibGlobal(expr, expr.text)
-    ) {
-      const name = `%builtin.${expr.text}`;
-      const type = funcOf([DYN], STRING);
-      if (!lowerer.liftedFns.some((fn) => fn.name === name)) {
-        const value: IrExpr = {
-          kind: "libCall",
-          fn: "dyn.toStringCoerce",
-          args: [varRef("value", DYN, loc)],
-          type: STRING,
-          loc,
-        };
-        const fn =
-          expr.text === "encodeURIComponent"
-            ? "str.encodeUriComponent"
-            : expr.text === "encodeURI"
-              ? "str.encodeUri"
-              : expr.text === "decodeURI"
-                ? "str.decodeUri"
-                : "str.decodeUriComponent";
-        lowerer.liftedFns.push({
-          name,
-          params: [{ localId: "value", name: "value", type: DYN }],
-          locals: [{ id: "value", name: "value", type: DYN, mutable: false }],
-          returnType: STRING,
-          body: [
-            {
-              kind: "return",
-              value: { kind: "libCall", fn, args: [value], type: STRING, loc },
-              loc,
-            },
-          ],
-          loc,
-        });
-      }
-      return { kind: "closure", fnName: name, captures: [], type, loc };
-    }
-    if (lowerer.isStdlibGlobal(expr, "crypto"))
-      return { kind: "libCall", fn: "crypto.native", args: [], type: DYN, loc };
-    const nativeAlias = stdlibGlobalNameOf(lowerer, expr);
-    if (nativeAlias === "Buffer" && expr.text !== "Buffer") {
-      return { kind: "strLit", value: "[builtin Buffer]", type: STRING, loc };
-    }
-    if (lowerer.isStdlibGlobal(expr, "fetch")) {
-      return { kind: "libCall", fn: "fetch.function", args: [], type: DYN, loc };
-    }
-    // The lib fence's IDENTIFIER chokepoint: the real standard library
-    // resolves names the old minimal ambient world never declared
-    // (Symbol, Reflect, Infinity, Date, ...) — and the adopted
-    // @types/node resolves its whole global surface (Buffer, fetch,
-    // setInterval, URL, ...). Reaching one that no lowering above
-    // claimed is SC2020, never an ICE — EXCEPT in JavaScript sources,
-    // where a stdlib global taken as a VALUE (never called through this
-    // path — call sites lower earlier) becomes an opaque IDENTITY TOKEN:
-    // an interned string naming the global. Identity flows (the
-    // harness's knownGlobals Set, === comparisons) are exact — one
-    // global, one token; what a token cannot do (be called, answer
-    // typeof "function") meets per-site fences/divergences, and
-    // SEMANTICS.md documents the stance.
-    if (stdlibGlobalNameOf(lowerer, expr) === "globalThis") {
-      return lowerGlobalValue(lowerer, expr);
-    }
-    {
-      const sym = lowerer.checker.getSymbolAtLocation(expr);
-      if (lowerer.isStdlibSymbol(sym) || expr.text === "globalThis") {
-        if (isJsSourceFile(expr.getSourceFile())) {
-          const canonical = stdlibGlobalNameOf(lowerer, expr) ?? expr.text;
-          return { kind: "strLit", value: `[builtin ${canonical}]`, type: STRING, loc };
-        }
-        // The families with a WHY: each hint states what makes the
-        // surface genuinely non-static (or what to use instead).
-        const globalHints: Record<string, string | undefined> = {
-          Proxy:
-            "Proxy constructor values have no native lowering; use a direct new Proxy with checked-native plain objects",
-          Reflect:
-            "reflective property access has no static lowering — read and call members directly",
-          Intl: 'native Intl supports default Unicode grapheme segmentation and the composed new Intl.NumberFormat("en-US").format(x); locale negotiation and other ICU-backed operations remain unsupported',
-          SharedArrayBuffer: "use direct new SharedArrayBuffer(length) for fixed shared storage",
-          ArrayBuffer:
-            "ArrayBuffer constructor values have no native lowering; use new ArrayBuffer(length) for fixed-length shared storage",
-          WeakRef:
-            "deref()-after-collect exposes GC timing — genuinely dynamic; hold a strong reference instead",
-          FinalizationRegistry:
-            "finalization callbacks expose GC timing — genuinely dynamic; release resources explicitly instead",
-          eval: "runtime code evaluation cannot be compiled ahead of time",
-        };
-        lowerer.noLowering(expr.text, expr, globalHints[expr.text], sym ?? undefined);
-      }
-    }
-    // An ambient global nothing defines compiles to exactly what Node does
-    // at the access: the catchable ReferenceError "<name> is not defined".
-    // Stdlib/@types/node ambients never reach here (their chokepoint
-    // is above); only user-file declares do.
-    {
-      const sym = lowerer.resolveValueSymbol(expr);
-      const decl = sym ? lowerer.checker.declarationsOf(sym)[0] : undefined;
-      if (
-        decl !== undefined &&
-        ts.isVariableDeclaration(decl) &&
-        decl.initializer === undefined &&
-        ts.getCombinedModifierFlags(decl) & ts.ModifierFlags.Ambient
-      ) {
-        const declared = lowerer.mapTypeOf(lowerer.typeOf(expr));
-        if (declared && declared.kind !== "void") {
-          return {
-            kind: "libCall",
-            fn: "global.undefRead",
-            args: [{ kind: "strLit", value: expr.text, type: STRING, loc }],
-            type: declared,
-            loc,
-          };
-        }
-      }
-    }
-    // An ambient `declare function` nothing defines, taken as a VALUE
-    // (call sites lower earlier, in lowerCall): the same story as the
-    // ambient `declare const` above — Node erases the declaration and
-    // the read throws the catchable ReferenceError at the access.
-    {
-      if (ambientUndefinedFnSymbolOf(lowerer, expr)) {
-        const t = ambientUndefReadType(lowerer, expr);
-        if (t) return nsUndefRead(lowerer, expr.text, expr, t);
-      }
-    }
-    // A read of a TRAP binding — a declaration whose own initializer
-    // provably threw (module init unwound there), so this reference can
-    // never execute: any lowering is sound, and the trap keeps the
-    // shape honest. Typed by the use site when it maps, the F64 dummy
-    // otherwise (never observed — never even reached).
-    {
-      const sym = lowerer.resolveValueSymbol(expr);
-      if (sym !== null && lowerer.trapBindings.has(sym)) {
-        const t =
-          ambientUndefReadType(lowerer, expr) ?? contextualUndefReadType(lowerer, expr) ?? F64;
-        return nsUndefRead(lowerer, expr.text, expr, t);
-      }
-    }
-    // A program CLASS NAME as a value: the classRef over the class's
-    // immortal class object (member accesses and construction never
-    // reach here — their hooks claim the property/new forms first).
-    {
-      const sym = lowerer.resolveValueSymbol(expr);
-      const classInfo = sym ? lowerer.classBySymbol.get(sym) : undefined;
-      // A GENERIC class name whose CONTEXTUAL type pins one instantiation
-      // (`const B: new (v: string) => Counter<string> = Counter`): the
-      // value is that instantiation's class object — the generic-fn
-      // pinning rule on the static side. Unpinned references fall
-      // through to classValueRef's family fence.
-      if (classInfo?.generic) {
-        const ctxT = lowerer.checker.getContextualType(expr);
-        const mapped = ctxT ? lowerer.mapTypeOf(ctxT) : null;
-        const instInfo =
-          mapped?.kind === "classval" ? lowerer.classes.get(mapped.className) : undefined;
-        if (instInfo && instInfo.genericInstance?.family === classInfo) {
-          return lowerer.classValueRef(instInfo, expr);
-        }
-      }
-      if (classInfo) {
-        // A decorated name a replacing decorator can REBIND: the value
-        // is the decoration result — the mutable classval global %init
-        // assigned at the class statement (TC39's name binding), never
-        // the declaration's own class object.
-        const decoratedGlobal = classInfo.classDecorators?.valueGlobalId;
-        if (decoratedGlobal !== undefined) {
-          return {
-            kind: "varRef",
-            localId: decoratedGlobal,
-            type: { kind: "classval", className: classInfo.def.name },
-            loc,
-          };
-        }
-        return lowerer.classValueRef(classInfo, expr);
-      }
-      // The enum OBJECT as a value (member reads never reach here — the
-      // access hooks fold them): iteration, storage, reverse lookups
-      // through variables all land on this pointed fence.
-      if (sym) fenceEnumObjectValue(lowerer, expr, sym);
-      // A MIXIN function as a first-class value: no runtime function
-      // exists — calls instantiate a class per call site
-      // (lower-mixins.ts). Generic mixins took the generic-fn value
-      // fence above; this names the non-generic spelling.
-      if (mixinFnOfCallee(lowerer, expr)) {
-        lowerer.unsupported(
-          "SC1090",
-          expr,
-          `the mixin function '${expr.text}' as a value (mixin calls compile per call site — call it directly)`,
-        );
-      }
-    }
-    // A NAMESPACE object as a first-class value: members lower at their
-    // qualified access sites; the object itself has no runtime
-    // representation (ambient namespaces compile to Node's
-    // ReferenceError instead — the object never exists at runtime).
-    {
-      const moduleNs = lowerer.mapTypeOf(lowerer.typeOf(expr));
-      if (moduleNs?.kind === "moduleNs") {
-        return { kind: "moduleNsRef", moduleId: moduleNs.moduleId, type: moduleNs, loc };
-      }
-      const builtinNs = lowerer.builtinNamespaceModuleOf(expr);
-      if (builtinNs === "constants") return builtinConstantsObject(lowerer, loc);
-      if (builtinNs !== null) {
-        const type: IrType = { kind: "moduleNs", moduleId: `builtin:${builtinNs}` };
-        return { kind: "moduleNsRef", moduleId: type.moduleId, type, loc };
-      }
-      const ns = lowerNsIdentifierValue(lowerer, expr);
-      if (ns) return ns;
-    }
-    // Preflight guarantees no unresolved identifiers; anything else here
-    // is a blocked declaration's binding (the SC2004 cascade) or a
-    // binding form we don't model yet.
-    lowerer.rejectUnresolved(
-      expr,
-      `the reference to '${expr.text}' (a binding form with no lowering)`,
-    );
-  }
+  if (ts.isTypeOfExpression(expr)) return lowerTypeofExpr(lowerer, expr, loc);
+  if (ts.isIdentifier(expr)) return lowerIdentifierExpr(lowerer, expr, loc);
   if (ts.isArrowFunction(expr) || ts.isFunctionExpression(expr)) {
     return lowerer.lowerLambda(expr);
   }
@@ -1712,6 +459,20 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
     const local = lowerer.resolveThis();
     if (local) {
       const value: IrExpr = { kind: "varRef", localId: local.id, type: local.type, loc };
+      // `this.#x` in a function-local class's prototype method, whose `this`
+      // is the call-site value: the field lives on the native instance of
+      // this evaluation (checkedPrivateReceiver).
+      const access = expr.parent;
+      if (
+        local.type.kind === "dyn" &&
+        ts.isPropertyAccessExpression(access) &&
+        access.expression === expr &&
+        ts.isPrivateIdentifier(access.name)
+      ) {
+        const owner = localPrivateBrandClass(lowerer, access.name);
+        if (owner)
+          return checkedPrivateReceiver(lowerer, owner.info, owner.decl, access, value, loc);
+      }
       const initialized = lowerer.ctx.superInitialized;
       if (initialized)
         return {
@@ -1928,1008 +689,7 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
   if (ts.isElementAccessExpression(expr)) return lowerer.lowerElementAccess(expr);
   if (ts.isConditionalExpression(expr)) return lowerTernary(lowerer, expr);
 
-  if (ts.isPropertyAccessExpression(expr)) {
-    // `require("./x").member` over a program module's export table: the
-    // module's %init at this position, then the member read exactly like
-    // a `const m = require("./x")` binding's (cjs-inline-require.ts).
-    if (!expr.questionDotToken) {
-      const req = inlineNamespaceRequireOf(lowerer, expr.expression);
-      if (req !== null && !lowerer.inlineRequireInitDone.has(req.call)) {
-        return lowerWithInlineRequireInit(lowerer, req, () => lowerExpr(lowerer, expr));
-      }
-      // `module.exports` compared by identity inside its own module, or
-      // refused by name as any other value (cjs-exports-object.ts).
-      if (expr.name.text === "exports") {
-        const exportsValue = lowerCjsExportsObjectValue(lowerer, expr);
-        if (exportsValue) return exportsValue;
-      }
-      // tsc's `x_1.default` over a dependency whose whole export is one
-      // value: that value (cjs-tsc-interop.ts).
-      const interop = tscInteropDefaultValueOf(lowerer, expr);
-      if (interop !== null) {
-        const value = wholeExportValue(lowerer, interop.dep, expr);
-        if (value !== null) return value;
-      }
-    }
-    {
-      const member = lifetimeRegionMemberOf(lowerer.program, expr, lowerer.experimentalFiles);
-      if (member !== null)
-        lowerer.noLowering(
-          `LifetimeRegion.${member} (@scriptc/experimental) as a value`,
-          expr,
-          `call region.${member}(${member === "run" ? "fn" : ""}) directly`,
-        );
-    }
-    {
-      const table = lowerInternTableProperty(lowerer, expr);
-      if (table) return table;
-    }
-    lowerThreadSlotsProperty(lowerer, expr);
-    // `EventEmitter.name`, `zlib.Gzip.name`, `C.name` over a builtin
-    // class alias.
-    if (expr.name.text === "name" && !expr.questionDotToken) {
-      const ref = builtinClassRefOf(lowerer, expr.expression);
-      if (ref !== null) return { kind: "strLit", value: ref.name, type: STRING, loc };
-    }
-    // `C.name` through a runtime-provided class VALUE (a `typeof Readable`
-    // parameter): the class object's stored name.
-    if (
-      expr.name.text === "name" &&
-      !expr.questionDotToken &&
-      runtimeClassValueOfType(lowerer, lowerer.typeOf(expr.expression)) !== null
-    ) {
-      const read = lowerer.lowerFieldRead(expr);
-      if (read) return read;
-    }
-    // Expando statics may still be absent even when JS inference sees
-    // the eventual assignment's scalar type. Preserve the checked value.
-    const staticField = lowerStaticFieldRead(lowerer, expr);
-    if (staticField) return staticField;
-    const prototypeData = lowerClassPrototypeData(lowerer, expr);
-    if (prototypeData) return prototypeData;
-    if (
-      ts.isPropertyAccessExpression(expr.expression) &&
-      expr.expression.name.text === "prototype"
-    ) {
-      const prototype = lowerClassPrototypeData(lowerer, expr.expression);
-      if (prototype)
-        return {
-          kind: "dynKeyGet",
-          value: prototype,
-          key: { kind: "strLit", value: expr.name.text, type: STRING, loc },
-          type: DYN,
-          loc,
-        };
-    }
-    // `super.x`: the base chain's GETTER, called directly (super
-    // dispatch is static in JS — never through the dynamic class).
-    // super.method() calls are routed at the call site; a bare super
-    // property read lands here.
-    if (expr.expression.kind === ts.SyntaxKind.SuperKeyword) {
-      return lowerer.lowerSuperAccessorRead(expr);
-    }
-    // Enum member reads (`E.A`) fold to their compile-time constants —
-    // claimed FIRST so no receiver-shaped path (records, the
-    // identifier fence on the enum object) sees them. lower-enums.ts.
-    {
-      const en = lowerEnumAccess(lowerer, expr);
-      if (en) return en;
-    }
-    // `import.meta.<field>` — the file-backed ESM metadata that survives
-    // compilation as a constant. Only direct, identifier-named reads are
-    // claimed here; the bare meta object, computed access, writes, and
-    // unsupported members continue through the generic module-loader fence
-    // below. The source file is the module identity, so imported modules
-    // receive their own filename/dirname and only the entry receives main.
-    const importMeta = importMetaProperty(lowerer, expr);
-    if (importMeta) return importMeta;
-    // `require.main.filename` / `require.main?.filename` — CommonJS
-    // entry-module identity: in a compiled binary require.main IS the
-    // entry module (never undefined in a CJS graph, so the chain's guard
-    // folds away), and its filename is the ENTRY file's real path —
-    // Node's exact value when the same tree runs in place, exactly the
-    // __filename stance. Checked BEFORE the optional-chain gate: the
-    // checker types the chain `string | undefined`, but the value is a
-    // compile-time string.
-    if (isRequireMainFilename(lowerer, expr)) {
-      return { kind: "strLit", value: lowerer.entry.fileName, type: STRING, loc };
-    }
-    const requireMain = lowerRequireMainProperty(lowerer, expr);
-    if (requireMain) return requireMain;
-    const moduleProperty = lowerNodeModuleProperty(lowerer, expr);
-    if (moduleProperty) return moduleProperty;
-    if (
-      stdlibGlobalNameOf(lowerer, expr.expression) === "Symbol" &&
-      [
-        "iterator",
-        "asyncIterator",
-        "toStringTag",
-        "toPrimitive",
-        "hasInstance",
-        "isConcatSpreadable",
-        "match",
-        "matchAll",
-        "replace",
-        "search",
-        "split",
-        "species",
-        "unscopables",
-        "dispose",
-        "asyncDispose",
-      ].includes(expr.name.text)
-    ) {
-      return {
-        kind: "libCall",
-        fn: "sym.wellKnown",
-        args: [{ kind: "strLit", value: expr.name.text, type: STRING, loc }],
-        type: { kind: "symbol" },
-        loc,
-      };
-    }
-    if (lowerer.stdlibGlobalMember(expr, "Object") === "freeze") {
-      const name = "%builtin.Object.freeze";
-      if (!lowerer.liftedFns.some((fn) => fn.name === name))
-        lowerer.liftedFns.push({
-          name,
-          params: [{ localId: "value", name: "value", type: DYN }],
-          locals: [{ id: "value", name: "value", type: DYN, mutable: false }],
-          returnType: DYN,
-          body: [
-            {
-              kind: "return",
-              value: {
-                kind: "libCall",
-                fn: "dyn.freeze",
-                args: [varRef("value", DYN, loc)],
-                type: DYN,
-                loc,
-              },
-              loc,
-            },
-          ],
-          loc,
-        });
-      return { kind: "closure", fnName: name, captures: [], type: funcOf([DYN], DYN), loc };
-    }
-    // An Hmac has no copy() (Hash does): Node answers undefined, which
-    // `typeof mac.copy` feature checks read. TypeScript rejects the read.
-    if (
-      expr.name.text === "copy" &&
-      lowerer.mapTypeOf(lowerer.typeOf(expr.expression))?.kind === "cryptoHmac"
-    ) {
-      return {
-        kind: "seqExpr",
-        stmts: [{ kind: "exprStmt", expr: lowerer.lowerExpr(expr.expression), loc }],
-        result: dynUndefinedExpr(loc),
-        type: DYN,
-        loc,
-      };
-    }
-    if (lowerer.stdlibGlobalMember(expr, "globalThis") === "console") {
-      return { kind: "libCall", fn: "console.native", args: [], type: DYN, loc };
-    }
-    if (lowerer.stdlibGlobalMember(expr, "console") !== null) {
-      return {
-        kind: "dynKeyGet",
-        value: { kind: "libCall", fn: "console.native", args: [], type: DYN, loc },
-        key: { kind: "strLit", value: expr.name.text, type: STRING, loc },
-        type: DYN,
-        loc,
-      };
-    }
-    // Missing host globals (Bun/Deno capability probes) have no binding
-    // in a native program. Declared globals retain their own lowering;
-    // arbitrary global-object mutation remains fenced. Preserve a dyn
-    // undefined value so stored probes compose with optional calls.
-    if (
-      stdlibGlobalNameOf(lowerer, expr.expression) === "globalThis" &&
-      !lowerer.checker.getPropertyOfType(lowerer.typeOf(expr.expression), expr.name.text)
-    ) {
-      return dynUndefinedExpr(loc);
-    }
-    if (expr.questionDotToken && expr.name.text === "electron") {
-      const processProperty = lowerer.lowerProcessProperty(expr);
-      if (processProperty) return processProperty;
-    }
-    // Optional chaining `a?.b`: the guard lowers here (a tag test around
-    // the plain property lowering below); the handled marker keeps this
-    // re-entrant dispatch from looping.
-    if (expr.questionDotToken && !lowerer.chainHandled.has(expr)) {
-      return lowerer.lowerOptionalChain(expr);
-    }
-    // `a?.b.c` — the tail of a chain whose token sits deeper: the whole
-    // tail short-circuits with the guard.
-    if (!expr.questionDotToken && isOptionalChainTail(lowerer, expr)) {
-      return lowerer.lowerOptionalChain(expr);
-    }
-    // Known Web handles retain their declared surface even when their
-    // storage uses checked values. Apply this before generic reads.
-    lowerer.fenceStaticAbortControllerMemberRead(expr);
-    lowerer.fenceStaticResponseMember(expr, "read");
-    lowerer.fenceStaticHeadersMember(expr, "read");
-    lowerer.fenceStaticReadableStreamMember(expr, "read");
-
-    // — reading off null/undefined — bridged catchably like everything
-    // at the boundary). `o?.x` arrives here too, through the chain
-    // lowering's re-dispatch (a questionDotToken past the gate above is
-    // always chain-handled; the receiver reads back as the chain's
-    // bound handle).
-
-    // `m.index` on a for-of-over-matchAll binding reads the companion-
-    // index array at this iteration's cursor — always a number: every
-    // drained row matched, so the lib's `.index` is never undefined
-    // here (lowerForOfMatchAll).
-    if (expr.name.text === "index" && !expr.questionDotToken && ts.isIdentifier(expr.expression)) {
-      const sym = lowerer.checker.getSymbolAtLocation(expr.expression);
-      const companion = sym !== undefined ? lowerer.matchAllIndexBindings.get(sym) : undefined;
-      if (companion !== undefined) {
-        return {
-          kind: "arrayGet",
-          arr: { kind: "varRef", localId: companion.idxsLocalId, type: arrayOf(F64), loc },
-          index: { kind: "varRef", localId: companion.curLocalId, type: F64, loc },
-          type: F64,
-          loc,
-        };
-      }
-    }
-    if ((expr.name.text === "index" || expr.name.text === "input") && !expr.questionDotToken) {
-      const represented = tryLowerExpression(lowerer, expr.expression);
-      if (
-        represented &&
-        isMatchSliceType(lowerer, represented.type) &&
-        (lowerer.isStdlibMember(expr) || isJsSourceFile(expr.getSourceFile()))
-      ) {
-        const recv = represented;
-        const key: IrExpr = { kind: "strLit", value: expr.name.text, type: STRING, loc };
-        // A plain slice answers from its match source without a dynamic copy.
-        const read: IrExpr = typeEquals(recv.type, arrayOf(STRING))
-          ? { kind: "libCall", fn: "regex.resultProp", args: [recv, key], type: DYN, loc }
-          : { kind: "dynKeyGet", value: lowerer.coerceToExpected(recv, DYN), key, type: DYN, loc };
-        return lowerer.maybeNarrow(read, expr);
-      }
-    }
-    // `m.groups` on a match result whose regex is statically known:
-    // the compile-time record projection over the honest slice (or
-    // Node's undefined when the pattern has no named groups) — see
-    // lowerMatchGroupsRead.
-    {
-      const g = lowerMatchGroupsRead(lowerer, expr);
-      if (g !== null) return g;
-    }
-    // `arguments.length` in a TYPED function whose signature is
-    // FIXED-ARITY (no optional/default/rest parameters): tsc enforces
-    // exact arity at every call site and call/apply/bind indirection is
-    // fenced, so the actual count IS the declared count — a compile-time
-    // constant. Arrows don't bind `arguments` (the walk skips them,
-    // exactly JS's scoping); variable-arity signatures keep the fence
-    // (the count would need a hidden argc). The JS-source variadic
-    // `arguments` object (dynRest) was claimed at identifier lowering.
-    if (
-      expr.name.text === "length" &&
-      !expr.questionDotToken &&
-      ts.isIdentifier(expr.expression) &&
-      expr.expression.text === "arguments" &&
-      !lowerer.ctx.argumentsLocal &&
-      lowerer.typeOf(expr.expression).getSymbol()?.name === "IArguments" &&
-      lowerer.isStdlibSymbol(lowerer.typeOf(expr.expression).getSymbol())
-    ) {
-      let fn: ts.Node | undefined = expr.parent;
-      while (
-        fn !== undefined &&
-        !ts.isFunctionDeclaration(fn) &&
-        !ts.isFunctionExpression(fn) &&
-        !ts.isMethodDeclaration(fn) &&
-        !ts.isConstructorDeclaration(fn) &&
-        !ts.isGetAccessorDeclaration(fn) &&
-        !ts.isSetAccessorDeclaration(fn)
-      ) {
-        fn = ts.isSourceFile(fn) ? undefined : fn.parent;
-      }
-      if (fn !== undefined) {
-        const fixedArity = (fn as ts.FunctionLikeDeclaration).parameters.nodes.every(
-          (p) =>
-            p.questionToken === undefined &&
-            p.initializer === undefined &&
-            p.dotDotDotToken === undefined,
-        );
-        if (fixedArity) {
-          return {
-            kind: "numLit",
-            value: (fn as ts.FunctionLikeDeclaration).parameters.nodes.length,
-            type: F64,
-            loc,
-          };
-        }
-        lowerer.unsupported(
-          "SC1090",
-          expr,
-          "'arguments.length' in functions with optional, default, or rest parameters (the count varies per call — a fixed-arity signature folds to a constant)",
-        );
-      }
-    }
-    // CommonJS namespace binding (`const lib = require("./lib.js")`):
-    // `lib.member` IS the member — the export table is alias plumbing,
-    // so the NAME resolves exactly like a bare identifier reference
-    // (resolveValueSymbol lands on the exporter's declaration and every
-    // existing path — globals, function values, classes — applies).
-    if (!expr.questionDotToken && lowerer.cjsLocalModuleBindingOf(expr.expression)) {
-      // A binding whose dep is a class-expression WHOLE export
-      // (`module.exports = class {…}`): the member surface is the
-      // CLASS's — `C.name` folds to NamedEvaluation's answer and own
-      // statics read their globals (lowerStaticFieldRead resolves the
-      // binding through the expression's own symbol). The plain
-      // member-name delegation below would resolve `name` against the
-      // stdlib var instead — a wrong VALUE, not a fence. Unknown
-      // members fall through to the delegation (expando statics ride
-      // their pre-registered export globals).
-      const viaClass = lowerStaticFieldRead(lowerer, expr);
-      if (viaClass) return viaClass;
-      return lowerExpr(lowerer, expr.name);
-    }
-    // `module.exports` READ in a CommonJS file whose whole export IS a
-    // class expression (`module.exports = class …{}`): the read answers
-    // the class VALUE — `new module.exports()` inside the module is the
-    // requirer's `new C()` spelled locally. Top-level reads ABOVE the
-    // assignment fall through to their existing fences (Node still
-    // answers the original export object there); function bodies
-    // resolve unconditionally — they run after the module evaluated,
-    // the same approximation identifier exports already make. Every
-    // other module.exports read keeps its existing story.
-    if (
-      !expr.questionDotToken &&
-      isModuleExportsAccess(expr) &&
-      isCjsJsFile(expr.getSourceFile(), lowerer.program)
-    ) {
-      const whole = cjsClassExprWholeExportOf(expr.getSourceFile());
-      if (whole) {
-        let inBody = false;
-        for (
-          let p: ts.Node | undefined = expr.parent;
-          p !== undefined && !ts.isSourceFile(p);
-          p = p.parent
-        ) {
-          if (ts.isFunctionLike(p) || ts.isClassDeclaration(p) || ts.isClassExpression(p)) {
-            inBody = true;
-            break;
-          }
-        }
-        if (inBody || expr.getStart() > whole.stmt.getEnd()) {
-          return lowerer.classValueRef(lowerer.lowerClassExpressionInfo(whole.classExpr), expr);
-        }
-      }
-    }
-    // `module.exports.Sub` / `exports.Sub` READ in the same module: an
-    // EXPRESSION-valued member rides its pre-registered export global —
-    // exactly what requirers see through `require('./x').Sub`, and the
-    // global IS the storage every `exports.Sub =` statement assigns, so
-    // the read is Node's live member. Identifier-valued members have no
-    // global (pure alias plumbing) and fall through unchanged; write
-    // positions belong to the export-assignment machinery.
-    {
-      const writePos =
-        ts.isBinaryExpression(expr.parent) &&
-        expr.parent.left === expr &&
-        expr.parent.operatorToken.kind === ts.SyntaxKind.EqualsToken;
-      const g = cjsInFileExportGlobalOf(lowerer, expr);
-      if (g && !writePos) return { kind: "varRef", localId: g.id, type: g.type, loc };
-    }
-    // Namespace-qualified reads (`N.x`, `A.B.C.f`, import= alias
-    // chains): the member is a compile-time-known declaration of a
-    // lowered namespace block — it resolves exactly like a bare
-    // identifier reference (globals, function values, classes), guarded
-    // by the namespace source-order fences (lower-namespaces.ts).
-    if (!expr.questionDotToken) {
-      const nsMember = nsMemberIdentOf(lowerer, expr);
-      if (nsMember) {
-        const memberSym = lowerer.checker.getSymbolAtLocation(nsMember);
-        if (memberSym) fenceEarlyNsMemberRef(lowerer, expr, memberSym);
-        return lowerExpr(lowerer, nsMember);
-      }
-      // Expando function members (`foo.bar` after `foo.bar = 12`): the
-      // member's module global (lower-expando.ts), before the ambient-
-      // namespace fence — a declare-namespace merge over a real function
-      // (`declare namespace Foo { var baz: number }` + `function Foo`)
-      // reads its assigned members, not the ambient ReferenceError.
-      {
-        const ex = expandoMemberRead(lowerer, expr);
-        if (ex) return lowerer.maybeNarrow(ex, expr);
-      }
-      // An AMBIENT namespace receiver (`M.x` where only `declare
-      // namespace M` exists): the namespace object never exists at
-      // runtime — Node's exact catchable ReferenceError at the access,
-      // the ambient `declare const` stance.
-      const ambientRoot = ambientNsRootOf(lowerer, expr.expression);
-      if (ambientRoot !== null) {
-        const t = ambientUndefReadType(lowerer, expr);
-        if (t) return nsUndefRead(lowerer, ambientRoot.text, expr, t);
-      }
-    }
-    // `exports.<name>` READS in a module whose export object was
-    // REPLACED (`module.exports = ...`): `exports` still references the
-    // ORIGINAL object — Node's aliasing rule — so when nothing ever
-    // attached this name to it (`exports.<name> =` nowhere in the
-    // file), the honest answer is undefined. tsc types the read off the
-    // REPLACEMENT (its CJS model is identity-blind), which is exactly
-    // the undiagnosed divergence this lowering closes. Reads in modules with
-    // real `exports.<name> =` attachments keep their fences.
-    {
-      const ex = lowerReplacedExportsRead(lowerer, expr);
-      if (ex) return ex;
-    }
-    // `this.<name>` inside a CJS export-table getter: Node binds the
-    // receiver to module.exports — the read is the sibling getter's
-    // lifted call.
-    {
-      const tm = lowerCjsExportTableThisMember(lowerer, expr);
-      if (tm) return tm;
-    }
-    // Property signatures of class-backed protocols read implementing
-    // classes' fields directly.
-    if (!hasOptionalChainGuard(expr.expression)) {
-      const typed = lowerProtocolPropertyRead(lowerer, expr);
-      if (typed) return typed;
-    }
-    const handled =
-      lowerer.lowerProcessEnvGet(expr) ??
-      lowerer.lowerServerProperty(expr) ??
-      // diagnostics_channel Channel receivers — name/hasSubscribers
-      // over the f64 channel handle.
-      lowerer.lowerDiagnosticsChannelProperty(expr) ??
-      // readline Interface receivers — the history and option members
-      // over the f64 interface handle.
-      lowerReadlineProperty(lowerer, expr) ??
-      // TracingChannel receivers — the five event channels and
-      // hasSubscribers over the f64 tracing handle.
-      lowerer.lowerTracingChannelProperty(expr) ??
-      lowerer.lowerTestCtxProperty(expr) ??
-      lowerer.lowerProcessProperty(expr) ??
-      lowerer.lowerProcessStreamProperty(expr) ??
-      lowerer.lowerFsConstantsProperty(expr) ??
-      // http2.constants.NGHTTP2_CANCEL (any constants-object spelling):
-      // the baked-literal table.
-      lowerer.lowerBuiltinConstantsProperty(expr) ??
-      // Builtin namespace imports (`path.sep`, `os.EOL`,
-      // `fs.constants.R_OK` where the root is `import * as ...`): the
-      // same constants and per-member fences as named builtin imports.
-      lowerer.lowerNamespaceBuiltinProperty(expr) ??
-      lowerer.lowerJsonProperty(expr) ??
-      lowerer.lowerErrorCodeProperty(expr) ??
-      lowerer.lowerNumberStaticProperty(expr) ??
-      lowerEventStaticProperty(lowerer, expr) ??
-      lowerer.lowerMathProperty(expr) ??
-      lowerer.lowerIntrinsicProperty(expr) ??
-      // The _readableState/_writableState scalar READS (the suite's
-      // asserts) — checked before the generic stream property surface:
-      // the inner access maps no type of its own.
-      lowerStreamStateProperty(lowerer, expr) ??
-      lowerStreamObjectProperty(lowerer, expr) ??
-      lowerEventObjectProperty(lowerer, expr) ??
-      lowerer.lowerUnionProperty(expr) ??
-      lowerer.lowerFieldRead(expr);
-    // A union-typed field read narrows like an identifier when the
-    // checker has narrowed this use to one arm.
-    if (handled) {
-      if (
-        handled.type.kind === "union" &&
-        lowerer.armTag(handled.type.unionId, UNDEFINED_T) >= 0 &&
-        handled.kind === "recordGet" &&
-        lowerer.isRuntimeOptionalField(handled.shapeId, handled.field)
-      )
-        return handled;
-      // A class field assigned a missing read: the checker narrows this
-      // read to the assigned value's bare type, but the stored undefined
-      // arm is real (`obj.n = bytes[i]; obj.n` is undefined in Node).
-      if (runtimeOptionalClassField(lowerer, handled, expr)) return handled;
-      return iteratorResultValueRead(lowerer, handled, expr) ?? lowerer.maybeNarrow(handled, expr);
-    }
-    // `globalThis.<name>` that no lowering above claimed
-    // (globalThis.crypto, globalThis.SubtleCrypto, globalThis.localStorage
-    // — the harness's capability-conditional knownGlobals adds): the
-    // PROPERTY spelling of the identifier chokepoint's JS rule — a stdlib
-    // global taken as a VALUE in a JavaScript source is the same opaque
-    // IDENTITY TOKEN the bare spelling answers (`globalThis.crypto` IS
-    // `crypto` — one global, one token, or identity flows through Sets
-    // and === would disagree between the two spellings). TypeScript
-    // sources keep the SC2020 member fence below, like the bare form.
-    if (
-      !expr.questionDotToken &&
-      stdlibGlobalNameOf(lowerer, expr.expression) === "globalThis" &&
-      isJsSourceFile(expr.getSourceFile())
-    ) {
-      const canonical = stdlibGlobalNameOf(lowerer, expr);
-      if (canonical !== null) {
-        if (canonical === "globalThis") return lowerGlobalValue(lowerer, expr);
-        if (canonical === "ArrayBuffer")
-          return { kind: "libCall", fn: "arrayBuffer.constructor", args: [], type: DYN, loc };
-        if (canonical === "fetch")
-          return { kind: "libCall", fn: "fetch.function", args: [], type: DYN, loc };
-        if (Object.values(BYTES_ELEMENT_NAME).includes(canonical))
-          return {
-            kind: "libCall",
-            fn: "bytes.constructor",
-            args: [{ kind: "strLit", value: canonical, type: STRING, loc }],
-            type: DYN,
-            loc,
-          };
-        return { kind: "strLit", value: `[builtin ${canonical}]`, type: STRING, loc };
-      }
-    }
-    // A JS receiver whose CHECKER type has no mapping (`mustCallChecks
-    // .length` where the binding is an evolving any[] living as a
-    // checked-dynamic global): the stdlib member fence below would blame
-    // the unmappable checker type (`any[].length`), but the VALUE is a
-    // dyn node — lower the receiver first and read through the dyn keyed
-    // read (ARR answers length; everything else JS's own-property
-    // answer). Mapped receivers keep the fence-first order: their
-    // members' gaps are real surface gaps ([1,2].entries), not
-    // representation artifacts. `.length` on a receiver whose checker
-    // ARRAY type lowers to the checked-dynamic representation —
-    // `unknown[]`, the collapsed `(string | object)[]`, and the `any[]`
-    // an Array.isArray guard narrows a collapsed union to — is the checked-dynamic tree
-    // array's OWN length (a keyed read the ARR kind answers exactly),
-    // never an `Array.prototype` surface gap; both source languages.
-    // Prototype-method VALUE reads (`ps.map` unparenthesized) keep the
-    // fence-first order: a stored-member undefined would mis-answer
-    // them, and calls dispatch through the dyn method machinery
-    // instead.
-    if (
-      (isJsSourceFile(expr.getSourceFile()) &&
-        (lowerer.mapTypeOf(lowerer.typeOf(expr.expression)) === null ||
-          (lowerer.typeOf(expr.expression).flags & ts.TypeFlags.Never) !== 0 ||
-          // A never-tainted receiver type maps (never rides as f64) but
-          // its VALUE lowered checked-dynamic — same dyn read.
-          neverTaintedJsType(lowerer, expr.expression, lowerer.typeOf(expr.expression)))) ||
-      (expr.name.text === "length" &&
-        (lowerer.checkerAnyArray(expr.expression) ||
-          (lowerer.checker.isArrayType(lowerer.typeOf(expr.expression)) &&
-            lowerer.mapTypeOf(lowerer.typeOf(expr.expression))?.kind === "dyn")))
-    ) {
-      const recv = lowerer.lowerExpr(expr.expression);
-      if (recv.type.kind === "dyn") {
-        const key: IrExpr = {
-          kind: "strLit",
-          value: expr.name.text,
-          type: STRING,
-          loc: locOf(expr.name),
-        };
-        const opt = hasOptionalChainGuard(expr.expression);
-        return lowerer.maybeNarrow(
-          {
-            kind: "dynKeyGet",
-            key,
-            ...(opt ? { optional: true as const } : {}),
-            value: recv,
-            type: DYN,
-            loc,
-          },
-          expr,
-        );
-      }
-      if (
-        expr.name.text === "length" &&
-        (recv.type.kind === "array" || recv.type.kind === "string")
-      ) {
-        return recv.type.kind === "array"
-          ? { kind: "arrIntrinsic", method: "length", receiver: recv, args: [], type: F64, loc }
-          : { kind: "strIntrinsic", method: "length", receiver: recv, args: [], type: F64, loc };
-      }
-    }
-    if (isJsSourceFile(expr.getSourceFile()) && expr.name.text === "constructor") {
-      const receiver = tryLowerExpression(lowerer, expr.expression);
-      if (
-        receiver?.type.kind === "dyn" ||
-        (receiver?.type.kind === "object" &&
-          !lowerer.classes.get(receiver.type.className)?.fields.has("constructor"))
-      ) {
-        return {
-          kind: "dynKeyGet",
-          value: lowerer.coerceToExpected(receiver, DYN),
-          key: { kind: "strLit", value: "constructor", type: STRING, loc },
-          type: DYN,
-          loc,
-        };
-      }
-    }
-    // `f.name` / `f.length` / own properties on a FUNCTION-typed JS
-    // value (the mustCall wrapper's function-instance members): read
-    // through the dyn box — the closure's own-property table answers
-    // first (defineProperties writes land there), then the box's
-    // best-effort static name and the declared arity; anything else is
-    // the own-property answer, undefined. Function.prototype METHOD
-    // names stay fenced (a stored-member undefined would mis-answer
-    // `f.call` as a value). Static callable values keep the existing TS fence; checked callable
-    // storage can expose its own name and length in both source languages.
-    if (
-      !["apply", "bind", "call", "toString", "caller", "arguments"].includes(expr.name.text) &&
-      (isJsSourceFile(expr.getSourceFile()) ||
-        expr.name.text === "name" ||
-        expr.name.text === "length" ||
-        expr.name.text === "constructor")
-    ) {
-      const probed = tryLowerExpression(lowerer, expr.expression);
-      // Inferred callable returns can use checked storage even when the
-      // checker still describes a function. Read its actual dyn value;
-      // the ambient Function member must not hide its own properties.
-      const receiverType = lowerer.typeOf(expr.expression);
-      const receiverSymbol = receiverType.getSymbol();
-      const checkedFunction =
-        lowerer.checker.getCallSignatures(receiverType).length > 0 ||
-        (receiverSymbol?.name === "Function" && lowerer.isStdlibSymbol(receiverSymbol));
-      if (probed?.type.kind === "dyn" && checkedFunction) {
-        const key: IrExpr = {
-          kind: "strLit",
-          value: expr.name.text,
-          type: STRING,
-          loc: locOf(expr.name),
-        };
-        const opt = hasOptionalChainGuard(expr.expression);
-        return lowerer.maybeNarrow(
-          {
-            kind: "dynKeyGet",
-            key,
-            value: probed,
-            ...(opt ? { optional: true as const } : {}),
-            type: DYN,
-            loc,
-          },
-          expr,
-        );
-      }
-      if (
-        (isJsSourceFile(expr.getSourceFile()) || expr.name.text === "constructor") &&
-        probed?.type.kind === "func" &&
-        canBoxFuncIntoDyn(
-          probed.type,
-          (id) => lowerer.shapes.get(id),
-          (id) => lowerer.unions.get(id),
-        )
-      ) {
-        const fnName = jsFuncNameOf(expr.expression);
-        const boxed: IrExpr = {
-          kind: "dynFrom",
-          value: probed,
-          type: DYN,
-          ...(fnName !== null ? { fnName } : {}),
-          loc,
-        };
-        const key: IrExpr = {
-          kind: "strLit",
-          value: expr.name.text,
-          type: STRING,
-          loc: locOf(expr.name),
-        };
-        return lowerer.maybeNarrow({ kind: "dynKeyGet", key, value: boxed, type: DYN, loc }, expr);
-      }
-    }
-    // A NARROWED IteratorResult receiver (`if (!r.done) r.value` — the
-    // checker narrows to IteratorYieldResult/IteratorReturnResult, whose
-    // own type cannot map: the shared record shape needs BOTH channels):
-    // the receiver's LOWERED record still carries the field, so the read
-    // is an ordinary recordGet — maybeNarrow then bridges the union slot
-    // to the checker's narrowed arm, exactly like a union field read.
-    if (expr.name.text === "done" || expr.name.text === "value") {
-      const receiverType = lowerer.typeOf(expr.expression);
-      const recvSym =
-        receiverType.getAliasSymbol()?.name === "IteratorResult"
-          ? receiverType.getAliasSymbol()
-          : receiverType.getSymbol();
-      if (
-        (recvSym?.name === "IteratorResult" ||
-          recvSym?.name === "IteratorYieldResult" ||
-          recvSym?.name === "IteratorReturnResult") &&
-        lowerer.checker
-          .declarationsOf(recvSym)
-          .some(
-            (d) =>
-              (ts.isInterfaceDeclaration(d) || ts.isTypeAliasDeclaration(d)) &&
-              lowerer.isStdlibFile(d.getSourceFile()),
-          )
-      ) {
-        const recv = lowerer.lowerExpr(expr.expression);
-        if (recv.type.kind === "dyn")
-          return lowerer.maybeNarrow(
-            {
-              kind: "dynKeyGet",
-              value: recv,
-              key: { kind: "strLit", value: expr.name.text, type: STRING, loc },
-              type: DYN,
-              loc,
-            },
-            expr,
-          );
-        if (recv.type.kind === "record") {
-          const shape = lowerer.shapes.get(recv.type.shapeId);
-          const field = shape?.fields.find((f) => f.name === expr.name.text);
-          if (field) {
-            const read: IrExpr = {
-              kind: "recordGet",
-              obj: recv,
-              shapeId: recv.type.shapeId,
-              field: field.name,
-              type: field.type,
-              loc,
-            };
-            return iteratorResultValueRead(lowerer, read, expr) ?? lowerer.maybeNarrow(read, expr);
-          }
-        }
-      }
-    }
-    // A chain rooted at an initializer-less ambient `declare const/var`
-    // whose declared type has NO mapping (mappable roots compose through
-    // the bare-read undefRead and never reach here): Node throws the
-    // catchable ReferenceError at the ROOT read before any member
-    // matters, so the whole access lowers to that throw — typed by the
-    // use site, or by the context it flows into (the throw never
-    // returns, so the dummy is never observed).
-    {
-      const ambientRoot = ambientUndefVarRootOf(lowerer, expr);
-      if (ambientRoot !== null) {
-        const t = ambientUndefReadType(lowerer, expr) ?? contextualUndefReadType(lowerer, expr);
-        if (t) return nsUndefRead(lowerer, ambientRoot.text, expr, t);
-      }
-    }
-    // Checked-dynamic stdlib results retain ambient property symbols,
-    // including parseArgs tokens narrowed to anonymous union arms. Only
-    // members owned by these implemented families bypass the stdlib fence.
-    const segmentDataSymbol = lowerer.typeOf(expr.expression).getSymbol();
-    const segmentDataProperty =
-      segmentDataSymbol?.name === "SegmentData" &&
-      lowerer.isStdlibSymbol(segmentDataSymbol) &&
-      ["segment", "index", "input", "isWordLike"].includes(expr.name.text);
-    // os.constants members vary by platform (the declared groups list
-    // every platform's names): a number member reads as `number |
-    // undefined`, like an array element, and a group stays checked.
-    const osConstants = isOsConstantsType(lowerer.typeOf(expr.expression), lowerer);
-    if (
-      isParseArgsDynProperty(lowerer, expr) ||
-      isStatFsDynProperty(lowerer, expr) ||
-      segmentDataProperty ||
-      osConstants ||
-      isLegacyUrlSymbol(lowerer.checker.getSymbolAtLocation(expr.name), lowerer)
-    ) {
-      const recv = lowerer.lowerExpr(expr.expression);
-      if (recv.type.kind === "dyn") {
-        const key: IrExpr = {
-          kind: "strLit",
-          value: expr.name.text,
-          type: STRING,
-          loc: locOf(expr.name),
-        };
-        const opt = hasOptionalChainGuard(expr.expression);
-        const read: IrExpr = {
-          kind: "dynKeyGet",
-          key,
-          ...(opt ? { optional: true as const } : {}),
-          value: recv,
-          type: DYN,
-          loc,
-        };
-        if (osConstants) {
-          return lowerer.mapTypeOf(lowerer.typeOf(expr))?.kind === "f64"
-            ? lowerer.coerceToExpected(read, lowerer.withUndefinedArm(F64))
-            : read;
-        }
-        return lowerer.maybeNarrow(read, expr);
-      }
-    }
-    // A member read through a NULLISH generic binding (`const i: I<A &
-    // B> = null as any; const _i: I<A> = i.something` — the receiver
-    // provably holds null/undefined forever): the read throws Node's
-    // exact TypeError at the access.
-    if (ts.isIdentifier(expr.expression) && expr.questionDotToken === undefined) {
-      const unit = nullishGenericBindingUnitOf(
-        lowerer,
-        lowerer.resolveValueSymbol(expr.expression),
-      );
-      if (unit !== null) {
-        const t =
-          ambientUndefReadType(lowerer, expr) ?? contextualUndefReadType(lowerer, expr) ?? F64;
-        return nodeThrowExpr(
-          1,
-          "",
-          `Cannot read properties of ${unit} (reading '${expr.name.text}')`,
-          t,
-          loc,
-        );
-      }
-    }
-    // The lib fence's PROPERTY chokepoint: a stdlib-declared member that
-    // no lowering above claimed ([1,2].entries, Math.SQRT2, Promise.all,
-    // re.exec as a value, ...) reports SC2020 here.
-    lowerer.stdlibMemberFence(expr);
-    // The npm chokepoint: a member on a package-typed receiver in a
-    // static build — attributed to the package, like every other site.
-    lowerer.npmMemberFence(expr);
-    // A property read rooted at a BLOCKED binding: the declaration
-    // carries the real diagnostic — the SC2004 cascade, not a generic
-    // "property access" rejection.
-    {
-      let root: ts.Expression = expr.expression;
-      while (ts.isPropertyAccessExpression(root)) root = root.expression;
-      if (ts.isIdentifier(root) && lowerer.isBlockedBinding(lowerer.resolveValueSymbol(root))) {
-        lowerer.pushDiag(blockedBindingUseDiag(root.text, loc));
-        throw new PoisonError();
-      }
-    }
-    // Nothing claimed the member. Lower the RECEIVER before rejecting:
-    // when the receiver itself is the blocker (`(await import(x)).y` —
-    // the dynamic import is the unsupported part), ITS diagnostic is the
-    // honest one, not a generic recitation about the outer dot. A
-    // receiver that lowers cleanly means the MEMBER is the gap — name
-    // the property and the receiver's type instead of "property access".
-    const recvLowered = lowerer.lowerExpr(expr.expression);
-    // A dyn receiver — JSON.parse's `any`, or `unknown` the checker
-    // narrowed to `object` — reads through the dyn keyed read: member
-    // or undefined (JS's own-property answer), throwing JS's TypeError
-    // on undefined/null receivers unless an earlier `?.` guards the
-    // chain. Scalar-narrowed occurrences bridge via maybeNarrow's
-    // validated dynCheck as usual.
-    if (
-      recvLowered.type.kind === "dyn" ||
-      (isJsSourceFile(expr.getSourceFile()) &&
-        (["f64", "bool", "bigint", "string", "symbol"].includes(recvLowered.type.kind) ||
-          (recvLowered.type.kind === "union" && lowerer.dynConvertible(recvLowered.type))))
-    ) {
-      const key: IrExpr = {
-        kind: "strLit",
-        value: expr.name.text,
-        type: STRING,
-        loc: locOf(expr.name),
-      };
-      const opt = hasOptionalChainGuard(expr.expression);
-      return lowerer.maybeNarrow(
-        {
-          kind: "dynKeyGet",
-          key,
-          ...(opt ? { optional: true as const } : {}),
-          value: lowerer.coerceToExpected(recvLowered, DYN),
-          type: DYN,
-          loc,
-        },
-        expr,
-      );
-    }
-    // The lowered receiver is a RECORD the checker spelled wider —
-    // `s.match(re).groups.key` in a JS file: the checker says
-    // `{ [key: string]: string } | undefined`, but the groups
-    // projection already answered the record arm (its null trap
-    // included). Declared fields read directly; an index-signature
-    // shape serves undeclared keys through the overflow read, exactly
-    // the dot-access rule on checker-spelled hybrids.
-    if (recvLowered.type.kind === "record") {
-      const recvShape = lowerer.shapes.get(recvLowered.type.shapeId);
-      const field = recvShape?.fields.find((f) => f.name === expr.name.text);
-      if (field) {
-        return lowerer.maybeNarrow(
-          {
-            kind: "recordGet",
-            obj: recvLowered,
-            shapeId: recvLowered.type.shapeId,
-            field: field.name,
-            type: field.type,
-            loc,
-          },
-          expr,
-        );
-      }
-      if (recvShape?.indexValue !== undefined && !recvShape.tuple) {
-        return lowerer.maybeNarrow(
-          {
-            kind: "recordKeyGet",
-            obj: recvLowered,
-            shapeId: recvLowered.type.shapeId,
-            key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
-            overflowOnly: true,
-            type: recvShape.indexValue,
-            loc,
-          },
-          expr,
-        );
-      }
-      // An inferred package-JS call specializes a parameter to the
-      // caller's own record shape. Optional option names omitted by that
-      // caller read undefined; the missing field is not a failed type
-      // assertion. Known prototype members were handled/fenced above.
-      if (
-        recvShape &&
-        !recvShape.tuple &&
-        lowerer.implicitParamTypes !== null &&
-        isJsSourceFile(expr.getSourceFile()) &&
-        npmStaticPackageOfPath(expr.getSourceFile().fileName) !== null
-      ) {
-        return {
-          kind: "seqExpr",
-          stmts: [{ kind: "exprStmt", expr: recvLowered, loc }],
-          result: dynUndefinedExpr(loc),
-          type: DYN,
-          loc,
-        };
-      }
-    }
-    // An ABSTRACT property through an abstract-typed receiver: the
-    // declaration is erased at runtime — Node defines no field for it,
-    // each concrete subclass declares its OWN (at its own layout
-    // position), so no shared base slot exists to read. Abstract
-    // ACCESSORS are the supported spelling: they declare a vtable slot.
-    if (recvLowered.type.kind === "object" && abstractPropertyDeclOf(lowerer, expr)) {
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        `reading the abstract property '${expr.name.text}' through a '${lowerer.checker.typeToString(lowerer.typeOf(expr.expression))}'-typed receiver (abstract property declarations are erased at runtime, so no shared slot exists — type the receiver as the concrete class, or declare an abstract getter instead)`,
-      );
-    }
-    // Array reads may add an undefined arm even when the checker still
-    // reports a class. Its property bag must remain reachable, while
-    // an absent element takes the normal checked-value TypeError.
-    const nativeReceiver = lowerer.stripUndefinedArm(recvLowered.type);
-    if (ts.isPrivateIdentifier(expr.name) && recvLowered.type.kind === "object") {
-      const field = lowerer.classes.get(recvLowered.type.className)?.fields.get(expr.name.text);
-      if (field)
-        return {
-          kind: "fieldGet",
-          obj: recvLowered,
-          className: recvLowered.type.className,
-          field: expr.name.text,
-          type: field,
-          loc,
-        };
-    }
-    if (nativeReceiver.kind === "object" && nativeReceiver.className === "%Error") {
-      return lowerer.maybeNarrow(
-        {
-          kind: "dynKeyGet",
-          value: lowerer.coerceToExpected(recvLowered, DYN),
-          key: { kind: "strLit", value: expr.name.text, type: STRING, loc },
-          type: DYN,
-          loc,
-        },
-        expr,
-      );
-    }
-    if (isDynTypedRefType(nativeReceiver)) {
-      const info = lowerer.classes.get(nativeReceiver.className);
-      if (
-        info &&
-        !info.def.runtime &&
-        !info.builtinError &&
-        !info.builtinEmitter &&
-        !info.builtinStream
-      ) {
-        return lowerer.maybeNarrow(
-          {
-            kind: "dynKeyGet",
-            value: lowerer.coerceToExpected(recvLowered, DYN),
-            key: { kind: "strLit", value: expr.name.text, type: STRING, loc },
-            type: DYN,
-            loc,
-          },
-          expr,
-        );
-      }
-    }
-    // A member a JavaScript module attached to one of its functions
-    // (`status.message = codes; module.exports = status`), read from
-    // TypeScript: JavaScript stores such members on the function's own
-    // property table (`fn.member = v` writes through the function's
-    // checked-dynamic face), so the read takes the same path and enters
-    // the static code at the type inference gave the member.
-    if (recvLowered.type.kind === "func" && jsFunctionExpandoMember(lowerer, expr)) {
-      const read: IrExpr = {
-        kind: "dynKeyGet",
-        value: lowerer.coerceToExpected(recvLowered, DYN),
-        key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
-        type: DYN,
-        loc,
-      };
-      const mapped = lowerer.mapTypeOf(lowerer.typeOf(expr));
-      return mapped && mapped.kind !== "void" ? lowerer.coerceInto(expr, read, mapped) : read;
-    }
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      `reading '${expr.name.text}' from a value of type '${lowerer.checker.typeToString(lowerer.typeOf(expr.expression))}'`,
-    );
-  }
+  if (ts.isPropertyAccessExpression(expr)) return lowerPropertyAccessExpr(lowerer, expr, loc);
 
   // Meta-properties, named: `new.target` reflects HOW a function was
   // invoked (compiled functions are never constructors of themselves —
@@ -2958,991 +718,6 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
   lowerer.unsupported("SC1090", expr, `syntax '${ts.syntaxKindName(expr.kind)}'`);
 }
 
-function moduleFileName(lowerer: Lowerer, sf: ts.SourceFile): string {
-  return lowerer.targetPlatform === "wasi"
-    ? (wasiGuestPath(sf.fileName) ?? sf.fileName.replace(/\\/g, "/"))
-    : sf.fileName;
-}
-
-function importMetaProperty(lowerer: Lowerer, expr: ts.PropertyAccessExpression): IrExpr | null {
-  return isImportMeta(expr.expression) ? importMetaField(lowerer, expr, expr.name.text) : null;
-}
-
-/** `c ? a : b`. An explicit destination constructs each branch at that
- * layout before joining it. Without one, retain the expression's inferred
- * type and the contextual/sibling rules below. */
-export function lowerTernary(
-  lowerer: Lowerer,
-  expr: ts.ConditionalExpression,
-  expected?: IrType,
-): IrExpr {
-  const loc = locOf(expr);
-  // `Array.isArray(x) ? x : [x]` over a `T | readonly T[]` union: tsc
-  // narrows the TRUE branch to `any[]` (maybeNarrow's isArray bridge
-  // rides that) but leaves the FALSE branch wide — a readonly array
-  // is not assignable to `any[]`, so the arm never subtracts. The
-  // RUNTIME tag test proves the remaining arm exactly, so the false
-  // arm's reads of x narrow to the union's one non-array checker
-  // constituent (the certs configuredTlds shape). Nested functions
-  // stay out (they run later, when the proof is stale — tsc's own
-  // invalidation rule).
-  const falseArmNarrows: ts.Identifier[] = [];
-  let falseArmNarrowType: ts.Type | null = null;
-  {
-    let c: ts.Expression = expr.condition;
-    while (ts.isParenthesizedExpression(c)) c = c.expression;
-    if (
-      ts.isCallExpression(c) &&
-      ts.isPropertyAccessExpression(c.expression) &&
-      c.arguments.nodes.length === 1 &&
-      ts.isIdentifier(c.arguments.nodes[0]!) &&
-      lowerer.stdlibGlobalMember(c.expression, "Array") === "isArray"
-    ) {
-      const argIdent = c.arguments.nodes[0] as ts.Identifier;
-      const sym = lowerer.resolveValueSymbol(argIdent);
-      const t = lowerer.checker.getTypeAtLocation(argIdent);
-      const constituents = t.isUnionType() ? ts.constituentTypes(t) : [];
-      const nonArray = constituents.filter(
-        (a) => !lowerer.checker.isArrayType(a) && !lowerer.checker.isTupleType(a),
-      );
-      const mapped = lowerer.mapTypeOf(t);
-      const armCount = mapped?.kind === "union" ? lowerer.arrayValueTags(mapped.unionId).length : 0;
-      if (sym && nonArray.length === 1 && armCount === 1) {
-        falseArmNarrowType = nonArray[0]!;
-        const collect = (n: ts.Node): void => {
-          if (ts.isFunctionLike(n)) return;
-          if (
-            ts.isIdentifier(n) &&
-            lowerer.resolveValueSymbol(n) === sym &&
-            !lowerer.chainNarrowedType.has(n)
-          ) {
-            falseArmNarrows.push(n);
-          }
-          n.forEachChild(collect);
-        };
-        collect(expr.whenFalse);
-      }
-    }
-  }
-  for (const n of falseArmNarrows) lowerer.chainNarrowedType.set(n, falseArmNarrowType!);
-  try {
-    const cond = lowerer.lowerCondition(expr.condition);
-    // A condition the LOWERING proved constant (typeof-dyn against a
-    // kind no dyn box can hold — the bigint/symbol/function fold): only
-    // the taken arm exists at runtime, so only it lowers — which is
-    // exactly what lets a dual-mode arm with no static lowering (bigint
-    // literals) sit untaken in compiled JS. A boolLit carries no
-    // effects, so dropping the condition read loses nothing.
-    if (cond.kind === "boolLit") {
-      return lowerer.lowerExprExpecting(cond.value ? expr.whenTrue : expr.whenFalse, expected);
-    }
-    if (expected) {
-      // Construct fresh literals in their actual destination. Joining
-      // inferred layouts first can erase the literal discriminator or
-      // choose an empty array's uninhabited element representation.
-      // Runtime-optional proofs apply only within the selected true arm.
-      const then = withRuntimeOptionalNarrowed(
-        lowerer,
-        runtimeOptionalTrueIds(lowerer, expr.condition),
-        () => lowerer.lowerExprExpecting(expr.whenTrue, expected),
-      );
-      const else_ = lowerer.lowerExprExpecting(expr.whenFalse, expected);
-      return { kind: "ternary", cond, then, else_, type: expected, loc };
-    }
-    const ctxTs = lowerer.checker.getContextualType(expr);
-    const ctxMapped = ctxTs ? lowerer.mapTypeOf(ctxTs) : null;
-    // Array-literal arms build directly as the slot's array type when
-    // the ternary sits under an ARRAY context (tsc accepts each arm
-    // covariantly — `[stdin]` types string[] against an
-    // (Uint8Array | string)[] slot — but a tagged element representation
-    // must be BUILT as the slot's element type, the same rule element
-    // expressions follow inside every array literal). And an EMPTY
-    // array-literal arm with no usable type of its own (tsc infers
-    // `never[]`; no mappable contextual type reaches into the arm — the
-    // conditional-spread idiom `[...(c ? [x] : [])]`) adopts the SIBLING
-    // arm's array type: the ternary twin of the union-slot rule in
-    // lowerArrayLiteral, and just as unambiguous — tsc already typed the
-    // whole ternary by the filled arm alone. Both arms empty stays
-    // fenced (no element type exists anywhere).
-    const ctxArray = ctxMapped?.kind === "array" ? ctxMapped : null;
-    const armLiteral = (e: ts.Expression): ts.ArrayLiteralExpression | null => {
-      let x = e;
-      while (ts.isParenthesizedExpression(x)) x = x.expression;
-      return ts.isArrayLiteralExpression(x) ? x : null;
-    };
-    const emptyUntypedArrayArm = (e: ts.Expression): boolean => {
-      const lit = armLiteral(e);
-      if (!lit || lit.elements.nodes.length !== 0) return false;
-      const t = lowerer.checker.getContextualType(lit) ?? lowerer.typeOf(lit);
-      if (!lowerer.mapTypeOf(t)) return true;
-      // never[] MAPS (the f64 representation for the uninhabited) but
-      // carries no element information — an empty literal typed that way
-      // still adopts the sibling arm's array type, tsc's own reading.
-      if (lowerer.checker.isArrayType(t)) {
-        const elem = lowerer.checker.getTypeArguments(t as ts.TypeReference)[0];
-        if (elem !== undefined && elem.flags & ts.TypeFlags.Never) return true;
-      }
-      return false;
-    };
-    // Inferred signature tables often join a populated argument array
-    // with nested empty-array branches. Carry the whole record layout
-    // through those branches before constructing their fresh fields.
-    const ownJoin = lowerer.mapTypeOf(lowerer.typeOf(expr));
-    const recordJoin =
-      ctxMapped?.kind === "record" ? ctxMapped : ownJoin?.kind === "record" ? ownJoin : undefined;
-    const lowerArm = (e: ts.Expression, siblingType?: IrType): IrExpr => {
-      let fresh = e;
-      while (ts.isParenthesizedExpression(fresh)) fresh = fresh.expression;
-      if (recordJoin && ts.isConditionalExpression(fresh))
-        return lowerTernary(lowerer, fresh, recordJoin);
-      if (recordJoin && ts.isObjectLiteralExpression(fresh)) {
-        return lowerer.lowerObjectLiteral(fresh, recordJoin);
-      }
-      const lit = armLiteral(e);
-      if (lit && ctxArray) return lowerer.lowerArrayLiteral(lit, ctxArray);
-      if (lit && siblingType?.kind === "array") {
-        if (emptyUntypedArrayArm(e)) {
-          return { kind: "arrayLit", elems: [], type: siblingType, loc: locOf(lit) };
-        }
-        // A FILLED literal arm whose own element type is a UNION
-        // carrying the sibling's element as an arm (`Array.isArray(x) ?
-        // x : [x]` — the false arm's x checker-types as the whole union
-        // even though the runtime tag proved the non-array arm): build
-        // as the sibling's array type — each element coerces into the
-        // sibling element or fences on its own.
-        const ownT = lowerer.mapTypeOf(lowerer.typeOf(lit));
-        if (
-          ownT?.kind === "array" &&
-          ownT.elem.kind === "union" &&
-          siblingType.elem.kind !== "union" &&
-          lowerer.armTag(ownT.elem.unionId, siblingType.elem) >= 0
-        ) {
-          return lowerer.lowerArrayLiteral(lit, siblingType);
-        }
-        // A FILLED literal arm whose own array type has NO lift into the
-        // sibling's (`isWindows ? ['cmd.exe', ['/d']] : ['pwd', []]` —
-        // the empty nested literal types never[], whose f64-element
-        // representation re-tags into nothing): the generic path could
-        // only fence the whole ternary, so build AS the sibling type —
-        // each element coerces into the sibling's element slot or fences
-        // on its own, and a nested empty literal adopts the slot's array
-        // arm (the union-slot rule). tsc already accepted the arm
-        // covariantly against the join, so a fitting literal is exactly
-        // the value the checker typed.
-        if (
-          ownT?.kind === "array" &&
-          !typeEquals(ownT, siblingType) &&
-          lowerer.widthLiftPlan(ownT, siblingType) === null
-        ) {
-          return lowerer.lowerArrayLiteral(lit, siblingType);
-        }
-      }
-      return lowerer.lowerExpr(e);
-    };
-    // Lower the filled arm first so an empty arm can adopt its type.
-    // When the checker's OWN join for the ternary maps to an ARRAY,
-    // literal arms build against it directly (tsc collapses the arms'
-    // covariant array types into one — `c ? ['sh', []] : ['cmd', ['/d']]`
-    // joins as (string | string[])[] whichever arm nests the empty
-    // literal), so neither arm's uninhabited never[] reading decides.
-    const ownArrayJoin = (() => {
-      const m = lowerer.mapTypeOf(lowerer.typeOf(expr));
-      return m?.kind === "array" ? m : null;
-    })();
-    let thenRaw: IrExpr;
-    let elseRaw: IrExpr;
-    const runtimeTrueIds = runtimeOptionalTrueIds(lowerer, expr.condition);
-    const lowerTrueArm = (): IrExpr =>
-      withRuntimeOptionalNarrowed(lowerer, runtimeTrueIds, () =>
-        lowerArm(expr.whenTrue, ownArrayJoin ?? undefined),
-      );
-    if (!ctxArray && emptyUntypedArrayArm(expr.whenTrue) && !emptyUntypedArrayArm(expr.whenFalse)) {
-      elseRaw = lowerer.lowerExpr(expr.whenFalse);
-      thenRaw = withRuntimeOptionalNarrowed(lowerer, runtimeTrueIds, () =>
-        lowerArm(
-          expr.whenTrue,
-          elseRaw.type.kind === "dyn" && ownArrayJoin ? ownArrayJoin : elseRaw.type,
-        ),
-      );
-    } else {
-      thenRaw = lowerTrueArm();
-      // A checked-dynamic producer (Object.entries(...).filter(...))
-      // can still have a precise checker array type. Empty literal arms
-      // must adopt that element layout before the checked array boundary.
-      elseRaw = lowerArm(
-        expr.whenFalse,
-        thenRaw.type.kind === "dyn" && ownArrayJoin ? ownArrayJoin : thenRaw.type,
-      );
-    }
-    // The ternary's IR type is normally the checker's own: it collapses
-    // same-kind literal unions ("a" | "b" → string) and forms tagged
-    // unions for mixed arms that map (`c ? okRec : errRec`); anything
-    // left unmappable gets the type fence (badType) here. A record/union CONTEXTUAL type
-    // takes over exactly when the own type can't carry the value —
-    // unmappable, or a DIFFERENT union (branch literals omitting
-    // DIFFERENT optional subsets make the own type a union of the
-    // narrower fresh shapes, and a union-typed slot can sub-union the
-    // same way; neither has a runtime re-tag, while tsc guarantees each
-    // branch is assignable to the context). A base-CLASS context absorbs
-    // the same case: branches producing different subclasses make the
-    // own type a class union (`c ? new Dog() : new Bird()` against an
-    // Animal slot), while each branch upcasts into the context fine. A
-    // collapsed own type must WIN over a wider contextual union
-    // (`console.log(c ? "yes" : "no")` stays string against the ambient
-    // string | number | boolean parameter), and an 'unknown'/'any'
-    // context never absorbs the ternary (`JSON.stringify(c ? 1 : 2)`
-    // stays f64-typed). Arms that AGREE on an array type decide it
-    // themselves (a context- or sibling-built literal arm can carry a
-    // tagged element type the checker's own type doesn't spell).
-    const own = lowerer.mapTypeOf(lowerer.typeOf(expr));
-    const useCtx =
-      (ctxMapped?.kind === "record" ||
-        ctxMapped?.kind === "union" ||
-        ctxMapped?.kind === "object") &&
-      (own === null ||
-        (own.kind === "union" &&
-          !typeEquals(own, ctxMapped) &&
-          !lowerer.inLogicalLeftPosition(expr)));
-    // Mixed dyn/unit arms under an unmappable own type (`typeof pkg.name
-    // === "string" ? pkg.name : null` — the lowering world types the
-    // unknown-receiver read `any`, which a static build cannot hold):
-    // dyn represents null and undefined directly, so the ternary stays
-    // dyn — a unit arm converts to the dyn unit value (the dynFrom form
-    // the index-signature lowerings already use). A FRESH literal arm
-    // (`... ? pkg.scripts : {}` — the default-object idiom) converts the
-    // same way when it is JSON-safe: nothing else aliases a literal, so
-    // the dyn copy is unobservable.
-    const dynish = (e: IrExpr): boolean =>
-      e.type.kind === "dyn" ||
-      e.kind === "unitLit" ||
-      ((e.kind === "recordLit" || e.kind === "arrayLit") && lowerer.dynConvertible(e.type));
-    const dynJoin =
-      own === null &&
-      !(useCtx && ctxMapped) &&
-      dynish(thenRaw) &&
-      dynish(elseRaw) &&
-      (thenRaw.type.kind === "dyn" || elseRaw.type.kind === "dyn");
-    // A checker-`any` ternary whose lowered arms are STATIC (`rawName ?
-    // rawName.replace(...) : null` — the dyn-receiver string machinery
-    // answers a static string): the checker's `any` carries no shape,
-    // but the arms do — equal arms take their shared type, a unit arm
-    // joins the other arm as its null/undefined-armed union. Gated on
-    // genuine `any` so every other unmappable keeps its own diagnostic.
-    let anyJoin: IrType | null = null;
-    if (
-      own === null &&
-      !dynJoin &&
-      !(useCtx && ctxMapped) &&
-      (lowerer.typeOf(expr).flags & ts.TypeFlags.Any) !== 0
-    ) {
-      const a = thenRaw.type;
-      const b = elseRaw.type;
-      const staticArm = (t: IrType): boolean =>
-        t.kind !== "dyn" && t.kind !== "caught" && t.kind !== "void";
-      if (staticArm(a) && staticArm(b)) {
-        if (typeEquals(a, b)) {
-          anyJoin = a;
-        } else if (isUnitType(a) !== isUnitType(b)) {
-          const unit = isUnitType(a) ? a : b;
-          const val = isUnitType(a) ? b : a;
-          const arms =
-            val.kind === "union" ? (lowerer.unions.get(val.unionId)?.arms ?? null) : [val];
-          if (arms && !arms.some((x) => typeEquals(x, unit))) {
-            anyJoin = { kind: "union", unionId: lowerer.unions.intern([...arms, unit]) };
-          } else if (arms) {
-            anyJoin = val; // the unit is already an arm
-          }
-        }
-      }
-    }
-    // JavaScript function selection preserves the chosen closure's full
-    // call ABI. A checker join can erase a rest/arguments pack even though
-    // a later call supplies additional observable arguments.
-    const callableJoin =
-      isJsSourceFile(expr.getSourceFile()) &&
-      thenRaw.type.kind === "func" &&
-      elseRaw.type.kind === "func" &&
-      !typeEquals(thenRaw.type, elseRaw.type) &&
-      lowerer.dynConvertible(thenRaw.type) &&
-      lowerer.dynConvertible(elseRaw.type);
-    // JavaScript inference can discard an initially-undefined field from
-    // a conditional's type even after that field acquired other values.
-    // A checked arm must retain its actual representation at the join.
-    const checkedJsJoin =
-      isJsSourceFile(expr.getSourceFile()) &&
-      (thenRaw.type.kind === "dyn" || elseRaw.type.kind === "dyn") &&
-      lowerer.dynConvertible(thenRaw.type) &&
-      lowerer.dynConvertible(elseRaw.type);
-    const type =
-      callableJoin || checkedJsJoin
-        ? DYN
-        : thenRaw.type.kind === "array" && typeEquals(thenRaw.type, elseRaw.type)
-          ? thenRaw.type
-          : dynJoin
-            ? DYN
-            : (anyJoin ?? (useCtx && ctxMapped ? ctxMapped : lowerer.irTypeOf(expr)));
-    // Each arm flows into the ternary's type through the slot-coercion
-    // path: union arms wrap, dyn slots reject the non-dyn arm with
-    // SC1101, mismatched record shapes get SC2002; coerceInto is
-    // inert when the types already agree.
-    const intoDyn = (e: IrExpr): IrExpr =>
-      e.type.kind === "dyn" ? e : { kind: "dynFrom", value: e, type: DYN, loc: e.loc };
-    const then = dynJoin ? intoDyn(thenRaw) : lowerer.coerceInto(expr.whenTrue, thenRaw, type);
-    const else_ = dynJoin ? intoDyn(elseRaw) : lowerer.coerceInto(expr.whenFalse, elseRaw, type);
-    if (then.type.kind !== type.kind || else_.type.kind !== type.kind) {
-      lowerer.badType(expr, lowerer.typeOf(expr));
-    }
-    return { kind: "ternary", cond, then, else_, type, loc };
-  } finally {
-    for (const n of falseArmNarrows) lowerer.chainNarrowedType.delete(n);
-  }
-}
-
-/** Checker-driven union narrowing. tsc's control-flow analysis narrows a
- * union-typed reference at use sites (`if (r.kind === "ok") { ...r... }`
- * types `r` as the ok-arm inside the branch); the IR value is still the
- * tagged union, so the read is bridged with a `unionNarrow` extracting
- * the arm's payload. The extraction relies on tsc having proven the tag;
- * backends verify it once and trap on a mismatch, so a wrong proof stops
- * the program instead of reading another arm. A checker type that maps to
- * the same union (unnarrowed use), to a SUB-union (partial narrowing —
- * unrepresentable without a re-tag), or to nothing (`never` in an
- * exhaustive default) leaves the expression union-typed. */
-export function maybeNarrow(lowerer: Lowerer, expr: IrExpr, node: ts.Node): IrExpr {
-  if (
-    (expr.type.kind === "union" || expr.type.kind === "dyn") &&
-    isJsSourceFile(node.getSourceFile()) &&
-    ts.isPropertyAccessExpression(node)
-  ) {
-    const symbol = lowerer.checker.getSymbolAtLocation(node.name);
-    if (
-      symbol &&
-      lowerer.checker
-        .declarationsOf(symbol)
-        .some(
-          (decl) =>
-            ts.isPropertyDeclaration(decl) &&
-            !decl.initializer &&
-            !decl.type &&
-            isJsSourceFile(decl.getSourceFile()),
-        )
-    ) {
-      // Inference describes later writes, not the initial undefined.
-      // A use that requires the inferred type must validate the value.
-      return expr.type.kind === "dyn"
-        ? expr
-        : { kind: "dynFrom", value: expr, type: DYN, loc: expr.loc };
-    }
-  }
-  // A dyn read tsc narrowed to a SCALAR (a typeof test proved the kind):
-  // bridge with a VALIDATED extraction — dynCheck, the checked-cast
-  // machinery — rather than a trusted one. After the guard the check
-  // never fires; a read smuggled past it throws a catchable TypeError
-  // instead of misreading the payload (the dyn boundary's usual stance).
-  // Object/array narrowings stay dyn-typed and keep their fences.
-  if (expr.type.kind === "dyn") {
-    // An inferred JS member's storage may be deliberately wider than its
-    // declaration (prototype-selected buffers, null-initialized scratch
-    // objects). Extract at the consuming operation, not at the read.
-    if (isJsSourceFile(node.getSourceFile()) && ts.isPropertyAccessExpression(node)) {
-      const receiver = lowerer.mapTypeOf(lowerer.typeOf(node.expression));
-      if (receiver?.kind === "object") {
-        const info = lowerer.classes.get(receiver.className);
-        if (
-          info?.fields.get(node.name.text)?.kind === "dyn" ||
-          lowerer.findMethodOn(info ?? null, `get:${node.name.text}`)?.sig.ret.kind === "dyn"
-        )
-          return expr;
-      }
-      if (receiver?.kind === "classval") {
-        const info = lowerer.classes.get(receiver.className);
-        if (info && hasRuntimeStatics(info)) return expr;
-      }
-    }
-    if (
-      isJsSourceFile(node.getSourceFile()) &&
-      (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node))
-    ) {
-      let receiver = node.expression;
-      while (
-        ts.isPropertyAccessExpression(receiver) ||
-        ts.isElementAccessExpression(receiver) ||
-        ts.isParenthesizedExpression(receiver)
-      ) {
-        if (ts.isPropertyAccessExpression(receiver)) {
-          const owner = lowerer.mapTypeOf(lowerer.typeOf(receiver.expression));
-          if (
-            owner?.kind === "object" &&
-            lowerer.classes.get(owner.className)?.fields.get(receiver.name.text)?.kind === "dyn"
-          )
-            return expr;
-        }
-        receiver = receiver.expression;
-      }
-      if (receiver.kind === ts.SyntaxKind.ThisKeyword && lowerer.resolveThis()?.type.kind === "dyn")
-        return expr;
-      if (ts.isIdentifier(receiver)) {
-        const stored = lowerer.peekLocal(receiver)?.type ?? lowerer.globalOf(receiver)?.type;
-        if (stored?.kind === "dyn") return expr;
-        const symbol = lowerer.resolveValueSymbol(receiver);
-        const bound = symbol && lowerer.implicitParamTypes?.get(symbol);
-        if (bound && lowerer.mapTypeOf(bound)?.kind === "dyn") return expr;
-      }
-    }
-    if (isJsSourceFile(node.getSourceFile()) && ts.isIdentifier(node)) {
-      const symbol = lowerer.resolveValueSymbol(node);
-      if (
-        symbol &&
-        lowerer.checker
-          .declarationsOf(symbol)
-          .some(
-            (decl) =>
-              ts.isParameter(decl) &&
-              ts.isMethodDeclaration(decl.parent) &&
-              lowerer.checkedVirtualJsMethods.has(decl.parent),
-          )
-      )
-        return expr;
-      if (
-        symbol &&
-        lowerer.checker
-          .declarationsOf(symbol)
-          .some((decl) => ts.isParameter(decl) && ts.isConstructorDeclaration(decl.parent))
-      )
-        return expr;
-      if (
-        symbol &&
-        lowerer.checker
-          .declarationsOf(symbol)
-          .some((decl) => ts.isVariableDeclaration(decl) && jsBindingHasOpenWrites(lowerer, decl))
-      )
-        return expr;
-      if (
-        symbol &&
-        lowerer.checker
-          .declarationsOf(symbol)
-          .some(
-            (decl) =>
-              ts.isParameter(decl) &&
-              decl.initializer &&
-              !decl.type &&
-              !/@(?:param|type)\b/.test(
-                decl.getSourceFile().text.slice(decl.parent?.pos ?? decl.pos, decl.getStart()),
-              ),
-          )
-      )
-        return expr;
-      if (
-        symbol &&
-        lowerer.checker.declarationsOf(symbol).some((decl) => {
-          if (!ts.isParameter(decl) || decl.type) return false;
-          const fn = decl.parent;
-          if (!ts.isFunctionExpression(fn) && !ts.isArrowFunction(fn)) return false;
-          const assignment = fn.parent;
-          return (
-            ts.isBinaryExpression(assignment) &&
-            assignment.right === fn &&
-            ts.isPropertyAccessExpression(assignment.left) &&
-            assignment.left.name.text === "write" &&
-            lowerer.isStdlibMember(assignment.left)
-          );
-        })
-      )
-        return expr;
-    }
-    // Node's TTY declarations promise booleans/numbers even when a pipe
-    // has no such property. Preserve the checked read for JS capability
-    // probes instead of treating a declaration as a runtime type guard.
-    if (
-      isJsSourceFile(node.getSourceFile()) &&
-      ts.isPropertyAccessExpression(node) &&
-      ["isTTY", "columns", "rows"].includes(node.name.text) &&
-      lowerer.isStdlibMember(node)
-    )
-      return expr;
-    // A null-initialized JS field can later receive an object even when
-    // checker flow calls its non-null branch never. The live checked
-    // value remains authoritative; never is not a numeric guard.
-    if (
-      isJsSourceFile(node.getSourceFile()) &&
-      (lowerer.typeOf(node).flags & ts.TypeFlags.Never) !== 0
-    )
-      return expr;
-    const narrowed = lowerer.mapTypeOf(lowerer.typeOf(node));
-    if (
-      narrowed &&
-      (narrowed.kind === "f64" ||
-        narrowed.kind === "bool" ||
-        narrowed.kind === "string" ||
-        narrowed.kind === "bigint")
-    ) {
-      return { kind: "dynCheck", value: expr, type: narrowed, loc: expr.loc };
-    }
-    // An instanceof narrow retains the native view after validating its
-    // exact element kind. Buffer also matches Uint8Array.
-    if (narrowed?.kind === "bytes" || narrowed?.kind === "url") {
-      return { kind: "dynCheck", value: expr, type: narrowed, loc: expr.loc };
-    }
-    // An `instanceof Error` narrow: the checked-dynamic tree's error encoding rebuilds a
-    // fresh %Error (name/message/code from the marker object — a COPY,
-    // the unknown boundary's stance; SEMANTICS.md 67), validated like
-    // every dyn extraction.
-    if (narrowed?.kind === "object" && narrowed.className === "%Error") {
-      return { kind: "dynCheck", value: expr, type: narrowed, loc: expr.loc };
-    }
-    return expr;
-  }
-  // instanceof narrowing for classes: tsc types this USE as a subclass of
-  // the IR value's class (only a dynamic instanceof test narrows a class
-  // type), so the read bridges with a static downcast that backends verify
-  // at run time, like the union bridge below.
-  if (expr.type.kind === "object") {
-    const narrowed = lowerer.mapTypeOf(lowerer.typeOf(node));
-    if (narrowed?.kind === "union") {
-      const union = narrowClassUnion(lowerer, expr, narrowed);
-      if (union) return union;
-    }
-    if (
-      narrowed?.kind === "object" &&
-      narrowed.className !== expr.type.className &&
-      lowerer.isSubclassOf(narrowed.className, expr.type.className)
-    ) {
-      if (lowerer.narrowing.untrusted(node, narrowed)) {
-        const checked = checkedClassAssertion(lowerer, expr, narrowed, expr.loc);
-        if (checked) return checked;
-      }
-      return { kind: "downcast", value: expr, type: narrowed, loc: expr.loc };
-    }
-    return expr;
-  }
-  if (expr.type.kind !== "union") return expr;
-  if (ts.isPropertyAccessExpression(node) && isOptionalProcessStreamProperty(lowerer, node))
-    return expr;
-
-  // Represented fields and index values can include undefined even when
-  // checker inference or lib.d.ts declares strings (RegExp captures).
-  // Only a declaration that represents the optional arm can provide a
-  // trustworthy flow narrowing; otherwise consumers must check it.
-  if (
-    (expr.kind === "recordGet" || expr.kind === "recordKeyGet") &&
-    (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node))
-  ) {
-    // The read itself rules out a null or undefined receiver, which a
-    // JavaScript receiver such as `m.groups` still declares.
-    const receiver = lowerer.mapTypeOf(
-      lowerer.checker.getNonNullableType(lowerer.typeOf(node.expression)),
-    );
-    const shape = receiver?.kind === "record" ? lowerer.shapes.get(receiver.shapeId) : undefined;
-    const declared =
-      expr.kind === "recordGet"
-        ? shape?.fields.find((field) => field.name === expr.field)?.type
-        : shape?.indexValue;
-    if (
-      lowerer.armTag(expr.type.unionId, UNDEFINED_T) >= 0 &&
-      declared &&
-      !(declared.kind === "union" && lowerer.armTag(declared.unionId, UNDEFINED_T) >= 0)
-    )
-      return expr;
-    // The same for a field holding a Date's toJSON() result, whose null
-    // the declared string does not represent.
-    if (
-      expr.kind === "recordGet" &&
-      lowerer.isRuntimeOptionalField(expr.shapeId, expr.field) &&
-      lowerer.armTag(expr.type.unionId, NULL_T) >= 0 &&
-      declared &&
-      !(declared.kind === "union" && lowerer.armTag(declared.unionId, NULL_T) >= 0)
-    )
-      return expr;
-  }
-  if (ts.isIdentifier(node)) {
-    const symbol = lowerer.resolveValueSymbol(node);
-    if (symbol && lowerer.unstableSwitchBindings.has(symbol)) return expr;
-    // A binding initialized by a Date's toJSON() can hold null where the
-    // checker says string; consumers check it.
-    if (symbol && lowerer.dateJsonBindings.has(symbol)) return expr;
-  }
-  if (
-    ts.isPropertyAccessExpression(node) &&
-    getterResultHoldsUndeclaredUndefined(lowerer, node, expr)
-  )
-    return expr;
-  const narrowedTs = lowerer.typeOf(node);
-  const narrowed = lowerer.mapTypeOf(narrowedTs);
-  // `Array.isArray(u)` on a union with one readonly array/tuple arm: the
-  // lib predicate narrows to `any[]`, possibly intersected with another
-  // type. That mapping may be a checked value or a synthetic record, but
-  // the tag test proved the union's one array-valued arm, so bridge to it
-  // with the same trusted unionNarrow the mapped case below builds.
-  if (lowerer.checkerAnyArrayType(narrowedTs)) {
-    const def = lowerer.unions.get(expr.type.unionId);
-    const arrayTags = lowerer.arrayValueTags(expr.type.unionId);
-    if (arrayTags.length === 1) {
-      const arm = def!.arms[arrayTags[0]!]!;
-      const checked = checkedStaleArm(lowerer, node, expr, arrayTags[0]!, arm);
-      if (checked) return checked;
-      return {
-        kind: "unionNarrow",
-        unionId: expr.type.unionId,
-        tag: arrayTags[0]!,
-        value: expr,
-        type: arm,
-        loc: expr.loc,
-      };
-    }
-  }
-  // A checker type narrowed to a UNIT arm (the `=== undefined` branch)
-  // also stays union-typed: a unit arm has no payload to extract, and
-  // nothing useful reads such a value anyway. (Standalone undefined maps
-  // to void and standalone null to nothing, so the isUnitType guard is
-  // defensive.)
-  if (!narrowed || narrowed.kind === "union" || narrowed.kind === "void" || isUnitType(narrowed)) {
-    return expr;
-  }
-  const tag = lowerer.armTag(expr.type.unionId, narrowed);
-  if (tag < 0) {
-    // The checker may refine fields inside a discriminated record too.
-    // That creates a different mapped shape, but does not change the
-    // stored payload layout. A required literal discriminator proves
-    // which original arm to read; retain all of that arm's field types.
-    const def = lowerer.unions.get(expr.type.unionId);
-    if (narrowed.kind === "record" && def?.discriminant) {
-      const property = lowerer.checker.getPropertyOfType(narrowedTs, def.discriminant.field);
-      if (
-        property &&
-        !(
-          property.flags &
-          (ts.SymbolFlags.Optional | ts.SymbolFlags.GetAccessor | ts.SymbolFlags.SetAccessor)
-        )
-      ) {
-        const values = literalValues(lowerer.checker.getTypeOfSymbol(property));
-        const arm = values && literalUnionArm(def, values, (id) => lowerer.shapes.get(id));
-        if (arm) {
-          const checked = checkedStaleArm(
-            lowerer,
-            node,
-            expr,
-            lowerer.armTag(expr.type.unionId, arm),
-            arm,
-          );
-          if (checked) return checked;
-          return {
-            kind: "unionNarrow",
-            unionId: expr.type.unionId,
-            tag: lowerer.armTag(expr.type.unionId, arm),
-            value: expr,
-            type: arm,
-            loc: expr.loc,
-          };
-        }
-      }
-    }
-    // A base-class arm can narrow to a subclass after instanceof. The
-    // payload retains its base-class tag even when the union also has
-    // records or other classes. Require one unambiguous containing arm.
-    const arms = lowerer.unions.get(expr.type.unionId)?.arms ?? [];
-    const valueTag =
-      narrowed.kind === "object"
-        ? arms.findIndex(
-            (arm) =>
-              arm.kind === "object" && lowerer.isSubclassOf(narrowed.className, arm.className),
-          )
-        : -1;
-    const valueType = arms[valueTag];
-    if (
-      narrowed.kind === "object" &&
-      valueType?.kind === "object" &&
-      arms.every(
-        (arm, i) =>
-          i === valueTag ||
-          arm.kind !== "object" ||
-          !lowerer.isSubclassOf(narrowed.className, arm.className),
-      ) &&
-      lowerer.isSubclassOf(narrowed.className, valueType.className)
-    ) {
-      const checked = checkedStaleArm(lowerer, node, expr, valueTag, valueType, narrowed);
-      if (checked) {
-        return checkedClassAssertion(lowerer, checked, narrowed, expr.loc) ?? checked;
-      }
-      return {
-        kind: "downcast",
-        value: {
-          kind: "unionNarrow",
-          unionId: expr.type.unionId,
-          tag: valueTag,
-          value: expr,
-          type: valueType,
-          loc: expr.loc,
-        },
-        type: narrowed,
-        loc: expr.loc,
-      };
-    }
-    return expr;
-  }
-  const checked = checkedStaleArm(lowerer, node, expr, tag, narrowed);
-  if (checked) return checked;
-  return {
-    kind: "unionNarrow",
-    unionId: expr.type.unionId,
-    tag,
-    value: expr,
-    type: narrowed,
-    loc: expr.loc,
-  };
-}
-
-/** A getter read whose runtime result can be undefined (an unchecked
- * element read in its body, or in another member of its override family)
- * although its declared type cannot. The checker's type for the read is
- * then no narrowing proof, so the read keeps the getter's result. */
-function getterResultHoldsUndeclaredUndefined(
-  lowerer: Lowerer,
-  node: ts.PropertyAccessExpression,
-  expr: IrExpr,
-): boolean {
-  if (expr.type.kind !== "union" || lowerer.armTag(expr.type.unionId, UNDEFINED_T) < 0)
-    return false;
-  const getter =
-    (expr.kind === "virtualCall" && expr.method.startsWith("get:")) ||
-    (expr.kind === "call" && expr.callee.includes(".get:"));
-  if (!getter) return false;
-  const symbol = lowerer.checker.getSymbolAtLocation(node.name);
-  if (!symbol || (symbol.flags & ts.SymbolFlags.GetAccessor) === 0) return false;
-  const declared = lowerer.checker.getTypeOfSymbol(symbol);
-  const holdsUndefined = (type: ts.Type): boolean =>
-    (type.flags &
-      (ts.TypeFlags.Undefined | ts.TypeFlags.Void | ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !==
-    0;
-  return !(
-    holdsUndefined(declared) ||
-    (declared.isUnionType() && ts.constituentTypes(declared).some(holdsUndefined))
-  );
-}
-
-/** The checked form of maybeNarrow's arm extraction for a narrowing the
- * checker may hold past code that replaced the value (a call clearing the
- * property; see NarrowingStability). Every other arm throws the TypeError
- * Node raises for the operation consuming the read (`Cannot read
- * properties of undefined (reading 'x')`, `o.f is not a function`), or the
- * stranded-value TypeError where Node would carry the value on. Null when
- * the narrowing is provably current. `narrowed` is the checker's type when
- * it refines the arm (a subclass view). */
-function checkedStaleArm(
-  lowerer: Lowerer,
-  node: ts.Node,
-  value: IrExpr,
-  tag: number,
-  arm: IrType,
-  narrowed: IrType = arm,
-): IrExpr | null {
-  if (value.type.kind !== "union" || tag < 0) return null;
-  if (!lowerer.narrowing.untrusted(node, narrowed)) return null;
-  const inPlace = checkedArmExtraction(lowerer, value, tag, arm, (found) =>
-    staleReadMessage(node, found),
-  );
-  if (inPlace) return inPlace;
-  const helper = lowerer.narrowedArmHelper(value.type.unionId, arm, value.loc);
-  return helper ? lowerer.checkedNarrowCall(helper, value, arm, value.loc) : null;
-}
-
-/** V8's spelling of a callee in "is not a function": a string-literal
- * element key reads as a property name (`o["a"]` is `o.a`), other keys
- * keep their brackets. */
-export function v8CalleeText(node: ts.Node): string {
-  if (ts.isElementAccessExpression(node)) {
-    const key = node.argumentExpression;
-    const object = v8CalleeText(node.expression);
-    return ts.isStringLiteral(key) || ts.isNoSubstitutionTemplateLiteral(key)
-      ? `${object}.${key.text}`
-      : `${object}[${key.getText()}]`;
-  }
-  if (ts.isPropertyAccessExpression(node) && !node.questionDotToken)
-    return `${v8CalleeText(node.expression)}.${node.name.text}`;
-  return node.getText();
-}
-
-/** Node's TypeError for the operation consuming `node` when it holds a
- * value of type `found`, or null where Node would not throw. */
-function staleReadMessage(node: ts.Node, found: IrType): string | null {
-  let child: ts.Node = node;
-  let parent = node.parent;
-  while (ts.isParenthesizedExpression(parent)) {
-    child = parent;
-    parent = parent.parent;
-  }
-  if (ts.isCallExpression(parent) && parent.expression === child && !parent.questionDotToken) {
-    return found.kind === "func" ? null : `${v8CalleeText(node)} is not a function`;
-  }
-  const unit = found.kind === "undefinedT" ? "undefined" : found.kind === "nullT" ? "null" : null;
-  if (unit === null) return null;
-  if (
-    !(ts.isPropertyAccessExpression(parent) || ts.isElementAccessExpression(parent)) ||
-    parent.expression !== child ||
-    parent.questionDotToken
-  )
-    return null;
-  let key: string | null = null;
-  if (ts.isPropertyAccessExpression(parent)) key = parent.name.text;
-  else if (ts.isStringLiteral(parent.argumentExpression)) key = parent.argumentExpression.text;
-  else if (ts.isNumericLiteral(parent.argumentExpression))
-    key = String(Number(parent.argumentExpression.text));
-  if (key === null) return null;
-  const store = parent.parent;
-  return ts.isBinaryExpression(store) &&
-    store.left === parent &&
-    store.operatorToken.kind === ts.SyntaxKind.EqualsToken
-    ? `Cannot set properties of ${unit} (setting '${key}')`
-    : `Cannot read properties of ${unit} (reading '${key}')`;
-}
-
-/** A runtime-optional slot can be assigned while a truthy guard is in
- * force. TypeScript then types a direct member receiver as the plain arm,
- * even though an OOB-safe assignment may have restored undefined. Check
- * that hidden arm and throw the member-read TypeError Node would produce. */
-function runtimeOptionalReceiverRead(
-  lowerer: Lowerer,
-  expr: ts.Identifier,
-  local: IrLocal,
-  property: string | null,
-  loc: SrcLoc,
-): IrExpr {
-  if (local.type.kind !== "union") {
-    lowerer.runtimeOptionalLocals.delete(local);
-    lowerer.runtimeOptionalStorageLocals.delete(local);
-    return varRef(local.id, local.type, loc);
-  }
-  // A non-null/type assertion around the receiver carries the useful
-  // checker narrowing on the wrapper rather than on the identifier token
-  // itself (`gg!.day`). Follow only erased wrappers; the member/call node
-  // still receives the checked extraction built below.
-  let narrowedNode: ts.Expression = expr;
-  while (
-    (ts.isParenthesizedExpression(narrowedNode.parent) ||
-      ts.isAssertionExpression(narrowedNode.parent) ||
-      ts.isSatisfiesExpression(narrowedNode.parent) ||
-      ts.isNonNullExpression(narrowedNode.parent)) &&
-    narrowedNode.parent.expression === narrowedNode
-  ) {
-    narrowedNode = narrowedNode.parent;
-  }
-  const narrowed = lowerer.mapTypeOf(lowerer.typeOf(narrowedNode));
-  if (!narrowed || isUnitType(narrowed)) {
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      "a runtime-optional capture whose narrowed value type is not representable",
-    );
-  }
-  if (narrowed.kind === "union") {
-    const classView = narrowStoredClassValue(lowerer, varRef(local.id, local.type, loc), narrowed);
-    if (classView) return classView;
-    // The checker may keep the receiver at the storage union unchanged
-    // (`string | undefined` on a JS `.match()` call). There is no
-    // sub-union to re-tag: preserve the value for the downstream
-    // nullable-receiver lowering, which performs the member-specific
-    // checked extraction. Refusing here deferred the whole statement to
-    // a runtime fence before that lowering could run.
-    if (typeEquals(local.type, narrowed)) {
-      return varRef(local.id, local.type, loc);
-    }
-    // A captured array element can itself be a union of records (for
-    // example Circle | Square). The optional storage union has one extra
-    // undefined arm; re-tag it to the checker-narrowed value union with a
-    // checked trap for that arm, then let union property lowering inspect
-    // the surviving record arms.
-    const helper = lowerer.narrowedRetagHelper(
-      narrowedNode,
-      local.type.unionId,
-      narrowed.unionId,
-      loc,
-    );
-    if (!helper) {
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        "a runtime-optional capture whose narrowed union is not representable",
-      );
-    }
-    return {
-      kind: "call",
-      callee: helper,
-      args: [varRef(local.id, local.type, loc)],
-      type: narrowed,
-      loc,
-    };
-  }
-  if (narrowed.kind === "object") {
-    const view = checkedClassAssertion(lowerer, varRef(local.id, local.type, loc), narrowed, loc);
-    // Preserve the member-specific missing-value error on the two-arm
-    // path below; mixed storage also needs to validate its concrete class.
-    if (view && (lowerer.unions.get(local.type.unionId)?.arms.length ?? 0) > 2) return view;
-  }
-  const undefTag = lowerer.armTag(local.type.unionId, UNDEFINED_T);
-  const def = lowerer.unions.get(local.type.unionId);
-  if (!def || undefTag < 0)
-    throw new InternalCompilerError("runtime-optional local is missing its undefined arm");
-  if (def.arms.length !== 2) {
-    // The checker may narrow a runtime-optional capture to one arm of a
-    // value union (`Circle | Square | undefined` -> `Circle`). The
-    // two-arm fast path below cannot extract that arm safely: a later
-    // array mutation can leave any of the stored tags in the slot. Use
-    // the checked helper so every other arm, including undefined, remains
-    // a catchable TypeError rather than an unchecked payload read.
-    const helper = lowerer.narrowedArmHelper(local.type.unionId, narrowed, loc);
-    if (!helper) {
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        "a direct read from a runtime-optional capture with multiple value arms",
-      );
-    }
-    return lowerer.checkedNarrowCall(helper, varRef(local.id, local.type, loc), narrowed, loc);
-  }
-  // A predicate can strengthen a record's fields or narrow a base class
-  // to a subclass without changing the slot's stored value arm. Extract
-  // that actual arm first: record reads need its original field layout,
-  // and class reads apply the ordinary downcast bridge afterward.
-  const valueTag = undefTag === 0 ? 1 : 0;
-  const valueType = def.arms[valueTag];
-  if (!valueType || isUnitType(valueType)) {
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      "a runtime-optional receiver without a representable value arm",
-    );
-  }
-  const message =
-    property === null
-      ? `${expr.text} is not a function`
-      : `Cannot read properties of undefined (reading '${property}')`;
-  return lowerer.maybeNarrow(
-    {
-      kind: "ternary",
-      cond: {
-        kind: "unionIsTag",
-        unionId: local.type.unionId,
-        tag: undefTag,
-        negated: false,
-        value: varRef(local.id, local.type, loc),
-        type: BOOL,
-        loc,
-      },
-      then: nodeThrowExpr(1, "", message, valueType, loc),
-      else_: {
-        kind: "unionNarrow",
-        unionId: local.type.unionId,
-        tag: valueTag,
-        value: varRef(local.id, local.type, loc),
-        type: valueType,
-        loc,
-      },
-      type: valueType,
-      loc,
-    },
-    narrowedNode,
-  );
-}
-
 type RuntimeOptionalUse =
   | {
       kind: "property";
@@ -3966,7 +741,7 @@ type RuntimeOptionalUse =
       comma: boolean;
     };
 
-function runtimeOptionalUseOf(expr: ts.Expression): RuntimeOptionalUse | null {
+export function runtimeOptionalUseOf(expr: ts.Expression): RuntimeOptionalUse | null {
   let receiver = expr;
   let complex = false;
   let comma = false;
@@ -4039,36 +814,7 @@ function runtimeOptionalUseOf(expr: ts.Expression): RuntimeOptionalUse | null {
   return null;
 }
 
-/** Object.keys/Object.entries require an object receiver, but their first
- * argument is not syntactically a member receiver. Recognize that one
- * standard-library position so a runtime-optional loop element can be
- * checked against the checker-narrowed record arm before builtin lowering. */
-function runtimeOptionalObjectWalkerArg(lowerer: Lowerer, expr: ts.Expression): boolean {
-  let arg = expr;
-  while (
-    (ts.isParenthesizedExpression(arg.parent) ||
-      ts.isAssertionExpression(arg.parent) ||
-      ts.isSatisfiesExpression(arg.parent) ||
-      ts.isNonNullExpression(arg.parent)) &&
-    arg.parent.expression === arg
-  ) {
-    arg = arg.parent;
-  }
-  const call = arg.parent;
-  if (
-    !ts.isCallExpression(call) ||
-    call.arguments.nodes[0] !== arg ||
-    !ts.isPropertyAccessExpression(call.expression)
-  )
-    return false;
-  const access = call.expression;
-  return (
-    (access.name.text === "keys" || access.name.text === "entries") &&
-    lowerer.isStdlibMember(access)
-  );
-}
-
-function runtimeOptionalElementKey(expr: ts.Expression): string | null {
+export function runtimeOptionalElementKey(expr: ts.Expression): string | null {
   if (ts.isStringLiteral(expr) || ts.isNumericLiteral(expr)) return expr.text;
   if (ts.isNoSubstitutionTemplateLiteral(expr)) return expr.text;
   return null;
@@ -4093,7 +839,10 @@ function isEqualityOperand(node: ts.Expression): boolean {
  * argument, an element assignment — arrays record the undefined state),
  * an equality operand, or a slot whose contextual type admits undefined.
  * TypeScript's `!` has no runtime effect, so such reads stay optional. */
-function assertedElementKeepsUndefined(lowerer: Lowerer, node: ts.NonNullExpression): boolean {
+export function assertedElementKeepsUndefined(
+  lowerer: Lowerer,
+  node: ts.NonNullExpression,
+): boolean {
   let outer: ts.Expression = node;
   while (ts.isParenthesizedExpression(outer.parent)) outer = outer.parent;
   const parent = outer.parent;
@@ -4135,7 +884,7 @@ function assertedElementKeepsUndefined(lowerer: Lowerer, node: ts.NonNullExpress
   );
 }
 
-function runtimeOptionalAssertionErases(
+export function runtimeOptionalAssertionErases(
   lowerer: Lowerer,
   expr: ts.Expression,
   inner: IrExpr,
@@ -4154,223 +903,6 @@ function runtimeOptionalAssertionErases(
   );
 }
 
-/** `v === undefined` / `v !== null` — the narrowing tests for unit-armed
- * unions. A union operand compared with a unit literal lowers to a
- * runtime TAG test (unionIsTag); afterwards tsc's control-flow narrowing
- * types the branches and reads bridge through maybeNarrow as usual. When
- * the checker already narrowed the non-literal side PAST the union
- * (`w = 5; if (w !== null)`), the comparison is statically decided and
- * folds to a bool literal — that drops only a side-effect-free read
- * (flow narrowing applies to references, never to calls), and soundness
- * rests on the same narrowing proof unionNarrow relies on. Null when
- * neither side is a unit literal (not a unit comparison). */
-export function lowerUnitComparison(
-  lowerer: Lowerer,
-  left: IrExpr,
-  right: IrExpr,
-  negated: boolean,
-  loc: SrcLoc,
-): IrExpr | null {
-  const unit = left.kind === "unitLit" ? left : right.kind === "unitLit" ? right : null;
-  if (!unit) return null;
-  const other = unit === left ? right : left;
-  if (other.kind === "unitLit") {
-    // Two unit literals (`undefined === undefined`): statically decided.
-    return { kind: "boolLit", value: (other.unit === unit.unit) !== negated, type: BOOL, loc };
-  }
-  const slot = lowerer.deferredFieldSlot(other);
-  if (slot) return lowerUnitComparison(lowerer, slot, unit, negated, loc);
-  // A binding the checker narrowed past the unit can still hold it at
-  // runtime when its value came from an unassigned deferred-init field;
-  // the stored tag answers either way.
-  if (
-    other.kind === "unionNarrow" &&
-    other.value.kind === "varRef" &&
-    other.value.type.kind === "union" &&
-    lowerer.armTag(other.value.type.unionId, unit.type) >= 0
-  )
-    return lowerUnitComparison(lowerer, other.value, unit, negated, loc);
-  if (other.type.kind === "union") {
-    const tag = lowerer.armTag(other.type.unionId, unit.type);
-    if (tag < 0) {
-      // A union WITHOUT that unit arm: legal TS (`miss === null` on a
-      // `number | undefined` — null/undefined guard comparisons are
-      // permitted against nullable-adjacent types), and === never
-      // coerces, so the answer is the constant `negated`. The literal
-      // must NOT flow into the union representation (the unionEq
-      // fallback would coerce it through the stranded-arm trap and
-      // throw where Node answers false). JS still evaluates the
-      // operand, so a non-droppable one (`xs.find(f) === null` — the
-      // callback's effects are observable) rides one throwaway tag
-      // test; droppable reads fold to the bare literal.
-      const answer: IrExpr = { kind: "boolLit", value: negated, type: BOOL, loc };
-      if (isSafeToDiscard(other)) return answer;
-      const evalOnce: IrExpr = {
-        kind: "unionIsTag",
-        unionId: other.type.unionId,
-        tag: 0,
-        negated: false,
-        value: other,
-        type: BOOL,
-        loc,
-      };
-      return {
-        kind: "logical",
-        op: negated ? "||" : "&&",
-        left: evalOnce,
-        right: answer,
-        type: BOOL,
-        loc,
-      };
-    }
-    return {
-      kind: "unionIsTag",
-      unionId: other.type.unionId,
-      tag,
-      negated,
-      value: other,
-      type: BOOL,
-      loc,
-    };
-  }
-  // A process.env read tsc narrowed past its union (an earlier write to
-  // the same key): the environment is VOLATILE — `delete process.env.K`
-  // undoes the write the narrowing rode on — so folding would bake a
-  // stale answer. Compare the fresh read's union tag instead.
-  const envRead = volatileEnvRead(other);
-  if (envRead && envRead.type.kind === "union") {
-    const tag = lowerer.armTag(envRead.type.unionId, unit.type);
-    if (tag >= 0) {
-      return {
-        kind: "unionIsTag",
-        unionId: envRead.type.unionId,
-        tag,
-        negated,
-        value: envRead,
-        type: BOOL,
-        loc,
-      };
-    }
-  }
-  // A VOID-typed operand (`foo() === undefined` where foo's declared
-  // return is undefined/void — the mapping folds both to void): JS
-  // yields undefined from such a call, so the compare is TRUE-when-equal
-  // — the opposite of the never-holds-units fold below — and the IR has
-  // no value (nor a sequence form to keep the call's effects). Fall
-  // through to the caller's comparison fence instead of folding a lie.
-  if (other.type.kind === "void") return null;
-  // Non-union operand: it can never hold undefined/null at runtime (the
-  // checker narrowed it to a concrete arm), so `=== unit` is false and
-  // `!== unit` is true.
-  return { kind: "boolLit", value: negated, type: BOOL, loc };
-}
-
-/** The union-typed process.envGet read inside a checker-narrowed operand,
- * or null — the volatility escape above (and lowerLooseNullCompare's). */
-function volatileEnvRead(e: IrExpr): IrExpr | null {
-  if (e.kind === "libCall" && e.fn === "process.envGet") return e;
-  if (e.kind === "unionNarrow" && e.value.kind === "libCall" && e.value.fn === "process.envGet") {
-    return e.value;
-  }
-  return null;
-}
-
-function lowerLooseNullCompare(
-  lowerer: Lowerer,
-  expr: ts.BinaryExpression,
-  loc: SrcLoc,
-): IrExpr | null {
-  const negated = expr.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsToken;
-  const unwrap = (e: ts.Expression): ts.Expression =>
-    ts.isParenthesizedExpression(e) ? unwrap(e.expression) : e;
-  const left = unwrap(expr.left);
-  const right = unwrap(expr.right);
-  const leftIsNull = left.kind === ts.SyntaxKind.NullKeyword;
-  if (!leftIsNull && right.kind !== ts.SyntaxKind.NullKeyword) return null;
-  const otherNode = leftIsNull ? right : left;
-  const other = lowerPresenceOperand(lowerer, otherNode);
-  if (isUnitType(other.type)) {
-    // `null == null`, `undefined == null`: units are mutually loose-equal.
-    return { kind: "boolLit", value: !negated, type: BOOL, loc };
-  }
-  if (other.type.kind === "dyn") {
-    // `v != null` on unknown: one dyn kind test covers both units.
-    return {
-      kind: "dynTest",
-      test: "nullish",
-      ...(negated ? { negated: true as const } : {}),
-      value: other,
-      type: BOOL,
-      loc,
-    };
-  }
-  if (other.type.kind === "union") {
-    const ut = other.type;
-    const def = lowerer.unions.get(ut.unionId);
-    if (!def) lowerer.badType(otherNode, lowerer.typeOf(otherNode));
-    const tags = def.arms.flatMap((a, i) => (isUnitType(a) ? [i] : []));
-    if (tags.length === 0) {
-      // No unit arms: never null-ish (defensive — the fold below).
-      return { kind: "boolLit", value: negated, type: BOOL, loc };
-    }
-    const isTag = (tag: number): IrExpr => ({
-      kind: "unionIsTag",
-      unionId: ut.unionId,
-      tag,
-      negated,
-      value: other,
-      type: BOOL,
-      loc,
-    });
-    if (tags.length === 1) return isTag(tags[0]!);
-    // Both null AND undefined arms: tag-in-set as a short-circuit pair
-    // (De Morgan for `!=`). The operand IrExpr rides both tests, so the
-    // backend emits it per test — restricted to re-emittable pure reads;
-    // anything effectful gets its own actionable fence (the generic
-    // SC1040 hint would wrongly suggest `== null` as the fix).
-    if (!isSafeToRepeat(other)) {
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        `'== null' / '!= null' on a '${lowerer.fmt(ut)}' value that isn't a plain read ` +
-          `(both unit arms need the operand twice — bind it to a const first)`,
-      );
-    }
-    return {
-      kind: "logical",
-      op: negated ? "&&" : "||",
-      left: isTag(tags[0]!),
-      right: isTag(tags[1]!),
-      type: BOOL,
-      loc,
-    };
-  }
-  if (other.type.kind === "void") {
-    return null; // no static tag to test — keep the fence
-  }
-  // The env-volatility escape (see lowerUnitComparison): a narrowed
-  // process.env read compares its FRESH union tag instead of folding.
-  const envRead = volatileEnvRead(other);
-  if (envRead && envRead.type.kind === "union") {
-    const def = lowerer.unions.get(envRead.type.unionId);
-    const tag = def ? def.arms.findIndex((a) => isUnitType(a)) : -1;
-    if (tag >= 0) {
-      return {
-        kind: "unionIsTag",
-        unionId: envRead.type.unionId,
-        tag,
-        negated,
-        value: envRead,
-        type: BOOL,
-        loc,
-      };
-    }
-  }
-  // A non-nullable operand (tsc allows the comparison as a guard):
-  // `== null` is statically false, `!= null` statically true.
-  return { kind: "boolLit", value: negated, type: BOOL, loc };
-}
-
 /** `a ?? b` — JS-exact nullish coalescing: ONLY null/undefined take the
  * default (0, "", and false do not), and the right side evaluates lazily.
  * On a unit-armed union left this is the `nullish` node (a runtime tag
@@ -4433,274 +965,17 @@ function assertedPresenceOperand(lowerer: Lowerer, node: ts.Expression): IrExpr
   return checkedClassUnionAssertion(lowerer, probe, target, locOf(outer)) ?? probe;
 }
 
-/** Read-modify-write updates read the member first: an unassigned
- * deferred-init receiver throws Node's member-read TypeError. */
-function checkDeferredMemberReceiver(
-  lowerer: Lowerer,
-  target: FieldTarget,
-  access: ts.Expression,
-): void {
-  if (
-    target.container !== "class" ||
-    !ts.isPropertyAccessExpression(access) ||
-    target.obj.type.kind !== "object" ||
-    lowerer.deferredFieldSlot(target.obj) === null
-  )
-    return;
-  target.obj =
-    lowerer.runtimeOptionalPropertyReceiver(
-      access.expression,
-      target.obj,
-      target.obj.type,
-      target.field,
-    ) ?? target.obj;
-}
-
-/** Whether evaluating `expr` cannot store anything or run other code:
- * reads, arithmetic, tests and checked extractions (which at most throw). */
-function writeFree(expr: IrExpr): boolean {
-  switch (expr.kind) {
-    case "numLit":
-    case "strLit":
-    case "boolLit":
-    case "unitLit":
-    case "varRef":
-      return true;
-    case "fieldGet":
-    case "recordGet":
-      return writeFree(expr.obj);
-    case "bin":
-    case "logical":
-      return writeFree(expr.left) && writeFree(expr.right);
-    case "unary":
-    case "toBool":
-      return writeFree(expr.operand);
-    case "ternary":
-      return writeFree(expr.cond) && writeFree(expr.then) && writeFree(expr.else_);
-    case "unionIsTag":
-    case "unionNarrow":
-    case "unionWrap":
-      return writeFree(expr.value);
-    case "libCall":
-      return expr.fn === "error.nodeThrow";
-    default:
-      return false;
-  }
-}
-
-/** The TypeError of a deferred-init field read that finds the field
- * unassigned where its declared type cannot hold undefined. */
-export const DEFERRED_READ_MESSAGE =
-  "undefined is not representable in the target union (a value narrowed or asserted past it still held it)";
-
 /** The undefined-armed slot behind a checked deferred-init field read, or
  * the value itself (Lowerer.deferredFieldSlot). */
-function deferredSlotOr(lowerer: Lowerer, value: IrExpr): IrExpr {
+export function deferredSlotOr(lowerer: Lowerer, value: IrExpr): IrExpr {
   return lowerer.deferredFieldSlot(value) ?? value;
 }
 
-/** A plain value read that may be runtime-optional: an unchecked element
- * read, or a binding, member or call that carries one. Lowering these
- * without a destination type is the same as lowering them into one. */
-function isPlainValueRead(node: ts.Expression): boolean {
-  while (ts.isParenthesizedExpression(node)) node = node.expression;
-  return (
-    ts.isElementAccessExpression(node) ||
-    ts.isIdentifier(node) ||
-    ts.isPropertyAccessExpression(node) ||
-    ts.isCallExpression(node)
-  );
-}
-
-/** A member access or call receiver needs the present value itself (JS
- * throws a TypeError reading a member of undefined). */
-function isMemberReceiver(node: ts.Expression): boolean {
-  let child: ts.Node = node;
-  let parent = node.parent;
-  while (ts.isParenthesizedExpression(parent)) {
-    child = parent;
-    parent = parent.parent;
-  }
-  return (
-    ((ts.isPropertyAccessExpression(parent) ||
-      ts.isElementAccessExpression(parent) ||
-      ts.isCallExpression(parent)) &&
-      parent.expression === child) ||
-    (ts.isTaggedTemplateExpression(parent) && parent.tag === child)
-  );
-}
-
-function lowerNullishPair(
-  lowerer: Lowerer,
-  expr: ts.BinaryExpression,
-  loc: SrcLoc,
-  left: IrExpr,
-): IrExpr {
-  if (left.type.kind === "dyn") {
-    // `a ?? b` on a CHECKED-DYNAMIC left: the deciding test is the
-    // runtime kind (scr_dyn_is_nullish — UNDEF/NULL take the default).
-    // Both sides live in the checked-dynamic tree — the right converts through
-    // the usual boundary and evaluates lazily in its branch; a default
-    // with no dyn representation keeps the fence.
-    const right = lowerer.coerceToExpected(lowerer.lowerExpr(expr.right), DYN);
-    if (right.type.kind !== "dyn") {
-      lowerer.unsupported(
-        "SC1100",
-        expr,
-        "nullish coalescing on 'unknown' values against defaults with no dynamic representation",
-      );
-    }
-    return { kind: "nullish", left, right, type: DYN, loc };
-  }
-
-  if (left.type.kind !== "union") return left;
-  const def = lowerer.unions.get(left.type.unionId);
-  if (!def) lowerer.badType(expr.left, lowerer.typeOf(expr.left));
-  if (!def.arms.some(isUnitType)) return left;
-  const rest = def.arms.filter((a) => !isUnitType(a));
-  // `optionalMap ?? new Map()` carries its element contract on the left;
-  // the empty fallback may use it without constructing a Map<any, any>
-  // arm that has no first-class union representation.
-  const fresh = rest.length === 1 ? lowerer.emptyCollectionFor(expr.right, rest[0]!) : null;
-  if (fresh) return { kind: "nullish", left, right: fresh, type: fresh.type, loc };
-  let type = lowerer.irTypeOf(expr);
-  // A runtime-optional read can reach the default even when declarations
-  // call the left side present. Preserve a differently typed primitive
-  // fallback rather than checking it against that incomplete result type.
-  const rightType = lowerer.mapTypeOf(lowerer.typeOf(expr.right));
-  const primitive = (t: IrType): boolean =>
-    t.kind === "f64" || t.kind === "string" || t.kind === "bool";
-  if (
-    rightType &&
-    primitive(type) &&
-    primitive(rightType) &&
-    !typeEquals(type, rightType) &&
-    rest.every(primitive)
-  ) {
-    const arms = [...rest];
-    if (!arms.some((arm) => typeEquals(arm, rightType))) arms.push(rightType);
-    arms.sort((a, b) => (typeKey(a) < typeKey(b) ? -1 : 1));
-    type = { kind: "union", unionId: lowerer.unions.intern(arms) };
-    lowerer.runtimeOptionalArithmeticTypes.set(expr, type);
-  }
-  if (type.kind === "dyn" && lowerer.dynConvertible(left.type)) {
-    return {
-      kind: "nullish",
-      left: lowerer.coerceToExpected(left, DYN),
-      right: lowerer.lowerExprExpecting(expr.right, DYN),
-      type: DYN,
-      loc,
-    };
-  }
-  // A runtime-optional default (`name ?? names[0]`): the checker types an
-  // unchecked element read as the bare element type, but an out-of-range
-  // read is undefined at runtime. When the default shares the left's
-  // optional union, that union is the result, so the undefined state
-  // reaches the consumer (an optional return or parameter takes it as its
-  // undefined arm; a plain slot still extracts the element with its
-  // checked narrow).
-  if (
-    rest.length === 1 &&
-    typeEquals(type, rest[0]!) &&
-    isPlainValueRead(expr.right) &&
-    !isMemberReceiver(expr)
-  ) {
-    const raw = lowerer.lowerExpr(expr.right);
-    if (typeEquals(raw.type, left.type))
-      return { kind: "nullish", left, right: raw, type: left.type, loc };
-    // `names[0] ?? undefined`: an explicit unit default stays the left's arm.
-    if (isUnitType(raw.type) && lowerer.armTag(left.type.unionId, raw.type) >= 0) {
-      const right = lowerer.coerceInto(expr.right, raw, left.type);
-      return { kind: "nullish", left, right, type: left.type, loc };
-    }
-    return { kind: "nullish", left, right: lowerer.coerceInto(expr.right, raw, type), type, loc };
-  }
-  if (typeEquals(type, left.type) || (rest.length === 1 && typeEquals(type, rest[0]!))) {
-    const right = lowerer.lowerExprExpecting(expr.right, type);
-    return { kind: "nullish", left, right, type, loc };
-  }
-  if (type.kind !== "union" && rest.length > 1 && rest.some((arm) => typeEquals(arm, type))) {
-    const helper = lowerer.narrowedArmHelper(left.type.unionId, type, loc);
-    if (helper !== null) {
-      return nullishBranches(
-        lowerer,
-        left,
-        left.type,
-        def.arms,
-        type,
-        loc,
-        () => lowerer.lowerExprExpecting(expr.right, type),
-        (stable) => ({ kind: "call", callee: helper, args: [stable], type, loc }),
-      );
-    }
-  }
-  // A subclass value defaulted to a base-class value (`circle ?? shape`):
-  // the present arm upcasts after the original nullish test, and the
-  // default lowers lazily into the base-class result.
-  const present = rest.length === 1 ? rest[0]! : null;
-  if (
-    present?.kind === "object" &&
-    type.kind === "object" &&
-    present.className !== type.className &&
-    lowerer.isSubclassOf(present.className, type.className)
-  ) {
-    const helper = lowerer.narrowedArmHelper(left.type.unionId, present, loc);
-    if (helper !== null) {
-      return nullishBranches(
-        lowerer,
-        left,
-        left.type,
-        def.arms,
-        type,
-        loc,
-        () => lowerer.lowerExprExpecting(expr.right, type),
-        (stable) => ({
-          kind: "upcast",
-          value: { kind: "call", callee: helper, args: [stable], type: present, loc },
-          type,
-          loc,
-        }),
-      );
-    }
-  }
-  // A default may change the union or widen its records. Test the
-  // original tag before coercing: converting the whole left first can
-  // lose nullish arms, and evaluating the default eagerly loses laziness.
-  if (type.kind === "union") {
-    const retag =
-      lowerer.unionRetagHelper(left.type.unionId, type.unionId, loc) ??
-      lowerer.narrowedRetagHelper(expr.left, left.type.unionId, type.unionId, loc);
-    if (retag !== null) {
-      // Narrowing may exclude a record/class arm while storage retains
-      // it. The checked retag traps that impossible arm, but only AFTER
-      // the original nullish test: null/undefined must reach the lazy
-      // default even when neither is representable in the result.
-      return nullishBranches(
-        lowerer,
-        left,
-        left.type,
-        def.arms,
-        type,
-        loc,
-        () => lowerer.lowerExprExpecting(expr.right, type),
-        (stable) => ({ kind: "call", callee: retag, args: [stable], type, loc }),
-      );
-    }
-  }
-  lowerer.unsupported(
-    "SC1090",
-    expr,
-    rest.length !== 1
-      ? `'??' on '${lowerer.fmt(left.type)}' (the non-nullish result is a sub-union; check a discriminant field first)`
-      : `'??' where the default changes the result type (left is '${lowerer.fmt(left.type)}' but the whole expression is '${lowerer.fmt(type)}' — give both sides one type)`,
-  );
-}
-
 /** Test the original storage before projecting its present value. Both
  * branches are lazy, and an effectful receiver is evaluated exactly once.
  * Keeping the original tags matters when the checker has removed an arm
  * or the default changes the union's layout. */
-function nullishBranches(
+export function nullishBranches(
   lowerer: Lowerer,
   left: IrExpr,
   leftType: IrType & { kind: "union" },
@@ -4847,7 +1122,7 @@ function maybePromiseThenPresence(
   };
 }
 
-function lowerPromiseThenPresence(
+export function lowerPromiseThenPresence(
   lowerer: Lowerer,
   access: ts.PropertyAccessExpression,
   result: IrExpr,
@@ -4950,7 +1225,7 @@ function lowerPromiseThenPresence(
   };
 }
 
-function runtimeOptionalLocalOf(lowerer: Lowerer, node: ts.Expression): IrLocal | null {
+export function runtimeOptionalLocalOf(lowerer: Lowerer, node: ts.Expression): IrLocal | null {
   let expr = node;
   while (ts.isParenthesizedExpression(expr)) expr = expr.expression;
   if (!ts.isIdentifier(expr)) return null;
@@ -4960,133 +1235,6 @@ function runtimeOptionalLocalOf(lowerer: Lowerer, node: ts.Expression): IrLocal
     : null;
 }
 
-export function runtimeOptionalTrueIds(lowerer: Lowerer, node: ts.Expression): IrLocal[] {
-  return runtimeOptionalGuardIds(lowerer, node, true);
-}
-
-/** Presence proved by one outcome of a boolean guard. Negation flips
- * the outcome; all operands of a true AND or false OR have that outcome.
- * Assignments invalidate a syntactic proof even when checker types hide
- * the undefined produced by an out-of-bounds read. */
-export function runtimeOptionalGuardIds(
-  lowerer: Lowerer,
-  node: ts.Expression,
-  truthy: boolean | null,
-): IrLocal[] {
-  const candidates: IrLocal[] = [];
-  const collect = (expr: ts.Expression, outcome: boolean | null): void => {
-    if (ts.isParenthesizedExpression(expr)) return collect(expr.expression, outcome);
-    if (ts.isPrefixUnaryExpression(expr) && expr.operator === ts.SyntaxKind.ExclamationToken) {
-      return collect(expr.operand, outcome === null ? null : !outcome);
-    }
-    if (
-      ts.isBinaryExpression(expr) &&
-      ((outcome === true && expr.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken) ||
-        (outcome === false && expr.operatorToken.kind === ts.SyntaxKind.BarBarToken))
-    ) {
-      collect(expr.left, outcome);
-      collect(expr.right, outcome);
-    } else if (ts.isPropertyAccessExpression(expr) && !expr.questionDotToken) {
-      // A completed ordinary member read checked its receiver even if
-      // the property's value was falsy. Optional chains make no such
-      // promise, and calls/captures retain their separate checked ABI.
-      const local = runtimeOptionalLocalOf(lowerer, expr.expression);
-      if (local !== null) candidates.push(local);
-      else if (ts.isPropertyAccessExpression(expr.expression)) collect(expr.expression, outcome);
-    } else if (
-      ts.isBinaryExpression(expr) &&
-      expr.operatorToken.kind !== ts.SyntaxKind.AmpersandAmpersandToken &&
-      expr.operatorToken.kind !== ts.SyntaxKind.BarBarToken &&
-      expr.operatorToken.kind !== ts.SyntaxKind.QuestionQuestionToken
-    ) {
-      // Both operands of a comparison/arithmetic operator are evaluated.
-      // Only member reads prove presence; bare identifiers need truth.
-      const member = (operand: ts.Expression): void => {
-        while (ts.isParenthesizedExpression(operand)) operand = operand.expression;
-        if (ts.isPropertyAccessExpression(operand)) collect(operand, outcome);
-      };
-      member(expr.left);
-      member(expr.right);
-      const op = expr.operatorToken.kind;
-      const equal =
-        op === ts.SyntaxKind.EqualsEqualsEqualsToken || op === ts.SyntaxKind.EqualsEqualsToken;
-      const unequal =
-        op === ts.SyntaxKind.ExclamationEqualsEqualsToken ||
-        op === ts.SyntaxKind.ExclamationEqualsToken;
-      if ((equal && outcome === false) || (unequal && outcome === true)) {
-        const present = (value: ts.Expression, unit: ts.Expression): void => {
-          while (ts.isParenthesizedExpression(unit)) unit = unit.expression;
-          const excludesUndefined =
-            (ts.isIdentifier(unit) &&
-              unit.text === "undefined" &&
-              (lowerer.typeOf(unit).flags & ts.TypeFlags.Undefined) !== 0) ||
-            (unit.kind === ts.SyntaxKind.NullKeyword &&
-              (op === ts.SyntaxKind.EqualsEqualsToken ||
-                op === ts.SyntaxKind.ExclamationEqualsToken));
-          if (excludesUndefined) {
-            const local = runtimeOptionalLocalOf(lowerer, value);
-            if (local !== null) candidates.push(local);
-          }
-        };
-        present(expr.left, expr.right);
-        present(expr.right, expr.left);
-      }
-    } else if (outcome) {
-      const local = runtimeOptionalLocalOf(lowerer, expr);
-      if (local !== null) candidates.push(local);
-    }
-  };
-  collect(node, truthy);
-  if (candidates.length === 0) return candidates;
-  const assigned = new Set<IrLocal>();
-  const visit = (part: ts.Node): void => {
-    if (ts.isFunctionLike(part)) return;
-    let target: ts.Node | null = null;
-    if (
-      ts.isBinaryExpression(part) &&
-      part.operatorToken.kind >= ts.SyntaxKind.FirstAssignment &&
-      part.operatorToken.kind <= ts.SyntaxKind.LastAssignment
-    )
-      target = part.left;
-    if (
-      (ts.isPrefixUnaryExpression(part) || ts.isPostfixUnaryExpression(part)) &&
-      (part.operator === ts.SyntaxKind.PlusPlusToken ||
-        part.operator === ts.SyntaxKind.MinusMinusToken)
-    )
-      target = part.operand;
-    if (target !== null) {
-      // Destructuring assignments can contain several identifiers.
-      const mark = (name: ts.Node): void => {
-        if (ts.isIdentifier(name)) {
-          const local = lowerer.resolveLocal(name);
-          if (local) assigned.add(lowerer.runtimeOptionalRootOf(local));
-        }
-        ts.forEachChild(name, mark);
-      };
-      mark(target);
-    }
-    ts.forEachChild(part, visit);
-  };
-  visit(node);
-  return candidates.filter((local) => !assigned.has(lowerer.runtimeOptionalRootOf(local)));
-}
-
-export function withRuntimeOptionalNarrowed<T>(
-  lowerer: Lowerer,
-  locals: readonly IrLocal[],
-  fn: () => T,
-): T {
-  if (locals.length === 0) return fn();
-  for (const local of locals)
-    lowerer.runtimeOptionalLocals.delete(lowerer.runtimeOptionalRootOf(local));
-  try {
-    return fn();
-  } finally {
-    for (const local of locals)
-      lowerer.runtimeOptionalLocals.add(lowerer.runtimeOptionalRootOf(local));
-  }
-}
-
 /** JS ToBoolean: bool passes through; f64/string get a `toBool` wrapper
  * (falsy: 0, -0, NaN, ""); unions get the same wrapper answered by a
  * per-union interned helper (unit arms falsy; scalar/string arms by
@@ -5140,1357 +1288,6 @@ export function eqComparableUnion(lowerer: Lowerer, unionId: string): boolean {
   return !!def && def.arms.every((a) => a.kind !== "dyn" && a.kind !== "caught");
 }
 
-/** Property access on a string or array receiver: `.length` lowers to the
- * matching intrinsic; a bare method reference (`const f = s.slice` — a
- * function value) is rejected with a specific message. Returns null for
- * other receivers (the generic property-access rejection applies). Both
- * the receiver type AND the ambient-file provenance of the member are
- * verified — the name alone proves nothing. */
-export function lowerIntrinsicProperty(
-  lowerer: Lowerer,
-  expr: ts.PropertyAccessExpression,
-): IrExpr | null {
-  for (const name of ["String", "Number", "Boolean", "BigInt"] as (
-    | "String"
-    | "Number"
-    | "Boolean"
-    | "BigInt"
-  )[]) {
-    if (!lowerer.chainBlocked(expr) && lowerer.isStdlibGlobal(expr, name)) {
-      return primitiveCtorClosure(lowerer, name, locOf(expr), isJsSourceFile(expr.getSourceFile()));
-    }
-  }
-  if (lowerer.stdlibGlobalMember(expr, "Reflect") === "ownKeys") {
-    const value = lowerer.lowerNativeCallableValue(
-      {
-        fn: "dyn.ownKeys",
-        params: [DYN],
-        result: DYN,
-        valueParams: [{ mode: "required", type: DYN }],
-      },
-      "Reflect.ownKeys",
-      locOf(expr),
-    )!;
-    return { kind: "dynFrom", value, fnName: "ownKeys", type: DYN, loc: locOf(expr) };
-  }
-  if (lowerer.chainBlocked(expr)) return null;
-  const builtinPrototype = builtinPrototypeMethod(lowerer, expr);
-  if (builtinPrototype)
-    return {
-      kind: "libCall",
-      fn: "dyn.builtinMethod",
-      args: [
-        { kind: "strLit", value: builtinPrototype, type: STRING, loc: locOf(expr) },
-        { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
-      ],
-      type: DYN,
-      loc: locOf(expr),
-    };
-  if (
-    ts.isPropertyAccessExpression(expr.expression) &&
-    lowerer.stdlibGlobalMember(expr.expression, "Array") === "prototype"
-  ) {
-    return {
-      kind: "dynKeyGet",
-      value: {
-        kind: "libCall",
-        fn: "dyn.arrayPrototype",
-        args: [],
-        type: DYN,
-        loc: locOf(expr.expression),
-      },
-      key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
-      type: DYN,
-      loc: locOf(expr),
-    };
-  }
-  if (
-    expr.name.text === "apply" &&
-    ts.isPropertyAccessExpression(expr.expression) &&
-    lowerer.stdlibGlobalMember(expr.expression, "Function") === "prototype"
-  )
-    return { kind: "libCall", fn: "dyn.functionApply", args: [], type: DYN, loc: locOf(expr) };
-  if (lowerer.stdlibGlobalMember(expr, "Array") === "prototype")
-    return { kind: "libCall", fn: "dyn.arrayPrototype", args: [], type: DYN, loc: locOf(expr) };
-  if (lowerer.stdlibGlobalMember(expr, "Object") === "prototype")
-    return { kind: "libCall", fn: "dyn.objectPrototype", args: [], type: DYN, loc: locOf(expr) };
-  // Function.prototype as a VALUE (a prototype-chain link:
-  // `Object.setPrototypeOf(F.prototype, Function.prototype)`): one
-  // anonymous function answering undefined, length 0 — a zero-capture
-  // closure of a compiler helper, so every read is the same function
-  // (closure identity) and shares its property table. Reads through it
-  // find the function members the checked runtime models for every
-  // function (apply, constructor, name, length). Member forms keep their
-  // own lowerings.
-  if (lowerer.stdlibGlobalMember(expr, "Function") === "prototype") {
-    const loc = locOf(expr);
-    const name = "%dyn.functionPrototype";
-    if (!lowerer.liftedFns.some((fn) => fn.name === name))
-      lowerer.liftedFns.push({
-        name,
-        params: [],
-        locals: [],
-        returnType: DYN,
-        body: [{ kind: "return", value: dynUndefinedExpr(loc), loc }],
-        loc,
-      });
-    return {
-      kind: "dynFrom",
-      value: { kind: "closure", fnName: name, captures: [], type: funcOf([], DYN), loc },
-      fnName: "",
-      type: DYN,
-      loc,
-    };
-  }
-  if (lowerer.stdlibGlobalMember(expr, "Array") === "isArray")
-    return lowerArrayIsArrayValue(lowerer, locOf(expr));
-  if (lowerer.stdlibGlobalMember(expr, "Array") === "from")
-    return lowerArrayFromValue(lowerer, locOf(expr));
-  const stringMember = lowerer.stdlibGlobalMember(expr, "String");
-  if (stringMember === "fromCharCode" || stringMember === "fromCodePoint")
-    return lowerStringCodesValue(lowerer, stringMember, locOf(expr));
-  const numberMember = lowerer.stdlibGlobalMember(expr, "Number");
-  if (numberMember === "parseInt" || numberMember === "parseFloat")
-    return lowerNumberParserValue(lowerer, numberMember, locOf(expr));
-  if (lowerer.stdlibGlobalMember(expr, "Buffer") === "poolSize")
-    return { kind: "libCall", fn: "buffer.poolSize", args: [], type: F64, loc: locOf(expr) };
-  const netAddressStatic = lowerNetAddressStaticRead(lowerer, expr);
-  if (netAddressStatic) return netAddressStatic;
-  if (lowerer.stdlibGlobalMember(expr, "Buffer") === "isBuffer")
-    return lowerCheckedPredicateValue(lowerer, "Buffer.isBuffer", "buffer", locOf(expr));
-  if (lowerer.stdlibGlobalMember(expr, "Date") === "now")
-    return lowerer.lowerNativeCallableValue(
-      {
-        fn: "date.now",
-        params: [],
-        result: F64,
-        valueParams: [],
-      },
-      "Date.now",
-      locOf(expr),
-    );
-  if (stdlibGlobalNameOf(lowerer, expr.expression) === "Object") {
-    if (expr.name.text === "assign") return lowerObjectAssignValue(lowerer, locOf(expr));
-    const fn = own(OBJECT_CALLABLE_VALUES, expr.name.text);
-    if (fn) return lowerer.lowerNativeCallableValue(fn, `Object.${expr.name.text}`, locOf(expr));
-  }
-  // A never-tainted JS receiver type lowered checked-dynamic
-  // (neverTaintedJsType — `cmd.length` on `const cmd = ['pwd', []]`):
-  // stand down so the dyn keyed read below the chain answers, instead
-  // of an array libCall over a dyn receiver hitting the boundary fence.
-  let kind = neverTaintedJsType(lowerer, expr.expression, lowerer.typeOf(expr.expression))
-    ? undefined
-    : lowerer.mapTypeOf(lowerer.typeOf(expr.expression))?.kind;
-  // A checker-`any[]` receiver (the readonly-array Array.isArray quirk)
-  // whose VALUE lowers to a real static array (maybeNarrow's isArray
-  // bridge): `.length` and friends ride the array path on the lowered
-  // value (re-lowering is pure IR construction).
-  if (kind === undefined && lowerer.checkerAnyArray(expr.expression)) {
-    const probe = lowerer.lowerExpr(expr.expression);
-    if (probe.type.kind === "array") kind = "array";
-  }
-  if (
-    kind !== "string" &&
-    kind !== "array" &&
-    kind !== "map" &&
-    kind !== "set" &&
-    kind !== "f64" &&
-    kind !== "date" &&
-    kind !== "regex" &&
-    kind !== "url" &&
-    kind !== "searchParams" &&
-    kind !== "stats" &&
-    kind !== "spawnRes" &&
-    kind !== "child" &&
-    kind !== "bytes" &&
-    kind !== "symbol"
-  ) {
-    return null;
-  }
-  // child receivers also admit the user's own child-shaped interface
-  // members (the NgrokChildProcess duck rule — see isChildSurfaceMember).
-  // The EMPTY tuple `[]` rides the array REPRESENTATION (type-mapper.ts), but
-  // its `length` member is the tuple's own synthesized property, not
-  // Array.prototype's — provenance alone would refuse it. It reads the
-  // runtime length (always 0) through the array intrinsic like any other
-  // array; non-empty tuples never reach here (they map to records and
-  // fold their arity constant on the record path).
-  const tupleLengthOnArray =
-    kind === "array" &&
-    expr.name.text === "length" &&
-    lowerer.checker.isTupleType(
-      lowerer.checker.getBaseTypeOfLiteralType(lowerer.typeOf(expr.expression)),
-    );
-  if (
-    kind === "child"
-      ? !isChildSurfaceMember(lowerer, expr)
-      : !tupleLengthOnArray && !lowerer.isStdlibMember(expr)
-  )
-    return null;
-  const name = expr.name.text;
-  if (kind === "array" && name === "constructor" && isJsSourceFile(expr.getSourceFile())) {
-    const receiver = lowerer.lowerExpr(expr.expression);
-    if (receiver.type.kind === "dyn")
-      return {
-        kind: "dynKeyGet",
-        value: receiver,
-        key: { kind: "strLit", value: name, type: STRING, loc: locOf(expr) },
-        type: DYN,
-        loc: locOf(expr),
-      };
-    const result: IrExpr = {
-      kind: "libCall",
-      fn: "dyn.arrayConstructor",
-      args: [],
-      type: DYN,
-      loc: locOf(expr),
-    };
-    return {
-      kind: "seqExpr",
-      stmts: [{ kind: "exprStmt", expr: receiver, loc: locOf(expr) }],
-      result,
-      type: DYN,
-      loc: locOf(expr),
-    };
-  }
-  const strictReceiver = (expected: IrType): IrExpr => {
-    const value = lowerer.lowerExpr(expr.expression);
-    if (value.type.kind === "dyn") {
-      if (isJsSourceFile(expr.getSourceFile()) && name === "length") return value;
-      return lowerer.coerceInto(expr.expression, value, expected);
-    }
-    return lowerer.runtimeOptionalPropertyReceiver(expr.expression, value, expected, name) ?? value;
-  };
-  if (kind === "child") {
-    const loc = locOf(expr);
-    // The lifecycle reads, Node's exact shapes (SEMANTICS.md pins the
-    // matrix): pid is `number | undefined` (undefined = spawn failure),
-    // exitCode `number | null` (null while running and after a signal
-    // death; -errno once a spawn failure settled), killed the
-    // sent-a-signal flag. The unions build type-directedly in the
-    // backend (the spawnRes.status pattern); a checker-narrowed read
-    // extracts through maybeNarrow like any union member.
-    if (name === "pid") {
-      const receiver = lowerer.lowerExpr(expr.expression);
-      const type: IrType = { kind: "union", unionId: lowerer.unions.intern([F64, UNDEFINED_T]) };
-      return { kind: "libCall", fn: "child.pid", args: [receiver], type, loc };
-    }
-    if (name === "exitCode") {
-      const receiver = lowerer.lowerExpr(expr.expression);
-      const type: IrType = { kind: "union", unionId: lowerer.unions.intern([F64, NULL_T]) };
-      return { kind: "libCall", fn: "child.exitCode", args: [receiver], type, loc };
-    }
-    if (name === "killed") {
-      const receiver = lowerer.lowerExpr(expr.expression);
-      return { kind: "libCall", fn: "child.killed", args: [receiver], type: BOOL, loc };
-    }
-    if (name === "on" || name === "once" || name === "kill" || name === "unref") {
-      lowerer.unsupported("SC1090", expr, `child methods as values (call '${name}' directly)`);
-    }
-    lowerer.noLowering(
-      `ChildProcess.${name}`,
-      expr,
-      'on/once("exit" | "close" | "error", cb), pid, exitCode, killed, kill(signal?), and unref() are the supported ChildProcess members',
-      lowerer.checker.getSymbolAtLocation(expr.name),
-    );
-  }
-  if (kind === "spawnRes") {
-    // The spawnSync-result reads. status is the interned `number | null`
-    // union (null = signal death or spawn failure); stdout/stderr are
-    // the captured utf8 strings — under @types/node WITHOUT the
-    // {encoding: "utf8"} options argument the checker types them Buffer,
-    // which is re-fenced here (the call site already said so).
-    const loc = locOf(expr);
-    if (name === "status") {
-      // Always the interned `number | null` union; a checker-NARROWED
-      // read (`missing.status === null ? ... : ${missing.status}`)
-      // bridges through maybeNarrow like any union read.
-      const receiver = lowerer.lowerExpr(expr.expression);
-      const type: IrType = { kind: "union", unionId: lowerer.unions.intern([F64, NULL_T]) };
-      const read: IrExpr = { kind: "libCall", fn: "spawnRes.status", args: [receiver], type, loc };
-      return lowerer.maybeNarrow(read, expr);
-    }
-    if (name === "stdout" || name === "stderr") {
-      if (lowerer.mapTypeOf(lowerer.typeOf(expr))?.kind !== "string") {
-        lowerer.noLowering(
-          `spawnSync's ${name} without the "utf8" encoding`,
-          expr,
-          'Buffer captures are not representable — call spawnSync(cmd, args, { encoding: "utf8" }) so the outputs are strings',
-        );
-      }
-      const receiver = lowerer.lowerExpr(expr.expression);
-      const fn = name === "stdout" ? "spawnRes.stdout" : "spawnRes.stderr";
-      return { kind: "libCall", fn, args: [receiver], type: STRING, loc };
-    }
-    if (name === "error") {
-      // Node's spawn-failure carrier: `Error | undefined` — a fresh
-      // %Error ("spawnSync <file> ENOENT", `code` stamped) when the
-      // spawn itself failed, the undefined arm otherwise. The libCall
-      // always carries the interned union (the declared `error?: Error`),
-      // and a checker-NARROWED read (`if (r.error) r.error.message`)
-      // bridges through maybeNarrow like any union read.
-      const receiver = lowerer.lowerExpr(expr.expression);
-      const type = lowerer.withUndefinedArmOf({ kind: "object", className: "%Error" });
-      if (!type) lowerer.badType(expr, lowerer.typeOf(expr));
-      const read: IrExpr = { kind: "libCall", fn: "spawnRes.error", args: [receiver], type, loc };
-      return lowerer.maybeNarrow(read, expr);
-    }
-    lowerer.noLowering(
-      `SpawnSyncReturns.${name}`,
-      expr,
-      "status, stdout, stderr, and error are the supported spawnSync-result members",
-      lowerer.checker.getSymbolAtLocation(expr.name),
-    );
-  }
-  if (kind === "stats") {
-    if (name === "size") {
-      const receiver = lowerer.lowerExpr(expr.expression);
-      return { kind: "libCall", fn: "stats.size", args: [receiver], type: F64, loc: locOf(expr) };
-    }
-    if (Object.hasOwn(STATS_TYPE_TESTS, name)) {
-      lowerer.unsupported("SC1090", expr, `Stats methods as values (call '${name}' directly)`);
-    }
-    lowerer.noLowering(
-      `Stats.${name}`,
-      expr,
-      "isFile(), isDirectory(), isSymbolicLink(), isBlockDevice(), isCharacterDevice(), isFIFO(), isSocket(), dev, mode, nlink, uid, gid, rdev, blksize, ino, size, blocks, atimeMs, mtimeMs, ctimeMs, birthtimeMs, atime, mtime, ctime, and birthtime are the supported Stats members",
-      lowerer.checker.getSymbolAtLocation(expr.name),
-    );
-  }
-  if (kind === "date") {
-    const methods = new Set([
-      "getTime",
-      "valueOf",
-      "toISOString",
-      "getFullYear",
-      "getUTCFullYear",
-      "getMonth",
-      "getUTCMonth",
-      "getDate",
-      "getUTCDate",
-      "getDay",
-      "getUTCDay",
-      "getHours",
-      "getUTCHours",
-      "getMinutes",
-      "getUTCMinutes",
-      "getSeconds",
-      "getUTCSeconds",
-      "getMilliseconds",
-      "getUTCMilliseconds",
-      "getTimezoneOffset",
-    ]);
-    if (methods.has(name)) {
-      lowerer.unsupported("SC1090", expr, `Date methods as values (call '${name}' directly)`);
-    }
-    lowerer.noLowering(
-      `Date.prototype.${name}`,
-      expr,
-      "getTime(), valueOf(), toISOString(), the local/UTC calendar getters, and getTimezoneOffset() are supported; Date setters and locale/string formatters have no lowering",
-      lowerer.checker.getSymbolAtLocation(expr.name),
-    );
-  }
-  if (kind === "symbol") {
-    const loc = locOf(expr);
-    // `.description`: the checker's `string | undefined` — undefined
-    // exactly for the description-less Symbol()/Symbol(undefined) forms
-    // (Symbol("") answers the EMPTY STRING arm, like Node). The interned
-    // union builds in the backend from the runtime's +1-or-NULL answer
-    // (the child.stdout pattern); a checker-narrowed read extracts
-    // through maybeNarrow like any union member.
-    if (name === "description") {
-      const receiver = lowerer.coerceToExpected(lowerer.lowerExpr(expr.expression), SYMBOL_T);
-      const type: IrType = { kind: "union", unionId: lowerer.unions.intern([STRING, UNDEFINED_T]) };
-      return { kind: "libCall", fn: "sym.desc", args: [receiver], type, loc };
-    }
-    if (name === "toString" || name === "valueOf") {
-      lowerer.unsupported("SC1090", expr, `symbol methods as values (call '${name}' directly)`);
-    }
-    lowerer.noLowering(
-      `Symbol.prototype.${name}`,
-      expr,
-      "description and toString() are the supported symbol members",
-      lowerer.checker.getSymbolAtLocation(expr.name),
-    );
-  }
-  if (kind === "url") {
-    // The supported URL getters. Everything else the lib declares
-    // (searchParams, setters-as-reads, ...) fences with the
-    // member-qualified name and the supported list. `host` is the WHATWG
-    // serialization: lowercased hostname, `:port` appended exactly when
-    // a non-default port is present (scr_url_host — Node-exact,
-    // opaque-path URLs answer ""); `hostname` is the stored port-less
-    // host field verbatim, including IPv6 brackets.
-    if (
-      name === "protocol" ||
-      name === "origin" ||
-      name === "username" ||
-      name === "password" ||
-      name === "pathname" ||
-      name === "href" ||
-      name === "host" ||
-      name === "hostname" ||
-      name === "port" ||
-      name === "search" ||
-      name === "hash"
-    ) {
-      const receiver = lowerer.lowerExpr(expr.expression);
-      const fn =
-        name === "protocol"
-          ? "url.protocol"
-          : name === "origin"
-            ? "url.origin"
-            : name === "username"
-              ? "url.username"
-              : name === "password"
-                ? "url.password"
-                : name === "pathname"
-                  ? "url.pathname"
-                  : name === "host"
-                    ? "url.host"
-                    : name === "hostname"
-                      ? "url.hostname"
-                      : name === "port"
-                        ? "url.port"
-                        : name === "search"
-                          ? "url.search"
-                          : name === "hash"
-                            ? "url.hash"
-                            : "url.href";
-      return { kind: "libCall", fn, args: [receiver], type: STRING, loc: locOf(expr) };
-    }
-    // `u.searchParams`: the LIVE cached view (one identity per URL —
-    // mutations through it re-serialize into the URL's query, so href
-    // reflects immediately; Node's binding exactly).
-    if (name === "searchParams") {
-      const receiver = lowerer.lowerExpr(expr.expression);
-      return {
-        kind: "libCall",
-        fn: "url.searchParams",
-        args: [receiver],
-        type: SEARCH_PARAMS_T,
-        loc: locOf(expr),
-      };
-    }
-    if (name === "toString" || name === "toJSON") {
-      lowerer.unsupported("SC1090", expr, `URL methods as values (call '${name}' directly)`);
-    }
-    lowerer.noLowering(
-      `URL.${name}`,
-      expr,
-      "protocol, origin, username, password, pathname, href, host, hostname, port, search, hash, searchParams, and toString() are the supported URL members",
-      lowerer.checker.getSymbolAtLocation(expr.name),
-    );
-  }
-  if (kind === "searchParams") {
-    const SEARCH_PARAMS_METHODS = new Set([
-      "get",
-      "getAll",
-      "set",
-      "append",
-      "delete",
-      "has",
-      "sort",
-      "toString",
-      "forEach",
-      "keys",
-      "values",
-      "entries",
-    ]);
-    // The one data property; every method lowers at its CALL
-    // (lowerSearchParamsMethodCall) — bare method references fence.
-    if (name === "size") {
-      const receiver = lowerer.lowerExpr(expr.expression);
-      return { kind: "libCall", fn: "sp.size", args: [receiver], type: F64, loc: locOf(expr) };
-    }
-    if (SEARCH_PARAMS_METHODS.has(name)) {
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        `URLSearchParams methods as values (call '${name}' directly)`,
-      );
-    }
-    lowerer.noLowering(
-      `URLSearchParams.${name}`,
-      expr,
-      "get, getAll, set, append, delete, has, sort, size, toString(), forEach, and for-of iteration are the supported URLSearchParams members",
-      lowerer.checker.getSymbolAtLocation(expr.name),
-    );
-  }
-  if (kind === "regex") {
-    if (name === "lastIndex") {
-      return {
-        kind: "regexIntrinsic",
-        method: "lastIndex",
-        receiver: strictReceiver({ kind: "regex" }),
-        args: [],
-        type: F64,
-        loc: locOf(expr),
-      };
-    }
-    if (name === "source" || name === "flags") {
-      const receiver = strictReceiver({ kind: "regex" });
-      return {
-        kind: "regexIntrinsic",
-        method: name,
-        receiver,
-        args: [],
-        type: STRING,
-        loc: locOf(expr),
-      };
-    }
-    // The flag getters answer whether `flags` holds the flag's letter.
-    const flag = REGEX_FLAG_GETTERS.get(name);
-    if (flag !== undefined) {
-      const loc = locOf(expr);
-      const flags: IrExpr = {
-        kind: "regexIntrinsic",
-        method: "flags",
-        receiver: strictReceiver({ kind: "regex" }),
-        args: [],
-        type: STRING,
-        loc,
-      };
-      return {
-        kind: "strIntrinsic",
-        method: "includes",
-        receiver: flags,
-        args: [{ kind: "strLit", value: flag, type: STRING, loc }],
-        type: BOOL,
-        loc,
-      };
-    }
-    if (name === "test") {
-      lowerer.unsupported("SC1090", expr, "regex methods as values (call 'test' directly)");
-    }
-    return null;
-  }
-  if (kind === "f64") {
-    if (own(STDLIB_SURFACE.number, name) !== undefined) {
-      lowerer.unsupported("SC1090", expr, `number methods as values (call '${name}' directly)`);
-    }
-    return null;
-  }
-  if (kind === "bytes") {
-    const loc = locOf(expr);
-    if (name === "constructor") {
-      const expected = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
-      const receiver =
-        expected?.kind === "bytes" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
-      return {
-        kind: "dynKeyGet",
-        value: lowerer.coerceInto(expr.expression, receiver, DYN),
-        key: { kind: "strLit", value: name, type: STRING, loc },
-        type: DYN,
-        loc,
-      };
-    }
-    if (name === "length" || name === "byteLength") {
-      const expected = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
-      let receiver =
-        expected?.kind === "bytes" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
-      if (receiver.type.kind === "dyn")
-        return {
-          kind: "dynCheck",
-          value: {
-            kind: "dynKeyGet",
-            value: receiver,
-            key: { kind: "strLit", value: name, type: STRING, loc: locOf(expr) },
-            type: DYN,
-            loc: locOf(expr),
-          },
-          type: F64,
-          loc: locOf(expr),
-        };
-      if (
-        receiver.type.kind === "union" &&
-        lowerer.armTag(receiver.type.unionId, UNDEFINED_T) >= 0
-      ) {
-        const present = lowerer.stripUndefinedArm(receiver.type);
-        const helper =
-          present.kind === "bytes"
-            ? lowerer.narrowedArmHelper(receiver.type.unionId, present, locOf(expr.expression))
-            : null;
-        receiver = helper
-          ? lowerer.checkedNarrowCall(helper, receiver, present, locOf(expr.expression))
-          : lowerer.maybeNarrow(receiver, expr.expression);
-      }
-
-      // property read, exiting at the declared number type (the array
-
-      return { kind: "bytesIntrinsic", method: name, receiver, args: [], type: F64, loc };
-    }
-    if (name === "byteOffset") {
-      // 0 for owners (scriptc typed arrays own their whole storage —
-      // SEMANTICS.md notes the divergence from Node's Buffer pooling),
-      // the view's real offset for a DataView. A runtime read, so the
-      // receiver's evaluation is never discarded.
-      const expected = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
-      const receiver =
-        expected?.kind === "bytes" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
-      return { kind: "bytesIntrinsic", method: "byteOffset", receiver, args: [], type: F64, loc };
-    }
-    if (name === "buffer") {
-      const expected = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
-      const receiver =
-        expected?.kind === "bytes" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
-      return { kind: "bytesIntrinsic", method: "buffer", receiver, args: [], type: DYN, loc };
-    }
-    if (name === "slice" || name === "subarray" || name === "set" || name === "toString") {
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        `typed-array methods as values (call '${name}' directly)`,
-      );
-    }
-    return null; // fill, reverse, ... → the SC2020 member fence
-  }
-  if (kind === "map") {
-    if (name === "size") {
-      const expected = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
-      const receiver =
-        expected?.kind === "map" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
-      return {
-        kind: "mapIntrinsic",
-        method: "size",
-        receiver,
-        args: [],
-        type: F64,
-        loc: locOf(expr),
-      };
-    }
-    if (MAP_METHODS.has(name) || name === "forEach") {
-      lowerer.unsupported("SC1090", expr, `Map methods as values (call '${name}' directly)`);
-    }
-    return null;
-  }
-  if (kind === "set") {
-    if (name === "size") {
-      const expected = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
-      const receiver =
-        expected?.kind === "set" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
-      return {
-        kind: "setIntrinsic",
-        method: "size",
-        receiver,
-        args: [],
-        type: F64,
-        loc: locOf(expr),
-      };
-    }
-    if (SET_METHODS.has(name)) {
-      lowerer.unsupported("SC1090", expr, `Set methods as values (call '${name}' directly)`);
-    }
-    return null;
-  }
-  if (name === "length") {
-    const expected =
-      kind === "string" ? STRING : lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
-    let receiver = lowerer.lowerExpr(expr.expression);
-    if (
-      receiver.type.kind !== "dyn" &&
-      expected &&
-      (expected.kind === "string" || expected.kind === "array")
-    ) {
-      receiver =
-        lowerer.runtimeOptionalPropertyReceiver(expr.expression, receiver, expected, name) ??
-        receiver;
-    }
-    if (
-      receiver.type.kind === "union" &&
-      lowerer.armTag(receiver.type.unionId, UNDEFINED_T) >= 0 &&
-      kind === "array"
-    ) {
-      const present = lowerer.stripUndefinedArm(receiver.type);
-      const helper =
-        present.kind === "array"
-          ? lowerer.narrowedArmHelper(receiver.type.unionId, present, locOf(expr.expression))
-          : null;
-      receiver = helper
-        ? lowerer.checkedNarrowCall(helper, receiver, present, locOf(expr.expression))
-        : lowerer.maybeNarrow(receiver, expr.expression);
-    }
-
-    // A CHECKED-DYNAMIC value behind an array-typed checker spelling
-    // (`Object.keys(u).length` — the dyn walk answers a dyn array while
-    // tsc spells string[]): the runtime-world dispatch — a dyn keyed
-    // read validated into the declared number (a lying length throws
-    // the catchable TypeError, the dynCheck stance).
-    if (receiver.type.kind === "dyn") {
-      const read: IrExpr = {
-        kind: "dynKeyGet",
-        key: { kind: "strLit", value: "length", type: STRING, loc: locOf(expr) },
-        ...(expr.questionDotToken ? { optional: true as const } : {}),
-        value: receiver,
-        type: DYN,
-        loc: locOf(expr),
-      };
-      if (expr.questionDotToken) return read;
-      return { kind: "dynCheck", value: read, type: F64, loc: locOf(expr) };
-    }
-    return kind === "string"
-      ? { kind: "strIntrinsic", method: "length", receiver, args: [], type: F64, loc: locOf(expr) }
-      : { kind: "arrIntrinsic", method: "length", receiver, args: [], type: F64, loc: locOf(expr) };
-  }
-  if (
-    kind === "string"
-      ? own(STR_METHODS, name) !== undefined ||
-        STRING_INDEX_METHODS.has(name) ||
-        own(STDLIB_SURFACE.string, name) !== undefined
-      : ARRAY_METHODS.has(name)
-  ) {
-    lowerer.unsupported("SC1090", expr, `${kind} methods as values (call '${name}' directly)`);
-  }
-  return null;
-}
-
-/** JavaScript: whether `expr` is or holds an existing checked-dynamic
- * object — a binding stored as a dyn value whose checker type is an
- * object, or an array or object literal with such an element. Building
- * the enclosing literal with a static element type would copy it. */
-export function jsHoldsDynObject(lowerer: Lowerer, expr: ts.Expression): boolean {
-  while (ts.isParenthesizedExpression(expr)) expr = expr.expression;
-  if (ts.isIdentifier(expr)) {
-    const stored = lowerer.peekLocal(expr)?.type ?? lowerer.globalOf(expr)?.type;
-    return stored?.kind === "dyn" && (lowerer.typeOf(expr).flags & ts.TypeFlags.Object) !== 0;
-  }
-  if (ts.isArrayLiteralExpression(expr))
-    return expr.elements.nodes.some(
-      (element) => !ts.isSpreadElement(element) && jsHoldsDynObject(lowerer, element),
-    );
-  if (ts.isObjectLiteralExpression(expr))
-    return expr.properties.nodes.some(
-      (property) =>
-        (ts.isPropertyAssignment(property) && jsHoldsDynObject(lowerer, property.initializer)) ||
-        (ts.isShorthandPropertyAssignment(property) &&
-          ts.isIdentifier(property.name) &&
-          jsHoldsDynObject(lowerer, property.name)),
-    );
-  return false;
-}
-
-/** `[a, b, c]`. The element type comes from the contextual type when tsc
- * has one (`const a: number[] = []`, arguments, nested literals) and from
- * the literal's own inferred type otherwise. A bare `[]` with no context
- * is `never[]` — unmappable, rejected with the component fence (SC2009). `expected` overrides
- * the contextual lookup where the caller knows the slot's array type and
- * tsc's API doesn't surface it (ternary arms under an array context —
- * tsc accepts the arm covariantly, but a tagged element representation
- * must be BUILT as the slot's element type). */
-export function lowerArrayLiteral(
-  lowerer: Lowerer,
-  expr: ts.ArrayLiteralExpression,
-  expected?: (IrType & { kind: "array" }) | (IrType & { kind: "record" }),
-): IrExpr {
-  const loc = locOf(expr);
-  const ctxType = lowerer.checker.getContextualType(expr);
-  // `as const satisfies readonly T[]` checks against an array but keeps
-  // the literal's inferred tuple type. Build that shape; an actual array
-  // destination can use the ordinary tuple-to-array coercion afterward.
-  const tsType = underConstAssertion(expr)
-    ? lowerer.typeOf(expr)
-    : (ctxType ?? lowerer.typeOf(expr));
-  let mapped = expected ?? lowerer.mapTypeOf(tsType);
-  // Inferred JavaScript arrays can contain unrelated constructors with
-  // structurally equal checker types. Their native class ABIs still differ.
-  if (
-    !expected &&
-    isJsSourceFile(expr.getSourceFile()) &&
-    mapped?.kind === "array" &&
-    mapped.elem.kind === "classval"
-  )
-    mapped = DYN;
-  // An inferred destructuring pattern supplies a contextual [any, ...]
-  // tuple. Its positions do not erase the literal's inferred element
-  // types; explicit destinations already arrive through expected.
-  if (
-    expected === undefined &&
-    ctxType &&
-    lowerer.checker.isTupleType(ctxType) &&
-    lowerer.checker
-      .getTypeArguments(ctxType as ts.TypeReference)
-      .some((type) => (type.flags & ts.TypeFlags.Any) !== 0)
-  ) {
-    const inferred = lowerer.mapTypeOf(lowerer.typeOf(expr));
-    if (
-      inferred?.kind === "array" ||
-      (inferred?.kind === "record" && lowerer.shapes.get(inferred.shapeId)?.tuple)
-    )
-      mapped = inferred;
-  }
-  // A JS literal whose OWN inferred type is never-tainted
-  // (neverTaintedJsType — the evolving `const gb = []`, the mixed
-  // command tuple `['pwd', []]`) carries no element information: route
-  // it to the checked-dynamic tree fallback below rather than letting never's f64
-  // representation build a static number array (a later dyn push would
-  // throw "expected number at $, got string"; the tuple's union arm
-  // would re-tag as number[] and fence). A REAL slot still wins:
-  // `expected`, a contextual array/tuple, or a contextual union's
-  // single array arm all provide element information first.
-  // (The contextual lookup can answer the binding's own tainted
-  // inference back — `const cmd = ['pwd', []]` — so the slot test is a
-  // taint test on whichever type mapped, not a presence test.)
-  const neverTaintedOwnJs =
-    expected === undefined && neverTaintedJsType(lowerer, expr, lowerer.typeOf(expr));
-  if (expected === undefined && neverTaintedJsType(lowerer, expr, tsType)) mapped = null;
-  // A union-typed slot (`const x: string[] | number = [..]`) contextually
-  // types the literal as the union; build the literal as its OWN type and
-  // let the slot's coercion wrap it into the union. An unknown-typed slot
-  // (`JSON.stringify([1, 2])`) likewise: build the literal's own type. An
-  // UNMAPPABLE context falls back the same way — a destructuring pattern
-  // without annotations contextually types its initializer `[any]`, while
-  // the literal's own inferred type is the real tuple.
-  if (!mapped || mapped.kind === "union" || mapped.kind === "dyn") {
-    const ctxUnion = mapped?.kind === "union" ? mapped : null;
-    mapped = lowerer.mapTypeOf(lowerer.typeOf(expr));
-    // The never-tainted own type carries no element information here
-    // either (the JS story above) — only a contextual union's single
-    // array arm below may still supply a static home.
-    if (neverTaintedOwnJs) mapped = null;
-    // An EMPTY literal in a union slot (`const t: string[] | undefined =
-    // []`, the `[]` default argument against `string[] | undefined`) has
-    // no useful own type — tsc infers `never[]`, whose f64-element
-    // mapping is a representation for the uninhabited, not the slot's
-    // arm. When the contextual union has exactly ONE array arm there is
-    // no ambiguity: build the literal as that arm and let the slot's
-    // coercion wrap it. Two array arms would need tsc's own best-fit
-    // choice — none arises in practice; the fence stands.
-    if (ctxUnion && expr.elements.nodes.length === 0) {
-      const def = lowerer.unions.get(ctxUnion.unionId);
-      const arrayArms = def?.arms.filter((a) => a.kind === "array") ?? [];
-      if (arrayArms.length === 1) mapped = arrayArms[0]!;
-    }
-    // A NON-EMPTY literal whose own type has no static home (the JS dyn
-    // fallback — a null/dyn mapping, or an inference that degraded to a
-    // unit-only-element array over non-unit elements) under a union
-    // with exactly ONE array-family arm — an array, or an
-    // arity-matching tuple (the option-table `default: [{ value: [] }]`
-    // shape): build AS that arm, exactly the empty-literal rule above;
-    // the slot's coercion wraps it.
-    if (ctxUnion && expr.elements.nodes.length > 0) {
-      // A unit-only-element array (`(null | undefined)[]`) cannot hold
-      // non-unit elements — neither as the literal's own mapping nor as
-      // a competing union arm.
-      const nonUnitElems = expr.elements.nodes.some(
-        (el) =>
-          !ts.isOmittedExpression(el) &&
-          el.kind !== ts.SyntaxKind.NullKeyword &&
-          !(ts.isIdentifier(el) && el.text === "undefined"),
-      );
-      const ownUnhelpful =
-        mapped === null ||
-        mapped.kind === "dyn" ||
-        // The checker may echo the context union rather than infer this literal.
-        mapped.kind === "union" ||
-        (mapped.kind === "array" && nonUnitElems && lowerer.unitOnlyElem(mapped.elem));
-      if (ownUnhelpful) {
-        const def = lowerer.unions.get(ctxUnion.unionId);
-        const arms = (def?.arms ?? []).filter(
-          (a) =>
-            (a.kind === "array" && !(nonUnitElems && lowerer.unitOnlyElem(a.elem))) ||
-            (a.kind === "record" &&
-              !!lowerer.shapes.get(a.shapeId)?.tuple &&
-              lowerer.shapes.get(a.shapeId)!.fields.length === expr.elements.nodes.length),
-        );
-        if (arms.length === 1) mapped = arms[0]!;
-      }
-    }
-  }
-  // A Date's toJSON() element keeps its null in a literal with no declared
-  // destination: the lib types say string.
-  if (
-    !expected &&
-    mapped?.kind === "array" &&
-    mapped.elem.kind === "string" &&
-    expr.elements.nodes.some((element) => isDateJsonSource(lowerer, element))
-  )
-    mapped = { kind: "array", elem: dateJsonType(lowerer) };
-  // An array literal inside an npm-static implicit-any instance can
-  // inherit the checker's poisoned any[] context even after the
-  // active binding gives every element one concrete lowering. Recover a
-  // static array only when every spelled element lowers to the same
-  // supported type. An explicit checked-dynamic destination still owns
-  // the later slot coercion; heterogeneous literals, holes, and spreads
-  // keep the checked-dynamic fallback below.
-  if (
-    lowerer.implicitParamTypes !== null &&
-    npmStaticPackageOfPath(expr.getSourceFile().fileName) !== null &&
-    (mapped === null ||
-      mapped.kind === "dyn" ||
-      (mapped.kind === "array" && mapped.elem.kind === "dyn")) &&
-    expr.elements.nodes.length > 0 &&
-    expr.elements.nodes.every(
-      (element) => !ts.isSpreadElement(element) && !ts.isOmittedExpression(element),
-    )
-  ) {
-    const elements = expr.elements.nodes.map((element) => tryLowerExpression(lowerer, element));
-    const first = elements[0];
-    if (
-      first !== undefined &&
-      first !== null &&
-      isSupportedArrayElem(first.type) &&
-      elements.every((element) => element !== null && typeEquals(element.type, first.type))
-    ) {
-      mapped = arrayOf(first.type);
-    }
-  }
-  if (!expected && isJsSourceFile(expr.getSourceFile()) && mapped?.kind === "array") {
-    const elem = mapped.elem;
-    const arms = elem.kind === "union" ? lowerer.unions.get(elem.unionId)?.arms : [elem];
-    if (arms?.length && arms.every((arm) => arm.kind === "classval")) mapped = DYN;
-    // Inferred JavaScript literals mixing promises and plain values
-    // (`[Promise.resolve(1), 2]`) keep the checked-dynamic array: their
-    // consumers (Readable.from, Promise.all over iterators) inspect each
-    // element at run time.
-    if (maybePromiseUnionOf(lowerer, elem)) mapped = DYN;
-  }
-  if (
-    !expected &&
-    isJsSourceFile(expr.getSourceFile()) &&
-    expr.elements.nodes.some(
-      (element) =>
-        ts.isSpreadElement(element) &&
-        tryLowerExpression(lowerer, element.expression)?.type.kind === "dyn",
-    )
-  )
-    mapped = DYN;
-  // An element that is an existing checked-dynamic object (a file-scope
-  // object literal binding, or a literal holding one) keeps its identity
-  // only in a checked-dynamic array: a static element type would copy it.
-  if (
-    !expected &&
-    isJsSourceFile(expr.getSourceFile()) &&
-    mapped?.kind !== "dyn" &&
-    expr.elements.nodes.some(
-      (element) => !ts.isSpreadElement(element) && jsHoldsDynObject(lowerer, element),
-    )
-  )
-    mapped = DYN;
-  // An EMPTY literal under a CONST ASSERTION whose type queries panicked
-  // (tsgo's readonly-[] TupleType conversion) uses a unit-element array,
-  // mapType's own `[] as const` rule.
-  if (
-    mapped === null &&
-    expr.elements.nodes.length === 0 &&
-    (tsType.flags & ts.TypeFlags.Any) !== 0 &&
-    underConstAssertion(expr)
-  ) {
-    mapped = arrayOf(unitOnlyUnion(lowerer.unions));
-  }
-  // Heterogeneous JavaScript object arrays must retain each literal's
-  // real keys. A structural union can otherwise drop descriptor fields.
-  if (
-    !expected &&
-    isJsSourceFile(expr.getSourceFile()) &&
-    mapped?.kind === "array" &&
-    mapped.elem.kind === "union" &&
-    expr.elements.nodes.some(ts.isObjectLiteralExpression)
-  )
-    mapped = DYN;
-
-  // A TUPLE-typed slot (`const t: [string, number] = ["a", 1]`): the
-  // literal constructs the tuple's record shape — one positional field
-  // per element, source order (which IS index order, so evaluation order
-  // is JS-exact). tsc has already checked the arity; the recount below
-  // backstops `as` smuggling. Fixed tuple spreads have known positions.
-  if (mapped?.kind === "record") {
-    const shape = lowerer.shapes.get(mapped.shapeId);
-    if (shape?.tuple) {
-      const spread = expr.elements.nodes.find(ts.isSpreadElement);
-      if (spread) {
-        return lowerTupleSpreadLiteral(lowerer, expr, mapped, shape);
-      }
-      if (expr.elements.nodes.length !== shape.fields.length) {
-        // tsc padded an UNDER-LENGTH literal against an optional-element
-        // tuple context (`options || []` with `options?: [string?,
-        // number?]` — the instantiated type spells every position, the
-        // literal spells fewer): no fixed shape holds it.
-        lowerer.badType(expr, tsType);
-      }
-      const byName = new Map(shape.fields.map((f) => [f.name, f.type]));
-      const fields = expr.elements.nodes.map((el, i) => {
-        const fieldType = byName.get(String(i));
-        if (!fieldType) lowerer.badType(el, lowerer.typeOf(el));
-        return { name: String(i), value: lowerer.lowerExprExpecting(el, fieldType) };
-      });
-      return { kind: "recordLit", fields, type: mapped, loc };
-    }
-  }
-  if (!mapped || mapped.kind !== "array") {
-    // The JS declaration fallback, literal-side: an element type with no
-    // static home (a string | string[] mixed command tuple, an evolving
-    // []) builds as a dyn ARRAY — one dyn value whose elements each
-    // convert through the usual boundary (dynFrom's JSON-safe domain);
-    // an element that cannot convert fences per element. length/index
-    // reads and dynamic consumers ride the keyed-dyn paths. TS literals
-    // take the same build when the slot ITSELF is checked-dynamic — an
-    // `unknown[]` annotation or a collapsed `(string | object)[]` maps
-    // to DYN wholesale now (mapType's dyn-element array rule), so the
-    // literal IS the dyn array.
-    if (
-      isJsSourceFile(expr.getSourceFile()) ||
-      mapped?.kind === "dyn" ||
-      lowerer.checkerAnyArray(expr)
-    ) {
-      if (expr.elements.nodes.some(ts.isSpreadElement)) {
-        // Native collection drains return vectors of retained dyn
-        // elements. Reuse the ordinary spread builder, then expose the
-        // resulting array through the established unknown[] representation.
-        const vector = lowerArrayLiteral(lowerer, expr, arrayOf(DYN) as IrType & { kind: "array" });
-        return lowerer.coerceInto(expr, vector, DYN);
-      }
-      const elems = expr.elements.nodes.map((el): IrExpr => {
-        if (ts.isSpreadElement(el)) {
-          lowerer.unsupported(
-            "SC1090",
-            el,
-            "spread elements in a dynamic (unknown[]) array literal",
-          );
-        }
-        const v = lowerer.coerceToExpected(lowerer.lowerExpr(el), DYN);
-        if (v.type.kind !== "dyn") {
-          lowerer.unsupported(
-            "SC1101",
-            el,
-            `holding '${lowerer.fmt(v.type)}' values in a dynamic (unknown[]) array literal`,
-          );
-        }
-        return v;
-      });
-      return { kind: "dynArrLit", elems, type: DYN, loc };
-    }
-    lowerer.badType(expr, tsType);
-  }
-  let type = mapped as IrType & { kind: "array" };
-  // An inferred array of records takes the layout of an element literal
-  // whose fields widened for missing-element reads; the other elements
-  // build that layout directly. An explicit destination keeps its own.
-  if (!expected && type.elem.kind === "record") {
-    let variant: IrType | null = null;
-    for (const candidate of expr.elements.nodes) {
-      let x: ts.Expression = candidate;
-      while (ts.isParenthesizedExpression(x)) x = x.expression;
-      if (!ts.isObjectLiteralExpression(x)) continue;
-      const probe = tryLowerExpression(lowerer, x);
-      if (!probe || !lowerer.isRuntimeOptionalRecordVariant(probe.type, type.elem)) continue;
-      if (variant !== null && !typeEquals(variant, probe.type)) {
-        variant = null;
-        break;
-      }
-      variant = probe.type;
-    }
-    if (variant !== null) type = arrayOf(variant) as IrType & { kind: "array" };
-  }
-  // Keep the array payload type fixed. Optional reads are stored through
-  // arrayValueStore, which records UNDEFINED in the state byte while the
-  // payload remains number/string/etc.; widening the array element here
-  // would force boxed union storage and change aliases.
-  const spreads: number[] = [];
-  const holes = new Set<number>();
-  const runtimeOptionalElements = new Set<number>();
-  let needsStateBuild = false;
-  for (let i = 0; i < expr.elements.nodes.length; i++) {
-    const candidate = expr.elements.nodes[i]!;
-    if (ts.isSpreadElement(candidate) || ts.isOmittedExpression(candidate)) continue;
-    const probe = tryLowerExpression(lowerer, candidate);
-    if (probe && lowerer.runtimeOptionalWidening(probe.type, type.elem) !== null) {
-      runtimeOptionalElements.add(i);
-      needsStateBuild = true;
-    }
-  }
-  const elems: IrExpr[] = expr.elements.nodes.map((el, i): IrExpr => {
-    if (ts.isSpreadElement(el)) {
-      // `[...xs, b]`: xs must be an array of the literal's own element
-      // type — its elements copy in at construction (a fresh array,
-      // JS-exact). Iterables that aren't arrays (strings, Sets, Maps)
-      // and mismatched element types stay fenced. A TERNARY source gets
-      // the literal's own type as its expected type (the conditional-
-      // spread idiom — tsc surfaces no contextual type through spreads,
-      // and the arm literals must BUILD as this element type).
-      let srcNode: ts.Expression = el.expression;
-      while (ts.isParenthesizedExpression(srcNode)) srcNode = srcNode.expression;
-      lowerer.fenceStaticHeadersIteration(el.expression);
-      let src = ts.isConditionalExpression(srcNode)
-        ? lowerTernary(lowerer, srcNode, type)
-        : lowerer.lowerExpr(el.expression);
-      src = lowerCollectionSpread(lowerer, src, el.expression) ?? src;
-      // `[...new SymbolIterator]`: a CLASS ITERABLE drains through its
-      // own protocol into a fresh element array (classIteratorDrainCall
-      // — an infinite iterator loops forever, exactly Node), and the
-      // spread machinery copies like any array source.
-      if (src.type.kind === "object") {
-        const drained = lowerer.classIteratorDrainCall(src, locOf(el), type.elem);
-        if (drained) src = drained;
-      }
-      // `[...s]` on a STRING spreads its code-point characters (the
-      // string iterator's walk — astral chars whole) through the same
-      // interned helper as Array.from(s); the result rides the array
-      // machinery below like any string[] source.
-      if (src.type.kind === "string") {
-        src = strCharsCall(lowerer, src, locOf(el));
-      }
-      // `[...typedArray]`: represented typed arrays are dense numeric
-      // iterables, so drain their elements into the fresh number[] that
-      // the surrounding array literal will copy. In particular this is
-      // the Uint8Array-to-Array bridge (`[...u8]`), with element values
-      // read rather than backing bytes for the wider typed-array kinds.
-      if (src.type.kind === "bytes") {
-        src = {
-          kind: "bytesIntrinsic",
-          method: "toArray",
-          receiver: src,
-          args: [],
-          type: arrayOf(F64),
-          loc: locOf(el),
-        };
-      }
-      // `[...it]` over a generator (or an iterator adapted into one):
-      // drain it once, in order, into a fresh element array.
-      if (src.type.kind === "generator") {
-        const drained = generatorDrain(lowerer, src, type.elem, locOf(el));
-        if (drained) src = drained;
-      }
-      // `[...sp]` and `[...sp.entries()]` over a URLSearchParams: its
-      // checked-dynamic view iterates the live pair list, and the drained
-      // [name, value] pairs convert to the literal's tuple elements.
-      const searchParamsSource = isSearchParamsIterable(lowerer, el.expression);
-      if (src.type.kind === "searchParams") src = lowerer.coerceInto(el.expression, src, DYN);
-      // A native checked iterable can supply scalar elements even when
-      // the checker inferred a typed array from its producer. Drain once
-      // and validate the elements before the ordinary spread copy.
-      if (
-        src.type.kind === "dyn" &&
-        (type.elem.kind === "dyn" ||
-          type.elem.kind === "f64" ||
-          type.elem.kind === "string" ||
-          type.elem.kind === "bool" ||
-          searchParamsSource)
-      ) {
-        src = lowerer.coerceInto(el.expression, checkedIteratorPack(lowerer, src, locOf(el)), type);
-      }
-      // A same-family array whose ELEMENT lifts (string[] into a
-      // (string | symbol)[] literal — per-element wrap/width copy):
-      // the interned width helper reshapes before the spread copies.
-      if (src.type.kind === "array" && !typeEquals(src.type, type)) {
-        const w = lowerer.widthCoerce(src, type);
-        if (w) src = w;
-      }
-      if (!typeEquals(src.type, type)) {
-        lowerer.unsupported(
-          "SC1090",
-          el,
-          `spreading '${lowerer.fmt(src.type)}' into a '${lowerer.fmt(type)}' literal (only a same-element-type array spreads)`,
-        );
-      }
-      spreads.push(i);
-      return src;
-    }
-    // A HOLE (`[,]` — an elision) remains absent. Ordinary reads still
-    // answer undefined, while presence-sensitive methods and concat keep
-    // the hole. The state-building path below advances length without
-    // writing a value into this slot.
-    if (ts.isOmittedExpression(el)) {
-      needsStateBuild = true;
-      holes.add(i);
-      return { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc: locOf(el) };
-    }
-    // An ARRAY-LITERAL element under a UNION element slot whose own type
-    // has no lift into the slot builds against the union's single array
-    // arm instead (`['pwd', []]` as (string | string[])[] — tsc pushes no
-    // contextual type through the unannotated chain, so the empty nested
-    // literal types never[], whose f64-element representation re-tags
-    // into nothing). One array arm is unambiguous — the union-slot rule's
-    // stance; several keep the fence.
-    if (type.elem.kind === "union" || type.elem.kind === "array") {
-      let x: ts.Expression = el;
-      while (ts.isParenthesizedExpression(x)) x = x.expression;
-      if (ts.isArrayLiteralExpression(x)) {
-        const ownT = lowerer.mapTypeOf(lowerer.checker.getContextualType(x) ?? lowerer.typeOf(x));
-        if (ownT === null || lowerer.widthLiftPlan(ownT, type.elem) === null) {
-          // An ARRAY-typed slot takes the literal directly; a union slot
-          // routes through its single array arm and wraps.
-          if (type.elem.kind === "array") {
-            return lowerer.lowerArrayLiteral(x, type.elem);
-          }
-          const def = lowerer.unions.get(type.elem.unionId);
-          const arrayArms = def?.arms.filter((a) => a.kind === "array") ?? [];
-          if (arrayArms.length === 1) {
-            const built = lowerer.lowerArrayLiteral(x, arrayArms[0] as IrType & { kind: "array" });
-            return lowerer.coerceInto(el, built, type.elem);
-          }
-        }
-      }
-    }
-    // Elements flow into the element slot like an assignment: union
-    // elements wrap plain arm values (`[1, "a"]` as (number | string)[]),
-    // holes reject inside lowerExpr.
-    let lowered: IrExpr;
-    const directOptionalCandidate =
-      runtimeOptionalElements.has(i) ||
-      ts.isElementAccessExpression(el) ||
-      (ts.isCallExpression(el) &&
-        ts.isPropertyAccessExpression(el.expression) &&
-        (el.expression.name.text === "pop" || el.expression.name.text === "shift"));
-    if (directOptionalCandidate) {
-      const raw = lowerer.lowerExpr(el);
-      if (!typeEquals(raw.type, type.elem)) {
-        needsStateBuild = true;
-        return raw;
-      }
-      lowered = raw;
-    } else {
-      lowered = lowerer.lowerExprExpecting(el, type.elem);
-    }
-    if (!typeEquals(lowered.type, type.elem)) lowerer.badType(el, lowerer.typeOf(el));
-    return lowered;
-  });
-  if (!needsStateBuild) {
-    return { kind: "arrayLit", elems, ...(spreads.length > 0 ? { spreads } : {}), type, loc };
-  }
-  const out = lowerer.declareHiddenLocal("%arrayLit", type);
-  const outRef = varRef(out.id, type, loc);
-  // Dense capacity for the elements the statements below store.
-  const capacity = Math.min(elems.length - spreads.length, 1024);
-  const body: IrStmt[] = [
-    {
-      kind: "varDecl",
-      localId: out.id,
-      init: {
-        kind: "arrayLit",
-        elems: [],
-        ...(capacity > 0 ? { capacity } : {}),
-        type,
-        loc,
-      },
-      loc,
-    },
-  ];
-  const spreadSet = new Set(spreads);
-  const currentLength = (): IrExpr => ({
-    kind: "arrIntrinsic",
-    method: "length",
-    receiver: outRef,
-    args: [],
-    type: F64,
-    loc,
-  });
-  const nextLength = (): IrExpr => ({
-    kind: "bin",
-    op: "+",
-    left: currentLength(),
-    right: { kind: "numLit", value: 1, type: F64, loc },
-    type: F64,
-    loc,
-  });
-  for (let i = 0; i < elems.length; i++) {
-    const el = elems[i]!;
-    if (spreadSet.has(i)) {
-      body.push({
-        kind: "exprStmt",
-        expr: {
-          kind: "arrIntrinsic",
-          method: "pushSpread",
-          receiver: outRef,
-          args: [el],
-          type: F64,
-          loc,
-        },
-        loc,
-      });
-      continue;
-    }
-    if (holes.has(i)) {
-      body.push({ kind: "arraySetLength", arr: outRef, length: nextLength(), loc });
-      continue;
-    }
-    let value = el;
-    if (!typeEquals(value.type, type.elem)) {
-      const temp = lowerer.declareHiddenLocal("%arrayValue", value.type);
-      body.push({ kind: "varDecl", localId: temp.id, init: value, loc });
-      value = varRef(temp.id, temp.type, loc);
-    }
-    body.push(arrayValueStore(lowerer, outRef, currentLength(), value, type.elem, loc));
-  }
-  return {
-    kind: "seqExpr",
-    stmts: body,
-    result: outRef,
-    type,
-    loc,
-  };
-}
-
-/** Build a fixed tuple from positional elements and fixed tuple spreads.
- * Capture each value in source order: deferring the reads until recordLit
- * would observe a later element's mutations of the spread source. */
-function lowerTupleSpreadLiteral(
-  lowerer: Lowerer,
-  expr: ts.ArrayLiteralExpression,
-  type: IrType & { kind: "record" },
-  shape: IrRecordShape,
-): IrExpr {
-  const loc = locOf(expr);
-  const byName = new Map(shape.fields.map((field) => [field.name, field.type]));
-  const stmts: IrStmt[] = [];
-  const fields: { name: string; value: IrExpr }[] = [];
-  const append = (node: ts.Expression, value: IrExpr): void => {
-    const name = String(fields.length);
-    const expected = byName.get(name);
-    if (!expected) lowerer.badType(expr, lowerer.typeOf(expr));
-    const coerced = lowerer.coerceInto(node, value, expected);
-    const temp = lowerer.declareHiddenLocal("%tupleElement", expected);
-    const at = locOf(node);
-    stmts.push({ kind: "varDecl", localId: temp.id, init: coerced, loc: at });
-    fields.push({ name, value: varRef(temp.id, expected, at) });
-  };
-  for (const element of expr.elements.nodes) {
-    if (!ts.isSpreadElement(element)) {
-      const expected = byName.get(String(fields.length));
-      if (!expected) lowerer.badType(element, lowerer.typeOf(element));
-      append(element, lowerer.lowerExprExpecting(element, expected));
-      continue;
-    }
-    const source = lowerer.lowerExpr(element.expression);
-    const sourceShape =
-      source.type.kind === "record" ? lowerer.shapes.get(source.type.shapeId) : undefined;
-    if (!sourceShape?.tuple) {
-      // Empty tuples use a zero-length array representation. Preserve a
-      // producing call's effects even though there are no positions to copy.
-      const sourceTs = lowerer.typeOf(element.expression);
-      if (
-        source.type.kind === "array" &&
-        lowerer.checker.isTupleType(sourceTs) &&
-        lowerer.checker.getTypeArguments(sourceTs as ts.TypeReference).length === 0
-      ) {
-        stmts.push({ kind: "exprStmt", expr: source, loc: locOf(element) });
-        continue;
-      }
-      lowerer.unsupported(
-        "SC1090",
-        element,
-        "spreading a variable-length value into a fixed tuple literal",
-      );
-    }
-    const temp = lowerer.declareHiddenLocal("%tupleSpread", source.type);
-    const at = locOf(element);
-    stmts.push({ kind: "varDecl", localId: temp.id, init: source, loc: at });
-    const receiver = varRef(temp.id, source.type, at);
-    const positions = [...sourceShape.fields].sort((a, b) => Number(a.name) - Number(b.name));
-    for (const field of positions) {
-      append(element.expression, {
-        kind: "recordGet",
-        obj: receiver,
-        shapeId: sourceShape.id,
-        field: field.name,
-        type: field.type,
-        loc: at,
-      });
-    }
-  }
-  if (fields.length !== shape.fields.length) lowerer.badType(expr, lowerer.typeOf(expr));
-  return { kind: "seqExpr", stmts, result: { kind: "recordLit", fields, type, loc }, type, loc };
-}
-
 /** Convert an undefined-armed numeric value at an arithmetic use. Ordinary
  * reads preserve their tagged value; JavaScript's ToNumber(undefined) is NaN,
  * so compounds and binary arithmetic use this checked one-time extraction. */
@@ -6580,1299 +1377,6 @@ export function lowerToNumberArgument(lowerer: Lowerer, node: ts.Expression): Ir
   return lowerer.coerceInto(node, value, F64);
 }
 
-/** `a[i]` reads. Only f64 indices into array receivers are modeled; JS
- * string-key element access (`a["length"]`) and string indexing (`s[0]`
- * typechecks against the lib's index signature; use .charAt) stay out. */
-export function lowerElementAccess(lowerer: Lowerer, expr: ts.ElementAccessExpression): IrExpr {
-  if (isImportMeta(expr.expression)) {
-    const name = lowerer.foldedStringKeyOf(expr.argumentExpression);
-    if (name === null)
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        "import.meta with a runtime-computed key (use a statically-known metadata field)",
-      );
-    return importMetaField(lowerer, expr, name);
-  }
-
-  // `a?.[i]`: the guard lowers as an optional-chain step around the
-  // plain element read below.
-  if (expr.questionDotToken && !lowerer.chainHandled.has(expr)) {
-    return lowerer.lowerOptionalChain(expr);
-  }
-  // `a?.b[i]` — the tail of a chain whose token sits deeper: the whole
-  // tail short-circuits with the guard.
-  if (!expr.questionDotToken && isOptionalChainTail(lowerer, expr)) {
-    return lowerer.lowerOptionalChain(expr);
-  }
-  // Enum accesses in element clothing — `E["A"]` forward reads and
-  // `E[0]` reverse-mapping reads — fold to constants (lower-enums.ts),
-  // claimed before any receiver-kind dispatch can see the enum object.
-  {
-    const en = lowerEnumAccess(lowerer, expr);
-    if (en) return en;
-  }
-  const cachedModule = lowerRequireCacheElement(lowerer, expr);
-  if (cachedModule) return cachedModule;
-  const namespaceElement = lowerModuleNamespaceElement(lowerer, expr);
-  if (namespaceElement) return namespaceElement;
-  // Native Web handles use the same supported surface for bracket and dot
-  // spellings. Fence a statically-known unsupported key before the generic
-  // checked-dynamic element-read path can turn it into a runtime missing
-  // member.
-  lowerer.fenceStaticAbortControllerMemberRead(expr);
-  lowerer.fenceStaticResponseMember(expr, "read");
-  lowerer.fenceStaticHeadersMember(expr, "read");
-  lowerer.fenceStaticReadableStreamMember(expr, "read");
-  // Computed global reads share the stored global object's custom
-  // properties. Symbol keys retain their identity-indexed store.
-  if (!expr.questionDotToken && stdlibGlobalNameOf(lowerer, expr.expression) === "globalThis") {
-    const symbol = globalSymbolKey(lowerer, expr.expression, expr.argumentExpression);
-    if (symbol)
-      return {
-        kind: "libCall",
-        fn: "dyn.globalSymbolGet",
-        args: [symbol],
-        type: DYN,
-        loc: locOf(expr),
-      };
-    const key = lowerer.lowerExpr(expr.argumentExpression);
-    const name: IrExpr =
-      key.type.kind === "string"
-        ? key
-        : {
-            kind: "libCall",
-            fn: "dyn.toStringCoerce",
-            args: [lowerer.coerceInto(expr.argumentExpression, key, DYN)],
-            type: STRING,
-            loc: locOf(expr),
-          };
-    return {
-      kind: "dynKeyGet",
-      value: lowerGlobalValue(lowerer, expr.expression),
-      key: name,
-      type: DYN,
-      loc: locOf(expr),
-    };
-  }
-  // `req.headers["x-name"]` — the computed twin of `req.headers.host`
-  // (the server spoke owns both; the envGet precedent).
-  {
-    const header = lowerer.lowerHttpHeadersElement(expr);
-    if (header) return lowerer.maybeNarrow(header, expr);
-  }
-  // `process.env[expr]` — the computed twin of `process.env.NAME`; both
-  // lower to the ONE process.envGet intrinsic. The read narrows like any
-  // union-typed expression when the checker narrowed this occurrence.
-  if (lowerer.isProcessEnv(expr.expression)) {
-    const key = lowerEnvironmentKey(lowerer, expr.argumentExpression);
-    if (key.type.kind !== "string") {
-      lowerer.unsupported(
-        "SC1090",
-        expr.argumentExpression,
-        "indexing process.env with non-string keys",
-      );
-    }
-    const get: IrExpr = {
-      kind: "libCall",
-      fn: "process.envGet",
-      args: [key],
-      type: lowerer.envValueType(),
-      loc: locOf(expr),
-    };
-    return lowerer.maybeNarrow(get, expr);
-  }
-  // Expando function members in element clothing (`foo[strMem]`,
-  // `foo[_private]` where foo is a module-level function/callable const
-  // and the key folds or is a unique-symbol const): the member's module
-  // global — the dotted read's twin (lower-expando.ts).
-  {
-    const ex = expandoMemberRead(lowerer, expr);
-    if (ex) return lowerer.maybeNarrow(ex, expr);
-  }
-  // Symbol-keyed property READS (`this[kLimit]`): when the key is a
-  // statically-resolvable symbol declared as a field of the receiver's
-  // class (classSymbolKeyOf — the countdown.js/OpenTUI idioms), the
-  // read IS an ordinary field read of the hidden slot. Every other
-  // symbol key stays fenced: record shapes, runtime-identity keys
-  // (symbol parameters, reassigned bindings), and keys no class declares
-  // — the layouts are compile-time field lists.
-  if (lowerer.mapTypeOf(lowerer.typeOf(expr.argumentExpression))?.kind === "symbol") {
-    const target = symbolFieldTarget(lowerer, expr);
-    if (target) return lowerer.maybeNarrow(lowerer.fieldGetExpr(target, locOf(expr), expr), expr);
-    let receiver = lowerer.lowerExpr(expr.expression);
-    const classInfo =
-      receiver.type.kind === "classval" ? lowerer.classes.get(receiver.type.className) : undefined;
-    if (
-      receiver.type.kind === "func" ||
-      receiver.type.kind === "generator" ||
-      ((receiver.type.kind === "array" ||
-        receiver.type.kind === "string" ||
-        receiver.type.kind === "bytes") &&
-        lowerer.dynConvertible(receiver.type)) ||
-      (receiver.type.kind === "object" && lowerer.dynConvertible(receiver.type)) ||
-      isDynTypedRefType(receiver.type) ||
-      (classInfo && (classInfo.callableBase || hasRuntimeStatics(classInfo))) ||
-      ((receiver.type.kind === "map" || receiver.type.kind === "set") &&
-        lowerer.dynConvertible(receiver.type))
-    ) {
-      const fnName = jsFuncNameOf(expr.expression);
-      receiver = {
-        kind: "dynFrom",
-        value: receiver,
-        type: DYN,
-        loc: locOf(expr),
-        ...(fnName !== null ? { fnName } : {}),
-      };
-    }
-    if (receiver.type.kind === "dyn") {
-      const key = lowerer.lowerExprExpecting(expr.argumentExpression, DYN);
-      return lowerer.maybeNarrow(
-        { kind: "dynKeyGet", value: receiver, key, type: DYN, loc: locOf(expr) },
-        expr,
-      );
-    }
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      "symbol-keyed property access outside class fields keyed by a stable module-level literal Symbol()/Symbol.for() (other static shapes have no symbol-keyed storage)",
-    );
-  }
-  // A never-tainted JS receiver type (neverTaintedJsType — `cmd[1]` on
-  // `const cmd = ['pwd', []]`, whose binding lowered checked-dynamic)
-  // dispatches as unmapped so the dyn-receiver branch below reads
-  // through the checked-dynamic tree instead of dynChecking into never's f64 residue.
-  let receiverIr = neverTaintedJsType(lowerer, expr.expression, lowerer.typeOf(expr.expression))
-    ? null
-    : lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
-  if (isJsSourceFile(expr.getSourceFile())) {
-    const receiver = tryLowerExpression(lowerer, expr.expression);
-    if (receiver?.type.kind === "dyn") {
-      const key = lowerer.lowerExprExpecting(expr.argumentExpression, DYN);
-      const optional = hasOptionalChainGuard(expr.expression);
-      return lowerer.maybeNarrow(
-        {
-          kind: "dynKeyGet",
-          value: receiver,
-          key,
-          ...(optional ? { optional: true as const } : {}),
-          type: DYN,
-          loc: locOf(expr),
-        },
-        expr,
-      );
-    }
-    if (receiver?.type.kind === "func" && lowerer.dynConvertible(receiver.type)) {
-      const loc = locOf(expr);
-      const fnName = jsFuncNameOf(expr.expression);
-      const boxed: IrExpr = {
-        kind: "dynFrom",
-        value: receiver,
-        type: DYN,
-        loc,
-        ...(fnName !== null ? { fnName } : {}),
-      };
-      const key = lowerer.lowerExprExpecting(expr.argumentExpression, DYN);
-      return lowerer.maybeNarrow({ kind: "dynKeyGet", key, value: boxed, type: DYN, loc }, expr);
-    }
-    if (receiver?.type.kind === "array" || receiver?.type.kind === "bytes")
-      receiverIr = receiver.type;
-    if (receiver?.type.kind === "union") {
-      const present = lowerer.stripUndefinedArm(receiver.type);
-      if (present.kind === "array" || present.kind === "bytes") receiverIr = present;
-    }
-  }
-  // A readonly tuple union under Array.isArray is checker-typed as an
-  // intersection with any[], whose structural mapping is not the tuple
-  // shape. maybeNarrow on the receiver uses the runtime tag proof to
-  // extract the one array-valued arm; dispatch element access from that
-  // lowered representation, like the existing any[] array-method path.
-  const checkerArray = lowerer.checkerArrayValue(expr.expression);
-  if (checkerArray) receiverIr = checkerArray.type;
-  if (receiverIr?.kind === "object") {
-    const key =
-      recordKeyLiteralText(expr.argumentExpression) ??
-      recordKeyTypeLiteralText(lowerer, expr.argumentExpression);
-    if (key !== null) {
-      const target = classFieldTarget(lowerer, expr.expression, receiverIr, key);
-      if (target) return lowerer.maybeNarrow(lowerer.fieldGetExpr(target, locOf(expr), expr), expr);
-    }
-    if (receiverIr.className === "%Error" || isDynTypedRefType(receiverIr)) {
-      const receiver = lowerer.coerceToExpected(lowerer.lowerExpr(expr.expression), DYN);
-      const key = lowerer.lowerExprExpecting(expr.argumentExpression, DYN);
-      return lowerer.maybeNarrow(
-        { kind: "dynKeyGet", value: receiver, key, type: DYN, loc: locOf(expr) },
-        expr,
-      );
-    }
-  }
-
-  // Typed-array element read `b[i]` — like arrayGet with a scalar
-  // result; any invalid index traps (the array discipline; JS would
-  // read undefined — divergence 4's policy).
-  if (receiverIr?.kind === "bytes") {
-    let recv = lowerer.lowerExpr(expr.expression);
-    if (recv.type.kind === "dyn") recv = lowerer.coerceInto(expr.expression, recv, receiverIr);
-    if (recv.type.kind === "union" && lowerer.armTag(recv.type.unionId, UNDEFINED_T) >= 0) {
-      const present = lowerer.stripUndefinedArm(recv.type);
-      const helper =
-        present.kind === "bytes"
-          ? lowerer.narrowedArmHelper(recv.type.unionId, present, locOf(expr.expression))
-          : null;
-      recv = helper
-        ? lowerer.checkedNarrowCall(helper, recv, present, locOf(expr.expression))
-        : lowerer.maybeNarrow(recv, expr.expression);
-    }
-
-    const index = lowerOptionalNumber(
-      lowerer,
-      lowerer.lowerExpr(expr.argumentExpression),
-      locOf(expr.argumentExpression),
-      expr.argumentExpression,
-    );
-    if (isJsSourceFile(expr.getSourceFile()) && recv.type.kind === "bytes") {
-      return {
-        kind: "dynKeyGet",
-        value: lowerer.coerceInto(expr.expression, recv, DYN),
-        key:
-          index.type.kind === "f64"
-            ? { kind: "toString", operand: index, type: STRING, loc: locOf(expr) }
-            : index,
-        type: DYN,
-        loc: locOf(expr),
-      };
-    }
-    if (index.type.kind === "dyn" && recv.type.kind === "bytes") {
-      return {
-        kind: "dynKeyGet",
-        value: lowerer.coerceInto(expr.expression, recv, DYN),
-        key: index,
-        type: DYN,
-        loc: locOf(expr),
-      };
-    }
-    if (index.type.kind !== "f64") {
-      lowerer.unsupported("SC1090", expr.argumentExpression, "indexing with non-number keys");
-    }
-    // `t[i]!` asserts presence: the numeric element read (NaN when
-    // invalid). Every other read answers undefined for an invalid index,
-    // like Node.
-    // A read whose every consumer treats undefined like NaN (see
-    // nan-coded-reads.ts) is the same plain numeric read.
-    if (
-      (ts.isNonNullExpression(expr.parent) && expr.parent.expression === expr) ||
-      lowerer.nanCodedReads?.isNumericRead(expr) === true
-    ) {
-      return {
-        kind: "bytesIntrinsic",
-        method: "get",
-        receiver: recv,
-        args: [index],
-        type: F64,
-        loc: locOf(expr),
-        invalidNaN: true,
-      };
-    }
-    return lowerSafeBytesRead(lowerer, recv, index, locOf(expr));
-  }
-  // Tuple element read `t[0]`: a positional-field read of the tuple's
-  // record shape — LITERAL indices only (the checker's per-index types
-  // are what make the read honest; a dynamic index over a heterogeneous
-  // shape has no single element type). Narrows like any field read.
-  if (receiverIr?.kind === "record") {
-    const shape = lowerer.shapes.get(receiverIr.shapeId);
-    if (shape?.tuple) {
-      let obj = lowerer.lowerExpr(expr.expression);
-
-      if (obj.type.kind === "dyn") {
-        // Object.entries over a checked value stores each pair in the
-        // dynamic tree even when the checker names a tuple type.
-        const key = lowerRecordPropertyKey(
-          lowerer,
-          lowerer.lowerExpr(expr.argumentExpression),
-          expr.argumentExpression,
-        );
-        const optional = hasOptionalChainGuard(expr.expression);
-        return lowerer.maybeNarrow(
-          {
-            kind: "dynKeyGet",
-            value: obj,
-            key,
-            ...(optional ? { optional: true as const } : {}),
-            type: DYN,
-            loc: locOf(expr),
-          },
-          expr,
-        );
-      }
-      if (obj.type.kind === "union" && lowerer.armTag(obj.type.unionId, UNDEFINED_T) >= 0) {
-        // The checker sees the outer `arrays[i]` as a tuple when
-        // noUncheckedIndexedAccess is disabled, but the lowered read is
-        // still tuple | undefined. A nested tuple field must validate the
-        // outer tag before recordGet; an unchecked unionNarrow would let a
-        // missing outer element reach the record backend as a bad pointer.
-        const present = lowerer.stripUndefinedArm(obj.type);
-        const helper =
-          present.kind === "record"
-            ? lowerer.narrowedArmHelper(obj.type.unionId, present, locOf(expr.expression))
-            : null;
-        obj = helper
-          ? lowerer.checkedNarrowCall(helper, obj, present, locOf(expr.expression))
-          : lowerer.maybeNarrow(obj, expr.expression);
-      }
-      const idx = tupleLiteralIndex(expr.argumentExpression);
-      if (idx === null) {
-        lowerer.unsupported(
-          "SC1090",
-          expr.argumentExpression,
-          "tuple indexing with a non-literal index (tuples are fixed-shape — use t[0], t[1], ...)",
-        );
-      }
-      const shapeId = obj.type.kind === "record" ? obj.type.shapeId : receiverIr.shapeId;
-      const actualShape = lowerer.shapes.get(shapeId) ?? shape;
-      const fieldType = actualShape.fields.find((f) => f.name === String(idx))?.type;
-      if (fieldType === undefined) lowerer.badType(expr, lowerer.typeOf(expr)); // OOB smuggled past tsc
-      const get: IrExpr = {
-        kind: "recordGet",
-        obj,
-        shapeId,
-        field: String(idx),
-        type: fieldType,
-        loc: locOf(expr),
-      };
-      return lowerer.isRuntimeOptionalField(shapeId, String(idx))
-        ? get
-        : lowerer.maybeNarrow(get, expr);
-    }
-    if (shape && !shape.tuple) {
-      return lowerer.lowerRecordKeyRead(expr, receiverIr.shapeId, shape);
-    }
-  }
-  // `pkg["k"]` / `scripts[name]` / `scopeMatch[1]` on a dyn receiver (a
-  // JSON.parse result): the dyn keyed read, exactly the dot form.
-  // NUMBER-typed indices convert through ToString first — JS property
-  // keys are strings, and the canonical number text answers array
-  // indices in the helper (fractions, negatives, and NaN read as
-  // absent keys, exactly JS). An UNMAPPABLE checker type takes the
-  // same path when the receiver LOWERS dyn
-  // (`pkg.workspaces.packages["0"]` — the lowering world types the
-  // unknown-rooted chain `any`); a non-dyn lowering falls through to
-  // the fences below (re-lowering is pure IR construction).
-  if (receiverIr?.kind === "dyn" || receiverIr?.kind === "union" || receiverIr === null) {
-    const obj = lowerer.lowerExpr(expr.expression);
-    // A generic mapped type can stay unresolved at this body use even
-    // though its instantiated parameter has a concrete record ABI.
-    // Dispatch from that stored shape, as the array fallback below does.
-    if (receiverIr === null && obj.type.kind === "record") {
-      const shape = lowerer.shapes.get(obj.type.shapeId);
-      const index = tupleLiteralIndex(expr.argumentExpression);
-      const field =
-        shape?.tuple && index !== null
-          ? shape.fields.find((field) => field.name === String(index))
-          : null;
-      if (field)
-        return lowerer.maybeNarrow(
-          {
-            kind: "recordGet",
-            obj,
-            shapeId: obj.type.shapeId,
-            field: field.name,
-            type: field.type,
-            loc: locOf(expr),
-          },
-          expr,
-        );
-      if (shape && !shape.tuple) {
-        return lowerer.lowerRecordKeyRead(expr, obj.type.shapeId, shape);
-      }
-    }
-    if (
-      obj.type.kind === "dyn" ||
-      (obj.type.kind === "object" && obj.type.className === "%Error") ||
-      isDynTypedRefType(obj.type)
-    ) {
-      const rawKey = lowerer.lowerExpr(expr.argumentExpression);
-      // Number, bool, and DYN keys stringify (ToPropertyKey) — the
-      // dyn-keyed read `catchWarning[warning.name]` where the property
-      // chain itself lowered dyn.
-      const key =
-        rawKey.type.kind === "dyn" ||
-        rawKey.type.kind === "symbol" ||
-        (rawKey.type.kind === "union" && lowerer.dynConvertible(rawKey.type))
-          ? lowerer.coerceToExpected(rawKey, DYN)
-          : lowerRecordPropertyKey(lowerer, rawKey, expr.argumentExpression);
-      if (key.type.kind === "string" || key.type.kind === "dyn") {
-        const opt = hasOptionalChainGuard(expr.expression);
-        return lowerer.maybeNarrow(
-          {
-            kind: "dynKeyGet",
-            key,
-            ...(opt ? { optional: true as const } : {}),
-            value: lowerer.coerceToExpected(obj, DYN),
-            type: DYN,
-            loc: locOf(expr),
-          },
-          expr,
-        );
-      }
-    }
-    // A checker-`any` receiver that LOWERS to a static ARRAY
-    // (`pm.split("@")[0]` — the dyn-receiver string machinery answers
-    // string[]): the element read rides the ordinary array path on the
-    // lowered value (invalid indices trap, divergence 4's policy).
-    if (obj.type.kind === "array") {
-      const index = lowerer.lowerExpr(expr.argumentExpression);
-      if (index.type.kind === "f64") {
-        const safe = lowerSafeIndexRead(lowerer, obj, index, locOf(expr));
-        if (safe) return safe;
-        return lowerer.maybeNarrow(
-          { kind: "arrayGet", arr: obj, index, type: obj.type.elem, loc: locOf(expr) },
-          expr,
-        );
-      }
-    }
-  }
-  // `env[key]` on a UNION of record shapes (`ProcessEnv | Record<string,
-  // string>` — the env-bag parameter pattern): the per-arm keyed read,
-  // joined exactly like the dot form (lowerUnionProperty's keyed path).
-  if (receiverIr?.kind === "union") {
-    const value = lowerer.lowerExpr(expr.expression);
-    if (value.type.kind === "union") {
-      const key = lowerer.lowerExpr(expr.argumentExpression);
-      if (key.type.kind === "f64") {
-        const def = lowerer.unions.get(value.type.unionId);
-        const presentArms = def?.arms.filter((arm) => !isUnitType(arm)) ?? [];
-        if (presentArms.length === 1 && presentArms[0]?.kind === "string") {
-          const property = runtimeOptionalElementKey(expr.argumentExpression);
-          const receiver =
-            property === null
-              ? null
-              : lowerer.runtimeOptionalPropertyReceiver(expr.expression, value, STRING, property);
-          if (receiver !== null) {
-            return {
-              kind: "strIntrinsic",
-              method: "charAt",
-              receiver,
-              args: [key],
-              type: STRING,
-              loc: locOf(expr),
-            };
-          }
-        }
-      }
-      if (key.type.kind === "string" || key.type.kind === "f64") {
-        const lit = ts.isStringLiteral(expr.argumentExpression)
-          ? expr.argumentExpression.text
-          : null;
-        const keyed = lowerUnionKeyedRead(lowerer, expr, value.type.unionId, value, key, lit);
-        if (keyed) return lowerer.maybeNarrow(keyed, expr);
-      }
-    }
-  }
-  if (receiverIr?.kind !== "array") {
-    {
-      const receiver = tryLowerExpression(lowerer, expr.expression);
-      if (
-        receiver?.type.kind === "dyn" ||
-        (receiver &&
-          isJsSourceFile(expr.getSourceFile()) &&
-          (receiver.type.kind === "union" || receiver.type.kind === "bytes") &&
-          lowerer.dynConvertible(receiver.type))
-      ) {
-        const key = lowerRecordPropertyKey(
-          lowerer,
-          lowerer.lowerExpr(expr.argumentExpression),
-          expr.argumentExpression,
-        );
-        return lowerer.maybeNarrow(
-          {
-            kind: "dynKeyGet",
-            value: lowerer.coerceInto(expr.expression, receiver, DYN),
-            key,
-            type: DYN,
-            loc: locOf(expr),
-          },
-          expr,
-        );
-      }
-      if (
-        receiver?.type.kind === "func" &&
-        canBoxFuncIntoDyn(
-          receiver.type,
-          (id) => lowerer.shapes.get(id),
-          (id) => lowerer.unions.get(id),
-        )
-      ) {
-        const key = lowerRecordPropertyKey(
-          lowerer,
-          lowerer.lowerExpr(expr.argumentExpression),
-          expr.argumentExpression,
-        );
-        if (key.type.kind === "string") {
-          const boxed: IrExpr = {
-            kind: "dynFrom",
-            value: receiver,
-            type: DYN,
-            loc: locOf(expr.expression),
-          };
-          return lowerer.maybeNarrow(
-            { kind: "dynKeyGet", key, value: boxed, type: DYN, loc: locOf(expr) },
-            expr,
-          );
-        }
-      }
-    }
-    if (receiverIr?.kind === "string") {
-      // An indexed string property is absent for non-integer and missing
-      // indexes. charAt has different coercion and out-of-range semantics.
-      const recv = lowerer.lowerExpr(expr.expression);
-      const index = lowerOptionalNumber(
-        lowerer,
-        lowerer.lowerExpr(expr.argumentExpression),
-        locOf(expr.argumentExpression),
-        expr.argumentExpression,
-      );
-      if (index.type.kind === "f64" && recv.type.kind === "string") {
-        // A proven in-bounds integer index always names a code unit, where
-        // charAt and the property read agree.
-        if (lowerer.stringIndexBounds.inBounds(expr))
-          return {
-            kind: "strIntrinsic",
-            method: "charAt",
-            receiver: recv,
-            args: [index],
-            type: STRING,
-            loc: locOf(expr),
-          };
-        return lowerOptionalStringIndex(
-          lowerer,
-          recv,
-          index,
-          lowerer.withUndefinedArm(STRING),
-          locOf(expr),
-        );
-      }
-      // The checker narrowed the receiver to string, but its stored value
-      // is still the union (an array-derived binding, a typeof guard).
-      if (index.type.kind === "f64") {
-        const read = lowerUnionStringIndex(
-          lowerer,
-          recv,
-          index,
-          expr.argumentExpression,
-          lowerer.withUndefinedArm(STRING),
-          locOf(expr),
-        );
-        if (read) return read;
-      }
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        "string indexing with this index/result shape (expected a number index and a string or string | undefined result)",
-      );
-    }
-    lowerer.unsupported("SC1090", expr, "element access on non-array values");
-  }
-  let arr = lowerer.lowerExpr(expr.expression);
-  const runtimeOptionalSource = lowerer.runtimeOptionalSourceValue(expr.expression, arr);
-  if (
-    runtimeOptionalSource?.kind === "varRef" &&
-    runtimeOptionalSource.type.kind === "union" &&
-    arr.type.kind === "array"
-  ) {
-    // lowerer.lowerElementAccess has already recognized a captured
-    // array | undefined receiver and supplied its checked extraction as
-    // the expression override. Rebuild that check here so a missing
-    // receiver throws the member-access error Node exposes, rather than
-    // the generic target-union narrowing error. The stored receiver is a
-    // varRef, so both the tag test and extraction read the same value
-    // without repeating an effect.
-    const stored = runtimeOptionalSource;
-    if (stored.type.kind !== "union")
-      throw new InternalCompilerError("runtime-optional array source lost its union storage");
-    const unionId = stored.type.unionId;
-    const undefTag = lowerer.armTag(unionId, UNDEFINED_T);
-    const valueTag = lowerer.armTag(unionId, arr.type);
-    const property = runtimeOptionalElementKey(expr.argumentExpression);
-    if (undefTag >= 0 && valueTag >= 0 && property !== null) {
-      arr = {
-        kind: "ternary",
-        cond: {
-          kind: "unionIsTag",
-          unionId,
-          tag: undefTag,
-          negated: false,
-          value: stored,
-          type: BOOL,
-          loc: locOf(expr.expression),
-        },
-        then: nodeThrowExpr(
-          1,
-          "",
-          `Cannot read properties of undefined (reading '${property}')`,
-          arr.type,
-          locOf(expr.expression),
-        ),
-        else_: {
-          kind: "unionNarrow",
-          unionId,
-          tag: valueTag,
-          value: stored,
-          type: arr.type,
-          loc: locOf(expr.expression),
-        },
-        type: arr.type,
-        loc: locOf(expr.expression),
-      };
-    }
-  }
-  if (
-    arr.type.kind === "union" &&
-    lowerer.armTag(arr.type.unionId, UNDEFINED_T) >= 0 &&
-    receiverIr.kind === "array"
-  ) {
-    // As with tuple receivers above, an unchecked outer read can be
-    // undefined even when the checker reports an array. Extract the
-    // present array arm with a runtime tag check before arrayGet or the
-    // safe indexed-read helper runs.
-    const present = lowerer.stripUndefinedArm(arr.type);
-    const helper =
-      present.kind === "array"
-        ? lowerer.narrowedArmHelper(arr.type.unionId, present, locOf(expr.expression))
-        : null;
-    arr = helper
-      ? lowerer.checkedNarrowCall(helper, arr, present, locOf(expr.expression))
-      : lowerer.maybeNarrow(arr, expr.expression);
-  }
-
-  // The checker sees an array but the VALUE lowered checked-dynamic (a
-  // jsdoc-typed default export from a .js module — signature 14): the
-  // read rides the dynCheck boundary when the array shape is one the checked-dynamic tree
-  // can validate, and fences by name when it is not — an arrayGet over a
-  // dyn receiver is never emitted (the validator ICE).
-  if (arr.type.kind === "dyn") {
-    if (
-      canDynCheckTo(
-        receiverIr,
-        (id) => lowerer.shapes.get(id),
-        (id) => lowerer.unions.get(id),
-      )
-    ) {
-      arr = { kind: "dynCheck", value: arr, type: receiverIr, loc: locOf(expr) };
-    } else {
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        `element access on checked-dynamic values with '${lowerer.fmt(receiverIr)}' elements`,
-      );
-    }
-  }
-  // Array reads can themselves supply an index. A missing numeric value
-  // is undefined, whose property lookup misses just like NaN; keep that
-  // value instead of rejecting a checker-number index with optional IR.
-  const index = lowerOptionalNumber(
-    lowerer,
-    lowerer.lowerExpr(expr.argumentExpression),
-    locOf(expr.argumentExpression),
-    expr.argumentExpression,
-  );
-  if (
-    arr.type.kind === "array" &&
-    (index.type.kind === "dyn" ||
-      (isJsSourceFile(expr.getSourceFile()) &&
-        index.type.kind !== "f64" &&
-        lowerer.dynConvertible(index.type)))
-  ) {
-    return {
-      kind: "dynKeyGet",
-      value: lowerer.coerceToExpected(arr, DYN),
-      key: index,
-      type: DYN,
-      loc: locOf(expr),
-    };
-  }
-  if (index.type.kind !== "f64") {
-    lowerer.unsupported("SC1090", expr.argumentExpression, "indexing with non-number keys");
-  }
-  // The LOWERED receiver's element type wins over the checker's when
-  // both are arrays: a spoke result can be more precise than the
-  // declared surface (emitter.listeners() answers the event's tuple
-  // signature where the .d.ts says Function[], which would flatten the
-  // element to a zero-parameter closure).
-  const elemT = arr.type.kind === "array" ? arr.type.elem : receiverIr.elem;
-  // Every ordinary array read is a JavaScript property read: an invalid
-  // index answers undefined, even when the checker was built without
-  // noUncheckedIndexedAccess. Keep the explicit optional union in the IR
-  // so it can flow through templates, locals, calls, returns, operators,
-  // and narrowing. The helper performs one length/proof check and then
-  // uses the dense getter for the proven-present path, so this does not
-  // change the storage representation or the low-level getter itself.
-  if (arr.type.kind === "array") {
-    // A non-null assertion is the explicit proven-present form. Preserve
-    // the dense getter's established bounds trap where the asserted value
-    // must be the element type (library ABI checks and the catchable
-    // RangeError contract for an out-of-bounds assert). Where undefined is
-    // representable, the assertion keeps JavaScript's unchecked read.
-    const provenPresent =
-      ts.isNonNullExpression(expr.parent) &&
-      expr.parent.expression === expr &&
-      !assertedElementKeepsUndefined(lowerer, expr.parent);
-    if (provenPresent) {
-      return lowerer.maybeNarrow(
-        { kind: "arrayGet", arr, index, type: elemT, loc: locOf(expr) },
-        expr,
-      );
-    }
-    const safe = lowerSafeIndexRead(lowerer, arr, index, locOf(expr));
-    if (safe) return safe;
-  }
-  // --npm-static package files retain the original slice-specific route
-  // for compatibility with package-source inference.
-  if (
-    arr.type.kind === "array" &&
-    arr.kind === "arrIntrinsic" &&
-    arr.method === "slice" &&
-    npmStaticPackageOfPath(expr.getSourceFile().fileName) !== null
-  ) {
-    const safe = lowerSafeIndexRead(lowerer, arr, index, locOf(expr));
-    if (safe) return safe;
-  }
-  // A union-element read narrows like an identifier when the checker has
-  // narrowed THIS occurrence (`if (a[0] !== undefined) use(a[0])` — tsc
-  // narrows literal-index element accesses).
-  return lowerer.maybeNarrow({ kind: "arrayGet", arr, index, type: elemT, loc: locOf(expr) }, expr);
-}
-
-/** A record receiver that an outer keyed read left optional
- * (`nested[a][b]`, where `nested[a]` can miss). The receiver evaluates
- * once into `stmts`; `present` is its record arm, valid only once the
- * access has tested `stable` against the undefined (or, for reads, null)
- * arm. */
-interface OptionalRecordReceiver {
-  stmts: IrStmt[];
-  stable: IrExpr;
-  present: IrExpr;
-  unionId: string;
-  undefTag: number;
-  nullish: "undefined" | "null";
-}
-
-function optionalRecordReceiver(
-  lowerer: Lowerer,
-  value: IrExpr,
-  loc: SrcLoc,
-  allowNull = false,
-): OptionalRecordReceiver | null {
-  if (value.type.kind !== "union") return null;
-  const unionId = value.type.unionId;
-  const arms = lowerer.unions.get(unionId)?.arms;
-  if (arms?.length !== 2) return null;
-  let undefTag = lowerer.armTag(unionId, UNDEFINED_T);
-  let nullish: OptionalRecordReceiver["nullish"] = "undefined";
-  // A null-initialized slot assigned a record later (iconv-lite's
-  // `encodings = null` table, filled on first use): the checker narrows
-  // the read to the record, the storage keeps the null arm.
-  if (undefTag < 0 && allowNull) {
-    undefTag = lowerer.armTag(unionId, NULL_T);
-    nullish = "null";
-  }
-  if (undefTag < 0) return null;
-  const record = arms[1 - undefTag]!;
-  if (record.kind !== "record") return null;
-  const stmts: IrStmt[] = [];
-  const stable = stabilized(lowerer, value, "%recordReceiver", stmts);
-  const present: IrExpr = {
-    kind: "unionNarrow",
-    unionId,
-    tag: lowerer.armTag(unionId, record),
-    value: stable,
-    type: record,
-    loc,
-  };
-  return { stmts, stable, present, unionId, undefTag, nullish };
-}
-
-/** `value`, evaluated once at this point of `out`. */
-function stabilized(lowerer: Lowerer, value: IrExpr, name: string, out: IrStmt[]): IrExpr {
-  if (isSafeToRepeat(value)) return value;
-  const tmp = lowerer.declareHiddenLocal(name, value.type);
-  out.push({ kind: "varDecl", localId: tmp.id, init: value, loc: value.loc });
-  return varRef(tmp.id, value.type, value.loc);
-}
-
-function undefinedReceiver(receiver: OptionalRecordReceiver, loc: SrcLoc): IrExpr {
-  return {
-    kind: "unionIsTag",
-    unionId: receiver.unionId,
-    tag: receiver.undefTag,
-    negated: false,
-    value: receiver.stable,
-    type: BOOL,
-    loc,
-  };
-}
-
-/** Node's TypeError for a keyed read or write on an undefined (or null)
- * receiver. */
-function undefinedReceiverThrow(
-  key: IrExpr,
-  action: "read" | "set",
-  type: IrType,
-  loc: SrcLoc,
-  nullish: OptionalRecordReceiver["nullish"] = "undefined",
-): IrExpr {
-  const head = `Cannot ${action} properties of ${nullish} (${action === "read" ? "reading" : "setting"} '`;
-  const message: IrExpr = {
-    kind: "strConcat",
-    left: {
-      kind: "strConcat",
-      left: { kind: "strLit", value: head, type: STRING, loc },
-      right: key,
-      type: STRING,
-      loc,
-    },
-    right: { kind: "strLit", value: "')", type: STRING, loc },
-    type: STRING,
-    loc,
-  };
-  return {
-    kind: "libCall",
-    fn: "error.nodeThrow",
-    args: [numLit(1, loc), { kind: "strLit", value: "", type: STRING, loc }, message],
-    type,
-    loc,
-  };
-}
-
-/** The receiver and key of a keyed access whose receiver can be undefined,
- * evaluated in order into `stmts`, with the receiver's record arm and the
- * key's property-name string. Null when the receiver is not optional. */
-function guardedRecordAccess(
-  lowerer: Lowerer,
-  access: ts.ElementAccessExpression,
-  rawObj: IrExpr,
-  allowNull = false,
-): { receiver: OptionalRecordReceiver; key: IrExpr; name: IrExpr } | null {
-  const receiver = optionalRecordReceiver(lowerer, rawObj, locOf(access.expression), allowNull);
-  if (!receiver) return null;
-  const keyNode = access.argumentExpression;
-  const litKey = recordKeyLiteralText(keyNode) ?? recordKeyTypeLiteralText(lowerer, keyNode);
-  const key =
-    litKey !== null
-      ? ({ kind: "strLit", value: litKey, type: STRING, loc: locOf(keyNode) } satisfies IrExpr)
-      : stabilized(lowerer, lowerer.lowerExpr(keyNode), "%recordKey", receiver.stmts);
-  // A symbol key names no string property; its message spelling is not
-  // modeled.
-  const name =
-    key.type.kind === "symbol"
-      ? ({ kind: "strLit", value: "Symbol()", type: STRING, loc: locOf(keyNode) } satisfies IrExpr)
-      : lowerRecordPropertyKey(lowerer, key, keyNode);
-  return { receiver, key, name };
-}
-
-/** `nested[a][b] = v` where `nested[a]` can miss: the receiver, the key and
- * the value evaluate in order, then an undefined receiver throws Node's
- * TypeError and a present one takes the write. Only member and identifier
- * receivers are probed, since a probe that finds no optional receiver
- * lowers the receiver again. */
-function lowerGuardedRecordWrite(
-  lowerer: Lowerer,
-  expr: ts.BinaryExpression,
-  target: ts.ElementAccessExpression,
-): IrStmt | null {
-  let receiverNode: ts.Expression = target.expression;
-  while (ts.isParenthesizedExpression(receiverNode)) receiverNode = receiverNode.expression;
-  if (
-    lowerer.chainRecvByNode.has(target.expression) ||
-    !(
-      ts.isElementAccessExpression(receiverNode) ||
-      ts.isPropertyAccessExpression(receiverNode) ||
-      ts.isIdentifier(receiverNode)
-    )
-  )
-    return null;
-  const guarded = guardedRecordAccess(lowerer, target, lowerer.lowerExpr(target.expression));
-  if (!guarded) return null;
-  const { receiver, key, name } = guarded;
-  const loc = locOf(expr);
-  const value = stabilized(lowerer, lowerer.lowerExpr(expr.right), "%recordValue", receiver.stmts);
-  const write = lowerer.withExpressionOverride(target.expression, receiver.present, () =>
-    lowerer.withExpressionOverride(target.argumentExpression, key, () =>
-      lowerer.withExpressionOverride(expr.right, value, () => lowerElementWrite(lowerer, expr)),
-    ),
-  );
-  return {
-    kind: "block",
-    body: [
-      ...receiver.stmts,
-      {
-        kind: "if",
-        cond: undefinedReceiver(receiver, loc),
-        then: [{ kind: "exprStmt", expr: undefinedReceiverThrow(name, "set", VOID, loc), loc }],
-        else_: [write],
-        loc,
-      },
-    ],
-    loc,
-  };
-}
-
-/** `b[i] = v` where the checker's flow type of `b` is a typed array but
- * its storage is wider. A hoisted JavaScript `var` (or a field written
- * after construction) holds `bytes | undefined`: the receiver, index and
- * value evaluate in order, then an undefined receiver throws Node's
- * TypeError and a present one takes the typed store. Any other storage (a
- * `var` later reassigned a string, a checked-dynamic value) takes the
- * checked-dynamic store, which applies whatever value the receiver holds. */
-function lowerWiderBytesWrite(
-  lowerer: Lowerer,
-  expr: ts.BinaryExpression,
-  target: ts.ElementAccessExpression,
-  recv: IrExpr,
-): IrStmt {
-  const loc = locOf(expr);
-  if (recv.type.kind === "union") {
-    const unionId = recv.type.unionId;
-    const arms = lowerer.unions.get(unionId)?.arms;
-    const undefTag = lowerer.armTag(unionId, UNDEFINED_T);
-    const bytes = arms?.length === 2 && undefTag >= 0 ? arms[1 - undefTag]! : null;
-    const keyType = lowerer.mapTypeOf(lowerer.typeOf(target.argumentExpression));
-    const index =
-      bytes?.kind === "bytes" && keyType?.kind === "f64"
-        ? lowerer.lowerExpr(target.argumentExpression)
-        : null;
-    // An index stored wider than a number (a hoisted `var` counter) keeps
-    // the checked-dynamic store below, which converts the key exactly.
-    if (bytes?.kind === "bytes" && index?.type.kind === "f64") {
-      const stmts: IrStmt[] = [];
-      const stable = stabilized(lowerer, recv, "%bytesReceiver", stmts);
-      const key = stabilized(lowerer, index, "%bytesIndex", stmts);
-      const value = stabilized(
-        lowerer,
-        lowerer.lowerExprExpecting(expr.right, F64),
-        "%bytesValue",
-        stmts,
-      );
-      const name = lowerRecordPropertyKey(lowerer, key, target.argumentExpression);
-      const present: IrExpr = {
-        kind: "unionNarrow",
-        unionId,
-        tag: 1 - undefTag,
-        value: stable,
-        type: bytes,
-        loc,
-      };
-      return {
-        kind: "block",
-        body: [
-          ...stmts,
-          {
-            kind: "if",
-            cond: {
-              kind: "unionIsTag",
-              unionId,
-              tag: undefTag,
-              negated: false,
-              value: stable,
-              type: BOOL,
-              loc,
-            },
-            then: [{ kind: "exprStmt", expr: undefinedReceiverThrow(name, "set", VOID, loc), loc }],
-            else_: [{ kind: "bytesSet", arr: present, index: key, value, loc }],
-            loc,
-          },
-        ],
-        loc,
-      };
-    }
-  }
-  if (!lowerer.dynConvertible(recv.type)) {
-    lowerer.unsupported(
-      "SC1090",
-      target.expression,
-      `typed-array element writes through '${lowerer.fmt(recv.type)}' storage`,
-    );
-  }
-  return {
-    kind: "exprStmt",
-    expr: lowerDynMemberAssignment(lowerer, expr, lowerer.coerceInto(target.expression, recv, DYN)),
-    loc,
-  };
-}
-
-/** `r[k]` over a (non-tuple) record shape. A LITERAL key naming a declared
- * field is the bracket spelling of field access (the ONLY spelling tsc
- * permits for signature-declared fields under
- * noPropertyAccessFromIndexSignature) — an ordinary recordGet. Everything
- * else is a runtime-keyed read (recordKeyGet): declared fields answer
- * first via an emitted string-switch, index-signature shapes fall through
- * to the overflow map. The result type is the index signature's value type
- * armed with undefined (dyn for `unknown`): a missing key reads undefined,
- * as in JavaScript, whatever noUncheckedIndexedAccess says. Every declared
- * field must be able to SURFACE as that type (equal, an arm of it, or —
- * for dyn results — JSON-safe for the dyn conversion); shapes mixing in
- * fields outside that stay fenced. Declared-only shapes support reads
- * whose key type proves membership (tsc's keyof check): all fields must
- * share the result type, and a smuggled miss traps. */
-export function lowerRecordKeyRead(
-  lowerer: Lowerer,
-  expr: ts.ElementAccessExpression,
-  shapeId: string,
-  shape: IrRecordShape,
-  includeUndefined = false,
-): IrExpr {
-  const loc = locOf(expr);
-  const keyNode = expr.argumentExpression;
-  // Literal declared keys are plain field reads (narrowing included).
-  // NUMERIC literals are their canonical string spelling — JS object keys
-  // ARE strings (`r[1]` reads `r["1"]`), so `b[1]` hits a declared field
-  // named "1" (a mapped type over a numeric enum) exactly like `b["1"]`.
-  // A key IDENTIFIER whose type proves one literal (a literal-typed
-  // const, a keyof-constrained type parameter bound to a literal inside
-  // a generic instance) is the same static read — identifier evaluation
-  // is pure, so skipping it matches JS exactly.
-  const litKey = recordKeyLiteralText(keyNode) ?? recordKeyTypeLiteralText(lowerer, keyNode);
-  // An outer keyed read can leave the receiver undefined: evaluate the
-  // receiver and the key, then throw Node's TypeError or read the present
-  // record.
-  // The receiver lowers FIRST (both branches below read it, and JS
-  // evaluates the receiver before the key).
-  const obj = lowerer.lowerExpr(expr.expression);
-  {
-    // A null arm is guarded only for string and number keys: other keys
-    // already take the checked-dynamic read, which handles null itself.
-    // Only a receiver with a null arm asks about the key.
-    let allowNull = false;
-    if (obj.type.kind === "union" && lowerer.armTag(obj.type.unionId, NULL_T) >= 0) {
-      const keyType = litKey !== null ? STRING : lowerer.mapTypeOf(lowerer.typeOf(keyNode));
-      allowNull = keyType?.kind === "string" || keyType?.kind === "f64";
-    }
-    const guarded = guardedRecordAccess(lowerer, expr, obj, allowNull);
-    if (guarded) {
-      const { receiver, key, name } = guarded;
-      const read = lowerer.withExpressionOverride(expr.expression, receiver.present, () =>
-        litKey !== null
-          ? lowerRecordKeyRead(lowerer, expr, shapeId, shape, includeUndefined)
-          : lowerer.withExpressionOverride(keyNode, key, () =>
-              lowerRecordKeyRead(lowerer, expr, shapeId, shape, includeUndefined),
-            ),
-      );
-      return {
-        kind: "seqExpr",
-        stmts: receiver.stmts,
-        result: {
-          kind: "ternary",
-          cond: undefinedReceiver(receiver, loc),
-          then: undefinedReceiverThrow(name, "read", read.type, loc, receiver.nullish),
-          else_: read,
-          type: read.type,
-          loc,
-        },
-        type: read.type,
-        loc,
-      };
-    }
-  }
-  // A record-mapped CHECKER type over a VALUE living in the checked-dynamic tree (a JS
-  // file-scope object-literal global): the checked-dynamic keyed read —
-  // dynKeyGet against the runtime keys (a missing key answers the checked-dynamic tree
-  // undefined, exactly JS); consumers validate (dynCheck) where a
-  // static type is required, the member-read discipline.
-  if (obj.type.kind === "dyn") {
-    let dk =
-      litKey !== null
-        ? ({ kind: "strLit", value: litKey, type: STRING, loc: locOf(keyNode) } satisfies IrExpr)
-        : lowerer.lowerExpr(keyNode);
-    // Number AND checked-dynamic keys ride the JS-exact formatter —
-    // property keys ARE strings (o[k] is o[String(k)] in JS), and a dyn
-    // key (agent.sockets[agent.getName(...)]) stringifies the same way.
-    if (dk.type.kind === "union" && lowerer.dynConvertible(dk.type))
-      dk = lowerer.coerceToExpected(dk, DYN);
-    if (dk.type.kind !== "symbol" && dk.type.kind !== "dyn")
-      dk = lowerRecordPropertyKey(lowerer, dk, keyNode);
-    if (dk.type.kind !== "string" && dk.type.kind !== "symbol" && dk.type.kind !== "dyn") {
-      lowerer.unsupported("SC1090", keyNode, "indexing records with non-string or non-number keys");
-    }
-    const read: IrExpr = { kind: "dynKeyGet", key: dk, value: obj, type: DYN, loc };
-    // Absence probes must keep the checked-dynamic undefined produced by
-    // a missing key. The ordinary read narrows to the checker's declared
-    // index value (and therefore validates it); ===/!==, ||, and ?? need
-    // to observe the missing value instead of throwing during that check.
-    return includeUndefined ? read : lowerer.maybeNarrow(read, expr);
-  }
-  if (litKey !== null) {
-    const nominal = representedClassFieldTarget(lowerer, expr.expression, litKey, obj);
-    if (nominal) {
-      const read = lowerer.fieldGetExpr(nominal, loc, expr);
-      return includeUndefined ? read : lowerer.maybeNarrow(read, expr);
-    }
-  }
-  if (hasClassPayload(lowerer, obj.type)) {
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      "computed property reads through structural views of class instances (use a declared literal key)",
-    );
-  }
-  // Predicates can strengthen optional fields without changing the
-  // receiver's stored layout. Use that layout for bracket reads just as
-  // fieldTarget does for the corresponding dot reads.
-  if (obj.type.kind === "record") {
-    const actualShape = lowerer.shapes.get(obj.type.shapeId);
-    if (!actualShape)
-      throw new InternalCompilerError("record receiver is missing its stored shape");
-    shapeId = obj.type.shapeId;
-    shape = actualShape;
-  }
-  if (litKey !== null) {
-    const field = shape.fields.find((f) => f.name === litKey);
-    if (field) {
-      const get: IrExpr = {
-        kind: "recordGet",
-        obj,
-        shapeId,
-        field: field.name,
-        type: field.type,
-        loc,
-      };
-      return lowerer.maybeNarrow(get, expr);
-    }
-  }
-  let key =
-    litKey !== null
-      ? ({ kind: "strLit", value: litKey, type: STRING, loc: locOf(keyNode) } satisfies IrExpr)
-      : lowerer.lowerExpr(keyNode);
-  // Optional string/number keys need ToPropertyKey, not a boxed copy of
-  // the receiver. Keep record reads on their native storage so nested
-  // references retain identity across index-signature reads.
-  if (
-    key.type.kind === "union" &&
-    !lowerer.unions
-      .get(key.type.unionId)
-      ?.arms.some((arm) => arm.kind === "symbol" || arm.kind === "dyn")
-  ) {
-    key = lowerRecordPropertyKey(lowerer, key, keyNode);
-  }
-  if (
-    (key.type.kind === "symbol" || key.type.kind === "dyn" || key.type.kind === "union") &&
-    lowerer.dynConvertible(key.type) &&
-    lowerer.dynConvertible(obj.type)
-  ) {
-    const read: IrExpr = {
-      kind: "dynKeyGet",
-      value: lowerer.coerceToExpected(obj, DYN),
-      key: lowerer.coerceToExpected(key, DYN),
-      type: DYN,
-      loc,
-    };
-    return includeUndefined ? read : lowerer.maybeNarrow(read, expr);
-  }
-  // Runtime NUMBER keys ride the JS-exact formatter (o[n] is o[String(n)]
-  // in JS — the number-keyed-signature access path).
-  key = lowerRecordPropertyKey(lowerer, key, keyNode);
-  if (key.type.kind !== "string") {
-    lowerer.unsupported("SC1090", keyNode, "indexing records with non-string or non-number keys");
-  }
-  if (shape.fields.length === 0 && shape.indexValue === undefined) {
-    const result = dynUndefinedExpr(loc);
-    return {
-      kind: "seqExpr",
-      stmts: [
-        { kind: "exprStmt", expr: obj, loc },
-        { kind: "exprStmt", expr: key, loc },
-      ],
-      result,
-      type: DYN,
-      loc,
-    };
-  }
-  // The result type of the access — the index signature's value type
-  // armed with undefined, or the declared fields' one common type on
-  // signature-free shapes (tsc's keyof check proved membership; a
-  // smuggled miss traps). On signature-free shapes the checker may have
-  // NARROWED this occurrence (assignment CFA on literal keys) — maybeNarrow
-  // bridges to the narrowed arm exactly like a field read.
-  let declared: IrType | null = null;
-  // An index-signature read is a JavaScript property read: a missing key
-  // answers undefined even without noUncheckedIndexedAccess. The read keeps
-  // that explicit optional union, as an ordinary array read does.
-  let optionalRead = false;
-  // A read whose every consumer treats undefined like NaN (see
-  // nan-coded-reads.ts) is a plain number that is NaN for a missing key.
-  const nanCoded =
-    !includeUndefined &&
-    shape.indexValue?.kind === "f64" &&
-    lowerer.nanCodedReads?.isNumericRead(expr) === true;
-  if (shape.indexValue) {
-    declared = shape.indexValue;
-    if (declared.kind !== "dyn" && !nanCoded) {
-      declared = lowerer.withUndefinedArmOf(declared);
-      if (!declared) lowerer.badType(expr, lowerer.typeOf(expr));
-      optionalRead = true;
-    }
-  } else if (
-    shape.fields.length > 0 &&
-    shape.fields.every((f) => typeEquals(f.type, shape.fields[0]!.type))
-  ) {
-    declared = shape.fields[0]!.type;
-  }
-  if (!declared && isJsSourceFile(expr.getSourceFile()) && recordKeyResultOk(lowerer, shape, DYN))
-    declared = DYN;
-  if (!declared) {
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      `dynamic keyed reads of '${lowerer.fmt({ kind: "record", shapeId })}' (the declared fields have no one common type)`,
-    );
-  }
-  // A LITERAL key naming no declared field can only hit the overflow:
-  // the declared-field surfacing constraint doesn't apply.
-  const overflowOnly = litKey !== null && !!shape.indexValue;
-  if (!recordKeyResultOk(lowerer, overflowOnly ? { ...shape, fields: [] } : shape, declared)) {
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      `dynamic keyed reads of '${lowerer.fmt({ kind: "record", shapeId })}' as '${lowerer.fmt(declared)}' (every declared field must be readable at that type)`,
-    );
-  }
-  const read: IrExpr = {
-    kind: "recordKeyGet",
-    obj,
-    shapeId,
-    key,
-    ...(overflowOnly ? { overflowOnly: true as const } : {}),
-    ...(nanCoded ? { missNaN: true as const } : {}),
-    type: declared,
-    loc,
-  };
-  if (nanCoded) return read;
-  return includeUndefined || optionalRead ? read : lowerer.maybeNarrow(read, expr);
-}
-
-/** ToPropertyKey for represented record keys. Missing array-derived string
- * values remain real undefined values, whose JavaScript property spelling
- * is the string "undefined". */
-function lowerRecordPropertyKey(lowerer: Lowerer, key: IrExpr, node: ts.Expression): IrExpr {
-  if (key.type.kind === "union" && lowerer.dynConvertible(key.type)) {
-    return {
-      kind: "libCall",
-      fn: "dyn.toStringCoerce",
-      args: [lowerer.coerceInto(node, key, DYN)],
-      type: STRING,
-      loc: key.loc,
-    };
-  }
-  if (
-    key.type.kind === "f64" ||
-    key.type.kind === "bool" ||
-    key.type.kind === "dyn" ||
-    lowerer.runtimeOptionalWidening(key.type, STRING) !== null
-  ) {
-    return lowerer.ensureString(key, node);
-  }
-  return key;
-}
-
 /** The stored value of an identifier whose storage holds an undefined arm
  * that the checker's type at this use has dropped. An assignment from an
  * unchecked indexed read narrows the declared type even though the value
@@ -7920,24 +1424,6 @@ export function runtimeOptionalStorageOperand(
   return optional.value;
 }
 
-/** A `T | undefined` class field read that the checker narrowed to `T`
- * where the field was assigned a value that may be missing (an unchecked
- * indexed read). TypeScript's assignment narrowing is not a runtime fact
- * there, so the read keeps the stored union instead of extracting `T`. */
-function runtimeOptionalClassField(
-  lowerer: Lowerer,
-  value: IrExpr,
-  node: ts.PropertyAccessExpression,
-): boolean {
-  if (value.kind !== "fieldGet" || value.type.kind !== "union") return false;
-  if (lowerer.armTag(value.type.unionId, UNDEFINED_T) < 0) return false;
-  if ((lowerer.unions.get(value.type.unionId)?.arms.length ?? 0) !== 2) return false;
-  const symbol = lowerer.checker.getSymbolAtLocation(node.name);
-  if (!symbol || !lowerer.runtimeOptionalAssignedSymbols.has(symbol)) return false;
-  const narrowed = lowerer.mapTypeOf(lowerer.typeOf(node));
-  return narrowed !== null && typeEquals(narrowed, lowerer.stripUndefinedArm(value.type));
-}
-
 /** A presence-test operand: an absence-aware element or field read, an
  * identifier's runtime-optional storage, or the ordinary lowering. */
 export function lowerPresenceOperand(lowerer: Lowerer, node: ts.Expression): IrExpr {
@@ -8021,6 +1507,22 @@ export function lowerAbsenceProbe(lowerer: Lowerer, node: ts.Expression): IrExpr
     }
     return null;
   }
+  // `m[2]` on a JavaScript `RegExpExecArray | null` that a previous
+  // statement ruled non-null without narrowing it (jose's secs()).
+  if (
+    receiverT?.kind === "union" &&
+    isJsSourceFile(expr.getSourceFile()) &&
+    !expr.questionDotToken &&
+    !hasOptionalChainGuard(expr.expression)
+  ) {
+    const arms = lowerer.unions.get(receiverT.unionId)?.arms ?? [];
+    const present = arms.filter((arm) => !isUnitType(arm));
+    if (present.length !== 1 || present[0]!.kind !== "array") return null;
+    const value = lowerer.lowerExpr(expr.expression);
+    const index = lowerer.lowerExpr(expr.argumentExpression);
+    if (index.type.kind !== "f64") return null;
+    return lowerOptionalArrayIndexRead(lowerer, expr, value, index);
+  }
   if (receiverT?.kind !== "array") return null;
   const arr = lowerer.lowerExpr(expr.expression);
   if (arr.type.kind !== "array") return null;
@@ -8029,42 +1531,6 @@ export function lowerAbsenceProbe(lowerer: Lowerer, node: ts.Expression): IrExpr
   return lowerSafeIndexRead(lowerer, arr, index, locOf(expr));
 }
 
-/** The compile-time string spelling of a record key literal: a string
- * literal's text, or a NON-NEGATIVE numeric literal's canonical JS
- * spelling (`1` → "1", `1e21` → "1e+21" — String(Number(text)), which is
- * exactly the key JS derives; negative/computed keys stay runtime
- * expressions and canonicalize through ensureString instead). Null for
- * everything else. */
-function recordKeyLiteralText(node: ts.Expression): string | null {
-  if (ts.isStringLiteral(node)) return node.text;
-  if (ts.isNumericLiteral(node)) return String(Number(node.text));
-  return null;
-}
-
-/** The compile-time key an IDENTIFIER's TYPE proves: a key variable whose
- * (narrowed) type is one string/number literal — `const k: "a" = …; o[k]`,
- * and the generic-body form where k's type is a keyof-constrained
- * parameter bound to a literal (`pick(o, "a")`'s instance reads `o[k]`
- * with K = "a", resolved through typeParamTsBindings). Identifier reads
- * are pure, so the static field read may skip evaluating the key exactly
- * like a syntactic literal. Null anywhere the type keeps more than one
- * key. */
-function recordKeyTypeLiteralText(lowerer: Lowerer, node: ts.Expression): string | null {
-  if (!ts.isIdentifier(node)) return null;
-  let t: ts.Type = lowerer.typeOf(node);
-  if (t.flags & ts.TypeFlags.TypeParameter) {
-    const bound = lowerer.typeParamTsResolver(t);
-    if (!bound) return null;
-    t = bound;
-  }
-  if (t.isStringLiteralType()) return t.value;
-  if (t.isNumberLiteralType()) {
-    const n = t.value;
-    return Number.isFinite(n) && n >= 0 ? String(n) : null;
-  }
-  return null;
-}
-
 /** Can every value a dynamic key can reach (declared fields + the
  * overflow) surface as the read's result type? dyn results need
  * dyn-convertible fields (JSON-safe, with the undefined arm allowed at
@@ -8072,7 +1538,7 @@ function recordKeyTypeLiteralText(lowerer: Lowerer, node: ts.Expression): string
  * value, exactly what the missing-key path produces); typed results need
  * each field to be the type itself or one of its arms, and the overflow
  * value to be the type or wrappable into it. */
-function recordKeyResultOk(lowerer: Lowerer, shape: IrRecordShape, type: IrType): boolean {
+export function recordKeyResultOk(lowerer: Lowerer, shape: IrRecordShape, type: IrType): boolean {
   const surfaces = (t: IrType): boolean =>
     typeEquals(t, type) ||
     (type.kind === "union" && lowerer.armTag(type.unionId, t) >= 0) ||
@@ -8086,40 +1552,13 @@ function recordKeyResultOk(lowerer: Lowerer, shape: IrRecordShape, type: IrType)
   return true;
 }
 
-function exactUnionWidening(lowerer: Lowerer, from: IrType, to: IrType): boolean {
+export function exactUnionWidening(lowerer: Lowerer, from: IrType, to: IrType): boolean {
   if (from.kind !== "union" || to.kind !== "union") return false;
   const source = lowerer.unions.get(from.unionId);
   const target = lowerer.unions.get(to.unionId);
   return !!source && !!target && unionWideningTags(source.arms, target.arms) !== null;
 }
 
-/** The literal index of a tuple access, or null when the expression isn't
- * a non-negative integer literal (parentheses tolerated — tsc's own
- * literal-index typing accepts them). */
-function tupleLiteralIndex(node: ts.Expression): number | null {
-  let e: ts.Expression = node;
-  while (ts.isParenthesizedExpression(e)) e = e.expression;
-  if (!ts.isNumericLiteral(e)) return null;
-  const n = Number(e.text);
-  return Number.isInteger(n) && n >= 0 ? n : null;
-}
-
-/** `a[i] op= rhs` over native arrays and byte views. A compound assignment
- * evaluates the receiver and index, reads the old element, evaluates rhs,
- * then writes. Capture each stage so a call in the index or rhs cannot
- * change the target or the value used by the operator. The expression yields
- * the computed value before a typed array or Buffer coerces it for storage. */
-export function lowerElementCompound(
-  lowerer: Lowerer,
-  expr: ts.BinaryExpression,
-  op: CompoundOp,
-): IrExpr {
-  const lowered = lowerElementCompoundParts(lowerer, expr, op, false);
-  if (!lowered.expr)
-    throw new InternalCompilerError("a compound element value lowered to statements");
-  return lowered.expr;
-}
-
 /** `a[i] op= rhs` in statement position: a string array append becomes the
  * canonical `a[i] = a[i] + rhs` store (receiver and index saved first),
  * which the backend appends in place; other forms keep the value path. */
@@ -8133,229 +1572,9 @@ export function lowerElementCompoundStatement(
   return { kind: "exprStmt", expr: lowered.expr!, loc: locOf(expr) };
 }
 
-function lowerElementCompoundParts(
-  lowerer: Lowerer,
-  expr: ts.BinaryExpression,
-  op: CompoundOp,
-  statement: boolean,
-): { expr: IrExpr | null; stmts: IrStmt[] | null } {
-  const target = expr.left as ts.ElementAccessExpression;
-  fenceNodeModuleMutation(lowerer, target, "assignment");
-  const loc = locOf(expr);
-  const checked = lowerer.lowerExpr(target.expression);
-  if (checked?.type.kind === "dyn" && isJsSourceFile(expr.getSourceFile())) {
-    const stmts: IrStmt[] = [];
-    const save = (value: IrExpr, name: string): IrExpr => {
-      const local = lowerer.declareHiddenLocal(name, value.type);
-      stmts.push({ kind: "varDecl", localId: local.id, init: value, loc });
-      return varRef(local.id, value.type, loc);
-    };
-    const receiver = save(checked, "%compoundReceiver");
-    const key = save(lowerer.lowerExprExpecting(target.argumentExpression, DYN), "%compoundKey");
-    const old = save({ kind: "dynKeyGet", value: receiver, key, type: DYN, loc }, "%compoundOld");
-    const rhs = lowerer.lowerExprExpecting(expr.right, DYN);
-    const numeric = ["-", "*", "/", "%", "**"].includes(op);
-    const value = save(
-      {
-        kind: "libCall",
-        fn: op === "+" ? "dyn.add" : numeric ? "dyn.arithmetic" : "dyn.bitwise",
-        args: op === "+" ? [old, rhs] : [old, rhs, strLit(op, loc)],
-        type: DYN,
-        loc,
-      },
-      "%compoundResult",
-    );
-    stmts.push({
-      kind: "exprStmt",
-      expr: {
-        kind: "libCall",
-        fn: "dyn.keySetComputed",
-        args: [receiver, key, value],
-        type: VOID,
-        loc,
-      },
-      loc,
-    });
-    return { expr: { kind: "seqExpr", stmts, result: value, type: DYN, loc }, stmts: null };
-  }
-  const receiverType =
-    checked.type.kind === "array" || checked.type.kind === "bytes"
-      ? checked.type
-      : lowerer.mapTypeOf(lowerer.typeOf(target.expression));
-  if (receiverType?.kind !== "array" && receiverType?.kind !== "bytes") {
-    lowerer.unsupported("SC1090", target, "compound assignment to non-array elements");
-  }
-  let receiver = checked;
-  if (receiver.type.kind === "union" && lowerer.armTag(receiver.type.unionId, UNDEFINED_T) >= 0) {
-    const present = lowerer.stripUndefinedArm(receiver.type);
-    const helper =
-      present.kind === receiverType.kind
-        ? lowerer.narrowedArmHelper(receiver.type.unionId, present, locOf(target.expression))
-        : null;
-    if (helper)
-      receiver = lowerer.checkedNarrowCall(helper, receiver, present, locOf(target.expression));
-  }
-  if (receiver.type.kind !== receiverType.kind) {
-    lowerer.unsupported(
-      "SC1090",
-      target.expression,
-      "compound assignment through a non-native array or byte view",
-    );
-  }
-  const index = lowerer.lowerExpr(target.argumentExpression);
-  if (index.type.kind !== "f64")
-    lowerer.unsupported("SC1090", target.argumentExpression, "indexing with non-number keys");
-  const receiverLocal = lowerer.declareHiddenLocal("%compoundArray", receiver.type);
-  const indexLocal = lowerer.declareHiddenLocal("%compoundIndex", F64);
-  const receiverRef = (): IrExpr => varRef(receiverLocal.id, receiver.type, loc);
-  const indexRef = (): IrExpr => varRef(indexLocal.id, F64, loc);
-  const oldValue: IrExpr =
-    receiver.type.kind === "array"
-      ? receiver.type.elem.kind === "f64"
-        ? // Every numeric operator applies ToNumber to the old value, so a
-          // missing element is NaN without materializing `number | undefined`.
-          arrayNumberRead(receiverRef(), indexRef(), locOf(target))
-        : receiver.type.elem.kind === "string" && op === "+"
-          ? arrayStringOperand(receiverRef(), indexRef(), locOf(target))
-          : arrayValueRead(lowerer, receiverRef(), indexRef(), receiver.type.elem, locOf(target))
-      : {
-          // An invalid index reads undefined in Node, which every numeric
-          // compound operator turns into NaN; the write is then ignored.
-          kind: "bytesIntrinsic",
-          method: "get",
-          receiver: receiverRef(),
-          args: [indexRef()],
-          type: F64,
-          loc: locOf(target),
-          invalidNaN: true,
-        };
-  const oldLocal = lowerer.declareHiddenLocal("%compoundOld", oldValue.type);
-  const oldRef = (): IrExpr => varRef(oldLocal.id, oldValue.type, loc);
-  const rhs = lowerer.lowerExpr(expr.right);
-  const numericRhs =
-    rhs.type.kind === "dyn" &&
-    isJsSourceFile(expr.getSourceFile()) &&
-    receiver.type.kind === "bytes"
-      ? { kind: "libCall" as const, fn: "dyn.toNumberCoerce" as const, args: [rhs], type: F64, loc }
-      : lowerOptionalNumber(lowerer, rhs, loc);
-  const elementType = receiver.type.kind === "array" ? receiver.type.elem : F64;
-  const valueType =
-    elementType.kind === "union" && lowerer.armTag(elementType.unionId, UNDEFINED_T) >= 0
-      ? lowerer.stripUndefinedArm(elementType)
-      : elementType;
-  if (
-    statement &&
-    op === "+" &&
-    receiver.type.kind === "array" &&
-    receiver.type.elem.kind === "string"
-  ) {
-    // Receiver, index, old element (read inside the concat), rhs, write.
-    const appended: IrExpr = {
-      kind: "strConcat",
-      left: oldValue,
-      right: concatOperand(lowerer, rhs, expr.right),
-      type: STRING,
-      loc,
-    };
-    return {
-      expr: null,
-      stmts: [
-        { kind: "varDecl", localId: receiverLocal.id, init: receiver, loc },
-        { kind: "varDecl", localId: indexLocal.id, init: index, loc },
-        { kind: "arraySet", arr: receiverRef(), index: indexRef(), value: appended, loc },
-      ],
-    };
-  }
-  let computed: IrExpr;
-  if (op === "+" && valueType.kind === "string") {
-    computed = {
-      kind: "strConcat",
-      left: lowerer.ensureString(oldRef(), target),
-      right: concatOperand(lowerer, rhs, expr.right),
-      type: STRING,
-      loc,
-    };
-  } else if (valueType.kind === "f64" && numericRhs.type.kind === "f64") {
-    computed = {
-      kind: "bin",
-      op,
-      left: lowerOptionalNumber(lowerer, oldRef(), loc),
-      right: numericRhs,
-      type: F64,
-      loc,
-    };
-  } else if (valueType.kind === "dyn" && isJsSourceFile(expr.getSourceFile())) {
-    const left = lowerer.coerceToExpected(oldRef(), DYN),
-      right = lowerer.coerceToExpected(rhs, DYN);
-    computed = dynCompoundValue(op, left, right, loc);
-  } else if (
-    rhs.type.kind === "dyn" &&
-    receiver.type.kind === "array" &&
-    lowerer.dynConvertible(oldValue.type) &&
-    lowerer.dynConvertible(valueType)
-  ) {
-    // An untyped right operand: the expanded `a[i] = a[i] op rhs`, checked
-    // back into the element type.
-    computed = lowerer.coerceInto(
-      expr,
-      dynCompoundValue(
-        op,
-        lowerer.coerceToExpected(oldRef(), DYN),
-        lowerer.coerceToExpected(rhs, DYN),
-        loc,
-      ),
-      valueType,
-    );
-  } else {
-    compoundUnsupported(lowerer, expr, op, oldValue.type, rhs.type);
-  }
-  const resultLocal = lowerer.declareHiddenLocal("%compoundResult", computed.type);
-  const resultRef = (): IrExpr => varRef(resultLocal.id, computed.type, loc);
-  const write: IrStmt =
-    receiver.type.kind === "array"
-      ? arrayValueStore(lowerer, receiverRef(), indexRef(), resultRef(), receiver.type.elem, loc)
-      : { kind: "bytesSet", arr: receiverRef(), index: indexRef(), value: resultRef(), loc };
-  return {
-    expr: {
-      kind: "seqExpr",
-      stmts: [
-        { kind: "varDecl", localId: receiverLocal.id, init: receiver, loc },
-        { kind: "varDecl", localId: indexLocal.id, init: index, loc },
-        { kind: "varDecl", localId: oldLocal.id, init: oldValue, loc },
-        { kind: "varDecl", localId: resultLocal.id, init: computed, loc },
-        write,
-      ],
-      result: resultRef(),
-      type: computed.type,
-      loc,
-    },
-    stmts: null,
-  };
-}
-
-/** ToString of one stabilized `string[]` element read for `+=`: a missing
- * element concatenates as "undefined". */
-function arrayStringOperand(arr: IrExpr, index: IrExpr, loc: SrcLoc): IrExpr {
-  return {
-    kind: "ternary",
-    cond: {
-      kind: "bin",
-      op: "===",
-      left: { kind: "arrayState", arr, index, type: F64, loc },
-      right: { kind: "numLit", value: 1, type: F64, loc },
-      type: BOOL,
-      loc,
-    },
-    then: { kind: "arrayGet", arr, index, type: STRING, loc },
-    else_: strLit("undefined", loc),
-    type: STRING,
-    loc,
-  };
-}
-
 /** Checked member assignment evaluates the reference before its RHS and
  * yields the original assigned value, including in a chained assignment. */
-function lowerDynMemberAssignment(
+export function lowerDynMemberAssignment(
   lowerer: Lowerer,
   expr: ts.BinaryExpression,
   recv: IrExpr,
@@ -8409,624 +1628,62 @@ function lowerDynMemberAssignment(
   };
 }
 
-/** JavaScript callable members live on the closure, so aliases and chained
- * writes share the same storage as Object.defineProperties. */
-export function lowerNativeFunctionAssignment(
-  lowerer: Lowerer,
-  expr: ts.BinaryExpression,
-): IrExpr | null {
-  const target = expr.left;
-  if (
-    !isJsSourceFile(expr.getSourceFile()) ||
-    (!ts.isPropertyAccessExpression(target) && !ts.isElementAccessExpression(target)) ||
-    target.questionDotToken
-  )
-    return null;
-  // Checked constructors share the callable's live property descriptors.
-  const classType = storedClassValueType(lowerer, target.expression);
-  const staticClass =
-    classType?.kind === "classval" ? lowerer.classes.get(classType.className) : undefined;
-  if (staticClass && hasRuntimeStatics(staticClass)) {
-    return lowerDynMemberAssignment(
-      lowerer,
-      expr,
-      lowerer.lowerExprExpecting(target.expression, DYN),
-    );
-  }
-  // Other class statics and prototype tables have their own paths.
-  // Probing them as ordinary functions could materialize unused methods.
-  if (
-    lowerer.exactClassOfReceiver(target.expression) ||
-    (ts.isPropertyAccessExpression(target.expression) &&
-      target.expression.name.text === "prototype" &&
-      lowerer.exactClassOfReceiver(target.expression.expression))
-  )
-    return null;
-  const receiver = tryLowerExpression(lowerer, target.expression);
-  if (
-    receiver?.type.kind !== "func" ||
-    !canBoxFuncIntoDyn(
-      receiver.type,
-      (id) => lowerer.shapes.get(id),
-      (id) => lowerer.unions.get(id),
-    )
-  )
-    return null;
-  fenceNodeModuleMutation(lowerer, target, "assignment");
-  const fnName = jsFuncNameOf(target.expression);
-  const boxed: IrExpr = {
-    kind: "dynFrom",
-    value: receiver,
-    type: DYN,
-    loc: locOf(target.expression),
-    ...(fnName !== null ? { fnName } : {}),
-  };
-  return lowerDynMemberAssignment(lowerer, expr, boxed);
+/** `typeof` of a Node 24 Web-platform constructor global or one of its
+ * static methods: "function", decided by name. The read has no effects.
+ * Static methods answer by name because after a `typeof
+ * globalThis.AbortSignal === "function" &&` guard the checker narrows a
+ * fallback-typed receiver to never, hiding the member's declaration. */
+export function constructorGlobalTypeof(lowerer: Lowerer, tested: ts.Expression): string | null {
+  while (ts.isParenthesizedExpression(tested)) tested = tested.expression;
+  const globalName = stdlibGlobalNameOf(lowerer, tested);
+  if (globalName !== null && NODE_CONSTRUCTOR_GLOBALS.has(globalName)) return "function";
+  if (!ts.isPropertyAccessExpression(tested) || tested.questionDotToken) return null;
+  const owner = stdlibGlobalNameOf(lowerer, tested.expression);
+  return owner !== null &&
+    Object.hasOwn(NODE_CONSTRUCTOR_STATICS, owner) &&
+    NODE_CONSTRUCTOR_STATICS[owner]!.includes(tested.name.text)
+    ? "function"
+    : null;
 }
 
-export function lowerElementWrite(lowerer: Lowerer, expr: ts.BinaryExpression): IrStmt {
-  const prototype = lowerClassPrototypeComputedAssignment(lowerer, expr);
-  if (prototype) return { kind: "exprStmt", expr: prototype, loc: locOf(expr) };
-  const target = expr.left as ts.ElementAccessExpression;
-  fenceNodeModuleMutation(lowerer, target, "assignment");
-  const globalKey = globalSymbolKey(lowerer, target.expression, target.argumentExpression);
-  if (globalKey) {
-    const value = lowerer.lowerExprExpecting(expr.right, DYN);
-    const loc = locOf(expr);
-    return {
-      kind: "exprStmt",
-      expr: {
-        kind: "libCall",
-        fn: "dyn.globalSymbolSet",
-        args: [globalKey, value],
-        type: VOID,
-        loc,
-      },
-      loc,
-    };
-  }
-  // `process.env[key] = v` — the computed twin of the dotted env write:
-  // setenv(3), string keys and string values only.
-  if (lowerer.isProcessEnv(target.expression) && !target.questionDotToken) {
-    const loc = locOf(expr);
-    const key = lowerEnvironmentKey(lowerer, target.argumentExpression);
-    if (key.type.kind !== "string") {
-      lowerer.unsupported(
-        "SC1090",
-        target.argumentExpression,
-        "indexing process.env with non-string keys",
-      );
-    }
-    const value = lowerer.lowerExpr(expr.right);
-    if (value.type.kind !== "string") {
-      lowerer.unsupported(
-        "SC1090",
-        expr.right,
-        `assigning '${lowerer.fmt(value.type)}' values to process.env (env values are strings — convert first: \`\${v}\`)`,
-      );
-    }
-    return {
-      kind: "exprStmt",
-      expr: { kind: "libCall", fn: "process.envSet", args: [key, value], type: VOID, loc },
-      loc,
-    };
-  }
-  // Symbol-keyed property WRITES (`this[kLimit] = v`): the read path's
-  // twin — a statically-resolvable unique-symbol key declared on the
-  // receiver's class writes the hidden field slot; everything else keeps
-  // the fence (static shapes have no symbol-keyed storage).
-  if (lowerer.mapTypeOf(lowerer.typeOf(target.argumentExpression))?.kind === "symbol") {
-    const fieldT = symbolFieldTarget(lowerer, target);
-    if (fieldT) {
-      const value = lowerer.lowerExprExpecting(expr.right, fieldT.fieldType);
-      return lowerer.fieldSetStmt(fieldT, value, locOf(expr), target);
-    }
-    const receiver = lowerer.lowerExpr(target.expression);
-    if (receiver.type.kind === "dyn")
-      return {
-        kind: "exprStmt",
-        expr: lowerDynMemberAssignment(lowerer, expr, receiver),
-        loc: locOf(expr),
-      };
-    if (
-      isJsSourceFile(expr.getSourceFile()) &&
-      receiver.type.kind === "object" &&
-      lowerer.dynConvertible(receiver.type)
-    ) {
-      return {
-        kind: "exprStmt",
-        expr: lowerDynMemberAssignment(lowerer, expr, lowerer.coerceToExpected(receiver, DYN)),
-        loc: locOf(expr),
-      };
-    }
-    lowerer.unsupported(
-      "SC1090",
-      target,
-      "symbol-keyed property writes outside class fields keyed by a stable module-level literal Symbol()/Symbol.for() (other static shapes have no symbol-keyed storage)",
-    );
-  }
-  const checkedReceiver = tryLowerExpression(lowerer, target.expression);
-  if (checkedReceiver?.type.kind === "dyn") {
-    return {
-      kind: "exprStmt",
-      expr: lowerDynMemberAssignment(lowerer, expr, checkedReceiver),
-      loc: locOf(expr),
-    };
-  }
-  if (checkedReceiver?.type.kind === "object" && isJsSourceFile(expr.getSourceFile())) {
-    const info = lowerer.classes.get(checkedReceiver.type.className);
-    const key =
-      recordKeyLiteralText(target.argumentExpression) ??
-      recordKeyTypeLiteralText(lowerer, target.argumentExpression);
-    if (info && key !== null && isClassCallback(lowerer, info, key)) {
-      const receiver = lowerer.coerceInto(target.expression, checkedReceiver, DYN);
-      return {
-        kind: "exprStmt",
-        expr: lowerDynMemberAssignment(lowerer, expr, receiver),
-        loc: locOf(expr),
-      };
-    }
-  }
-  let receiverIr = lowerer.mapTypeOf(lowerer.typeOf(target.expression));
-  if (isJsSourceFile(expr.getSourceFile()) && checkedReceiver) {
-    const represented =
-      checkedReceiver.type.kind === "union"
-        ? lowerer.stripUndefinedArm(checkedReceiver.type)
-        : checkedReceiver.type;
-    if (represented.kind === "array" || represented.kind === "bytes") receiverIr = represented;
-  }
-  if (receiverIr === null || receiverIr.kind === "dyn") {
-    const receiver = tryLowerExpression(lowerer, target.expression);
-    if (receiver?.type.kind === "array") receiverIr = receiver.type;
-  }
+/** Static methods of Node 24's Web-platform constructor globals. */
+const NODE_CONSTRUCTOR_STATICS: Readonly<Record<string, readonly string[]>> = {
+  AbortSignal: ["abort", "any", "timeout"],
+  Response: ["error", "json", "redirect"],
+  URL: ["canParse", "createObjectURL", "parse", "revokeObjectURL"],
+};
 
-  // A checked-dynamic receiver TYPE (`unknown[]` and the collapsed
-  // `(string | object)[]` map to DYN wholesale now): the dyn keyed
-  // write — dyn.keySet. Number keys canonicalize through the JS-exact
-  // formatter; ARR receivers take canonical index keys as element
-  // set/extend (undefined-hole padding, JS's length growth exactly),
-  // OBJ receivers set the member, and the runtime throws Node's
-  // TypeErrors on every other kind. Values convert into the checked-dynamic tree;
-  // unconvertible ones fence per site (the dynFrom stance).
-  if (receiverIr?.kind === "dyn") {
-    const obj = lowerer.lowerExpr(target.expression);
-    if (obj.type.kind === "dyn") {
-      const loc = locOf(expr);
-      const key = lowerRecordPropertyKey(
-        lowerer,
-        lowerer.lowerExpr(target.argumentExpression),
-        target.argumentExpression,
-      );
-      if (key.type.kind !== "string") {
-        lowerer.unsupported(
-          "SC1090",
-          target.argumentExpression,
-          "indexing with non-string or non-number keys",
-        );
-      }
-      const value = lowerer.coerceToExpected(lowerer.lowerExpr(expr.right), DYN);
-      if (value.type.kind !== "dyn") {
-        lowerer.unsupported(
-          "SC1101",
-          expr.right,
-          `storing '${lowerer.fmt(value.type)}' values in a checked-dynamic array (the value cannot convert into the checked-dynamic tree)`,
-        );
-      }
-      return {
-        kind: "exprStmt",
-        expr: { kind: "libCall", fn: "dyn.keySet", args: [obj, key, value], type: VOID, loc },
-        loc,
-      };
-    }
-  }
-  if (receiverIr?.kind === "object" || receiverIr?.kind === "record") {
-    const key =
-      recordKeyLiteralText(target.argumentExpression) ??
-      recordKeyTypeLiteralText(lowerer, target.argumentExpression);
-    if (key !== null) {
-      const receiver = lowerer.lowerExpr(target.expression);
-      const field = representedClassFieldTarget(lowerer, target.expression, key, receiver);
-      if (field) {
-        const value = lowerer.lowerExprExpecting(expr.right, field.fieldType);
-        return lowerer.fieldSetStmt(field, value, locOf(expr), target);
-      }
-      if (hasClassPayload(lowerer, receiver.type)) {
-        if (receiver.type.kind === "object" && receiver.type.className === "%Error") {
-          return {
-            kind: "exprStmt",
-            expr: lowerDynMemberAssignment(
-              lowerer,
-              expr,
-              lowerer.coerceInto(target.expression, receiver, DYN),
-            ),
-            loc: locOf(expr),
-          };
-        }
-        lowerer.unsupported(
-          "SC1090",
-          target,
-          "writing undeclared properties through structural views of class instances",
-        );
-      }
-    }
-  }
-  // Typed-array element write `b[i] = v` — bytesSet: the value is an f64
-  // the runtime coerces JS-exactly; invalid indices are ignored.
-  if (receiverIr?.kind === "bytes") {
-    const recv = lowerer.lowerExpr(target.expression);
-    // The checker's flow type is a typed array, but the storage is wider.
-    if (recv.type.kind !== "bytes") return lowerWiderBytesWrite(lowerer, expr, target, recv);
-    const index = lowerer.lowerExpr(target.argumentExpression);
-    if (index.type.kind === "dyn" && recv.type.kind === "bytes") {
-      return {
-        kind: "exprStmt",
-        expr: lowerDynMemberAssignment(
-          lowerer,
-          expr,
-          lowerer.coerceInto(target.expression, recv, DYN),
-        ),
-        loc: locOf(expr),
-      };
-    }
-    if (index.type.kind !== "f64") {
-      lowerer.unsupported("SC1090", target.argumentExpression, "indexing with non-number keys");
-    }
-    const value = lowerer.lowerExprExpecting(expr.right, F64);
-    return { kind: "bytesSet", arr: recv, index, value, loc: locOf(expr) };
-  }
-  // Tuple element write `t[0] = v`: a positional-field write (recordSet)
-  // — literal indices only, like the read.
-  if (receiverIr?.kind === "record") {
-    const shape = lowerer.shapes.get(receiverIr.shapeId);
-
-    if (shape) {
-      const obj = lowerer.lowerExpr(target.expression);
-      if (hasClassPayload(lowerer, obj.type)) {
-        lowerer.unsupported(
-          "SC1090",
-          target,
-          "computed property writes through structural views of class instances (use a declared literal key)",
-        );
-      }
-
-      // A record-mapped CHECKER type over a VALUE living in the checked-dynamic tree (a
-      // JS file-scope object-literal global): the checked-dynamic keyed
-      // write — dyn.keySet (later writes win, insertion order; Node's
-      // TypeErrors on non-object receivers), the value converting into
-      // the checked-dynamic tree. Literal and runtime keys alike: the checked-dynamic tree's key set is
-      // open, so no declared-field collision analysis applies.
-      if (obj.type.kind === "dyn") {
-        const loc = locOf(expr);
-        const litKey = recordKeyLiteralText(target.argumentExpression);
-        let key: IrExpr =
-          litKey !== null
-            ? { kind: "strLit", value: litKey, type: STRING, loc: locOf(target.argumentExpression) }
-            : lowerer.lowerExpr(target.argumentExpression);
-        key = lowerRecordPropertyKey(lowerer, key, target.argumentExpression);
-        if (key.type.kind !== "string") {
-          lowerer.unsupported(
-            "SC1090",
-            target.argumentExpression,
-            "indexing records with non-string or non-number keys",
-          );
-        }
-        const value = lowerer.coerceToExpected(lowerer.lowerExpr(expr.right), DYN);
-        if (value.type.kind !== "dyn") {
-          lowerer.unsupported(
-            "SC1101",
-            expr.right,
-            `storing '${lowerer.fmt(value.type)}' values in a checked-dynamic object (the value cannot convert into the checked-dynamic tree)`,
-          );
-        }
-        return {
-          kind: "exprStmt",
-          expr: { kind: "libCall", fn: "dyn.keySet", args: [obj, key, value], type: VOID, loc },
-          loc,
-        };
-      }
-    }
-    if (shape?.tuple) {
-      const idx = tupleLiteralIndex(target.argumentExpression);
-      if (idx === null) {
-        lowerer.unsupported(
-          "SC1090",
-          target.argumentExpression,
-          "tuple indexing with a non-literal index (tuples are fixed-shape — use t[0], t[1], ...)",
-        );
-      }
-      const fieldType = shape.fields.find((f) => f.name === String(idx))?.type;
-      if (fieldType === undefined) lowerer.badType(target, lowerer.typeOf(target));
-      const obj = lowerer.lowerExpr(target.expression);
-      const value = lowerer.lowerExprExpecting(expr.right, fieldType);
-      return {
-        kind: "recordSet",
-        obj,
-        shapeId: receiverIr.shapeId,
-        field: String(idx),
-        value,
-        loc: locOf(expr),
-      };
-    }
-    // Dynamic keyed write `r[k] = v` — index-signature shapes only (a
-    // declared-only shape's writable key set is closed; spell the field).
-    // A LITERAL declared key is the bracket spelling of a field write.
-    // Values flow into the index-value slot (dyn slots convert, typed
-    // slots coerce); declared-key collisions at runtime validate against
-    // the field's type through the emitted helper (a mismatch throws the
-    // catchable TypeError — SEMANTICS.md).
-    if (shape && !shape.tuple) {
-      const guarded = lowerGuardedRecordWrite(lowerer, expr, target);
-      if (guarded) return guarded;
-      // Literal keys — string literals AND numeric literals in their
-      // canonical string spelling (`b[1] = v` writes field/key "1", JS's
-      // own key derivation) — name declared fields directly. A key
-      // IDENTIFIER whose TYPE proves one literal (a literal-typed const,
-      // a keyof-constrained type parameter bound to a literal inside a
-      // generic instance — `set(o, "a", v)`'s body writing `o[k] = v`)
-      // is the same static field write.
-      const litKey =
-        recordKeyLiteralText(target.argumentExpression) ??
-        recordKeyTypeLiteralText(lowerer, target.argumentExpression);
-      if (litKey !== null) {
-        const field = shape.fields.find((f) => f.name === litKey);
-        if (field) {
-          const obj = lowerer.lowerExpr(target.expression);
-          const value = lowerer.lowerExprExpecting(expr.right, field.type);
-          return {
-            kind: "recordSet",
-            obj,
-            shapeId: receiverIr.shapeId,
-            field: litKey,
-            value,
-            loc: locOf(expr),
-          };
-        }
-      }
-      if (!shape.indexValue) {
-        // A SIGNATURE-FREE shape whose declared fields share ONE type
-        // writes through the same per-shape dispatch (the mockable-clock
-        // module shape: `mocked[functionality] = implementation` over a
-        // table of same-signature closures). A key naming no declared
-        // field throws the catchable TypeError — JS would ADD the
-        // property, which a monomorphic struct cannot (the SEMANTICS.md
-        // keyed-write-miss divergence). Mixed-type and accessor-carrying
-        // shapes keep the fence.
-        const common =
-          shape.fields.length > 0 &&
-          !shapeHasAccessorSlots(shape) &&
-          shape.fields.every((f) => typeEquals(f.type, shape.fields[0]!.type))
-            ? shape.fields[0]!.type
-            : null;
-        if (!common) {
-          lowerer.unsupported(
-            "SC1090",
-            target,
-            "dynamic keyed writes to records without an index signature (declared fields of ONE shared type dispatch by key — spell the field name otherwise)",
-          );
-        }
-        const obj = lowerer.lowerExpr(target.expression);
-        let key: IrExpr =
-          litKey !== null
-            ? { kind: "strLit", value: litKey, type: STRING, loc: locOf(target.argumentExpression) }
-            : lowerer.lowerExpr(target.argumentExpression);
-        // Runtime number/boolean/dyn keys stringify — ToPropertyKey,
-        // exactly the index-signature path's rule.
-        key = lowerRecordPropertyKey(lowerer, key, target.argumentExpression);
-        if (key.type.kind !== "string") {
-          lowerer.unsupported(
-            "SC1090",
-            target.argumentExpression,
-            "indexing records with non-string or non-number keys",
-          );
-        }
-        const value = lowerer.coerceInto(expr.right, lowerer.lowerExpr(expr.right), common);
-        if (!typeEquals(value.type, common))
-          lowerer.badType(expr.right, lowerer.typeOf(expr.right));
-        return {
-          kind: "recordKeySet",
-          obj,
-          shapeId: receiverIr.shapeId,
-          key,
-          value,
-          loc: locOf(expr),
-        };
-      }
-      // A LITERAL key naming no declared field is a pure overflow insert
-      // — no collision to validate. Runtime keys must be able to collide
-      // with every declared field: dyn slots validate through the
-      // dynCheck walker (fields must be dyn-convertible — the same
-      // convertibility the read needs); typed slots write through
-      // directly, so every field must BE the index-value type.
-      const overflowOnly = litKey !== null;
-      const writable =
-        overflowOnly ||
-        (shape.indexValue.kind === "dyn"
-          ? shape.fields.every((f) => lowerer.dynConvertible(f.type))
-          : shape.fields.every((f) => typeEquals(f.type, shape.indexValue!)));
-      if (!writable) {
-        lowerer.unsupported(
-          "SC1090",
-          target,
-          `dynamic keyed writes to '${lowerer.fmt(receiverIr)}' (a declared field's type cannot take the index signature's value at runtime)`,
-        );
-      }
-      const obj = lowerer.lowerExpr(target.expression);
-      let key =
-        litKey !== null
-          ? ({
-              kind: "strLit",
-              value: litKey,
-              type: STRING,
-              loc: locOf(target.argumentExpression),
-            } satisfies IrExpr)
-          : lowerer.lowerExpr(target.argumentExpression);
-      // Runtime NUMBER keys canonicalize through the JS-exact formatter
-      // (o[n] = v writes o[String(n)] — the number-keyed-signature path).
-      key = lowerRecordPropertyKey(lowerer, key, target.argumentExpression);
-      if (key.type.kind !== "string") {
-        lowerer.unsupported(
-          "SC1090",
-          target.argumentExpression,
-          "indexing records with non-string or non-number keys",
-        );
-      }
-      const value = lowerer.intoIndexValueSlot(
-        lowerer.lowerExpr(expr.right),
-        shape.indexValue,
-        expr.right,
-      );
-      return {
-        kind: "recordKeySet",
-        obj,
-        shapeId: receiverIr.shapeId,
-        key,
-        value,
-        ...(overflowOnly ? { overflowOnly: true as const } : {}),
-        loc: locOf(expr),
-      };
-    }
-  }
-  // Keyed write `d[k] = v` on a CHECKED-DYNAMIC receiver (a JS `any`
-  // dictionary — the Object.create(null) memo-table idiom writes
-  // `result[key] = value`): dyn.keySet, exactly the record-mapped dyn
-  // arm above — later writes win in insertion order, number keys
-  // canonicalize through the JS-exact formatter (ToPropertyKey's string
-  // side), index keys on dyn arrays set/extend elements, and non-object
-  // receivers throw Node's TypeErrors at runtime. An unmapped checker type
-  // probes the receiver's lowered representation: a dyn value takes the same
-  // write, anything else falls through to the fences.
-  if (receiverIr?.kind === "dyn" || receiverIr?.kind === "object" || receiverIr === null) {
-    const obj =
-      receiverIr !== null
-        ? lowerer.lowerExpr(target.expression)
-        : tryLowerExpression(lowerer, target.expression);
-    if (
-      obj !== null &&
-      (obj.type.kind === "dyn" ||
-        (obj.type.kind === "object" && obj.type.className === "%Error") ||
-        isDynTypedRefType(obj.type))
-    ) {
-      const loc = locOf(expr);
-      const litKey = recordKeyLiteralText(target.argumentExpression);
-      let key: IrExpr =
-        litKey !== null
-          ? { kind: "strLit", value: litKey, type: STRING, loc: locOf(target.argumentExpression) }
-          : lowerer.lowerExpr(target.argumentExpression);
-      key = lowerRecordPropertyKey(lowerer, key, target.argumentExpression);
-      if (key.type.kind !== "string") {
-        lowerer.unsupported(
-          "SC1090",
-          target.argumentExpression,
-          "indexing checked-dynamic values with non-string or non-number keys",
-        );
-      }
-      const value = lowerer.coerceToExpected(lowerer.lowerExpr(expr.right), DYN);
-      if (value.type.kind !== "dyn") {
-        lowerer.unsupported(
-          "SC1101",
-          expr.right,
-          `storing '${lowerer.fmt(value.type)}' values in a checked-dynamic object (the value cannot convert into the checked-dynamic tree)`,
-        );
-      }
-      return {
-        kind: "exprStmt",
-        expr: {
-          kind: "libCall",
-          fn: "dyn.keySet",
-          args: [lowerer.coerceToExpected(obj, DYN), key, value],
-          type: VOID,
-          loc,
-        },
-        loc,
-      };
-    }
-  }
-  if (receiverIr?.kind !== "array") {
-    lowerer.unsupported("SC1090", target, "assignment to non-array elements");
-  }
-  let arr = lowerer.lowerExpr(target.expression);
-
-  if (
-    arr.type.kind === "union" &&
-    lowerer.armTag(arr.type.unionId, UNDEFINED_T) >= 0 &&
-    receiverIr.kind === "array"
-  ) {
-    const present = lowerer.stripUndefinedArm(arr.type);
-    const helper =
-      present.kind === "array"
-        ? lowerer.narrowedArmHelper(arr.type.unionId, present, locOf(target.expression))
-        : null;
-    if (helper) {
-      arr = lowerer.checkedNarrowCall(helper, arr, present, locOf(target.expression));
-    }
-  }
-  if (arr.type.kind !== "array") {
-    lowerer.unsupported(
-      "SC1090",
-      target.expression,
-      "assignment through a possibly missing nested array receiver",
-    );
-  }
-  const index = lowerOptionalNumber(
-    lowerer,
-    lowerer.lowerExpr(target.argumentExpression),
-    locOf(target.argumentExpression),
-    target.argumentExpression,
-  );
-  if (index.type.kind === "dyn" && lowerer.dynConvertible(arr.type)) {
-    return {
-      kind: "exprStmt",
-      expr: lowerDynMemberAssignment(
-        lowerer,
-        expr,
-        lowerer.coerceInto(target.expression, arr, DYN),
-      ),
-      loc: locOf(expr),
-    };
-  }
-  if (index.type.kind !== "f64") {
-    lowerer.unsupported("SC1090", target.argumentExpression, "indexing with non-number keys");
-  }
-  // Optional array reads carry the source array's payload type plus an
-  // undefined arm. arrayValueStore turns that arm into the runtime's
-  // UNDEFINED state while keeping number[]/string[] payload storage scalar.
-  let literal = expr.right;
-  while (ts.isParenthesizedExpression(literal) || ts.isSatisfiesExpression(literal))
-    literal = literal.expression;
-  const value =
-    ts.isObjectLiteralExpression(literal) || ts.isArrayLiteralExpression(literal)
-      ? lowerer.lowerExprExpecting(literal, arr.type.elem)
-      : lowerer.lowerExpr(expr.right);
-  // Validate the payload before emitting a native store. A dormant JS
-  // method can contradict its JSDoc element type; retain its call-time
-  // refusal instead of leaving invalid IR in a newly reachable method.
-  const expected =
-    value.type.kind === "undefinedT" ||
-    (value.type.kind === "union" && lowerer.armTag(value.type.unionId, UNDEFINED_T) >= 0)
-      ? arrayValueType(lowerer, arr.type.elem)
-      : arr.type.elem;
-  return arrayValueStore(
-    lowerer,
-    arr,
-    index,
-    lowerer.coerceInto(expr.right, value, expected),
-    arr.type.elem,
-    locOf(expr),
-  );
-}
-
-/** Environment property names use ToPrimitive with the string hint, so
- * checked objects must execute their own conversion hooks. */
-export function lowerEnvironmentKey(lowerer: Lowerer, node: ts.Expression): IrExpr {
-  const key = lowerer.lowerExpr(node);
-  if (key.type.kind === "dyn")
-    return { kind: "libCall", fn: "dyn.toStringCoerce", args: [key], type: STRING, loc: key.loc };
-  return lowerRecordPropertyKey(lowerer, key, node);
-}
+/** Node 24's Web-platform constructor globals: `typeof` answers
+ * "function" for each. */
+const NODE_CONSTRUCTOR_GLOBALS: ReadonlySet<string> = new Set([
+  "AbortController",
+  "AbortSignal",
+  "Blob",
+  "BroadcastChannel",
+  "CustomEvent",
+  "DOMException",
+  "Event",
+  "EventTarget",
+  "File",
+  "FormData",
+  "Headers",
+  "MessageChannel",
+  "MessageEvent",
+  "MessagePort",
+  "ReadableStream",
+  "Request",
+  "Response",
+  "TextDecoder",
+  "TextEncoder",
+  "TransformStream",
+  "URL",
+  "URLSearchParams",
+  "WritableStream",
+]);
 
 /** An operand of `+` with a string: ToString of ToPrimitive with the
  * default hint, which tries a class instance's valueOf before toString. */
-function concatOperand(lowerer: Lowerer, e: IrExpr, node: ts.Node): IrExpr {
+export function concatOperand(lowerer: Lowerer, e: IrExpr, node: ts.Node): IrExpr {
   return (
     classToStringConversion(lowerer, e, "default", node) ??
     classUnionToString(lowerer, e, "default", node) ??
@@ -9034,238 +1691,6 @@ function concatOperand(lowerer: Lowerer, e: IrExpr, node: ts.Node): IrExpr {
   );
 }
 
-export function ensureString(lowerer: Lowerer, e: IrExpr, node: ts.Node): IrExpr {
-  if (e.type.kind === "string") return e;
-  if (e.type.kind === "url")
-    return { kind: "libCall", fn: "url.href", args: [e], type: STRING, loc: e.loc };
-  // String(date) / `${date}` / "" + date: Date's ToPrimitive prefers
-  // toString().
-  if (e.type.kind === "date")
-    return { kind: "libCall", fn: "date.toString", args: [e], type: STRING, loc: e.loc };
-  if (e.type.kind === "regex") {
-    return {
-      kind: "regexIntrinsic",
-      method: "toString",
-      receiver: e,
-      args: [],
-      type: STRING,
-      loc: e.loc,
-    };
-  }
-  if (e.type.kind === "bigint") {
-    return {
-      kind: "libCall",
-      fn: "bigint.toString",
-      args: [e, { kind: "numLit", value: 10, type: F64, loc: e.loc }],
-      type: STRING,
-      loc: e.loc,
-    };
-  }
-  if (e.type.kind === "dyn") {
-    // String(u) / `${u}`: a runtime dispatch over the dyn kind — Node's
-    // String() exactly (undefined/null texts, JS number formatting,
-    // strings verbatim, arrays via join, objects as "[object Object]").
-    return { kind: "toString", operand: e, type: STRING, loc: e.loc };
-  }
-  if (e.type.kind === "bytes") {
-    // Preserve the runtime brand: typed arrays join numeric elements,
-    // while a Buffer stored in a Uint8Array slot decodes its bytes.
-    const boxed: IrExpr = { kind: "dynFrom", value: e, type: DYN, loc: e.loc };
-    return { kind: "toString", operand: boxed, type: STRING, loc: e.loc };
-  }
-
-  if (e.type.kind === "object") {
-    // String(err) / `${err}` uses the same dispatch as err.toString().
-    for (let c = lowerer.classes.get(e.type.className) ?? null; c; c = c.base) {
-      if (c.builtinError) {
-        return errorToStringCall(lowerer, e);
-      }
-    }
-    // A program class instance converts through its own methods.
-    const converted = classToStringConversion(lowerer, e, "string", node);
-    if (converted) return converted;
-  }
-  if (e.type.kind === "union") {
-    // `${u}` — the arm's ToString via a per-union interned helper
-    // (sc_us_*), Node-exact per arm kind: unit arms are the known texts
-    // "undefined"/"null", string arms pass through, f64/bool arms use the
-    // JS-exact formatters. Ref arms (records, arrays, ...) stay fenced:
-    // JS would print "[object Object]" and friends — narrow first.
-    const def = lowerer.unions.get(e.type.unionId);
-    const stringable = def?.arms.every(
-      (a) =>
-        a.kind === "undefinedT" ||
-        a.kind === "nullT" ||
-        a.kind === "string" ||
-        a.kind === "f64" ||
-        a.kind === "bigint" ||
-        a.kind === "bool",
-    );
-    if (stringable) {
-      return { kind: "toString", operand: e, type: STRING, loc: e.loc };
-    }
-    // Runtime-optional locals can retain their stored union after the
-    // checker has narrowed this use to a primitive arm. Validate that
-    // arm before converting it; an unguarded object arm stays fenced.
-    const narrowed = lowerer.mapTypeOf(lowerer.typeOf(node));
-    if (
-      narrowed &&
-      (narrowed.kind === "string" ||
-        narrowed.kind === "f64" ||
-        narrowed.kind === "bool" ||
-        narrowed.kind === "bigint")
-    ) {
-      const helper = lowerer.narrowedArmHelper(e.type.unionId, narrowed, e.loc);
-      if (helper) {
-        return ensureString(lowerer, lowerer.checkedNarrowCall(helper, e, narrowed, e.loc), node);
-      }
-    }
-    if (
-      narrowed?.kind === "union" &&
-      !typeEquals(narrowed, e.type) &&
-      lowerer.unions
-        .get(narrowed.unionId)
-        ?.arms.every(
-          (arm) =>
-            isUnitType(arm) ||
-            arm.kind === "string" ||
-            arm.kind === "f64" ||
-            arm.kind === "bool" ||
-            arm.kind === "bigint",
-        )
-    ) {
-      const helper = lowerer.narrowedRetagHelper(node, e.type.unionId, narrowed.unionId, e.loc);
-      if (helper)
-        return ensureString(
-          lowerer,
-          { kind: "call", callee: helper, args: [e], type: narrowed, loc: e.loc },
-          node,
-        );
-    }
-    const viaClasses = classUnionToString(lowerer, e, "string", node);
-    if (viaClasses) return viaClasses;
-    lowerer.unsupported(
-      "SC1090",
-      node,
-      `string conversions of unions with object arms (${NARROW_FIRST})`,
-    );
-  }
-  if (e.type.kind === "symbol") {
-    // JS splits here: `${sym}` and concatenation THROW a TypeError,
-    // String(sym) answers "Symbol(desc)". One shared lowering cannot
-    // honor both — fence with the sanctioned spelling instead of
-    // guessing the context.
-    lowerer.unsupported(
-      "SC1090",
-      node,
-      "string conversions of symbol values (template literals throw in JS — call .toString() explicitly)",
-    );
-  }
-  if (isUnitType(e.type)) {
-    if (e.kind === "unitLit") {
-      return { kind: "strLit", value: e.unit, type: STRING, loc: e.loc };
-    }
-    // Keep sequencing and branch effects even though the final unit's
-    // spelling is constant. Never turn an unknown producer into a literal.
-    if (e.kind === "seqExpr") {
-      return { ...e, result: lowerer.ensureString(e.result, node), type: STRING };
-    }
-    if (e.kind === "ternary") {
-      return {
-        ...e,
-        then: lowerer.ensureString(e.then, node),
-        else_: lowerer.ensureString(e.else_, node),
-        type: STRING,
-      };
-    }
-    lowerer.unsupported(
-      "SC1090",
-      node,
-      `string conversions of '${e.type.kind === "undefinedT" ? "undefined" : "null"}' values`,
-    );
-  }
-  if (e.type.kind === "array") {
-    // `${[1,2,3]}` / String(arr): Array.prototype.toString IS join(",")
-    // — the SAME intrinsic the .join() lowering emits, fenced to the
-    // same element kinds (f64/string/bool, unions of those with unit
-    // arms printing empty). Nested arrays would need JS's recursive
-    // dispatch — the join fence already tells that story.
-    const elem = e.type.elem;
-    const joinableUnion =
-      elem.kind === "union" &&
-      (lowerer.unions
-        .get(elem.unionId)
-        ?.arms.every(
-          (a) => a.kind === "f64" || a.kind === "string" || a.kind === "bool" || isUnitType(a),
-        ) ??
-        false);
-    if (elem.kind === "f64" || elem.kind === "string" || elem.kind === "bool" || joinableUnion) {
-      const sep: IrExpr = { kind: "strLit", value: ",", type: STRING, loc: e.loc };
-      return {
-        kind: "arrIntrinsic",
-        method: "join",
-        receiver: e,
-        args: [sep],
-        type: STRING,
-        loc: e.loc,
-      };
-    }
-  }
-  if (e.type.kind === "record") {
-    // `${obj}` / String(obj): a plain data record has no toString of its
-    // own (a func-typed `toString` FIELD would shadow the prototype's —
-    // JS would call it, so that shape keeps the fence), and a TUPLE
-    // prints its elements like an array (not lowered — fenced) — every
-    // other record is Object.prototype.toString's constant.
-    const shape = lowerer.shapes.get(e.type.shapeId);
-    if (isPerfEntryType(lowerer, e.type)) return perfEntryTag(lowerer, e, e.type, e.loc);
-    if (shape && !shape.tuple && !shape.fields.some((f) => f.name === "toString")) {
-      // A null-prototype record (Object.groupBy) has no toString or
-      // valueOf: ToPrimitive throws Node's TypeError.
-      const nullProtoT = nullProtoRecordShape(lowerer, e.type);
-      if (nullProtoT) return nullProtoToString(lowerer, e, nullProtoT);
-      return { kind: "toString", operand: e, type: STRING, loc: e.loc };
-    }
-  }
-  if (e.type.kind !== "f64" && e.type.kind !== "bool") lowerer.badType(node, lowerer.typeOf(node));
-  return { kind: "toString", operand: e, type: STRING, loc: e.loc };
-}
-
-/** String(r) over a record that may have a null prototype: an interned
- * helper that throws Node's TypeError for a null-prototype record and
- * answers "[object Object]" otherwise. */
-function nullProtoToString(lowerer: Lowerer, e: IrExpr, t: IrType & { kind: "record" }): IrExpr {
-  const loc = e.loc;
-  const key = `nullProtoToString:${t.shapeId}`;
-  let helper = lowerer.valueHelpers.get(key);
-  if (!helper) {
-    helper = `%rec.tostr.${lowerer.valueHelpers.size}`;
-    lowerer.valueHelpers.set(key, helper);
-    const r = varRef("r.0", t, loc);
-    lowerer.liftedFns.push({
-      name: helper,
-      params: [{ localId: "r.0", name: "r", type: t }],
-      returnType: STRING,
-      locals: [{ id: "r.0", name: "r", type: t, mutable: false }],
-      body: [
-        {
-          kind: "return",
-          value: guardNullProto(
-            r,
-            t.shapeId,
-            "Cannot convert object to primitive value",
-            { kind: "toString", operand: r, type: STRING, loc },
-            loc,
-          ),
-          loc,
-        },
-      ],
-      loc,
-    });
-  }
-  return { kind: "call", callee: helper, args: [e], type: STRING, loc };
-}
-
 /** `new String(x)` (stdlib provenance, ≤1 argument) in a ToString
  * position: the wrapper's only distinguishers are typeof and identity —
  * neither is observable where the value immediately stringifies — so the
@@ -9319,701 +1744,6 @@ export function lowerTemplate(lowerer: Lowerer, expr: ts.TemplateExpression): Ir
   return pieces.reduce((acc, p) => ({ kind: "strConcat", left: acc, right: p, type: STRING, loc }));
 }
 
-/** `x as T`. Non-dyn inner values ordinarily erase; a record assertion
- * changing monomorphic shape rebuilds through the established width-copy
- * path so its represented value agrees with its asserted type.
- * A dyn ('unknown') inner value makes this THE dynamic boundary:
- * - `as unknown` (dyn → dyn) stays erasure;
- * - dyn → a JSON-representable target type T compiles to `dynCheck`, a
- *   runtime validation that builds the typed value or THROWS a catchable
- *   TypeError-flavored error (JS `as` never checks — the headline
- *   documented divergence: a lying cast throws instead of corrupting
- *   memory);
- * - dyn → anything else (closures, class instances, void) is rejected:
- *   those types cannot be found inside a JSON dyn. */
-/** `e as T` and the old-style assertion `<T>e` — one node shape (both
- * carry `.type` and `.expression`), one lowering. */
-export function lowerAsExpression(
-  lowerer: Lowerer,
-  expr: ts.AsExpression | ts.TypeAssertion,
-): IrExpr {
-  // `[] as const` — tsgo panics computing the expression's `readonly []`
-  // type (the facade's fence answers `any`), but the syntax pins the
-  // value exactly: the empty tuple, ridden as the unit-element array
-  // (mapType's empty-tuple rule). Lower it directly; enclosing slots
-  // coerce like any other empty-array source.
-  if (
-    ts.isAsExpression(expr) &&
-    isConstAssertionTypeNode(expr.type) &&
-    ts.isArrayLiteralExpression(expr.expression) &&
-    expr.expression.elements.nodes.length === 0
-  ) {
-    return {
-      kind: "arrayLit",
-      elems: [],
-      type: arrayOf(unitOnlyUnion(lowerer.unions)),
-      loc: locOf(expr),
-    };
-  }
-  // `e as C` on a CATCH BINDING (`(err as Error).message`): the checked
-  // extraction — an instanceof match extracts the payload, anything else
-  // throws the catchable TypeError (dynCheck's trust-but-verify stance,
-  // extended to exception payloads). Intercepts BEFORE lowerExpr — the
-  // raw read would hit caughtRead's narrowness fence.
-  const caughtLocal = lowerer.caughtLocalOf(expr.expression);
-  if (caughtLocal) {
-    const loc = locOf(expr);
-    const targetTs = lowerer.checker.getTypeFromTypeNode(expr.type);
-    const target = lowerer.mapTypeOf(targetTs);
-    if (target?.kind === "object") {
-      const info = lowerer.classes.get(target.className);
-      if (info && lowerer.inHierarchy(info)) {
-        return {
-          kind: "caughtCheck",
-          value: { kind: "varRef", localId: caughtLocal.id, type: CAUGHT, loc },
-          className: target.className,
-          type: target,
-          loc,
-        };
-      }
-    }
-    // Structural assertions use the ordinary checked dynamic bridge. It
-    // retains primitive values and native class identity before validating
-    // the requested shape; an assertion does not bypass runtime checks.
-    const narrowed = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
-    const bridged =
-      narrowed &&
-      (narrowed.kind === "f64" ||
-        narrowed.kind === "bool" ||
-        narrowed.kind === "string" ||
-        narrowed.kind === "object" ||
-        narrowed.kind === "dyn");
-    if (!bridged) lowerer.unsupported("SC1063", expr);
-  }
-  const inner = lowerer.lowerExpr(expr.expression);
-  const use = runtimeOptionalUseOf(expr);
-  if (inner.type.kind === "union" && runtimeOptionalAssertionErases(lowerer, expr, inner, use))
-    return inner;
-  if (inner.type.kind !== "dyn") {
-    const targetTs0 = lowerer.checker.getTypeFromTypeNode(expr.type);
-    const target = lowerer.mapTypeOf(targetTs0);
-    if (target?.kind === "object") {
-      const asserted = checkedClassAssertion(lowerer, inner, target, locOf(expr));
-      if (asserted) return asserted;
-    }
-    // Unknown-only record views use the checked-dynamic representation.
-    // A native record asserted to such a view still denotes the original
-    // object. Box a live reference instead of erasing the assertion and
-    // handing native storage to a checked-dynamic property operation.
-    if (target?.kind === "dyn" && (targetTs0.flags & ts.TypeFlags.Object) !== 0) {
-      // A class instance asserted to a class-backed protocol view (a type
-      // class instances flow into): the same identity-keeping box an
-      // implicit flow into the view uses.
-      if (inner.type.kind === "object" && lowerer.classImplementedProtocol(targetTs0))
-        return lowerer.coerceInto(expr, inner, DYN);
-      const sourceShape =
-        inner.type.kind === "record" ? lowerer.shapes.get(inner.type.shapeId) : undefined;
-      if (
-        hasClassPayload(lowerer, inner.type) ||
-        (sourceShape && shapeHasAccessorSlots(sourceShape))
-      ) {
-        lowerer.unsupported(
-          "SC1090",
-          expr,
-          "opaque structural views of classes or accessor records (name the property's concrete type to retain native accessor dispatch)",
-        );
-      }
-      const boxed = lowerer.coerceInto(expr, inner, DYN);
-      // Only references box live; a scalar or unit source (`value as
-      // unknown as View`) is an ordinary snapshot.
-      const seen = new Set<string>();
-      const live = (type: IrType): boolean => {
-        if (
-          type.kind === "record" ||
-          type.kind === "array" ||
-          type.kind === "bytes" ||
-          isDynTypedRefType(type)
-        )
-          return true;
-        if (type.kind !== "union" || seen.has(type.unionId)) return false;
-        seen.add(type.unionId);
-        return lowerer.unions.get(type.unionId)?.arms.some(live) ?? false;
-      };
-      return boxed.kind === "dynFrom" && live(boxed.value.type)
-        ? { ...boxed, liveRef: true }
-        : boxed;
-    }
-    // Collection assertions are interface views only: their backing
-    // value must already have the same native key/element/value layout.
-    // Erasing a mock or a different instantiation here would let member
-    // lowering interpret a record (or another ABI) as a native handle.
-    if (target?.kind === "map" || target?.kind === "set") {
-      return lowerer.coerceInto(expr, inner, target);
-    }
-    // A class-derived interface still names the class's native layout.
-    // An assertion must not let a structural mock acquire that layout;
-    // unions retain their checked extraction below, and real instances
-    // keep the ordinary class narrowing path.
-    if (target?.kind === "object" && inner.type.kind !== "object" && inner.type.kind !== "union") {
-      return lowerer.coerceInto(expr, inner, target);
-    }
-    if (
-      target?.kind === "object" &&
-      inner.type.kind === "object" &&
-      !typeEquals(target, inner.type) &&
-      !lowerer.isSubclassOf(inner.type.className, target.className) &&
-      !lowerer.isSubclassOf(target.className, inner.type.className)
-    ) {
-      return lowerer.coerceInto(expr, inner, target);
-    }
-    // Static assertions normally erase, but record layouts are
-    // monomorphic: a consumer selected from the asserted shape must see
-    // that shape physically. Reuse the ordinary slot coercion so plain
-    // widths and index-signature captures share their established copy
-    // semantics (and unsupported pairs report SC2002 at this assertion).
-    if (
-      inner.type.kind === "record" &&
-      target?.kind === "record" &&
-      inner.type.shapeId !== target.shapeId
-    ) {
-      return lowerer.coerceInto(expr, inner, target);
-    }
-    // `u as Arm` on a UNION value is `u!`'s spelling with a named arm
-    // (`req.headers[h] as string`): the CHECKED single-arm extraction —
-    // the asserted arm's payload comes out, any other arm throws the
-    // catchable TypeError (divergence 38's lying-assertion stance; an
-    // erasure would just move the failure to the next typed slot as an
-    // opaque union-mismatch fence). Sub-union targets and same-type
-    // casts keep the historic erasure.
-    if (inner.type.kind === "union") {
-      if (target && target.kind !== "union" && !typeEquals(target, inner.type)) {
-        const helper = lowerer.narrowedArmHelper(inner.type.unionId, target, locOf(expr));
-        if (helper) {
-          return lowerer.checkedNarrowCall(helper, inner, target, locOf(expr));
-        }
-      }
-    }
-    // `node.parent as Sub | undefined`: a union target whose class arm is
-    // narrower than the stored class gets the same checked class view as
-    // `node.parent as Sub`; the other arms keep their identical tags.
-    if (
-      target?.kind === "union" &&
-      (inner.type.kind === "union" || inner.type.kind === "object") &&
-      !typeEquals(target, inner.type)
-    ) {
-      const asserted = checkedClassUnionAssertion(lowerer, inner, target, locOf(expr));
-      if (asserted) return asserted;
-    }
-    return inner; // erasure, unchanged
-  }
-
-  const targetTs = lowerer.checker.getTypeFromTypeNode(expr.type);
-  const target = lowerer.mapTypeOf(targetTs) ?? dynFallbackType(lowerer, expr.type, targetTs);
-  if (!target) lowerer.badType(expr.type, targetTs);
-  if (target.kind === "dyn") return inner; // `as unknown`: erasure
-  // An all-`unknown`-fields record target (`err as { code?: unknown }`
-  // — the errno-probing idiom): there is nothing to validate (every
-  // field is unknown, exactly what the dyn value already answers) and
-  // nothing to build — the cast is pure typing, so it ERASES and the
-  // reads ride the dyn keyed read.
-  if (target.kind === "record") {
-    const shape = lowerer.shapes.get(target.shapeId);
-    if (
-      shape &&
-      !shape.tuple &&
-      shape.fields.every((f) => f.type.kind === "dyn") &&
-      (!shape.indexValue || shape.indexValue.kind === "dyn")
-    ) {
-      return inner;
-    }
-  }
-  if (
-    target.kind === "void" ||
-    !canDynCheckTo(
-      target,
-      (id) => lowerer.shapes.get(id),
-      (id) => lowerer.unions.get(id),
-    )
-  ) {
-    // Bare undefined-armed targets pass when every OTHER arm is
-    // JSON-safe: the checked-dynamic tree holds a first-class undefined value now
-    // (index-signature overflow reads produce it for missing keys), and
-    // the undefined arm matches exactly it — `p[key] as string |
-    // undefined` is the missing-key idiom. Parsed JSON still never
-    // contains undefined, so casts over parse results keep failing on
-    // non-string values with the usual path-annotated TypeError.
-    if (target.kind === "union" && lowerer.dynConvertible(target)) {
-      return { kind: "dynCheck", value: inner, type: target, loc: locOf(expr) };
-    }
-    // Uint8Array targets: the checked-dynamic tree carries a bytes kind now (converted
-    // stdin chunks) — the extraction validates the kind and copies out.
-    if (target.kind === "bytes" && target.elem === "u8") {
-      return { kind: "dynCheck", value: inner, type: target, loc: locOf(expr) };
-    }
-    // Class instances round-trip only through compiler-owned typed
-    // references. Plain JSON objects fail the runtime class-brand check;
-    // exact capsules unwrap the original object by identity.
-    if (isDynTypedRefType(target)) {
-      return { kind: "dynCheck", value: inner, type: target, loc: locOf(expr) };
-    }
-    // ADAPTABLE function targets (`u as (x: number) => number` — the
-    // checked-dynamic function boundary): kind check, then exact unwrap
-    // or the per-target adapter shim. Non-adaptable signatures keep the
-    // fence below.
-    if (
-      target.kind === "func" &&
-      canAdaptDynFuncTo(
-        target,
-        (id) => lowerer.shapes.get(id),
-        (id) => lowerer.unions.get(id),
-      )
-    ) {
-      return { kind: "dynCheck", value: inner, type: target, loc: locOf(expr) };
-    }
-    // Runtime HANDLE targets (`u as IncomingMessage` — a boxed handle
-    // coming back out of an untyped wrapper): a tag-checked reference
-    // unwrap, identity preserved (DYN_HANDLE_KINDS).
-    if (DYN_HANDLE_KINDS.has(target.kind)) {
-      return { kind: "dynCheck", value: inner, type: target, loc: locOf(expr) };
-    }
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      `a checked cast of 'unknown' to '${target.kind === "void" ? "void" : lowerer.fmt(target)}' ` +
-        `(a dynamic value can only be validated against JSON-representable types: ` +
-        `number, string, boolean, records, arrays, and unions of those)`,
-    );
-  }
-  return { kind: "dynCheck", value: inner, type: target, loc: locOf(expr) };
-}
-
-export function lowerPrefixUnary(lowerer: Lowerer, expr: ts.PrefixUnaryExpression): IrExpr {
-  const loc = locOf(expr);
-  switch (expr.operator) {
-    case ts.SyntaxKind.MinusToken: {
-      const raw = lowerer.lowerExpr(expr.operand);
-
-      if (raw.type.kind === "bigint") {
-        return { kind: "libCall", fn: "bigint.neg", args: [raw], type: BIGINT_T, loc };
-      }
-      // Match the checked numeric boundary used by JS binary arithmetic.
-      const operand =
-        raw.type.kind === "dyn" && isJsSourceFile(expr.getSourceFile())
-          ? { kind: "dynCheck" as const, value: raw, type: F64, loc }
-          : lowerOptionalNumber(lowerer, raw, loc, expr.operand);
-      if (operand.type.kind !== "f64") operatorUnsupported(lowerer, expr, "-", [raw.type]);
-      if (operand.kind === "numLit") return { ...operand, value: -operand.value, loc };
-      return { kind: "unary", op: "-", operand, type: F64, loc };
-    }
-    case ts.SyntaxKind.PlusToken: {
-      const raw = lowerer.lowerExpr(expr.operand);
-      if (raw.type.kind === "dyn") {
-        return { kind: "libCall", fn: "dyn.toNumberCoerce", args: [raw], type: F64, loc };
-      }
-      // Unary + is ToNumber; on an already-number operand it's identity,
-      // and a STRING operand runs the runtime's ECMA-exact StringToNumber
-      // (num.fromString — Number(aString)'s lowering, scr_string.c).
-
-      if (raw.type.kind === "string") {
-        return { kind: "libCall", fn: "num.fromString", args: [raw], type: F64, loc };
-      }
-      const classNumber = classToNumberConversion(lowerer, raw, expr.operand, "unary plus");
-      if (classNumber) return classNumber;
-      const operand = lowerOptionalNumber(lowerer, raw, loc, expr.operand);
-      if (operand.type.kind !== "f64") operatorUnsupported(lowerer, expr, "+", [raw.type]);
-      return operand;
-    }
-    case ts.SyntaxKind.ExclamationToken: {
-      // `!x` is ToBoolean-then-negate: f64/string operands go through toBool.
-      const operand = lowerer.ensureBool(
-        deferredSlotOr(
-          lowerer,
-          runtimeOptionalStorageOperand(lowerer, expr.operand) ?? lowerer.lowerExpr(expr.operand),
-        ),
-        expr.operand,
-      );
-      return { kind: "unary", op: "!", operand, type: BOOL, loc };
-    }
-    case ts.SyntaxKind.TildeToken: {
-      // `~x`: ToInt32, complement, back to f64 (JS-exact, incl. NaN → -1).
-      const raw = lowerer.lowerExpr(expr.operand);
-      if (raw.type.kind === "bigint") {
-        return { kind: "libCall", fn: "bigint.not", args: [raw], type: BIGINT_T, loc };
-      }
-      if (raw.type.kind === "dyn")
-        return {
-          kind: "libCall",
-          fn: "dyn.bitwise",
-          args: [raw, dynUndefinedExpr(loc), { kind: "strLit", value: "~", type: STRING, loc }],
-          type: DYN,
-          loc,
-        };
-      // A checked-dynamic value retains enough JavaScript structure to
-      // run exact ToNumber, including the object valueOf/toString
-      // protocol. This is the static `any`/JS-lane answer for idioms
-      // such as `while (~index)`, where inference may have widened an
-      // otherwise numeric slot to the checked-dynamic tree.
-      const operand = lowerOptionalNumber(lowerer, raw, loc, expr.operand);
-      if (operand.type.kind !== "f64") operatorUnsupported(lowerer, expr, "~", [raw.type]);
-      return { kind: "unary", op: "~", operand, type: F64, loc };
-    }
-    case ts.SyntaxKind.PlusPlusToken:
-    case ts.SyntaxKind.MinusMinusToken:
-      // `++x` / `--x` in expression position: yields the NEW value.
-      return lowerIncDec(lowerer, expr, true);
-  }
-  lowerer.unsupported("SC1090", expr, `syntax '${ts.syntaxKindName(expr.kind)}'`);
-}
-
-/** Member updates evaluate the reference once, convert its old value with
- * ToNumeric, store the new value, then yield the old or new numeric value. */
-export function lowerIncDec(
-  lowerer: Lowerer,
-  expr: ts.PrefixUnaryExpression | ts.PostfixUnaryExpression,
-  prefix: boolean,
-): IrExpr {
-  const loc = locOf(expr);
-  const op = expr.operator === ts.SyntaxKind.PlusPlusToken ? "+" : "-";
-  if (!ts.isIdentifier(expr.operand)) {
-    const access = expr.operand;
-    if (
-      (!ts.isPropertyAccessExpression(access) && !ts.isElementAccessExpression(access)) ||
-      access.questionDotToken
-    ) {
-      lowerer.unsupported("SC1045", expr, "increment/decrement of this target");
-    }
-    fenceNodeModuleMutation(lowerer, access, "assignment");
-    if (ts.isPropertyAccessExpression(access)) {
-      const target =
-        staticFieldWriteTarget(lowerer, access) ??
-        expandoWritableTarget(lowerer, access) ??
-        nsWritableTarget(lowerer, access);
-      if (target) {
-        return lowerIncDecTarget(lowerer, expr, target, prefix);
-      }
-    }
-    const stmts: IrStmt[] = [];
-    const save = (value: IrExpr, name: string): IrExpr => {
-      const local = lowerer.declareHiddenLocal(name, value.type);
-      stmts.push({ kind: "varDecl", localId: local.id, init: value, loc });
-      return varRef(local.id, value.type, loc);
-    };
-    const finish = (read: IrExpr, write: (value: IrExpr) => IrStmt): IrExpr => {
-      if (read.type.kind === "bigint") {
-        const old = save(read, "%incrementOld");
-        const next = save(bigintStep(op, old, loc), "%incrementNext");
-        stmts.push(write(next));
-        const result = prefix ? next : old;
-        return { kind: "seqExpr", stmts, result, type: result.type, loc };
-      }
-      const old = save(
-        read.type.kind === "f64"
-          ? read
-          : {
-              kind: "libCall",
-              fn: "dyn.toNumeric",
-              args: [lowerer.coerceInto(access, read, DYN)],
-              type: DYN,
-              loc,
-            },
-        "%incrementOld",
-      );
-      const next = save(
-        old.type.kind === "f64"
-          ? {
-              kind: "bin",
-              op,
-              left: old,
-              right: { kind: "numLit", value: 1, type: F64, loc },
-              type: F64,
-              loc,
-            }
-          : {
-              kind: "libCall",
-              fn: "dyn.increment",
-              args: [old, { kind: "boolLit", value: op === "+", type: BOOL, loc }],
-              type: DYN,
-              loc,
-            },
-        "%incrementNext",
-      );
-      stmts.push(write(next));
-      const result = prefix ? next : old;
-      return { kind: "seqExpr", stmts, result, type: result.type, loc };
-    };
-    const raw = lowerer.lowerExpr(access.expression);
-    // Keep native array/byte storage: boxing a native array can create a
-    // checked view, which is not a substitute for updating its slot.
-    if (
-      ts.isElementAccessExpression(access) &&
-      (raw.type.kind === "array" || raw.type.kind === "bytes")
-    ) {
-      const receiver = save(raw, "%incrementArray");
-      const rawIndex = lowerer.lowerExpr(access.argumentExpression);
-      const index = save(
-        rawIndex.type.kind === "dyn" && isJsSourceFile(expr.getSourceFile())
-          ? { kind: "libCall", fn: "dyn.toNumberCoerce", args: [rawIndex], type: F64, loc }
-          : rawIndex,
-        "%incrementIndex",
-      );
-      if (index.type.kind !== "f64")
-        lowerer.unsupported("SC1090", access, "incrementing non-number array keys");
-      const type = raw.type;
-      const read: IrExpr =
-        type.kind === "array"
-          ? type.elem.kind === "f64"
-            ? arrayNumberRead(receiver, index, loc)
-            : arrayValueRead(lowerer, receiver, index, type.elem, loc)
-          : {
-              kind: "bytesIntrinsic",
-              method: "get",
-              receiver,
-              args: [index],
-              type: F64,
-              loc,
-              invalidNaN: true,
-            };
-      return finish(read, (value) =>
-        type.kind === "array"
-          ? arrayValueStore(
-              lowerer,
-              receiver,
-              index,
-              lowerer.coerceInto(access, value, type.elem),
-              type.elem,
-              loc,
-            )
-          : {
-              kind: "bytesSet",
-              arr: receiver,
-              index,
-              value: lowerer.coerceInto(access, value, F64),
-              loc,
-            },
-      );
-    }
-    // A TS member statically typed number on a checked-dynamic receiver (a
-    // class-backed protocol view): the expanded form `o.v = o.v + 1`, its
-    // read checked into number like any other read of the member.
-    const checkedNumber =
-      !isJsSourceFile(expr.getSourceFile()) &&
-      raw.type.kind === "dyn" &&
-      lowerer.mapTypeOf(lowerer.typeOf(access))?.kind === "f64";
-    if ((isJsSourceFile(expr.getSourceFile()) || checkedNumber) && raw.type.kind === "dyn") {
-      const receiver = save(raw, "%incrementReceiver");
-      const key = save(
-        ts.isElementAccessExpression(access)
-          ? lowerer.lowerExprExpecting(access.argumentExpression, DYN)
-          : lowerer.coerceInto(
-              access,
-              { kind: "strLit", value: access.name.text, type: STRING, loc },
-              DYN,
-            ),
-        "%incrementKey",
-      );
-      const read: IrExpr = { kind: "dynKeyGet", value: receiver, key, type: DYN, loc };
-      return finish(checkedNumber ? lowerer.coerceInto(access, read, F64) : read, (value) => ({
-        kind: "exprStmt",
-        expr: {
-          kind: "libCall",
-          fn: "dyn.keySetComputed",
-          args: [receiver, key, lowerer.coerceInto(access, value, DYN)],
-          type: VOID,
-          loc,
-        },
-        loc,
-      }));
-    }
-    const target = ts.isPropertyAccessExpression(access)
-      ? lowerer.fieldTarget(access)
-      : symbolFieldTarget(lowerer, access);
-    if (target && lowerer.dynConvertible(target.fieldType)) {
-      checkDeferredMemberReceiver(lowerer, target, access);
-      target.obj = save(target.obj, "%incrementReceiver");
-      return finish(lowerer.fieldGetExpr(target, loc, access), (value) =>
-        lowerer.fieldSetStmt(
-          target,
-          lowerer.coerceInto(access, value, target.fieldType),
-          loc,
-          access,
-        ),
-      );
-    }
-    if (isJsSourceFile(expr.getSourceFile()) && lowerer.dynConvertible(raw.type)) {
-      const receiver = save(lowerer.coerceInto(access.expression, raw, DYN), "%incrementReceiver");
-      const key = save(
-        ts.isElementAccessExpression(access)
-          ? lowerer.lowerExprExpecting(access.argumentExpression, DYN)
-          : lowerer.coerceInto(
-              access,
-              { kind: "strLit", value: access.name.text, type: STRING, loc },
-              DYN,
-            ),
-        "%incrementKey",
-      );
-      return finish({ kind: "dynKeyGet", value: receiver, key, type: DYN, loc }, (value) => ({
-        kind: "exprStmt",
-        expr: {
-          kind: "libCall",
-          fn: "dyn.keySetComputed",
-          args: [receiver, key, lowerer.coerceInto(access, value, DYN)],
-          type: VOID,
-          loc,
-        },
-        loc,
-      }));
-    }
-    lowerer.unsupported("SC1045", expr, "increment/decrement of this member target");
-  }
-  const target = lowerer.resolveWritable(expr.operand);
-  if (!target) {
-    lowerer.rejectUnresolved(
-      expr.operand,
-      `increment/decrement of '${expr.operand.text}' (not a writable local or module global)`,
-    );
-  }
-  return lowerIncDecTarget(lowerer, expr, target, prefix);
-}
-
-/** Numeric updates read the represented slot once and write the computed
- * value back in that same representation. In particular, an unchecked
- * indexed initializer can leave undefined in an otherwise numeric binding. */
-export function lowerIncDecTarget(
-  lowerer: Lowerer,
-  expr: ts.PrefixUnaryExpression | ts.PostfixUnaryExpression,
-  target: { id: string; type: IrType },
-  prefix: boolean,
-): IrExpr {
-  const loc = locOf(expr);
-  const op = expr.operator === ts.SyntaxKind.PlusPlusToken ? "+" : "-";
-  if (target.type.kind === "dyn") {
-    const old = lowerer.declareHiddenLocal("%numericOld", DYN);
-    const next = lowerer.declareHiddenLocal("%numericNext", DYN);
-    const read = varRef(target.id, target.type, loc);
-    return {
-      kind: "seqExpr",
-      stmts: [
-        {
-          kind: "varDecl",
-          localId: old.id,
-          init: { kind: "libCall", fn: "dyn.toNumeric", args: [read], type: DYN, loc },
-          loc,
-        },
-        {
-          kind: "varDecl",
-          localId: next.id,
-          init: {
-            kind: "libCall",
-            fn: "dyn.increment",
-            args: [
-              varRef(old.id, DYN, loc),
-              { kind: "boolLit", value: op === "+", type: BOOL, loc },
-            ],
-            type: DYN,
-            loc,
-          },
-          loc,
-        },
-        { kind: "assign", localId: target.id, value: varRef(next.id, DYN, loc), loc },
-      ],
-      result: varRef(prefix ? next.id : old.id, DYN, loc),
-      type: DYN,
-      loc,
-    };
-  }
-  if (target.type.kind === "union") {
-    const read = lowerOptionalNumber(
-      lowerer,
-      varRef(target.id, target.type, loc),
-      loc,
-      expr.operand,
-    );
-    if (read.type.kind === "f64") {
-      const old = lowerer.declareHiddenLocal("%numericOld", F64);
-      const next = lowerer.declareHiddenLocal("%numericNext", F64);
-      const result = varRef(prefix ? next.id : old.id, F64, loc);
-      return {
-        kind: "seqExpr",
-        stmts: [
-          { kind: "varDecl", localId: old.id, init: read, loc },
-          {
-            kind: "varDecl",
-            localId: next.id,
-            init: {
-              kind: "bin",
-              op,
-              left: varRef(old.id, F64, loc),
-              right: numLit(1, loc),
-              type: F64,
-              loc,
-            },
-            loc,
-          },
-          {
-            kind: "assign",
-            localId: target.id,
-            value: lowerer.coerceInto(expr.operand, varRef(next.id, F64, loc), target.type),
-            loc,
-          },
-        ],
-        result,
-        type: F64,
-        loc,
-      };
-    }
-  }
-  if (target.type.kind === "bigint") {
-    const old = lowerer.declareHiddenLocal("%bigintOld", BIGINT_T);
-    const next = lowerer.declareHiddenLocal("%bigintNext", BIGINT_T);
-    return {
-      kind: "seqExpr",
-      stmts: [
-        { kind: "varDecl", localId: old.id, init: varRef(target.id, BIGINT_T, loc), loc },
-        {
-          kind: "varDecl",
-          localId: next.id,
-          init: bigintStep(op, varRef(old.id, BIGINT_T, loc), loc),
-          loc,
-        },
-        { kind: "assign", localId: target.id, value: varRef(next.id, BIGINT_T, loc), loc },
-      ],
-      result: varRef(prefix ? next.id : old.id, BIGINT_T, loc),
-      type: BIGINT_T,
-      loc,
-    };
-  }
-  if (target.type.kind !== "f64")
-    operatorUnsupported(lowerer, expr, op === "+" ? "++" : "--", [target.type]);
-  return { kind: "incDec", op, prefix, localId: target.id, type: F64, loc };
-}
-
-/** Whether a lowered statement can live inside a seqExpr. These statements
- * do not leave the expression through a jump; the native emitters can place
- * their writes and local state branches before evaluating the final result.
- * Blocks check their bodies recursively. */
-function seqExprSafeStmt(s: IrStmt): boolean {
-  switch (s.kind) {
-    case "varDecl":
-    case "assign":
-    case "exprStmt":
-    case "fieldSet":
-    case "recordSet":
-    case "recordKeySet":
-    case "arraySet":
-    case "arraySetLength":
-    case "bytesSet":
-    case "arraySetUndefined":
-    case "arrayDelete":
-      return true;
-    case "if":
-      return s.then.every(seqExprSafeStmt) && (s.else_?.every(seqExprSafeStmt) ?? true);
-    case "block":
-      return s.body.every(seqExprSafeStmt);
-    default:
-      return false;
-  }
-}
-
 const BIGINT_COMPOUND = {
   "+": "bigint.add",
   "-": "bigint.sub",
@@ -10030,7 +1760,7 @@ const BIGINT_COMPOUND = {
 
 /** `old op= rhs` over two bigints: the binary operator's libCall. Null
  * for other operand types (and `>>>`, which BigInt does not have). */
-function bigintCompoundValue(
+export function bigintCompoundValue(
   op: CompoundOp,
   left: IrExpr,
   right: IrExpr,
@@ -10040,88 +1770,9 @@ function bigintCompoundValue(
   return { kind: "libCall", fn: BIGINT_COMPOUND[op], args: [left, right], type: BIGINT_T, loc };
 }
 
-/** `++`/`--` on a bigint value: old ± 1n. */
-function bigintStep(op: "+" | "-", old: IrExpr, loc: SrcLoc): IrExpr {
-  const one: IrExpr = {
-    kind: "libCall",
-    fn: "bigint.parse",
-    args: [{ kind: "strLit", value: "1", type: STRING, loc }],
-    type: BIGINT_T,
-    loc,
-  };
-  return {
-    kind: "libCall",
-    fn: op === "+" ? "bigint.add" : "bigint.sub",
-    args: [old, one],
-    type: BIGINT_T,
-    loc,
-  };
-}
-
-export function lowerCompoundValueToTarget(
-  lowerer: Lowerer,
-  expr: ts.BinaryExpression,
-  compound: CompoundOp,
-  target: { id: string; type: IrType },
-): IrExpr {
-  const loc = locOf(expr);
-  const read: IrExpr = {
-    kind: "varRef",
-    localId: target.id,
-    type: target.type,
-    loc: locOf(expr.left),
-  };
-  const rhs = lowerer.lowerExpr(expr.right);
-  const numericRead = lowerOptionalNumber(lowerer, read, loc);
-  const numericRhs = lowerOptionalNumber(lowerer, rhs, loc);
-
-  if (
-    compound === "+" &&
-    (target.type.kind === "string" ||
-      (target.type.kind === "union" &&
-        lowerer.stripUndefinedArm(target.type).kind === "string" &&
-        rhs.type.kind === "string"))
-  ) {
-    return lowerer.coerceInto(
-      expr,
-      {
-        kind: "strConcat",
-        left: lowerer.ensureString(read, expr.left),
-        right: concatOperand(lowerer, rhs, expr.right),
-        type: STRING,
-        loc,
-      },
-      target.type,
-    );
-  }
-  if (numericRead.type.kind === "f64" && numericRhs.type.kind === "f64") {
-    return lowerer.coerceInto(
-      expr,
-      { kind: "bin", op: compound, left: numericRead, right: numericRhs, type: F64, loc },
-      target.type,
-    );
-  }
-  // An untyped operand: exactly the expanded `x = x op rhs` — the runtime
-  // operator on both values, then the checked conversion into the
-  // target's declared type (a string result for a number target throws the
-  // catchable TypeError, as the expanded assignment does).
-  if (
-    (target.type.kind === "dyn" || rhs.type.kind === "dyn") &&
-    (isJsSourceFile(expr.getSourceFile()) ||
-      (lowerer.dynConvertible(read.type) && lowerer.dynConvertible(rhs.type)))
-  ) {
-    const left = lowerer.coerceInto(expr.left, read, DYN);
-    const right = lowerer.coerceInto(expr.right, rhs, DYN);
-    return lowerer.coerceInto(expr, dynCompoundValue(compound, left, right, loc), target.type);
-  }
-  const bigint = bigintCompoundValue(compound, read, rhs, loc);
-  if (bigint) return bigint;
-  compoundUnsupported(lowerer, expr, compound, read.type, rhs.type);
-}
-
 /** The runtime operator of a compound assignment over two checked-dynamic
  * operands (Node's ToPrimitive/ToNumeric order lives in the runtime). */
-function dynCompoundValue(op: CompoundOp, left: IrExpr, right: IrExpr, loc: SrcLoc): IrExpr {
+export function dynCompoundValue(op: CompoundOp, left: IrExpr, right: IrExpr, loc: SrcLoc): IrExpr {
   const numeric = ["-", "*", "/", "%", "**"].includes(op);
   return {
     kind: "libCall",
@@ -10140,7 +1791,7 @@ function operandText(lowerer: Lowerer, t: IrType): string {
 
 /** SC1043 for a compound assignment whose operand types have no lowering,
  * naming the operator and both types rather than the comparison wording. */
-function compoundUnsupported(
+export function compoundUnsupported(
   lowerer: Lowerer,
   node: ts.Node,
   op: CompoundOp,
@@ -10156,7 +1807,7 @@ function compoundUnsupported(
 
 /** SC1043 for an arithmetic, unary or update operator whose operand types
  * have no lowering (comparisons keep the registry wording). */
-function operatorUnsupported(
+export function operatorUnsupported(
   lowerer: Lowerer,
   node: ts.Node,
   op: string,
@@ -10172,1788 +1823,6 @@ function operatorUnsupported(
   );
 }
 
-/** Equality of two NaN-coded values (nan-coded-reads.ts), each of which may
- * stand for undefined and never holds a genuine NaN: Node's undefined equals
- * undefined, so two NaNs compare equal here. Operands evaluate once, in
- * order. */
-function lowerNanCodedEquality(lowerer: Lowerer, expr: ts.BinaryExpression): IrExpr | null {
-  const loc = locOf(expr);
-  const left = lowerer.lowerExpr(expr.left);
-  const right = lowerer.lowerExpr(expr.right);
-  if (left.type.kind !== "f64" || right.type.kind !== "f64") {
-    throw new InternalCompilerError("NaN-coded equality operand is not a plain number");
-  }
-  const stmts: IrStmt[] = [];
-  const stable = (value: IrExpr, name: string): IrExpr => {
-    if (value.kind === "varRef" || value.kind === "numLit") return value;
-    const tmp = lowerer.declareHiddenLocal(name, F64);
-    stmts.push({ kind: "varDecl", localId: tmp.id, init: value, loc });
-    return varRef(tmp.id, F64, loc);
-  };
-  const a = stable(left, "%eqLeft");
-  const b = stable(right, "%eqRight");
-  const isNaN = (value: IrExpr): IrExpr => ({
-    kind: "libCall",
-    fn: "num.isNaN",
-    args: [value],
-    type: BOOL,
-    loc,
-  });
-  const bothUndefined: IrExpr = {
-    kind: "logical",
-    op: "&&",
-    left: isNaN(a),
-    right: isNaN(b),
-    type: BOOL,
-    loc,
-  };
-  const op = expr.operatorToken.kind;
-  const negated =
-    op === ts.SyntaxKind.ExclamationEqualsEqualsToken ||
-    op === ts.SyntaxKind.ExclamationEqualsToken;
-  const result: IrExpr = negated
-    ? {
-        kind: "logical",
-        op: "&&",
-        left: { kind: "bin", op: "!==", left: a, right: b, type: BOOL, loc },
-        right: { kind: "unary", op: "!", operand: bothUndefined, type: BOOL, loc },
-        type: BOOL,
-        loc,
-      }
-    : {
-        kind: "logical",
-        op: "||",
-        left: { kind: "bin", op: "===", left: a, right: b, type: BOOL, loc },
-        right: bothUndefined,
-        type: BOOL,
-        loc,
-      };
-  return stmts.length === 0 ? result : { kind: "seqExpr", stmts, result, type: BOOL, loc };
-}
-
-export function lowerBinary(lowerer: Lowerer, expr: ts.BinaryExpression): IrExpr {
-  const loc = locOf(expr);
-  const op = expr.operatorToken.kind;
-
-  const cacheHas = lowerRequireCacheHas(lowerer, expr);
-  if (cacheHas) return cacheHas;
-
-  if (lowerer.nanCodedReads?.needsUndefinedEquality(expr)) {
-    const undefinedEquality = lowerNanCodedEquality(lowerer, expr);
-    if (undefinedEquality) return undefinedEquality;
-  }
-
-  if (
-    op === ts.SyntaxKind.EqualsToken ||
-    (op >= ts.SyntaxKind.FirstCompoundAssignment && op <= ts.SyntaxKind.LastCompoundAssignment)
-  ) {
-    const urlWrite = lowerUrlAssignment(lowerer, expr);
-    if (urlWrite) return urlWrite;
-    if (op === ts.SyntaxKind.EqualsToken) {
-      const prototypeWrite = lowerClassPrototypeComputedAssignment(lowerer, expr);
-      if (prototypeWrite) return prototypeWrite;
-      const callableWrite = lowerNativeFunctionAssignment(lowerer, expr);
-      if (callableWrite) return callableWrite;
-    }
-    if (
-      op === ts.SyntaxKind.QuestionQuestionEqualsToken ||
-      op === ts.SyntaxKind.AmpersandAmpersandEqualsToken ||
-      op === ts.SyntaxKind.BarBarEqualsToken
-    ) {
-      return lowerShortCircuitAssignment(lowerer, expr);
-    }
-    if (ts.isPropertyAccessExpression(expr.left) || ts.isElementAccessExpression(expr.left)) {
-      fenceNodeModuleMutation(lowerer, expr.left, "assignment");
-    }
-    // The writable Event accessors on Event subclass instances, in value
-    // position (`const r = (event.returnValue = false)`).
-    if (op === ts.SyntaxKind.EqualsToken && ts.isPropertyAccessExpression(expr.left)) {
-      const eventWrite = lowerEventObjectPropertyWrite(lowerer, expr.left, expr.right);
-      if (eventWrite) return eventWrite;
-    }
-    // `x = e` in EXPRESSION position (`while ((idx = s.indexOf("\n")) !== -1)`,
-    // `f(x = v)`): evaluate e once, write the binding, yield the assigned
-    // value — JS evaluation order. Variable targets only (locals and module
-    // globals, captured/boxed included); the RHS coerces into the binding's
-    // type exactly like statement position, and the expression's value is
-    // the coerced binding-typed value (representation change only — never
-    // observably different from JS's raw-RHS yield). Indexed compounds
-    // use a sequenced read/modify/write; other member targets and
-    // destructuring targets stay fenced.
-    if (op === ts.SyntaxKind.EqualsToken && ts.isIdentifier(expr.left)) {
-      const target = lowerer.resolveWritable(expr.left);
-      if (!target) {
-        lowerer.rejectUnresolved(
-          expr.left,
-          `assignment to '${expr.left.text}' (not a writable local or module global)`,
-        );
-      }
-      const value = lowerer.lowerExprExpecting(expr.right, target.type);
-      const runtimeOptionalRoot = lowerer.runtimeOptionalRootOf(target);
-      if (lowerer.runtimeOptionalStorageLocals.has(runtimeOptionalRoot))
-        lowerer.runtimeOptionalLocals.add(runtimeOptionalRoot);
-      return { kind: "assignExpr", localId: target.id, value, type: target.type, loc };
-    }
-    const indexedCompound = COMPOUND_ASSIGN_OPS[op];
-    if (indexedCompound !== undefined && ts.isElementAccessExpression(expr.left)) {
-      if (symbolFieldInfo(lowerer, expr.left))
-        return lowerFieldCompoundValue(lowerer, expr.left, indexedCompound, expr.right, loc);
-      return lowerElementCompound(lowerer, expr, indexedCompound);
-    }
-    if (indexedCompound !== undefined && ts.isIdentifier(expr.left)) {
-      const target = lowerer.resolveWritable(expr.left);
-      if (!target) {
-        lowerer.rejectUnresolved(expr.left, "assignment to an unresolved variable");
-      }
-      const value = lowerCompoundValueToTarget(lowerer, expr, indexedCompound, target);
-      return { kind: "assignExpr", localId: target.id, value, type: target.type, loc };
-    }
-    if (
-      indexedCompound !== undefined &&
-      (ts.isPropertyAccessExpression(expr.left) || ts.isElementAccessExpression(expr.left)) &&
-      !(ts.isPropertyAccessExpression(expr.left) && expr.left.questionDotToken)
-    ) {
-      const target =
-        expandoWritableTarget(lowerer, expr.left) ??
-        (ts.isPropertyAccessExpression(expr.left) ? nsWritableTarget(lowerer, expr.left) : null);
-      if (target) {
-        const value = lowerCompoundValueToTarget(lowerer, expr, indexedCompound, target);
-        return { kind: "assignExpr", localId: target.id, value, type: target.type, loc };
-      }
-      return lowerFieldCompoundValue(lowerer, expr.left, indexedCompound, expr.right, loc);
-    }
-    // `events.defaultMaxListeners = v` — the module-property write
-    // Node validates (validateNumber(n, 'defaultMaxListeners', 0)):
-    // the value crosses into the checked-dynamic tree and the runtime ladder throws
-    // ERR_INVALID_ARG_TYPE / ERR_OUT_OF_RANGE with Node's exact slot
-    // name; valid numbers apply. The expression's value is the RHS
-    // (JS's assignment yield).
-    if (
-      op === ts.SyntaxKind.EqualsToken &&
-      ts.isPropertyAccessExpression(expr.left) &&
-      !expr.left.questionDotToken &&
-      expr.left.name.text === "defaultMaxListeners"
-    ) {
-      const bi = lowerer.builtinMemberOf(expr.left);
-      if (bi && bi.module === "events" && bi.member === "defaultMaxListeners") {
-        const rhs = lowerer.lowerExpr(expr.right);
-        if (rhs.type.kind === "dyn" || rhs.kind === "unitLit" || lowerer.dynConvertible(rhs.type)) {
-          const valTmp = lowerer.declareHiddenLocal("%setVal", rhs.type);
-          const valRef = (): IrExpr => ({
-            kind: "varRef",
-            localId: valTmp.id,
-            type: rhs.type,
-            loc,
-          });
-          const dynVal: IrExpr =
-            rhs.type.kind === "dyn"
-              ? valRef()
-              : { kind: "dynFrom", value: valRef(), type: DYN, loc };
-          return {
-            kind: "seqExpr",
-            stmts: [
-              { kind: "varDecl", localId: valTmp.id, init: rhs, loc },
-              {
-                kind: "exprStmt",
-                expr: {
-                  kind: "libCall",
-                  fn: "emitter.setDefaultMaxChk",
-                  args: [
-                    dynVal,
-                    { kind: "strLit", value: "defaultMaxListeners", type: STRING, loc },
-                  ],
-                  type: VOID,
-                  loc,
-                },
-                loc,
-              },
-            ],
-            result: valRef(),
-            type: rhs.type,
-            loc,
-          };
-        }
-      }
-    }
-    // Member targets whose storage IS a module global — namespace
-    // members (`N.x`) and expando function members (`Foo.baz`): the
-    // same assignExpr, since the "member" is a variable.
-    if (
-      op === ts.SyntaxKind.EqualsToken &&
-      (ts.isPropertyAccessExpression(expr.left) || ts.isElementAccessExpression(expr.left)) &&
-      !(ts.isPropertyAccessExpression(expr.left) && expr.left.questionDotToken)
-    ) {
-      const target =
-        expandoWritableTarget(lowerer, expr.left) ??
-        (ts.isPropertyAccessExpression(expr.left) ? nsWritableTarget(lowerer, expr.left) : null);
-      if (target) {
-        const value = lowerer.lowerExprExpecting(expr.right, target.type);
-        return { kind: "assignExpr", localId: target.id, value, type: target.type, loc };
-      }
-      // Bundled numeric enums use e[e["name"] = value] = "name".
-      // Capture the receiver and key before the RHS. PutValue coerces the
-      // key afterward, then yields the RHS without rereading the property.
-      if (ts.isElementAccessExpression(expr.left) && !expr.left.questionDotToken) {
-        const recv = tryLowerExpression(lowerer, expr.left.expression);
-        if (
-          recv &&
-          (recv.type.kind === "dyn" ||
-            (recv.type.kind === "array" &&
-              isJsSourceFile(expr.getSourceFile()) &&
-              lowerer.dynConvertible(recv.type)))
-        ) {
-          return lowerDynMemberAssignment(
-            lowerer,
-            expr,
-            lowerer.coerceInto(expr.left.expression, recv, DYN),
-          );
-        }
-        if (recv?.type.kind === "array" || recv?.type.kind === "bytes") {
-          const receiver = lowerer.declareHiddenLocal("%setArray", recv.type);
-          const index = lowerer.lowerExpr(expr.left.argumentExpression);
-          if (index.type.kind !== "f64")
-            lowerer.unsupported(
-              "SC1090",
-              expr.left.argumentExpression,
-              "indexing with non-number keys",
-            );
-          const key = lowerer.declareHiddenLocal("%setIndex", F64);
-          const raw = lowerer.lowerExpr(expr.right);
-          const value = lowerer.declareHiddenLocal("%setValue", raw.type);
-          const result = varRef(value.id, raw.type, loc);
-          const arr = varRef(receiver.id, recv.type, loc);
-          const idx = varRef(key.id, F64, loc);
-          const write: IrStmt =
-            recv.type.kind === "array"
-              ? arrayValueStore(lowerer, arr, idx, result, recv.type.elem, loc)
-              : {
-                  kind: "bytesSet",
-                  arr,
-                  index: idx,
-                  value: lowerer.coerceInto(expr.right, result, F64),
-                  loc,
-                };
-          return {
-            kind: "seqExpr",
-            stmts: [
-              { kind: "varDecl", localId: receiver.id, init: recv, loc },
-              { kind: "varDecl", localId: key.id, init: index, loc },
-              { kind: "varDecl", localId: value.id, init: raw, loc },
-              write,
-            ],
-            result,
-            type: result.type,
-            loc,
-          };
-        }
-      }
-
-      // `h.k = v` on a CHECKED-DYNAMIC receiver in VALUE position
-      // (`var _ = module.exports = foo`): receiver first, then RHS
-      // (JS's reference-before-value order), the keyed write, and the
-      // RHS value is the expression's value — its OWN type, so the
-      // consumer sees exactly what the checker typed.
-      if (ts.isPropertyAccessExpression(expr.left) && !expr.left.questionDotToken) {
-        // `const src = exports.src = []`: an export member assigned in
-        // value position writes its export global and yields the value.
-        {
-          let inFunction = false;
-          for (let p: ts.Node | undefined = expr.parent; p !== undefined; p = p.parent) {
-            if (ts.isFunctionLike(p) || ts.isClassDeclaration(p) || ts.isClassExpression(p)) {
-              inFunction = true;
-              break;
-            }
-          }
-          const g = inFunction
-            ? cjsExportMemberWriteGlobalOf(lowerer, expr.left)
-            : cjsInFileExportGlobalOf(lowerer, expr.left);
-          if (g) {
-            const value = lowerer.lowerExprExpecting(expr.right, g.type);
-            const tmp = lowerer.declareHiddenLocal("%exportValue", value.type);
-            const result = varRef(tmp.id, value.type, loc);
-            return {
-              kind: "seqExpr",
-              stmts: [
-                { kind: "varDecl", localId: tmp.id, init: value, loc },
-                { kind: "assign", localId: g.id, value: result, loc },
-              ],
-              result,
-              type: value.type,
-              loc,
-            };
-          }
-        }
-        const recv = tryLowerExpression(lowerer, expr.left.expression);
-        if (recv && recv.type.kind === "dyn") return lowerDynMemberAssignment(lowerer, expr, recv);
-        const unionWrite = lowerUnionFieldWrite(lowerer, expr.left, expr.right);
-        if (unionWrite) return unionWrite;
-        const field = lowerer.fieldTarget(expr.left);
-        if (field) {
-          const recvTmp = lowerer.declareHiddenLocal("%setReceiver", field.obj.type);
-          const receiver = field.obj;
-          field.obj = varRef(recvTmp.id, receiver.type, loc);
-          const value = lowerer.lowerExprExpecting(expr.right, field.fieldType);
-          const valTmp = lowerer.declareHiddenLocal("%setValue", value.type);
-          const result = varRef(valTmp.id, value.type, loc);
-          return {
-            kind: "seqExpr",
-            stmts: [
-              { kind: "varDecl", localId: recvTmp.id, init: receiver, loc },
-              { kind: "varDecl", localId: valTmp.id, init: value, loc },
-              lowerer.fieldSetStmt(field, result, loc, expr.left),
-            ],
-            result,
-            type: result.type,
-            loc,
-          };
-        }
-      }
-    }
-    // Destructuring assignment in VALUE position (`(() => [i] = [i+1])()`,
-    // `({} = {x} = a)`, `var d = ([] = src)`): the statement machinery's
-    // parts under a seqExpr — the expression's value is the RHS value
-    // (JS's GetValue of the right reference), which is exactly the
-    // parts' hidden temp.
-    if (
-      op === ts.SyntaxKind.EqualsToken &&
-      (ts.isObjectLiteralExpression(expr.left) || ts.isArrayLiteralExpression(expr.left))
-    ) {
-      const parts = lowerer.lowerDestructuringAssignParts(expr.left, expr.right, loc);
-      return {
-        kind: "seqExpr",
-        stmts: parts.stmts,
-        result: parts.value,
-        type: parts.value.type,
-        loc,
-      };
-    }
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      op === ts.SyntaxKind.EqualsToken
-        ? "assignment to non-variables as an expression (only `x = e` over a variable yields a value; write property/destructuring assignments as statements)"
-        : "compound assignment as an expression (write `x op= e` as a statement, or spell out `x = x op e`)",
-    );
-  }
-  if (op === ts.SyntaxKind.EqualsEqualsToken || op === ts.SyntaxKind.ExclamationEqualsToken) {
-    const nullTest = lowerLooseNullCompare(lowerer, expr, loc);
-    if (nullTest) return nullTest;
-    const loose = lowerAbstractEquality(
-      lowerer,
-      deferredSlotOr(lowerer, lowerer.lowerExpr(expr.left)),
-      deferredSlotOr(lowerer, lowerer.lowerExpr(expr.right)),
-      op === ts.SyntaxKind.ExclamationEqualsToken,
-      loc,
-    );
-    if (loose) return loose;
-    lowerer.unsupported(
-      "SC1040",
-      expr,
-      undefined,
-      "object-to-primitive loose equality can call user-defined valueOf/toString methods — compare explicit primitive conversions instead",
-    );
-  }
-  if (op === ts.SyntaxKind.AmpersandAmpersandToken || op === ts.SyntaxKind.BarBarToken) {
-    return lowerLogicalChain(lowerer, expr);
-  }
-  if (op === ts.SyntaxKind.QuestionQuestionToken) {
-    return lowerer.lowerNullishCoalesce(expr, loc);
-  }
-  if (op === ts.SyntaxKind.CommaToken) {
-    // Comma expression in VALUE position (`r = ({} = a, [] = a)` — the
-    // conformance corpus's paired-destructuring idiom): the left operand
-    // runs for EFFECT exactly as its statement lowering (JS discards its
-    // value), the right operand is the expression's value — a seqExpr.
-    // The validator restricts seqExpr statements to straight-line writes
-    // (the lowering point is mid-expression), so a left operand whose
-    // statement lowering needs real control flow keeps a pointed fence
-    // instead of tripping the validator downstream.
-    const effect = lowerer.lowerExprStatement(expr.left);
-    if (!seqExprSafeStmt(effect)) {
-      lowerer.unsupported(
-        "SC1090",
-        expr.left,
-        "comma expressions whose left operand needs control flow (run it as its own statement first)",
-      );
-    }
-    const result = lowerer.lowerExpr(expr.right);
-    return { kind: "seqExpr", stmts: [effect], result, type: result.type, loc };
-  }
-  if (op === ts.SyntaxKind.InstanceOfKeyword) return lowerer.lowerInstanceOf(expr, loc);
-  if (op === ts.SyntaxKind.InKeyword) {
-    return lowerInExpression(lowerer, expr, loc);
-  }
-  // `typeof e === "string"` on a catch binding or an `unknown` value: a
-  // runtime kind test — intercepted BEFORE the operands lower (a raw
-  // read of the binding is the narrowness fence, and bare `typeof e`
-  // has no lowering).
-  if (
-    op === ts.SyntaxKind.EqualsEqualsEqualsToken ||
-    op === ts.SyntaxKind.ExclamationEqualsEqualsToken
-  ) {
-    const test =
-      lowerWebAssemblyTypeofTest(lowerer, expr, loc) ??
-      lowerErrorCodeTypeofTest(lowerer, expr, loc) ??
-      lowerer.lowerCaughtTypeofTest(expr, loc) ??
-      lowerDynTypeofTest(lowerer, expr, loc) ??
-      lowerUnionTypeofTest(lowerer, expr, loc);
-    if (test) return test;
-  }
-  // `C === EventEmitter` between two builtin class references: the
-  // classes are compile-time values, so the answer folds.
-  if (
-    op === ts.SyntaxKind.EqualsEqualsEqualsToken ||
-    op === ts.SyntaxKind.ExclamationEqualsEqualsToken
-  ) {
-    const leftClass = builtinClassRefOf(lowerer, expr.left);
-    const rightClass = leftClass === null ? null : builtinClassRefOf(lowerer, expr.right);
-    if (leftClass !== null && rightClass !== null) {
-      const negated = op === ts.SyntaxKind.ExclamationEqualsEqualsToken;
-      const same = sameBuiltinClass(leftClass, rightClass);
-      return { kind: "boolLit", value: same !== negated, type: BOOL, loc };
-    }
-  }
-
-  const strictEquality =
-    op === ts.SyntaxKind.EqualsEqualsEqualsToken ||
-    op === ts.SyntaxKind.ExclamationEqualsEqualsToken;
-  // An identifier whose storage is runtime-optional is compared by its
-  // stored value: the checker's narrowing to the present arm is not a
-  // runtime proof. Identifier reads are pure, so taking the stored value
-  // after both operands lowered keeps the evaluation order. A union on
-  // the other side keeps the narrowed read (union-to-union comparison
-  // has no lowering).
-  let left = strictEquality
-    ? (lowerAbsenceProbe(lowerer, expr.left) ?? lowerer.lowerExpr(expr.left))
-    : lowerer.lowerExpr(expr.left);
-  let right = strictEquality
-    ? (lowerAbsenceProbe(lowerer, expr.right) ?? lowerer.lowerExpr(expr.right))
-    : lowerer.lowerExpr(expr.right);
-  if (strictEquality) {
-    const storedLeft = runtimeOptionalStorageOperand(lowerer, expr.left);
-    const storedRight = runtimeOptionalStorageOperand(lowerer, expr.right);
-    if (storedLeft !== null && right.type.kind !== "union") left = storedLeft;
-    if (storedRight !== null && left.type.kind !== "union") right = storedRight;
-    // A typed-array read compared with a plain number needs no
-    // `number | undefined` box.
-    const fusedLeft = tryLowerBytesReadNumberEquality(lowerer, left, right, expr.right);
-    if (fusedLeft) left = fusedLeft;
-    else {
-      const fusedRight = tryLowerBytesReadNumberEquality(lowerer, right, left, expr.left);
-      if (fusedRight) right = fusedRight;
-    }
-  }
-  if (strictEquality && (left.type.kind === "caught" || right.type.kind === "caught")) {
-    if (left.type.kind === "caught")
-      left = { kind: "caughtToDyn", value: left, type: DYN, loc: left.loc };
-    if (right.type.kind === "caught")
-      right = { kind: "caughtToDyn", value: right, type: DYN, loc: right.loc };
-  }
-  if (left.type.kind === "dyn" || right.type.kind === "dyn") {
-    // The narrowing unit comparisons ARE answerable on unknown: `v ===
-    // undefined` / `v !== null` test the dyn node's kind directly, and
-    // tsc's control flow narrows the branches (reads then bridge through
-    // maybeNarrow's validated extraction).
-    if (
-      op === ts.SyntaxKind.EqualsEqualsEqualsToken ||
-      op === ts.SyntaxKind.ExclamationEqualsEqualsToken
-    ) {
-      const negated = op === ts.SyntaxKind.ExclamationEqualsEqualsToken;
-      const unit = left.kind === "unitLit" ? left : right.kind === "unitLit" ? right : null;
-      const other = left.kind === "unitLit" ? right : left;
-      if (unit && other.type.kind === "dyn") {
-        return {
-          kind: "dynTest",
-          test: unit.unit,
-          ...(negated ? { negated: true as const } : {}),
-          value: other,
-          type: BOOL,
-          loc,
-        };
-      }
-      // dyn vs SCALAR strict equality (`value !== ""`, `u === 5` — the
-      // normalizePricing filter): a guarded kind test + payload compare,
-      // JS-exact (strict equality never coerces; a non-matching dyn kind
-      // answers false). dyn vs dyn keeps the fence below.
-      const dynSide = left.type.kind === "dyn" ? left : right;
-      const scalarSide = dynSide === left ? right : left;
-      const reference = scalarSide.type;
-      if (
-        (reference.kind === "object" ||
-          reference.kind === "record" ||
-          reference.kind === "array" ||
-          reference.kind === "bytes" ||
-          reference.kind === "func" ||
-          reference.kind === "classval" ||
-          reference.kind === "regex" ||
-          reference.kind === "url" ||
-          reference.kind === "bigint" ||
-          reference.kind === "symbol" ||
-          reference.kind === "map" ||
-          reference.kind === "set" ||
-          reference.kind === "union" ||
-          DYN_HANDLE_KINDS.has(reference.kind)) &&
-        lowerer.dynConvertible(reference)
-      ) {
-        // Records, arrays and byte views compare by the capsule identity
-        // their dyn reads produce, including when they arrive through a
-        // union (an optional array field read from a typed record).
-        const liveArm = (type: IrType): boolean => {
-          if (type.kind === "array" || type.kind === "bytes") return true;
-          const shape = type.kind === "record" ? lowerer.shapes.get(type.shapeId) : undefined;
-          return !!shape && (shape.fields.length > 0 || shape.indexValue !== undefined);
-        };
-        const boxed: IrExpr = {
-          kind: "dynFrom",
-          value: scalarSide,
-          type: DYN,
-          loc: scalarSide.loc,
-          ...(reference.kind === "record" ||
-          liveArm(reference) ||
-          (reference.kind === "union" &&
-            (lowerer.unions.get(reference.unionId)?.arms.some(liveArm) ?? false))
-            ? { liveRef: true as const }
-            : {}),
-        };
-        return {
-          kind: "dynScalarEq",
-          left: scalarSide === left ? boxed : left,
-          right: scalarSide === right ? boxed : right,
-          ...(negated ? { negated: true as const } : {}),
-          type: BOOL,
-          loc,
-        };
-      }
-      if (
-        dynSide.type.kind === "dyn" &&
-        (scalarSide.type.kind === "f64" ||
-          scalarSide.type.kind === "string" ||
-          scalarSide.type.kind === "bool" ||
-          // dyn vs dyn (`context.actual !== context.exact` —
-          // test/common's exit accounting): the runtime's whole-dyn
-          // strict equality — scalars by value, units by kind,
-          // reference kinds by identity (scr_dyn_strict_eq).
-          scalarSide.type.kind === "dyn")
-      ) {
-        return {
-          kind: "dynScalarEq",
-          left,
-          right,
-          ...(negated ? { negated: true as const } : {}),
-          type: BOOL,
-          loc,
-        };
-      }
-    }
-    const bitwise: Partial<Record<ts.SyntaxKind, string>> = {
-      [ts.SyntaxKind.AmpersandToken]: "&",
-      [ts.SyntaxKind.BarToken]: "|",
-      [ts.SyntaxKind.CaretToken]: "^",
-      [ts.SyntaxKind.LessThanLessThanToken]: "<<",
-      [ts.SyntaxKind.GreaterThanGreaterThanToken]: ">>",
-      [ts.SyntaxKind.GreaterThanGreaterThanGreaterThanToken]: ">>>",
-    };
-    if (bitwise[op]) {
-      const l = lowerer.coerceToExpected(left, DYN);
-      const r = lowerer.coerceToExpected(right, DYN);
-      if (l.type.kind === "dyn" && r.type.kind === "dyn") {
-        const value: IrExpr = {
-          kind: "libCall",
-          fn: "dyn.bitwise",
-          args: [l, r, { kind: "strLit", value: bitwise[op]!, type: STRING, loc }],
-          type: DYN,
-          loc,
-        };
-        return left.type.kind === "f64" || right.type.kind === "f64"
-          ? { kind: "dynCheck", value, type: F64, loc }
-          : value;
-      }
-    }
-    // Numeric operators dispatch on ToNumeric's actual Number/BigInt
-    // result, including values flowing through native callable properties.
-    if (
-      isJsSourceFile(expr.getSourceFile()) ||
-      op === ts.SyntaxKind.PlusToken ||
-      [
-        ts.SyntaxKind.LessThanToken,
-        ts.SyntaxKind.LessThanEqualsToken,
-        ts.SyntaxKind.GreaterThanToken,
-        ts.SyntaxKind.GreaterThanEqualsToken,
-      ].includes(op) ||
-      [
-        ts.SyntaxKind.MinusToken,
-        ts.SyntaxKind.AsteriskToken,
-        ts.SyntaxKind.SlashToken,
-        ts.SyntaxKind.PercentToken,
-        ts.SyntaxKind.AsteriskAsteriskToken,
-      ].includes(op)
-    ) {
-      const other = left.type.kind === "dyn" ? right : left;
-      const NUM_BIN: Partial<Record<ts.SyntaxKind, "-" | "*" | "/" | "%" | "**">> = {
-        [ts.SyntaxKind.MinusToken]: "-",
-        [ts.SyntaxKind.AsteriskToken]: "*",
-        [ts.SyntaxKind.SlashToken]: "/",
-        [ts.SyntaxKind.PercentToken]: "%",
-        [ts.SyntaxKind.AsteriskAsteriskToken]: "**",
-      };
-      const NUM_CMP: Partial<Record<ts.SyntaxKind, "<" | "<=" | ">" | ">=">> = {
-        [ts.SyntaxKind.LessThanToken]: "<",
-        [ts.SyntaxKind.LessThanEqualsToken]: "<=",
-        [ts.SyntaxKind.GreaterThanToken]: ">",
-        [ts.SyntaxKind.GreaterThanEqualsToken]: ">=",
-      };
-      const arith = NUM_BIN[op];
-      const cmp = NUM_CMP[op];
-      if (arith) {
-        const l = lowerer.coerceToExpected(left, DYN);
-        const r = lowerer.coerceToExpected(right, DYN);
-        if (l.type.kind === "dyn" && r.type.kind === "dyn") {
-          const value: IrExpr = {
-            kind: "libCall",
-            fn: "dyn.arithmetic",
-            args: [l, r, { kind: "strLit", value: arith, type: STRING, loc }],
-            type: DYN,
-            loc,
-          };
-          const numeric =
-            left.type.kind === "bigint" || right.type.kind === "bigint"
-              ? BIGINT_T
-              : left.type.kind === "f64" || right.type.kind === "f64"
-                ? F64
-                : null;
-          return numeric ? { kind: "dynCheck", value, type: numeric, loc } : value;
-        }
-      }
-      if (cmp && lowerer.dynConvertible(left.type) && lowerer.dynConvertible(right.type)) {
-        return {
-          kind: "libCall",
-          fn: "dyn.compare",
-          args: [
-            lowerer.coerceToExpected(left, DYN),
-            lowerer.coerceToExpected(right, DYN),
-            { kind: "strLit", value: cmp, type: STRING, loc },
-          ],
-          type: BOOL,
-          loc,
-        };
-      }
-      // Untyped addition chooses concatenation or numeric addition only
-      // after both operands have undergone ToPrimitive at runtime.
-      if (op === ts.SyntaxKind.PlusToken) {
-        const l = lowerer.coerceToExpected(left, DYN);
-        const r = lowerer.coerceToExpected(right, DYN);
-        if (l.type.kind === "dyn" && r.type.kind === "dyn") {
-          const value: IrExpr = { kind: "libCall", fn: "dyn.add", args: [l, r], type: DYN, loc };
-          // A statically known string operand guarantees a string result.
-          return other.type.kind === "string"
-            ? { kind: "dynCheck", value, type: STRING, loc }
-            : value;
-        }
-      }
-    }
-    // Unsupported `any`-origin operations get their specific diagnostic;
-    // unknown retains the narrowing diagnostic below.
-    if (
-      (left.type.kind === "dyn" && lowerer.anyOrigin(expr.left)) ||
-      (right.type.kind === "dyn" && lowerer.anyOrigin(expr.right))
-    ) {
-      // `JSON.parse` and other checked-dynamic producers deliberately
-      // remain dyn when assigned to an `any` local: eagerly converting
-      // the binding would deep-copy its data and sever aliases. At an
-      // unsupported operator, require an explicit represented type.
-      lowerer.anyOpFence(`the '${ts.tokenToString(op) ?? ts.syntaxKindName(op)}' operator`, expr);
-    }
-    // tsc allows ===/!== on unknown (arithmetic/comparisons it rejects
-    // itself); a dynamic equality would need a dyn walk — validate first.
-    lowerer.unsupported("SC1100", expr, "operators on 'unknown' values");
-  }
-
-  if (left.type.kind === "bigint" && right.type.kind === "bigint") {
-    const binary: Partial<
-      Record<
-        ts.SyntaxKind,
-        | "bigint.add"
-        | "bigint.sub"
-        | "bigint.mul"
-        | "bigint.div"
-        | "bigint.mod"
-        | "bigint.pow"
-        | "bigint.and"
-        | "bigint.or"
-        | "bigint.xor"
-        | "bigint.shl"
-        | "bigint.shr"
-      >
-    > = {
-      [ts.SyntaxKind.PlusToken]: "bigint.add",
-      [ts.SyntaxKind.MinusToken]: "bigint.sub",
-      [ts.SyntaxKind.AsteriskToken]: "bigint.mul",
-      [ts.SyntaxKind.SlashToken]: "bigint.div",
-      [ts.SyntaxKind.PercentToken]: "bigint.mod",
-      [ts.SyntaxKind.AsteriskAsteriskToken]: "bigint.pow",
-      [ts.SyntaxKind.AmpersandToken]: "bigint.and",
-      [ts.SyntaxKind.BarToken]: "bigint.or",
-      [ts.SyntaxKind.CaretToken]: "bigint.xor",
-      [ts.SyntaxKind.LessThanLessThanToken]: "bigint.shl",
-      [ts.SyntaxKind.GreaterThanGreaterThanToken]: "bigint.shr",
-    };
-    const fn = binary[op];
-    if (fn) return { kind: "libCall", fn, args: [left, right], type: BIGINT_T, loc };
-    if (
-      op === ts.SyntaxKind.EqualsEqualsEqualsToken ||
-      op === ts.SyntaxKind.ExclamationEqualsEqualsToken
-    ) {
-      const equal: IrExpr = {
-        kind: "libCall",
-        fn: "bigint.eq",
-        args: [left, right],
-        type: BOOL,
-        loc,
-      };
-      return op === ts.SyntaxKind.ExclamationEqualsEqualsToken
-        ? { kind: "unary", op: "!", operand: equal, type: BOOL, loc }
-        : equal;
-    }
-    if (
-      op === ts.SyntaxKind.LessThanToken ||
-      op === ts.SyntaxKind.LessThanEqualsToken ||
-      op === ts.SyntaxKind.GreaterThanToken ||
-      op === ts.SyntaxKind.GreaterThanEqualsToken
-    ) {
-      const cmp: IrExpr = {
-        kind: "libCall",
-        fn: "bigint.cmp",
-        args: [left, right],
-        type: F64,
-        loc,
-      };
-      const zero: IrExpr = { kind: "numLit", value: 0, type: F64, loc };
-      const cmpOp =
-        op === ts.SyntaxKind.LessThanToken
-          ? "<"
-          : op === ts.SyntaxKind.LessThanEqualsToken
-            ? "<="
-            : op === ts.SyntaxKind.GreaterThanToken
-              ? ">"
-              : ">=";
-      return { kind: "bin", op: cmpOp, left: cmp, right: zero, type: BOOL, loc };
-    }
-  }
-  if (
-    (left.type.kind === "bigint" && right.type.kind === "f64") ||
-    (left.type.kind === "f64" && right.type.kind === "bigint")
-  ) {
-    if (
-      op === ts.SyntaxKind.LessThanToken ||
-      op === ts.SyntaxKind.LessThanEqualsToken ||
-      op === ts.SyntaxKind.GreaterThanToken ||
-      op === ts.SyntaxKind.GreaterThanEqualsToken
-    ) {
-      const big = left.type.kind === "bigint" ? left : right;
-      const num = left.type.kind === "f64" ? left : right;
-      const cmp: IrExpr = {
-        kind: "libCall",
-        fn: "bigint.cmpNumber",
-        args: [big, num],
-        type: F64,
-        loc,
-      };
-      const cmpLocal = lowerer.declareHiddenLocal("%bigcmp", F64);
-      const cmpRef: IrExpr = { kind: "varRef", localId: cmpLocal.id, type: F64, loc };
-      const unordered: IrExpr = {
-        kind: "bin",
-        op: "===",
-        left: cmpRef,
-        right: { kind: "numLit", value: 2, type: F64, loc },
-        type: BOOL,
-        loc,
-      };
-      const zero: IrExpr = { kind: "numLit", value: 0, type: F64, loc };
-      const leftBig = left.type.kind === "bigint";
-      const cmpOp = leftBig
-        ? op === ts.SyntaxKind.LessThanToken
-          ? "<"
-          : op === ts.SyntaxKind.LessThanEqualsToken
-            ? "<="
-            : op === ts.SyntaxKind.GreaterThanToken
-              ? ">"
-              : ">="
-        : op === ts.SyntaxKind.LessThanToken
-          ? ">"
-          : op === ts.SyntaxKind.LessThanEqualsToken
-            ? ">="
-            : op === ts.SyntaxKind.GreaterThanToken
-              ? "<"
-              : "<=";
-      const result: IrExpr = {
-        kind: "logical",
-        op: "&&",
-        left: { kind: "unary", op: "!", operand: unordered, type: BOOL, loc },
-        right: { kind: "bin", op: cmpOp, left: cmpRef, right: zero, type: BOOL, loc },
-        type: BOOL,
-        loc,
-      };
-      return {
-        kind: "seqExpr",
-        stmts: [{ kind: "varDecl", localId: cmpLocal.id, init: cmp, loc }],
-        result,
-        type: BOOL,
-        loc,
-      };
-    }
-  }
-  // An unchecked array read keeps its undefined arm in the IR even when
-  // the checker typed the binding as `string`. An optional string is not
-  // itself a string operand for `+`: `undefined + 1` and
-  // `undefined + undefined` are NaN, while a present string concatenates.
-  // Keep this predicate exact so a nullable string does not take the
-  // string path either.
-  const optionalStringType = (type: IrType): boolean => {
-    if (type.kind !== "union") return false;
-    const arms = lowerer.unions.get(type.unionId)?.arms;
-    return (
-      !!arms &&
-      arms.length === 2 &&
-      arms.some((arm) => arm.kind === "string") &&
-      arms.some((arm) => arm.kind === "undefinedT")
-    );
-  };
-  const arithmeticNumber = (operand: IrExpr, node: ts.Expression): IrExpr =>
-    lowerOptionalNumber(lowerer, operand, loc, node);
-  const arithmeticLeft = strictEquality ? left : arithmeticNumber(left, expr.left);
-  const arithmeticRight = strictEquality ? right : arithmeticNumber(right, expr.right);
-  const bothNum = arithmeticLeft.type.kind === "f64" && arithmeticRight.type.kind === "f64";
-  const bothStr = left.type.kind === "string" && right.type.kind === "string";
-
-  const lowerOptionalStringPlus = (): IrExpr | null => {
-    const leftOptional = optionalStringType(left.type);
-    const rightOptional = optionalStringType(right.type);
-    if (!leftOptional && !rightOptional) return null;
-    const allowed = (type: IrType): boolean =>
-      type.kind === "f64" || type.kind === "string" || optionalStringType(type);
-    if (!allowed(left.type) || !allowed(right.type)) return null;
-
-    // The tag tests and the chosen concatenation branch must see the same
-    // operand values. This matters for `take()[0] + 1` and for two reads
-    // with observable getters/calls.
-    const prefix: IrStmt[] = [];
-    const stable = (operand: IrExpr): IrExpr => {
-      if (isSafeToRepeat(operand) || isSafeToDiscard(operand)) return operand;
-      const tmp = lowerer.declareHiddenLocal("%plus", operand.type);
-      prefix.push({ kind: "varDecl", localId: tmp.id, init: operand, loc });
-      return varRef(tmp.id, operand.type, loc);
-    };
-    const stableLeft = stable(left);
-    const stableRight = stable(right);
-    const leftString = lowerer.ensureString(stableLeft, expr.left);
-    const rightString = lowerer.ensureString(stableRight, expr.right);
-    const concat: IrExpr = {
-      kind: "strConcat",
-      left: leftString,
-      right: rightString,
-      type: STRING,
-      loc,
-    };
-    const nan: IrExpr = {
-      kind: "bin",
-      op: "/",
-      left: numLit(0, loc),
-      right: numLit(0, loc),
-      type: F64,
-      loc,
-    };
-    const resultT: IrType = { kind: "union", unionId: lowerer.unions.intern([F64, STRING]) };
-    lowerer.runtimeOptionalArithmeticTypes.set(expr, resultT);
-    const numberTag = lowerer.armTag(resultT.unionId, F64);
-    const stringTag = lowerer.armTag(resultT.unionId, STRING);
-    if (numberTag < 0 || stringTag < 0)
-      throw new InternalCompilerError("lowerer bug: optional string plus result union");
-    const number = (): IrExpr => ({
-      kind: "unionWrap",
-      unionId: resultT.unionId,
-      tag: numberTag,
-      value: nan,
-      type: resultT,
-      loc,
-    });
-    const string = (): IrExpr => ({
-      kind: "unionWrap",
-      unionId: resultT.unionId,
-      tag: stringTag,
-      value: concat,
-      type: resultT,
-      loc,
-    });
-    const undefinedTest = (operand: IrExpr): IrExpr => ({
-      kind: "unionIsTag",
-      unionId: operand.type.kind === "union" ? operand.type.unionId : "",
-      tag: operand.type.kind === "union" ? lowerer.armTag(operand.type.unionId, UNDEFINED_T) : -1,
-      negated: false,
-      value: operand,
-      type: BOOL,
-      loc,
-    });
-    let result: IrExpr;
-    if (leftOptional && rightOptional) {
-      const rightMissing = undefinedTest(stableRight);
-      const bothMissing: IrExpr = {
-        kind: "ternary",
-        cond: rightMissing,
-        then: number(),
-        else_: string(),
-        type: resultT,
-        loc,
-      };
-      result = {
-        kind: "ternary",
-        cond: undefinedTest(stableLeft),
-        then: bothMissing,
-        else_: string(),
-        type: resultT,
-        loc,
-      };
-    } else if (leftOptional) {
-      result = {
-        kind: "ternary",
-        cond: undefinedTest(stableLeft),
-        then: number(),
-        else_: string(),
-        type: resultT,
-        loc,
-      };
-    } else {
-      result = {
-        kind: "ternary",
-        cond: undefinedTest(stableRight),
-        then: number(),
-        else_: string(),
-        type: resultT,
-        loc,
-      };
-    }
-    return prefix.length === 0
-      ? result
-      : { kind: "seqExpr", stmts: prefix, result, type: resultT, loc };
-  };
-
-  switch (op) {
-    case ts.SyntaxKind.PlusToken:
-      if (bothNum)
-        return {
-          kind: "bin",
-          op: "+",
-          left: arithmeticLeft,
-          right: arithmeticRight,
-          type: F64,
-          loc,
-        };
-      if (left.type.kind === "string" || right.type.kind === "string") {
-        return {
-          kind: "strConcat",
-          left: concatOperand(lowerer, left, expr.left),
-          right: concatOperand(lowerer, right, expr.right),
-          type: STRING,
-          loc,
-        };
-      }
-      const optionalStringPlus = lowerOptionalStringPlus();
-      if (optionalStringPlus) return optionalStringPlus;
-      {
-        const primitive = (type: IrType): boolean =>
-          type.kind === "f64" ||
-          type.kind === "string" ||
-          type.kind === "bool" ||
-          isUnitType(type) ||
-          (type.kind === "union" &&
-            (lowerer.unions.get(type.unionId)?.arms.every(primitive) ?? false));
-        if (
-          (left.type.kind === "union" || right.type.kind === "union") &&
-          primitive(left.type) &&
-          primitive(right.type)
-        ) {
-          lowerer.runtimeOptionalArithmeticTypes.set(expr, DYN);
-          return {
-            kind: "libCall",
-            fn: "dyn.add",
-            args: [lowerer.coerceToExpected(left, DYN), lowerer.coerceToExpected(right, DYN)],
-            type: DYN,
-            loc,
-          };
-        }
-      }
-      operatorUnsupported(lowerer, expr, "+", [left.type, right.type]);
-      break;
-    case ts.SyntaxKind.MinusToken:
-    case ts.SyntaxKind.AsteriskToken:
-    case ts.SyntaxKind.SlashToken:
-    case ts.SyntaxKind.PercentToken:
-    case ts.SyntaxKind.AsteriskAsteriskToken: {
-      if (!bothNum)
-        operatorUnsupported(lowerer, expr, ts.tokenToString(op) ?? "?", [left.type, right.type]);
-      const binOp =
-        op === ts.SyntaxKind.MinusToken
-          ? "-"
-          : op === ts.SyntaxKind.AsteriskToken
-            ? "*"
-            : op === ts.SyntaxKind.SlashToken
-              ? "/"
-              : op === ts.SyntaxKind.PercentToken
-                ? "%"
-                : "**";
-      return {
-        kind: "bin",
-        op: binOp,
-        left: arithmeticLeft,
-        right: arithmeticRight,
-        type: F64,
-        loc,
-      };
-    }
-    // The bitwise six, JS-exact: operands through ToInt32/ToUint32
-    // (NaN/±Infinity → 0, truncate, wrap mod 2^32), the operation in
-    // 32-bit space (shift counts masked to 5 bits), the result back to
-    // f64 — `>>>` as Uint32, the rest as Int32 (runtime scr_bit_*).
-    case ts.SyntaxKind.AmpersandToken:
-    case ts.SyntaxKind.BarToken:
-    case ts.SyntaxKind.CaretToken:
-    case ts.SyntaxKind.LessThanLessThanToken:
-    case ts.SyntaxKind.GreaterThanGreaterThanToken:
-    case ts.SyntaxKind.GreaterThanGreaterThanGreaterThanToken: {
-      if (!bothNum)
-        operatorUnsupported(lowerer, expr, ts.tokenToString(op) ?? "?", [left.type, right.type]);
-      const bitOp =
-        op === ts.SyntaxKind.AmpersandToken
-          ? "&"
-          : op === ts.SyntaxKind.BarToken
-            ? "|"
-            : op === ts.SyntaxKind.CaretToken
-              ? "^"
-              : op === ts.SyntaxKind.LessThanLessThanToken
-                ? "<<"
-                : op === ts.SyntaxKind.GreaterThanGreaterThanToken
-                  ? ">>"
-                  : ">>>";
-      return {
-        kind: "bin",
-        op: bitOp,
-        left: arithmeticLeft,
-        right: arithmeticRight,
-        type: F64,
-        loc,
-      };
-    }
-    case ts.SyntaxKind.EqualsEqualsEqualsToken:
-    case ts.SyntaxKind.ExclamationEqualsEqualsToken:
-      return lowerStrictEquality(
-        lowerer,
-        expr,
-        expr.left,
-        expr.right,
-        left,
-        right,
-        op === ts.SyntaxKind.ExclamationEqualsEqualsToken,
-        loc,
-      );
-    case ts.SyntaxKind.LessThanToken:
-    case ts.SyntaxKind.LessThanEqualsToken:
-    case ts.SyntaxKind.GreaterThanToken:
-    case ts.SyntaxKind.GreaterThanEqualsToken: {
-      const cmpOp =
-        op === ts.SyntaxKind.LessThanToken
-          ? "<"
-          : op === ts.SyntaxKind.LessThanEqualsToken
-            ? "<="
-            : op === ts.SyntaxKind.GreaterThanToken
-              ? ">"
-              : ">=";
-      if (bothNum)
-        return {
-          kind: "bin",
-          op: cmpOp,
-          left: arithmeticLeft,
-          right: arithmeticRight,
-          type: BOOL,
-          loc,
-        };
-      if (bothStr) return { kind: "strCmp", op: cmpOp, left, right, type: BOOL, loc };
-      // A Date converts to a new checked-dynamic Date on each crossing, so
-      // comparisons keep their Date fence instead of comparing copies.
-      if (
-        left.type.kind !== "date" &&
-        right.type.kind !== "date" &&
-        lowerer.dynConvertible(left.type) &&
-        lowerer.dynConvertible(right.type)
-      ) {
-        return {
-          kind: "libCall",
-          fn: "dyn.compare",
-          args: [
-            lowerer.coerceToExpected(left, DYN),
-            lowerer.coerceToExpected(right, DYN),
-            { kind: "strLit", value: cmpOp, type: STRING, loc },
-          ],
-          type: BOOL,
-          loc,
-        };
-      }
-      lowerer.unsupported("SC1043", expr);
-      break;
-    }
-    default:
-      break;
-  }
-  lowerer.unsupported(
-    "SC1090",
-    expr,
-    `operator '${ts.tokenToString(op) ?? ts.syntaxKindName(op)}'`,
-  );
-}
-
-/** `left === right` (`!==` when negated) over lowered operands: JS strict
- * equality for every pair of static kinds the program can compare.
- * `node` anchors diagnostics, and `leftNode`/`rightNode` the coercions. */
-export function lowerStrictEquality(
-  lowerer: Lowerer,
-  node: ts.Node,
-  leftNode: ts.Node,
-  rightNode: ts.Node,
-  left: IrExpr,
-  right: IrExpr,
-  negated: boolean,
-  loc: SrcLoc,
-): IrExpr {
-  const plainBothNum = left.type.kind === "f64" && right.type.kind === "f64";
-  const bothStr = left.type.kind === "string" && right.type.kind === "string";
-  const indexed = tryLowerIndexedComparison(lowerer, left, right, negated, loc);
-  if (indexed) return indexed;
-  if (plainBothNum)
-    return { kind: "bin", op: negated ? "!==" : "===", left, right, type: BOOL, loc };
-  if (bothStr) {
-    if (left.kind === "strLit" && right.kind === "strLit")
-      return {
-        kind: "boolLit",
-        value: (left.value === right.value) !== negated,
-        type: BOOL,
-        loc,
-      };
-    return { kind: "strEq", negated, left, right, type: BOOL, loc };
-  }
-  // bool === bool: a plain value compare (the config-drift checks'
-  // `desired.lanMode !== actual.lanMode` shape).
-  if (left.type.kind === "bool" && right.type.kind === "bool") {
-    return { kind: "bin", op: negated ? "!==" : "===", left, right, type: BOOL, loc };
-  }
-  const unitTest = lowerer.lowerUnitComparison(left, right, negated, loc);
-  if (unitTest) return unitTest;
-  if (left.type.kind === "union" || right.type.kind === "union") {
-    const compared = lowerUnionEquality(lowerer, left, right, negated, false, loc);
-    if (compared) return compared;
-    const aliasRefusal = (type: IrType): void => {
-      if (tagEqualityMayMissAlias(lowerer, type))
-        lowerer.unsupported(
-          "SC1090",
-          node,
-          `comparisons of related class values beside structural union members (${NARROW_FIRST})`,
-        );
-    };
-
-    // JS strict equality of the ARM values, per union tag (a
-    // per-union helper): equal tags compare payloads (f64 ==, string
-    // bytes, bool ==, ref-arm POINTER identity), different tags are
-    // never equal. Two shapes lower: same union on both sides, and
-    // union vs plain arm value (`u === "text"` where the checker
-    // didn't narrow) — the plain side wraps into the union, which
-    // preserves payload identity. Different unions (tsc admits
-    // partially-overlapping ones) still need narrowing first.
-    const ut = left.type.kind === "union" ? left.type : (right.type as IrType & { kind: "union" });
-    const bothUnion = left.type.kind === "union" && right.type.kind === "union";
-    const sameUnion = bothUnion && typeEquals(left.type, right.type);
-    const plainFunc = left.type.kind === "func" ? left : right.type.kind === "func" ? right : null;
-    const unionArms = lowerer.unions.get(ut.unionId)?.arms ?? [];
-    const funcArm = unionArms.find((arm) => arm.kind === "func");
-    // `listeners()` reports original prefix callbacks, but the
-    // checker views an indexed result as function | undefined. For
-    // identity comparison, retain the original closure pointer rather
-    // than adapting it to the tuple signature.
-    if (
-      !bothUnion &&
-      plainFunc !== null &&
-      funcArm?.kind === "func" &&
-      unionArms.filter((arm) => arm.kind === "func").length === 1 &&
-      unionArms.some(isUnitType)
-    ) {
-      return {
-        kind: "unionFuncEq",
-        unionId: ut.unionId,
-        tag: lowerer.armTag(ut.unionId, funcArm),
-        union: left.type.kind === "union" ? left : right,
-        func: plainFunc,
-        negated,
-        type: BOOL,
-        loc,
-      };
-    }
-    if ((sameUnion || !bothUnion) && lowerer.eqComparableUnion(ut.unionId)) {
-      aliasRefusal(ut);
-      return {
-        kind: "unionEq",
-        unionId: ut.unionId,
-        negated,
-        sameValue: false,
-        left: lowerer.coerceInto(leftNode, left, ut),
-        right: lowerer.coerceInto(rightNode, right, ut),
-        type: BOOL,
-        loc,
-      };
-    }
-    if (left.type.kind === "union" && right.type.kind === "union") {
-      const leftDef = lowerer.unions.get(left.type.unionId);
-      const rightDef = lowerer.unions.get(right.type.unionId);
-      if (leftDef && rightDef) {
-        const leftValues = leftDef.arms.filter((arm) => !isUnitType(arm));
-        const rightValues = rightDef.arms.filter((arm) => !isUnitType(arm));
-        const sameValueArms =
-          leftValues.length === rightValues.length &&
-          leftValues.every((arm) => rightValues.some((candidate) => typeEquals(candidate, arm)));
-        if (sameValueArms) {
-          const arms = [...leftDef.arms];
-          for (const arm of rightDef.arms) {
-            if (!arms.some((candidate) => typeEquals(candidate, arm))) arms.push(arm);
-          }
-          arms.sort((a, b) => (typeKey(a) < typeKey(b) ? -1 : 1));
-          const common: IrType & { kind: "union" } = {
-            kind: "union",
-            unionId: lowerer.unions.intern(arms),
-          };
-          aliasRefusal(common);
-          return {
-            kind: "unionEq",
-            unionId: common.unionId,
-            negated,
-            sameValue: false,
-            left: lowerer.coerceInto(leftNode, left, common),
-            right: lowerer.coerceInto(rightNode, right, common),
-            type: BOOL,
-            loc,
-          };
-        }
-      }
-    }
-    lowerer.unsupported("SC1090", node, `comparisons of union-typed values (${NARROW_FIRST})`);
-  }
-  // Arrays, maps, functions, class instances and records compare by
-  // reference identity (pointer compare) — JS-exact object equality.
-  // Hierarchy-related classes compare after widening the derived side
-  // (same pointer either way — prefix layout).
-  let idLeft = left;
-  let idRight = right;
-  if (left.type.kind === "object" && right.type.kind === "object") {
-    if (lowerer.isSubclassOf(left.type.className, right.type.className)) {
-      idLeft = lowerer.upcastTo(left, right.type.className);
-    } else if (lowerer.isSubclassOf(right.type.className, left.type.className)) {
-      idRight = lowerer.upcastTo(right, left.type.className);
-    }
-  }
-  // Two function values compare by identity whatever their STATIC
-  // signatures (tsc admits the comparison when one side is
-  // assignable to the other — a tuple-typed listeners() element
-  // against a prefix-declared handler): the pointer answers it.
-  if (idLeft.type.kind === "func" && idRight.type.kind === "func") {
-    return {
-      kind: "bin",
-      op: negated ? "!==" : "===",
-      left: idLeft,
-      right: idRight,
-      type: BOOL,
-      loc,
-    };
-  }
-  // Two CLASS values compare by identity whatever their static
-  // classes — one immortal object per class, one pointer compare
-  // (the function-identity rule verbatim; `X === D` through a
-  // base-typed slot answers exactly JS).
-  if (idLeft.type.kind === "classval" && idRight.type.kind === "classval") {
-    return {
-      kind: "bin",
-      op: negated ? "!==" : "===",
-      left: idLeft,
-      right: idRight,
-      type: BOOL,
-      loc,
-    };
-  }
-  if (idLeft.type.kind === "moduleNs" && idRight.type.kind === "moduleNs") {
-    return {
-      kind: "bin",
-      op: negated ? "!==" : "===",
-      left: idLeft,
-      right: idRight,
-      type: BOOL,
-      loc,
-    };
-  }
-  if (
-    (idLeft.type.kind === "array" ||
-      idLeft.type.kind === "map" ||
-      idLeft.type.kind === "set" ||
-      idLeft.type.kind === "regex" ||
-      idLeft.type.kind === "url" ||
-      idLeft.type.kind === "object" ||
-      idLeft.type.kind === "record" ||
-      // Symbols ARE identity: `Symbol('a') === Symbol('a')` is false,
-      // a symbol equals exactly itself, and Symbol.for's interned
-      // values compare equal across call sites — all one pointer
-      // compare, JS's spec without approximation.
-      idLeft.type.kind === "symbol" ||
-      // Typed arrays / Buffers ARE objects to ===: pointer identity
-      // (buf === buf.swap16() — the in-place mutators return this).
-      idLeft.type.kind === "bytes" ||
-      idLeft.type.kind === "promise") &&
-    typeEquals(idLeft.type, idRight.type)
-  ) {
-    return {
-      kind: "bin",
-      op: negated ? "!==" : "===",
-      left: idLeft,
-      right: idRight,
-      type: BOOL,
-      loc,
-    };
-  }
-  // Runtime HANDLES are objects to === too: one handle per socket/
-  // request/response, so pointer identity IS JS's object equality
-  // (`c.pause() === c` — Node's chaining assertions). */
-  if (DYN_HANDLE_KINDS.has(idLeft.type.kind) && typeEquals(idLeft.type, idRight.type)) {
-    return {
-      kind: "bin",
-      op: negated ? "!==" : "===",
-      left: idLeft,
-      right: idRight,
-      type: BOOL,
-      loc,
-    };
-  }
-  // A Date converts to a new checked-dynamic Date on each crossing; its
-  // identity has no representation, so equality keeps the fence.
-  if (
-    idLeft.type.kind !== "date" &&
-    idRight.type.kind !== "date" &&
-    lowerer.dynConvertible(idLeft.type) &&
-    lowerer.dynConvertible(idRight.type)
-  ) {
-    return {
-      kind: "dynScalarEq",
-      left: lowerer.coerceToExpected(idLeft, DYN),
-      right: lowerer.coerceToExpected(idRight, DYN),
-      ...(negated ? { negated: true as const } : {}),
-      type: BOOL,
-      loc,
-    };
-  }
-  return lowerer.unsupported("SC1043", node);
-}
-
-function lowerLogicalChain(lowerer: Lowerer, expr: ts.BinaryExpression): IrExpr {
-  // Logical chains have a left-nested AST. Keep the native stack bounded
-  // while retaining each pair's checker type and lazy operand evaluation.
-  const parents: ts.BinaryExpression[] = [];
-  let current = expr;
-  let result: IrExpr;
-  while (true) {
-    if (current.operatorToken.kind === ts.SyntaxKind.BarBarToken) {
-      const fallback = lowerAbsenceAwareOrChain(lowerer, current);
-      if (fallback !== null) {
-        result = fallback;
-        break;
-      }
-    }
-    const left = current.left;
-    if (
-      ts.isBinaryExpression(left) &&
-      (left.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken ||
-        left.operatorToken.kind === ts.SyntaxKind.BarBarToken) &&
-      !lowerer.chainRecvByNode.has(left)
-    ) {
-      parents.push(current);
-      current = left;
-      continue;
-    }
-    result = lowerLogicalPair(
-      lowerer,
-      current,
-      current.operatorToken.kind === ts.SyntaxKind.BarBarToken
-        ? lowerPresenceOperand(lowerer, left)
-        : (lowerAbsenceProbe(lowerer, left) ?? lowerer.lowerExpr(left)),
-    );
-    break;
-  }
-  for (let i = parents.length - 1; i >= 0; i--) {
-    result = lowerLogicalPair(lowerer, parents[i]!, result);
-  }
-  return result;
-}
-
-function lowerLogicalPair(lowerer: Lowerer, expr: ts.BinaryExpression, left: IrExpr): IrExpr {
-  const op = expr.operatorToken.kind;
-  const loc = locOf(expr);
-  // Preserve short-circuiting during lowering too: an unreachable member
-  // on a specialized value must not poison the surrounding JS statement.
-  if (left.kind === "boolLit") {
-    const takeRight = op === ts.SyntaxKind.AmpersandAmpersandToken ? left.value : !left.value;
-    return takeRight ? lowerer.lowerExpr(expr.right) : left;
-  }
-  if (left.kind === "unitLit" && op === ts.SyntaxKind.AmpersandAmpersandToken) return left;
-  if (op === ts.SyntaxKind.BarBarToken && REF_TRUTHY_KINDS.has(left.type.kind)) return left;
-  const right = lowerer.lowerExpr(expr.right);
-  // A LITERAL-unit left operand (a compile-time undefined/null — the
-  // capability-probe members: `process.features.inspector ||
-  // !flag.startsWith('--inspect')` reads undefined in a compiled
-  // binary): statically falsy, so the operator folds JS-exactly —
-  // `unit || X` IS X, `unit && X` IS the unit (X's side effects never
-  // run in JS either; the lowered right is simply dropped). Literal
-  // units only — computed unit-typed values keep the fences below.
-  if (left.kind === "unitLit") {
-    return op === ts.SyntaxKind.BarBarToken ? right : left;
-  }
-  // JS objects and symbols are always truthy. In `ref || fallback`
-  // the fallback is therefore unreachable and the result is the
-  // already-evaluated left value — the browser-fallback idiom used by
-  // packages for `process.argv || []` and `process.env || {}`. The
-  // operand itself remains in the IR, preserving reads/calls that
-  // produce the reference; only the unreachable right lowering drops.
-  if (op === ts.SyntaxKind.BarBarToken && REF_TRUTHY_KINDS.has(left.type.kind)) {
-    return left;
-  }
-  if (left.type.kind === "dyn" || right.type.kind === "dyn") {
-    // A checked-dynamic operand (`fn.name || '<anonymous>'` —
-    // test/common's _mustCallInner): both sides live in the checked-dynamic tree and
-    // the deciding test is ToBoolean over the dyn kind
-    // (scr_dyn_truthy) — JS value semantics exactly, result dyn. The
-    // non-dyn side converts through the usual boundary; a value with
-    // no dyn representation keeps the fence.
-    const l = lowerer.coerceToExpected(left, DYN);
-    const r = lowerer.coerceToExpected(right, DYN);
-    if (l.type.kind !== "dyn" || r.type.kind !== "dyn") {
-      lowerer.unsupported("SC1100", expr, "logical operators on 'unknown' values");
-    }
-    return {
-      kind: "logical",
-      op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
-      left: l,
-      right: r,
-      type: DYN,
-      loc,
-    };
-  }
-
-  if (
-    isJsSourceFile(expr.getSourceFile()) &&
-    op === ts.SyntaxKind.AmpersandAmpersandToken &&
-    left.type.kind === "union" &&
-    lowerer.unions.get(left.type.unionId)?.arms.some((arm) => arm.kind === "bool") &&
-    !typeEquals(left.type, right.type) &&
-    lowerer.dynConvertible(left.type) &&
-    lowerer.dynConvertible(right.type)
-  ) {
-    return {
-      kind: "logical",
-      op: "&&",
-      left: lowerer.coerceToExpected(left, DYN),
-      right: lowerer.coerceToExpected(right, DYN),
-      type: DYN,
-      loc,
-    };
-  }
-  if (left.type.kind === "union" || right.type.kind === "union") {
-    // Test the deciding operand in its own representation. The result
-    // contains only the values that can survive short-circuit evaluation.
-    let target = lowerer.mapTypeOf(lowerer.typeOf(expr));
-    // Index reads can be absent without noUncheckedIndexedAccess. Their
-    // explicit nullish fallback still runs, even if the checker discarded it.
-    if (target !== null) {
-      const returned = [
-        right.type,
-        ...(op === ts.SyntaxKind.AmpersandAmpersandToken ? [left.type] : []),
-      ];
-      for (const type of returned) {
-        const arms =
-          type.kind === "union" ? (lowerer.unions.get(type.unionId)?.arms ?? []) : [type];
-        for (const arm of arms) {
-          if (arm.kind === "undefinedT" && !isUnitType(target))
-            target = lowerer.runtimeOptionalType(target);
-          if (arm.kind === "nullT")
-            target = withUnitArm(target, arm.kind, lowerer.unions) ?? target;
-        }
-      }
-    }
-    // A broad-JSDoc npm-static body can leave the CHECKER result `any`
-    // even after declaration-backed specialization has recovered both
-    // operands (`helpOption && args.find(...)` in commander). When the
-    // left consists only of always-truthy references and falsy units,
-    // the static result is exactly the right operand plus those units.
-    if (
-      op === ts.SyntaxKind.AmpersandAmpersandToken &&
-      target === null &&
-      lowerer.implicitParamTypes !== null &&
-      npmStaticPackageOfPath(expr.getSourceFile().fileName) !== null &&
-      (lowerer.typeOf(expr).flags & ts.TypeFlags.Any) !== 0 &&
-      left.type.kind === "union"
-    ) {
-      const leftArms = lowerer.unions.get(left.type.unionId)?.arms;
-      const rightArms =
-        right.type.kind === "union" ? lowerer.unions.get(right.type.unionId)?.arms : [right.type];
-      const rightIsStatic =
-        rightArms?.every(
-          (arm) => arm.kind !== "dyn" && arm.kind !== "caught" && arm.kind !== "void",
-        ) ?? false;
-      if (
-        leftArms &&
-        rightArms &&
-        rightIsStatic &&
-        leftArms.some(isUnitType) &&
-        leftArms.every((arm) => isUnitType(arm) || REF_TRUTHY_KINDS.has(arm.kind))
-      ) {
-        const byKey = new Map<string, IrType>();
-        for (const arm of [...rightArms, ...leftArms.filter(isUnitType)]) {
-          byKey.set(typeKey(arm), arm);
-        }
-        const arms = [...byKey.values()].sort((a, b) => (typeKey(a) < typeKey(b) ? -1 : 1));
-        if (arms.length > 1) {
-          const source =
-            right.type.kind === "union" ? lowerer.unions.get(right.type.unionId) : undefined;
-          target = {
-            kind: "union",
-            unionId: source ? lowerer.unions.transform(source, arms) : lowerer.unions.intern(arms),
-          };
-        }
-      }
-    }
-    if (target?.kind === "union") {
-      // `&&` whose left does NOT fit the result union: the checker
-      // built that result by DROPPING left arms which are always
-      // truthy (`Option | undefined && string | undefined` answers
-      // `string | undefined`, not `Option | string | undefined`).
-      // Evaluate the left once, test it in its own union, and retag it
-      // only on the falsy path. Any stranded reference arms are
-      // unreachable there because every JS object is truthy.
-      if (
-        op === ts.SyntaxKind.AmpersandAmpersandToken &&
-        left.type.kind === "union" &&
-        !typeEquals(left.type, target)
-      ) {
-        const def = lowerer.unions.get(left.type.unionId);
-        const trappable = new Set<number>();
-        def?.arms.forEach((arm, tag) => {
-          if (lowerer.armTag(target.unionId, arm) < 0 && REF_TRUTHY_KINDS.has(arm.kind)) {
-            trappable.add(tag);
-          }
-        });
-        const retag =
-          trappable.size === 0
-            ? null
-            : lowerer.unionRetagHelper(left.type.unionId, target.unionId, loc, trappable);
-        if (retag) {
-          lowerer.requireTruthyUnion(left.type.unionId, expr);
-          const stmts: IrStmt[] = [];
-          let stable: IrExpr = left;
-          if (!isSafeToRepeat(left)) {
-            const local = lowerer.declareHiddenLocal("%and", left.type);
-            stmts.push({ kind: "varDecl", localId: local.id, init: left, loc });
-            stable = varRef(local.id, left.type, loc);
-          }
-          const result: IrExpr = {
-            kind: "ternary",
-            cond: lowerer.ensureBool(stable, expr.left),
-            then: lowerer.coerceInto(expr.right, right, target),
-            else_: { kind: "call", callee: retag, args: [stable], type: target, loc },
-            type: target,
-            loc,
-          };
-          return stmts.length === 0
-            ? result
-            : { kind: "seqExpr", stmts, result, type: target, loc };
-        }
-      }
-      // `||` whose left does NOT fit the result union: the checker built
-      // that result by DROPPING the left's falsy arms (`process.env.X ||
-      // null` is `string | null`, `|| 3000` is `string | number` — the
-      // `undefined` is gone from both), so coercing the left eagerly, as
-      // the shared shape below does, retags an arm the test is about to
-      // rule out and throws where Node yields the default. Single-eval
-      // instead: test the left in its OWN union and retag only on the
-      // truthy side, where the dropped arms are unreachable.
-      if (
-        op === ts.SyntaxKind.BarBarToken &&
-        left.type.kind === "union" &&
-        !typeEquals(left.type, target)
-      ) {
-        const retag = lowerer.unionRetagHelper(left.type.unionId, target.unionId, loc);
-        if (retag) {
-          lowerer.requireTruthyUnion(left.type.unionId, expr);
-          return {
-            kind: "orDefault",
-            left,
-            right: lowerer.coerceInto(expr.right, right, target),
-            retag,
-            type: target,
-            loc,
-          };
-        }
-      }
-      lowerer.requireTruthyUnion(target.unionId, expr);
-      return {
-        kind: "logical",
-        op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
-        left: lowerer.coerceInto(expr.left, left, target),
-        right: lowerer.coerceInto(expr.right, right, target),
-        type: target,
-        loc,
-      };
-    }
-    // `u || d` NARROWED by the default: the checker types the result
-    // as u's single non-unit arm (`marker() || "default"`) — evaluate
-    // u once, truthy extracts the arm, falsy takes d lazily (the
-    // orDefault node, nullish's truthiness sibling). An UNMAPPABLE
-    // checker result takes the same rule (`options.runner ||
-    // defaultRunner` — tsc's union of two structurally-compatible
-    // function types has no representation, while the left's one
-    // non-unit arm is the only representable answer): the default
-    // must coerce into the arm or fence on its own.
-    if (op === ts.SyntaxKind.BarBarToken && left.type.kind === "union") {
-      const def = lowerer.unions.get(left.type.unionId);
-      const rest = def ? def.arms.filter((a) => !isUnitType(a)) : [];
-      const funcArmDefault =
-        rest[0]?.kind === "func" && (target === null || target.kind === "func");
-      if (
-        rest.length === 1 &&
-        ((target !== null && typeEquals(target, rest[0]!)) || funcArmDefault)
-      ) {
-        lowerer.requireTruthyUnion(left.type.unionId, expr);
-        const dflt = lowerer.lowerExprExpecting(expr.right, rest[0]!);
-        return { kind: "orDefault", left, right: dflt, type: rest[0]!, loc };
-      }
-    }
-    // JavaScript defaults can join differently inferred object layouts.
-    // When both operands have native checked representations, preserve
-    // the deciding value and short-circuit evaluation in that domain.
-    if (
-      isJsSourceFile(expr.getSourceFile()) &&
-      lowerer.dynConvertible(left.type) &&
-      lowerer.dynConvertible(right.type)
-    ) {
-      return {
-        kind: "logical",
-        op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
-        left: lowerer.coerceInto(expr.left, left, DYN),
-        right: lowerer.coerceInto(expr.right, right, DYN),
-        type: DYN,
-        loc,
-      };
-    }
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      `logical operators on union-typed values outside conditions (${NARROW_FIRST})`,
-    );
-  }
-  const kind = left.type.kind;
-  if (kind !== right.type.kind || (kind !== "f64" && kind !== "string" && kind !== "bool")) {
-    // Mixed PLAIN operands (`value || null`, `flag || undefined`,
-    // `s || 0`): JS value semantics still compile when the checker
-    // types the RESULT as one union both operands coerce into — the
-    // same lift the union-operand path above takes, arriving here
-    // with two plain arm values instead.
-    const target = lowerer.mapTypeOf(lowerer.typeOf(expr));
-    // An always-truthy left operand (a record, object, array or function
-    // value: every JS object is truthy): `o && x` evaluates `o` for its
-    // effects and answers `x`; `o || x` answers `o` and never evaluates
-    // `x`. supports-color's `stream && stream.isTTY` is the shape. Ahead
-    // of the union lift below exactly where that lift would store the
-    // object in a result union with no arm for it; a union holding the
-    // operand keeps the lift.
-    if (
-      REF_TRUTHY_KINDS.has(kind) &&
-      (target?.kind !== "union" ||
-        (op === ts.SyntaxKind.AmpersandAmpersandToken &&
-          lowerer.armTag(target.unionId, left.type) < 0))
-    ) {
-      const and = op === ts.SyntaxKind.AmpersandAmpersandToken;
-      const answer = and ? right : left;
-      const answerT = target ?? answer.type;
-      if (answerT.kind !== "void") {
-        const value = lowerer.coerceInto(and ? expr.right : expr.left, answer, answerT);
-        if (!and) return value;
-        return {
-          kind: "seqExpr",
-          stmts: [{ kind: "exprStmt", expr: left, loc }],
-          result: value,
-          type: answerT,
-          loc,
-        };
-      }
-    }
-    if (target?.kind === "union") {
-      lowerer.requireTruthyUnion(target.unionId, expr);
-      return {
-        kind: "logical",
-        op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
-        left: lowerer.coerceInto(expr.left, left, target),
-        right: lowerer.coerceInto(expr.right, right, target),
-        type: target,
-        loc,
-      };
-    }
-    lowerer.unsupported("SC1042", expr);
-  }
-  return {
-    kind: "logical",
-    op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
-    left,
-    right,
-    type: left.type,
-    loc,
-  };
-}
-
-function lowerAbsenceAwareOrChain(lowerer: Lowerer, expr: ts.BinaryExpression): IrExpr | null {
-  const nodes: ts.Expression[] = [];
-  const pending: ts.Expression[] = [expr];
-  while (pending.length !== 0) {
-    const node = pending.pop()!;
-    if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.BarBarToken) {
-      pending.push(node.right, node.left);
-    } else {
-      nodes.push(node);
-    }
-  }
-  if (nodes.length < 3) return null;
-  const lowered = nodes.map((node) => lowerAbsenceProbe(lowerer, node) ?? lowerer.lowerExpr(node));
-  if (
-    !lowered.some(
-      (value) =>
-        value.type.kind === "union" && lowerer.armTag(value.type.unionId, UNDEFINED_T) >= 0,
-    )
-  ) {
-    return null;
-  }
-  let result = lowered[lowered.length - 1]!;
-  for (let i = lowered.length - 2; i >= 0; i--) {
-    const left = lowered[i]!;
-    const loc = locOf(nodes[i]!);
-    if (left.type.kind === "union") {
-      const def = lowerer.unions.get(left.type.unionId);
-      const nonUnit = def?.arms.filter((arm) => !isUnitType(arm)) ?? [];
-      if (nonUnit.length !== 1 || !typeEquals(nonUnit[0]!, result.type)) return null;
-      lowerer.requireTruthyUnion(left.type.unionId, expr);
-      result = { kind: "orDefault", left, right: result, type: result.type, loc };
-      continue;
-    }
-    if (!typeEquals(left.type, result.type)) return null;
-    result = { kind: "logical", op: "||", left, right: result, type: result.type, loc };
-  }
-  return result;
-}
-
 /** `typeof e === "lit"` / `typeof e !== "lit"` where e is a catch
  * binding: the runtime kind test over the snapshot's tag. Only the
  * primitive literals narrow ("string"/"number"/"boolean" — exactly what
@@ -11967,7 +1836,7 @@ function lowerAbsenceAwareOrChain(lowerer: Lowerer, expr: ts.BinaryExpression):
  * what `err instanceof Error && "code" in err` narrows a catch binding
  * to; the refinement parts are type-level decoration, the VALUE is the
  * error object). */
-function errorRootedObjectOf(lowerer: Lowerer, t: ts.Type): IrType | null {
+export function errorRootedObjectOf(lowerer: Lowerer, t: ts.Type): IrType | null {
   const rooted = (m: IrType | null): m is IrType & { kind: "object" } => {
     if (m?.kind !== "object") return false;
     let info = lowerer.classes.get(m.className) ?? null;
@@ -11985,100 +1854,6 @@ function errorRootedObjectOf(lowerer: Lowerer, t: ts.Type): IrType | null {
   return null;
 }
 
-/** `typeof WebAssembly === "object"` and `typeof WebAssembly.<member> ===
- * "function"`: the operand needs no value, so the test folds as bare typeof
- * does (builtins/webassembly.ts) before any dyn-typed operand lowers. */
-function lowerWebAssemblyTypeofTest(
-  lowerer: Lowerer,
-  expr: ts.BinaryExpression,
-  loc: SrcLoc,
-): IrExpr | null {
-  const negated = expr.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken;
-  for (const [a, b] of operandPairs(expr)) {
-    if (!ts.isTypeOfExpression(a) || !ts.isStringLiteral(b)) continue;
-    const folded = lowerWebAssemblyTypeof(lowerer, a.expression);
-    if (folded?.kind !== "strLit") continue;
-    return { kind: "boolLit", value: (folded.value === b.text) !== negated, type: BOOL, loc };
-  }
-  return null;
-}
-
-/** `typeof e.code === "string"` / `"undefined"` (and the `!==` forms)
- * where e — through parens and as-casts — is a catch binding or a value
- * of %Error-rooted type: the runtime error's code slot is a string
- * exactly when present, so the typeof test IS the presence test (the
- * isErrnoException predicate's third conjunct,
- * `typeof (err as Record<string, unknown>).code === "string"`). The
- * as-cast changes the expression's TYPE, never the value — peeled like
- * lowerProcessStreamProperty's receiver match. Null for every other
- * shape, so the sibling typeof lowerings keep trying. */
-function lowerErrorCodeTypeofTest(
-  lowerer: Lowerer,
-  expr: ts.BinaryExpression,
-  loc: SrcLoc,
-): IrExpr | null {
-  const negated = expr.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken;
-  for (const [a, b] of operandPairs(expr)) {
-    if (!ts.isTypeOfExpression(a)) continue;
-    let prop: ts.Expression = a.expression;
-    while (ts.isParenthesizedExpression(prop)) prop = prop.expression;
-    if (!ts.isPropertyAccessExpression(prop) || prop.questionDotToken) continue;
-    if (prop.name.text !== "code") continue;
-    let recv: ts.Expression = prop.expression;
-    while (
-      ts.isParenthesizedExpression(recv) ||
-      ts.isAsExpression(recv) ||
-      ts.isTypeAssertion(recv)
-    )
-      recv = recv.expression;
-    const errT = errorRootedObjectOf(lowerer, lowerer.typeOf(recv));
-    if (!errT) continue;
-    if (isExecExceptionType(lowerer, lowerer.typeOf(recv))) refuseExecExceptionCode(lowerer, prop);
-    const caught = lowerer.caughtLocalOf(recv);
-    let receiver: IrExpr;
-    if (caught) {
-      // The checker proved the Error narrowing (errT above), so the
-      // trusted extraction is sound — caughtRead itself would fence on
-      // the intersection spelling.
-      receiver = {
-        kind: "caughtNarrow",
-        value: { kind: "varRef", localId: caught.id, type: CAUGHT, loc },
-        type: errT,
-        loc,
-      };
-    } else {
-      receiver = lowerer.lowerExpr(recv);
-      if (receiver.type.kind !== "object") continue;
-    }
-    if (!ts.isStringLiteral(b)) continue;
-    if (b.text !== "string" && b.text !== "undefined") continue;
-    const codeType = lowerer.envValueType();
-    if (codeType.kind !== "union")
-      throw new InternalCompilerError("lowerer bug: error code type is not a union");
-    const undefTag = lowerer.armTag(codeType.unionId, UNDEFINED_T);
-    const read: IrExpr = {
-      kind: "libCall",
-      fn: "error.code",
-      args: [receiver],
-      type: codeType,
-      loc,
-    };
-    // typeof === "string" ⇔ the code slot is present (NOT the undefined
-    // arm); === "undefined" ⇔ absent. `!==` flips either.
-    const isNotUndef = b.text === "string" ? !negated : negated;
-    return {
-      kind: "unionIsTag",
-      unionId: codeType.unionId,
-      tag: undefTag,
-      ...(isNotUndef ? { negated: true as const } : {}),
-      value: read,
-      type: BOOL,
-      loc,
-    };
-  }
-  return null;
-}
-
 export function lowerCaughtTypeofTest(
   lowerer: Lowerer,
   expr: ts.BinaryExpression,
@@ -12115,7 +1890,7 @@ export function lowerCaughtTypeofTest(
   return null;
 }
 
-function typeofAnswer(arm: IrType): string | null {
+export function typeofAnswer(arm: IrType): string | null {
   switch (arm.kind) {
     case "f64":
       return "number";
@@ -12220,7 +1995,7 @@ export function aliasTypeofNarrows(
 }
 
 /** Visit both operand orders while keeping the sequence an array of pairs. */
-function operandPairs(expr: ts.BinaryExpression): [ts.Expression, ts.Expression][] {
+export function operandPairs(expr: ts.BinaryExpression): [ts.Expression, ts.Expression][] {
   return [
     [expr.left, expr.right],
     [expr.right, expr.left],
@@ -12238,7 +2013,7 @@ function aliasTypeofArmOf(
     const a = strip(a0);
     if (!ts.isIdentifier(a)) continue;
     const aliasSym = lowerer.resolveValueSymbol(a);
-    const aliasDecl = aliasSym ? lowerer.checker.valueDeclarationOf(aliasSym) : undefined;
+    const aliasDecl = aliasSym ? aliasSym.valueDeclaration : undefined;
     if (
       !aliasSym ||
       !aliasDecl ||
@@ -12252,7 +2027,7 @@ function aliasTypeofArmOf(
     if (!ts.isIdentifier(opnd)) continue;
     if (!bindingNeverReassigned(lowerer, aliasSym, aliasDecl)) continue;
     const valSym = lowerer.resolveValueSymbol(opnd);
-    const valDecl = valSym ? lowerer.checker.valueDeclarationOf(valSym) : undefined;
+    const valDecl = valSym ? valSym.valueDeclaration : undefined;
     if (!valSym || !valDecl) continue;
     // v1: identifier PARAMETERS only — initialized at function entry,
     // before any alias can capture their typeof.
@@ -12282,270 +2057,8 @@ function aliasTypeofArmOf(
   return null;
 }
 
-/** `typeof v === "lit"` / `typeof v !== "lit"` where v is UNION-typed: the
- * arms whose static typeof answer equals the literal form a tag set, and
- * the test is a runtime tag test — one `unionIsTag` for a single matching
- * arm (the operand embeds once, so even effectful operands compose), a
- * short-circuit chain for several (pure reads only — the operand rides
- * every test, exactly the `== null` composition rule). When every arm
- * answers the same way the comparison is statically decided and folds to
- * a bool literal — dropping only a side-effect-free read, the same
- * trust-the-checker bet as lowerUnitComparison. tsc's control-flow
- * narrowing then types the branches, and reads bridge through
- * maybeNarrow's unionNarrow as usual. Null when neither side is a typeof
- * over a union-typed operand or the literal side isn't a literal (the
- * bare-typeof value form then composes with strEq for pure operands). */
-function lowerUnionTypeofTest(
-  lowerer: Lowerer,
-  expr: ts.BinaryExpression,
-  loc: SrcLoc,
-): IrExpr | null {
-  const negated = expr.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken;
-  for (const [a, b] of operandPairs(expr)) {
-    if (!ts.isTypeOfExpression(a)) continue;
-    const stored = runtimeOptionalStorageOperand(lowerer, a.expression);
-    if (stored === null && lowerer.mapTypeOf(lowerer.typeOf(a.expression))?.kind !== "union")
-      continue;
-    if (!ts.isStringLiteral(b)) continue; // bare-typeof + strEq handles pure operands
-    const value = stored ?? lowerer.lowerExpr(a.expression);
-    if (value.type.kind !== "union") continue; // defensive: an already-narrowed use
-    const unionId = value.type.unionId;
-    const def = lowerer.unions.get(unionId);
-    const answers = def?.arms.map(typeofAnswer);
-    if (!def || !answers || !answers.every((s): s is string => s !== null)) continue;
-    const tags = answers.flatMap((s, i) => (s === b.text ? [i] : []));
-    if (tags.length === 0 || tags.length === def.arms.length) {
-      if (!isSafeToRepeat(value)) {
-        lowerer.unsupported(
-          "SC1090",
-          expr,
-          "statically-decided 'typeof' tests over effectful operands (bind the value to a const first)",
-        );
-      }
-      return { kind: "boolLit", value: (tags.length !== 0) !== negated, type: BOOL, loc };
-    }
-    const isTag = (tag: number): IrExpr => ({
-      kind: "unionIsTag",
-      unionId,
-      tag,
-      negated,
-      value,
-      type: BOOL,
-      loc,
-    });
-    if (tags.length === 1) return isTag(tags[0]!);
-    if (!isSafeToRepeat(value)) {
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        "'typeof' tests matching several union arms over operands that aren't plain reads (bind the value to a const first)",
-      );
-    }
-    // Tag-in-set as a short-circuit chain (De Morgan for `!==`).
-    let acc = isTag(tags[0]!);
-    for (const t of tags.slice(1)) {
-      acc = {
-        kind: "logical",
-        op: negated ? "&&" : "||",
-        left: acc,
-        right: isTag(t),
-        type: BOOL,
-        loc,
-      };
-    }
-    return acc;
-  }
-  return null;
-}
-
-/** `typeof v === "lit"` / `typeof v !== "lit"` where v is `unknown`-typed
- * (dyn): the runtime kind test over the dyn node's tag. Only the kinds a
- * later read can bridge narrow ("string"/"number"/"boolean") plus
- * "undefined" (no payload to read); "object"/"function" tests keep the
- * fence — an object-narrowed `unknown` read has no lowering anyway (a
- * checked cast `v as T` is the supported extraction). Null when neither
- * side is a typeof over a dyn-typed operand (not this pattern). */
-function lowerDynTypeofTest(
-  lowerer: Lowerer,
-  expr: ts.BinaryExpression,
-  loc: SrcLoc,
-): IrExpr | null {
-  const negated = expr.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken;
-  for (const [a, b] of operandPairs(expr)) {
-    if (!ts.isTypeOfExpression(a)) continue;
-    if (lowerer.isStdlibGlobal(a.expression, "fetch")) continue;
-    // Non-literal comparisons use the ordinary typeof string value,
-    // preserving both operands' evaluation order without a narrowing test.
-    if (!ts.isStringLiteral(b)) continue;
-    const declared = lowerer.mapTypeOf(lowerer.typeOf(a.expression));
-    let value: IrExpr;
-    if (declared?.kind === "dyn") {
-      value = lowerer.lowerExpr(a.expression);
-      if (value.type.kind !== "dyn") continue; // defensive: an already-narrowed use
-    } else if (lowerer.caughtLocalOf(a.expression)) {
-      continue; // the caught lowering's territory (it ran first and declined)
-    } else {
-      // `typeof (value as T).field === "string"` — the raw-object
-      // validation idiom (routes.ts's isValidRoute): the `as` is erasure
-      // in JS, so the READ is the dyn KEYED read of the un-cast value —
-      // a missing key answers undefined and the guard goes false,
-      // Node-exact — never the checked cast (validating T here would
-      // throw on exactly the values the guard exists to reject).
-      const unparen = (e: ts.Expression): ts.Expression => {
-        while (ts.isParenthesizedExpression(e)) e = e.expression;
-        return e;
-      };
-      let keyed: IrExpr | null = null;
-      const pn = unparen(a.expression);
-      if (ts.isPropertyAccessExpression(pn) && !pn.questionDotToken && ts.isIdentifier(pn.name)) {
-        const recv = unparen(pn.expression);
-        if (ts.isAsExpression(recv) || ts.isTypeAssertion(recv)) {
-          const inner = unparen(recv.expression);
-          const obj = tryLowerExpression(lowerer, inner);
-          if (obj?.type.kind === "dyn") {
-            keyed = {
-              kind: "dynKeyGet",
-              key: { kind: "strLit", value: pn.name.text, type: STRING, loc },
-              value: obj,
-              type: DYN,
-              loc,
-            };
-          }
-        }
-      }
-      if (keyed) {
-        value = keyed;
-      } else {
-        // A narrowing residue of `unknown`: a `!== undefined` (or truthy)
-        // guard ahead of the typeof test spells the operand `{}`/`{} |
-        // null` — no useful static mapping, but the READ is still the dyn
-        // value (`if (obj.name !== undefined) { if (typeof obj.name !==
-        // "string") ... }`, the validateConfig idiom). Probe the lowering
-        // and claim exactly the dyn results; anything else keeps its
-        // sibling lowerings and fences untouched.
-        const probed = tryLowerExpression(lowerer, a.expression);
-        if (probed?.type.kind !== "dyn") continue;
-        value = probed;
-      }
-    }
-    if (
-      b.text === "string" ||
-      b.text === "number" ||
-      b.text === "boolean" ||
-      b.text === "undefined" ||
-      b.text === "bigint" ||
-      b.text === "symbol"
-    ) {
-      return {
-        kind: "dynTest",
-        test: b.text,
-        ...(negated ? { negated: true as const } : {}),
-        value,
-        type: BOOL,
-        loc,
-      };
-    }
-    // `typeof v === "object"`: the dyn answers exactly (object, array,
-    // bytes, and null kinds — JS's oldest wart preserved). tsc narrows
-    // the branch to `object | null`; reads past the narrow take the
-    // checked-cast path per site.
-    if (b.text === "object") {
-      return {
-        kind: "dynTest",
-        test: "object",
-        ...(negated ? { negated: true as const } : {}),
-        value,
-        type: BOOL,
-        loc,
-      };
-    }
-    // `typeof v === "function"`: a REAL runtime test since the checked-dynamic tree's
-    // function kind exists (boxed closures — the mustCall guard
-    // `if (typeof fn !== 'function') throw` answers honestly).
-    if (b.text === "function") {
-      return {
-        kind: "dynTest",
-        test: "function",
-        ...(negated ? { negated: true as const } : {}),
-        value,
-        type: BOOL,
-        loc,
-      };
-    }
-    // Native checked values do not yet carry symbols.
-    if (b.text === "symbol") {
-      return { kind: "boolLit", value: negated, type: BOOL, loc };
-    }
-    lowerer.unsupported(
-      "SC1090",
-      b,
-      `'typeof' tests against "${b.text}" on 'unknown' values (only "string"/"number"/` +
-        `"boolean"/"undefined"/"object" narrow; use a checked cast — 'v as T' — to extract)`,
-    );
-  }
-  return null;
-}
-
-/** `exports.<name>` in a JS module whose `module.exports =` REPLACED the
- * export object, with no `exports.<name> =` attachment anywhere in the
- * file: the read observes the ORIGINAL (empty-here) exports object, so
- * the honest value is undefined (Node's object identity exactly; tsc's
- * CJS model types the read off the replacement — identity-blind). Null
- * everywhere else: no replacement, a real attachment of this name, a
- * shadowing binding named `exports`, or write position. */
-function lowerReplacedExportsRead(
-  lowerer: Lowerer,
-  expr: ts.PropertyAccessExpression,
-): IrExpr | null {
-  if (expr.questionDotToken) return null;
-  const recv = expr.expression;
-  if (!ts.isIdentifier(recv) || recv.text !== "exports") return null;
-  const sf = expr.getSourceFile();
-  if (!isJsSourceFile(sf) || isNodeEsmFile(sf, lowerer.program)) return null;
-  if (lowerer.peekLocal(recv) || lowerer.globalOf(recv)) return null; // a user binding shadows
-  // Write position is the export-assignment machinery's territory.
-  if (
-    ts.isBinaryExpression(expr.parent) &&
-    expr.parent.left === expr &&
-    expr.parent.operatorToken.kind === ts.SyntaxKind.EqualsToken
-  ) {
-    return null;
-  }
-  let replaced = false;
-  for (const stmt of sf.statements.nodes) {
-    const cjs = cjsExportAssignmentOf(stmt);
-    if (!cjs) continue;
-    if (cjs.kind === "table" && cjsExportDiscardReason(stmt) === null) replaced = true;
-    if (cjs.kind === "member" && ts.isIdentifier(cjs.name) && cjs.name.text === expr.name.text) {
-      return null; // a real attachment of this name exists somewhere
-    }
-  }
-  if (!replaced) return null;
-  return { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc: locOf(expr) };
-}
-
-/** A read that resolves to a CJS export-table ACCESSOR property
- * (`module.exports = { get path() {...}, set path(v) {...} }`): the
- * getter lifts as a module-level function (module globals need no
- * captures) — interned per declaration so every read site calls ONE
- * function — and the read IS the call, Node's per-read evaluation
- * exactly. Null when the identifier doesn't resolve to such a property
- * (or it has no getter: a setter-only read answers undefined in Node —
- * rare enough to keep fenced). */
-function cjsExportAccessorRead(lowerer: Lowerer, ident: ts.Identifier): IrExpr | null {
-  const symbol = lowerer.resolveValueSymbol(ident);
-  const getter = symbol
-    ? lowerer.checker.declarationsOf(symbol).find(ts.isGetAccessorDeclaration)
-    : undefined;
-  if (!getter) return null;
-  if (!ts.isObjectLiteralExpression(getter.parent) || !isCjsExportTableLiteral(getter.parent)) {
-    return null;
-  }
-  return cjsAccessorCall(lowerer, getter, locOf(ident));
-}
-
 /** The interned lifted-getter call both accessor-read paths share. */
-function cjsAccessorCall(
+export function cjsAccessorCall(
   lowerer: Lowerer,
   getter: ts.GetAccessorDeclaration,
   loc: SrcLoc,
@@ -12570,43 +2083,6 @@ function cjsAccessorCall(
   return { kind: "callValue", callee: closureVal, args: [], type: fn.type.ret, loc };
 }
 
-/** `this.<name>` INSIDE a CJS export-table accessor (test/common's
- * `get localhostIPv4() { if (this.inFreeBSDJail) ... }`): Node binds the
- * getter's receiver to module.exports, so the read is the SIBLING table
- * property — a sibling GETTER's lifted call (per-read evaluation, like
- * any accessor read). Only arrows inherit the binding (a nested function
- * expression's `this` is its own). Null everywhere else — non-getter
- * siblings and absent names keep their per-site fences (none of the
- * probed suite shapes read them). */
-function lowerCjsExportTableThisMember(
-  lowerer: Lowerer,
-  expr: ts.PropertyAccessExpression,
-): IrExpr | null {
-  if (expr.expression.kind !== ts.SyntaxKind.ThisKeyword || expr.questionDotToken) return null;
-  if (!isJsSourceFile(expr.getSourceFile())) return null;
-  // The enclosing accessor, crossing only arrow boundaries (arrows
-  // inherit `this`; any other function form rebinds it).
-  let n: ts.Node | undefined = expr.parent;
-  while (n !== undefined && !ts.isGetAccessorDeclaration(n) && !ts.isSetAccessorDeclaration(n)) {
-    if (ts.isFunctionLike(n) && !ts.isArrowFunction(n)) return null;
-    if (ts.isSourceFile(n)) return null;
-    n = n.parent;
-  }
-  if (
-    n === undefined ||
-    !ts.isObjectLiteralExpression(n.parent) ||
-    !isCjsExportTableLiteral(n.parent)
-  ) {
-    return null;
-  }
-  const sibling = n.parent.properties.nodes.find(
-    (p): p is ts.GetAccessorDeclaration =>
-      ts.isGetAccessorDeclaration(p) && ts.isIdentifier(p.name) && p.name.text === expr.name.text,
-  );
-  if (!sibling) return null;
-  return cjsAccessorCall(lowerer, sibling, locOf(expr));
-}
-
 /** A read of a catch binding — the caught analog of maybeNarrow. Where
  * tsc's control-flow narrowing has proven a supported test (`instanceof`
  * over a hierarchy class, `typeof` over a primitive), the read bridges
@@ -12690,1618 +2166,6 @@ export function caughtLocalOf(lowerer: Lowerer, node: ts.Expression): IrLocal |
   return local?.type.kind === "caught" ? local : null;
 }
 
-/** `x instanceof C` for a program-declared class C. When x's static
- * class and C are both in extends-hierarchies the test is dynamic — the
- * O(1) preorder-interval check against the vtable (`instanceOf` node).
- * Everything else is decided by the static class graph alone and folds
- * to the honest constant: `x instanceof C` is always true when x's
- * static class IS C or descends from it, and always false when the
- * classes are unrelated (a standalone class has no other relatives).
- * Folding is limited to side-effect-free operands — dropping a computed
- * operand would skip its effects, so those are rejected instead. */
-export function lowerInstanceOf(lowerer: Lowerer, expr: ts.BinaryExpression, loc: SrcLoc): IrExpr {
-  refuseWebAssemblyUse(lowerer, expr.right);
-  // `x instanceof net.Socket` over a union with a netSocket arm — the
-  // h2 compat 'connect' narrowing (lower-server.ts): a union tag test.
-  const sockTest = lowerSocketInstanceOf(lowerer, expr, loc);
-  if (sockTest !== null) return sockTest;
-  const rightClass = builtinClassRefOf(lowerer, expr.right);
-  if (rightClass?.kind === "zlib") return lowerZlibInstanceOf(lowerer, expr, rightClass.mode, loc);
-
-  if (rightClass?.kind === "collection") {
-    const collection = rightClass.which === "Map" ? "map" : "set";
-    const value = lowerer.lowerExpr(expr.left);
-    if (value.type.kind === "union") {
-      const union = lowerer.unions.get(value.type.unionId);
-      if (union) {
-        const local = lowerer.declareHiddenLocal("%collectionTest", value.type);
-        const reference = varRef(local.id, value.type, loc);
-        let result: IrExpr = { kind: "boolLit", value: false, type: BOOL, loc };
-        union.arms.forEach((arm, tag) => {
-          if (arm.kind !== collection) return;
-          const test: IrExpr = {
-            kind: "unionIsTag",
-            unionId: union.id,
-            value: reference,
-            tag,
-            negated: false,
-            type: BOOL,
-            loc,
-          };
-          result =
-            result.kind === "boolLit"
-              ? test
-              : { kind: "logical", op: "||", left: result, right: test, type: BOOL, loc };
-        });
-        return {
-          kind: "seqExpr",
-          stmts: [{ kind: "varDecl", localId: local.id, init: value, loc }],
-          result,
-          type: BOOL,
-          loc,
-        };
-      }
-    }
-    if (value.type.kind === "dyn")
-      return {
-        kind: "libCall",
-        fn: collection === "map" ? "dyn.nativeMapIs" : "dyn.nativeSetIs",
-        args: [value],
-        type: BOOL,
-        loc,
-      };
-    if (value.type.kind === collection)
-      return {
-        kind: "seqExpr",
-        stmts: [{ kind: "exprStmt", expr: value, loc }],
-        result: { kind: "boolLit", value: true, type: BOOL, loc },
-        type: BOOL,
-        loc,
-      };
-    return {
-      kind: "libCall",
-      fn: collection === "map" ? "dyn.nativeMapIs" : "dyn.nativeSetIs",
-      args: [lowerer.coerceInto(expr.left, value, DYN)],
-      type: BOOL,
-      loc,
-    };
-  }
-  if (
-    lowerer.isStdlibGlobal(expr.right, "WeakMap") ||
-    lowerer.isStdlibGlobal(expr.right, "WeakSet")
-  ) {
-    const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
-    return {
-      kind: "libCall",
-      fn: lowerer.isStdlibGlobal(expr.right, "WeakMap") ? "weakMap.is" : "weakSet.is",
-      args: [value],
-      type: BOOL,
-      loc,
-    };
-  }
-  const rhsBuiltin = ts.isIdentifier(expr.right)
-    ? lowerer.builtinImportOf(expr.right)
-    : ts.isPropertyAccessExpression(expr.right)
-      ? lowerer.builtinMemberOf(expr.right)
-      : null;
-  if (
-    lowerer.isStdlibGlobal(expr.right, "URL") ||
-    (rhsBuiltin?.module === "url" && rhsBuiltin.member === "URL")
-  ) {
-    const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
-    return { kind: "libCall", fn: "dyn.nativeUrlIs", args: [value], type: BOOL, loc };
-  }
-  {
-    const stack = lowerDisposableStackInstanceOf(lowerer, expr);
-    if (stack) return stack;
-  }
-  if (lowerer.isStdlibGlobal(expr.right, "DataView")) {
-    const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
-    return { kind: "libCall", fn: "dyn.dataViewIs", args: [value], type: BOOL, loc };
-  }
-  {
-    const eventKind = ["Event", "CustomEvent", "EventTarget"].findIndex((name) =>
-      lowerer.isStdlibGlobal(expr.right, name),
-    );
-    if (eventKind >= 0) {
-      const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
-      const kind: IrExpr = { kind: "numLit", value: eventKind, type: F64, loc };
-      return { kind: "libCall", fn: "event.is", args: [value, kind], type: BOOL, loc };
-    }
-  }
-  {
-    const blob = lowerBlobInstanceof(lowerer, expr);
-    if (blob) return blob;
-    const keyObject = lowerKeyObjectInstanceof(lowerer, expr);
-    if (keyObject) return keyObject;
-    const netAddress = lowerNetAddressInstanceof(lowerer, expr);
-    if (netAddress) return netAddress;
-    const readlineInterface = lowerReadlineInstanceof(lowerer, expr);
-    if (readlineInterface) return readlineInterface;
-  }
-  if (lowerer.isStdlibGlobal(expr.right, "SharedArrayBuffer")) {
-    const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
-    return { kind: "libCall", fn: "sharedArrayBuffer.is", args: [value], type: BOOL, loc };
-  }
-  if (lowerer.isStdlibGlobal(expr.right, "ArrayBuffer")) {
-    const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
-    return { kind: "libCall", fn: "arrayBuffer.is", args: [value], type: BOOL, loc };
-  }
-  const rhsSymbol = ts.isIdentifier(expr.right) ? lowerer.resolveValueSymbol(expr.right) : null;
-  // `x instanceof events.EventEmitter` — the namespace-member spelling
-  // resolves to the same ambient class as the named import.
-  const rhsMemberSymbol = (() => {
-    if (!ts.isPropertyAccessExpression(expr.right) || !ts.isIdentifier(expr.right.name))
-      return null;
-    const sym = lowerer.checker.getSymbolAtLocation(expr.right.name);
-    return sym && sym.flags & ts.SymbolFlags.Alias
-      ? lowerer.checker.getAliasedSymbol(sym)
-      : (sym ?? null);
-  })();
-  // `x instanceof N.C` — the USER-namespace-qualified spelling: the
-  // member resolves to the registered program class, with the
-  // source-order guard (an init-position test above the class's block
-  // would read an uninitialized member in Node).
-  const rhsNsClass = (() => {
-    if (!ts.isPropertyAccessExpression(expr.right)) return undefined;
-    const nsMember = nsMemberIdentOf(lowerer, expr.right);
-    if (!nsMember) return undefined;
-    const memberSym = lowerer.checker.getSymbolAtLocation(nsMember);
-    if (memberSym) fenceEarlyNsMemberRef(lowerer, expr.right, memberSym);
-    const classSym = lowerer.resolveValueSymbol(nsMember);
-    const nsInfo = classSym ? lowerer.classBySymbol.get(classSym) : undefined;
-    // Qualified spellings of a rebindable decorated class (import=
-    // alias chains) must not fold against the declaration — the
-    // decoration result decides at runtime.
-    return nsInfo?.classDecorators?.valueGlobalId !== undefined ? undefined : nsInfo;
-  })();
-  // A rebindable decorated name as the RHS: the runtime target is the
-  // decoration result — fall to the class-VALUE path below, whose
-  // instanceOfValue reads the interval off the bound class object.
-  const directRhs = rhsSymbol ? lowerer.classBySymbol.get(rhsSymbol) : undefined;
-  const target =
-    (directRhs?.localClass || directRhs?.classDecorators?.valueGlobalId !== undefined
-      ? undefined
-      : directRhs) ??
-    rhsNsClass ??
-    lowerer.builtinErrorInfoOf(rhsSymbol) ??
-    lowerer.builtinErrorInfoOf(rhsMemberSymbol) ??
-    lowerer.builtinEmitterInfoOf(rhsSymbol) ??
-    lowerer.builtinEmitterInfoOf(rhsMemberSymbol) ??
-    lowerer.builtinStreamInfoOf(rhsSymbol) ??
-    lowerer.builtinStreamInfoOf(rhsMemberSymbol) ??
-    undefined;
-  if (!target) {
-    const date = lowerer.isStdlibGlobal(expr.right, "Date");
-    const url = lowerer.isStdlibGlobal(expr.right, "URL");
-    if ((date || url) && !lowerer.caughtLocalOf(expr.left)) {
-      const value = lowerer.lowerExpr(expr.left);
-      if (value.type.kind === "dyn")
-        return {
-          kind: "libCall",
-          fn: date ? "dyn.nativeDateIs" : "dyn.nativeUrlIs",
-          args: [value],
-          type: BOOL,
-          loc,
-        };
-      if (value.type.kind === "union")
-        return {
-          kind: "libCall",
-          fn: date ? "dyn.nativeDateIs" : "dyn.nativeUrlIs",
-          args: [lowerer.coerceInto(expr.left, value, DYN)],
-          type: BOOL,
-          loc,
-        };
-      return {
-        kind: "seqExpr",
-        stmts: [{ kind: "exprStmt", expr: value, loc }],
-        result: {
-          kind: "boolLit",
-          value: value.type.kind === (date ? "date" : "url"),
-          type: BOOL,
-          loc,
-        },
-        type: BOOL,
-        loc,
-      };
-    }
-    const webBrand = ["Request", "Response", "Headers"].find((name) =>
-      lowerer.isStdlibGlobal(expr.right, name),
-    );
-    if (webBrand)
-      return {
-        kind: "libCall",
-        fn: "fetch.webIs",
-        args: [
-          lowerer.lowerExprExpecting(expr.left, DYN),
-          { kind: "strLit", value: webBrand, type: STRING, loc },
-        ],
-        type: BOOL,
-        loc,
-      };
-    if (lowerer.isStdlibGlobal(expr.right, "ReadableStream")) {
-      const value = lowerer.lowerExprExpecting(expr.left, DYN);
-      return { kind: "libCall", fn: "fetch.streamIs", args: [value], type: BOOL, loc };
-    }
-    // Unknown storage retains each numeric typed array's exact native brand.
-    if (!lowerer.caughtLocalOf(expr.left)) {
-      const elem = (Object.keys(BYTES_ELEMENT_NAME) as IrBytesElem[]).find((kind) =>
-        lowerer.isStdlibGlobal(expr.right, BYTES_ELEMENT_NAME[kind]),
-      );
-      if (elem !== undefined) {
-        const left = lowerer.lowerExpr(expr.left);
-        if (left.type.kind === "dyn") {
-          return { kind: "dynTest", test: "bytes", bytesElem: elem, value: left, type: BOOL, loc };
-        }
-        return {
-          kind: "dynTest",
-          test: "bytes",
-          bytesElem: elem,
-          value: lowerer.coerceInto(expr.left, left, DYN),
-          type: BOOL,
-          loc,
-        };
-      }
-    }
-    // `x instanceof Promise` over a promise-armed union (the maybe-promise
-    // `T | Promise<T>` dispatch): a union tag test — the data arms are
-    // never promises (scriptc promises are all native, and no data arm
-    // can hold one). A promise-typed operand answers true after its
-    // evaluation; a checked-dynamic one asks the runtime.
-    if (
-      ts.isIdentifier(expr.right) &&
-      lowerer.isStdlibGlobal(expr.right, "Promise") &&
-      !lowerer.caughtLocalOf(expr.left)
-    ) {
-      const left = lowerer.lowerExpr(expr.left);
-      const tagTest = maybePromiseInstanceOf(lowerer, left, loc);
-      if (tagTest) return tagTest;
-      if (left.type.kind === "dyn")
-        return { kind: "dynTest", test: "promise", value: left, type: BOOL, loc };
-      if (left.type.kind === "promise") {
-        const yes: IrExpr = { kind: "boolLit", value: true, type: BOOL, loc };
-        if (isSafeToDiscard(left)) return yes;
-        return {
-          kind: "seqExpr",
-          stmts: [{ kind: "exprStmt", expr: left, loc }],
-          result: yes,
-          type: BOOL,
-          loc,
-        };
-      }
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        `'instanceof Promise' on '${lowerer.fmt(left.type)}' values (only promises, promise-armed unions, and checked-dynamic values have a lowering)`,
-      );
-    }
-    // `x instanceof RegExp` over a union with a regex arm (the
-    // skip-utility `string | RegExp` dispatch): a union tag test — the
-    // socket-narrowing shape; the checker types the branches and
-    // maybeNarrow bridges the reads. A plain regex-typed LHS folds
-    // true; the fold keeps the operand-purity rule of the class folds
-    // (identifier reads only).
-    if (
-      ts.isIdentifier(expr.right) &&
-      lowerer.isStdlibGlobal(expr.right, "RegExp") &&
-      !lowerer.caughtLocalOf(expr.left)
-    ) {
-      const left = lowerer.lowerExpr(expr.left);
-      if (left.type.kind === "dyn")
-        return { kind: "libCall", fn: "dyn.nativeRegexIs", args: [left], type: BOOL, loc };
-      if (left.type.kind === "union") {
-        const def = lowerer.unions.get(left.type.unionId);
-        const tag = def ? def.arms.findIndex((a) => a.kind === "regex") : -1;
-        if (tag >= 0) {
-          return {
-            kind: "unionIsTag",
-            unionId: left.type.unionId,
-            tag,
-            negated: false,
-            value: left,
-            type: BOOL,
-            loc,
-          };
-        }
-      }
-      return {
-        kind: "libCall",
-        fn: "dyn.nativeRegexIs",
-        args: [lowerer.coerceInto(expr.left, left, DYN)],
-        type: BOOL,
-        loc,
-      };
-    }
-    // `x instanceof X` where X is a class VALUE (a classval-typed
-    // binding): the target is DYNAMIC — a hierarchy target reads its
-    // interval from the class object at runtime (instanceOfValue); a
-    // STANDALONE target class has exactly one possible runtime value
-    // (itself — no descendants can flow into the slot), so the answer
-    // folds statically exactly like the named-target folds below.
-    const rhsClassval = storedClassValueType(lowerer, expr.right);
-    if (rhsClassval?.kind === "classval" && !lowerer.caughtLocalOf(expr.left)) {
-      const targetInfo = lowerer.classes.get(rhsClassval.className);
-      if (!targetInfo) {
-        // The type world names a class the lowering never registered
-        // (a fenced class expression, a deferred declaration): flush
-        // its diagnostics and poison the test site, never an ICE.
-        lowerer.flushDeferredClass(rhsClassval.className);
-        lowerer.unsupported(
-          "SC1090",
-          expr,
-          "'instanceof' against a class value whose class has no lowering (the class declaration itself was rejected — see its own diagnostic)",
-        );
-      }
-      const left = lowerer.lowerExpr(expr.left);
-      if (left.type.kind === "dyn") {
-        if (targetInfo.def.runtime) {
-          lowerer.unsupported(
-            "SC1090",
-            expr,
-            "'instanceof' through a runtime-provided class value on an untyped value (give the operand a class type first)",
-          );
-        }
-        const classValue = lowerer.lowerExpr(expr.right);
-        return classInstanceOf(lowerer, left, targetInfo, loc, classValue);
-      }
-      // A union of class instances against a runtime class value (`new K()`
-      // through a widened `[Readable, Writable]` element).
-      if (left.type.kind === "union" && targetInfo.def.runtime) {
-        const tested = unionClassValueInstanceOf(lowerer, left, expr.right, targetInfo, loc);
-        if (tested) return tested;
-      }
-      if (left.type.kind !== "object") {
-        lowerer.unsupported(
-          "SC1090",
-          expr,
-          "'instanceof' on values other than class instances (narrow union-typed values first)",
-        );
-      }
-      const lhsInfo = lowerer.classes.get(left.type.className);
-      if (!lhsInfo)
-        throw new InternalCompilerError(`lowerer bug: unknown class ${left.type.className}`);
-      if (
-        (lowerer.inHierarchy(targetInfo) && lowerer.inHierarchy(lhsInfo)) ||
-        (targetInfo.localClass !== undefined && lhsInfo.localClass !== undefined)
-      ) {
-        const classValue = lowerer.lowerExpr(expr.right);
-        if (classValue.type.kind !== "classval")
-          lowerer.badType(expr.right, lowerer.typeOf(expr.right));
-        const writableTest = writableClassValueTest(
-          lowerer,
-          left,
-          classValue,
-          targetInfo,
-          lhsInfo,
-          loc,
-        );
-        if (writableTest) return writableTest;
-        return { kind: "instanceOfValue", value: left, classValue, type: BOOL, loc };
-      }
-      // A standalone side: the answer is static (the target slot can
-      // only hold the named class; a standalone operand's runtime class
-      // IS its static class). Folding discards the operands' evaluation,
-      // so only side-effect-free shapes fold — the named-target rule.
-      const value =
-        left.type.className === targetInfo.def.name ||
-        lowerer.isSubclassOf(left.type.className, targetInfo.def.name);
-      if (
-        left.kind === "varRef" &&
-        (ts.isIdentifier(expr.right) || expr.right.kind === ts.SyntaxKind.ThisKeyword)
-      ) {
-        return readsClassAfter(lowerer, targetInfo, expr.right, [], {
-          kind: "boolLit",
-          value,
-          type: BOOL,
-          loc,
-        });
-      }
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        "statically-decided 'instanceof' on computed operands (bind the values to variables first)",
-      );
-    }
-    const constructor = tryLowerExpression(lowerer, expr.right);
-    if (constructor?.type.kind === "dyn" && isJsSourceFile(expr.getSourceFile())) {
-      const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
-      return checkedClassInstanceOf(lowerer, value, constructor, loc);
-    }
-    lowerer.unsupported(
-      "SC1090",
-      expr.right,
-      "'instanceof' right-hand sides other than classes declared in the program",
-    );
-  }
-  // `x instanceof Writable`: Node's Writable[Symbol.hasInstance] also
-  // answers true for streams with a writable side that do not inherit from
-  // Writable, which are Duplex and its subclasses (Transform, PassThrough,
-  // the zlib streams). Subclasses of Writable keep the prototype test.
-  const duplex =
-    target.def.name === "%Writable" && target.builtinStream !== undefined
-      ? lowerer.classes.get("%Duplex")
-      : undefined;
-  // The classes whose interval test can answer true for a value of static
-  // class `className`: Writable and Duplex are disjoint, so a value typed
-  // as one side needs only that side's test.
-  const runtimeTests = (className: string): ClassInfo[] => {
-    if (!duplex) return [target];
-    const mayHold = (info: ClassInfo): boolean =>
-      className === info.def.name ||
-      lowerer.isSubclassOf(className, info.def.name) ||
-      lowerer.isSubclassOf(info.def.name, className);
-    const tests = [target, duplex].filter(mayHold);
-    return tests.length > 0 ? tests : [target];
-  };
-  // A catch binding on the left: the runtime test against the class's
-  // preorder interval (false for non-hierarchy-object payloads). tsc's
-  // narrowing then types the branches; reads bridge through caughtRead.
-  const caughtLocal = lowerer.caughtLocalOf(expr.left);
-  if (caughtLocal) {
-    const caughtInstanceOf = (info: ClassInfo): IrExpr => {
-      if (!lowerer.inHierarchy(info)) {
-        const value = varRef(caughtLocal.id, CAUGHT, loc);
-        return {
-          kind: "ternary",
-          cond: {
-            kind: "caughtTest",
-            value,
-            test: "instanceof",
-            className: info.def.name,
-            type: BOOL,
-            loc,
-          },
-          then: { kind: "boolLit", value: true, type: BOOL, loc },
-          else_: classInstanceOf(
-            lowerer,
-            { kind: "caughtToDyn", value, type: DYN, loc },
-            info,
-            loc,
-          ),
-          type: BOOL,
-          loc,
-        };
-      }
-      return {
-        kind: "caughtTest",
-        value: { kind: "varRef", localId: caughtLocal.id, type: CAUGHT, loc },
-        test: "instanceof",
-        className: info.def.name,
-        type: BOOL,
-        loc,
-      };
-    };
-    const test = caughtInstanceOf(target);
-    return duplex
-      ? { kind: "logical", op: "||", left: test, right: caughtInstanceOf(duplex), type: BOOL, loc }
-      : test;
-  }
-  const left = lowerer.lowerExpr(expr.left);
-  // `u instanceof Error` on an `unknown` value: the checked-dynamic tree's error encoding
-  // (the shape caughtToDyn builds for Error payloads — the reserved
-  // "%error" marker) answers the test, so a caught Error passed through
-  // an unknown slot narrows like Node (`error instanceof Error ?
-  // error.message : String(error)` — the LAN-monitor handler). ROOT
-  // only: the marker cannot honestly answer subclass prototype chains
-  // (name strings are user-writable), so `u instanceof TypeError` keeps
-  // the fence. Reads past the narrow bridge through maybeNarrow's
-  // validated %Error extraction. SEMANTICS.md 67.
-  if (
-    left.type.kind === "dyn" &&
-    !target.def.runtime &&
-    !target.builtinError &&
-    !target.builtinEmitter &&
-    !target.builtinStream &&
-    !target.localClass
-  ) {
-    return classInstanceOf(lowerer, left, target, loc);
-  }
-  if (left.type.kind === "dyn" && target.def.name === "%Error") {
-    return { kind: "dynTest", test: "error", value: left, type: BOOL, loc };
-  }
-  // `u instanceof TypeError` (and the other BUILTIN error classes) on a
-  // dyn value: the from_error cache holds the checked-dynamic tree↔error identity edge,
-  // so the runtime resolves the encoding back to its error and asks the
-  // vtable's stamped interval — exact for every error that crossed the
-  // boundary (a hand-built {%error} literal answers false: subclass
-  // identity is unknowable there). User subclasses keep the fence.
-  if (left.type.kind === "dyn" && RUNTIME_ERROR_CLASSES.has(target.def.name)) {
-    const rec = RUNTIME_ERROR_CLASSES.get(target.def.name)!;
-    return {
-      kind: "libCall",
-      fn: "dyn.errInstanceof",
-      args: [left, { kind: "numLit", value: rec.kind, type: F64, loc }],
-      type: BOOL,
-      loc,
-    };
-  }
-  if (left.type.kind === "dyn") {
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      `'instanceof ${target.def.name.replace(/^%/, "")}' on 'unknown' values (only the Error classes answer — test 'instanceof Error' and read '.name')`,
-    );
-  }
-  if (left.type.kind === "union") {
-    const unionId = left.type.unionId;
-    const arms = lowerer.unions.get(unionId)?.arms;
-    // Ordinary records, arrays and scalar values do not carry a class
-    // prototype (no program class extends Array). Dynamic/opaque runtime
-    // objects keep their existing instanceof fences.
-    if (
-      arms?.every(
-        (arm) =>
-          arm.kind === "object" ||
-          arm.kind === "record" ||
-          arm.kind === "array" ||
-          arm.kind === "f64" ||
-          arm.kind === "string" ||
-          arm.kind === "bool" ||
-          arm.kind === "bigint" ||
-          arm.kind === "symbol" ||
-          isUnitType(arm),
-      )
-    ) {
-      const key = `instanceof.union:${unionId}:${target.def.name}`;
-      let helper = lowerer.valueHelpers.get(key);
-      if (!helper) {
-        helper = `%instanceof.union.${lowerer.valueHelpers.size}`;
-        lowerer.valueHelpers.set(key, helper);
-        const value: IrExpr = { kind: "varRef", localId: "value.0", type: left.type, loc };
-        const body: IrStmt[] = [];
-        arms.forEach((arm, tag) => {
-          if (arm.kind !== "object") return;
-          const lhsInfo = lowerer.classes.get(arm.className);
-          if (!lhsInfo)
-            throw new InternalCompilerError(`lowerer bug: unknown class ${arm.className}`);
-          const armTest = (info: ClassInfo): IrExpr =>
-            lowerer.inHierarchy(lhsInfo) && lowerer.inHierarchy(info)
-              ? {
-                  kind: "instanceOf",
-                  value: { kind: "unionNarrow", unionId, tag, value, type: arm, loc },
-                  className: info.def.name,
-                  type: BOOL,
-                  loc,
-                }
-              : {
-                  kind: "boolLit",
-                  value:
-                    arm.className === info.def.name ||
-                    lowerer.isSubclassOf(arm.className, info.def.name),
-                  type: BOOL,
-                  loc,
-                };
-          const result = runtimeTests(arm.className)
-            .map(armTest)
-            .reduce((left: IrExpr, right: IrExpr): IrExpr => ({
-              kind: "logical",
-              op: "||",
-              left,
-              right,
-              type: BOOL,
-              loc,
-            }));
-          body.push({
-            kind: "if",
-            cond: { kind: "unionIsTag", unionId, tag, negated: false, value, type: BOOL, loc },
-            then: [{ kind: "return", value: result, loc }],
-            else_: null,
-            loc,
-          });
-        });
-        body.push({
-          kind: "return",
-          value: { kind: "boolLit", value: false, type: BOOL, loc },
-          loc,
-        });
-        lowerer.liftedFns.push({
-          name: helper,
-          params: [{ localId: "value.0", name: "value", type: left.type }],
-          returnType: BOOL,
-          locals: [{ id: "value.0", name: "value", type: left.type, mutable: false }],
-          body,
-          loc,
-        });
-      }
-      return { kind: "call", callee: helper, args: [left], type: BOOL, loc };
-    }
-    // A class arm could hold an instance: the test cannot be decided
-    // statically.
-    if (arms?.some((arm) => arm.kind === "object"))
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        "'instanceof' on a union of class instances and values without a class prototype test",
-      );
-  }
-  if (left.type.kind !== "object") {
-    return readsClassAfter(lowerer, target, expr.right, [{ kind: "exprStmt", expr: left, loc }], {
-      kind: "boolLit",
-      value: false,
-      type: BOOL,
-      loc,
-    });
-  }
-  const lhsInfo = lowerer.classes.get(left.type.className);
-  if (!lhsInfo)
-    throw new InternalCompilerError(`lowerer bug: unknown class ${left.type.className}`);
-  if (lowerer.inHierarchy(lhsInfo) && lowerer.inHierarchy(target)) {
-    const tests = runtimeTests(left.type.className);
-    if (tests.length === 1) {
-      return { kind: "instanceOf", value: left, className: tests[0]!.def.name, type: BOOL, loc };
-    }
-    const local = lowerer.declareHiddenLocal("%writableTest", left.type);
-    const ref = varRef(local.id, left.type, loc);
-    const test = (className: string): IrExpr => ({
-      kind: "instanceOf",
-      value: ref,
-      className,
-      type: BOOL,
-      loc,
-    });
-    return {
-      kind: "seqExpr",
-      stmts: [{ kind: "varDecl", localId: local.id, init: left, loc }],
-      result: {
-        kind: "logical",
-        op: "||",
-        left: test(tests[0]!.def.name),
-        right: test(tests[1]!.def.name),
-        type: BOOL,
-        loc,
-      },
-      type: BOOL,
-      loc,
-    };
-  }
-  const leftClass = left.type.className;
-  const isInstance = (className: string): boolean =>
-    leftClass === className || lowerer.isSubclassOf(leftClass, className);
-  const value =
-    isInstance(target.def.name) || (duplex !== undefined && isInstance(duplex.def.name));
-  if (left.kind === "varRef") {
-    return readsClassAfter(lowerer, target, expr.right, [], {
-      kind: "boolLit",
-      value,
-      type: BOOL,
-      loc,
-    });
-  }
-  lowerer.unsupported(
-    "SC1090",
-    expr,
-    "statically-decided 'instanceof' on computed operands (bind the value to a variable first)",
-  );
-}
-
-/** `x instanceof K` for a union-typed operand whose arms are class
- * instances or unit values: each instance arm tests against the class
- * value (with the Writable rule), unit arms answer false. Null when an arm
- * is anything else. */
-function unionClassValueInstanceOf(
-  lowerer: Lowerer,
-  left: IrExpr,
-  right: ts.Expression,
-  targetInfo: ClassInfo,
-  loc: SrcLoc,
-): IrExpr | null {
-  if (left.type.kind !== "union") return null;
-  const unionId = left.type.unionId;
-  const arms = lowerer.unions.get(unionId)?.arms;
-  if (
-    !arms?.every((arm) => {
-      if (arm.kind !== "object") return isUnitType(arm);
-      const info = lowerer.classes.get(arm.className);
-      return info !== undefined && lowerer.inHierarchy(info);
-    })
-  )
-    return null;
-  const classValue = lowerer.lowerExpr(right);
-  if (classValue.type.kind !== "classval") lowerer.badType(right, lowerer.typeOf(right));
-  const value = lowerer.declareHiddenLocal("%instanceValue", left.type);
-  const cls = lowerer.declareHiddenLocal("%instanceClass", classValue.type);
-  const valueRef = varRef(value.id, left.type, loc);
-  const clsRef = varRef(cls.id, classValue.type, loc);
-  let result: IrExpr = { kind: "boolLit", value: false, type: BOOL, loc };
-  arms.forEach((arm, tag) => {
-    if (arm.kind !== "object") return;
-    const narrowed: IrExpr = { kind: "unionNarrow", unionId, tag, value: valueRef, type: arm, loc };
-    const lhsInfo = lowerer.classes.get(arm.className)!;
-    const test: IrExpr = writableClassValueTest(
-      lowerer,
-      narrowed,
-      clsRef,
-      targetInfo,
-      lhsInfo,
-      loc,
-    ) ?? { kind: "instanceOfValue", value: narrowed, classValue: clsRef, type: BOOL, loc };
-    result = {
-      kind: "ternary",
-      cond: { kind: "unionIsTag", unionId, tag, negated: false, value: valueRef, type: BOOL, loc },
-      then: test,
-      else_: result,
-      type: BOOL,
-      loc,
-    };
-  });
-  return {
-    kind: "seqExpr",
-    stmts: [
-      { kind: "varDecl", localId: value.id, init: left, loc },
-      { kind: "varDecl", localId: cls.id, init: classValue, loc },
-    ],
-    result,
-    type: BOOL,
-    loc,
-  };
-}
-
-/** `x instanceof K` where K is a class value that may hold Writable (a
- * `typeof Writable` or `typeof EventEmitter` slot): Node's
- * Writable[Symbol.hasInstance] also answers true for streams with a
- * writable side that do not inherit from Writable (Duplex and its
- * subclasses), so when K is Writable the Duplex interval answers too.
- * Null when the slot cannot hold Writable or the operand cannot be a
- * Duplex. */
-function writableClassValueTest(
-  lowerer: Lowerer,
-  left: IrExpr,
-  classValue: IrExpr,
-  targetInfo: ClassInfo,
-  lhsInfo: ClassInfo,
-  loc: SrcLoc,
-): IrExpr | null {
-  const writable = lowerer.classes.get("%Writable");
-  const duplex = lowerer.classes.get("%Duplex");
-  if (!writable || !duplex || classValue.type.kind !== "classval" || left.type.kind !== "object")
-    return null;
-  const slotHoldsWritable =
-    targetInfo === writable || lowerer.isSubclassOf("%Writable", targetInfo.def.name);
-  const operandMayBeDuplex =
-    lhsInfo === duplex ||
-    lowerer.isSubclassOf(lhsInfo.def.name, "%Duplex") ||
-    lowerer.isSubclassOf("%Duplex", lhsInfo.def.name);
-  if (!slotHoldsWritable || !operandMayBeDuplex) return null;
-  lowerer.defineClassValueConstruct(writable);
-  const value = lowerer.declareHiddenLocal("%instanceValue", left.type);
-  const cls = lowerer.declareHiddenLocal("%instanceClass", classValue.type);
-  const valueRef = varRef(value.id, left.type, loc);
-  const clsRef = varRef(cls.id, classValue.type, loc);
-  return {
-    kind: "seqExpr",
-    stmts: [
-      { kind: "varDecl", localId: value.id, init: left, loc },
-      { kind: "varDecl", localId: cls.id, init: classValue, loc },
-    ],
-    result: {
-      kind: "logical",
-      op: "||",
-      left: { kind: "instanceOfValue", value: valueRef, classValue: clsRef, type: BOOL, loc },
-      right: {
-        kind: "logical",
-        op: "&&",
-        left: {
-          kind: "bin",
-          op: "===",
-          left: clsRef,
-          right: {
-            kind: "classRef",
-            className: "%Writable",
-            type: { kind: "classval", className: "%Writable" },
-            loc,
-          },
-          type: BOOL,
-          loc,
-        },
-        right: { kind: "instanceOf", value: valueRef, className: "%Duplex", type: BOOL, loc },
-        type: BOOL,
-        loc,
-      },
-      type: BOOL,
-      loc,
-    },
-    type: BOOL,
-    loc,
-  };
-}
-
-/** A statically decided `instanceof` still reads its class after the left
- * operand: a class with an initialization flag throws there before its
- * declaration ran. */
-function readsClassAfter(
-  lowerer: Lowerer,
-  target: ClassInfo,
-  right: ts.Expression,
-  stmts: IrStmt[],
-  result: IrExpr,
-): IrExpr {
-  if (!lowerer.classInitFlags.has(target.def.name)) {
-    if (stmts.length === 0) return result;
-    return { kind: "seqExpr", stmts, result, type: result.type, loc: result.loc };
-  }
-  const read = lowerer.lowerExpr(right);
-  return {
-    kind: "seqExpr",
-    stmts: [...stmts, { kind: "exprStmt", expr: read, loc: locOf(right) }],
-    result,
-    type: result.type,
-    loc: result.loc,
-  };
-}
-
-/** `#name in obj` — the ergonomic brand check. In this closed world a
- * brand is held by exactly the instances of the declaring class
- * (subclasses included — construction always runs the declaring class's
- * own initializers), so the test IS `obj instanceof <declaring class>`:
- * statically decided when the receiver's class sits at/below the
- * declarer (true) or in a disjoint subtree (false) — both folds under
- * the instanceof purity rule — and a runtime interval test when the
- * declarer sits strictly BELOW the receiver's static class (the
- * narrowing use; tsc types the true branch at the class, and reads
- * bridge through maybeNarrow's downcast exactly like instanceof). tsc
- * confines the spelling to the declaring class's body and rejects
- * primitive/unknown receivers, so Node's in-operator TypeError is
- * unreachable in compilable programs. Timing residue: JS installs
- * brands DURING construction, so a check reachable from a base
- * constructor can observe false mid-construction where this answers
- * true (SEMANTICS.md). */
-function lowerPrivateIn(
-  lowerer: Lowerer,
-  expr: ts.BinaryExpression,
-  priv: ts.PrivateIdentifier,
-  loc: SrcLoc,
-): IrExpr {
-  const pname = priv.text;
-  // The declaring class: the nearest enclosing class declaring the name
-  // (JS scoping — an inner class's spelling shadows an outer one's).
-  let classDecl: ts.ClassLikeDeclaration | null = null;
-  let staticBrand = false;
-  for (let n: ts.Node | undefined = priv.parent; n; n = n.parent) {
-    if (ts.isClassDeclaration(n) || ts.isClassExpression(n)) {
-      const owner = n.members.nodes.find((m) => {
-        const name = (m as { name?: ts.PropertyName }).name;
-        return name !== undefined && ts.isPrivateIdentifier(name) && name.text === pname;
-      });
-      if (owner) {
-        classDecl = n;
-        staticBrand =
-          ts.canHaveModifiers(owner) &&
-          ts.getModifiers(owner)?.some((m) => m.kind === ts.SyntaxKind.StaticKeyword) === true;
-        break;
-      }
-    }
-  }
-  // tsc rejects the spelling outside a declaring class body; defensive.
-  if (!classDecl)
-    lowerer.unsupported("SC1090", expr, `'${pname} in …' outside a class declaring '${pname}'`);
-  if (staticBrand) {
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      `'${pname} in …' brand checks for private STATICS (JS brands the declaring class OBJECT, not instances — compare against the class value directly)`,
-    );
-  }
-  const info =
-    lowerer.currentClass?.decl === classDecl
-      ? lowerer.currentClass
-      : (() => {
-          const sym = classDecl.name
-            ? lowerer.checker.getSymbolAtLocation(classDecl.name)
-            : undefined;
-          return sym ? lowerer.classBySymbol.get(sym) : undefined;
-        })();
-  if (!info) {
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      `'${pname} in …' where the declaring class has no lowering (see the class declaration's own diagnostic)`,
-    );
-  }
-  // A GENERIC family: JS has ONE runtime class and ONE brand for every
-  // instantiation, while these layouts mint one class per instantiation
-  // — a cross-instantiation check would answer false where Node says
-  // true, so the family reports SC1090 instead of splitting the brand.
-  if (info.generic || info.genericInstance) {
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      `'${pname} in …' inside a generic class (JS shares one brand across every instantiation; these layouts mint one class per instantiation)`,
-    );
-  }
-  const recv = lowerer.lowerExpr(expr.right);
-  const declName = info.def.name;
-  // A UNION of class instances (`o: Counter | Helper` — the
-  // discriminating use): every object arm answers membership STATICALLY
-  // (at/below the declarer → true, disjoint subtree → false), so the
-  // whole test collapses to runtime TAG tests — the record-shape 'in'
-  // discrimination, brand form. An arm ABOVE the declarer answers per
-  // VALUE (its slot can hold branded and unbranded instances), and
-  // non-object arms have no brand story — both fence.
-  if (recv.type.kind === "union") {
-    const unionId = recv.type.unionId;
-    const arms = lowerer.unions.get(unionId)?.arms ?? [];
-    const answers: { tag: number; has: boolean }[] = [];
-    let staticAnswers = arms.length > 0;
-    for (const arm of arms) {
-      const tag = lowerer.armTag(unionId, arm);
-      if (tag < 0 || arm.kind !== "object" || lowerer.isSubclassOf(declName, arm.className)) {
-        staticAnswers = false;
-        break;
-      }
-      answers.push({
-        tag,
-        has: arm.className === declName || lowerer.isSubclassOf(arm.className, declName),
-      });
-    }
-    if (staticAnswers) {
-      const pureRecv =
-        recv.kind === "varRef" || recv.kind === "recordGet" || recv.kind === "fieldGet";
-      const isTag = (tag: number, negated: boolean): IrExpr => ({
-        kind: "unionIsTag",
-        unionId,
-        tag,
-        negated,
-        value: recv,
-        type: BOOL,
-        loc,
-      });
-      const trues = answers.filter((a) => a.has);
-      if (trues.length === answers.length || trues.length === 0) {
-        const ans = trues.length !== 0;
-        if (pureRecv) return { kind: "boolLit", value: ans, type: BOOL, loc };
-        // Constant either way, receiver still evaluates once: one tag
-        // test whose branches agree (the record-'in' rule verbatim).
-        return {
-          kind: "ternary",
-          cond: isTag(answers[0]!.tag, false),
-          then: { kind: "boolLit", value: ans, type: BOOL, loc },
-          else_: { kind: "boolLit", value: ans, type: BOOL, loc },
-          type: BOOL,
-          loc,
-        };
-      }
-      if (trues.length === 1) return isTag(trues[0]!.tag, false);
-      const falses = answers.filter((a) => !a.has);
-      if (falses.length === 1) return isTag(falses[0]!.tag, true);
-      if (pureRecv) {
-        let out: IrExpr = isTag(trues[0]!.tag, false);
-        for (const t of trues.slice(1)) {
-          out = {
-            kind: "logical",
-            op: "||",
-            left: out,
-            right: isTag(t.tag, false),
-            type: BOOL,
-            loc,
-          };
-        }
-        return out;
-      }
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        `statically-decided '${pname} in …' on computed receivers (bind the value to a variable first)`,
-      );
-    }
-  }
-  if (recv.type.kind !== "object") {
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      `'${pname} in …' on '${lowerer.fmt(recv.type)}' receivers (only class-instance receivers — and unions of classes below or beside the declarer — have a static brand answer; narrow first)`,
-    );
-  }
-  const lhsName = recv.type.className;
-  const lhsInfo = lowerer.classes.get(lhsName);
-  if (!lhsInfo) throw new InternalCompilerError(`lowerer bug: unknown class ${lhsName}`);
-  if (lowerer.isSubclassOf(declName, lhsName)) {
-    // The narrowing direction: the declarer strictly below the
-    // receiver's static class — a strict subclass relation puts both in
-    // a hierarchy, so the vtable interval test always exists.
-    return { kind: "instanceOf", value: recv, className: declName, type: BOOL, loc };
-  }
-  const value = lhsName === declName || lowerer.isSubclassOf(lhsName, declName);
-  if (recv.kind === "varRef") return { kind: "boolLit", value, type: BOOL, loc };
-  lowerer.unsupported(
-    "SC1090",
-    expr,
-    `statically-decided '${pname} in …' on computed operands (bind the value to a variable first)`,
-  );
-}
-
-/** The string keys every record inherits from Object.prototype. */
-const OBJECT_PROTOTYPE_KEYS: ReadonlySet<string> = new Set([
-  "constructor",
-  "__defineGetter__",
-  "__defineSetter__",
-  "hasOwnProperty",
-  "__lookupGetter__",
-  "__lookupSetter__",
-  "isPrototypeOf",
-  "propertyIsEnumerable",
-  "toString",
-  "valueOf",
-  "__proto__",
-  "toLocaleString",
-]);
-
-/** `"key" in v` — the key-presence test. Three lowered receivers:
- * process.env (getenv(3) presence — Node-exact, an empty value still
- * counts as present), and monomorphic record shapes, where the answer is
- * type-directed: a declared non-optional field is a compile-time `true`,
- * a missing field (no index signature) a compile-time `false` unless
- * Object.prototype has it — both
- * folds limited to side-effect-free receivers, the lowerInstanceOf rule —
- * and an OPTIONAL field (undefined-armed union) is a runtime presence
- * test on the slot: an omitted or deleted property is absent, while a
- * property explicitly holding `undefined` is present, as in JS
- * (`"a" in {a: undefined}` is true). Union receivers (the `in`-narrowing
- * idiom over multiple shapes), index-signature keys, class instances,
- * and dyn/unknown stay fenced. Keys are literal strings — a computed key
- * over a shape would need the runtime key table. */
-function lowerInExpression(lowerer: Lowerer, expr: ts.BinaryExpression, loc: SrcLoc): IrExpr {
-  if (
-    lowerer.isStdlibGlobal(expr.right, "process") &&
-    lowerer.foldedStringKeyOf(expr.left) === "hrtime"
-  ) {
-    return { kind: "boolLit", value: true, type: BOOL, loc };
-  }
-  const globalKey = globalSymbolKey(lowerer, expr.right, expr.left);
-  if (globalKey)
-    return { kind: "libCall", fn: "dyn.globalSymbolHas", args: [globalKey], type: BOOL, loc };
-  // `#name in obj` — the ergonomic brand check (ES2022) — resolves
-  // before any string-key machinery: the left operand is a private
-  // NAME, not a value.
-  if (ts.isPrivateIdentifier(expr.left)) {
-    return lowerPrivateIn(lowerer, expr, expr.left, loc);
-  }
-  // Compile-time-known STRING keys fold — literals, and the same
-  // const/enum-literal and template folding computed property keys get
-  // (foldedStringKeyOf); runtime-valued keys keep the fence.
-  // NUMERIC literal keys answer on ARRAY receivers through the shared
-  // presence query. Arrays retain holes independently from length, and
-  // noncanonical numeric keys live in their ordinary-property table, so
-  // a length comparison is not an honest `in` answer.
-  {
-    let kNode = expr.left;
-    while (ts.isParenthesizedExpression(kNode)) kNode = kNode.expression;
-    if (
-      ts.isNumericLiteral(kNode) &&
-      lowerer.mapTypeOf(lowerer.typeOf(expr.right))?.kind === "array"
-    ) {
-      const recvArr = lowerer.lowerExpr(expr.right);
-      if (recvArr.type.kind === "array") {
-        const n = Number(kNode.text);
-        return {
-          kind: "arrayHas",
-          arr: recvArr,
-          index: { kind: "numLit", value: n, type: F64, loc },
-          type: BOOL,
-          loc,
-        };
-      }
-    }
-  }
-  // A RUNTIME numeric key over an ARRAY receiver (`if (i in arr)` in a
-  // loop) asks the same slot/property presence query as the literal fold
-  // above and `Object.hasOwn`. The checked-dynamic fallback below would
-  // box the receiver and materialize every element on each evaluation,
-  // which makes such loops quadratic. A Number key never names an
-  // inherited property: neither Array.prototype nor Object.prototype has
-  // index-like or numeric-string keys. JS evaluates the key before the
-  // receiver, so the key is stabilized in a hidden local first.
-  if (
-    lowerer.mapTypeOf(lowerer.typeOf(expr.left))?.kind === "f64" &&
-    lowerer.mapTypeOf(lowerer.typeOf(expr.right))?.kind === "array"
-  ) {
-    const k = lowerer.lowerExpr(expr.left);
-    const recvArr = lowerer.lowerExpr(expr.right);
-    if (k.type.kind === "f64" && recvArr.type.kind === "array") {
-      const keyLocal = lowerer.declareHiddenLocal("%inIndex", F64);
-      return {
-        kind: "seqExpr",
-        stmts: [{ kind: "varDecl", localId: keyLocal.id, init: k, loc }],
-        result: {
-          kind: "arrayHas",
-          arr: recvArr,
-          index: varRef(keyLocal.id, F64, loc),
-          type: BOOL,
-          loc,
-        },
-        type: BOOL,
-        loc,
-      };
-    }
-  }
-  const key = foldedStringKeyOf(lowerer, expr.left);
-  if (key === null) {
-    // A RUNTIME string key over an INDEX-SIGNATURE record receiver (the
-    // `names.filter((k) => k in config)` idiom): the interned key-
-    // presence helper — declared fields answer statically per name
-    // (optional slots by their runtime presence), then the overflow
-    // map's live keys. Other receivers keep the
-    // fence: fixed shapes want the literal folds above, and there is no
-    // runtime key table to ask.
-    const rIn = lowerRuntimeKeyIn(lowerer, expr, loc);
-    if (rIn) return rIn;
-    // A runtime key over a CHECKED-DYNAMIC receiver (`name in
-    // agent.sockets` — both sides computed; the checker may type the
-    // receiver as a Dict while the VALUE lives in the checked-dynamic tree, so the
-    // LOWERED type decides): the dyn presence answer, with the key
-    // stringified like every property key (o[k] is o[String(k)] in JS;
-    // `in` shares the coercion).
-    {
-      const probed = tryLowerExpression(lowerer, expr.right);
-      if (probed && lowerer.dynConvertible(probed.type)) {
-        const k = lowerer.lowerExpr(expr.left); // JS order: the key evaluates first
-        if (lowerer.dynConvertible(k.type)) {
-          const boxed = lowerer.coerceToExpected(k, DYN);
-          const keyLocal = lowerer.declareHiddenLocal("%inKey", DYN);
-          return {
-            kind: "seqExpr",
-            stmts: [{ kind: "varDecl", localId: keyLocal.id, init: boxed, loc }],
-            result: {
-              kind: "libCall",
-              fn: "dyn.hasKeyComputed",
-              args: [
-                lowerer.coerceToExpected(lowerer.lowerExpr(expr.right), DYN),
-                varRef(keyLocal.id, DYN, loc),
-              ],
-              type: BOOL,
-              loc,
-            },
-            type: BOOL,
-            loc,
-          };
-        }
-      }
-    }
-    lowerer.unsupported(
-      "SC1090",
-      expr.left,
-      "'in' with computed (non-literal) keys (a const whose type is one string literal folds; a string-typed key answers over index-signature record receivers)",
-    );
-  }
-  // A receiver re-read (the static folds below) is safe for plain reads
-  // AND for side-effect-free expressions (an object literal of literals
-  // — the `"a" in { a: true }` shape).
-  const pureRecvNode = sideEffectFreeOptionValue(expr.right);
-  if (lowerer.isProcessEnv(expr.right)) {
-    // `"NO_COLOR" in process.env`: presence via the one envGet intrinsic —
-    // getenv(3) returning non-NULL is Node's `in` on process.env exactly.
-    const envType = lowerer.envValueType();
-    if (envType.kind !== "union")
-      throw new InternalCompilerError("lowerer bug: env value type is not a union");
-    const undefTag = lowerer.armTag(envType.unionId, UNDEFINED_T);
-    const read: IrExpr = {
-      kind: "libCall",
-      fn: "process.envGet",
-      args: [{ kind: "strLit", value: key, type: STRING, loc }],
-      type: envType,
-      loc,
-    };
-    return {
-      kind: "unionIsTag",
-      unionId: envType.unionId,
-      tag: undefTag,
-      negated: true,
-      value: read,
-      type: BOOL,
-      loc,
-    };
-  }
-  if (key === "code" && isExecExceptionType(lowerer, lowerer.typeOf(expr.right))) {
-    refuseExecExceptionCode(lowerer, expr);
-  }
-  let recv = lowerer.lowerExpr(expr.right);
-  const classInfo =
-    recv.type.kind === "classval" ? lowerer.classes.get(recv.type.className) : undefined;
-  if (
-    (classInfo && (classInfo.callableBase || hasRuntimeStatics(classInfo))) ||
-    (isJsSourceFile(expr.getSourceFile()) &&
-      recv.type.kind === "func" &&
-      lowerer.dynConvertible(recv.type))
-  ) {
-    recv = lowerer.coerceToExpected(recv, DYN);
-  }
-  const siteType = lowerer.mapTypeOf(lowerer.typeOf(expr.right));
-  if (
-    recv.type.kind === "union" &&
-    siteType?.kind === "union" &&
-    !typeEquals(recv.type, siteType)
-  ) {
-    const helper = lowerer.narrowedRetagHelper(
-      expr.right,
-      recv.type.unionId,
-      siteType.unionId,
-      loc,
-    );
-    if (helper) recv = { kind: "call", callee: helper, args: [recv], type: siteType, loc };
-  }
-  // Error-rooted receivers (builtin or user subclass — the isErrnoException
-  // predicate's `err instanceof Error && "code" in err` shape): `code`
-  // answers from the runtime error's code slot (stamped by fs/system/
-  // event/spawn errors, absent on plain constructions — exactly Node's
-  // own-property answer), and the always-declared members fold true.
-  // Everything else fences: the runtime object carries no other dynamic
-  // properties to ask (`stack` would be a lie — Node has one, we don't).
-  if (recv.type.kind === "object") {
-    // %DOMException first: `'cause' in e` answers the options form's
-    // own-property record (the runtime slot), and code/name/message are
-    // always present.
-    if (recv.type.className === "%DOMException") {
-      if (key === "cause") {
-        return { kind: "libCall", fn: "error.domHasCause", args: [recv], type: BOOL, loc };
-      }
-      if (
-        (key === "code" || key === "message" || key === "name") &&
-        (recv.kind === "varRef" || recv.kind === "caughtNarrow")
-      ) {
-        return { kind: "boolLit", value: true, type: BOOL, loc };
-      }
-    }
-    let info = lowerer.classes.get(recv.type.className) ?? null;
-    while (info && info.base) info = info.base;
-    if (info?.def.name === "%Error") {
-      if (key === "cause") {
-        return { kind: "libCall", fn: "error.hasCause", args: [recv], type: BOOL, loc };
-      }
-      if (key === "code") {
-        const codeType = lowerer.envValueType();
-        if (codeType.kind !== "union")
-          throw new InternalCompilerError("lowerer bug: error code type is not a union");
-        const undefTag = lowerer.armTag(codeType.unionId, UNDEFINED_T);
-        const read: IrExpr = {
-          kind: "libCall",
-          fn: "error.code",
-          args: [recv],
-          type: codeType,
-          loc,
-        };
-        return {
-          kind: "unionIsTag",
-          unionId: codeType.unionId,
-          tag: undefTag,
-          negated: true,
-          value: read,
-          type: BOOL,
-          loc,
-        };
-      }
-      if (
-        (key === "message" || key === "name") &&
-        (recv.kind === "varRef" || recv.kind === "caughtNarrow")
-      ) {
-        return { kind: "boolLit", value: true, type: BOOL, loc };
-      }
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        `'in' with the key '${key}' on Error receivers (code answers from the error's code slot; message and name are always present)`,
-      );
-    }
-  }
-  // A dyn receiver (`"portless" in pkg` after the `typeof pkg ===
-  // "object"` guard): own-member presence on the checked-dynamic tree — tsc admits `in`
-  // only on object-typed operands, so unit receivers are unreachable.
-  if (recv.type.kind === "dyn") {
-    return { kind: "dynHasKey", key, value: recv, type: BOOL, loc };
-  }
-  // `"k" in u` over a UNION whose arms are FIXED record shapes: every
-  // arm answers membership STATICALLY (a declared non-optional field is
-  // always present, an undeclared name never is), so the whole test
-  // collapses to runtime TAG tests — tsc's own narrowing then types the
-  // branches (the discriminating-`in` idiom). Optional (undefined-armed)
-  // fields and tuple/index-signature arms answer per VALUE, not per arm
-  // — those unions keep the fence below.
-  if (recv.type.kind === "union") {
-    const unionId = recv.type.unionId;
-    const arms = lowerer.unions.get(unionId)?.arms ?? [];
-    const answers: { tag: number; has: boolean }[] = [];
-    let staticAnswers = arms.length > 0;
-    for (const arm of arms) {
-      const tag = lowerer.armTag(unionId, arm);
-      const shape = arm.kind === "record" ? lowerer.shapes.get(arm.shapeId) : undefined;
-      if (tag < 0 || !shape || shape.tuple || shape.indexValue) {
-        staticAnswers = false;
-        break;
-      }
-      const f = shape.fields.find((x) => x.name === key);
-      const inherited = OBJECT_PROTOTYPE_KEYS.has(key);
-      if (
-        f &&
-        !inherited &&
-        f.type.kind === "union" &&
-        lowerer.armTag(f.type.unionId, UNDEFINED_T) >= 0
-      ) {
-        staticAnswers = false; // an optional slot: presence is per-value
-        break;
-      }
-      // Accessor properties are own properties to `in` (Node answers
-      // true without invoking the getter) — either slot present makes
-      // the name a member.
-      const acc = shape.fields.some((x) => x.name === `%get:${key}` || x.name === `%set:${key}`);
-      answers.push({ tag, has: f !== undefined || acc || inherited });
-    }
-    if (staticAnswers) {
-      const pureRecv =
-        recv.kind === "varRef" ||
-        recv.kind === "recordGet" ||
-        recv.kind === "fieldGet" ||
-        pureRecvNode;
-      const isTag = (tag: number, negated: boolean): IrExpr => ({
-        kind: "unionIsTag",
-        unionId,
-        tag,
-        negated,
-        value: recv,
-        type: BOOL,
-        loc,
-      });
-      const trues = answers.filter((a) => a.has);
-      if (trues.length === answers.length || trues.length === 0) {
-        // Constant either way — but JS still EVALUATES the operand (it
-        // may throw: an ambient-const read is a ReferenceError). Pure
-        // reads fold; anything else rides one tag test whose branches
-        // agree, evaluating the receiver exactly once.
-        const ans = trues.length !== 0;
-        if (pureRecv) return { kind: "boolLit", value: ans, type: BOOL, loc };
-        return {
-          kind: "ternary",
-          cond: isTag(answers[0]!.tag, false),
-          then: { kind: "boolLit", value: ans, type: BOOL, loc },
-          else_: { kind: "boolLit", value: ans, type: BOOL, loc },
-          type: BOOL,
-          loc,
-        };
-      }
-      // One deciding arm (either polarity): a single tag test, receiver
-      // evaluated once — no purity requirement.
-      if (trues.length === 1) return isTag(trues[0]!.tag, false);
-      const falses = answers.filter((a) => !a.has);
-      if (falses.length === 1) return isTag(falses[0]!.tag, true);
-      // Several arms on each side: the OR chain re-reads the receiver,
-      // so only side-effect-free reads qualify.
-      if (pureRecv) {
-        let out: IrExpr = isTag(trues[0]!.tag, false);
-        for (const t of trues.slice(1)) {
-          out = {
-            kind: "logical",
-            op: "||",
-            left: out,
-            right: isTag(t.tag, false),
-            type: BOOL,
-            loc,
-          };
-        }
-        return out;
-      }
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        "statically-decided 'in' on computed receivers (bind the value to a variable first)",
-      );
-    }
-  }
-  if (recv.type.kind !== "record") {
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      `'in' on '${lowerer.fmt(recv.type)}' receivers (only process.env, Error instances, record-typed values, and unions of fixed record shapes answer; ${NARROW_FIRST})`,
-    );
-  }
-  const shape = lowerer.shapes.get(recv.type.shapeId);
-  if (!shape) throw new InternalCompilerError(`lowerer bug: unknown shape ${recv.type.shapeId}`);
-  const field = shape.fields.find((f) => f.name === key);
-  if (field) {
-    if (
-      !OBJECT_PROTOTYPE_KEYS.has(key) &&
-      field.type.kind === "union" &&
-      lowerer.armTag(field.type.unionId, UNDEFINED_T) >= 0
-    ) {
-      // Optional slot: the key is present unless the field is absent
-      // (omitted or deleted); an explicit undefined is present.
-      return lowerer.recordFieldPresent(recv, recv.type.shapeId, key, loc);
-    }
-    // A declared non-optional field always exists on every value of the
-    // shape — statically true, but folding may only drop a
-    // side-effect-free receiver read.
-    if (
-      recv.kind === "varRef" ||
-      recv.kind === "recordGet" ||
-      recv.kind === "fieldGet" ||
-      pureRecvNode
-    ) {
-      return { kind: "boolLit", value: true, type: BOOL, loc };
-    }
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      "statically-decided 'in' on computed receivers (bind the value to a variable first)",
-    );
-  }
-  // Accessor properties answer `in` as own members (Node: true, getter
-  // NOT invoked) — statically true under the same purity discipline as
-  // declared non-optional fields.
-  if (shape.fields.some((f) => f.name === `%get:${key}` || f.name === `%set:${key}`)) {
-    if (
-      recv.kind === "varRef" ||
-      recv.kind === "recordGet" ||
-      recv.kind === "fieldGet" ||
-      pureRecvNode
-    ) {
-      return { kind: "boolLit", value: true, type: BOOL, loc };
-    }
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      "statically-decided 'in' on computed receivers (bind the value to a variable first)",
-    );
-  }
-  // Records are ordinary objects: Object.prototype's members are in them.
-  const inherited = OBJECT_PROTOTYPE_KEYS.has(key);
-  if (shape.indexValue && !inherited) {
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      "'in' over index-signature keys (read the key and test '!== undefined' instead)",
-    );
-  }
-  if (
-    recv.kind === "varRef" ||
-    recv.kind === "recordGet" ||
-    recv.kind === "fieldGet" ||
-    pureRecvNode
-  ) {
-    // A null-prototype record (Object.groupBy) has no inherited names.
-    const nullProtoT = inherited ? nullProtoRecordShape(lowerer, recv.type) : null;
-    if (nullProtoT) {
-      return {
-        kind: "unary",
-        op: "!",
-        operand: recordNullProtoTest(recv, nullProtoT.shapeId, loc),
-        type: BOOL,
-        loc,
-      };
-    }
-    return { kind: "boolLit", value: inherited, type: BOOL, loc };
-  }
-  lowerer.unsupported(
-    "SC1090",
-    expr,
-    "statically-decided 'in' on computed receivers (bind the value to a variable first)",
-  );
-}
-
-/** The runtime-key `in` (see lowerInExpression): `k in r` where k is a
- * runtime string and r an index-signature record — an interned
- * `%rec.haskey.<n>(k, r)` walks the declared names (a string-equality
- * chain: non-optional fields and accessor slots answer true, optional
- * slots answer their per-value tag test) and then probes the overflow
- * map's hashed key set. Null when the pair is outside that shape (the
- * caller keeps its fence). */
-function lowerRuntimeKeyIn(
-  lowerer: Lowerer,
-  expr: ts.BinaryExpression,
-  loc: SrcLoc,
-): IrExpr | null {
-  if (lowerer.mapTypeOf(lowerer.typeOf(expr.left))?.kind !== "string") return null;
-  const recvT = lowerer.mapTypeOf(lowerer.typeOf(expr.right));
-  if (recvT?.kind !== "record") return null;
-  const shape = lowerer.shapes.get(recvT.shapeId);
-  if (!shape?.indexValue || shape.tuple) return null;
-  const keyIr = lowerer.lowerExprExpecting(expr.left, STRING);
-  const recv = lowerer.lowerExprExpecting(expr.right, recvT);
-  const hkey = `haskey:${recvT.shapeId}`;
-  let helper = lowerer.valueHelpers.get(hkey);
-  if (!helper) {
-    helper = `%rec.haskey.${lowerer.valueHelpers.size}`;
-    lowerer.valueHelpers.set(hkey, helper);
-    const recT: IrType = { kind: "record", shapeId: recvT.shapeId };
-
-    const k = varRef("k.0", STRING, loc);
-    const r = varRef("r.0", recT, loc);
-    const body: IrStmt[] = [];
-    const ret = (value: IrExpr): IrStmt => ({ kind: "return", value, loc });
-    for (const f of shape.fields) {
-      const accessor = f.name.startsWith("%get:") || f.name.startsWith("%set:");
-      if (f.name.startsWith("%") && !accessor) continue;
-      const name = accessor ? f.name.slice(5) : f.name;
-      const eq: IrExpr = {
-        kind: "strEq",
-        negated: false,
-        left: k,
-        right: { kind: "strLit", value: name, type: STRING, loc },
-        type: BOOL,
-        loc,
-      };
-      const answer: IrExpr = accessor
-        ? { kind: "boolLit", value: true, type: BOOL, loc }
-        : lowerer.recordFieldPresent(r, recvT.shapeId, f.name, loc);
-      body.push({ kind: "if", cond: eq, then: [ret(answer)], else_: null, loc });
-    }
-    // Overflow keys answer through the map's hashed presence probe (a
-    // stored undefined value is still present), not a scan over a fresh
-    // key snapshot, which made `k in dict` loops quadratic.
-    const ovfHas: IrExpr = {
-      kind: "recordOvfHas",
-      obj: r,
-      shapeId: recvT.shapeId,
-      key: k,
-      type: BOOL,
-      loc,
-    };
-    // A miss in the record's own keys still finds Object.prototype's,
-    // unless the record has a null prototype (Object.groupBy).
-    let protoName: IrExpr | null = null;
-    for (const name of OBJECT_PROTOTYPE_KEYS) {
-      if (shape.fields.some((f) => f.name === name)) continue;
-      const eq: IrExpr = {
-        kind: "strEq",
-        negated: false,
-        left: k,
-        right: { kind: "strLit", value: name, type: STRING, loc },
-        type: BOOL,
-        loc,
-      };
-      protoName =
-        protoName === null
-          ? eq
-          : { kind: "logical", op: "||", left: protoName, right: eq, type: BOOL, loc };
-    }
-    if (protoName !== null && nullProtoRecordShape(lowerer, recT)) {
-      protoName = {
-        kind: "logical",
-        op: "&&",
-        left: protoName,
-        right: {
-          kind: "unary",
-          op: "!",
-          operand: recordNullProtoTest(r, recvT.shapeId, loc),
-          type: BOOL,
-          loc,
-        },
-        type: BOOL,
-        loc,
-      };
-    }
-    body.push(
-      ret(
-        protoName === null
-          ? ovfHas
-          : { kind: "logical", op: "||", left: ovfHas, right: protoName, type: BOOL, loc },
-      ),
-    );
-    lowerer.liftedFns.push({
-      name: helper,
-      params: [
-        { localId: "k.0", name: "k", type: STRING },
-        { localId: "r.0", name: "r", type: recT },
-      ],
-      returnType: BOOL,
-      locals: [
-        { id: "k.0", name: "k", type: STRING, mutable: true },
-        { id: "r.0", name: "r", type: recT, mutable: true },
-      ],
-      body,
-      loc,
-    });
-  }
-  return { kind: "call", callee: helper, args: [keyIr, recv], type: BOOL, loc };
-}
-
-/** RegExp.prototype's flag getters and the flag each one reads. */
-const REGEX_FLAG_GETTERS: ReadonlyMap<string, string> = new Map([
-  ["hasIndices", "d"],
-  ["global", "g"],
-  ["ignoreCase", "i"],
-  ["multiline", "m"],
-  ["dotAll", "s"],
-  ["unicode", "u"],
-  ["unicodeSets", "v"],
-  ["sticky", "y"],
-]);
-
 /** A regex literal `/ab+c/gi` → regexLit (fresh state per evaluation,
  * shared bytecode per (pattern, flags) pair). The TS parser has already syntax-checked the literal;
  * what remains here is the flag-alphabet fence (d is a
@@ -14342,7 +2206,9 @@ export function lowerRegexLiteral(lowerer: Lowerer, expr: ts.RegularExpressionLi
  * only needs to track escapes, character classes, and `(` kinds; tsc
  * has already syntax-checked the literal, so a malformed pattern here
  * answers null and the engine's lazy compile reports it. */
-function namedCaptureGroupsOfPattern(pattern: string): { name: string; index: number }[] | null {
+export function namedCaptureGroupsOfPattern(
+  pattern: string,
+): { name: string; index: number }[] | null {
   const groups: { name: string; index: number }[] = [];
   let captureIndex = 0;
   let inClass = false;
@@ -14394,7 +2260,7 @@ function namedCaptureGroupsOfPattern(pattern: string): { name: string; index: nu
  * `const regexp = /(?<m>\d+)/` shape), or `new RegExp("...")` over a
  * string literal (the cooked text IS the pattern). Null when the regex
  * only exists at runtime — .groups consumers fence there. */
-function staticRegexPatternOf(lowerer: Lowerer, e: ts.Expression): string | null {
+export function staticRegexPatternOf(lowerer: Lowerer, e: ts.Expression): string | null {
   let expr = e;
   for (;;) {
     if (ts.isParenthesizedExpression(expr) || ts.isNonNullExpression(expr)) {
@@ -14430,9 +2296,9 @@ function staticRegexPatternOf(lowerer: Lowerer, e: ts.Expression): string | null
  * VariableDeclaration under a const list) — the one-hop provenance step
  * the regex traces walk. Null for let/var (reassignable), params,
  * destructured bindings, and unresolvable names. */
-function constInitializerOf(lowerer: Lowerer, ident: ts.Identifier): ts.Expression | null {
+export function constInitializerOf(lowerer: Lowerer, ident: ts.Identifier): ts.Expression | null {
   const sym = lowerer.resolveValueSymbol(ident);
-  const decl = sym ? lowerer.checker.valueDeclarationOf(sym) : undefined;
+  const decl = sym ? sym.valueDeclaration : undefined;
   if (decl === undefined || !ts.isVariableDeclaration(decl) || decl.initializer === undefined)
     return null;
   if (!ts.isVariableDeclarationList(decl.parent) || (decl.parent.flags & ts.NodeFlags.Const) === 0)
@@ -14440,137 +2306,6 @@ function constInitializerOf(lowerer: Lowerer, ident: ts.Identifier): ts.Expressi
   return decl.initializer;
 }
 
-/** The named-group table of the regex that PRODUCED a match-result
- * expression — the `.groups` desugar's provenance question. Traces
- * (through parens, `!`, and const bindings):
- *   - `re.exec(s)` / `s.match(re)`   → re's static pattern
- *   - a matchAll ROW: `rows[i]`, the for-of binding over a direct
- *     `s.matchAll(re)` or a stored const drain → re's static pattern
- * Answers null when the producing regex isn't statically known (the
- * caller keeps its fence), or the groups list (possibly empty — a
- * traced regex WITHOUT named groups is the Node-undefined case). */
-export function matchResultNamedGroupsOf(
-  lowerer: Lowerer,
-  e: ts.Expression,
-): { name: string; index: number }[] | null {
-  let producer = e;
-  while (ts.isParenthesizedExpression(producer) || ts.isNonNullExpression(producer))
-    producer = producer.expression;
-  if (ts.isIdentifier(producer)) {
-    const init = constInitializerOf(lowerer, producer);
-    if (init !== null) return matchResultNamedGroupsOf(lowerer, init);
-  }
-  const reExpr = matchProducerRegexOf(lowerer, e);
-  if (reExpr === null) return null;
-  if (
-    ts.isCallExpression(producer) &&
-    ts.isPropertyAccessExpression(producer.expression) &&
-    producer.expression.name.text === "match"
-  ) {
-    const flags = staticRegexFlagsOf(lowerer, reExpr);
-    if (flags === null) return null;
-    // Global String.match returns whole matches without a groups
-    // property, even when the pattern contains named captures.
-    if (flags.includes("g")) return [];
-  }
-  const pattern = staticRegexPatternOf(lowerer, reExpr);
-  if (pattern === null) return null;
-  return namedCaptureGroupsOfPattern(pattern);
-}
-
-function staticRegexFlagsOf(lowerer: Lowerer, node: ts.Expression): string | null {
-  let expr = node;
-  while (ts.isParenthesizedExpression(expr) || ts.isNonNullExpression(expr)) expr = expr.expression;
-  if (ts.isRegularExpressionLiteral(expr)) return expr.text.slice(expr.text.lastIndexOf("/") + 1);
-  if (ts.isIdentifier(expr)) {
-    const init = constInitializerOf(lowerer, expr);
-    return init !== null ? staticRegexFlagsOf(lowerer, init) : null;
-  }
-  if (
-    ts.isNewExpression(expr) &&
-    ts.isIdentifier(expr.expression) &&
-    lowerer.isStdlibGlobal(expr.expression, "RegExp")
-  ) {
-    const flags = expr.arguments?.nodes[1];
-    if (!flags) return "";
-    if (ts.isStringLiteral(flags) || ts.isNoSubstitutionTemplateLiteral(flags)) return flags.text;
-  }
-  return null;
-}
-
-/** The regex EXPRESSION whose match produced `e` (see
- * matchResultNamedGroupsOf for the traced shapes). */
-function matchProducerRegexOf(lowerer: Lowerer, e: ts.Expression): ts.Expression | null {
-  let expr = e;
-  for (;;) {
-    if (ts.isParenthesizedExpression(expr) || ts.isNonNullExpression(expr)) {
-      expr = expr.expression;
-      continue;
-    }
-    break;
-  }
-  // The direct producers: re.exec(s) / s.match(re) — the receiver's
-  // mapped type pins the STDLIB operation (a regex for exec, a string
-  // or its nullable spelling for match — the claim string-and-regexp
-  // makes), so a user method that happens to be named `match` with a
-  // regex argument never traces.
-  if (ts.isCallExpression(expr) && ts.isPropertyAccessExpression(expr.expression)) {
-    const name = expr.expression.name.text;
-    const recvT = lowerer.mapTypeOf(lowerer.typeOf(expr.expression.expression));
-    if (name === "exec" && expr.arguments.nodes.length === 1 && recvT?.kind === "regex") {
-      return expr.expression.expression;
-    }
-    if (
-      name === "match" &&
-      expr.arguments.nodes.length === 1 &&
-      (recvT?.kind === "string" ||
-        (recvT !== null && recvT !== undefined && nullableStringType(lowerer, recvT))) &&
-      lowerer.mapTypeOf(lowerer.typeOf(expr.arguments.nodes[0]!))?.kind === "regex"
-    ) {
-      return expr.arguments.nodes[0]!;
-    }
-  }
-  // A matchAll ROW by element access: rows[i] with rows tracing to the
-  // drain call — or the direct s.matchAll(re)[i] spelling.
-  if (ts.isElementAccessExpression(expr)) {
-    return matchAllRegexOf(lowerer, expr.expression);
-  }
-  // A row picked by `rows.find(cb)`, `rows.findLast(cb)` or `rows.at(i)`.
-  if (
-    ts.isCallExpression(expr) &&
-    ts.isPropertyAccessExpression(expr.expression) &&
-    MATCH_ROW_PICK_METHODS.has(expr.expression.name.text) &&
-    lowerer.isStdlibMember(expr.expression)
-  ) {
-    return matchAllRegexOf(lowerer, expr.expression.expression);
-  }
-  if (ts.isIdentifier(expr)) {
-    // The for-of binding over a matchAll drain: `for (const m of
-    // s.matchAll(re))` (or over a stored const rows).
-    const sym = lowerer.resolveValueSymbol(expr);
-    const decl = sym ? lowerer.checker.valueDeclarationOf(sym) : undefined;
-    if (
-      decl !== undefined &&
-      ts.isVariableDeclaration(decl) &&
-      ts.isVariableDeclarationList(decl.parent) &&
-      ts.isForOfStatement(decl.parent.parent)
-    ) {
-      return matchAllRegexOf(lowerer, decl.parent.parent.expression);
-    }
-    // A stored const match result: `const m = re.exec(s)`.
-    const init = constInitializerOf(lowerer, expr);
-    if (init !== null) return matchProducerRegexOf(lowerer, init);
-    // The element parameter of an array callback over matchAll rows:
-    // `[...s.matchAll(re)].map((m) => m.groups)`, and Array.from's
-    // mapping function over `s.matchAll(re)`.
-    if (decl !== undefined && ts.isParameter(decl)) return matchAllCallbackRegexOf(lowerer, decl);
-  }
-  return null;
-}
-
-/** Array methods that return one row of the receiver. */
-const MATCH_ROW_PICK_METHODS = new Set(["find", "findLast", "at"]);
-
 /** Array methods whose result holds rows of the receiver. */
 const MATCH_ROW_SUBSET_METHODS = new Set(["filter", "slice", "toReversed", "toSorted"]);
 
@@ -14589,7 +2324,7 @@ const MATCH_ROW_CALLBACK_METHODS = new Set([
 
 /** The regex behind `param` when it is the first parameter of an inline
  * callback whose rows come from a matchAll drain. */
-function matchAllCallbackRegexOf(
+export function matchAllCallbackRegexOf(
   lowerer: Lowerer,
   param: ts.ParameterDeclaration,
 ): ts.Expression | null {
@@ -14634,7 +2369,7 @@ export function matchCallbackParamGroupsOf(
 }
 
 /** The regex argument of a (possibly const-stored) `s.matchAll(re)`. */
-function matchAllRegexOf(lowerer: Lowerer, e: ts.Expression): ts.Expression | null {
+export function matchAllRegexOf(lowerer: Lowerer, e: ts.Expression): ts.Expression | null {
   let expr = e;
   for (;;) {
     if (ts.isParenthesizedExpression(expr) || ts.isNonNullExpression(expr)) {
@@ -14673,874 +2408,60 @@ function matchAllRegexOf(lowerer: Lowerer, e: ts.Expression): ts.Expression | nu
   return null;
 }
 
-/** `m.groups` on a match result whose producing regex is statically
- * known: the honest slice already HOLDS every named group's value at
- * its capture index, so the groups object is a compile-time record
- * projection — `{ year: m[1], month: m[2] }` — built by one interned
- * helper per (shape, index list, receiver type). Node's exact shape
- * decisions:
- *   - no named groups → `undefined` (the identifier-receiver shapes —
- *     a call receiver would lose its own null trap, so those keep the
- *     member fence);
- *   - a nullable receiver (the JS `s.match(re).groups` idiom) throws
- *     Node's exact TypeError on the unit arms;
- *   - every declared name is a key (nonparticipating groups hold undefined,
- *     exactly the slice elements they project);
- *   - ES2025 duplicate names (distinct alternatives) project the first
- *     participating occurrence, including a participating empty string;
- *   - key order is group declaration order (declaredOrder), Node's own.
- * The record has a null prototype, like Node's groups object. A
- * JavaScript callback parameter holds the row as a dynamic array; the
- * projection reads its elements through dynamic reads. Null when the
- * receiver isn't a match slice or the regex isn't traceable — the
- * caller's member fence (with the groups hint) names the gap. */
-function lowerMatchGroupsRead(lowerer: Lowerer, expr: ts.PropertyAccessExpression): IrExpr | null {
-  if (expr.name.text !== "groups") return null;
-  // `m?.groups` re-dispatches through the optional-chain machinery, which
-  // narrows the receiver to its match arm first.
-  if (expr.questionDotToken !== undefined && !lowerer.chainHandled.has(expr)) return null;
-  const loc = locOf(expr);
-  const strArr = arrayOf(STRING);
-  const recvT = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
-  if (!recvT || !isMatchSliceType(lowerer, recvT) || !lowerer.isStdlibMember(expr)) return null;
-  const groups = matchResultNamedGroupsOf(lowerer, expr.expression);
-  // An untraced regex: TypeScript reaches the member fence; JavaScript
-  // would otherwise read the slice's absent expando as undefined.
-  if (groups === null && isJsSourceFile(expr.getSourceFile())) lowerer.stdlibMemberFence(expr);
-  if (groups === null) return null;
-  if (groups.length === 0) {
-    // Node: a match result of a group-less regex answers undefined —
-    // the unit literal, exactly the `undefined` identifier's lowering.
-    // Identifier receivers only (evaluation-free): a CALL receiver's
-    // exec/match must still run and null-trap, which a folded unit
-    // cannot carry — those keep the fence.
-    let r: ts.Expression = expr.expression;
-    while (ts.isParenthesizedExpression(r) || ts.isNonNullExpression(r)) r = r.expression;
-    if (ts.isIdentifier(r) && typeEquals(recvT, strArr)) {
-      return { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc };
-    }
-    return null;
-  }
-  const recv = lowerer.lowerExpr(expr.expression);
-  // A JavaScript callback parameter holds the row as a dynamic array.
-  const dynRow = recv.type.kind === "dyn" && isJsSourceFile(expr.getSourceFile());
-  if (!dynRow && !isMatchSliceType(lowerer, recv.type)) return null;
-  return lowerGroupsProjection(lowerer, recv, groups, loc);
-}
-
-/** True when the IR type is a string-or-units union — the Dict<string>
- * member spelling (`process.versions.openssl`), match's nullable
- * receiver claim. */
-function nullableStringType(lowerer: Lowerer, t: IrType): boolean {
-  if (t.kind !== "union") return false;
-  const arms = lowerer.unions.get(t.unionId)?.arms ?? [];
-  return (
-    arms.some((a) => a.kind === "string") && arms.every((a) => a.kind === "string" || isUnitType(a))
-  );
-}
-
-/** True when the IR type is the honest match slice — `string[]`, or a
- * union of it with unit arms only (`string[] | null`). The groups
- * projection's receiver gate, shared with the destructure interception. */
-export function isMatchSliceType(lowerer: Lowerer, t: IrType): boolean {
-  if (typeEquals(t, arrayOf(STRING))) return true;
-  return t.kind === "union" && matchSliceUnionArms(lowerer, t.unionId) !== null;
-}
-
-/** The union-arm layout of a nullable match slice (`string[] | null`,
- * matchAll's checker spellings with undefined arms included): the
- * string[] arm's tag plus each unit arm's tag and spelling. Null when
- * the union holds anything else. */
-function matchSliceUnionArms(
+/** A number-keyed read in JavaScript on an array that may be undefined or
+ * null outside an optional chain (`m[1]` on a `RegExpExecArray | null`
+ * that an earlier statement ruled non-null without narrowing it): the
+ * array arm is an ordinary JavaScript element read, so a hole, a present
+ * undefined (a regex group that did not participate) or an invalid index
+ * answers undefined, as lowerSafeIndexRead does for a plain array. The
+ * unit arms keep the keyed read's answer. The receiver and key evaluate
+ * once, in source order. Null when the union is not exactly one array arm
+ * beside unit arms; optional-chain tails and TypeScript keep the keyed
+ * read. */
+export function lowerOptionalArrayIndexRead(
   lowerer: Lowerer,
-  unionId: string,
-): { arrTag: number; units: { tag: number; unit: "null" | "undefined" }[] } | null {
-  const def = lowerer.unions.get(unionId);
-  if (!def) return null;
-  const strArr = arrayOf(STRING);
-  const arrTag = def.arms.findIndex((a) => typeEquals(a, strArr));
-  if (arrTag < 0) return null;
-  const units: { tag: number; unit: "null" | "undefined" }[] = [];
-  for (let i = 0; i < def.arms.length; i++) {
-    if (i === arrTag) continue;
-    const a = def.arms[i]!;
-    if (!isUnitType(a)) return null;
-    units.push({ tag: i, unit: a.kind === "nullT" ? "null" : "undefined" });
-  }
-  return { arrTag, units };
-}
-
-/** Node's TypeError for `.groups` read off null or undefined. */
-function groupsReadTypeError(unit: "null" | "undefined", loc: SrcLoc): IrStmt {
-  return {
-    kind: "throw",
-    value: {
-      kind: "libCall",
-      fn: "error.new",
-      args: [strLit(`Cannot read properties of ${unit} (reading 'groups')`, loc)],
-      type: { kind: "object", className: "%TypeError" },
-      loc,
-    },
-    loc,
-  };
-}
-
-/** The groups-record projection holds string | undefined values, including
- * an own overflow entry for every nonparticipating capture. One lifted helper per
- * (index list, receiver representation) builds it; see
- * lowerMatchGroupsRead for the semantics the body encodes. */
-export function lowerGroupsProjection(
-  lowerer: Lowerer,
-  recv: IrExpr,
-  groups: { name: string; index: number }[],
-  loc: SrcLoc,
-): IrExpr {
-  // Name → its capture indices, in declaration order (duplicates keep
-  // every occurrence — the projection picks the participating one).
-  const order: string[] = [];
-  const indicesByName = new Map<string, number[]>();
-  for (const g of groups) {
-    const got = indicesByName.get(g.name);
-    if (got) {
-      got.push(g.index);
-    } else {
-      indicesByName.set(g.name, [g.index]);
-      order.push(g.name);
-    }
-  }
-  const valueType = arrayValueType(lowerer, STRING);
-  const shapeId = lowerer.shapes.intern([], false, valueType);
-  const recordT: IrType = { kind: "record", shapeId };
-  const recvKey =
-    recv.type.kind === "union" ? recv.type.unionId : recv.type.kind === "dyn" ? "dyn" : "arr";
-  const key = `regexgroups:${shapeId}:${groups.map((g) => `${g.name}=${g.index}`).join(",")}:${recvKey}`;
-  let helper = lowerer.valueHelpers.get(key);
-  if (!helper) {
-    helper = `%regex.groups.${lowerer.valueHelpers.size}`;
-    lowerer.valueHelpers.set(key, helper);
-    const body: IrStmt[] = [];
-    const locals: IrLocal[] = [{ id: "m.0", name: "m", type: recv.type, mutable: true }];
-    let mRef: IrExpr = { kind: "varRef", localId: "m.0", type: recv.type, loc };
-    if (recv.type.kind === "union") {
-      // Node's exact TypeError per unit arm, then the checked narrow.
-      const arms = matchSliceUnionArms(lowerer, recv.type.unionId)!;
-      for (const u of arms.units) {
-        body.push({
-          kind: "if",
-          cond: {
-            kind: "unionIsTag",
-            unionId: recv.type.unionId,
-            tag: u.tag,
-            negated: false,
-            value: mRef,
-            type: BOOL,
-            loc,
-          },
-          then: [groupsReadTypeError(u.unit, loc)],
-          else_: null,
-          loc,
-        });
-      }
-      const narrowed: IrExpr = {
-        kind: "unionNarrow",
-        unionId: recv.type.unionId,
-        tag: arms.arrTag,
-        value: mRef,
-        type: arrayOf(STRING),
-        loc,
-      };
-      locals.push({ id: "arr.0", name: "arr", type: arrayOf(STRING), mutable: false });
-      body.push({ kind: "varDecl", localId: "arr.0", init: narrowed, loc });
-      mRef = { kind: "varRef", localId: "arr.0", type: arrayOf(STRING), loc };
-    } else if (recv.type.kind === "dyn") {
-      // A JavaScript callback parameter holds the row as a dynamic array:
-      // Node's TypeError for null and undefined, then dynamic element reads.
-      for (const unit of ["null", "undefined"] as const) {
-        body.push({
-          kind: "if",
-          cond: { kind: "dynTest", test: unit, value: mRef, type: BOOL, loc },
-          then: [groupsReadTypeError(unit, loc)],
-          else_: null,
-          loc,
-        });
-      }
-    }
-
-    const elem = (index: number): IrExpr =>
-      mRef.type.kind === "dyn"
-        ? lowerer.coerceToExpected(
-            {
-              kind: "dynKeyGet",
-              value: mRef,
-              key: strLit(String(index), loc),
-              type: DYN,
-              loc,
-            },
-            valueType,
-          )
-        : arrayValueRead(lowerer, mRef, numLit(index, loc), STRING, loc);
-    const values = new Map<string, IrExpr>();
-    order.forEach((name, i) => {
-      const idxs = indicesByName.get(name)!;
-      if (idxs.length === 1) {
-        values.set(name, elem(idxs[0]!));
-        return;
-      }
-      // Duplicates: the first participating occurrence. Empty strings
-      // participate; undefined means this alternative did not match.
-      const id = `g${i}.0`;
-      locals.push({ id, name: `g${i}`, type: valueType, mutable: true });
-      body.push({ kind: "varDecl", localId: id, init: elem(idxs[0]!), loc });
-      const gRef: IrExpr = { kind: "varRef", localId: id, type: valueType, loc };
-      for (const idx of idxs.slice(1)) {
-        body.push({
-          kind: "if",
-          cond: {
-            kind: "unionIsTag",
-            unionId: valueType.kind === "union" ? valueType.unionId : "",
-            tag: valueType.kind === "union" ? lowerer.armTag(valueType.unionId, UNDEFINED_T) : -1,
-            negated: false,
-            value: gRef,
-            type: BOOL,
-            loc,
-          },
-          then: [{ kind: "assign", localId: id, value: elem(idx), loc }],
-          else_: null,
-          loc,
-        });
-      }
-      values.set(name, gRef);
-    });
-    body.push({
-      kind: "return",
-      value: {
-        kind: "recordLit",
-        fields: order.map((name) => ({ name, value: values.get(name)!, overflow: true as const })),
-        nullProto: true,
-        type: recordT,
-        loc,
-      },
-      loc,
-    });
-    lowerer.liftedFns.push({
-      name: helper,
-      params: [{ localId: "m.0", name: "m", type: recv.type }],
-      returnType: recordT,
-      locals,
-      body,
-      loc,
-    });
-  }
-  return { kind: "call", callee: helper, args: [recv], type: recordT, loc };
-}
-
-/** Field reads use the shared FieldTarget union. Native method reads select
- * an interned unbound callable; invocation supplies its receiver separately. */
-export function lowerFieldRead(lowerer: Lowerer, expr: ts.PropertyAccessExpression): IrExpr | null {
-  // A checked receiver already owns its property table. An ambient
-  // generic method signature must not divert its value into native
-  // object-literal specialization (Array.prototype.map is one example).
-  if (ts.isIdentifier(expr.expression)) {
-    const stored = lowerer.peekLocal(expr.expression) ?? lowerer.globalOf(expr.expression);
-    if (stored?.type.kind === "dyn") {
-      const value = lowerer.lowerExpr(expr.expression);
-      if (value.type.kind === "dyn")
-        return {
-          kind: "dynKeyGet",
-          value,
-          key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
-          ...(expr.questionDotToken || hasOptionalChainGuard(expr.expression)
-            ? { optional: true as const }
-            : {}),
-          type: DYN,
-          loc: locOf(expr),
-        };
-    }
-  }
-  const target = lowerer.fieldTarget(expr);
-  if (target) return lowerer.fieldGetExpr(target, locOf(expr), expr);
-  if (expr.questionDotToken) return null;
-  let receiverIr = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
-  // The readonly-tuple Array.isArray narrow has no directly mappable
-  // checker type (`Result & any[]`), but maybeNarrow extracted the tuple
-  // record behind it. Route tuple properties such as `.length` from that
-  // lowered value, the element-access bridge's twin.
-  const checkerArray = lowerer.checkerArrayValue(expr.expression);
-  if (checkerArray?.type.kind === "record") receiverIr = checkerArray.type;
-  if (
-    receiverIr?.kind === "object" &&
-    (lowerer.findMethodOn(lowerer.classes.get(receiverIr.className) ?? null, expr.name.text) ||
-      findGenericMethodOn(
-        lowerer,
-        lowerer.classes.get(receiverIr.className) ?? null,
-        expr.name.text,
-      ))
-  ) {
-    const info = lowerer.classes.get(receiverIr.className);
-    if (info) return lowerClassMethodValue(lowerer, expr, info);
-  }
-  // An object-literal GENERIC method as a VALUE (`o.m` — the member is
-  // excluded from the record shape): the pinned-value rule verbatim when
-  // the receiver is the defining literal's own const binding (the value
-  // is the pinned instance's closure — no `this` exists); anything else
-  // fences by name inside the helpers.
-  {
-    const propSym = lowerer.checker.getPropertyOfType(
-      lowerer.typeOf(expr.expression),
-      expr.name.text,
-    );
-    if (
-      receiverIr?.kind !== "object" &&
-      propSym &&
-      isGenericCallableMemberType(lowerer.checker.getTypeOfSymbol(propSym), lowerer.checker) &&
-      // CLASS members keep the class-path fences (a poisoned class's own
-      // diagnostics, the bound-method fence above).
-      !lowerer.checker
-        .declarationsOf(propSym)
-        .some(
-          (d) =>
-            d.parent !== undefined &&
-            (ts.isClassDeclaration(d.parent) || ts.isClassExpression(d.parent)),
-        )
-    ) {
-      const found = objLitGenericFnNodeOf(lowerer, propSym);
-      if (!found) {
-        lowerer.unsupported(
-          "SC1090",
-          expr,
-          `the generic method '${expr.name.text}' as a value with no defining object literal (only methods declared with a body in an object literal compile)`,
-        );
-      }
-      requireObjLitGenericReceiver(lowerer, expr, expr.expression, found.literal, expr.name.text);
-      return lowerer.lowerGenericFnValue(
-        expr,
-        objLitGenericFnInfoOf(lowerer, expr, expr.name.text, found),
-      );
-    }
-  }
-  // Dot access to an UNDECLARED key of an index-signature shape
-  // (`bag.count` on `Record<string, number>`): tsc allows it without
-  // noPropertyAccessFromIndexSignature, but the bracket spelling is the
-  // canonical index-signature form here — point at it.
-  if (receiverIr?.kind === "record") {
-    const shape = lowerer.shapes.get(receiverIr.shapeId);
-    if (shape?.indexValue && !shape.fields.some((f) => f.name === expr.name.text)) {
-      const actual = tryLowerExpression(lowerer, expr.expression);
-      if (actual?.type.kind === "dyn")
-        return {
-          kind: "dynKeyGet",
-          value: actual,
-          key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
-          type: DYN,
-          loc: locOf(expr),
-        };
-      if (actual?.type.kind === "record") {
-        const field = lowerer.shapes
-          .get(actual.type.shapeId)
-          ?.fields.find((field) => field.name === expr.name.text);
-        if (field)
-          return {
-            kind: "recordGet",
-            obj: actual,
-            shapeId: actual.type.shapeId,
-            field: field.name,
-            type: field.type,
-            loc: locOf(expr),
-          };
-      }
-      lowerer.unsupported(
-        "SC1090",
-        expr,
-        `dot access to index-signature keys (spell it r["${expr.name.text}"] — brackets are the index-signature form)`,
-      );
-    }
-  }
-  // `t.length` on a tuple: the arity CONSTANT (tuples are fixed-shape —
-  // the checker types it as the literal arity too). Folding discards the
-  // receiver's evaluation, so only side-effect-free receivers fold;
-  // anything else (a call result) binds to a const first.
-  if (receiverIr?.kind === "record" && expr.name.text === "length") {
-    const shape = lowerer.shapes.get(receiverIr.shapeId);
-    if (shape?.tuple) {
-      let root: ts.Expression = expr.expression;
-      while (ts.isPropertyAccessExpression(root)) root = root.expression;
-      if (!ts.isIdentifier(root) && root.kind !== ts.SyntaxKind.ThisKeyword) {
-        lowerer.unsupported(
-          "SC1090",
-          expr,
-          "'.length' of a computed tuple expression (the arity is a constant — bind the tuple to a const first)",
-        );
-      }
-      return { kind: "numLit", value: shape.fields.length, type: F64, loc: locOf(expr) };
-    }
-  }
-  return null;
-}
-
-/** Shared-field read `r.f` on a UNION receiver: supported exactly when
- * every arm is a record/class possessing the field with ONE shared IR
- * type — the discriminant pattern (`r.kind`, primitive) and the
- * shared-payload pattern (`spec.config` where every ServiceSpec arm
- * carries the same record). Lowers to `unionDisc` (the backend switches
- * on the runtime tag and reads the field from the concrete arm), which
- * composes with existing strEq/bin/switch nodes, so `r.kind === "ok"`
- * and `switch (r.kind)` work without dedicated test nodes. Anything else
- * on a union receiver is rejected specifically (narrow first). */
-export function lowerUnionProperty(
-  lowerer: Lowerer,
-  expr: ts.PropertyAccessExpression,
-): IrExpr | null {
-  if (lowerer.chainBlocked(expr)) return null;
-  const receiverIr = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
-  if (receiverIr?.kind !== "union") return null;
-  // Lower the receiver first: its runtime value can still carry the full
-  // binding union even when the checker has removed several variants.
-  let value = lowerer.lowerExpr(expr.expression);
-  // A guard can remove several variants without selecting one record.
-  // Materialize that sub-union before looking for common fields; arms
-  // ruled out by the guard must not veto a field shared by the survivors.
-  if (value.type.kind === "union" && !typeEquals(value.type, receiverIr)) {
-    const helper = lowerer.narrowedRetagHelper(
-      expr.expression,
-      value.type.unionId,
-      receiverIr.unionId,
-      locOf(expr),
-    );
-    if (helper)
-      value = { kind: "call", callee: helper, args: [value], type: receiverIr, loc: locOf(expr) };
-    // Optional storage of a base class (a runtime-optional binding holding
-    // `Base | undefined`) that `instanceof` narrowed to several subclasses:
-    // extract the instance and test its class, as typed slots do.
-    else value = narrowStoredClassValue(lowerer, value, receiverIr) ?? value;
-  }
-  // A checker-union receiver whose VALUE lowered to a plain RECORD (the
-  // merged-signature fiction — `runner(cmd, args)` where runner joined
-  // a structural runner type with spawnSync's, and the local adopted
-  // the record arm): read the record field directly, the dyn-receiver
-  // fallback's discipline.
-  // A checker-union receiver whose VALUE lowered checked-dynamic (a
-  // never-tainted JS chain — `cmd[1].length` on `const cmd = ['pwd',
-  // []]`, where the element read stayed a dyn node): read through the
-  // dyn keyed read like the unmappable-receiver path below the chain.
-  if (value.type.kind === "dyn") {
-    const key: IrExpr = {
-      kind: "strLit",
-      value: expr.name.text,
-      type: STRING,
-      loc: locOf(expr.name),
-    };
-    return { kind: "dynKeyGet", key, value, type: DYN, loc: locOf(expr) };
-  }
-  if (value.type.kind === "record") {
-    const shape = lowerer.shapes.get(value.type.shapeId);
-    const f = shape?.fields.find((x) => x.name === expr.name.text);
-    if (f) {
-      return {
-        kind: "recordGet",
-        obj: value,
-        shapeId: value.type.shapeId,
-        field: f.name,
-        type: f.type,
-        loc: locOf(expr),
-      };
-    }
-    return null;
-  }
-  // A class instance the checker sees through a wider union (`(concrete
-  // as A | B).value`): the value is that class's instance, so read its
-  // field directly.
-  if (value.type.kind === "object") {
-    const className = value.type.className;
-    const info = lowerer.classes.get(className) ?? null;
-    const field = expr.name.text;
-    const fieldType = info?.fields.get(field);
-    if (fieldType !== undefined)
-      return lowerer.fieldGetExpr(
-        { container: "class", obj: value, className, field, fieldType },
-        locOf(expr),
-        expr,
-      );
-    const getter = lowerer.findMethodOn(info, `get:${field}`);
-    if (getter)
-      return lowerer.fieldGetExpr(
-        { container: "accessor", obj: value, className, field, fieldType: getter.sig.ret },
-        locOf(expr),
-        expr,
-      );
-  }
-  if (value.type.kind !== "union") {
-    lowerer.unsupported(
-      "SC1090",
-      expr,
-      "shared property access without a represented union receiver",
-    );
-  }
-  const def = lowerer.unions.get(value.type.unionId);
-  if (!def) throw new InternalCompilerError(`lowerer bug: unknown union ${value.type.unionId}`);
-  const field = expr.name.text;
-  if (field === "length") {
-    const presentArms = def.arms.filter((arm) => !isUnitType(arm));
-    const present = presentArms.length === 1 ? presentArms[0]! : null;
-    if (present?.kind === "string" || present?.kind === "array") {
-      const receiver = lowerer.runtimeOptionalPropertyReceiver(
-        expr.expression,
-        value,
-        present,
-        field,
-      );
-      if (receiver !== null) {
-        return present.kind === "string"
-          ? {
-              kind: "strIntrinsic",
-              method: "length",
-              receiver,
-              args: [],
-              type: F64,
-              loc: locOf(expr),
-            }
-          : {
-              kind: "arrIntrinsic",
-              method: "length",
-              receiver,
-              args: [],
-              type: F64,
-              loc: locOf(expr),
-            };
-      }
-    }
-  }
-  const nonUnitArms = def.arms.filter((arm) => !isUnitType(arm));
-  if (nonUnitArms.length === 1 && nonUnitArms[0]?.kind === "object") {
-    const objectType = nonUnitArms[0];
-    const fieldType = lowerer.classes.get(objectType.className)?.fields.get(field);
-    if (fieldType !== undefined) {
-      let receiver = lowerer.runtimeOptionalPropertyReceiver(
-        expr.expression,
-        value,
-        objectType,
-        field,
-      );
-      if (receiver === null) {
-        const helper = lowerer.narrowedArmHelper(
-          value.type.unionId,
-          objectType,
-          locOf(expr.expression),
-        );
-        if (helper !== null)
-          receiver = lowerer.checkedNarrowCall(helper, value, objectType, locOf(expr.expression));
-      }
-      if (receiver !== null) {
-        return {
-          kind: "fieldGet",
-          obj: receiver,
-          className: objectType.className,
-          field,
-          type: fieldType,
-          loc: locOf(expr),
-        };
-      }
-    }
-  }
-  let common: IrType | null = null;
-  for (const arm of def.arms) {
-    let ft: IrType | undefined;
-    if (arm.kind === "record") {
-      ft = lowerer.shapes.get(arm.shapeId)?.fields.find((f) => f.name === field)?.type;
-    } else if (arm.kind === "object") {
-      ft = lowerer.classes.get(arm.className)?.fields.get(field);
-    }
-    if (!ft || ft.kind === "void" || isUnitType(ft) || (common && !typeEquals(common, ft))) {
-      common = null;
-      break;
-    }
-    common = ft;
-  }
-  if (common) {
-    return {
-      kind: "unionDisc",
-      unionId: value.type.unionId,
-      field,
-      value,
-      type: common,
-      loc: locOf(expr),
-    };
-  }
-  // The arms answer DIFFERENT types (or through index signatures / unit
-  // arms): the JOIN path — `env.PORTLESS_PORT` on `ProcessEnv |
-  // Record<string, string>`, the tail read of `loaded?.config.script`.
-  const key: IrExpr = { kind: "strLit", value: field, type: STRING, loc: locOf(expr.name) };
-  const keyed = lowerUnionKeyedRead(lowerer, expr, value.type.unionId, value, key, field);
-  if (keyed) return keyed;
-  // Class arms declaring the field with compatible but different types
-  // (`T | undefined` beside `T`): per-arm slot reads widened to one type.
-  const widened = lowerUnionFieldRead(lowerer, expr, value);
-  if (widened) return widened;
-  // JavaScript overloads commonly inspect a class brand on a scalar-or-
-  // instance argument (e.g. Matrix4.makeTranslation). Preserve primitive
-  // missing-property semantics and dispatch class data through its native
-  // capsule instead of demanding a field shared by every union arm.
-  if (isJsSourceFile(expr.getSourceFile()) && lowerer.dynConvertible(value.type)) {
-    return {
-      kind: "dynKeyGet",
-      value: lowerer.coerceToExpected(value, DYN),
-      key,
-      ...(hasOptionalChainGuard(expr.expression) ? { optional: true as const } : {}),
-      type: DYN,
-      loc: locOf(expr),
-    };
-  }
-  lowerer.unsupported(
-    "SC1090",
-    expr,
-    `reading '${field}' on a union-typed value (every arm must be an object/record ` +
-      `with a same-typed field '${field}'; ` +
-      `${NARROW_FIRST})`,
-  );
-}
-
-/** The unionDisc generalization: a keyed read on a union receiver whose
- * arms answer DIFFERENT (but joinable) types. Each arm contributes its
- * declared answer — an array element's type (number keys), a declared field's type (literal keys), an
- * index-signature arm's value type (plus its declared fields' types for
- * runtime keys, which reach them through the keyed-read helper), and
- * UNDEFINED for unit arms (reachable only through optional-chain tails,
- * where JS short-circuits to undefined; a unit arm the checker narrowed
- * away is simply unreachable). The result type is the JOIN of those
- * answers; every arm's answer must be the join itself, one of its
- * arms, or a sub-union whose payload representations are unchanged.
- * Array reads retain the ordinary invalid-index trap policy.
- * Returns null when any arm cannot answer — the caller owns the fence
- * message. The caller (the property/element dispatch) maybeNarrows. */
-function lowerUnionKeyedRead(
-  lowerer: Lowerer,
-  expr: ts.Expression,
-  unionId: string,
+  expr: ts.ElementAccessExpression,
   value: IrExpr,
   key: IrExpr,
-  literalField: string | null,
 ): IrExpr | null {
-  const def = lowerer.unions.get(unionId);
-  if (!def) return null;
-  // Pass 1: per-arm declared answers, joined into the result type.
-  const joinArms: IrType[] = [];
-  const seen = new Set<string>();
-  const push = (t: IrType): void => {
-    const k = typeKey(t);
-    if (!seen.has(k)) {
-      seen.add(k);
-      joinArms.push(t);
-    }
-  };
-  const pushAnswer = (t: IrType): boolean => {
-    if (t.kind === "void") return false;
-    if (t.kind === "union") {
-      const inner = lowerer.unions.get(t.unionId);
-      if (!inner) return false;
-      for (const a of inner.arms) push(a);
-      return true;
-    }
-    push(t);
-    return true;
-  };
-  for (const arm of def.arms) {
-    if (isUnitType(arm)) {
-      push(UNDEFINED_T);
-      continue;
-    }
-    if (key.type.kind === "f64") {
-      if (arm.kind !== "array" || !pushAnswer(arm.elem)) return null;
-      continue;
-    }
-    if (arm.kind !== "record") return null;
-    const shape = lowerer.shapes.get(arm.shapeId);
-    if (!shape || shape.tuple) return null;
-    const declared =
-      literalField !== null ? shape.fields.find((f) => f.name === literalField)?.type : undefined;
-    if (declared) {
-      if (!pushAnswer(declared)) return null;
-      continue;
-    }
-    // Runtime keys can reach the declared fields through the keyed-read
-    // helper's string switch — every one joins.
-    if (literalField === null) {
-      for (const f of shape.fields) if (!pushAnswer(f.type)) return null;
-    }
-    if (!shape.indexValue) {
-      if (literalField === null && shape.fields.length > 0) continue;
-      return null;
-    }
-    if (!pushAnswer(shape.indexValue)) return null;
-  }
-  if (joinArms.length === 0) return null;
-  // The join must satisfy native union invariants. The caller owns the
-  // diagnostic when a container or opaque arm prevents that join.
   if (
-    joinArms.length > 1 &&
-    (!unionContainerArmsOk(joinArms) ||
-      joinArms.some((a) => a.kind === "dyn" || a.kind === "generator" || a.kind === "caught"))
-  ) {
+    !isJsSourceFile(expr.getSourceFile()) ||
+    expr.questionDotToken ||
+    hasOptionalChainGuard(expr.expression)
+  )
     return null;
-  }
-  joinArms.sort((a, b) => (typeKey(a) < typeKey(b) ? -1 : 1));
-  const type: IrType =
-    joinArms.length === 1
-      ? joinArms[0]!
-      : { kind: "union", unionId: lowerer.unions.intern(joinArms) };
-  // Pass 2: every arm's answer must SURFACE as the join, and index arms
-  // must pass the single-record keyed-read constraints (the helper is
-  // shared with recordKeyGet, its missing-key policy included).
-  const surfaces = (t: IrType): boolean =>
-    typeEquals(t, type) ||
-    (type.kind === "union" && lowerer.armTag(type.unionId, t) >= 0) ||
-    exactUnionWidening(lowerer, t, type);
-  for (const arm of def.arms) {
-    if (isUnitType(arm)) {
-      if (!(type.kind === "union" && lowerer.armTag(type.unionId, UNDEFINED_T) >= 0)) return null;
-      continue;
-    }
-    if (key.type.kind === "f64") {
-      if (arm.kind !== "array" || !surfaces(arm.elem)) return null;
-      continue;
-    }
-    if (arm.kind !== "record") return null;
-    const shape = lowerer.shapes.get(arm.shapeId);
-    if (!shape) return null;
-    const declared =
-      literalField !== null ? shape.fields.find((f) => f.name === literalField)?.type : undefined;
-    if (declared) {
-      if (!surfaces(declared)) return null;
-      continue;
-    }
-    const ovfShape: IrRecordShape =
-      literalField !== null && shape.indexValue ? { ...shape, fields: [] } : shape;
-    if (!recordKeyResultOk(lowerer, ovfShape, type)) return null;
-  }
-  return { kind: "unionKeyGet", unionId, key, value, type, loc: locOf(expr) };
-}
-
-/** A structural TypeScript view does not change a nominal object's layout
- * or accessor dispatch. Resolve the property from the represented class;
- * the optional checker view must not turn its getter into a record read. */
-function classFieldTarget(
-  lowerer: Lowerer,
-  receiverNode: ts.Expression,
-  receiverType: IrType & { kind: "object" },
-  fieldName: string,
-  saved?: IrExpr,
-): FieldTarget | null {
-  const represented = saved ?? lowerer.lowerExpr(receiverNode);
-  if (
-    represented.type.kind === "dyn" &&
-    isJsSourceFile(receiverNode.getSourceFile()) &&
-    !fieldName.startsWith("#")
-  ) {
-    return { container: "dynamic", obj: represented, field: fieldName, fieldType: DYN };
-  }
-  const info = lowerer.classes.get(receiverType.className);
-  if (!info) {
-    // A receiver typed as a class whose collection deferred: the
-    // deferred diagnostics are what explains the miss.
-    lowerer.flushDeferredClass(receiverType.className);
-    return null;
-  }
-  const fieldType = info.fields.get(fieldName);
-  const lowerObjectReceiver = (): IrExpr => {
-    let obj = represented;
-    if (obj.type.kind === "union") {
-      // A receiver that may hold a missing value (a field assigned an
-      // unchecked read): Node's member-read TypeError for the unit arm.
-      const present = lowerer.runtimeOptionalPropertyReceiver(
-        receiverNode,
-        obj,
-        receiverType,
-        fieldName,
-      );
-      if (present) return present;
-      const helper = lowerer.narrowedArmHelper(obj.type.unionId, receiverType, locOf(receiverNode));
-      obj = helper
-        ? lowerer.checkedNarrowCall(helper, obj, receiverType, locOf(receiverNode))
-        : lowerer.maybeNarrow(obj, receiverNode);
-    }
-    return lowerer.coerceInto(receiverNode, obj, receiverType);
+  if (value.type.kind !== "union") return null;
+  const unionId = value.type.unionId;
+  const arms = lowerer.unions.get(unionId)?.arms;
+  if (!arms) return null;
+  const present = arms.filter((arm) => !isUnitType(arm));
+  const arm = present[0];
+  if (present.length !== 1 || arm?.kind !== "array" || arm.elem.kind === "void") return null;
+  const tag = arms.indexOf(arm);
+  const loc = locOf(expr);
+  const stmts: IrStmt[] = [];
+  const stable = (e: IrExpr, name: string): IrExpr => {
+    if (e.kind === "varRef" || e.kind === "numLit") return e;
+    const local = lowerer.declareHiddenLocal(name, e.type);
+    stmts.push({ kind: "varDecl", localId: local.id, init: e, loc });
+    return varRef(local.id, e.type, loc);
   };
-  if (fieldName === "cause" && receiverType.className !== "%DOMException") {
-    let root = info;
-    while (root.base) root = root.base;
-    if (root.def.name === "%Error") {
-      return {
-        container: "errorCause",
-        obj: lowerObjectReceiver(),
-        field: "cause",
-        fieldType: DYN,
-      };
-    }
-  }
-  if (fieldType) {
-    const obj = lowerObjectReceiver();
-    if (
-      isJsSourceFile(receiverNode.getSourceFile()) &&
-      !fieldName.startsWith("#") &&
-      [...lowerer.classes.values()].some(
-        (candidate) =>
-          lowerer.isSubclassOf(candidate.def.name, receiverType.className) &&
-          (candidate.methods.has(`get:${fieldName}`) || candidate.methods.has(`set:${fieldName}`)),
-      )
-    ) {
-      return {
-        container: "dynamic",
-        obj: lowerer.coerceToExpected(obj, DYN),
-        field: fieldName,
-        fieldType: DYN,
-      };
-    }
-    return {
-      container: "class",
-      obj,
-      className: receiverType.className,
-      field: fieldName,
-      fieldType,
-    };
-  }
-  // Accessor property: either half declared anywhere on the chain
-  // makes the name an accessor target (fields and accessors share a
-  // namespace — tsc rejects mixing them, so the halves agree on kind).
-  const getF = lowerer.findMethodOn(info, `get:${fieldName}`);
-  const setF = lowerer.findMethodOn(info, `set:${fieldName}`);
-  if (getF || setF) {
-    const obj = lowerObjectReceiver();
-    return {
-      container: "accessor",
-      obj,
-      className: receiverType.className,
-      field: fieldName,
-      fieldType: getF ? getF.sig.ret : setF!.sig.params[0]!.type,
-    };
-  }
-  if (info.decl && isJsSourceFile(info.decl.getSourceFile())) {
-    const property = lowerer.checker.getPropertyOfType(
-      lowerer.checker.getTypeAtLocation(receiverNode),
-      fieldName,
-    );
-    if (
-      property &&
-      lowerer.checker
-        .declarationsOf(property)
-        .some(
-          (declaration) =>
-            ts.isPropertyAccessExpression(declaration) ||
-            ts.isBinaryExpression(declaration) ||
-            ts.isElementAccessExpression(declaration),
-        )
-    ) {
-      return {
-        container: "dynamic",
-        obj: lowerer.coerceToExpected(lowerObjectReceiver(), DYN),
-        field: fieldName,
-        fieldType: DYN,
-      };
-    }
-  }
-  return null;
+  if (lowerUnionKeyedRead(lowerer, expr, unionId, value, key, null) === null) return null;
+  const recv = stable(value, "%indexReceiver");
+  const index = stable(key, "%indexKey");
+  const keyed = lowerUnionKeyedRead(lowerer, expr, unionId, recv, index, null)!;
+  const narrowed: IrExpr = { kind: "unionNarrow", unionId, tag, value: recv, type: arm, loc };
+  const read = lowerSafeIndexRead(lowerer, narrowed, index, loc);
+  if (read === null) return null;
+  const result: IrExpr = {
+    kind: "ternary",
+    cond: { kind: "unionIsTag", unionId, tag, value: recv, negated: false, type: BOOL, loc },
+    then: lowerer.coerceToExpected(read, keyed.type),
+    else_: keyed,
+    type: keyed.type,
+    loc,
+  };
+  return stmts.length === 0 ? result : { kind: "seqExpr", stmts, result, type: keyed.type, loc };
 }
 
 /** A structural assertion can leave the value in its original class
@@ -15548,7 +2469,7 @@ function classFieldTarget(
  * a single nominal payload has an unambiguous property layout. Validate
  * that payload before dispatching a field or accessor; an absent receiver
  * must never reach the backend as an object pointer. */
-function hasClassPayload(lowerer: Lowerer, type: IrType): boolean {
+export function hasClassPayload(lowerer: Lowerer, type: IrType): boolean {
   return (
     type.kind === "object" ||
     (type.kind === "union" &&
@@ -15556,7 +2477,7 @@ function hasClassPayload(lowerer: Lowerer, type: IrType): boolean {
   );
 }
 
-function representedClassFieldTarget(
+export function representedClassFieldTarget(
   lowerer: Lowerer,
   receiverNode: ts.Expression,
   fieldName: string,
@@ -15572,215 +2493,6 @@ function representedClassFieldTarget(
     : null;
 }
 
-/** Recognizes `obj.field` as an assignable field target: receiver is a
- * known class instance OR a record, and the member is a field or (class
- * receivers) a declared accessor property. Returns the pieces of a
- * fieldSet/recordSet/accessor-call (minus value/kind) or null. */
-export function fieldTarget(
-  lowerer: Lowerer,
-  access: ts.PropertyAccessExpression,
-): FieldTarget | null {
-  if (lowerer.cjsLocalModuleBindingOf(access.expression)) return null;
-  // `module.exports` / `module.id`: CommonJS module surface, never a field.
-  if (isCjsModuleGlobal(lowerer, access.expression)) return null;
-  if (isCjsExportsIdentifier(lowerer, access.expression)) return null;
-  if (lowerer.chainBlocked(access)) return null;
-  if (
-    access.name.text === "stackTraceLimit" &&
-    lowerer.isStdlibGlobal(access.expression, "Error")
-  ) {
-    return {
-      container: "errorStackLimit",
-      obj: { kind: "numLit", value: 0, type: F64, loc: locOf(access) },
-      field: "stackTraceLimit",
-      fieldType: F64,
-    };
-  }
-  const stored = ts.isIdentifier(access.expression)
-    ? (lowerer.peekLocal(access.expression)?.type ?? lowerer.globalOf(access.expression)?.type)
-    : undefined;
-  const narrowed = lowerer.mapTypeOf(lowerer.typeOf(access.expression));
-  // Structural record views retain their storage layout, while a nominal
-  // subclass guard proves a more specific layout of the same object.
-  const receiverIr =
-    stored?.kind === "record"
-      ? stored
-      : stored?.kind === "object" &&
-          !(
-            narrowed?.kind === "object" &&
-            lowerer.isSubclassOf(narrowed.className, stored.className)
-          )
-        ? stored
-        : narrowed;
-  if (receiverIr?.kind === "object") {
-    const target = classFieldTarget(lowerer, access.expression, receiverIr, access.name.text);
-    if (target) return target;
-    // Abstract properties declare no base storage. Resolve the concrete
-    // instance's live field or accessor through the existing class bridge;
-    // inventing a shared field offset would misread subclass layouts.
-    if (abstractPropertyDeclOf(lowerer, access)) {
-      return {
-        container: "dynamic",
-        obj: lowerer.coerceInto(access.expression, lowerer.lowerExpr(access.expression), DYN),
-        field: access.name.text,
-        fieldType: lowerer.irTypeOf(access),
-      };
-    }
-    return null;
-  }
-  if (receiverIr?.kind === "union" && hasClassPayload(lowerer, receiverIr)) {
-    return representedClassFieldTarget(
-      lowerer,
-      access.expression,
-      access.name.text,
-      lowerer.lowerExpr(access.expression),
-    );
-  }
-  if (receiverIr?.kind === "record") {
-    const shape = lowerer.shapes.get(receiverIr.shapeId);
-    const fieldType = shape?.fields.find((f) => f.name === access.name.text)?.type;
-    if (fieldType) {
-      let obj = lowerer.lowerExpr(access.expression);
-      const nominal = representedClassFieldTarget(
-        lowerer,
-        access.expression,
-        access.name.text,
-        obj,
-      );
-      if (nominal) return nominal;
-      // A checker-record receiver whose VALUE stayed dyn (the erased
-      // all-unknown-fields cast — `(err as { code?: unknown }).code`):
-      // decline, and the dyn keyed-read fallback answers.
-      if (obj.type.kind === "union" && lowerer.armTag(obj.type.unionId, UNDEFINED_T) >= 0) {
-        // A nested property read such as `rows[i].value` or
-        // `table[k].value`: the outer read can miss. Validate the record
-        // arm before fieldGet/recordGet so a missing outer value raises
-        // Node's TypeError rather than reaching the backend with a union
-        // receiver.
-        const present = lowerer.stripUndefinedArm(obj.type);
-        const parent = access.parent;
-        const written =
-          parent !== undefined &&
-          ts.isBinaryExpression(parent) &&
-          parent.left === access &&
-          parent.operatorToken.kind === ts.SyntaxKind.EqualsToken;
-        const helper =
-          present.kind === "record"
-            ? lowerer.narrowedArmHelper(obj.type.unionId, present, locOf(access.expression))
-            : null;
-        obj =
-          (present.kind === "record"
-            ? lowerer.runtimeOptionalPropertyReceiver(
-                access.expression,
-                obj,
-                present,
-                access.name.text,
-                written ? "set" : "read",
-              )
-            : null) ??
-          (helper
-            ? lowerer.checkedNarrowCall(helper, obj, present, locOf(access.expression))
-            : lowerer.maybeNarrow(obj, access.expression));
-      }
-      if (obj.type.kind !== "record") return null;
-      const actualShape = lowerer.shapes.get(obj.type.shapeId);
-      const actualField = actualShape?.fields.find((f) => f.name === access.name.text);
-      return {
-        container: "record",
-        obj,
-        shapeId: obj.type.shapeId,
-        field: access.name.text,
-        fieldType: actualField?.type ?? fieldType,
-      };
-    }
-    // A RECORD accessor property: either slot present makes the name an
-    // accessor target (get/set share the property namespace — tsc
-    // rejects mixing an accessor with a data property, so the halves
-    // agree). Reads dispatch the %get: closure, writes the %set: one.
-    {
-      const getSlot = shape?.fields.find((f) => f.name === `%get:${access.name.text}`)?.type;
-      const setSlot = shape?.fields.find((f) => f.name === `%set:${access.name.text}`)?.type;
-      if (getSlot?.kind === "func" || setSlot?.kind === "func") {
-        const obj = lowerer.lowerExpr(access.expression);
-        if (obj.type.kind !== "record") return null; // dyn-valued receiver: the keyed fallback answers
-        const getType = getSlot?.kind === "func" ? getSlot : undefined;
-        const setType = setSlot?.kind === "func" ? setSlot : undefined;
-        return {
-          container: "recordAccessor",
-          obj,
-          shapeId: receiverIr.shapeId,
-          field: access.name.text,
-          fieldType: getType ? getType.ret : setType!.params[0]!,
-          ...(getType ? { getType } : {}),
-          ...(setType ? { setType } : {}),
-        };
-      }
-    }
-    // Dot access to an UNDECLARED key of an index-signature shape: tsc
-    // types it through the signature — the access resolves to NO property
-    // symbol (mapped types like Record<string, T>) or to the signature's
-    // own `__index` symbol (interface-declared signatures). A real member
-    // symbol means a lib member like `toString` — not an index access;
-    // those keep their fences below. It IS the bracket access in dot
-    // spelling — the same overflow path.
-    const nameSym = lowerer.checker.getSymbolAtLocation(access.name);
-    if (shape?.indexValue && !shape.tuple) {
-      // A member the shape CANONICALIZATION dropped into the overflow
-      // (the header family: @types declares `host?: string` on
-      // IncomingHttpHeaders while the canonical shape is a pure index
-      // record) is the bracket access in dot spelling too: a PROPERTY
-      // declaration whose own type fits within the index value. METHOD
-      // members (`toString` — the lib's inherited surface) keep their
-      // fences: JS finds the prototype function, never an overflow miss.
-      const canonicalized = (): boolean => {
-        if (!nameSym) return false;
-        const nameDecls = lowerer.checker.declarationsOf(nameSym);
-        if (!nameDecls.length) return false;
-        if (!nameDecls.every((d) => ts.isPropertySignature(d))) return false;
-        const declared = lowerer.mapTypeOf(lowerer.typeOf(access));
-        if (!declared) return false;
-        const iv = shape.indexValue!;
-        if (typeEquals(declared, iv)) return true;
-        if (iv.kind !== "union") return false;
-        const ivArms = lowerer.unions.get(iv.unionId)?.arms;
-        if (!ivArms) return false;
-        const declaredArms =
-          declared.kind === "union"
-            ? (lowerer.unions.get(declared.unionId)?.arms ?? [declared])
-            : [declared];
-        return declaredArms.every((a) => ivArms.some((b) => typeEquals(a, b)));
-      };
-      if (!nameSym || nameSym.name === ts.InternalSymbolName.Index || canonicalized()) {
-        let obj = lowerer.lowerExpr(access.expression);
-        if (obj.type.kind === "union" && lowerer.armTag(obj.type.unionId, UNDEFINED_T) >= 0) {
-          const present = lowerer.stripUndefinedArm(obj.type);
-          obj =
-            present.kind === "record"
-              ? (lowerer.runtimeOptionalPropertyReceiver(
-                  access.expression,
-                  obj,
-                  present,
-                  access.name.text,
-                ) ?? obj)
-              : lowerer.maybeNarrow(obj, access.expression);
-        }
-        if (obj.type.kind !== "record") return null;
-        const actualShape = lowerer.shapes.get(obj.type.shapeId);
-        if (!actualShape?.indexValue) return null;
-        return {
-          container: "recordOvf",
-          obj,
-          shapeId: obj.type.shapeId,
-          field: access.name.text,
-          fieldType: actualShape.indexValue,
-        };
-      }
-    }
-    return null;
-  }
-  return null;
-}
-
 /** A STATICALLY-RESOLVABLE unique-symbol key: an identifier whose value
  * resolves (imports included) to a module-level `const k = Symbol(...)`
  * with no description or a literal one. tsc types such a const `unique
@@ -15807,7 +2519,7 @@ export function uniqueSymbolKeyOf(
   // which a runtime-identity symbol value can never satisfy.
   if (!(t.flags & (ts.TypeFlags.UniqueESSymbol | ts.TypeFlags.ESSymbol))) return null;
   const sym = lowerer.resolveValueSymbol(key);
-  const decl = sym ? lowerer.checker.valueDeclarationOf(sym) : undefined;
+  const decl = sym ? sym.valueDeclaration : undefined;
   if (!sym || !decl || !ts.isVariableDeclaration(decl)) return null;
   if (!(ts.getCombinedNodeFlags(decl) & ts.NodeFlags.Const)) return null;
   // Module level only: a unique-symbol const inside a FUNCTION is a
@@ -15860,7 +2572,10 @@ export function symbolFieldInfo(
 
 /** `obj[k]` as an assignable field target — the symbol-keyed twin of
  * fieldTarget's class branch (the receiver lowers here, exactly once). */
-function symbolFieldTarget(lowerer: Lowerer, expr: ts.ElementAccessExpression): FieldTarget | null {
+export function symbolFieldTarget(
+  lowerer: Lowerer,
+  expr: ts.ElementAccessExpression,
+): FieldTarget | null {
   const info = symbolFieldInfo(lowerer, expr);
   if (!info) return null;
   const obj = lowerer.lowerExpr(expr.expression);
@@ -15873,472 +2588,6 @@ function symbolFieldTarget(lowerer: Lowerer, expr: ts.ElementAccessExpression):
   };
 }
 
-/** The read expression for a field target (fieldGet / recordGet /
- * getter call). `blame` locates the rejection of a setter-only read —
- * tsc-clean (the property types as the setter's param), but Node yields
- * undefined, which these property types cannot represent. */
-export function fieldGetExpr(
-  lowerer: Lowerer,
-  target: FieldTarget,
-  loc: SrcLoc,
-  blame: ts.Node,
-): IrExpr {
-  // A member read through an unassigned deferred-init field throws Node's
-  // member-read TypeError instead of the generic checked extraction.
-  if (
-    target.container === "class" &&
-    ts.isPropertyAccessExpression(blame) &&
-    target.obj.type.kind === "object" &&
-    lowerer.deferredFieldSlot(target.obj) !== null
-  ) {
-    const checked = lowerer.runtimeOptionalPropertyReceiver(
-      blame.expression,
-      target.obj,
-      target.obj.type,
-      target.field,
-    );
-    if (checked) target = { ...target, obj: checked };
-  }
-  if (target.container === "dynamic")
-    return lowerer.coerceInto(
-      blame,
-      {
-        kind: "dynKeyGet",
-        value: target.obj,
-        key: { kind: "strLit", value: target.field, type: STRING, loc },
-        type: DYN,
-        loc,
-      },
-      target.fieldType,
-    );
-  if (
-    target.container === "class" &&
-    (target.field === "message" || target.field === "name") &&
-    (target.className === "%Error" || lowerer.isSubclassOf(target.className, "%Error"))
-  )
-    return errorPropertyRead(lowerer, target.obj, target.field);
-  if (target.container === "errorStackLimit") {
-    return { kind: "libCall", fn: "error.stackLimitGet", args: [], type: F64, loc };
-  }
-  if (target.container === "errorCause") {
-    return { kind: "libCall", fn: "error.cause", args: [target.obj], type: DYN, loc };
-  }
-  // A record-shaped CHECKER target whose receiver VALUE lives in the checked-dynamic tree
-  // (a JS file-scope object-literal global): the checked-dynamic keyed
-  // read — dynKeyGet (a missing key answers the dyn undefined, exactly
-  // JS); consumers validate (dynCheck) where a static type is required.
-  if (
-    (target.container === "record" || target.container === "recordOvf") &&
-    target.obj.type.kind === "dyn"
-  ) {
-    return {
-      kind: "dynKeyGet",
-      key: { kind: "strLit", value: target.field, type: STRING, loc },
-      value: target.obj,
-      type: DYN,
-      loc,
-    };
-  }
-  if (target.container === "accessor") {
-    const getF = lowerer.findMethodOn(
-      lowerer.classes.get(target.className) ?? null,
-      `get:${target.field}`,
-    );
-    if (!getF) {
-      lowerer.unsupported(
-        "SC1090",
-        blame,
-        `reading a property that has only a setter ('${target.field}' — Node would yield undefined)`,
-      );
-    }
-    if (
-      !target.field.startsWith("#") &&
-      isJsSourceFile(blame.getSourceFile()) &&
-      lowerer.dynConvertible(getF.sig.ret)
-    ) {
-      const value: IrExpr = {
-        kind: "dynKeyGet",
-        value: lowerer.coerceToExpected(target.obj, DYN),
-        key: { kind: "strLit", value: target.field, type: STRING, loc },
-        type: DYN,
-        loc,
-      };
-      return lowerer.coerceToExpected(value, getF.sig.ret);
-    }
-    return lowerer.accessorCall(
-      target.className,
-      `get:${target.field}`,
-      target.obj,
-      [],
-      getF.sig.ret,
-      loc,
-    );
-  }
-  // Record accessor properties: the read IS a call of the %get: closure
-  // — once per read, side effects and all (JS's evaluation). The
-  // setter-only read keeps the class-path fence: the property types as
-  // the setter's param where Node yields undefined.
-  if (target.container === "recordAccessor") {
-    if (!target.getType) {
-      lowerer.unsupported(
-        "SC1090",
-        blame,
-        `reading a property that has only a setter ('${target.field}' — Node would yield undefined)`,
-      );
-    }
-    const closure: IrExpr = {
-      kind: "recordGet",
-      obj: target.obj,
-      shapeId: target.shapeId,
-      field: `%get:${target.field}`,
-      type: target.getType,
-      loc,
-    };
-    return { kind: "callValue", callee: closure, args: [], type: target.getType.ret, loc };
-  }
-  // Overflow dot reads: exactly the bracket read with a literal key —
-  // recordKeyGet, overflowOnly (the name declares no field by
-  // construction), typed as the index value armed with undefined
-  // (mirroring lowerRecordKeyRead).
-  if (target.container === "recordOvf") {
-    let obj = target.obj;
-    if (obj.type.kind === "union" && ts.isPropertyAccessExpression(blame)) {
-      const present = lowerer.stripUndefinedArm(obj.type);
-      if (present.kind === "record") {
-        obj =
-          lowerer.runtimeOptionalPropertyReceiver(blame.expression, obj, present, target.field) ??
-          obj;
-      }
-    }
-    if (obj.type.kind !== "record") {
-      lowerer.unsupported(
-        "SC1090",
-        blame,
-        `reading '${target.field}' on a non-record receiver (narrow first)`,
-      );
-    }
-    const shape = lowerer.shapes.get(obj.type.shapeId);
-    if (!shape?.indexValue)
-      lowerer.unsupported(
-        "SC1090",
-        blame,
-        `reading '${target.field}' on a record without an index signature`,
-      );
-    let t: IrType = shape.indexValue;
-    if (t.kind !== "dyn") {
-      const armed = lowerer.withUndefinedArmOf(t);
-      if (!armed) lowerer.badType(blame, lowerer.typeOf(blame));
-      t = armed;
-    }
-    return {
-      kind: "recordKeyGet",
-      obj,
-      shapeId: obj.type.shapeId,
-      key: { kind: "strLit", value: target.field, type: STRING, loc },
-      overflowOnly: true,
-      type: t,
-      loc,
-    };
-  }
-  if (target.container === "class") {
-    const read: IrExpr = {
-      kind: "fieldGet",
-      obj: target.obj,
-      className: target.className,
-      field: target.field,
-      type: target.fieldType,
-      loc,
-    };
-    // DEFERRED-INIT fields (`stream!: T` assigned past the constructor's
-    // top level — ClassInfo.deferredInitFields): the SLOT is the
-    // undefined-armed union; the read CHECKED-extracts the declared type
-    // — a genuinely unassigned read throws the catchable TypeError
-    // where Node reads an undefined the declared type cannot hold.
-    if (
-      lowerer.classes.get(target.className)?.deferredInitFields?.has(target.field) === true &&
-      target.fieldType.kind === "union"
-    ) {
-      const inner = lowerer.stripUndefinedArm(target.fieldType);
-      // Reference arms over a stable receiver check inline: the present
-      // arm is a plain projection of the slot, so ordinary reads keep their
-      // borrowed form and only an unassigned slot reaches the throw.
-      const unionId = target.fieldType.unionId;
-      const presentTag = lowerer.armTag(unionId, inner);
-      const undefTag = lowerer.armTag(unionId, UNDEFINED_T);
-      if (
-        inner.kind === "object" &&
-        presentTag >= 0 &&
-        undefTag >= 0 &&
-        lowerer.unions.get(unionId)?.arms.length === 2 &&
-        isSafeToRepeat(read)
-      ) {
-        return {
-          kind: "ternary",
-          cond: {
-            kind: "unionIsTag",
-            unionId,
-            tag: undefTag,
-            negated: false,
-            value: read,
-            type: BOOL,
-            loc,
-          },
-          then: nodeThrowExpr(1, "", DEFERRED_READ_MESSAGE, inner, loc),
-          else_: { kind: "unionNarrow", unionId, tag: presentTag, value: read, type: inner, loc },
-          type: inner,
-          loc,
-        };
-      }
-      const helper = lowerer.deferredReadHelper(target.fieldType.unionId, inner, loc);
-      if (helper) return { kind: "call", callee: helper, args: [read], type: inner, loc };
-    }
-    return read;
-  }
-  return {
-    kind: "recordGet",
-    obj: target.obj,
-    shapeId: target.shapeId,
-    field: target.field,
-    type: target.fieldType,
-    loc,
-  };
-}
-
-/** The write statement for a field target (fieldSet / recordSet / setter
- * call). A write to a getter-only property never gets here in a clean
- * program (tsc's TS2540 is the fence); the rejection is the backstop. */
-export function fieldSetStmt(
-  lowerer: Lowerer,
-  target: FieldTarget,
-  value: IrExpr,
-  loc: SrcLoc,
-  blame: ts.Node,
-): IrStmt {
-  // A member write through an unassigned deferred-init field: the value
-  // still evaluates first, then the write throws Node's TypeError.
-  const deferredSlot =
-    target.container === "class" &&
-    !(
-      (target.field === "message" || target.field === "name") &&
-      (target.className === "%Error" || lowerer.isSubclassOf(target.className, "%Error"))
-    )
-      ? lowerer.deferredFieldSlot(target.obj)
-      : null;
-  if (target.container === "class" && deferredSlot?.type.kind === "union") {
-    const unionId = deferredSlot.type.unionId;
-    const undefTag = lowerer.armTag(unionId, UNDEFINED_T);
-    const presentTag = lowerer.armTag(unionId, target.obj.type);
-    if (undefTag >= 0 && presentTag >= 0) {
-      // A value that cannot write anything leaves the field unchanged, so
-      // the field is read after it (no snapshot of the slot).
-      const late = isSafeToRepeat(deferredSlot) && writeFree(value);
-      const receiver = late
-        ? null
-        : lowerer.declareHiddenLocal("%deferredWriteObject", deferredSlot.type);
-      const stored = lowerer.declareHiddenLocal("%deferredWriteValue", value.type);
-      const receiverRef = receiver ? varRef(receiver.id, receiver.type, loc) : deferredSlot;
-      const result = varRef(stored.id, stored.type, loc);
-      const write: IrStmt = {
-        kind: "fieldSet",
-        obj: {
-          kind: "unionNarrow",
-          unionId,
-          tag: presentTag,
-          value: receiverRef,
-          type: target.obj.type,
-          loc,
-        },
-        className: target.className,
-        field: target.field,
-        value: result,
-        loc,
-      };
-      return {
-        kind: "exprStmt",
-        expr: {
-          kind: "seqExpr",
-          stmts: [
-            ...(receiver
-              ? [{ kind: "varDecl" as const, localId: receiver.id, init: deferredSlot, loc }]
-              : []),
-            { kind: "varDecl", localId: stored.id, init: value, loc },
-          ],
-          result: {
-            kind: "ternary",
-            cond: {
-              kind: "unionIsTag",
-              unionId,
-              tag: undefTag,
-              value: receiverRef,
-              negated: false,
-              type: BOOL,
-              loc,
-            },
-            then: nodeThrowExpr(
-              1,
-              "",
-              `Cannot set properties of undefined (setting '${target.field}')`,
-              result.type,
-              loc,
-            ),
-            else_: { kind: "seqExpr", stmts: [write], result, type: result.type, loc },
-            type: result.type,
-            loc,
-          },
-          type: result.type,
-          loc,
-        },
-        loc,
-      };
-    }
-  }
-  if (target.container === "dynamic")
-    return {
-      kind: "exprStmt",
-      expr: {
-        kind: "libCall",
-        fn: "dyn.keySet",
-        args: [
-          target.obj,
-          { kind: "strLit", value: target.field, type: STRING, loc },
-          lowerer.coerceToExpected(value, DYN),
-        ],
-        type: VOID,
-        loc,
-      },
-      loc,
-    };
-  if (
-    target.container === "class" &&
-    (target.field === "message" || target.field === "name") &&
-    (target.className === "%Error" || lowerer.isSubclassOf(target.className, "%Error"))
-  )
-    return errorPropertyWrite(lowerer, target.obj, value, target.field);
-  if (target.container === "errorStackLimit") {
-    return {
-      kind: "exprStmt",
-      expr: { kind: "libCall", fn: "error.stackLimitSet", args: [value], type: VOID, loc },
-      loc,
-    };
-  }
-  if (target.container === "errorCause") {
-    return {
-      kind: "exprStmt",
-      expr: { kind: "libCall", fn: "error.setCause", args: [target.obj, value], type: VOID, loc },
-      loc,
-    };
-  }
-  // A record-shaped CHECKER target whose receiver VALUE lives in the checked-dynamic tree:
-  // the checked-dynamic keyed write — dyn.keySet (later writes win,
-  // insertion order; Node's TypeErrors on non-object receivers), the
-  // value converting into the checked-dynamic tree.
-  if (
-    (target.container === "record" || target.container === "recordOvf") &&
-    target.obj.type.kind === "dyn"
-  ) {
-    const v = lowerer.coerceToExpected(value, DYN);
-    if (v.type.kind !== "dyn") {
-      lowerer.unsupported(
-        "SC1101",
-        blame,
-        `storing '${lowerer.fmt(value.type)}' values in a checked-dynamic object (the value cannot convert into the checked-dynamic tree)`,
-      );
-    }
-    return {
-      kind: "exprStmt",
-      expr: {
-        kind: "libCall",
-        fn: "dyn.keySet",
-        args: [target.obj, { kind: "strLit", value: target.field, type: STRING, loc }, v],
-        type: VOID,
-        loc,
-      },
-      loc,
-    };
-  }
-  if (target.container === "accessor") {
-    const setF = lowerer.findMethodOn(
-      lowerer.classes.get(target.className) ?? null,
-      `set:${target.field}`,
-    );
-    if (!setF)
-      lowerer.unsupported(
-        "SC1090",
-        blame,
-        `assignment to the getter-only property '${target.field}'`,
-      );
-    return {
-      kind: "exprStmt",
-      expr: lowerer.accessorCall(
-        target.className,
-        `set:${target.field}`,
-        target.obj,
-        [value],
-        VOID,
-        loc,
-      ),
-      loc,
-    };
-  }
-  // Record accessor properties: the write calls the %set: closure with
-  // the coerced value. A getter-only write never gets here in a clean
-  // program (tsc's TS2540); the rejection is the backstop.
-  if (target.container === "recordAccessor") {
-    if (!target.setType) {
-      lowerer.unsupported(
-        "SC1090",
-        blame,
-        `assignment to the getter-only property '${target.field}'`,
-      );
-    }
-    const closure: IrExpr = {
-      kind: "recordGet",
-      obj: target.obj,
-      shapeId: target.shapeId,
-      field: `%set:${target.field}`,
-      type: target.setType,
-      loc,
-    };
-    return {
-      kind: "exprStmt",
-      expr: { kind: "callValue", callee: closure, args: [value], type: VOID, loc },
-      loc,
-    };
-  }
-  // Overflow dot writes: the bracket write with a literal key — a pure
-  // overflow insert (recordKeySet, overflowOnly: the name declares no
-  // field, so no declared collision exists to validate). The value was
-  // coerced into the index-value slot type by the caller.
-  if (target.container === "recordOvf") {
-    return {
-      kind: "recordKeySet",
-      obj: target.obj,
-      shapeId: target.shapeId,
-      key: { kind: "strLit", value: target.field, type: STRING, loc },
-      value,
-      overflowOnly: true,
-      loc,
-    };
-  }
-  return target.container === "class"
-    ? {
-        kind: "fieldSet",
-        obj: target.obj,
-        className: target.className,
-        field: target.field,
-        value,
-        loc,
-      }
-    : {
-        kind: "recordSet",
-        obj: target.obj,
-        shapeId: target.shapeId,
-        field: target.field,
-        value,
-        loc,
-      };
-}
-
 /** `Promise.reject(reason)` on THE Promise global: a pre-rejected
  * promise. The reason is pinned to the Error hierarchy (the executor
  * reject parameter's contract — rejection payloads share the
@@ -16483,233 +2732,6 @@ export function lowerFieldCompound(
   };
 }
 
-function lowerFieldCompoundValue(
-  lowerer: Lowerer,
-  access: ts.PropertyAccessExpression | ts.ElementAccessExpression,
-  op: CompoundOp,
-  rhsNode: ts.Expression | null,
-  loc: SrcLoc,
-): IrExpr {
-  if (access.expression.kind === ts.SyntaxKind.SuperKeyword) {
-    lowerer.unsupported(
-      "SC1090",
-      access,
-      "compound assignment through 'super' (read and write separately)",
-    );
-  }
-  const body: IrStmt[] = [];
-  const save = (value: IrExpr, name: string): IrExpr => {
-    const local = lowerer.declareHiddenLocal(name, value.type);
-    body.push({ kind: "varDecl", localId: local.id, init: value, loc: value.loc });
-    return varRef(local.id, value.type, value.loc);
-  };
-  // A CHECKED-DYNAMIC receiver (`context.actual++` — test/common's call
-  // accounting; dot spelling only — symbol-keyed element targets are
-  // static fields): read the member (dynKeyGet), VALIDATE it as a
-  // number (dynCheck — a non-number member throws the catchable
-  // TypeError where JS would ToNumber-coerce; it throws instead of
-  // producing NaN — SEMANTICS.md), combine, write back (dyn.keySet). The
-  // receiver and member read are saved before evaluating the RHS.
-  if (ts.isPropertyAccessExpression(access)) {
-    let probed = tryLowerExpression(lowerer, access.expression);
-    const staticClass =
-      probed?.type.kind === "classval" ? lowerer.classes.get(probed.type.className) : undefined;
-    if (probed && staticClass && hasRuntimeStatics(staticClass))
-      probed = lowerer.coerceToExpected(probed, DYN);
-    if (probed?.type.kind === "dyn") {
-      const receiver = save(probed, "%compoundReceiver");
-      const key: IrExpr = {
-        kind: "strLit",
-        value: access.name.text,
-        type: STRING,
-        loc: locOf(access.name),
-      };
-      const read = save(
-        { kind: "dynKeyGet", key, value: receiver, type: DYN, loc },
-        "%compoundOld",
-      );
-      const cur: IrExpr = { kind: "dynCheck", value: read, type: F64, loc };
-      const rhs = save(
-        rhsNode ? lowerer.lowerExpr(rhsNode) : { kind: "numLit", value: 1, type: F64, loc },
-        "%compoundRhs",
-      );
-      if (isJsSourceFile(access.getSourceFile()) && lowerer.dynConvertible(rhs.type)) {
-        const numeric = ["-", "*", "/", "%", "**"].includes(op);
-        const right = lowerer.coerceToExpected(rhs, DYN);
-        const value = save(
-          {
-            kind: "libCall",
-            fn: op === "+" ? "dyn.add" : numeric ? "dyn.arithmetic" : "dyn.bitwise",
-            args:
-              op === "+"
-                ? [read, right]
-                : [read, right, { kind: "strLit", value: op, type: STRING, loc }],
-            type: DYN,
-            loc,
-          },
-          "%compoundResult",
-        );
-        body.push({
-          kind: "exprStmt",
-          expr: {
-            kind: "libCall",
-            fn: "dyn.keySet",
-            args: [receiver, key, value],
-            type: VOID,
-            loc,
-          },
-          loc,
-        });
-        return { kind: "seqExpr", stmts: body, result: value, type: DYN, loc };
-      }
-      const numericRhs: IrExpr =
-        rhs.type.kind === "dyn"
-          ? { kind: "dynCheck", value: rhs, type: F64, loc: rhs.loc }
-          : lowerOptionalNumber(lowerer, rhs, loc);
-      if (numericRhs.type.kind !== "f64")
-        compoundUnsupported(lowerer, access, op, F64, numericRhs.type);
-      const value = save(
-        { kind: "bin", op, left: cur, right: numericRhs, type: F64, loc },
-        "%compoundResult",
-      );
-      const boxed: IrExpr = { kind: "dynFrom", value, type: DYN, loc };
-      body.push({
-        kind: "exprStmt",
-        expr: {
-          kind: "libCall",
-          fn: "dyn.keySet",
-          args: [receiver, { ...key }, boxed],
-          type: VOID,
-          loc,
-        },
-        loc,
-      });
-      return { kind: "seqExpr", stmts: body, result: value, type: value.type, loc };
-    }
-  }
-  const targetOf = (): FieldTarget | null =>
-    ts.isPropertyAccessExpression(access)
-      ? lowerer.fieldTarget(access)
-      : symbolFieldTarget(lowerer, access);
-  const target = targetOf();
-  if (!target)
-    lowerer.unsupported("SC1090", access, "compound assignment to unsupported field targets");
-  checkDeferredMemberReceiver(lowerer, target, access);
-  target.obj = save(target.obj, "%compoundReceiver");
-  // Accessors observe getter, RHS side effects, then setter, all through
-  // the saved receiver.
-  const fieldRead = lowerer.fieldGetExpr(target, locOf(access), access);
-  // `+=` on a stored string field reads it into a mutable local, so the
-  // concat below can append to that local in place.
-  const storedString =
-    op === "+" &&
-    fieldRead.type.kind === "string" &&
-    target.fieldType.kind === "string" &&
-    (target.container === "class" || target.container === "record");
-  let read: IrExpr;
-  if (storedString) {
-    const old = declareContextLocal(
-      lowerer.ctx,
-      "%compoundOld",
-      STRING,
-      true,
-      undefined,
-      undefined,
-    );
-    body.push({ kind: "varDecl", localId: old.id, init: fieldRead, loc: fieldRead.loc });
-    read = varRef(old.id, STRING, fieldRead.loc);
-  } else {
-    read = save(fieldRead, "%compoundOld");
-  }
-  const rhs = save(
-    rhsNode ? lowerer.lowerExpr(rhsNode) : { kind: "numLit", value: 1, type: F64, loc },
-    "%compoundRhs",
-  );
-  const numericRhs: IrExpr =
-    rhs.type.kind === "dyn" && isJsSourceFile(access.getSourceFile())
-      ? { kind: "dynCheck", value: rhs, type: F64, loc: rhs.loc }
-      : lowerOptionalNumber(lowerer, rhs, loc);
-  let value: IrExpr;
-  let appended: IrExpr | null = null;
-  const numericRead = lowerOptionalNumber(lowerer, read, loc, access);
-  const bigintValue = rhsNode ? bigintCompoundValue(op, read, rhs, loc) : null;
-  if (op === "+" && read.type.kind === "string") {
-    appended = concatOperand(lowerer, rhs, rhsNode ?? access);
-    value = { kind: "strConcat", left: read, right: appended, type: STRING, loc };
-  } else if (numericRead.type.kind === "f64" && numericRhs.type.kind === "f64") {
-    value = { kind: "bin", op, left: numericRead, right: numericRhs, type: F64, loc };
-  } else if (bigintValue) {
-    value = bigintValue;
-  } else if (
-    (target.fieldType.kind === "dyn" && isJsSourceFile(access.getSourceFile())) ||
-    // An untyped right operand: the expanded `o.f = o.f op rhs`; the field
-    // write below checks the result into the declared field type.
-    (rhs.type.kind === "dyn" &&
-      lowerer.dynConvertible(read.type) &&
-      lowerer.dynConvertible(target.fieldType))
-  ) {
-    value = dynCompoundValue(
-      op,
-      lowerer.coerceToExpected(read, DYN),
-      lowerer.coerceToExpected(rhs, DYN),
-      loc,
-    );
-  } else {
-    compoundUnsupported(lowerer, access, op, read.type, rhs.type);
-  }
-  if (storedString && rhs.type.kind === "string" && read.kind === "varRef" && appended !== null) {
-    // The field gives up its value before the concat (no code runs in
-    // between: both operands are already strings), and the concat is the
-    // self-append `old = old + rhs`, which hands the local's reference to
-    // the runtime: the old string is then uniquely owned unless something
-    // else holds it, and is appended to in place. Repeated `this.text += s`
-    // is linear rather than a copy per append.
-    const oldId = read.localId;
-    const oldLoc = read.loc;
-    const oldRef = (): IrExpr => varRef(oldId, STRING, oldLoc);
-    const concat: IrExpr = {
-      kind: "strConcat",
-      left: oldRef(),
-      right: appended,
-      type: STRING,
-      loc,
-    };
-    body.push(
-      lowerer.fieldSetStmt(target, { kind: "strLit", value: "", type: STRING, loc }, loc, access),
-      { kind: "assign", localId: oldId, value: concat, loc },
-      lowerer.fieldSetStmt(target, oldRef(), loc, access),
-    );
-    return { kind: "seqExpr", stmts: body, result: oldRef(), type: STRING, loc };
-  }
-  const result = save(value, "%compoundResult");
-  body.push(
-    lowerer.fieldSetStmt(target, lowerer.coerceInto(access, result, target.fieldType), loc, access),
-  );
-  return { kind: "seqExpr", stmts: body, result, type: result.type, loc };
-}
-
-/** Stream-rooted receivers' property surface (readableEnded, destroyed,
- * ...): the receiver's mapped class dispatches into lower-stream.ts.
- * Null off the stream hierarchy or for names the spoke does not own. */
-function lowerStreamObjectProperty(
-  lowerer: Lowerer,
-  expr: ts.PropertyAccessExpression,
-): IrExpr | null {
-  if (expr.questionDotToken && !lowerer.chainHandled.has(expr)) return null;
-  const recvT = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
-  if (recvT?.kind !== "object") return null;
-  const info = lowerer.classes.get(recvT.className);
-  if (!info || streamSidesOf(lowerer, info) === null) return null;
-  if (expr.name.text === "bytesWritten" && isZlibStreamMember(lowerer, expr)) {
-    return lowerZlibStreamBytesWritten(lowerer, expr);
-  }
-  if (isFsStreamMember(lowerer, expr)) {
-    const member = lowerFsStreamProperty(lowerer, expr);
-    if (member) return member;
-  }
-  return lowerStreamProperty(lowerer, expr, info);
-}
-
 /** The primitive-constructor closure (`String`/`Number`/`Boolean` as a
  * VALUE): interns one synthesized module function per constructor/ABI and
  * returns the zero-capture closure over it. Typed sources use the mapped
@@ -16719,7 +2741,7 @@ function lowerStreamObjectProperty(
  * dyn bodies run exact ToString/ToNumber/ToBoolean, including object hooks.
  * Interning makes every reference under one ABI the SAME immortal closure,
  * so `opt.type === String` compares like JS function identity. */
-function primitiveCtorClosure(
+export function primitiveCtorClosure(
   lowerer: Lowerer,
   name: "String" | "Number" | "Boolean" | "BigInt",
   loc: SrcLoc,
@@ -16769,133 +2791,3 @@ function primitiveCtorClosure(
   }
   return { kind: "closure", fnName, captures: [], type: fnT, loc };
 }
-
-/** Drain using checked dispatch so native class and generator iterators keep their methods. */
-function checkedIteratorPack(lowerer: Lowerer, source: IrExpr, loc: SrcLoc): IrExpr {
-  const name = "%iterator.pack.checked";
-  if (!lowerer.liftedFns.some((fn) => fn.name === name)) {
-    const ref = (id: string): IrExpr => ({ kind: "varRef", localId: id, type: DYN, loc });
-    const property = (key: string): IrExpr => ({
-      kind: "dynKeyGet",
-      value: ref("step"),
-      key: { kind: "strLit", value: key, type: STRING, loc },
-      type: DYN,
-      loc,
-    });
-    lowerer.liftedFns.push({
-      name,
-      params: [{ localId: "source", name: "source", type: DYN }],
-      returnType: DYN,
-      locals: ["source", "iterator", "step", "result"].map((id) => ({
-        id,
-        name: id,
-        type: DYN,
-        mutable: id !== "source",
-      })),
-      body: [
-        {
-          kind: "varDecl",
-          localId: "iterator",
-          init: {
-            kind: "libCall",
-            fn: "dyn.iterator",
-            args: [ref("source"), { kind: "strLit", value: "value", type: STRING, loc }],
-            type: DYN,
-            loc,
-          },
-          loc,
-        },
-        {
-          kind: "varDecl",
-          localId: "result",
-          init: { kind: "dynArrLit", elems: [], type: DYN, loc },
-          loc,
-        },
-        {
-          kind: "while",
-          cond: { kind: "boolLit", value: true, type: BOOL, loc },
-          body: [
-            {
-              kind: "varDecl",
-              localId: "step",
-              init: {
-                kind: "dynInvoke",
-                recv: ref("iterator"),
-                method: "next",
-                calleeName: "iterator.next",
-                args: [],
-                type: DYN,
-                loc,
-              },
-              loc,
-            },
-            {
-              kind: "if",
-              cond: { kind: "dynTest", test: "truthy", value: property("done"), type: BOOL, loc },
-              then: [{ kind: "return", value: ref("result"), loc }],
-              else_: null,
-              loc,
-            },
-            {
-              kind: "exprStmt",
-              expr: {
-                kind: "libCall",
-                fn: "dyn.packPush",
-                args: [ref("result"), property("value")],
-                type: VOID,
-                loc,
-              },
-              loc,
-            },
-          ],
-          loc,
-        },
-        { kind: "return", value: ref("result"), loc },
-      ],
-      loc,
-    });
-  }
-  return { kind: "call", callee: name, args: [source], type: DYN, loc };
-}
-
-/** The `declare module "..."` body (or nested namespace body) a module
- * export's declaration sits directly in, or undefined. */
-function builtinModuleExportParent(decl: ts.Node): ts.ModuleBlock | undefined {
-  const parent = ts.isVariableDeclaration(decl) ? decl.parent?.parent?.parent : decl.parent;
-  return parent !== undefined && ts.isModuleBlock(parent) ? parent : undefined;
-}
-
-/** A function, class or variable exported by a builtin module's body. */
-function isBuiltinModuleValueDecl(decl: ts.Node): boolean {
-  return (
-    builtinModuleExportParent(decl) !== undefined &&
-    (ts.isFunctionDeclaration(decl) ||
-      ts.isClassDeclaration(decl) ||
-      ts.isVariableDeclaration(decl))
-  );
-}
-
-/** True when `access` reads a member that JavaScript sources attach to a
- * function by assignment (`fn.member = value`): the receiver's type is
- * callable and every declaration of the member is such an assignment in a
- * JS file. */
-function jsFunctionExpandoMember(lowerer: Lowerer, access: ts.PropertyAccessExpression): boolean {
-  if (access.questionDotToken || !ts.isIdentifier(access.name)) return false;
-  const recvType = lowerer.typeOf(access.expression);
-  if (lowerer.checker.getCallSignatures(recvType).length === 0) return false;
-  const member = lowerer.checker.getPropertyOfType(recvType, access.name.text);
-  const decls = member ? lowerer.checker.declarationsOf(member) : [];
-  return (
-    decls.length > 0 &&
-    decls.every((d) => {
-      if (!isJsSourceFile(d.getSourceFile())) return false;
-      const assign = ts.isBinaryExpression(d) ? d : d.parent;
-      return (
-        assign !== undefined &&
-        ts.isBinaryExpression(assign) &&
-        assign.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
-        ts.isPropertyAccessExpression(assign.left)
-      );
-    })
-  );
-}
diff --git a/packages/compiler/src/frontend/lowering/lower-functions.ts b/packages/compiler/src/frontend/lowering/lower-functions.ts
index 7cc448994..0ef601672 100644
--- a/packages/compiler/src/frontend/lowering/lower-functions.ts
+++ b/packages/compiler/src/frontend/lowering/lower-functions.ts
@@ -59,7 +59,7 @@ function declareCallReceiver(
 export function isTopLevelFnSymbol(lowerer: Lowerer, ident: ts.Identifier): boolean {
   const symbol = lowerer.resolveValueSymbol(ident);
   if (symbol && lowerer.staticCallables.get(symbol)?.kind === "declared-function") return true;
-  const decl = symbol ? lowerer.checker.declarationsOf(symbol)[0] : undefined;
+  const decl = symbol ? symbol.declarations[0] : undefined;
   return (
     !!decl &&
     ts.isFunctionDeclaration(decl) &&
diff --git a/packages/compiler/src/frontend/lowering/lower-generators.ts b/packages/compiler/src/frontend/lowering/lower-generators.ts
index 6bf414f29..b1d0a1aa5 100644
--- a/packages/compiler/src/frontend/lowering/lower-generators.ts
+++ b/packages/compiler/src/frontend/lowering/lower-generators.ts
@@ -203,14 +203,12 @@ function isGeneratorMember(lowerer: Lowerer, access: ts.PropertyAccessExpression
   const member = lowerer.checker.getSymbolAtLocation(access.name);
   return (
     member !== undefined &&
-    lowerer.checker
-      .declarationsOf(member)
-      .some(
-        (d) =>
-          ts.isInterfaceDeclaration(d.parent) &&
-          (d.parent.name.text === "Generator" || d.parent.name.text === "AsyncGenerator") &&
-          lowerer.isStdlibFile(d.getSourceFile()),
-      )
+    member.declarations.some(
+      (d) =>
+        ts.isInterfaceDeclaration(d.parent) &&
+        (d.parent.name.text === "Generator" || d.parent.name.text === "AsyncGenerator") &&
+        lowerer.isStdlibFile(d.getSourceFile()),
+    )
   );
 }
 
@@ -268,28 +266,24 @@ export function isSettledIteratorValueRead(
   const member = lowerer.checker.getSymbolAtLocation(node.name);
   if (
     !member ||
-    !lowerer.checker
-      .declarationsOf(member)
-      .some(
-        (d) =>
-          ts.isPropertySignature(d) &&
-          ts.isInterfaceDeclaration(d.parent) &&
-          (d.parent.name.text === "IteratorYieldResult" ||
-            d.parent.name.text === "IteratorReturnResult") &&
-          lowerer.isStdlibFile(d.getSourceFile()),
-      )
+    !member.declarations.some(
+      (d) =>
+        ts.isPropertySignature(d) &&
+        ts.isInterfaceDeclaration(d.parent) &&
+        (d.parent.name.text === "IteratorYieldResult" ||
+          d.parent.name.text === "IteratorReturnResult") &&
+        lowerer.isStdlibFile(d.getSourceFile()),
+    )
   )
     return false;
   const receiver = lowerer.typeOf(node.expression);
   const stdlib = (sym: ts.Symbol | undefined): boolean =>
     sym !== undefined &&
-    lowerer.checker
-      .declarationsOf(sym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isTypeAliasDeclaration(d)) &&
-          lowerer.isStdlibFile(d.getSourceFile()),
-      );
+    sym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isTypeAliasDeclaration(d)) &&
+        lowerer.isStdlibFile(d.getSourceFile()),
+    );
   const alias = receiver.getAliasSymbol();
   const symbol = receiver.getSymbol();
   if (
diff --git a/packages/compiler/src/frontend/lowering/lower-inspect.ts b/packages/compiler/src/frontend/lowering/lower-inspect.ts
index be7f21c1c..245d1b676 100644
--- a/packages/compiler/src/frontend/lowering/lower-inspect.ts
+++ b/packages/compiler/src/frontend/lowering/lower-inspect.ts
@@ -10,6 +10,7 @@ import {
   DYN,
   F64,
   type IrExpr,
+  type IrFunction,
   type IrStmt,
   type IrType,
   RUNTIME_ERROR_CLASSES,
@@ -992,6 +993,7 @@ function inspectHelper(lowerer: Lowerer, t: IrType, loc: SrcLoc): string {
       // Object.keys' declared order (SEMANTICS.md 36's stance). Retained
       // reachability can settle this shape after the helper is first
       // interned, so rebuild the field walk once metadata is final.
+      lowerer.keyOrder.observe(t);
       rebuildShapeOrderBody = (): void => {
         const current = lowerer.shapes.get(t.shapeId) ?? shape;
         const order = current.declaredOrder ?? current.fields.map((f) => f.name);
@@ -1342,7 +1344,10 @@ function inspectHelper(lowerer: Lowerer, t: IrType, loc: SrcLoc): string {
     prependCycleGuard();
   }
 
-  const fn = {
+  // Typed as the IR function itself: the finalizer below replaces the
+  // body of the very object liftedFns holds (natively, a differently typed
+  // literal would be copied into the list).
+  const fn: IrFunction = {
     name,
     params: [
       { localId: "v.0", name: "v", type: t },
@@ -1768,7 +1773,7 @@ function directCallableInspect(lowerer: Lowerer, node: ts.Expression, loc: SrcLo
     const base = cls.base ? ` extends ${cls.base.def.name.replace(/^%/, "")}` : "";
     return strLit(`[class ${cls.def.name}${base}]`, loc);
   }
-  const decl = lowerer.checker.declarationsOf(sym)[0];
+  const decl = sym.declarations[0];
   if (!decl) return null;
   if (ts.isFunctionDeclaration(decl) && decl.name) {
     return strLit(`[Function: ${decl.name.text}]`, loc);
diff --git a/packages/compiler/src/frontend/lowering/lower-mixins.ts b/packages/compiler/src/frontend/lowering/lower-mixins.ts
index 5677b2812..90789b4a0 100644
--- a/packages/compiler/src/frontend/lowering/lower-mixins.ts
+++ b/packages/compiler/src/frontend/lowering/lower-mixins.ts
@@ -223,7 +223,7 @@ export function mixinFnOfCallee(lowerer: Lowerer, callee: ts.Expression): MixinF
   let sym = lowerer.checker.getSymbolAtLocation(callee) ?? null;
   if (sym && sym.flags & ts.SymbolFlags.Alias) sym = lowerer.checker.getAliasedSymbol(sym);
   if (!sym) return null;
-  const decls = lowerer.checker.declarationsOf(sym);
+  const decls = sym.declarations;
   if (decls.length !== 1 || decls[0] === undefined) return null; // overloads / merged declarations
   const d = decls[0];
   if (ts.isFunctionDeclaration(d)) return mixinFnShapeOf(lowerer, d);
@@ -348,7 +348,7 @@ export function mixinResultBindingClassOf(
   sym: ts.Symbol | null | undefined,
 ): ClassInfo | null {
   if (!sym) return null;
-  const decls = lowerer.checker.declarationsOf(sym);
+  const decls = sym.declarations;
   if (decls.length !== 1 || decls[0] === undefined || !ts.isVariableDeclaration(decls[0]))
     return null;
   const decl = decls[0];
@@ -541,7 +541,7 @@ export function mixinIntersectionInstanceType(lowerer: Lowerer, widened: ts.Type
   const plainParts: string[] = [];
   for (const part of parts) {
     const sym = part.getSymbol();
-    const decl = sym ? lowerer.checker.valueDeclarationOf(sym) : undefined;
+    const decl = sym ? sym.valueDeclaration : undefined;
     const node =
       decl &&
       (ts.isClassDeclaration(decl) || ts.isClassExpression(decl)) &&
diff --git a/packages/compiler/src/frontend/lowering/lower-modules.ts b/packages/compiler/src/frontend/lowering/lower-modules.ts
index bc963c9ec..fa4c98372 100644
--- a/packages/compiler/src/frontend/lowering/lower-modules.ts
+++ b/packages/compiler/src/frontend/lowering/lower-modules.ts
@@ -93,6 +93,7 @@ import {
 import { isPromisifyCall, registerBuiltinCallableAlias } from "./builtins/callable-aliases.js";
 import { registerBuiltinClassAlias } from "./builtins/class-values.js";
 import { stripTypeCasts } from "./builtins/arguments.js";
+import { isWebCryptoMemberType } from "./builtins/webcrypto.js";
 import {
   bindingContextualGenericFnNodeOf,
   bindingGenericFnAliasInfoOf,
@@ -113,6 +114,7 @@ import {
   isVarDeclared,
   numericIteratorSourceOf,
   provenanceElidedConstDecl,
+  stdlibBufferVarAlias,
 } from "./lower-stmts.js";
 import { objectFactoryGlobalType } from "./object-factory-new.js";
 import { streamClassAliasDecl } from "./lower-stream.js";
@@ -144,6 +146,7 @@ import { workerTargetPaths } from "../worker-target.js";
 import { isNativeProxyInitializer } from "./expressions/native-proxy.js";
 import { handleEventReaderPrelude } from "./lower-event-target.js";
 import { jsHoldsDynObject } from "./lower-exprs.js";
+import { keptIdentityAssertion } from "./assertion-identity.js";
 
 /** One file's declarations, split for collection and init-body lowering. */
 export interface FileParts {
@@ -651,9 +654,7 @@ function collectDynamicImports(lowerer: Lowerer, sf: ts.SourceFile): void {
         const modSym = lowerer.checker.getSymbolAtLocation(node.arguments.nodes[0]);
         const ownModule =
           modSym !== undefined &&
-          lowerer.checker
-            .declarationsOf(modSym)
-            .some((d) => ts.isSourceFile(d) && !d.isDeclarationFile);
+          modSym.declarations.some((d) => ts.isSourceFile(d) && !d.isDeclarationFile);
         const builtin = canonicalBuiltinModule(spec);
         const res = ownModule
           ? ({ kind: "program-module" } as const)
@@ -691,7 +692,7 @@ export function collectJsonImports(lowerer: Lowerer, parts: FileParts[]): void {
       const nameSym = lowerer.checker.getSymbolAtLocation(clause.name);
       if (!nameSym || !(nameSym.flags & ts.SymbolFlags.Alias)) continue;
       const target = lowerer.checker.getAliasedSymbol(nameSym);
-      const jsonSf = lowerer.checker.declarationsOf(target)[0]?.getSourceFile();
+      const jsonSf = target.declarations[0]?.getSourceFile();
       if (!jsonSf || !jsonSf.fileName.endsWith(".json")) continue;
       try {
         const tsType = lowerer.typeOf(clause.name);
@@ -1053,7 +1054,7 @@ function checkedGlobalReference(lowerer: Lowerer, expression: ts.Expression): bo
   )
     return false;
   const root = lowerer.checker.getSymbolAtLocation(expression.expression);
-  const namespace = root && lowerer.checker.declarationsOf(root).some(ts.isNamespaceImport);
+  const namespace = root && root.declarations.some(ts.isNamespaceImport);
   return (
     (namespace || lowerer.cjsLocalModuleBindingOf(expression.expression)) &&
     lowerer.globalOf(expression.name)?.type.kind === "dyn"
@@ -1261,7 +1262,7 @@ export function collectGlobals(
       if (!symbol) continue;
       if (symbol.flags & ts.SymbolFlags.Alias) {
         const target = lowerer.checker.getAliasedSymbol(symbol);
-        const vd = lowerer.checker.valueDeclarationOf(target);
+        const vd = target.valueDeclaration;
         const mutableVar =
           vd !== undefined &&
           ts.isVariableDeclaration(vd) &&
@@ -1370,8 +1371,7 @@ export function collectGlobals(
               if (vG) {
                 if (!vG.mutable) {
                   lowerer.globalsBySymbol.set(symbol, vG);
-                  for (const d of lowerer.checker.declarationsOf(symbol))
-                    lowerer.globalsByDeclNode.set(d, vG);
+                  for (const d of symbol.declarations) lowerer.globalsByDeclNode.set(d, vG);
                   return;
                 }
                 const g: IrGlobal = {
@@ -1381,8 +1381,7 @@ export function collectGlobals(
                   mutable: false,
                 };
                 lowerer.globalsBySymbol.set(symbol, g);
-                for (const d of lowerer.checker.declarationsOf(symbol))
-                  lowerer.globalsByDeclNode.set(d, g);
+                for (const d of symbol.declarations) lowerer.globalsByDeclNode.set(d, g);
                 lowerer.globalsList.push(g);
                 return;
               }
@@ -1392,8 +1391,7 @@ export function collectGlobals(
           lowerer.globalsBySymbol.set(symbol, g);
           // Importer aliases resolve to a DISTINCT late-bound symbol with
           // the same declaration — key the node too (globalOf's fallback).
-          for (const d of lowerer.checker.declarationsOf(symbol))
-            lowerer.globalsByDeclNode.set(d, g);
+          for (const d of symbol.declarations) lowerer.globalsByDeclNode.set(d, g);
           lowerer.globalsList.push(g);
         } catch (e) {
           if (!(e instanceof PoisonError)) throw e;
@@ -1536,7 +1534,7 @@ export function collectGlobals(
       )
         continue;
       const target = lowerer.checker.getAliasedSymbol(aliasSym);
-      const vd = lowerer.checker.valueDeclarationOf(target);
+      const vd = target.valueDeclaration;
       const mutableVar =
         vd !== undefined &&
         ts.isVariableDeclaration(vd) &&
@@ -1895,6 +1893,7 @@ export function collectGlobals(
       // same test).
       const stableStdlibAlias =
         isConst ||
+        stdlibBufferVarAlias(lowerer, decl) ||
         ((list.flags & ts.NodeFlags.Let) !== 0 &&
           ts.isIdentifier(decl.name) &&
           stdlibGlobalAliasNameOf(lowerer, decl.initializer) !== null &&
@@ -1919,7 +1918,8 @@ export function collectGlobals(
             decl.initializer &&
             !decl.type &&
             !hasJsTypeAnnotation(decl) &&
-            !lowerer.mapTypeOf(lowerer.typeOf(nameNode))
+            (!lowerer.mapTypeOf(lowerer.typeOf(nameNode)) ||
+              isWebCryptoMemberType(lowerer, lowerer.typeOf(nameNode)))
           ) {
             const symbol = lowerer.checker.getSymbolAtLocation(nameNode);
             if (symbol && !lowerer.globalsBySymbol.has(symbol)) {
@@ -1970,6 +1970,30 @@ export function collectGlobals(
             }
             continue;
           }
+          // A file-scope binding of an assertion of the global object
+          // (`const state = globalThis as { [KEY]?: State }`): the binding
+          // holds that object, so writes through it reach the object other
+          // modules read (assertion-identity.ts).
+          const asserted = decl.initializer
+            ? keptIdentityAssertion(lowerer, decl.initializer)
+            : undefined;
+          if (nameNode === decl.name && !decl.type && asserted) {
+            const symbol = lowerer.checker.getSymbolAtLocation(nameNode);
+            if (symbol && !lowerer.globalsBySymbol.has(symbol)) {
+              const g: IrGlobal = {
+                id: `%g.${tag}${nsPrefix}${nameNode.text}`,
+                name: nameNode.text,
+                type: DYN,
+                mutable: isLet,
+                source: bindingSource(nameNode),
+                ...(!isVarDeclared(decl) ? { tdz: true as const } : {}),
+              };
+              lowerer.globalsBySymbol.set(symbol, g);
+              lowerer.globalsList.push(g);
+              if (isVarDeclared(decl)) noteVarGlobalEntryInit(lowerer, sf, g);
+            }
+            continue;
+          }
           // A JS file-scope evolving ARRAY (`const mustCallChecks = [];`
           // — test/common's exit-accounting ledger): the strict type
           // (any[]) has no mapping, but the VALUE is the dyn array the
@@ -2248,8 +2272,7 @@ export function collectGlobals(
             ts.isCallExpression(decl.initializer)
               ? lowerer.checker.getResolvedSignature(decl.initializer)
               : undefined;
-          const callDeclaration =
-            callSignature && lowerer.checker.signatureDeclaration(callSignature);
+          const callDeclaration = callSignature && callSignature.declaration;
           const callType =
             callDeclaration && isJsSourceFile(callDeclaration.getSourceFile())
               ? lowerer.mapTypeOf(lowerer.typeOf(nameNode))
@@ -2516,6 +2539,11 @@ export function collectGlobals(
           };
           lowerer.globalsBySymbol.set(symbol, g);
           lowerer.globalsList.push(g);
+          // `let f: T;` initializes the binding (to undefined) where the
+          // declaration runs: later writes are ordinary stores, which the
+          // pointer guard alone would refuse (markCycleEarlyBindings).
+          if (g.tdz && !decl.initializer)
+            lowerer.uninitializedLexicalGlobals.set(g.id, { name: nameNode, module: sf, symbol });
           // Mutable checked-dynamic LET globals ride the same entry
           // init: a closure called above the declaration statement
           // reads the dyn undefined instead of faulting on NULL — the
@@ -2877,11 +2905,16 @@ export function lowerFileInit(
     // a function called above the declaration reads `undefined`, exactly
     // Node); checked-dynamic var globals hold the dyn undefined the same
     // way. After the guard: a cache-hit revisit must not reset them.
+    // A union slot the body retypes checked-dynamic (lowerVarDecl: a
+    // JavaScript var initialized with an existing checked-dynamic object)
+    // gets the dyn undefined once the body has lowered.
+    const unionEntryInits: { at: number; g: IrGlobal }[] = [];
     for (const g of lowerer.varGlobalEntryInits.get(sf) ?? []) {
       if (g.type.kind !== "union" && g.type.kind !== "dyn") continue;
       const wrapped =
         g.type.kind === "dyn" ? dynUndefinedExpr(loc0) : lowerer.unassignedSlotInit(g.type, loc0);
       if (wrapped) {
+        if (g.type.kind === "union") unionEntryInits.push({ at: header.length, g });
         // A let global whose early reads are checked (initFlag) only
         // gets its storage filled here: this is not the source write, so
         // it must neither run the TDZ check nor set the flag.
@@ -2976,6 +3009,16 @@ export function lowerFileInit(
       );
       at++;
     }
+    for (const { at, g } of unionEntryInits) {
+      if (g.type.kind !== "dyn") continue;
+      body[at] = {
+        kind: "assign",
+        localId: g.id,
+        value: dynUndefinedExpr(loc0),
+        ...(g.initFlag !== undefined ? { initializes: true as const } : {}),
+        loc: loc0,
+      };
+    }
     const moduleRef = cjsModuleRef(lowerer, sf);
     if (moduleRef !== null) {
       const guardedBody = body.splice(guardId !== undefined ? 2 : 0);
@@ -3133,6 +3176,7 @@ function rememberEvaluationError(
 export function buildMain(lowerer: Lowerer): IrFunction {
   const loc: SrcLoc = { file: lowerer.entry.fileName, start: 0, end: 0 };
   const body: IrStmt[] = [
+    ...lowerer.mainPrelude,
     ...cjsModuleRegistryPrelude(lowerer, loc),
     ...handleEventReaderPrelude(lowerer, loc),
   ];
diff --git a/packages/compiler/src/frontend/lowering/lower-namespaces.ts b/packages/compiler/src/frontend/lowering/lower-namespaces.ts
index 7c1d70ed0..23b7d0f57 100644
--- a/packages/compiler/src/frontend/lowering/lower-namespaces.ts
+++ b/packages/compiler/src/frontend/lowering/lower-namespaces.ts
@@ -96,7 +96,7 @@ function nsSymbolRuntimeKind(
   if (!(sym.flags & (ts.SymbolFlags.ValueModule | ts.SymbolFlags.NamespaceModule))) return null;
   let sawTypeOnly = false;
   let sawNamespace = false;
-  for (const d of lowerer.checker.declarationsOf(sym)) {
+  for (const d of sym.declarations) {
     if (!ts.isModuleDeclaration(d)) continue;
     sawNamespace = true;
     let body = d.body;
@@ -189,7 +189,7 @@ export function nsPathPrefix(node: ts.Node, modifierDecl?: ts.Node): string {
  * null. The walk stops at class/function boundaries: a static member of a
  * class INSIDE a namespace is the class's business, not the namespace's. */
 function nsBlockKindOfSymbol(lowerer: Lowerer, sym: ts.Symbol): "flattened" | "typeOnly" | null {
-  for (const d of lowerer.checker.declarationsOf(sym)) {
+  for (const d of sym.declarations) {
     // TYPE declarations don't make a member a namespace VALUE: a class
     // static `C.B` whose name also carries `namespace C { export
     // interface B }` is the static's business — value references consult
@@ -253,7 +253,7 @@ function moduleNsSourceFileOf(lowerer: Lowerer, e: ts.Expression): ts.SourceFile
   }
   if (!sym) return null;
   if (sym.flags & ts.SymbolFlags.Alias) sym = lowerer.checker.getAliasedSymbol(sym);
-  for (const d of lowerer.checker.declarationsOf(sym)) {
+  for (const d of sym.declarations) {
     if (
       sym.flags & ts.SymbolFlags.ValueModule &&
       ts.isSourceFile(d) &&
@@ -322,7 +322,7 @@ export function ambientNsRootOf(lowerer: Lowerer, e: ts.Expression): ts.Identifi
   if (!sym || !(sym.flags & (ts.SymbolFlags.ValueModule | ts.SymbolFlags.NamespaceModule)))
     return null;
   if (lowerer.isStdlibSymbol(sym)) return null;
-  const decls = lowerer.checker.declarationsOf(sym);
+  const decls = sym.declarations;
   if (decls.length === 0) return null;
   for (const d of decls) {
     // A namespace declaration, or the fundule/clazzdule merge partners
@@ -427,7 +427,7 @@ export function ambientUndefVarRootOf(lowerer: Lowerer, e: ts.Expression): ts.Id
     if (lowerer.trapBindings.has(sym)) return root;
     if (lowerer.isStdlibSymbol(sym)) return null;
     if (ambientUndefinedFnSymbolOf(lowerer, root) !== null) return root;
-    const decls = lowerer.checker.declarationsOf(sym);
+    const decls = sym.declarations;
     if (decls.length === 0) return null;
     for (const d of decls) {
       if (!ts.isVariableDeclaration(d) || d.initializer !== undefined) return null;
@@ -608,7 +608,7 @@ export function ambientUndefinedFnSymbolOf(
   if (!sym || !(sym.flags & ts.SymbolFlags.Function)) return null;
   if (lowerer.isStdlibSymbol(sym)) return null;
   let sawFn = false;
-  for (const d of lowerer.checker.declarationsOf(sym)) {
+  for (const d of sym.declarations) {
     if (ts.isInterfaceDeclaration(d) || ts.isTypeAliasDeclaration(d)) continue; // type-world merge partners
     if (ts.isFunctionDeclaration(d)) {
       if (d.body) return null; // an implementation exists — not ambient-undefined
@@ -656,7 +656,7 @@ function initExecutingPosition(node: ts.Node): boolean {
 
 function earliestSameFileDeclStart(lowerer: Lowerer, sym: ts.Symbol, sf: ts.SourceFile): number {
   let earliest = Infinity;
-  for (const d of lowerer.checker.declarationsOf(sym)) {
+  for (const d of sym.declarations) {
     if (d.getSourceFile() === sf) earliest = Math.min(earliest, d.getStart());
   }
   return earliest;
@@ -669,7 +669,7 @@ function earliestSameFileDeclStart(lowerer: Lowerer, sym: ts.Symbol, sf: ts.Sour
 export function fenceEarlyAliasUse(lowerer: Lowerer, ident: ts.Identifier, refNode: ts.Node): void {
   const sym = lowerer.checker.getSymbolAtLocation(ident);
   if (!sym || !(sym.flags & ts.SymbolFlags.Alias)) return;
-  const aliasDecl = lowerer.checker.declarationsOf(sym).find(ts.isImportEqualsDeclaration);
+  const aliasDecl = sym.declarations.find(ts.isImportEqualsDeclaration);
   if (!aliasDecl || ts.isExternalModuleReference(aliasDecl.moduleReference)) return;
   if (!initExecutingPosition(refNode)) return;
   const sf = refNode.getSourceFile();
@@ -766,7 +766,7 @@ export function fenceCrossBlockNsRef(
   ) {
     if (lowerer.nsBlocks.has(q)) refBlocks.push(q);
   }
-  for (const d of lowerer.checker.declarationsOf(symbol)) {
+  for (const d of symbol.declarations) {
     for (
       let q: ts.Node | undefined = d.parent;
       q !== undefined && !ts.isSourceFile(q);
diff --git a/packages/compiler/src/frontend/lowering/lower-node-module.ts b/packages/compiler/src/frontend/lowering/lower-node-module.ts
index 68f11b948..fee25b10f 100644
--- a/packages/compiler/src/frontend/lowering/lower-node-module.ts
+++ b/packages/compiler/src/frontend/lowering/lower-node-module.ts
@@ -42,7 +42,7 @@ function cjsGlobal(lowerer: Lowerer, node: ts.Expression, name: "module" | "requ
   if (!ts.isIdentifier(node) || node.text !== name) return false;
   if (lowerer.isStdlibGlobal(node, name)) return true;
   const symbol = lowerer.checker.getSymbolAtLocation(node);
-  const decls = symbol ? lowerer.checker.declarationsOf(symbol) : [];
+  const decls = symbol ? symbol.declarations : [];
   const sourceShadow = decls.some(
     (decl) =>
       !decl.getSourceFile().isDeclarationFile &&
@@ -204,16 +204,14 @@ function nodeModuleType(lowerer: Lowerer, node: ts.Expression): boolean {
   if (
     symbol &&
     (symbol.name === "Module" || symbol.name === "ScriptcModule") &&
-    lowerer.checker
-      .declarationsOf(symbol)
-      .some((decl) => lowerer.isStdlibFile(decl.getSourceFile()))
+    symbol.declarations.some((decl) => lowerer.isStdlibFile(decl.getSourceFile()))
   ) {
     return true;
   }
   const property = lowerer.checker.getPropertyOfType(type, "filename");
   const declaredByModule =
     property &&
-    lowerer.checker.declarationsOf(property).some((decl) => {
+    property.declarations.some((decl) => {
       for (let parent: ts.Node | undefined = decl.parent; parent; parent = parent.parent) {
         if (
           (ts.isInterfaceDeclaration(parent) || ts.isClassDeclaration(parent)) &&
diff --git a/packages/compiler/src/frontend/lowering/lower-server.ts b/packages/compiler/src/frontend/lowering/lower-server.ts
index aedd123c6..7cdb9ef5d 100644
--- a/packages/compiler/src/frontend/lowering/lower-server.ts
+++ b/packages/compiler/src/frontend/lowering/lower-server.ts
@@ -2476,6 +2476,20 @@ function lowerNetSocketMethodCall(
       ? value
       : lowerer.coerceInto(call, value, declared);
   }
+  if (name === "isSessionReused" && args.length === 0) {
+    // TLSSocket.isSessionReused(): the client never offers a cached
+    // session (no session resumption, a documented TLS divergence), so
+    // no handshake resumes one. A plain socket asserted to be a
+    // TLSSocket answers false too, where Node has no such method.
+    const receiver = coerceToHandle(lowerer, access.expression, NETSOCKET_T);
+    return {
+      kind: "seqExpr",
+      stmts: [{ kind: "exprStmt", expr: receiver, loc }],
+      result: boolLit(false, loc),
+      type: BOOL,
+      loc,
+    };
+  }
   if (name === "resetAndDestroy") {
     // An RST close; a connecting socket resets once it connects. Answers
     // the socket, Node's chaining.
@@ -5051,7 +5065,7 @@ function clientFnRefOf(
  * `const` declaration, or a parameter/let whose enclosing scope contains
  * no assignment or ++/-- targeting it. */
 function neverReassigned(lowerer: Lowerer, sym: ts.Symbol): boolean {
-  const decl = lowerer.checker.declarationsOf(sym)[0];
+  const decl = sym.declarations[0];
   if (!decl) return false;
   if (
     ts.isVariableDeclaration(decl) &&
diff --git a/packages/compiler/src/frontend/lowering/lower-stdlib.ts b/packages/compiler/src/frontend/lowering/lower-stdlib.ts
index 92d9f0690..2f0e1c66f 100644
--- a/packages/compiler/src/frontend/lowering/lower-stdlib.ts
+++ b/packages/compiler/src/frontend/lowering/lower-stdlib.ts
@@ -177,15 +177,13 @@ function requestInitConstBacked(
   if (!symbol || seen.has(symbol)) return false;
   if (requestInitPropMutatedSymbols(lowerer).has(symbol)) return false;
   seen.add(symbol);
-  const declarations = lowerer.checker
-    .declarationsOf(symbol)
-    .filter(
-      (declaration): declaration is ts.VariableDeclaration =>
-        ts.isVariableDeclaration(declaration) &&
-        declaration.initializer !== undefined &&
-        ts.isVariableDeclarationList(declaration.parent) &&
-        (declaration.parent.flags & ts.NodeFlags.Const) !== 0,
-    );
+  const declarations = symbol.declarations.filter(
+    (declaration): declaration is ts.VariableDeclaration =>
+      ts.isVariableDeclaration(declaration) &&
+      declaration.initializer !== undefined &&
+      ts.isVariableDeclarationList(declaration.parent) &&
+      (declaration.parent.flags & ts.NodeFlags.Const) !== 0,
+  );
   return (
     declarations.length > 0 &&
     declarations.every((declaration) =>
@@ -300,7 +298,7 @@ function visitRequestInitConstSelectedValues(
   seen.add(symbol);
   let sawDeclaration = false;
   let defines = true;
-  for (const declaration of lowerer.checker.declarationsOf(symbol)) {
+  for (const declaration of symbol.declarations) {
     if (
       ts.isVariableDeclaration(declaration) &&
       declaration.initializer !== undefined &&
@@ -413,7 +411,7 @@ function fenceRequestInitProperty(
     : lowerer.checker.getPropertyOfType(lowerer.typeOf(access.expression), key);
   if (!symbol || seen.has(symbol)) return;
   seen.add(symbol);
-  for (const declaration of lowerer.checker.declarationsOf(symbol)) {
+  for (const declaration of symbol.declarations) {
     if (ts.isPropertyAssignment(declaration)) {
       fenceRequestInitValueInner(lowerer, declaration.initializer, seen);
     } else if (ts.isShorthandPropertyAssignment(declaration) && ts.isIdentifier(declaration.name)) {
@@ -533,7 +531,7 @@ function fenceRequestInitValueInner(
   if (!symbol || seen.has(symbol)) return;
   if (requestInitPropMutatedSymbols(lowerer).has(symbol)) return;
   seen.add(symbol);
-  for (const declaration of lowerer.checker.declarationsOf(symbol)) {
+  for (const declaration of symbol.declarations) {
     if (ts.isBindingElement(declaration)) {
       const source = requestInitConstBindingSource(lowerer, declaration);
       if (source !== null) {
@@ -1618,9 +1616,9 @@ export function lowerStaticAbortControllerCall(
   const symbol = receiverTs.getAliasSymbol() ?? receiverTs.getSymbol();
   if (
     symbol?.name !== "AbortController" ||
-    !lowerer.checker
-      .declarationsOf(symbol)
-      .some((d) => ts.isInterfaceDeclaration(d) && lowerer.isStdlibFile(d.getSourceFile()))
+    !symbol.declarations.some(
+      (d) => ts.isInterfaceDeclaration(d) && lowerer.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     return null;
   }
@@ -1672,9 +1670,9 @@ export function lowerStaticReadableStreamControllerCall(
   const symbol = receiverTs.getAliasSymbol() ?? receiverTs.getSymbol();
   if (
     symbol?.name !== "ReadableStreamDefaultController" ||
-    !lowerer.checker
-      .declarationsOf(symbol)
-      .some((d) => ts.isInterfaceDeclaration(d) && lowerer.isStdlibFile(d.getSourceFile()))
+    !symbol.declarations.some(
+      (d) => ts.isInterfaceDeclaration(d) && lowerer.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     return null;
   }
@@ -1780,9 +1778,9 @@ export function lowerStaticAbortSignalListenerCall(
   const symbol = receiverTs.getAliasSymbol() ?? receiverTs.getSymbol();
   if (
     (symbol?.name !== "AbortSignal" && symbol?.name !== "EventTarget") ||
-    !lowerer.checker
-      .declarationsOf(symbol)
-      .some((d) => ts.isInterfaceDeclaration(d) && lowerer.isStdlibFile(d.getSourceFile()))
+    !symbol.declarations.some(
+      (d) => ts.isInterfaceDeclaration(d) && lowerer.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     return null;
   }
@@ -2127,9 +2125,9 @@ export function lowerStaticReadableStreamReaderCall(
   const symbol = receiverTs.getSymbol();
   if (
     symbol?.name !== "ReadableStreamDefaultReader" ||
-    !lowerer.checker
-      .declarationsOf(symbol)
-      .some((d) => ts.isInterfaceDeclaration(d) && lowerer.isStdlibFile(d.getSourceFile()))
+    !symbol.declarations.some(
+      (d) => ts.isInterfaceDeclaration(d) && lowerer.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     return null;
   }
@@ -2183,7 +2181,7 @@ export function lowerDynamicImportCall(lowerer: Lowerer, call: ts.CallExpression
 /** The checker-resolved program source behind one literal import(). */
 function programImportTarget(lowerer: Lowerer, arg: ts.StringLiteralLike): ts.SourceFile | null {
   const modSym = lowerer.checker.getSymbolAtLocation(arg);
-  for (const d of modSym ? lowerer.checker.declarationsOf(modSym) : []) {
+  for (const d of modSym ? modSym.declarations : []) {
     if (ts.isSourceFile(d) && !d.isDeclarationFile) return d;
   }
   return null;
@@ -2543,7 +2541,7 @@ export function npmMemberFence(lowerer: Lowerer, access: ts.PropertyAccessExpres
  * npmPackageOf, also asked directly for import-alias bindings (whose
  * aliased symbol is the package's export). */
 export function npmPackageOfSymbol(lowerer: Lowerer, sym: ts.Symbol | undefined): string | null {
-  const decls = sym ? lowerer.checker.declarationsOf(sym) : undefined;
+  const decls = sym ? sym.declarations : undefined;
   if (!decls || decls.length === 0) return null;
   if (!decls.every((d) => lowerer.isNpmFile(d.getSourceFile()))) return null;
   return npmPackageNameOf(decls[0]!.getSourceFile().fileName);
diff --git a/packages/compiler/src/frontend/lowering/lower-stmts.ts b/packages/compiler/src/frontend/lowering/lower-stmts.ts
index 53e41f259..e1ff31018 100644
--- a/packages/compiler/src/frontend/lowering/lower-stmts.ts
+++ b/packages/compiler/src/frontend/lowering/lower-stmts.ts
@@ -19,6 +19,7 @@ import { processDataMemberValue } from "./builtins/process.js";
 import { requireInitFlagStmt } from "./require-initialization.js";
 import { isJsonRequireDecl } from "./json-require.js";
 import { bindingSource } from "../binding-source.js";
+import { lowerConstructorReturn } from "./constructor-returns.js";
 import type { Lowerer } from "./lowerer.js";
 import {
   cjsExportValueByName,
@@ -46,7 +47,7 @@ import {
   lowerYieldStarStatement,
   type GenType,
 } from "./lower-generators.js";
-import { lowerForAwaitBuiltin } from "./lower-async-iteration.js";
+import { classAsyncGeneratorIterator, lowerForAwaitBuiltin } from "./lower-async-iteration.js";
 import {
   BOOL,
   BYTES_U8,
@@ -87,6 +88,7 @@ import {
   isJsSourceFile,
   isNodeEsmFile,
   locOf,
+  requireEarlyReference,
   requireSpecOf,
 } from "../program.js";
 import {
@@ -98,6 +100,7 @@ import {
   sideEffectFreeOptionValue,
   stdlibGlobalAliasDecl,
   stdlibGlobalAliasNameOf,
+  bufferNamespaceMember,
   stdlibGlobalNameOf,
 } from "./surfaces.js";
 import { isNativeBuiltinValueInitializer } from "./lower-builtin-values.js";
@@ -191,10 +194,12 @@ import {
 import { globalSymbolKey } from "./expressions/global-symbols.js";
 import { lowerShortCircuitAssignment } from "./expressions/nullish-assignment.js";
 import {
+  jsHoldsDynObject,
   lowerEnvironmentKey,
   lowerNativeFunctionAssignment,
   lowerStrictEquality,
 } from "./lower-exprs.js";
+import { keptIdentityAssertion } from "./assertion-identity.js";
 import { isNativeProxyInitializer } from "./expressions/native-proxy.js";
 import { tryLowerExpression } from "./expressions/try-lower-expression.js";
 import { lowerUnionFieldWrite } from "./expressions/union-fields.js";
@@ -346,8 +351,7 @@ function stdlibTypeNamed(lowerer: Lowerer, node: ts.Node, name: string): boolean
     if (t.flags & ts.TypeFlags.Union) return constituentTypes(t).some(visit);
     const sym = t.getAliasSymbol() ?? t.getSymbol();
     return (
-      sym?.name === name &&
-      lowerer.checker.declarationsOf(sym).some((d) => lowerer.isStdlibFile(d.getSourceFile()))
+      sym?.name === name && sym.declarations.some((d) => lowerer.isStdlibFile(d.getSourceFile()))
     );
   };
   return visit(lowerer.typeOf(node));
@@ -910,7 +914,7 @@ const TDZ_KINDS = new Set<IrType["kind"]>([
  * is empty. Mutable bindings also guard writes; only the declaration's
  * initializing assignment may leave the temporal dead zone. */
 export function predeclareForwardCapture(lowerer: Lowerer, symbol: ts.Symbol): boolean {
-  const decl = lowerer.checker.valueDeclarationOf(symbol);
+  const decl = symbol.valueDeclaration;
   if (
     !decl ||
     !ts.isVariableDeclaration(decl) ||
@@ -990,7 +994,7 @@ export function predeclareForwardCapture(lowerer: Lowerer, symbol: ts.Symbol): b
  * lower the declaration under the owning statement list's context, then
  * resume the caller and thread its captures normally. */
 export function predeclareForwardFnDecl(lowerer: Lowerer, symbol: ts.Symbol): boolean {
-  const decl = lowerer.checker.valueDeclarationOf(symbol);
+  const decl = symbol.valueDeclaration;
   if (!decl || !ts.isFunctionDeclaration(decl) || !decl.body || decl.typeParameters?.nodes)
     return false;
   for (let i = lowerer.activeStmtLists.length - 1; i >= 0; i--) {
@@ -1067,13 +1071,124 @@ function hostVariableDeclarationOf(name: ts.Identifier): ts.VariableDeclaration
 export function forOfVarTarget(
   lowerer: Lowerer,
   decl: ts.VariableDeclaration,
+  valueType?: IrType,
 ): { id: string; type: IrType } | null {
   if (!ts.isIdentifier(decl.name) || !isVarDeclared(decl)) return null;
   const symbol = lowerer.checker.getSymbolAtLocation(decl.name);
   if (!symbol) return null;
   const g = lowerer.globalsBySymbol.get(symbol);
-  if (g) return g;
-  return hoistVarBinding(lowerer, symbol, decl.name);
+  if (g) {
+    if (valueType?.kind === "dyn" && jsBindingKeepsCheckedObject(lowerer, decl.name, g.type))
+      g.type = DYN;
+    return g;
+  }
+  return hoistVarBinding(lowerer, symbol, decl.name, valueType);
+}
+
+/** JavaScript: whether an unannotated variable binding whose static type
+ * is `type` keeps a checked-dynamic value unconverted. The checker types
+ * such a binding by the object it receives (an element of an evolving
+ * `[]`, a `find` result, a member of a checked-dynamic object), but the
+ * value is an existing checked-dynamic object or array: a record- or
+ * array-typed slot would hold a converted copy, so writes through the
+ * binding would miss the object other references see, and `===` against
+ * them would fail. Block-scoped bindings with an identifier name keep such
+ * values by the same rule in lowerVarDecl (preservesObjectIdentity). */
+function jsBindingKeepsCheckedObject(
+  lowerer: Lowerer,
+  nameNode: ts.Identifier,
+  type: IrType,
+): boolean {
+  if (!isJsSourceFile(nameNode.getSourceFile())) return false;
+  const host = hostVariableDeclarationOf(nameNode);
+  if (!host || host.type || hasJsTypeAnnotation(host)) return false;
+  const arms = type.kind === "union" ? (lowerer.unions.get(type.unionId)?.arms ?? []) : [type];
+  return (
+    arms.some((arm) => arm.kind === "record" || arm.kind === "array") &&
+    arms.every((arm) => arm.kind === "record" || arm.kind === "array" || isUnitType(arm))
+  );
+}
+
+/** Whether `node` mentions the binding `symbol` anywhere, nested functions
+ * included. */
+function mentionsSymbol(lowerer: Lowerer, node: ts.Node, symbol: ts.Symbol): boolean {
+  if (ts.isIdentifier(node)) return lowerer.checker.getSymbolAtLocation(node) === symbol;
+  return (
+    node.forEachChild((child) => (mentionsSymbol(lowerer, child, symbol) ? true : undefined)) ===
+    true
+  );
+}
+
+/** Whether `node` evaluates to an existing value rather than constructing
+ * one whose layout a destination directs: not a literal, `new`, function
+ * or class expression, nor a conditional with such an arm (an arm that
+ * is `null` or `undefined` constructs nothing). */
+function existingValueForm(node: ts.Expression, armOfConditional = false): boolean {
+  while (ts.isParenthesizedExpression(node)) node = node.expression;
+  if (ts.isConditionalExpression(node))
+    return existingValueForm(node.whenTrue, true) && existingValueForm(node.whenFalse, true);
+  if (
+    armOfConditional &&
+    (node.kind === ts.SyntaxKind.NullKeyword ||
+      (ts.isIdentifier(node) && node.text === "undefined"))
+  )
+    return true;
+  return !(
+    ts.isObjectLiteralExpression(node) ||
+    ts.isArrayLiteralExpression(node) ||
+    ts.isNewExpression(node) ||
+    ts.isFunctionExpression(node) ||
+    ts.isArrowFunction(node) ||
+    ts.isClassExpression(node) ||
+    ts.isLiteralExpression(node) ||
+    node.kind === ts.SyntaxKind.NullKeyword
+  );
+}
+
+/** JavaScript `var x = e` whose binding could hold an existing
+ * checked-dynamic object (jsBindingKeepsCheckedObject): lowers `e` BEFORE
+ * minting the hoisted slot, as a block-scoped declaration does, so a
+ * checked-dynamic value gets a checked-dynamic slot instead of a converted
+ * copy. Other values coerce into the planned slot exactly as
+ * lowerExprExpecting would. Null when the declaration does not qualify:
+ * the slot already exists, the initializer is fresh construction whose
+ * layout the slot type directs (existingValueForm; a literal holding an
+ * existing checked-dynamic object qualifies), or it refers to the binding
+ * itself (hoist-before-init resolves that reference). */
+function lowerJsVarFromExisting(
+  lowerer: Lowerer,
+  decl: ts.VariableDeclaration,
+  symbol: ts.Symbol,
+): IrStmt | null {
+  if (!ts.isIdentifier(decl.name) || !decl.initializer) return null;
+  if (!isJsSourceFile(decl.getSourceFile()) || lowerer.ctx.hoistedVars.has(symbol)) return null;
+  if (lowerer.bindingIn(lowerer.ctx, symbol)) return null;
+  let node: ts.Expression = decl.initializer;
+  while (ts.isParenthesizedExpression(node) || ts.isSatisfiesExpression(node))
+    node = node.expression;
+  // A literal holding an existing checked-dynamic object builds as a
+  // checked-dynamic literal without a destination (lowerArrayLiteral,
+  // lowerObjectLiteral): a record- or array-typed slot would copy it.
+  const holdsChecked =
+    (ts.isArrayLiteralExpression(node) || ts.isObjectLiteralExpression(node)) &&
+    jsHoldsDynObject(lowerer, node);
+  if (!holdsChecked && !existingValueForm(node)) return null;
+  const planned = varBindingType(lowerer, decl.name);
+  if (!planned || !jsBindingKeepsCheckedObject(lowerer, decl.name, planned)) return null;
+  if (mentionsSymbol(lowerer, node, symbol)) return null;
+  const value = lowerer.lowerExpr(node);
+  const local = hoistVarBinding(
+    lowerer,
+    symbol,
+    decl.name,
+    value.type.kind === "dyn" ? DYN : undefined,
+  );
+  return {
+    kind: "assign",
+    localId: local.id,
+    value: lowerer.coerceExistingInto(node, value, local.type),
+    loc: locOf(decl),
+  };
 }
 
 /** The `var` symbol's function-scoped binding TYPE — the declared type at
@@ -1129,7 +1244,12 @@ function varBindingType(lowerer: Lowerer, nameNode: ts.Identifier): IrType | nul
  * a loop re-ASSIGNS the one binding per pass and never resets it — the
  * classic capture semantics fall out: closures made in a loop share the
  * single boxed binding, where `let` gets a fresh box per iteration. */
-function hoistVarBinding(lowerer: Lowerer, symbol: ts.Symbol, nameNode: ts.Identifier): IrLocal {
+function hoistVarBinding(
+  lowerer: Lowerer,
+  symbol: ts.Symbol,
+  nameNode: ts.Identifier,
+  valueType?: IrType,
+): IrLocal {
   const existing = lowerer.ctx.hoistedVars.get(symbol);
   if (existing) return existing;
   // The parameter merge: the symbol already binds a function-root local.
@@ -1138,7 +1258,15 @@ function hoistVarBinding(lowerer: Lowerer, symbol: ts.Symbol, nameNode: ts.Ident
     lowerer.ctx.hoistedVars.set(symbol, bound);
     return bound;
   }
-  const type = varBindingType(lowerer, nameNode);
+  let type = varBindingType(lowerer, nameNode);
+  // The first value stored is an existing checked-dynamic object: keep it
+  // (jsBindingKeepsCheckedObject). A checked-dynamic slot holds undefined
+  // natively, so no runtime-optional widening applies.
+  const keepsChecked =
+    valueType?.kind === "dyn" &&
+    type !== null &&
+    jsBindingKeepsCheckedObject(lowerer, nameNode, type);
+  if (keepsChecked) type = DYN;
   if (!type) lowerer.badType(nameNode, lowerer.typeOf(nameNode));
   const root = lowerer.activeStmtLists.find((e) => e.ctx === lowerer.ctx);
   if (!root)
@@ -1155,7 +1283,7 @@ function hoistVarBinding(lowerer: Lowerer, symbol: ts.Symbol, nameNode: ts.Ident
   };
   lowerer.ctx.locals.push(local);
   lowerer.ctx.scopes[0]!.set(symbol, local);
-  noteEarlyReadVar(lowerer, symbol, local);
+  if (!keepsChecked) noteEarlyReadVar(lowerer, symbol, local);
   // A checked-dynamic slot holds the dyn undefined (a NULL dyn is a
   // trap); everything else rides unassignedSlotInit (interned union arm,
 
@@ -1184,7 +1312,7 @@ function hoistVarBinding(lowerer: Lowerer, symbol: ts.Symbol, nameNode: ts.Ident
 export function predeclareForwardVar(lowerer: Lowerer, symbol: ts.Symbol): boolean {
   // Module-scope vars already have their global storage.
   if (lowerer.globalsBySymbol.has(symbol)) return false;
-  const decl = lowerer.checker.valueDeclarationOf(symbol);
+  const decl = symbol.valueDeclaration;
   if (!decl || !ts.isVariableDeclaration(decl) || !isVarDeclared(decl)) return false;
   const nameNode = ts.isIdentifier(decl.name) ? decl.name : null;
   if (!nameNode) {
@@ -1348,6 +1476,18 @@ function lowerLabeled(lowerer: Lowerer, stmt: ts.LabeledStatement): IrStmt | IrS
   return { kind: "block", body, labels, loc: locOf(stmt) };
 }
 
+// Value kinds a `throw` converts to a checked-dynamic value, so the catch
+// binding sees the thrown object rather than a type-erased reference.
+const THROWN_AS_DYN: ReadonlySet<IrType["kind"]> = new Set([
+  "array",
+  "union",
+  "map",
+  "set",
+  "bytes",
+  "func",
+  "regex",
+]);
+
 export function lowerStmt(lowerer: Lowerer, stmt: ts.Statement): IrStmt | IrStmt[] | null {
   if (ts.isClassDeclaration(stmt)) {
     if (!stmt.name) lowerer.unsupported("SC1090", stmt, "anonymous local class declarations");
@@ -1450,6 +1590,11 @@ export function lowerStmt(lowerer: Lowerer, stmt: ts.Statement): IrStmt | IrStmt
     // incompatible boundary keeps the ordinary per-statement refusal.
     let value: IrExpr | null = null;
     if (stmt.expression) {
+      // A constructor's returned object replaces the constructed `this`.
+      if (lowerer.currentClass?.ctor) {
+        const constructorReturn = lowerConstructorReturn(lowerer, stmt);
+        if (constructorReturn !== null) return constructorReturn;
+      }
       return lowerer.lowerReturnStmt(stmt.expression, locOf(stmt));
     } else if (lowerer.ctx.returnType.kind === "union") {
       value = lowerer.wrappedUndefined(lowerer.ctx.returnType, locOf(stmt));
@@ -1521,6 +1666,12 @@ export function lowerStmt(lowerer: Lowerer, stmt: ts.Statement): IrStmt | IrStmt
       value = lowerer.coerceToExpected(value, DYN);
     } else if (value.type.kind === "record" && lowerer.dynConvertible(value.type)) {
       value = { kind: "dynFrom", value, liveRef: true, type: DYN, loc: locOf(stmt.expression) };
+    } else if (THROWN_AS_DYN.has(value.type.kind) && lowerer.dynConvertible(value.type)) {
+      // Arrays, Maps, Sets, typed arrays, Buffers, functions, regexes and
+      // unions over them keep their identity and contents the same way:
+      // the catch binding, `typeof`, `instanceof`, `Array.isArray`,
+      // inspection and typed views read the thrown object.
+      value = lowerer.coerceInto(stmt.expression, value, DYN);
     }
     if (value.type.kind === "date") {
       lowerer.unsupported(
@@ -1925,11 +2076,7 @@ export function isParseArgsDynCheckerType(lowerer: Lowerer, type: ts.Type): bool
     return false;
   };
   const sym = widened.getAliasSymbol() ?? widened.getSymbol();
-  if (
-    sym &&
-    isParseArgsDynTypeName(sym.name) &&
-    lowerer.checker.declarationsOf(sym).some(declarationBelongs)
-  ) {
+  if (sym && isParseArgsDynTypeName(sym.name) && sym.declarations.some(declarationBelongs)) {
     return true;
   }
   // A discriminant check erases the token alias and leaves one anonymous
@@ -1937,7 +2084,44 @@ export function isParseArgsDynCheckerType(lowerer: Lowerer, type: ts.Type): bool
   // is the same stable signal the dotted-member bridge uses.
   return lowerer.checker
     .getPropertiesOfType(widened)
-    .some((p) => lowerer.checker.declarationsOf(p).some(declarationBelongs));
+    .some((p) => p.declarations.some(declarationBelongs));
+}
+
+/** True when an `any` value comes from a JavaScript function's result:
+ * a call (possibly awaited) whose callee is declared in a JavaScript file,
+ * or a const bound to one. A TypeScript program importing a JavaScript
+ * package sees the package's inferred types (`jwtVerify` from jose
+ * answers `any`), and its object destructuring reads the members of that
+ * checked-dynamic value as JavaScript does — member reads on the same
+ * value already compile. Other `any` sources keep the fence. */
+function javaScriptAnyOrigin(lowerer: Lowerer, node: ts.Expression, depth: number): boolean {
+  let expr = node;
+  while (ts.isParenthesizedExpression(expr) || ts.isAwaitExpression(expr)) expr = expr.expression;
+  if (ts.isCallExpression(expr)) {
+    const callee = ts.isPropertyAccessExpression(expr.expression)
+      ? expr.expression.name
+      : expr.expression;
+    if (!ts.isIdentifier(callee)) return false;
+    const symbol = lowerer.resolveValueSymbol(callee);
+    const declarations = symbol ? symbol.declarations : [];
+    return (
+      declarations.length > 0 &&
+      declarations.every((d) => isJsSourceFile(d.getSourceFile()) && ts.isFunctionLike(d))
+    );
+  }
+  if (ts.isIdentifier(expr) && depth === 0) {
+    const symbol = lowerer.resolveValueSymbol(expr);
+    const declaration = symbol ? symbol.valueDeclaration : undefined;
+    return (
+      declaration !== undefined &&
+      ts.isVariableDeclaration(declaration) &&
+      ts.isIdentifier(declaration.name) &&
+      declaration.initializer !== undefined &&
+      (ts.getCombinedNodeFlags(declaration) & ts.NodeFlags.Const) !== 0 &&
+      javaScriptAnyOrigin(lowerer, declaration.initializer, depth + 1)
+    );
+  }
+  return false;
 }
 
 /** Destructuring declarations, desugared as sugar over indexed/field
@@ -1984,7 +2168,12 @@ export function lowerDestructuringDecl(
     lowerer.anyOrigin(decl.initializer) &&
     !isJsSourceFile(decl.getSourceFile()) &&
     init.type.kind !== "record" &&
-    init.type.kind !== "array"
+    init.type.kind !== "array" &&
+    !(
+      init.type.kind === "dyn" &&
+      ts.isObjectBindingPattern(decl.name) &&
+      javaScriptAnyOrigin(lowerer, decl.initializer, 0)
+    )
   ) {
     lowerer.anyOpFence("destructuring", decl);
   }
@@ -2397,7 +2586,7 @@ export function lowerBindingPattern(
         )
           ? {
               kind: "libCall",
-              fn: "dyn.iterPack",
+              fn: "dyn.destructureRest",
               args: [srcRef(), { kind: "strLit", value: dynSpell ?? "", type: STRING, loc }],
               type: DYN,
               loc,
@@ -2906,6 +3095,10 @@ export function lowerBindingPattern(
     lowerMatchResultObjectPattern(lowerer, pattern, srcRef, srcType, isLet, out);
     return;
   }
+  if (srcType.kind === "array" && isArrayPositionPattern(lowerer, pattern)) {
+    lowerArrayPositionObjectPattern(lowerer, pattern, srcRef, srcType, isLet, out);
+    return;
+  }
   if (srcType.kind !== "record") {
     lowerer.unsupported(
       "SC1031",
@@ -3236,19 +3429,8 @@ function lowerMatchResultObjectPattern(
       );
     }
     let value: IrExpr;
-    if (/^(?:0|[1-9]\d{0,8})$/.test(propName)) {
-      const index = Number(propName);
-      const position: IrExpr = { kind: "numLit", value: index, type: F64, loc };
-      value = lowerSafeIndexRead(lowerer, srcRef(), position, loc) ?? {
-        kind: "arrayGet",
-        arr: srcRef(),
-        index: position,
-        type: srcType.elem,
-        loc,
-      };
-      if (el.initializer) {
-        value = arrayPositionDefault(lowerer, el, value, srcRef, index, srcType.elem, out);
-      }
+    if (ARRAY_POSITION_KEY.test(propName)) {
+      value = arrayPositionBinding(lowerer, el, srcRef, srcType, Number(propName), out);
     } else if (propName === "index" || propName === "input") {
       if (el.initializer) {
         lowerer.unsupported(
@@ -3294,6 +3476,83 @@ function lowerMatchResultObjectPattern(
   }
 }
 
+/** A canonical array index key (the numeric positions an object pattern
+ * reads off an array). */
+const ARRAY_POSITION_KEY = /^(?:0|[1-9]\d{0,8})$/;
+
+/** The positional read `{ <index>: x }` takes off an array: the element,
+ * undefined past the end, with the binding default applied. */
+function arrayPositionBinding(
+  lowerer: Lowerer,
+  el: ts.BindingElement,
+  srcRef: () => IrExpr,
+  srcType: IrType & { kind: "array" },
+  index: number,
+  out: IrStmt[],
+): IrExpr {
+  const loc = locOf(el);
+  const position: IrExpr = { kind: "numLit", value: index, type: F64, loc };
+  const value = lowerSafeIndexRead(lowerer, srcRef(), position, loc) ?? {
+    kind: "arrayGet",
+    arr: srcRef(),
+    index: position,
+    type: srcType.elem,
+    loc,
+  };
+  return el.initializer
+    ? arrayPositionDefault(lowerer, el, value, srcRef, index, srcType.elem, out)
+    : value;
+}
+
+/** Whether every element of an object pattern over an array names a
+ * numeric position or `length` (`const { 0: a, 1: b, length } =
+ * s.split(".")`), with no rest element. */
+function isArrayPositionPattern(lowerer: Lowerer, pattern: ts.ObjectBindingPattern): boolean {
+  return pattern.elements.nodes.every((el) => {
+    if (el.name === undefined) return true;
+    if (el.dotDotDotToken) return false;
+    const prop = el.propertyName ?? el.name;
+    if (
+      !ts.isIdentifier(prop) &&
+      !ts.isComputedPropertyName(prop) &&
+      !ts.isStringLiteralLike(prop) &&
+      !ts.isNumericLiteral(prop)
+    )
+      return false;
+    const name = patternKeyNameOf(lowerer, prop as ts.PropertyName);
+    return name !== null && (name === "length" || ARRAY_POSITION_KEY.test(name));
+  });
+}
+
+/** An object pattern of positions and `length` over an array: each
+ * position is the read the equivalent array pattern makes, and `length`
+ * the array's length (always present, so its default never runs). */
+function lowerArrayPositionObjectPattern(
+  lowerer: Lowerer,
+  pattern: ts.ObjectBindingPattern,
+  srcRef: () => IrExpr,
+  srcType: IrType & { kind: "array" },
+  isLet: boolean,
+  out: IrStmt[],
+): void {
+  for (const el of pattern.elements.nodes) {
+    if (el.name === undefined) continue;
+    const name = patternKeyNameOf(lowerer, (el.propertyName ?? el.name) as ts.PropertyName)!;
+    const value: IrExpr =
+      name === "length"
+        ? {
+            kind: "arrIntrinsic",
+            method: "length",
+            receiver: srcRef(),
+            args: [],
+            type: F64,
+            loc: locOf(el),
+          }
+        : arrayPositionBinding(lowerer, el, srcRef, srcType, Number(name), out);
+    lowerer.bindPatternTarget(el.name, value, isLet, out);
+  }
+}
+
 /** Decode one non-rest object-assignment property into its static source
  * field, destination expression, and optional default initializer. */
 function destructuringPropertyOf(
@@ -4014,7 +4273,7 @@ function objectRestValue(
       ),
     };
   });
-  return { kind: "recordLit", fields, type: restT, loc };
+  return lowerer.keyOrder.copy({ kind: "recordLit", fields, type: restT, loc }, srcType.shapeId);
 }
 
 /** The fresh record for `{ a, ...rest }` over a CLASS-INSTANCE source:
@@ -4197,6 +4456,8 @@ export function bindPatternTarget(
     const symbol = lowerer.checker.getSymbolAtLocation(name);
     const g = symbol ? lowerer.globalsBySymbol.get(symbol) : undefined;
     if (g) {
+      if (value.type.kind === "dyn" && jsBindingKeepsCheckedObject(lowerer, name, g.type))
+        g.type = DYN;
       out.push({
         kind: "assign",
         localId: g.id,
@@ -4213,7 +4474,7 @@ export function bindPatternTarget(
     // here by declareParams) carry no block-scope flag either, but their
     // bindings are the parameters' own.
     if (symbol && hostVariableDeclarationOf(name) !== null && isVarDeclared(name)) {
-      const hoisted = hoistVarBinding(lowerer, symbol, name);
+      const hoisted = hoistVarBinding(lowerer, symbol, name, value.type);
       out.push({
         kind: "assign",
         localId: hoisted.id,
@@ -4228,7 +4489,7 @@ export function bindPatternTarget(
       value.type.kind === "dyn" &&
       (() => {
         const mapped = lowerer.mapTypeOf(lowerer.typeOf(name));
-        return mapped === null;
+        return mapped === null || jsBindingKeepsCheckedObject(lowerer, name, mapped);
       })();
     let type = dynStays
       ? DYN
@@ -4564,6 +4825,7 @@ export function lowerVarDecl(
   // alias plumbing (see stdlibGlobalAliasDecl), no storage, no code.
   const stableStdlibAlias =
     !isLet ||
+    stdlibBufferVarAlias(lowerer, decl) ||
     (ts.isVariableDeclarationList(decl.parent) &&
       (decl.parent.flags & ts.NodeFlags.Let) !== 0 &&
       ts.isIdentifier(decl.name) &&
@@ -4711,7 +4973,11 @@ export function lowerVarDecl(
       !decl.type &&
       !hasJsTypeAnnotation(decl) &&
       raw.type.kind === "dyn" &&
-      (g.type.kind === "record" || g.type.kind === "object")
+      (g.type.kind === "record" ||
+        g.type.kind === "object" ||
+        (ts.isIdentifier(decl.name) &&
+          jsBindingKeepsCheckedObject(lowerer, decl.name, g.type) &&
+          (existingValueForm(decl.initializer) || jsHoldsDynObject(lowerer, decl.initializer))))
     )
       g.type = DYN;
     g.type = inferredOptionalRecordType(lowerer, decl, g.type, raw.type);
@@ -4758,6 +5024,8 @@ export function lowerVarDecl(
   // types already hold the interned undefined arm), and a declaration
   // re-run in a loop must not reset the persisting value.
   if (isVarDeclared(decl) && declSymbol) {
+    const fromExisting = lowerJsVarFromExisting(lowerer, decl, declSymbol);
+    if (fromExisting) return fromExisting;
     const local = hoistVarBinding(lowerer, declSymbol, decl.name);
     if (!decl.initializer) return null;
     const init = lowerer.lowerExprExpecting(decl.initializer, local.type);
@@ -4918,9 +5186,16 @@ export function lowerVarDecl(
             lowerer.unions.get(inferredObjectType.unionId)?.arms.every(isUnitType))))) &&
     !decl.type &&
     !hasJsTypeAnnotation(decl);
+  // The binding of an assertion of the global object holds that object,
+  // whatever its asserted type (assertion-identity.ts).
+  const keepsAssertedObject =
+    init.type.kind === "dyn" &&
+    !decl.type &&
+    keptIdentityAssertion(lowerer, decl.initializer) !== undefined;
   if (
     expandsObject ||
     preservesObjectIdentity ||
+    keepsAssertedObject ||
     (isJsSourceFile(decl.getSourceFile()) &&
       !decl.type &&
       isNativeBuiltinValueInitializer(lowerer, decl.initializer))
@@ -5133,7 +5408,7 @@ export function lowerVarDecl(
     ? npmStaticOptionalSelfWriteType(lowerer, decl, settledType)
     : null;
   settledType =
-    expandsObject || preservesObjectIdentity
+    expandsObject || preservesObjectIdentity || keepsAssertedObject
       ? DYN
       : lowerer.runtimeOptionalBindingType(decl.name, settledType);
   if (optionalSelfWriteType !== null) settledType = optionalSelfWriteType;
@@ -5977,6 +6252,28 @@ function lowerDeleteStatement(lowerer: Lowerer, expr: ts.DeleteExpression): IrSt
     };
   }
   let obj = lowerer.lowerExpr(target.expression);
+  // `delete this.stack` in an Error subclass that declares a `stack`
+  // accessor (quickjs-wasi's JSException): V8 gives each error an own
+  // `stack` that shadows the accessor, and the delete removes it so reads
+  // reach the accessor. Compiled errors keep the trace internally and
+  // class dispatch already reads the accessor, so only the receiver's
+  // evaluation remains.
+  if (
+    obj.type.kind === "object" &&
+    ts.isPropertyAccessExpression(target) &&
+    target.name.text === "stack"
+  ) {
+    let accessor = false;
+    let errorBase = false;
+    for (let c = lowerer.classes.get(obj.type.className); c; c = c.base ?? undefined) {
+      if (c.builtinError) {
+        errorBase = true;
+        break;
+      }
+      if (c.methods.has("get:stack")) accessor = true;
+    }
+    if (accessor && errorBase) return { kind: "exprStmt", expr: obj, loc };
+  }
   if (isJsSourceFile(expr.getSourceFile()) && obj.type.kind === "object") {
     const info = lowerer.classes.get(obj.type.className);
     const keyType = ts.isElementAccessExpression(target)
@@ -6168,7 +6465,10 @@ function lowerCjsExportStatement(
     // storage — collectGlobals skipped it; importers re-resolve through
     // cjsMemberExportClassSymbol): the statement lowers to nothing.
     if (lowerer.cjsMemberExportClassSymbol(cjs.expr) !== null) {
-      return { kind: "block", body: [], loc };
+      // An inline require still evaluates its module here.
+      const req = inlineProgramRequireOf(lowerer, cjs.value);
+      const init = req !== null ? lowerer.requireInitStmt(req.spec, req.call) : null;
+      return init ?? { kind: "block", body: [], loc };
     }
     // The tsc VOID-INIT PREAMBLE (`exports.leaf = void 0;` with the real
     // `exports.leaf = leaf;` further down — every tsc-emitted dist file
@@ -6401,10 +6701,7 @@ function lowerCjsSingleValueExport(
     // own statement already evaluated it), and a builtin global
     // (`module.exports = TypeError`) is the global itself: requirer
     // bindings alias straight through to it, so nothing is stored.
-    if (
-      lowerer.checker.declarationsOf(sym).some((d) => ts.isSourceFile(d)) ||
-      lowerer.isStdlibSymbol(sym)
-    ) {
+    if (sym.declarations.some((d) => ts.isSourceFile(d)) || lowerer.isStdlibSymbol(sym)) {
       return { kind: "block", body: [], loc };
     }
     const g = lowerer.globalsBySymbol.get(sym);
@@ -6523,10 +6820,7 @@ export function lowerExprStatement(lowerer: Lowerer, expr: ts.Expression): IrStm
   // positions keep the first-class-namespace fences.
   if (ts.isIdentifier(expr)) {
     const sym = lowerer.checker.getSymbolAtLocation(expr);
-    if (
-      sym !== undefined &&
-      lowerer.checker.declarationsOf(sym).some((d) => ts.isNamespaceImport(d))
-    ) {
+    if (sym !== undefined && sym.declarations.some((d) => ts.isNamespaceImport(d))) {
       return { kind: "block", body: [], loc: locOf(expr) };
     }
   }
@@ -7016,6 +7310,32 @@ export function lowerExprStatement(lowerer: Lowerer, expr: ts.Expression): IrStm
               loc,
             };
           }
+          // process.emitWarning = fn: an ordinary writable property. Later
+          // process.emitWarning(...) calls, and the warnings Node's own
+          // modules emit through process.emitWarning, call the replacement
+          // instead (silencing them when it does nothing).
+          if (flag === "emitWarning") {
+            const loc = locOf(expr);
+            let rhs: ts.Expression = expr.right;
+            while (
+              ts.isParenthesizedExpression(rhs) ||
+              ts.isAsExpression(rhs) ||
+              ts.isSatisfiesExpression(rhs)
+            )
+              rhs = rhs.expression;
+            const value = lowerer.lowerExprExpecting(rhs, DYN);
+            return {
+              kind: "exprStmt",
+              expr: {
+                kind: "libCall",
+                fn: "process.setEmitWarning",
+                args: [value],
+                type: VOID,
+                loc,
+              },
+              loc,
+            };
+          }
           // process.title = name: libuv's uv_set_process_title (the
           // runtime truncates to the original argument area on POSIX).
           if (flag === "title") {
@@ -7302,6 +7622,15 @@ export function lowerExprStatement(lowerer: Lowerer, expr: ts.Expression): IrStm
   if (droppedPureStdlibStatement(lowerer, expr)) {
     return { kind: "block", body: [], loc: locOf(expr) };
   }
+  if (
+    stmtNode !== undefined &&
+    ts.isExpressionStatement(stmtNode) &&
+    ts.isBinaryExpression(expr) &&
+    (expr.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken ||
+      expr.operatorToken.kind === ts.SyntaxKind.BarBarToken)
+  ) {
+    return lowerDiscardedLogical(lowerer, expr);
+  }
   const value = lowerer.lowerExpr(expr);
   // A bare unit-literal statement (`undefined;`): a pure no-op in JS,
   // and the IR has no bare-unit VALUE outside a union wrap — drop it
@@ -7310,6 +7639,59 @@ export function lowerExprStatement(lowerer: Lowerer, expr: ts.Expression): IrStm
   return { kind: "exprStmt", expr: value, loc: locOf(expr) };
 }
 
+/** A discarded `a && b` / `a || b` statement (the minifier's `if`). The
+ * value form lowers first, exactly as before. Only when it fails on the
+ * logical's own result type — the operands have no common representation
+ * (jose's `(!m || m[4] && m[1]) && invalid()` joins a boolean, a string
+ * and undefined into the checker's `string`) — does the statement lower
+ * as the control flow it is: `if (a) b;` / `if (!a) b;`, a condition test
+ * that needs no result value. Diagnostics outside the statement, and
+ * internal errors, keep the original failure. */
+function lowerDiscardedLogical(lowerer: Lowerer, expr: ts.BinaryExpression): IrStmt {
+  const diagsBefore = lowerer.diags.length;
+  try {
+    const value = lowerer.lowerExpr(expr);
+    if (value.kind === "unitLit") return { kind: "block", body: [], loc: locOf(expr) };
+    return { kind: "exprStmt", expr: value, loc: locOf(expr) };
+  } catch (e) {
+    // A probe (a capture buffer is active) keeps its failure: its owner
+    // picks another lowering, exactly as before.
+    if (!(e instanceof PoisonError) || lowerer.diagSink !== null) throw e;
+    const added = lowerer.diags.slice(diagsBefore);
+    const file = expr.getSourceFile().fileName;
+    const start = expr.getStart();
+    const local =
+      added.length > 0 &&
+      added.every(
+        (d) =>
+          d.code !== "SC9001" &&
+          d.loc.file === file &&
+          d.loc.start >= start &&
+          d.loc.end <= expr.end,
+      );
+    if (!local) throw e;
+    lowerer.diags.length = diagsBefore;
+  }
+  const and = expr.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken;
+  const cond = lowerer.lowerCondition(expr.left);
+  if (cond.kind === "boolLit") {
+    return cond.value === and
+      ? lowerExprStatement(lowerer, expr.right)
+      : { kind: "block", body: [], loc: locOf(expr) };
+  }
+  const right = (): IrStmt[] =>
+    lowerer.narrowingAliases(aliasTypeofNarrows(lowerer, expr.left, and), () =>
+      and
+        ? withRuntimeOptionalNarrowed(lowerer, runtimeOptionalTrueIds(lowerer, expr.left), () => [
+            lowerExprStatement(lowerer, expr.right),
+          ])
+        : [lowerExprStatement(lowerer, expr.right)],
+    );
+  return and
+    ? { kind: "if", cond, then: right(), else_: [], loc: locOf(expr) }
+    : { kind: "if", cond, then: [], else_: right(), loc: locOf(expr) };
+}
+
 /** True for a statement-position expression whose evaluation cannot be
  * observed once the value is discarded:
  *   - a property/element READ (`?.` included) whose receiver IS a
@@ -7907,22 +8289,25 @@ function destructuringAssignInto(
           ),
         );
       }
-      const packed: IrExpr = {
-        kind: "recordLit",
-        fields: remaining.map((f): Extract<IrExpr, { kind: "recordLit" }>["fields"][number] => ({
-          name: f.name,
-          value: {
-            kind: "recordGet",
-            obj: { kind: "varRef", localId: tmp.id, type: srcType, loc: locOf(prop) },
-            shapeId: srcType.shapeId,
-            field: f.name,
-            type: f.type,
-            loc: locOf(prop),
-          },
-        })),
-        type: { kind: "record", shapeId: restShapeId },
-        loc: locOf(prop),
-      };
+      const packed: IrExpr = lowerer.keyOrder.copy(
+        {
+          kind: "recordLit",
+          fields: remaining.map((f): Extract<IrExpr, { kind: "recordLit" }>["fields"][number] => ({
+            name: f.name,
+            value: {
+              kind: "recordGet",
+              obj: { kind: "varRef", localId: tmp.id, type: srcType, loc: locOf(prop) },
+              shapeId: srcType.shapeId,
+              field: f.name,
+              type: f.type,
+              loc: locOf(prop),
+            },
+          })),
+          type: { kind: "record", shapeId: restShapeId },
+          loc: locOf(prop),
+        },
+        srcType.shapeId,
+      );
       if (!ts.isIdentifier(restTo)) {
         // `({ a, ...box.rest } = src)` — the rest packs identically and
         // lands through the property/element write machinery.
@@ -8526,6 +8911,10 @@ export function lowerForOf(lowerer: Lowerer, stmt: ts.ForOfStatement): IrStmt {
         }
       }
     }
+    {
+      const opened = classAsyncGeneratorIterator(lowerer, stmt.expression);
+      if (opened) return lowerForAwaitGenerator(lowerer, stmt, opened, labels);
+    }
     if (
       ts.isPropertyAccessExpression(stmt.expression) &&
       lowerer.stdlibGlobalMember(stmt.expression, "process") === "stdin"
@@ -9220,7 +9609,7 @@ export function lowerForOf(lowerer: Lowerer, stmt: ts.ForOfStatement): IrStmt {
     // local and the body opens by ASSIGNING it into the one hoisted
     // binding — closures capture the shared slot, and the value persists
     // after the loop (both Node-exact for var).
-    const varTarget = forOfVarTarget(lowerer, decl);
+    const varTarget = forOfVarTarget(lowerer, decl, elemValueT);
     if (varTarget) {
       const elemType = elemValueT;
       const loc = locOf(decl.name);
@@ -9956,7 +10345,7 @@ function lowerForOfDyn(
           binds,
         );
       } else if (ts.isIdentifier(decl.name)) {
-        const varTarget = forOfVarTarget(lowerer, decl);
+        const varTarget = forOfVarTarget(lowerer, decl, DYN);
         if (varTarget) {
           // `for (var x of d)`: the element mechanics stay on a hidden
           // per-iteration local; the body opens by assigning the ONE
@@ -10800,3 +11189,25 @@ export function lowerForStatement(lowerer: Lowerer, stmt: ts.ForStatement): IrSt
     lowerer.scopes.pop();
   }
 }
+
+/** safe-buffer's `var Buffer = buffer.Buffer` at file scope: a `var` alias
+ * of the global Buffer is the same alias plumbing as the const spelling
+ * when nothing reassigns it and no code that runs before the declaration
+ * can read it (the require-binding early-reference analysis), so the
+ * hoisted undefined is unobservable. */
+export function stdlibBufferVarAlias(lowerer: Lowerer, decl: ts.VariableDeclaration): boolean {
+  if (
+    !ts.isIdentifier(decl.name) ||
+    !ts.isVariableDeclarationList(decl.parent) ||
+    (decl.parent.flags & (ts.NodeFlags.Let | ts.NodeFlags.Const)) !== 0 ||
+    decl.initializer === undefined ||
+    !bufferNamespaceMember(lowerer, decl.initializer)
+  )
+    return false;
+  const symbol = lowerer.checker.getSymbolAtLocation(decl.name);
+  return (
+    symbol !== undefined &&
+    bindingNeverReassigned(lowerer, symbol, decl) &&
+    requireEarlyReference(lowerer.program, decl) === null
+  );
+}
diff --git a/packages/compiler/src/frontend/lowering/lower-stream.ts b/packages/compiler/src/frontend/lowering/lower-stream.ts
index 7639e0974..5769e1e0a 100644
--- a/packages/compiler/src/frontend/lowering/lower-stream.ts
+++ b/packages/compiler/src/frontend/lowering/lower-stream.ts
@@ -492,7 +492,7 @@ function followOptionsArg(
     } catch {
       return node;
     }
-    const decl = sym ? lowerer.checker.valueDeclarationOf(sym) : undefined;
+    const decl = sym ? sym.valueDeclaration : undefined;
     if (!sym || !decl || !ts.isVariableDeclaration(decl) || decl.initializer === undefined)
       return node;
     if ((ts.getCombinedNodeFlags(decl) & ts.NodeFlags.Const) === 0) return node;
diff --git a/packages/compiler/src/frontend/lowering/lower-test.ts b/packages/compiler/src/frontend/lowering/lower-test.ts
index 5c6011425..32870c2cf 100644
--- a/packages/compiler/src/frontend/lowering/lower-test.ts
+++ b/packages/compiler/src/frontend/lowering/lower-test.ts
@@ -334,7 +334,7 @@ function staticFunctionName(lowerer: Lowerer, node: ts.Expression): string | nul
   if (!ts.isIdentifier(node)) return null;
   const symbol = lowerer.resolveValueSymbol(node);
   if (!symbol) return null;
-  for (const decl of lowerer.checker.declarationsOf(symbol)) {
+  for (const decl of symbol.declarations) {
     if (ts.isFunctionDeclaration(decl)) return decl.name?.text ?? "default";
     if (ts.isVariableDeclaration(decl) && ts.isIdentifier(decl.name) && decl.initializer) {
       let init = decl.initializer;
@@ -728,7 +728,7 @@ export function lowerTestDirectCall(
   if (!ts.isIdentifier(callee)) return null;
   if (lowerer.builtinNamespaceModuleOf(callee) !== "test") return null;
   const calleeSym = lowerer.checker.getSymbolAtLocation(callee);
-  const decl = calleeSym ? lowerer.checker.declarationsOf(calleeSym)[0] : undefined;
+  const decl = calleeSym ? calleeSym.declarations[0] : undefined;
   if (decl && ts.isNamespaceImport(decl)) {
     lowerer.unsupported(
       "SC1013",
diff --git a/packages/compiler/src/frontend/lowering/lower-timers.ts b/packages/compiler/src/frontend/lowering/lower-timers.ts
index 740ff66f1..22983fbb4 100644
--- a/packages/compiler/src/frontend/lowering/lower-timers.ts
+++ b/packages/compiler/src/frontend/lowering/lower-timers.ts
@@ -330,7 +330,7 @@ function isRealTimerCallee(lowerer: Lowerer, callee: ts.Expression): boolean {
   if (ts.isIdentifier(callee)) return lowerer.builtinImportOf(callee)?.module === "timers";
   if (ts.isPropertyAccessExpression(callee) && ts.isIdentifier(callee.expression)) {
     const sym = lowerer.checker.getSymbolAtLocation(callee.expression);
-    const decl = sym ? lowerer.checker.declarationsOf(sym)[0] : undefined;
+    const decl = sym ? sym.declarations[0] : undefined;
     return decl !== undefined && ts.isNamespaceImport(decl);
   }
   return false;
diff --git a/packages/compiler/src/frontend/lowering/lowerer.test.ts b/packages/compiler/src/frontend/lowering/lowerer.test.ts
index 093c78632..bacdc7941 100644
--- a/packages/compiler/src/frontend/lowering/lowerer.test.ts
+++ b/packages/compiler/src/frontend/lowering/lowerer.test.ts
@@ -241,25 +241,26 @@ test("optional union widening keeps refused and missing contracts current", () =
 });
 
 test("stdlib provenance is cached by symbol identity, including merged and shadowed declarations", () => {
-  const builtin = {} as Symbol,
-    shadow = {} as Symbol;
   const userFile = { fileName: "user.ts" } as SourceFile;
   const library = { fileName: "library.d.ts" } as SourceFile;
   const userDeclaration = { getSourceFile: () => userFile } as Node;
   const libraryDeclaration = { getSourceFile: () => library } as Node;
-  const declarationsOf = vi.fn((symbol: Symbol) =>
-    symbol === builtin ? [userDeclaration, libraryDeclaration] : [userDeclaration],
-  );
-  const lowerer = new Lowerer(
-    { getTypeChecker: () => ({ declarationsOf }) } as unknown as Program,
-    userFile,
-    [],
-  );
+  let declarationReads = 0;
+  const symbolWith = (declarations: readonly Node[]): Symbol =>
+    ({
+      get declarations() {
+        declarationReads++;
+        return declarations;
+      },
+    }) as unknown as Symbol;
+  const builtin = symbolWith([userDeclaration, libraryDeclaration]),
+    shadow = symbolWith([userDeclaration]);
+  const lowerer = new Lowerer({ getTypeChecker: () => ({}) } as unknown as Program, userFile, []);
   vi.spyOn(lowerer, "isStdlibFile").mockImplementation((file) => file === library);
   for (let i = 0; i < 20; i++) {
     expect(lowerer.isStdlibSymbol(builtin)).toBe(true);
     expect(lowerer.isStdlibSymbol(shadow)).toBe(false);
     expect(lowerer.isStdlibSymbol(undefined)).toBe(false);
   }
-  expect(declarationsOf).toHaveBeenCalledTimes(2);
+  expect(declarationReads).toBe(2);
 });
diff --git a/packages/compiler/src/frontend/lowering/lowerer.ts b/packages/compiler/src/frontend/lowering/lowerer.ts
index b0985e36d..7144e574e 100644
--- a/packages/compiler/src/frontend/lowering/lowerer.ts
+++ b/packages/compiler/src/frontend/lowering/lowerer.ts
@@ -4,6 +4,7 @@ import {
   lowerLifetimeRegionCall,
   lowerLifetimeRegionNew,
 } from "./lifetime-regions.js";
+import type { ConstructorReturnPlan } from "./constructor-returns.js";
 import { internTableType, lowerInternTableCall, lowerInternTableNew } from "./intern-tables.js";
 import { lowerThreadSlotsCall, lowerThreadSlotsNew, threadSlotsType } from "./thread-slots.js";
 import { isExperimentalDeclarationFile } from "../experimental-import.js";
@@ -20,6 +21,7 @@ import {
 } from "./require-initialization.js";
 import { identityPreservingWidening } from "./coercions/identity.js";
 import { scanDivergences } from "./divergences.js";
+import { applyKeyOrderWitnesses, KeyOrderNotes } from "./key-order-witness.js";
 import { checkedClassAssertion } from "./class-assertions.js";
 import { narrowStoredClassValue, narrowGenericClassValue } from "./class-unions.js";
 import { isOptionalProcessStreamProperty } from "./builtins/process.js";
@@ -31,6 +33,7 @@ import { refuseWebAssemblyUse } from "./builtins/webassembly.js";
 import { discoverWasmModules, type WasmModuleReport } from "../../wasm/discover.js";
 import { resolveRequireRuntime } from "../runtime-resolve.js";
 import { lowerKeyObjectCall } from "./builtins/key-object.js";
+import { fenceWebCryptoMember, lowerWebCryptoCall } from "./builtins/webcrypto.js";
 import { hashStreamOf } from "./builtins/hash-stream.js";
 import { lowerNetAddressCall, lowerNetAddressNew } from "./builtins/net-address.js";
 import { dynUndefinedExpr, nodeThrowExpr, numLit, varRef } from "../../ir/build.js";
@@ -72,6 +75,7 @@ import {
   uninhabitedArmRetagHelper,
   strandedUnitTrap,
   strandedCoercionTrap,
+  recordUnionRouteHelper,
   recordUnionWrapHelper,
   unionRetagHelper,
   narrowedArmHelper,
@@ -116,6 +120,7 @@ import { ClassProtocols } from "./class-protocols.js";
 import { earlyReadVarSymbols } from "./var-hoisting.js";
 import { recordTextCodecClass } from "../../ir/ir.js";
 import { assignLegacyTiers, type DynamicFunction } from "../../ir/tiers.js";
+import { promoteJsvals } from "../../ir/jsval.js";
 import {
   analyzeTiers,
   dynamicStatementCount,
@@ -124,7 +129,8 @@ import {
 } from "../tier-analysis.js";
 import { DeferredModuleInitializers } from "./deferred-module-initializers.js";
 import { finalizeClassMethodValues } from "./class-method-values.js";
-import type { ClassSymbolKey } from "./symbol-fields.js";
+import { finalizePrivateBrands } from "./private-brands.js";
+import { type ClassSymbolKey, tableKeyFieldType } from "./symbol-fields.js";
 import type { HttpClientFnBinding } from "./lower-server.js";
 export type { WidthLift } from "./width-lift.js";
 export { newFnCtx, type FnCtx } from "./function-context.js";
@@ -294,6 +300,7 @@ import {
 import { prepareCjsModuleGraph, usesCjsTopLevelThis } from "./lower-node-module.js";
 import {
   cjsNamespaceModule,
+  cjsWholeExportValueOf,
   inlineNamespaceRequireOf,
   inlineProgramRequireOf,
 } from "./cjs-inline-require.js";
@@ -474,6 +481,8 @@ import { lowerConsoleNew } from "./lower-console.js";
 import { lowerNumberStaticCall, lowerNumberStaticProperty } from "./builtins/numbers.js";
 import { dateJsonType, isDateJsonSource, lowerDateCall } from "./builtins/dates.js";
 import {
+  fsConstantMemberRead,
+  fsConstantsObject,
   lowerFsConstantsProperty,
   lowerBuiltinConstantsProperty,
   builtinConstantBindingOf,
@@ -1193,9 +1202,9 @@ export function staticImportNamespaceType(
     const symbol = lowerer.checker.getSymbolAtLocation(arg);
     const source =
       symbol &&
-      lowerer.checker
-        .declarationsOf(symbol)
-        .find((decl): decl is ts.SourceFile => ts.isSourceFile(decl) && !decl.isDeclarationFile);
+      symbol.declarations.find(
+        (decl): decl is ts.SourceFile => ts.isSourceFile(decl) && !decl.isDeclarationFile,
+      );
     if (
       source &&
       !source.fileName.endsWith(".cts") &&
@@ -1450,7 +1459,7 @@ function jsFallbackFunctionType(lowerer: Lowerer, node: ts.Node, t: ts.Type): Ir
     // slot. JS inference reports the body type (`boolean` for
     // `enabled = true`) rather than that call-site type, so recover the
     // syntactic optionality from the parameter declaration.
-    const decl = lowerer.checker.valueDeclarationOf(p);
+    const decl = p.valueDeclaration;
     mapped = jsOpenObjectType(decl, mapped, lowerer.shapes, lowerer.unions);
     const optional =
       decl !== undefined &&
@@ -1462,7 +1471,7 @@ function jsFallbackFunctionType(lowerer: Lowerer, node: ts.Node, t: ts.Type): Ir
     return mapped;
   });
   const retT = lowerer.checker.getReturnTypeOfSignature(sig);
-  const sigDecl = lowerer.checker.signatureDeclaration(sig);
+  const sigDecl = sig.declaration;
   const jsUnitReturn =
     sigDecl !== undefined &&
     isJsSourceFile(sigDecl.getSourceFile()) &&
@@ -1491,7 +1500,7 @@ function jsArgumentsFunctionType(lowerer: Lowerer, t: ts.Type): IrType | null {
     lowerer.checker.getPropertiesOfType(t).length !== 0
   )
     return null;
-  const decl = lowerer.checker.signatureDeclaration(sigs[0]!);
+  const decl = sigs[0]!.declaration;
   if (
     decl === undefined ||
     !(
@@ -1537,14 +1546,14 @@ function pureSingleCallSignatureOf(lowerer: Lowerer, t: ts.Type): ts.Signature |
     lowerer.checker.getConstructSignatures(t).length === 0 &&
     sigs[0]!.getTypeParameters().length === 0 &&
     sigs[0]!.getParameters().every((p) => {
-      const pDecl = lowerer.checker.valueDeclarationOf(p);
+      const pDecl = p.valueDeclaration;
       return !pDecl || !ts.isParameter(pDecl) || pDecl.dotDotDotToken === undefined;
     }) &&
     // A SYNTHESIZED rest param (tsc's `arguments` inference — no
     // valueDeclaration to carry the dotDotDot): param-count mismatch
     // against the signature's declaration; the whole value stays dyn.
     (() => {
-      const sigDecl = lowerer.checker.signatureDeclaration(sigs[0]!);
+      const sigDecl = sigs[0]!.declaration;
       const declParams =
         sigDecl !== undefined && ts.isFunctionLike(sigDecl) ? sigDecl.parameters.nodes : undefined;
       if (declParams !== undefined && declParams.length !== sigs[0]!.getParameters().length)
@@ -1600,7 +1609,7 @@ export function jsFuncNameOf(node: ts.Node, lowerer?: Lowerer): string | null {
     const symbol = lowerer.resolveValueSymbol(n);
     if (!symbol || seen.has(symbol)) break;
     seen.add(symbol);
-    const declaration = lowerer.checker.valueDeclarationOf(symbol);
+    const declaration = symbol.valueDeclaration;
     if (declaration && ts.isFunctionDeclaration(declaration)) {
       n = declaration;
       break;
@@ -1718,7 +1727,7 @@ export class Lowerer {
   get stringIndexBounds(): StringIndexBounds {
     this.stringIndexBoundsCache ??= new StringIndexBounds(
       (node) => this.checker.getSymbolAtLocation(node) ?? null,
-      (symbol) => this.checker.valueDeclarationOf(symbol),
+      (symbol) => symbol.valueDeclaration,
       (node) => (this.typeOf(node).flags & ts.TypeFlags.StringLike) !== 0,
     );
     return this.stringIndexBoundsCache;
@@ -1954,6 +1963,9 @@ export class Lowerer {
    * their symbol/node keys; no module-level cache should retain a pass. */
   readonly classSymbolKeys = new Map<ts.Symbol, ClassSymbolKey | null>();
   readonly registeredClassSymbols = new Map<string, ts.Symbol>();
+  /** Symbol-key identities by description, in resolution order (the slot
+   * ordinals of key-table keys — symbolKeyOf). */
+  readonly symbolFieldIdentities = new Map<string, ts.Symbol[]>();
   readonly httpClientFnBindings = new Map<ts.Symbol, HttpClientFnBinding>();
   streamPropMutatedSyms: Set<ts.Symbol> | null = null;
   requestInitPropMutatedSyms: Set<ts.Symbol> | null = null;
@@ -2080,7 +2092,7 @@ export class Lowerer {
     // directly from the aliased declaration as a final read-side hook, so
     // the initializer cannot fall back to a narrowing adapter.
     if (ts.isIdentifier(node) && fallback?.kind === "func") {
-      const decl = this.checker.valueDeclarationOf(symbol);
+      const decl = symbol.valueDeclaration;
       if (
         decl &&
         ts.isVariableDeclaration(decl) &&
@@ -2108,6 +2120,51 @@ export class Lowerer {
     return fallback ?? null;
   }
 
+  /** A TypeScript object literal handed to a JavaScript checked-value
+   * parameter whose inferred type is open (`constructor({ factory, ...options
+   * } = {})` — the rest element admits any property): the literal names a
+   * property the contextual JS type does not declare, so it has no record
+   * layout there and is built as the plain object the JS side receives. */
+  private excessJsContextualProperty(
+    literal: ts.ObjectLiteralExpression,
+    contextual: readonly ts.Type[],
+  ): boolean {
+    const objects = contextual.filter(
+      (part) => !(part.flags & (ts.TypeFlags.Undefined | ts.TypeFlags.Null)),
+    );
+    if (objects.length === 0) return false;
+    // Only a destructuring pattern with a rest element is open; other
+    // inferred JS types keep their record lowering.
+    const fromJs = objects.every((part) => {
+      const sym = part.getSymbol();
+      return (
+        sym !== undefined &&
+        sym.declarations.some((d) => {
+          if (!isJsSourceFile(d.getSourceFile())) return false;
+          // The pattern itself, or the `= {}` default of a pattern parameter.
+          const pattern =
+            ts.isObjectLiteralExpression(d) &&
+            d.parent !== undefined &&
+            ts.isParameter(d.parent) &&
+            d.parent.initializer === d
+              ? d.parent.name
+              : d;
+          return (
+            ts.isObjectBindingPattern(pattern) &&
+            pattern.elements.nodes.some((element) => element.dotDotDotToken !== undefined)
+          );
+        })
+      );
+    });
+    if (!fromJs) return false;
+    return literal.properties.nodes.some((prop) => {
+      if (!prop.name || !(ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name)))
+        return false;
+      const name = prop.name.text;
+      return objects.every((part) => !this.checker.getPropertyOfType(part, name));
+    });
+  }
+
   /** The index value of a keyed read of a record's index signature that
    * can answer undefined for a missing key while its checker type does not
    * admit undefined, or null. A literal key naming a declared field is a
@@ -2439,6 +2496,9 @@ export class Lowerer {
    * Reachability lowers inits before the declarations they discover, so
    * these rebuild after the worklist restores historical shape metadata. */
   readonly shapeOrderHelperFinalizers: (() => void)[] = [];
+  /** Construction witnesses that choose each shape's enumeration order
+   * once lowering settles (key-order-witness.ts). */
+  readonly keyOrder = new KeyOrderNotes();
   /** Emit-override specializations (`%C.emit:<event>` — lower-event-emitter.ts's
    * emit-overrides block): interned names, the drive-loop queue, and the
    * currently-lowering specialization's context (the super-forward
@@ -2450,6 +2510,9 @@ export class Lowerer {
   /** Generated value helpers, keyed by operation and type. Callers own
    * their key prefixes; this includes more than structural conversions. */
   readonly valueHelpers = new Map<string, string>();
+  /** structuralNarrowing's assignable classes, keyed by static and
+   * narrowed class name. */
+  readonly structuralClassPeers = new Map<string, readonly string[]>();
 
   /** Interned node:assert helpers (deep-equality comparisons keyed by
    * typeKey, throws wrappers keyed by callback type + expected class) —
@@ -2531,6 +2594,8 @@ export class Lowerer {
    * so named imports, namespace reads, CommonJS bindings, and alias chains
    * all reuse one immortal zero-capture closure. */
   readonly builtinCallableValueFns = new Map<string, string>();
+  /** Each builtin function-value adapter's Node name, for boxed values. */
+  readonly builtinCallableValueNames = new Map<string, string>();
   /** Optional-chain lowering state. While a chain body lowers, the guarded
    * receiver NODE reads as a chainRecv (typed by the narrowed arm) instead
    * of re-lowering, its checker type reads non-nullish (typeOf), and the
@@ -2816,6 +2881,16 @@ export class Lowerer {
    * by class name (cycle-initialization.ts). */
   readonly classInitFlags = new Map<string, CycleInitFlag>();
   readonly cycleInitDeclarations = new Map<ts.Statement, CycleInitFlag[]>();
+  /** Each class's constructor return plan by class name
+   * (constructor-returns.ts); null when no return can yield an object. */
+  readonly constructorReturnPlans = new Map<string, ConstructorReturnPlan | null>();
+  /** Pointer-guarded (`tdz`) module bindings declared without an
+   * initializer (`let f: T;`): an initialization flag tracks their
+   * declaration (markCycleEarlyBindings). */
+  readonly uninitializedLexicalGlobals = new Map<
+    string,
+    { name: ts.Identifier; module: ts.SourceFile; symbol: ts.Symbol }
+  >();
   /** CommonJS require declarations whose bindings code running before the
    * require can read, and those references (require-initialization.ts). */
   readonly requireInitFlags = new Map<ts.VariableDeclaration, RequireInitFlag>();
@@ -3150,15 +3225,39 @@ export class Lowerer {
 
   /** Declared class fields may store a DYN value only when its static type
    * is `unknown` or `object` (also with `null` or `undefined`, or an array
-   * of those), names checked protocol identity, or is an owned runtime
-   * handle (a Worker or MessagePort, or a fetch Headers/Request/Response);
-   * `any` fields stay refused. */
+   * of those), names checked protocol identity, is an owned runtime
+   * handle (a Worker or MessagePort, or a fetch Headers/Request/Response),
+   * or is a WeakMap/WeakSet (native weak collections live in
+   * checked-dynamic storage, as locals of those types do); `any` fields
+   * stay refused. */
   classFieldStoresDyn(type: ts.Type): boolean {
     return (
       this.opaqueValueType(type) ||
       this.classImplementedProtocol(type) ||
       isWorkerHandleType(type, this.typeCtx) ||
-      isFetchHandleType(type, this.typeCtx)
+      isFetchHandleType(type, this.typeCtx) ||
+      this.weakCollectionType(type)
+    );
+  }
+
+  /** A stdlib WeakMap or WeakSet, alone or with `null`/`undefined`. */
+  private weakCollectionType(type: ts.Type): boolean {
+    const weak = (part: ts.Type): boolean => {
+      const symbol = part.getSymbol();
+      return (
+        (symbol?.name === "WeakMap" || symbol?.name === "WeakSet") &&
+        symbol.declarations.some(
+          (d) => ts.isInterfaceDeclaration(d) && this.isStdlibFile(d.getSourceFile()),
+        )
+      );
+    };
+    if (!type.isUnionType()) return weak(type);
+    const parts = ts.constituentTypes(type);
+    return (
+      parts.some(weak) &&
+      parts.every(
+        (part) => (part.flags & (ts.TypeFlags.Null | ts.TypeFlags.Undefined)) !== 0 || weak(part),
+      )
     );
   }
 
@@ -3187,7 +3286,7 @@ export class Lowerer {
     let sym = type.getSymbol();
     if (!sym) return null;
     if (sym.flags & ts.SymbolFlags.Alias) sym = this.checker.getAliasedSymbol(sym);
-    for (const decl of this.checker.declarationsOf(sym)) {
+    for (const decl of sym.declarations) {
       if (
         ts.isSourceFile(decl) &&
         !decl.isDeclarationFile &&
@@ -3451,7 +3550,7 @@ export class Lowerer {
    * every project-module spelling. */
   private moduleSourceFileOf(from: ts.SourceFile, spec: ts.StringLiteral): ts.SourceFile | null {
     const moduleSymbol = this.checker.getSymbolAtLocation(spec);
-    for (const decl of moduleSymbol ? this.checker.declarationsOf(moduleSymbol) : []) {
+    for (const decl of moduleSymbol ? moduleSymbol.declarations : []) {
       if (ts.isSourceFile(decl)) return decl;
     }
     return resolveImport(this.program, from, spec.text);
@@ -3496,9 +3595,7 @@ export class Lowerer {
     }
     if (!ts.isIdentifier(value)) return null;
     const symbol = this.checker.getSymbolAtLocation(value);
-    const namespaceDecl = symbol
-      ? this.checker.declarationsOf(symbol).find(ts.isNamespaceImport)
-      : undefined;
+    const namespaceDecl = symbol ? symbol.declarations.find(ts.isNamespaceImport) : undefined;
     if (namespaceDecl === undefined) return null;
     const importDecl = namespaceDecl.parent?.parent;
     if (!ts.isImportDeclaration(importDecl) || !ts.isStringLiteral(importDecl.moduleSpecifier))
@@ -3518,7 +3615,7 @@ export class Lowerer {
   ): string | null {
     if (symbol === undefined || seenSymbols.has(symbol)) return null;
     seenSymbols.add(symbol);
-    const declarations = this.checker.declarationsOf(symbol);
+    const declarations = symbol.declarations;
 
     // Route-aware alias hops run before declaration-file ownership. An
     // exact import must keep the specifier it actually named, rather than
@@ -3587,9 +3684,9 @@ export class Lowerer {
     let sym: ts.Symbol | undefined = alias;
     for (let hop = 0; sym !== undefined && hop < 32; hop++) {
       if (hop > 0 && sym.flags & ts.SymbolFlags.Alias && this.globalsBySymbol.has(sym)) return sym;
-      const d = this.checker
-        .declarationsOf(sym)
-        .find((x) => ts.isImportClause(x) || ts.isImportSpecifier(x) || ts.isExportSpecifier(x));
+      const d = sym.declarations.find(
+        (x) => ts.isImportClause(x) || ts.isImportSpecifier(x) || ts.isExportSpecifier(x),
+      );
       let spec: ts.Expression | undefined;
       let name: string | undefined;
       if (d && ts.isImportClause(d) && ts.isImportDeclaration(d.parent)) {
@@ -3636,7 +3733,7 @@ export class Lowerer {
    * see resolveValueSymbol. Null when `symbol` is not such a property (or
    * the property's value is not a plain identifier reference). */
   private cjsExportValueSymbol(symbol: ts.Symbol): ts.Symbol | null {
-    const d = this.checker.declarationsOf(symbol)[0];
+    const d = symbol.declarations[0];
     if (!d) return null;
     // MEMBER-form class exports (`exports.C = C` — commander's error.js):
     // alias plumbing exactly like a table entry, so importers land on the
@@ -3672,17 +3769,38 @@ export class Lowerer {
         ? d.parent
         : null;
     if (!assign || assign.operatorToken.kind !== ts.SyntaxKind.EqualsToken) return null;
-    if (!ts.isIdentifier(assign.right)) return null;
     const stmt = assign.parent;
     if (!stmt || !ts.isExpressionStatement(stmt) || !ts.isSourceFile(stmt.parent)) return null;
     if (!isJsSourceFile(stmt.parent)) return null;
     const cjs = cjsExportAssignmentOf(stmt);
     if (cjs?.kind !== "member" || cjs.expr !== assign) return null;
     if (cjsExportDiscardReason(stmt) !== null) return null;
+    // `module.exports.C = require('./c')` over a module whose whole export
+    // is a class identifier: the same alias plumbing; the statement keeps
+    // the require's module evaluation at its position.
+    const required = this.memberExportRequiredClass(assign.right);
+    if (required !== undefined) return required;
+    if (!ts.isIdentifier(assign.right)) return null;
     let value = this.checker.getSymbolAtLocation(assign.right);
     if (!value) return null;
     if (value.flags & ts.SymbolFlags.Alias) value = this.checker.getAliasedSymbol(value);
-    const isClass = this.checker.declarationsOf(value).some((decl) => ts.isClassDeclaration(decl));
+    const isClass = value.declarations.some((decl) => ts.isClassDeclaration(decl));
+    return isClass ? value : null;
+  }
+
+  /** For an inline program `require("./c")`: the class symbol its module's
+   * kept `module.exports = <class identifier>` names, or null when the
+   * whole export is something else. Undefined when `expr` is not such a
+   * require. */
+  memberExportRequiredClass(expr: ts.Expression): ts.Symbol | null | undefined {
+    const req = inlineProgramRequireOf(this, expr);
+    if (req === null) return undefined;
+    const whole = cjsWholeExportValueOf(req.dep);
+    if (whole === null || !ts.isIdentifier(whole.rhs)) return null;
+    let value = this.checker.getSymbolAtLocation(whole.rhs);
+    if (!value) return null;
+    if (value.flags & ts.SymbolFlags.Alias) value = this.checker.getAliasedSymbol(value);
+    const isClass = value.declarations.some((decl) => ts.isClassDeclaration(decl));
     return isClass ? value : null;
   }
 
@@ -3728,7 +3846,7 @@ export class Lowerer {
    * member-symbol fallback and namespace classification in lockstep. */
   private localModuleBindingDepOf(expr: ts.Identifier): ts.SourceFile | null {
     const sym = this.checker.getSymbolAtLocation(expr);
-    const decls = sym ? this.checker.declarationsOf(sym) : [];
+    const decls = sym ? sym.declarations : [];
     const decl = decls.find(ts.isImportClause) ?? decls[0];
     if (!decl) return null;
     if (ts.isImportClause(decl)) return this.cjsDefaultImportDepOf(decl);
@@ -3756,31 +3874,27 @@ export class Lowerer {
    * static storage or callable/class metadata. */
   private createRequireWholeExportSymbolOf(ident: ts.Identifier): ts.Symbol | null {
     const binding = this.checker.getSymbolAtLocation(ident);
-    const decl = binding
-      ? this.checker.declarationsOf(binding).find(ts.isVariableDeclaration)
-      : undefined;
+    const decl = binding ? binding.declarations.find(ts.isVariableDeclaration) : undefined;
     if (!decl || !ts.isIdentifier(decl.name) || !decl.initializer) return null;
     const target = createRequireProgramModuleOf(this, decl.initializer);
     if (target === null) return null;
     const moduleSym = this.checker.getSymbolAtLocation(target.dep);
     let symbol = moduleSym?.getExports().get("export=" as ts.__String);
     if (!symbol) return null;
-    const wholeAssignment = this.checker
-      .declarationsOf(symbol)
-      .find((d): d is ts.BinaryExpression => {
-        if (
-          !ts.isBinaryExpression(d) ||
-          !ts.isExpressionStatement(d.parent) ||
-          !ts.isSourceFile(d.parent.parent)
-        )
-          return false;
-        const exported = cjsExportAssignmentOf(d.parent);
-        return (
-          exported?.kind === "table" &&
-          exported.obj === null &&
-          cjsExportDiscardReason(d.parent) === null
-        );
-      });
+    const wholeAssignment = symbol.declarations.find((d): d is ts.BinaryExpression => {
+      if (
+        !ts.isBinaryExpression(d) ||
+        !ts.isExpressionStatement(d.parent) ||
+        !ts.isSourceFile(d.parent.parent)
+      )
+        return false;
+      const exported = cjsExportAssignmentOf(d.parent);
+      return (
+        exported?.kind === "table" &&
+        exported.obj === null &&
+        cjsExportDiscardReason(d.parent) === null
+      );
+    });
     if (wholeAssignment === undefined) return null;
     let rhs: ts.Expression = wholeAssignment.right;
     while (ts.isParenthesizedExpression(rhs)) rhs = rhs.expression;
@@ -3807,9 +3921,7 @@ export class Lowerer {
    * target module's real export symbol. */
   private createRequireDestructuredExportSymbolOf(ident: ts.Identifier): ts.Symbol | null {
     const binding = this.checker.getSymbolAtLocation(ident);
-    const element = binding
-      ? this.checker.declarationsOf(binding).find(ts.isBindingElement)
-      : undefined;
+    const element = binding ? binding.declarations.find(ts.isBindingElement) : undefined;
     if (
       !element ||
       element.name === undefined ||
@@ -3857,7 +3969,7 @@ export class Lowerer {
     if (sym && sym.flags & ts.SymbolFlags.Alias) {
       // `module.exports = TypeError`: the binding IS the builtin global.
       if (this.isStdlibSymbol(this.checker.getAliasedSymbol(sym))) return false;
-      const d = this.checker.declarationsOf(this.checker.getAliasedSymbol(sym))[0];
+      const d = this.checker.getAliasedSymbol(sym).declarations[0];
       if (d && (ts.isClassDeclaration(d) || ts.isFunctionDeclaration(d))) return false;
       if (d && ts.isVariableDeclaration(d)) {
         let init = d.initializer;
@@ -3922,7 +4034,7 @@ export class Lowerer {
       if (g.type.kind === "func") g.type = this.runtimeOptionalBindingType(ident, g.type);
       return g;
     }
-    for (const d of this.checker.declarationsOf(symbol)) {
+    for (const d of symbol.declarations) {
       const byDecl = this.globalsByDeclNode.get(d);
       if (byDecl) return byDecl;
     }
@@ -4438,7 +4550,7 @@ export class Lowerer {
     };
     const recordFlows = new RecordFlowClasses(sourceFiles, {
       symbolOf,
-      declarationOf: (symbol) => this.checker.valueDeclarationOf(symbol),
+      declarationOf: (symbol) => symbol.valueDeclaration,
       mayBeRecord: (node) => {
         if (node.parent && ts.isParameter(node.parent))
           return plainRecordShape(parameterType(node)) !== null;
@@ -4469,7 +4581,7 @@ export class Lowerer {
     const nanCoded = new NanCodedReads(
       {
         symbolOf,
-        declarationOf: (symbol) => this.checker.valueDeclarationOf(symbol),
+        declarationOf: (symbol) => symbol.valueDeclaration,
         bytesElemOf: (receiver) => {
           const t = mappedOrNull(receiver);
           return t?.kind === "bytes" ? t.elem : null;
@@ -4521,7 +4633,7 @@ export class Lowerer {
       const seen = new Set<ts.Symbol>();
       while (symbol && !signatureBySymbol.has(symbol) && !seen.has(symbol)) {
         seen.add(symbol);
-        const declaration = this.checker.valueDeclarationOf(symbol);
+        const declaration = symbol.valueDeclaration;
         if (declaration && ts.isMethodDeclaration(declaration)) {
           symbol = symbolOf(declaration.name);
         } else if (
@@ -4666,7 +4778,7 @@ export class Lowerer {
       if (ts.isIdentifier(e)) {
         // A binding initialized from such a read and never reassigned.
         const symbol = symbolOf(e);
-        const decl = symbol ? this.checker.valueDeclarationOf(symbol) : undefined;
+        const decl = symbol ? symbol.valueDeclaration : undefined;
         return (
           symbol !== null &&
           !reassigned.has(symbol) &&
@@ -4707,7 +4819,7 @@ export class Lowerer {
       const read = peel(node);
       if (!ts.isElementAccessExpression(read) || !ts.isIdentifier(read.expression)) return false;
       const source = symbolOf(read.expression);
-      const declaration = source ? this.checker.valueDeclarationOf(source) : undefined;
+      const declaration = source ? source.valueDeclaration : undefined;
       if (!declaration || !ts.isVariableDeclaration(declaration) || !declaration.initializer)
         return false;
       const init = peel(declaration.initializer);
@@ -4936,7 +5048,7 @@ export class Lowerer {
      * exactly `T | undefined`: an assignment from a missing read stores the
      * undefined arm while the checker narrows later reads to `T`. */
     const optionalInstanceField = (symbol: ts.Symbol): boolean => {
-      const decl = this.checker.valueDeclarationOf(symbol);
+      const decl = symbol.valueDeclaration;
       if (!decl || !ts.isPropertyDeclaration(decl) || !ts.isIdentifier(decl.name)) return false;
       if (ts.getCombinedModifierFlags(decl) & ts.ModifierFlags.Static) return false;
       const sf = decl.getSourceFile();
@@ -5020,13 +5132,42 @@ export class Lowerer {
       return out;
     };
     const scanPattern = (name: ts.BindingName, init: ts.Expression): boolean => {
-      if (ts.isObjectBindingPattern(name)) return scanRecordPattern(name, init);
+      if (ts.isObjectBindingPattern(name)) {
+        // `const { 0: a, 1: b, length } = parts` reads positions like the
+        // equivalent array pattern: each may sit past the end.
+        // Regex match results keep their own pattern lowering.
+        const arrayType = this.mapTypeOf(this.typeOf(init));
+        const initType = this.checker.getNonNullableType(this.typeOf(init));
+        const initSymbol = initType.getAliasSymbol() ?? initType.getSymbol();
+        const matchResult =
+          initSymbol !== undefined &&
+          (initSymbol.name === "RegExpExecArray" || initSymbol.name === "RegExpMatchArray");
+        if (arrayType?.kind !== "array" || matchResult) return scanRecordPattern(name, init);
+        const positions = name.elements.nodes.filter((el) => {
+          const key = el.propertyName;
+          return (
+            key !== undefined && ts.isNumericLiteral(key) && /^(?:0|[1-9]\d{0,8})$/.test(key.text)
+          );
+        });
+        return scanPositions(positions, init, arrayType);
+      }
       if (!ts.isArrayBindingPattern(name)) return false;
       const sourceType = this.mapTypeOf(this.typeOf(init));
       if (sourceType?.kind !== "array") return false;
+      return scanPositions(
+        name.elements.nodes.filter((el): el is ts.BindingElement => !ts.isOmittedExpression(el)),
+        init,
+        sourceType,
+      );
+    };
+    const scanPositions = (
+      elements: readonly ts.BindingElement[],
+      init: ts.Expression,
+      sourceType: IrType & { kind: "array" },
+    ): boolean => {
       let changed = false;
-      name.elements.nodes.forEach((el) => {
-        if (ts.isOmittedExpression(el) || el.name === undefined || el.dotDotDotToken) return;
+      elements.forEach((el) => {
+        if (el.name === undefined || el.dotDotDotToken) return;
         if (ts.isIdentifier(el.name)) {
           const symbol = symbolOf(el.name);
           if (symbol && !el.initializer && !optionalSymbols.has(symbol)) {
@@ -5275,7 +5416,7 @@ export class Lowerer {
       // monomorphic ABI or poisons valid generic value programs.
       if (this.genericFnsBySymbol.has(symbol)) return false;
       seen.add(symbol);
-      const declaration = this.checker.valueDeclarationOf(symbol);
+      const declaration = symbol.valueDeclaration;
       if (declaration && ts.isVariableDeclaration(declaration) && declaration.initializer) {
         if (promoteHofCallback(peel(declaration.initializer), parameterIndices, seen))
           changed = true;
@@ -5409,7 +5550,7 @@ export class Lowerer {
       seen.add(symbol);
       const fn = functionDeclBySymbol.get(symbol);
       if (fn) return bodyReturnsOptional(fn);
-      const decl = this.checker.valueDeclarationOf(symbol);
+      const decl = symbol.valueDeclaration;
       return (
         !!decl &&
         ts.isVariableDeclaration(decl) &&
@@ -5490,7 +5631,7 @@ export class Lowerer {
     };
     const ownership = new ArrayOwnership(sourceFiles, {
       symbolOf,
-      declarationOf: (symbol) => this.checker.valueDeclarationOf(symbol),
+      declarationOf: (symbol) => symbol.valueDeclaration,
       typeOf: typeOrNull,
       instanceAssignableTo: (owner, target) =>
         panicSafe(
@@ -5515,7 +5656,7 @@ export class Lowerer {
         // flow type such as `Array.isArray(x)`'s `any[]` only narrows it.
         const e = peel(node);
         const symbol = ts.isIdentifier(e) ? symbolOf(e) : null;
-        const declaration = symbol ? this.checker.valueDeclarationOf(symbol) : undefined;
+        const declaration = symbol ? symbol.valueDeclaration : undefined;
         const declared =
           declaration &&
           (ts.isVariableDeclaration(declaration) || ts.isParameter(declaration)) &&
@@ -5837,7 +5978,7 @@ export class Lowerer {
           const assertion = forwardedAssertion(node.right);
           const symbol = assertion ? symbolOf(node.left) : null;
           // Only a variable's storage is promoted (see the final pass).
-          const declaration = symbol ? this.checker.valueDeclarationOf(symbol) : undefined;
+          const declaration = symbol ? symbol.valueDeclaration : undefined;
           if (
             assertion &&
             symbol &&
@@ -5923,9 +6064,7 @@ export class Lowerer {
             let nativeArrayReceiver = receiver?.kind === "array" || tuple;
             if (nativeArrayReceiver && ts.isIdentifier(receiverNode)) {
               const receiverSymbol = symbolOf(receiverNode);
-              const declaration = receiverSymbol
-                ? this.checker.valueDeclarationOf(receiverSymbol)
-                : undefined;
+              const declaration = receiverSymbol ? receiverSymbol.valueDeclaration : undefined;
               if (declaration && ts.isVariableDeclaration(declaration)) {
                 const declared = this.mapTypeOf(this.typeOf(declaration.name));
                 if (
@@ -5985,7 +6124,7 @@ export class Lowerer {
             // number) => ...`): a possibly missing argument widens that
             // parameter, as for a callback the same value is passed as.
             if (!ts.isIdentifier(node.expression) || reassigned.has(symbol)) return;
-            const declaration = this.checker.valueDeclarationOf(symbol);
+            const declaration = symbol.valueDeclaration;
             const value =
               declaration && ts.isVariableDeclaration(declaration) && declaration.initializer
                 ? peel(declaration.initializer)
@@ -6212,7 +6351,7 @@ export class Lowerer {
     // there, whatever its declared type.
     for (const symbol of earlyReadVarSymbols(this, sourceFiles)) {
       // Text codec bindings keep their own presence-checked storage.
-      const declaration = this.checker.valueDeclarationOf(symbol);
+      const declaration = symbol.valueDeclaration;
       const mapped =
         declaration && ts.isVariableDeclaration(declaration)
           ? mappedOrNull(declaration.name)
@@ -6788,6 +6927,7 @@ export class Lowerer {
   finishModule(functions: IrFunction[]): LowerResult {
     if (this.diags.length === 0) fuseArrayPipelines(this, functions);
     finalizeClassMethodValues(this, functions);
+    finalizePrivateBrands(this, functions);
     trackClassFieldCreation(this, functions);
 
     // Globals typed by a class that never REGISTERED (a JS class whose
@@ -6882,7 +7022,7 @@ export class Lowerer {
       this.diags.length > 0
         ? null
         : {
-            irVersion: 16,
+            irVersion: 17,
             sourceFile: this.entry.fileName,
             functions,
             classes: artifacts.classes,
@@ -6906,6 +7046,10 @@ export class Lowerer {
     this.dynamicFunctions = assignLegacyTiers(functions);
     if (this.dynamicFunctions.length > 0)
       this.dynamicBodies = functions.filter((fn) => fn.tier === "dynamic");
+    // Dynamic-tier functions compute with jsval values (ir/jsval.ts). The
+    // rewrite keeps every dynamic operation dynamic (each dyn operator
+    // becomes its js twin), so coverage's dynamic statements are unchanged.
+    if (module && this.dynamicFunctions.length > 0) promoteJsvals(module);
     return {
       module,
       diagnostics: this.diags,
@@ -7429,6 +7573,13 @@ export class Lowerer {
     this.settleGenericDemandPriorities();
     this.shapes.settleDeclaredOrderPriorities();
     for (const finalize of this.shapeOrderMetadataFinalizers) finalize();
+    applyKeyOrderWitnesses(this, [
+      ...orderedUnits,
+      ...initFunctions,
+      ...instanceFunctions,
+      ...this.liftedFns,
+      ...this.implicitFns,
+    ]);
     for (const finalize of this.shapeOrderHelperFinalizers) finalize();
     const functions = [
       ...orderedUnits,
@@ -7751,13 +7902,11 @@ export class Lowerer {
       const ownSym = widened.getSymbol();
       if (
         ownSym &&
-        this.checker
-          .declarationsOf(ownSym)
-          .some(
-            (d) =>
-              (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-              this.isStdlibFile(d.getSourceFile()),
-          )
+        ownSym.declarations.some(
+          (d) =>
+            (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+            this.isStdlibFile(d.getSourceFile()),
+        )
       ) {
         this.pushDiag(noLoweringDiag(this.checker.typeToString(type), locOf(node)));
         throw new PoisonError();
@@ -7799,13 +7948,11 @@ export class Lowerer {
     const stdlibOwnSym = widened.getSymbol();
     const stdlibNominal =
       stdlibOwnSym !== undefined &&
-      this.checker
-        .declarationsOf(stdlibOwnSym)
-        .some(
-          (d) =>
-            (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-            this.isStdlibFile(d.getSourceFile()),
-        );
+      stdlibOwnSym.declarations.some(
+        (d) =>
+          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+          this.isStdlibFile(d.getSourceFile()),
+      );
     // OVERLOADED call signatures (SC2007) — after the generic branch, so a
     // generic overload set keeps the monomorphization story: a value of a
     // multi-signature type has no single compiled signature to hold.
@@ -7901,7 +8048,11 @@ export class Lowerer {
     access: ts.PropertyAccessExpression | ts.ElementAccessExpression,
     use: "read" | "call",
   ): IrExpr | null {
-    return fenceStaticResponseMember(this, access, use) ?? fenceStaticBlobMember(this, access, use);
+    return (
+      fenceStaticResponseMember(this, access, use) ??
+      fenceStaticBlobMember(this, access, use) ??
+      fenceWebCryptoMember(this, access, use)
+    );
   }
 
   fenceUnsupportedFetchConstructorMember(
@@ -7958,6 +8109,17 @@ export class Lowerer {
         return this.checker.getUnknownType();
       }
     }
+    // A symbol-keyed field read through a CommonJS key-table key reads as
+    // the field's layout type (tableKeyFieldType).
+    if (ts.isElementAccessExpression(node) && isJsSourceFile(node.getSourceFile())) {
+      const field = tableKeyFieldType(this, node);
+      if (field) {
+        if (field.kind === "f64") return this.checker.getNumberType();
+        if (field.kind === "string") return this.checker.getStringType();
+        if (field.kind === "bool") return this.checker.getBooleanType();
+        return this.checker.getUnknownType();
+      }
+    }
     // A checked JS method receives its actual call-site receiver. Its
     // declaration's inferred class type must not turn property reads back
     // into native field loads when the method is borrowed by another object.
@@ -8018,7 +8180,7 @@ export class Lowerer {
           // JSDoc and initializer inference are declaration types, not flow
           // proofs. A checked specialization must not reinstate those
           // stale layouts (mutable/null slots and heterogeneous JS arrays).
-          const declaration = sym && this.checker.valueDeclarationOf(sym);
+          const declaration = sym && sym.valueDeclaration;
           const declared =
             declaration && ts.isParameter(declaration)
               ? this.mapTypeOf(this.checker.getTypeAtLocation(declaration.name))
@@ -8597,12 +8759,17 @@ export class Lowerer {
           liveReference(expr.type) ||
           (expr.type.kind === "union" &&
             (this.unions.get(expr.type.unionId)?.arms.some(liveReference) ?? false));
+        // A builtin function's adapter boxes under the builtin's name, the
+        // name Node's function carries (`[Function: randomUUID]`).
+        const builtinName =
+          expr.kind === "closure" ? this.builtinCallableValueNames.get(expr.fnName) : undefined;
         return {
           kind: "dynFrom",
           value: expr,
           type: DYN,
           loc: expr.loc,
           ...(liveRef ? { liveRef: true as const } : {}),
+          ...(builtinName !== undefined ? { fnName: builtinName } : {}),
         };
       }
       return expr;
@@ -9145,6 +9312,14 @@ export class Lowerer {
     return recordUnionWrapHelper(this, source, toId, loc);
   }
 
+  recordUnionRouteHelper(
+    source: IrType & { kind: "record" },
+    toId: string,
+    loc: SrcLoc,
+  ): string | null {
+    return recordUnionRouteHelper(this, source, toId, loc);
+  }
+
   unionRetagHelper(
     fromId: string,
     toId: string,
@@ -9341,7 +9516,7 @@ export class Lowerer {
     if (!ts.isIdentifier(n)) return null;
     const sym = this.resolveValueSymbol(n);
     if (!sym) return null;
-    const decls = this.checker.declarationsOf(sym);
+    const decls = sym.declarations;
     if (decls.length === 0) return null;
     const units = new Set<string>();
     let allConst = true;
@@ -9579,7 +9754,8 @@ export class Lowerer {
           builtinOption("SpawnOptions") ||
           builtinOption("UrlObject") ||
           builtinOption("URLFormatOptions") ||
-          !this.mapTypeOf(this.typeOf(x))
+          !this.mapTypeOf(this.typeOf(x)) ||
+          this.excessJsContextualProperty(x, parts)
         ) {
           return lowerDynObjectLiteral(this, x);
         }
@@ -9645,16 +9821,23 @@ export class Lowerer {
         }
       }
     }
-    let e = this.lowerExpr(node);
+    const e = this.lowerExpr(node);
+    return expected ? this.coerceExistingInto(node, e, expected) : e;
+  }
+
+  /** The conversion lowerExprExpecting applies to `e`, the lowered value
+   * of `node` when it is not fresh construction the destination directs
+   * (a literal, conditional, or empty collection). */
+  coerceExistingInto(node: ts.Expression, e: IrExpr, expected: IrType): IrExpr {
     if (
-      (expected?.kind === "union" && this.armTag(expected.unionId, UNDEFINED_T) >= 0) ||
-      (expected?.kind === "dyn" && isJsSourceFile(node.getSourceFile()))
+      (expected.kind === "union" && this.armTag(expected.unionId, UNDEFINED_T) >= 0) ||
+      (expected.kind === "dyn" && isJsSourceFile(node.getSourceFile()))
     ) {
       // A destination that accepts undefined must retain an unchecked
       // read's storage value even when the checker still calls it present.
       e = this.runtimeOptionalSourceValue(node, e) ?? e;
     }
-    return expected ? this.coerceInto(node, e, expected) : e;
+    return this.coerceInto(node, e, expected);
   }
 
   /** An unannotated empty collection has no existing elements or aliases
@@ -10114,7 +10297,7 @@ export class Lowerer {
       // declaration poisons under a source-anchored diagnostic, deferred
       // like any collection fence — never a crashed CLI.
       if (isCheckerPanic(e)) {
-        const decl = symbol ? this.checker.declarationsOf(symbol)[0] : undefined;
+        const decl = symbol ? symbol.declarations[0] : undefined;
         sink.push(
           checkerPanicDiag(
             e.message.split("\n", 1)[0]!,
@@ -10608,6 +10791,10 @@ export class Lowerer {
     return lowerDefaultExport(this, stmt);
   }
 
+  /** Statements %main runs before any module initializer: runtime
+   * registrations the lowering passes add. */
+  readonly mainPrelude: IrStmt[] = [];
+
   buildMain(): IrFunction {
     return buildMain(this);
   }
@@ -10855,6 +11042,21 @@ export class Lowerer {
         return;
       }
       const name = (decl.name as ts.Identifier).text;
+      if (shape.entryNarrow) {
+        // A typed override parameter over an inherited checked-value slot:
+        // the body local narrows from the dyn argument at entry.
+        const loc = locOf(decl);
+        const slot = this.declareHiddenLocal(name, shape.type);
+        params.push({ localId: slot.id, name, type: shape.type });
+        const narrowed = this.coerceInto(
+          decl.name,
+          { kind: "varRef", localId: slot.id, type: shape.type, loc },
+          shape.entryNarrow,
+        );
+        const body = this.declareLocal(decl.name, name, shape.entryNarrow, true);
+        prologue.push({ kind: "varDecl", localId: body.id, init: narrowed, loc });
+        return;
+      }
       if (shape.mode === "omittable" && shape.bodyType && decl.initializer) {
         const abi = shape.type;
         if (abi.kind === "dyn") {
@@ -11035,7 +11237,7 @@ export class Lowerer {
     // symbol — which is what declareParams registered the local under.
     // On a miss, normalize to the declaration's key and retry (ordinary
     // bindings never reach this — their two sides intern to one symbol).
-    const vd = this.checker.valueDeclarationOf(symbol);
+    const vd = symbol.valueDeclaration;
     if (
       vd &&
       ts.isParameter(vd) &&
@@ -11086,9 +11288,7 @@ export class Lowerer {
     });
     if (resolved.error !== null) {
       const location =
-        blame ??
-        (symbol === undefined ? undefined : this.checker.declarationsOf(symbol)[0]) ??
-        this.entry;
+        blame ?? (symbol === undefined ? undefined : symbol.declarations[0]) ?? this.entry;
       const message = `the binding '${resolved.origin!.name}' captured through a plain nested function (the declaration has no static storage a capture can thread — bind the value through a typed const, or read it in the declaring scope)`;
       this.unsupported("SC1090", location, message);
     }
@@ -11170,7 +11370,7 @@ export class Lowerer {
     // concrete signature — name the shape instead of the generic
     // binding-form text.
     if (symbol) {
-      const d = this.checker.valueDeclarationOf(symbol);
+      const d = symbol.valueDeclaration;
       if (d && ts.isVariableDeclaration(d) && d.initializer === undefined) {
         const t = this.checker.getTypeOfSymbol(symbol);
         const parts = t.isUnionType() ? ts.constituentTypes(t) : [t];
@@ -11192,7 +11392,7 @@ export class Lowerer {
     // assignment are `undefined`, and this binding's type has no slot for
     // that value — name the shape instead of the generic no-lowering text.
     if (symbol) {
-      const d = this.checker.valueDeclarationOf(symbol);
+      const d = symbol.valueDeclaration;
       if (
         d &&
         ts.isVariableDeclaration(d) &&
@@ -11716,6 +11916,7 @@ export class Lowerer {
       lowerStaticReadableStreamReaderCall(this, expr) ??
       lowerStaticResponseCall(this, expr) ??
       lowerStaticBlobCall(this, expr) ??
+      lowerWebCryptoCall(this, expr) ??
       lowerKeyObjectCall(this, expr) ??
       lowerNetAddressCall(this, expr) ??
       lowerFetchElementMethodCall(this, expr) ??
@@ -12051,9 +12252,21 @@ export class Lowerer {
     if (mapped?.kind === "moduleNs" && mapped.moduleId.startsWith("builtin:")) {
       return mapped.moduleId.slice("builtin:".length);
     }
+    // A nullable namespace binding (`const os: typeof NodeOs | null`, a
+    // probed process.getBuiltinModule result) read where the checker
+    // narrowed it present: its members key the same tables.
+    if (stored?.kind === "union") {
+      const present = this.unions.get(stored.unionId)?.arms.filter((arm) => !isUnitType(arm));
+      const only = present?.length === 1 ? present[0] : undefined;
+      if (only?.kind === "moduleNs" && only.moduleId.startsWith("builtin:")) {
+        const narrowed = this.mapTypeOf(this.typeOf(expr));
+        if (narrowed?.kind === "moduleNs" && narrowed.moduleId === only.moduleId)
+          return only.moduleId.slice("builtin:".length);
+      }
+    }
     if (ts.isIdentifier(expr)) {
       const symbol = this.checker.getSymbolAtLocation(expr);
-      const decl = symbol ? this.checker.declarationsOf(symbol)[0] : undefined;
+      const decl = symbol ? symbol.declarations[0] : undefined;
       if (!decl) return null;
       // The CommonJS twin: `const fs = require("fs")` binds the same
       // namespace surface as `import * as fs from "node:fs"` — and the
@@ -12118,7 +12331,7 @@ export class Lowerer {
     }
     if (ts.isIdentifier(expr)) {
       const symbol = this.checker.getSymbolAtLocation(expr);
-      const decl = symbol ? this.checker.declarationsOf(symbol)[0] : undefined;
+      const decl = symbol ? symbol.declarations[0] : undefined;
       if (!decl) return null;
       // The DEFAULT-import twin: Node's default export of a CJS builtin
       // IS the module object, so `import path from "node:path"` exposes
@@ -12251,13 +12464,7 @@ export class Lowerer {
           COPYFILE_FICLONE_FORCE: 4,
         };
         const value = own(MODES, expr.name.text);
-        if (value === undefined) {
-          this.noLowering(
-            `fs.constants.${expr.name.text}`,
-            expr,
-            "F_OK, R_OK, W_OK, X_OK, and COPYFILE_* are the lowered constants",
-          );
-        }
+        if (value === undefined) return fsConstantMemberRead(expr);
         return { kind: "numLit", value, type: F64, loc };
       }
     }
@@ -12326,14 +12533,8 @@ export class Lowerer {
       const callable = this.lowerBuiltinCallableValue(bi, loc);
       if (callable) return callable;
     }
-    if (bi.member === "constants" && bi.module === "fs") {
-      // A bare `fs.constants` read (not one of the baked bits above).
-      this.noLowering(
-        `fs.constants`,
-        expr,
-        "F_OK, R_OK, W_OK, X_OK, and COPYFILE_* are the lowered constants",
-      );
-    }
+    // A bare `fs.constants` read (not one of the baked bits above).
+    if (bi.member === "constants" && bi.module === "fs") return fsConstantsObject(loc);
     if (builtinModuleFnOf(this, bi.module, bi.member)) {
       this.unsupported(
         "SC1090",
@@ -12394,11 +12595,12 @@ export class Lowerer {
         param.mode === "optional" ? `${param.mode}:${param.defaultValue}` : param.mode,
       )
       .join(",");
-    const key = `${fn.fn}:${typeKey(funcType)}:${adapterShape}`;
+    const key = `${fn.valueFn ?? fn.fn}:${typeKey(funcType)}:${adapterShape}`;
     let fnName = this.builtinCallableValueFns.get(key);
     if (!fnName) {
-      fnName = `%builtin.value.${fn.fn}.${this.builtinCallableValueFns.size}`;
+      fnName = `%builtin.value.${fn.valueFn ?? fn.fn}.${this.builtinCallableValueFns.size}`;
       this.builtinCallableValueFns.set(key, fnName);
+      this.builtinCallableValueNames.set(fnName, display.slice(display.lastIndexOf(".") + 1));
       const params = funcType.params.map((type, index) => ({
         localId: `arg.${index}`,
         name: `arg${index}`,
@@ -12463,7 +12665,7 @@ export class Lowerer {
           loc,
         };
       });
-      const call: IrExpr = { kind: "libCall", fn: fn.fn, args, type: fn.result, loc };
+      const call: IrExpr = { kind: "libCall", fn: fn.valueFn ?? fn.fn, args, type: fn.result, loc };
       const body: IrStmt[] =
         fn.result.kind === "void"
           ? [
diff --git a/packages/compiler/src/frontend/lowering/module-member-this.ts b/packages/compiler/src/frontend/lowering/module-member-this.ts
new file mode 100644
index 000000000..205cc63e9
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/module-member-this.ts
@@ -0,0 +1,64 @@
+/* A module export called through its module binding (`m.f()` where `m` is
+ * `const m = require("./x")` or `import * as m from "./x"`): Node passes
+ * the module object (the exports object, or the namespace) as `this`. The
+ * member call lowers to a direct call of the exported function, which has
+ * no module object to pass, so an export that reads `this` refuses instead
+ * of seeing another receiver. */
+import * as ts from "../ts7/adapter.js";
+import type { Lowerer } from "./lowerer.js";
+
+/** The function an export binding holds, when its declaration shows it. */
+function exportedFunction(decl: ts.Node): ts.Node | null {
+  let node: ts.Node | undefined = decl;
+  if (ts.isPropertyAccessExpression(node) && node.parent && ts.isBinaryExpression(node.parent))
+    node = node.parent;
+  if (ts.isBinaryExpression(node)) node = node.right;
+  else if (ts.isVariableDeclaration(node) || ts.isPropertyAssignment(node)) node = node.initializer;
+  while (node !== undefined && ts.isParenthesizedExpression(node)) node = node.expression;
+  if (node === undefined) return null;
+  if (
+    ts.isFunctionDeclaration(node) ||
+    ts.isFunctionExpression(node) ||
+    ts.isMethodDeclaration(node)
+  )
+    return node;
+  return null;
+}
+
+/** Whether a function's own body reads `this` (arrows share it; other
+ * functions and classes have their own). */
+function readsOwnThis(fn: ts.Node): boolean {
+  let found = false;
+  const visit = (node: ts.Node): void => {
+    if (found) return;
+    if (node.kind === ts.SyntaxKind.ThisKeyword) {
+      found = true;
+      return;
+    }
+    if ((ts.isFunctionLike(node) && !ts.isArrowFunction(node)) || ts.isClassLikeDeclaration(node))
+      return;
+    node.forEachChild(visit);
+  };
+  fn.forEachChild(visit);
+  return found;
+}
+
+export function refuseModuleMemberThis(
+  lowerer: Lowerer,
+  call: ts.CallExpression,
+  member: ts.Identifier,
+): void {
+  let symbol = lowerer.checker.getSymbolAtLocation(member);
+  if (symbol !== undefined && (symbol.flags & ts.SymbolFlags.Alias) !== 0)
+    symbol = lowerer.checker.getAliasedSymbol(symbol);
+  if (symbol === undefined) return;
+  for (const decl of symbol.declarations) {
+    const fn = exportedFunction(decl);
+    if (fn === null || !readsOwnThis(fn)) continue;
+    lowerer.unsupported(
+      "SC1090",
+      call,
+      `calling a module export that reads 'this' through its module binding ('${member.text}': Node passes the module object as 'this', which this call has no value for)`,
+    );
+  }
+}
diff --git a/packages/compiler/src/frontend/lowering/module-namespace-elements.ts b/packages/compiler/src/frontend/lowering/module-namespace-elements.ts
index 368ce3c5f..d2425750b 100644
--- a/packages/compiler/src/frontend/lowering/module-namespace-elements.ts
+++ b/packages/compiler/src/frontend/lowering/module-namespace-elements.ts
@@ -31,7 +31,7 @@ export function lowerModuleNamespaceElement(
             ? lowerer.checker.getAliasedSymbol(exported)
             : exported;
         if (!(target.flags & ts.SymbolFlags.Value)) return;
-        const declaration = lowerer.checker.valueDeclarationOf(target);
+        const declaration = target.valueDeclaration;
         const identifier = declaration?.name as ts.Node | undefined;
         if (!identifier || !ts.isIdentifier(identifier)) {
           lowerer.unsupported("SC1090", expr, "computed namespace reads of unnamed exports");
diff --git a/packages/compiler/src/frontend/lowering/narrowing-stability.ts b/packages/compiler/src/frontend/lowering/narrowing-stability.ts
index 500267263..01801470d 100644
--- a/packages/compiler/src/frontend/lowering/narrowing-stability.ts
+++ b/packages/compiler/src/frontend/lowering/narrowing-stability.ts
@@ -190,7 +190,7 @@ export class NarrowingStability {
     const { call, argument } = slot;
     const checker = this.lowerer.checker;
     const signature = checker.getResolvedSignature(call);
-    const declaration = signature ? checker.signatureDeclaration(signature) : undefined;
+    const declaration = signature ? signature.declaration : undefined;
     if (!declaration || !this.lowerer.isStdlibFile(declaration.getSourceFile())) return true;
     const callee = skipOuter(call.expression);
     if (
@@ -372,7 +372,7 @@ export class NarrowingStability {
     this.staleBindings.set(symbol, false);
     let result = false;
     try {
-      const decl = this.lowerer.checker.valueDeclarationOf(symbol);
+      const decl = symbol.valueDeclaration;
       if (decl !== undefined && ts.isVariableDeclaration(decl)) {
         if (decl.initializer !== undefined && this.mayBeStale(decl.initializer)) result = true;
         else {
@@ -421,7 +421,7 @@ export class NarrowingStability {
     if (cached !== undefined) return cached;
     let result = false;
     try {
-      const decl = this.lowerer.checker.valueDeclarationOf(symbol);
+      const decl = symbol.valueDeclaration;
       const mutableBinding =
         decl !== undefined &&
         ((ts.isVariableDeclaration(decl) &&
diff --git a/packages/compiler/src/frontend/lowering/native-ffi.ts b/packages/compiler/src/frontend/lowering/native-ffi.ts
index 3ccd54b64..c9ff3300d 100644
--- a/packages/compiler/src/frontend/lowering/native-ffi.ts
+++ b/packages/compiler/src/frontend/lowering/native-ffi.ts
@@ -163,7 +163,7 @@ function ffiDeclarationDiagnostic(
   loc: SrcLoc,
 ): ScrDiagnostic | null {
   const { binding: bindingDiag, signature: signatureDiag } = ffiFlavor(lowerer);
-  const declarations = lowerer.checker.declarationsOf(symbol);
+  const declarations = symbol.declarations;
   const functionDecls = declarations.filter(ts.isFunctionDeclaration);
   if (
     functionDecls.length === 0 ||
@@ -386,7 +386,7 @@ export function lowerFfiCall(lowerer: Lowerer, expr: ts.CallExpression): IrExpr
     // are untouched.
     if (lowerer.libraryCallbacks) {
       const symbol = lowerer.resolveValueSymbol(expr.expression);
-      const decls = symbol === null ? [] : lowerer.checker.declarationsOf(symbol);
+      const decls = symbol === null ? [] : symbol.declarations;
       const callbackShaped =
         decls.length > 0 &&
         decls.every(
@@ -427,7 +427,7 @@ export function lowerFfiCall(lowerer: Lowerer, expr: ts.CallExpression): IrExpr
     if (validSymbols === undefined) throw new PoisonError();
     if (!validSymbols.has(symbol)) {
       if (lowerer.libraryCallbacks) {
-        const declarations = lowerer.checker.declarationsOf(symbol);
+        const declarations = symbol.declarations;
         const programDeclarations = declarations.filter((decl) =>
           libraryCallbackOwnsFile(lowerer, decl.getSourceFile()),
         );
diff --git a/packages/compiler/src/frontend/lowering/object-factory-new.ts b/packages/compiler/src/frontend/lowering/object-factory-new.ts
index ac83dccd8..ddd8d6d56 100644
--- a/packages/compiler/src/frontend/lowering/object-factory-new.ts
+++ b/packages/compiler/src/frontend/lowering/object-factory-new.ts
@@ -21,15 +21,13 @@ function isObjectFactoryNew(lowerer: Lowerer, expr: ts.NewExpression): boolean {
     lowerer.collecting = wasCollecting;
   }
   if (!symbol) return false;
-  const owner = lowerer.checker
-    .declarationsOf(symbol)
-    .find(
-      (node) =>
-        (ts.isFunctionDeclaration(node) && node.body !== undefined) ||
-        (ts.isVariableDeclaration(node) &&
-          node.initializer &&
-          ts.isFunctionExpression(node.initializer)),
-    );
+  const owner = symbol.declarations.find(
+    (node) =>
+      (ts.isFunctionDeclaration(node) && node.body !== undefined) ||
+      (ts.isVariableDeclaration(node) &&
+        node.initializer &&
+        ts.isFunctionExpression(node.initializer)),
+  );
   const declaration =
     owner &&
     ts.isVariableDeclaration(owner) &&
diff --git a/packages/compiler/src/frontend/lowering/private-brands.ts b/packages/compiler/src/frontend/lowering/private-brands.ts
new file mode 100644
index 000000000..e7b3edbd8
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/private-brands.ts
@@ -0,0 +1,328 @@
+import * as ts from "../ts7/adapter.js";
+import {
+  BOOL,
+  DYN,
+  RUNTIME_ERROR_CLASSES,
+  STRING,
+  typeKey,
+  type IrExpr,
+  type IrFunction,
+  type IrStmt,
+  type IrType,
+  type SrcLoc,
+} from "../../ir/ir.js";
+import { helperLoc, strLit, varRef } from "../../ir/build.js";
+import { isJsSourceFile } from "../program.js";
+import type { Lowerer } from "./lowerer.js";
+import type { ClassInfo } from "./lower-classes.js";
+
+/** How a brand helper uses its receiver: `in` answers `#x in v`, `read` and
+ * `write` return the receiver as the declaring class for a field access. */
+type BrandUse = "in" | "read" | "write";
+
+const PREFIX = "%private.";
+
+/** A function-local JavaScript class with private names. Its prototype
+ * methods and accessors exist once per evaluation and check their receiver's
+ * evaluation, so a method or accessor taken from an instance is the function
+ * of that instance's own evaluation. */
+export function perEvaluationPrivateNames(info: ClassInfo): boolean {
+  const declaration = info.localClass ? info.decl : null;
+  return (
+    !!declaration &&
+    isJsSourceFile(declaration.getSourceFile()) &&
+    declaration.members.nodes.some(
+      (member) => member.name !== undefined && ts.isPrivateIdentifier(member.name),
+    )
+  );
+}
+
+/** The function-local class declaring a private name, when its private names
+ * need a per-evaluation brand check: the nearest enclosing class that
+ * declares the name, as JavaScript scoping resolves it. */
+export function localPrivateBrandClass(
+  lowerer: Lowerer,
+  priv: ts.PrivateIdentifier,
+): { info: ClassInfo; decl: ts.ClassDeclaration & { name: ts.Identifier } } | null {
+  for (let node: ts.Node | undefined = priv.parent; node; node = node.parent) {
+    if (!ts.isClassDeclaration(node) && !ts.isClassExpression(node)) continue;
+    const declares = node.members.nodes.some((member) => {
+      const name = (member as { name?: ts.PropertyName }).name;
+      return name !== undefined && ts.isPrivateIdentifier(name) && name.text === priv.text;
+    });
+    if (!declares) continue;
+    if (!ts.isClassDeclaration(node) || !node.name) return null;
+    const symbol = lowerer.checker.getSymbolAtLocation(node.name);
+    const info =
+      lowerer.currentClass?.decl === node
+        ? lowerer.currentClass
+        : symbol
+          ? lowerer.classBySymbol.get(symbol)
+          : undefined;
+    if (!info?.localClass) return null;
+    return { info, decl: node as ts.ClassDeclaration & { name: ts.Identifier } };
+  }
+  return null;
+}
+
+/** Each evaluation of a function-local class creates fresh private names,
+ * while one compiled class serves every evaluation. Its JavaScript prototype
+ * methods are closures per evaluation whose `this` is a checked value, so a
+ * private name on `this` is present exactly when the receiver is an instance
+ * of the class (or a subclass) whose `%classEnvironment` field holds the
+ * class value of the closure's own evaluation. The class's own binding names
+ * that value (lowerClassExpressionInfo accepts only named declarations, whose
+ * binding the checker keeps from being assigned). */
+export function checkedPrivateReceiver(
+  lowerer: Lowerer,
+  info: ClassInfo,
+  decl: ts.ClassDeclaration & { name: ts.Identifier },
+  access: ts.PropertyAccessExpression,
+  receiver: IrExpr,
+  loc: SrcLoc,
+): IrExpr {
+  const use: BrandUse = isPrivateWriteTarget(access) ? "write" : "read";
+  return brandCall(lowerer, info, decl, use, access.name.text, receiver, loc);
+}
+
+/** Whether a checked value is a primitive: `#x in v` throws for those
+ * before any brand lookup. */
+export function primitiveOperand(value: IrExpr, loc: SrcLoc): IrExpr {
+  return (["nullish", "number", "string", "boolean", "bigint", "symbol"] as const)
+    .map((test): IrExpr => ({ kind: "dynTest", test, value, type: BOOL, loc }))
+    .reduce((left, right) => ({ kind: "logical", op: "||", left, right, type: BOOL, loc }));
+}
+
+/** Node's TypeError message for `#x in v` on a primitive, which spells the
+ * value as String(v) does. */
+export function privateInMessage(name: string, value: IrExpr, loc: SrcLoc): IrExpr {
+  return {
+    kind: "strConcat",
+    left: strLit(`Cannot use 'in' operator to search for '${name}' in `, loc),
+    right: { kind: "libCall", fn: "dyn.stringConstructor", args: [value], type: STRING, loc },
+    type: STRING,
+    loc,
+  };
+}
+
+/** A receiver checkedPrivateReceiver built for a field write. */
+export function isPrivateWriteReceiver(expr: IrExpr): boolean {
+  return expr.kind === "call" && expr.callee.startsWith(`${PREFIX}write:`);
+}
+
+/** `#x in v` for a checked value inside a function-local class: the brand
+ * test above, after the TypeError a primitive operand throws. */
+export function checkedPrivateIn(
+  lowerer: Lowerer,
+  info: ClassInfo,
+  decl: ts.ClassDeclaration & { name: ts.Identifier },
+  name: string,
+  receiver: IrExpr,
+  loc: SrcLoc,
+): IrExpr {
+  return brandCall(lowerer, info, decl, "in", name, receiver, loc);
+}
+
+function brandCall(
+  lowerer: Lowerer,
+  info: ClassInfo,
+  decl: ts.ClassDeclaration & { name: ts.Identifier },
+  use: BrandUse,
+  name: string,
+  receiver: IrExpr,
+  loc: SrcLoc,
+): IrExpr {
+  const className = info.def.name;
+  const classType: IrType = { kind: "classval", className };
+  const resultType: IrType = use === "in" ? BOOL : { kind: "object", className };
+  const helper = `${PREFIX}${use}:${className}:${name}`;
+  if (!lowerer.valueHelpers.has(helper)) {
+    const at = helperLoc(loc);
+    lowerer.liftedFns.push({
+      name: helper,
+      params: [
+        { localId: "value.0", name: "value", type: DYN },
+        { localId: "class.0", name: "class", type: classType },
+      ],
+      returnType: resultType,
+      locals: [
+        { id: "value.0", name: "value", type: DYN, mutable: false },
+        { id: "class.0", name: "class", type: classType, mutable: false },
+      ],
+      // finalizePrivateBrands fills the body once every class is collected,
+      // including subclasses declared after this use.
+      body: [],
+      loc: at,
+    });
+    lowerer.valueHelpers.set(helper, helper);
+  }
+  const evaluation = lowerer.classValueRef(info, decl.name);
+  return { kind: "call", callee: helper, args: [receiver, evaluation], type: resultType, loc };
+}
+
+/** A plain assignment, a destructuring target, or a for-in/of target writes
+ * the field. Compound assignments and updates read it first, and Node
+ * reports the failed read. */
+function isPrivateWriteTarget(access: ts.PropertyAccessExpression): boolean {
+  let node: ts.Node = access;
+  for (;;) {
+    const parent = node.parent;
+    if (ts.isParenthesizedExpression(parent)) {
+      node = parent;
+      continue;
+    }
+    if (ts.isBinaryExpression(parent))
+      return parent.left === node && parent.operatorToken.kind === ts.SyntaxKind.EqualsToken;
+    if (ts.isForOfStatement(parent) || ts.isForInStatement(parent))
+      return parent.initializer === node;
+    // Inside a destructuring pattern: keep walking to the assignment.
+    if (
+      ts.isArrayLiteralExpression(parent) ||
+      ts.isSpreadElement(parent) ||
+      (ts.isPropertyAssignment(parent) && parent.initializer === node) ||
+      ts.isObjectLiteralExpression(parent) ||
+      ts.isSpreadAssignment(parent)
+    ) {
+      node = parent;
+      continue;
+    }
+    return false;
+  }
+}
+
+/** Fill the brand helpers: one branch per class a checked reference to an
+ * instance can be boxed under (the declarer, its subclasses, and its
+ * ancestors when the instance is at or below the declarer). */
+export function finalizePrivateBrands(lowerer: Lowerer, functions: IrFunction[]): void {
+  for (const fn of functions) {
+    if (!fn.name.startsWith(PREFIX) || fn.body.length > 0) continue;
+    // `%private.<use>:<class>:<#name>`; class names may contain colons.
+    const spec = fn.name.slice(PREFIX.length);
+    const use = spec.slice(0, spec.indexOf(":")) as BrandUse;
+    const className = spec.slice(use.length + 1, spec.lastIndexOf(":"));
+    const name = spec.slice(spec.lastIndexOf(":") + 1);
+    const loc = fn.loc;
+    const value = varRef("value.0", DYN, loc);
+    const evaluation = varRef("class.0", { kind: "classval", className }, loc);
+    const ownerType: IrType = { kind: "object", className };
+    const body: IrStmt[] = [];
+    let matches = 0;
+    for (const candidate of lowerer.classes.values()) {
+      const candidateName = candidate.def.name;
+      if (RUNTIME_ERROR_CLASSES.has(candidateName)) continue;
+      const below = candidateName === className || lowerer.isSubclassOf(candidateName, className);
+      const above = lowerer.isSubclassOf(className, candidateName);
+      if (!below && !above) continue;
+      const candidateType: IrType = { kind: "object", className: candidateName };
+      const checked: IrExpr = { kind: "dynCheck", value, type: candidateType, loc };
+      const local = `receiver.${matches++}`;
+      fn.locals.push({ id: local, name: "receiver", type: ownerType, mutable: false });
+      const receiver = varRef(local, ownerType, loc);
+      const sameEvaluation: IrExpr = {
+        kind: "bin",
+        op: "===",
+        left: {
+          kind: "fieldGet",
+          obj: receiver,
+          className,
+          field: `%classEnvironment:${className}`,
+          type: evaluation.type,
+          loc,
+        },
+        right: evaluation,
+        type: BOOL,
+        loc,
+      };
+      const match = (typed: IrExpr): IrStmt[] => [
+        { kind: "varDecl", localId: local, init: typed, loc },
+        {
+          kind: "if",
+          cond: sameEvaluation,
+          then: [
+            {
+              kind: "return",
+              value: use === "in" ? { kind: "boolLit", value: true, type: BOOL, loc } : receiver,
+              loc,
+            },
+          ],
+          else_: null,
+          loc,
+        },
+      ];
+      const then: IrStmt[] = below
+        ? match(
+            candidateName === className
+              ? checked
+              : { kind: "upcast", value: checked, type: ownerType, loc },
+          )
+        : [
+            {
+              kind: "if",
+              cond: { kind: "instanceOf", value: checked, className, type: BOOL, loc },
+              then: match({ kind: "downcast", value: checked, type: ownerType, loc }),
+              else_: null,
+              loc,
+            },
+          ];
+      body.push({
+        kind: "if",
+        cond: {
+          kind: "libCall",
+          fn: "dyn.typedRefIs",
+          args: [value, strLit(typeKey(candidateType), loc)],
+          type: BOOL,
+          loc,
+        },
+        then,
+        else_: null,
+        loc,
+      });
+    }
+    const typeError = (message: IrExpr): IrStmt => ({
+      kind: "throw",
+      value: {
+        kind: "libCall",
+        fn: "error.new",
+        args: [message],
+        type: { kind: "object", className: "%TypeError" },
+        loc,
+      },
+      loc,
+    });
+    if (use === "in") {
+      body.push(
+        {
+          kind: "if",
+          cond: primitiveOperand(value, loc),
+          then: [typeError(privateInMessage(name, value, loc))],
+          else_: null,
+          loc,
+        },
+        { kind: "return", value: { kind: "boolLit", value: false, type: BOOL, loc }, loc },
+      );
+    } else {
+      const verb = use === "read" ? "reading" : "setting";
+      const action = use === "read" ? "Cannot read properties" : "Cannot set properties";
+      for (const unit of ["undefined", "null"] as const) {
+        body.push({
+          kind: "if",
+          cond: { kind: "dynTest", test: unit, value, type: BOOL, loc },
+          then: [typeError(strLit(`${action} of ${unit} (${verb} '${name}')`, loc))],
+          else_: null,
+          loc,
+        });
+      }
+      body.push(
+        typeError(
+          strLit(
+            use === "read"
+              ? `Cannot read private member ${name} from an object whose class did not declare it`
+              : `Cannot write private member ${name} to an object whose class did not declare it`,
+            loc,
+          ),
+        ),
+      );
+    }
+    fn.body = body;
+  }
+}
diff --git a/packages/compiler/src/frontend/lowering/sanitize-class-types.test.ts b/packages/compiler/src/frontend/lowering/sanitize-class-types.test.ts
index 7e7a97182..6f6d61649 100644
--- a/packages/compiler/src/frontend/lowering/sanitize-class-types.test.ts
+++ b/packages/compiler/src/frontend/lowering/sanitize-class-types.test.ts
@@ -21,7 +21,7 @@ test("fenced instance slots are erased throughout signatures, storage and nested
   };
   const ref = (type: IrType): IrExpr => ({ kind: "varRef", localId: "x", type, loc });
   const module: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     globals: [{ id: "g", name: "g", type: composite, mutable: false }],
@@ -110,7 +110,7 @@ test("modules without optional tables and registered class types retain their st
   const loc = { file: "registered.ts", start: 0, end: 1 };
   const type: IrType = { kind: "object", className: "Registered" };
   const module: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [
diff --git a/packages/compiler/src/frontend/lowering/split-consumers.ts b/packages/compiler/src/frontend/lowering/split-consumers.ts
index 11443051c..9624ac0aa 100644
--- a/packages/compiler/src/frontend/lowering/split-consumers.ts
+++ b/packages/compiler/src/frontend/lowering/split-consumers.ts
@@ -21,7 +21,7 @@ export function isPrivateSplitConsumer(
   const local = lowerer.bindingIn(lowerer.ctx, symbol);
   if (!local || local.boxed || local.tdz || local.mutable || local.id !== iterable.localId)
     return false;
-  const decl = lowerer.checker.valueDeclarationOf(symbol);
+  const decl = symbol.valueDeclaration;
   if (
     !decl ||
     !ts.isVariableDeclaration(decl) ||
diff --git a/packages/compiler/src/frontend/lowering/surfaces.ts b/packages/compiler/src/frontend/lowering/surfaces.ts
index e43748b39..7ae1371c2 100644
--- a/packages/compiler/src/frontend/lowering/surfaces.ts
+++ b/packages/compiler/src/frontend/lowering/surfaces.ts
@@ -22,7 +22,7 @@ import {
   VOID,
   arrayOf,
 } from "../../ir/ir.js";
-import { isNodeTypesPath, requireSpecOf } from "../program.js";
+import { isJsSourceFile, isNodeTypesPath, requireSpecOf } from "../program.js";
 import { ZLIB_CONSTANTS } from "./zlib-constants.js";
 
 /** zlib stream instances: runtime Transform streams (scr_zlib_stream.c). */
@@ -773,6 +773,7 @@ export const STATIC_NUMBER_METHODS: Record<
   { fns: readonly IrLibFn[]; minArgs: number; maxArgs: number } | undefined
 > = {
   toFixed: { fns: ["num.toFixed0", "num.toFixed"], minArgs: 0, maxArgs: 1 },
+  toPrecision: { fns: ["num.toPrecision"], minArgs: 0, maxArgs: 1 },
 };
 
 /** One lowerable builtin-module FUNCTION: `fn`'s libCall with `params`
@@ -793,6 +794,10 @@ export interface BuiltinModuleFn {
    * omission or explicit undefined; rest parameters pack into one typed
    * array slot. Entries with call-site-specific validation remain absent. */
   valueParams?: BuiltinValueParam[];
+  /** The libCall a function value's adapter makes when it differs from the
+   * direct-call row's `fn` (a direct call picks an arity-specific entry
+   * point; the value accepts every arity through one). */
+  valueFn?: IrLibFn;
 }
 
 export type BuiltinValueParam =
@@ -1502,7 +1507,15 @@ export const BUILTIN_MODULE_FNS: Record<
     userInfo: { fn: "os.userName", params: [], result: VOID },
   },
   crypto: {
-    randomUUID: { fn: "crypto.randomUUID", params: [], result: STRING },
+    randomUUID: {
+      fn: "crypto.randomUUID",
+      params: [],
+      result: STRING,
+      // As a value (uuid's `export default { randomUUID }`), the optional
+      // options argument goes through the validating entry point.
+      valueFn: "crypto.randomUUIDOpts",
+      valueParams: [{ mode: "optional", type: DYN, defaultValue: undefined }],
+    },
     // A real Buffer result. The composed randomBytes(n).toString(enc)
     // form KEEPS its one-libCall lowering (lowerCryptoComposedCall runs
     // first and the Buffer never materializes there); this entry covers
@@ -1521,9 +1534,15 @@ export const BUILTIN_MODULE_FNS: Record<
     hash: { fn: "crypto.hashDigestStr", params: [STRING, STRING, STRING], result: STRING },
     timingSafeEqual: { fn: "crypto.timingSafeEqual", params: [BYTES_U8, BYTES_U8], result: BOOL },
     randomFillSync: { fn: "crypto.randomFill", params: [BYTES_U8, F64, F64], result: BYTES_U8 },
+    getRandomValues: { fn: "crypto.getRandomValues", params: [BYTES_U8], result: BYTES_U8 },
     randomInt: { fn: "crypto.randomInt", params: [F64, F64], result: F64 },
     randomFill: { fn: "crypto.randomFillCb", params: [], result: VOID },
-    randomUUIDv7: { fn: "crypto.randomUUIDv7", params: [DYN], result: STRING },
+    randomUUIDv7: {
+      fn: "crypto.randomUUIDv7",
+      params: [DYN],
+      result: STRING,
+      valueParams: [{ mode: "optional", type: DYN, defaultValue: undefined }],
+    },
     createSecretKey: { fn: "crypto.createSecretKey", params: [DYN, DYN], result: DYN },
     generateKeySync: { fn: "crypto.generateKeySync", params: [DYN, DYN], result: DYN },
     generateKey: { fn: "crypto.generateKeyCb", params: [], result: VOID },
@@ -2086,6 +2105,7 @@ export const BUILTIN_MODULE_FN_ALIASES: Record<
       "crypto.randomFillPromiseDyn",
     ],
     timingSafeEqual: ["crypto.timingSafeEqualDyn"],
+    getRandomValues: ["crypto.getRandomValuesDyn"],
     randomInt: ["crypto.randomIntMax", "crypto.randomIntCb", "crypto.randomIntPromise"],
     randomUUID: ["crypto.randomUUIDOpts"],
   },
@@ -2159,6 +2179,20 @@ export const AMBIENT_SURFACE_FNS: readonly AmbientSurfaceRow[] = [
     fns: ["blob.fileNew"],
     note: "a Blob with name and lastModified (Date.now() when absent)",
   },
+  {
+    id: "stdlib.webcrypto.subtle",
+    kind: "stdlib",
+    name: "globalThis.crypto.subtle",
+    fns: ["webcrypto.importKey", "webcrypto.sign", "webcrypto.verify", "webcrypto.digest"],
+    note: "importKey('raw') for HMAC keys, HMAC sign and verify, and SHA-1/SHA-2 digest; other methods, algorithms and key formats are refused",
+  },
+  {
+    id: "stdlib.webcrypto.CryptoKey",
+    kind: "stdlib",
+    name: "CryptoKey",
+    fns: ["webcrypto.isCryptoKey"],
+    note: "secret HMAC keys with type, extractable, algorithm and usages, and instanceof CryptoKey",
+  },
   {
     id: "stdlib.atomics",
     kind: "stdlib",
@@ -2663,6 +2697,15 @@ export const AMBIENT_SURFACE_FNS: readonly AmbientSurfaceRow[] = [
     fns: ["os.constants"],
     note: "the platform's dlopen, errno, signals and priority groups; members a platform lacks read as undefined",
   },
+  // fs.constants as a value, and its members beyond the baked access-mode
+  // bits: the target libc's null-prototype constants object.
+  {
+    id: "node-builtin.fs.constants",
+    kind: "node-builtin",
+    name: "fs.constants",
+    fns: ["fs.constants"],
+    note: "node_constants.cc's fs group under the target libc's macros; members a platform lacks read as undefined",
+  },
 ];
 
 /** The win32-target overrides of the bare modules' constants: path's
@@ -3220,7 +3263,7 @@ export function isChildSurfaceMember(
 ): boolean {
   if (isStdlibMember(lowerer, access)) return true;
   const sym = lowerer.checker.getSymbolAtLocation(access.name);
-  const decl = sym ? lowerer.checker.declarationsOf(sym)[0] : undefined;
+  const decl = sym ? sym.declarations[0] : undefined;
   const iface = decl?.parent;
   if (!decl || !iface || !ts.isInterfaceDeclaration(iface)) return false;
   if (lowerer.isStdlibFile(decl.getSourceFile())) return false;
@@ -3233,10 +3276,7 @@ export function isChildSurfaceMember(
  * with lib interfaces, so a member can carry declarations from both. A
  * user's own declaration is in neither, so shadowing never matches. */
 export function isStdlibSymbol(lowerer: Lowerer, symbol: ts.Symbol | undefined): boolean {
-  return (
-    !!symbol &&
-    lowerer.checker.declarationsOf(symbol).some((d) => lowerer.isStdlibFile(d.getSourceFile()))
-  );
+  return !!symbol && symbol.declarations.some((d) => lowerer.isStdlibFile(d.getSourceFile()));
 }
 
 /** The canonical stdlib-global name `expr` denotes, or null. Three
@@ -3262,9 +3302,7 @@ export function stdlibGlobalNameOf(lowerer: Lowerer, expr: ts.Expression): strin
     // symbol has no ordinary declarations for the provenance check.
     if (
       expr.text === "globalThis" &&
-      (!symbol ||
-        lowerer.checker.declarationsOf(symbol).length === 0 ||
-        lowerer.isStdlibSymbol(symbol))
+      (!symbol || symbol.declarations.length === 0 || lowerer.isStdlibSymbol(symbol))
     )
       return "globalThis";
     if (!symbol) return null;
@@ -3272,7 +3310,7 @@ export function stdlibGlobalNameOf(lowerer: Lowerer, expr: ts.Expression): strin
     if (alias !== undefined) return alias;
     const classAlias = lowerer.builtinClassAliasOf(symbol);
     if (classAlias?.kind === "collection") return classAlias.which;
-    const decl = lowerer.checker.declarationsOf(symbol)[0];
+    const decl = symbol.declarations[0];
     if (decl !== undefined && ts.isImportClause(decl) && decl.name !== undefined) {
       const importDecl = decl.parent;
       if (ts.isImportDeclaration(importDecl) && ts.isStringLiteral(importDecl.moduleSpecifier)) {
@@ -3288,7 +3326,21 @@ export function stdlibGlobalNameOf(lowerer: Lowerer, expr: ts.Expression): strin
     // `Buffer` resolves to a user-file declaration and still misses.
     const resolved =
       symbol.flags & ts.SymbolFlags.Alias ? lowerer.checker.getAliasedSymbol(symbol) : symbol;
-    if (!lowerer.isStdlibSymbol(resolved)) return null;
+    if (!lowerer.isStdlibSymbol(resolved)) {
+      // A CommonJS binding of the buffer module's Buffer (`var Buffer =
+      // require('buffer').Buffer`, `const { Buffer } = require('buffer')`
+      // — safe-buffer and compression): the module member IS the global
+      // constructor.
+      if (
+        decl !== undefined &&
+        (ts.isVariableDeclaration(decl) || ts.isBindingElement(decl)) &&
+        isJsSourceFile(decl.getSourceFile())
+      ) {
+        const imported = lowerer.builtinImportOf(expr);
+        if (imported?.module === "buffer" && imported.member === "Buffer") return "Buffer";
+      }
+      return null;
+    }
     return resolved.name === "global" ? "globalThis" : resolved.name;
   }
   if (ts.isPropertyAccessExpression(expr) && !expr.questionDotToken) {
@@ -3363,7 +3415,9 @@ export function stdlibGlobalAliasNameOf(
   const name =
     requireSpec === "process" || requireSpec === "node:process"
       ? "process"
-      : stdlibGlobalNameOf(lowerer, aliasExpr);
+      : bufferNamespaceMember(lowerer, aliasExpr)
+        ? "Buffer"
+        : stdlibGlobalNameOf(lowerer, aliasExpr);
   if (name === null) return null;
   // These globals have provenance-aware call or member lowering, so a
   // stable snapshot keeps the same dispatch as the original global.
@@ -3384,6 +3438,14 @@ export function stdlibGlobalAliasNameOf(
     : null;
 }
 
+/** `buffer.Buffer` through a buffer-module namespace binding (`var buffer
+ * = require('buffer')`): the module's Buffer IS the global constructor. */
+export function bufferNamespaceMember(lowerer: Lowerer, expr: ts.Expression): boolean {
+  if (!ts.isPropertyAccessExpression(expr) || expr.name.text !== "Buffer") return false;
+  const member = lowerer.builtinMemberOf(expr);
+  return member?.module === "buffer" && member.member === "Buffer";
+}
+
 export function stdlibGlobalAliasDecl(
   lowerer: Lowerer,
   nameNode: ts.Node,
@@ -3411,7 +3473,7 @@ export function stdlibGlobalAliasDecl(
  * the SC2020 fence's wording: "typed by @types/node", not "standard
  * library". */
 export function nodeTypesOnlySymbol(lowerer: Lowerer, sym: ts.Symbol | null | undefined): boolean {
-  const decls = sym ? lowerer.checker.declarationsOf(sym) : undefined;
+  const decls = sym ? sym.declarations : undefined;
   if (!decls || decls.length === 0) return false;
   let viaNode = false;
   for (const d of decls) {
diff --git a/packages/compiler/src/frontend/lowering/symbol-fields.ts b/packages/compiler/src/frontend/lowering/symbol-fields.ts
index f4f536af9..0791fc6cd 100644
--- a/packages/compiler/src/frontend/lowering/symbol-fields.ts
+++ b/packages/compiler/src/frontend/lowering/symbol-fields.ts
@@ -1,5 +1,10 @@
 import * as ts from "../ts7/adapter.js";
-import { bindingEarlyUse7 } from "../program.js";
+import {
+  bindingEarlyUse7,
+  cjsExportDiscardReason,
+  isCjsExportTableLiteral,
+  isModuleExportsAccess,
+} from "../program.js";
 import type { Lowerer } from "./lowerer.js";
 import type { IrType } from "../../ir/ir.js";
 
@@ -26,7 +31,7 @@ function constantSymbolDescription(
   const symbol = lowerer.resolveValueSymbol(name);
   if (!symbol || seen.has(symbol)) return null;
   seen.add(symbol);
-  const declaration = lowerer.checker.valueDeclarationOf(symbol);
+  const declaration = symbol.valueDeclaration;
   if (
     !declaration ||
     !ts.isVariableDeclaration(declaration) ||
@@ -39,7 +44,7 @@ function constantSymbolDescription(
 }
 
 export function symbolFieldDisplayName(field: string): string {
-  return field.slice(FIELD_PREFIX.length);
+  return field.slice(FIELD_PREFIX.length).replace(/^\d+:/, "");
 }
 
 /** CopyDataProperties includes symbols, unlike the string-keyed view used
@@ -94,8 +99,13 @@ export function classSymbolKeyOfSymbol(lowerer: Lowerer, sym: ts.Symbol): ClassS
   const cached = cache.get(sym);
   if (cached !== undefined) return cached;
   cache.set(sym, null);
-  const decls = lowerer.checker.declarationsOf(sym);
-  const decl = lowerer.checker.valueDeclarationOf(sym);
+  const decls = sym.declarations;
+  const decl = sym.valueDeclaration;
+  if (decls.length === 1 && decl && ts.isPropertyAssignment(decl)) {
+    const key = cjsTableSymbolKeyOf(lowerer, sym, decl);
+    if (key) cache.set(sym, key);
+    return key;
+  }
   if (decls.length !== 1 || !decl || !ts.isVariableDeclaration(decl) || !ts.isIdentifier(decl.name))
     return null;
   const list = decl.parent;
@@ -124,21 +134,9 @@ export function classSymbolKeyOfSymbol(lowerer: Lowerer, sym: ts.Symbol): ClassS
     cache.set(sym, alias);
     return alias;
   }
-  if (!init || !ts.isCallExpression(init) || init.questionDotToken) return null;
-  const callee = init.expression;
-  const registered =
-    ts.isPropertyAccessExpression(callee) && !callee.questionDotToken && callee.name.text === "for";
-  const root = registered ? callee.expression : callee;
-  if (!ts.isIdentifier(root) || !lowerer.isStdlibGlobal(root, "Symbol")) return null;
-  const arg =
-    init.arguments.nodes.length === 0
-      ? null
-      : init.arguments.nodes.length === 1
-        ? init.arguments.nodes[0]!
-        : undefined;
-  if (arg === undefined || (registered && arg === null)) return null;
-  const description = arg === null ? "" : constantSymbolDescription(lowerer, arg);
-  if (description === null) return null;
+  const call = init ? literalSymbolCallOf(lowerer, init) : null;
+  if (!call) return null;
+  const { registered, description } = call;
   // Ordinary Symbol() is a fresh identity per evaluation, so only the
   // module-scope declaration above can name one fixed layout slot.
   const sf = decl.getSourceFile();
@@ -184,6 +182,18 @@ export function classSymbolKeyOfSymbol(lowerer: Lowerer, sym: ts.Symbol): ClassS
     ) !== null
   )
     return null;
+  const key = symbolKeyOf(lowerer, sym, registered, description);
+  cache.set(sym, key);
+  return key;
+}
+
+function symbolKeyOf(
+  lowerer: Lowerer,
+  sym: ts.Symbol,
+  registered: boolean,
+  description: string,
+  table = false,
+): ClassSymbolKey {
   // A registry name denotes one symbol even when several source bindings
   // initialize it. Intern those names into a representative checker symbol;
   // the layout table then has one identity-keyed domain for both forms.
@@ -193,16 +203,175 @@ export function classSymbolKeyOfSymbol(lowerer: Lowerer, sym: ts.Symbol): ClassS
     if (existing) identity = existing;
     else lowerer.registeredClassSymbols.set(description, sym);
   }
-  const key: ClassSymbolKey = {
+  // Distinct identities can share a description (undici's core and mock
+  // key tables both hold a `Symbol('close')`, and MockClient inherits one
+  // and declares the other). A key-table key whose description an earlier
+  // identity already holds takes an ordinal that keeps its slot apart; the
+  // printable name drops it. Const keys keep their plain names.
+  let identities = lowerer.symbolFieldIdentities.get(description);
+  if (!identities) lowerer.symbolFieldIdentities.set(description, (identities = []));
+  let ordinal = identities.indexOf(identity);
+  if (ordinal < 0) ordinal = identities.push(identity) - 1;
+  return {
     sym,
     identity,
     // Symbol slots are not string properties. The reserved prefix keeps
     // them out of the native class's string-keyed dynamic view, including
     // Object.keys/JSON serialization and string-property writeback.
-    fieldName: `${FIELD_PREFIX}Symbol(${description})`,
+    fieldName: `${FIELD_PREFIX}${table && ordinal > 0 ? `${ordinal}:` : ""}Symbol(${description})`,
   };
-  cache.set(sym, key);
-  return key;
+}
+
+/** `Symbol(<constant>)` or `Symbol.for(<constant>)` on the standard global. */
+function literalSymbolCallOf(
+  lowerer: Lowerer,
+  init: ts.Expression,
+): { registered: boolean; description: string } | null {
+  if (!ts.isCallExpression(init) || init.questionDotToken) return null;
+  const callee = init.expression;
+  const registered =
+    ts.isPropertyAccessExpression(callee) && !callee.questionDotToken && callee.name.text === "for";
+  const root = registered ? callee.expression : callee;
+  if (!ts.isIdentifier(root) || !lowerer.isStdlibGlobal(root, "Symbol")) return null;
+  const arg =
+    init.arguments.nodes.length === 0
+      ? null
+      : init.arguments.nodes.length === 1
+        ? init.arguments.nodes[0]!
+        : undefined;
+  if (arg === undefined || (registered && arg === null)) return null;
+  const description = arg === null ? "" : constantSymbolDescription(lowerer, arg);
+  return description === null ? null : { registered, description };
+}
+
+/** A key table property: `kX: Symbol('x')` in a JS module's effective
+ * top-level `module.exports = { ... }` literal (undici's core/symbols.js).
+ * The module evaluates once, so the property names one symbol identity for
+ * every requirer, as a module-scope const does. Requirers can observe the
+ * table only after its assignment completes, provided nothing before it
+ * can run code (a require there could close a cycle and publish the
+ * initial empty exports object instead). Any write to the property, or
+ * replacement through `exports`/`module.exports`, keeps it unstable. */
+function cjsTableSymbolKeyOf(
+  lowerer: Lowerer,
+  sym: ts.Symbol,
+  decl: ts.PropertyAssignment,
+): ClassSymbolKey | null {
+  const table = decl.parent;
+  if (!ts.isObjectLiteralExpression(table) || !ts.isIdentifier(decl.name)) return null;
+  const assign = table.parent;
+  if (
+    !ts.isBinaryExpression(assign) ||
+    assign.right !== table ||
+    !isCjsExportTableLiteral(table) ||
+    !ts.isExpressionStatement(assign.parent)
+  )
+    return null;
+  const stmt = assign.parent;
+  const sf = stmt.getSourceFile();
+  if (cjsExportDiscardReason(stmt) !== null) return null;
+  const call = literalSymbolCallOf(lowerer, decl.initializer);
+  if (!call) return null;
+  const inert = (expr: ts.Expression | undefined): boolean => {
+    if (!expr) return true;
+    while (ts.isParenthesizedExpression(expr)) expr = expr.expression;
+    return (
+      ts.isIdentifier(expr) ||
+      ts.isArrowFunction(expr) ||
+      ts.isFunctionExpression(expr) ||
+      ts.isStringLiteralLike(expr) ||
+      ts.isNumericLiteral(expr) ||
+      expr.kind === ts.SyntaxKind.TrueKeyword ||
+      expr.kind === ts.SyntaxKind.FalseKeyword ||
+      expr.kind === ts.SyntaxKind.NullKeyword ||
+      literalSymbolCallOf(lowerer, expr) !== null
+    );
+  };
+  const statements = sf.statements.nodes;
+  const prefixInert = statements
+    .slice(0, statements.indexOf(stmt))
+    .every(
+      (statement) =>
+        (ts.isExpressionStatement(statement) && ts.isStringLiteral(statement.expression)) ||
+        ts.isFunctionDeclaration(statement) ||
+        (ts.isVariableStatement(statement) &&
+          statement.declarationList.declarations.nodes.every(
+            (d) => ts.isIdentifier(d.name) && inert(d.initializer),
+          )),
+    );
+  if (!prefixInert) return null;
+  for (const property of table.properties.nodes) {
+    if (property === decl) break;
+    if (ts.isShorthandPropertyAssignment(property)) continue;
+    if (
+      !ts.isPropertyAssignment(property) ||
+      ts.isComputedPropertyName(property.name) ||
+      !inert(property.initializer)
+    )
+      return null;
+  }
+  // Requirers can reach the property through a checker-synthesized symbol
+  // (the export= type's member); the declaration's own symbol is the one
+  // identity every requirer and the table's export global share.
+  const canonical = lowerer.checker.getSymbolAtLocation(decl.name) ?? sym;
+  if (tablePropertyWritten(lowerer, new Set([sym, canonical]), decl.name.text, sf)) return null;
+  return { ...symbolKeyOf(lowerer, canonical, call.registered, call.description, true), sym };
+}
+
+function tablePropertyWritten(
+  lowerer: Lowerer,
+  symbols: ReadonlySet<ts.Symbol>,
+  name: string,
+  home: ts.SourceFile,
+): boolean {
+  let written = false;
+  const targets = (node: ts.Node): boolean => {
+    if (ts.isPropertyAccessExpression(node)) {
+      if (node.name.text !== name) return false;
+      const recv = node.expression;
+      if (
+        node.getSourceFile() === home &&
+        ((ts.isIdentifier(recv) && recv.text === "exports") || isModuleExportsAccess(recv))
+      )
+        return true;
+      const target = lowerer.checker.getSymbolAtLocation(node.name);
+      return target !== undefined && symbols.has(target);
+    }
+    if (ts.isElementAccessExpression(node)) {
+      const key = node.argumentExpression;
+      if (!ts.isStringLiteralLike(key) || key.text !== name) return false;
+      const target = lowerer.checker.getSymbolAtLocation(node);
+      return target !== undefined && symbols.has(target);
+    }
+    return false;
+  };
+  for (const sf of lowerer.program.getSourceFiles()) {
+    if (written) break;
+    if (sf.isDeclarationFile || !sf.text.includes(name)) continue;
+    ts.walkPreorder(sf, (node) => {
+      if (written) return "stop";
+      let target: ts.Node | undefined;
+      if (
+        ts.isBinaryExpression(node) &&
+        node.operatorToken.kind >= ts.SyntaxKind.FirstAssignment &&
+        node.operatorToken.kind <= ts.SyntaxKind.LastAssignment
+      )
+        target = node.left;
+      else if (ts.isDeleteExpression(node)) target = node.expression;
+      else if (
+        (ts.isPrefixUnaryExpression(node) || ts.isPostfixUnaryExpression(node)) &&
+        (node.operator === ts.SyntaxKind.PlusPlusToken ||
+          node.operator === ts.SyntaxKind.MinusMinusToken)
+      )
+        target = node.operand;
+      if (target && targets(target)) {
+        written = true;
+        return "stop";
+      }
+      return undefined;
+    });
+  }
+  return written;
 }
 
 function bindingWritten(lowerer: Lowerer, sym: ts.Symbol, sf: ts.SourceFile): boolean {
@@ -245,3 +414,29 @@ function bindingWritten(lowerer: Lowerer, sym: ts.Symbol, sf: ts.SourceFile): bo
   });
   return written;
 }
+
+/** The layout type of a symbol-keyed field read through a CommonJS
+ * key-table key (`this[kCount]` with `kCount` from a `module.exports = {
+ * kCount: Symbol('count') }` table), or null. The checker types such keys
+ * as plain `symbol`, so it answers the read with the union of every
+ * symbol-keyed property of the class; the field's own type is the read's
+ * type. Keys declared as consts keep their unique-symbol checker types. */
+export function tableKeyFieldType(
+  lowerer: Lowerer,
+  node: ts.ElementAccessExpression,
+): IrType | null {
+  const key = node.argumentExpression;
+  if (!ts.isIdentifier(key) && !ts.isPropertyAccessExpression(key)) return null;
+  const keyType = lowerer.checker.getTypeAtLocation(key);
+  if (!(keyType.flags & ts.TypeFlags.ESSymbol) || keyType.flags & ts.TypeFlags.UniqueESSymbol)
+    return null;
+  const resolved = classSymbolKeyOf(lowerer, key);
+  if (!resolved) return null;
+  const decl = resolved.identity.valueDeclaration;
+  if (!decl || !ts.isPropertyAssignment(decl)) return null;
+  const receiver = lowerer.mapTypeOf(lowerer.checker.getTypeAtLocation(node.expression));
+  if (receiver?.kind !== "object") return null;
+  const info = lowerer.classes.get(receiver.className);
+  const field = info?.symbolFields?.get(resolved.identity);
+  return field === undefined ? null : (info!.fields.get(field) ?? null);
+}
diff --git a/packages/compiler/src/frontend/lowering/thread-slots.ts b/packages/compiler/src/frontend/lowering/thread-slots.ts
index 6ec9af036..8227c6bd0 100644
--- a/packages/compiler/src/frontend/lowering/thread-slots.ts
+++ b/packages/compiler/src/frontend/lowering/thread-slots.ts
@@ -22,6 +22,7 @@ import {
   threadSlotsMemberOf,
 } from "../experimental-import.js";
 import * as ts from "../ts7/adapter.js";
+import { withUndefinedArm } from "../type-mapper.js";
 import type { ClassInfo } from "./lower-classes.js";
 import type { Lowerer } from "./lowerer.js";
 import { locOf } from "../program.js";
@@ -168,7 +169,7 @@ function declaringNew(lowerer: Lowerer, receiver: ts.Expression): ts.NewExpressi
   let symbol = checker.getSymbolAtLocation(ref);
   if (symbol !== undefined && (symbol.flags & ts.SymbolFlags.Alias) !== 0)
     symbol = checker.getAliasedSymbol(symbol);
-  const decl = symbol ? checker.declarationsOf(symbol)[0] : undefined;
+  const decl = symbol ? symbol.declarations[0] : undefined;
   if (decl === undefined || !ts.isVariableDeclaration(decl)) return null;
   const list = decl.parent;
   if (
@@ -238,10 +239,16 @@ export function lowerThreadSlotsCall(lowerer: Lowerer, expr: ts.CallExpression):
   const args = [name, receiver, key];
   switch (member) {
     case "get": {
+      // The slots hold values in the layout of the type the constructor registered (`family.value`,
+      // which `set` stores with). The receiver's annotation can name a structurally wider value
+      // type, so the value read is converted to the call's type like any value flowing into it.
       const resultTs = lowerer.typeOf(expr);
       const result = lowerer.mapTypeOf(resultTs);
       if (result === null) lowerer.badType(expr, resultTs);
-      return { kind: "intrinsic", name: "slots.get", args, type: result!, loc };
+      const stored = withUndefinedArm(family.value, lowerer.unions);
+      if (stored === null) lowerer.badType(expr, resultTs);
+      const read: IrExpr = { kind: "intrinsic", name: "slots.get", args, type: stored!, loc };
+      return typeKey(stored!) === typeKey(result!) ? read : lowerer.coerceInto(expr, read, result!);
     }
     case "has":
     case "delete":
diff --git a/packages/compiler/src/frontend/lowering/union-retag.test.ts b/packages/compiler/src/frontend/lowering/union-retag.test.ts
index 0cb7b1b9f..8116d6378 100644
--- a/packages/compiler/src/frontend/lowering/union-retag.test.ts
+++ b/packages/compiler/src/frontend/lowering/union-retag.test.ts
@@ -1,7 +1,12 @@
 import { describe, expect, test } from "vitest";
 import { BOOL, F64, NULL_T, STRING, UNDEFINED_T, typeEquals, typeKey } from "../../ir/ir.js";
 import type { IrRecordShape, IrType, IrUnionDef, SrcLoc } from "../../ir/ir.js";
-import { planUnionRetag, buildUnionRetag, planRecordUnionWrap } from "./union-retag.js";
+import {
+  planUnionRetag,
+  buildUnionRetag,
+  planRecordUnionLift,
+  planRecordUnionWrap,
+} from "./union-retag.js";
 import type { UnionRetagArm } from "./union-retag.js";
 import type { WidthLift } from "./width-lift.js";
 
@@ -126,6 +131,30 @@ describe("record conversion with shared layouts", () => {
     f.shapes[2]!.fields.reverse();
     expect(planRecordUnionWrap(f.shapes[1]!, f.to, f.shapeOf)).toBeNull();
   });
+
+  test("routes a record that fits several arms by its discriminant", () => {
+    const f = fixture();
+    expect(planRecordUnionLift(f.shapes[0]!, f.to, f.shapeOf, f.lift)).toEqual({
+      field: "kind",
+      fieldType: STRING,
+      routes: [
+        { tag: 0, lift: { how: "width" }, values: ["left"] },
+        { tag: 1, lift: { how: "width" }, values: ["right"] },
+      ],
+    });
+    // Without the discriminant field, or without an arm it converts into,
+    // there is no route.
+    const unnamed: IrRecordShape = { id: "r3", fields: f.shapes[0]!.fields.slice(1) };
+    expect(planRecordUnionLift(unnamed, f.to, f.shapeOf, f.lift)).toBeNull();
+    const unrelated: IrRecordShape = {
+      id: "r4",
+      fields: [
+        { name: "kind", type: STRING },
+        { name: "other", type: F64 },
+      ],
+    };
+    expect(planRecordUnionLift(unrelated, f.to, f.shapeOf, f.lift)).toBeNull();
+  });
 });
 
 describe("union conversion planning", () => {
diff --git a/packages/compiler/src/frontend/lowering/union-retag.ts b/packages/compiler/src/frontend/lowering/union-retag.ts
index 8d1c61d09..1c435ab36 100644
--- a/packages/compiler/src/frontend/lowering/union-retag.ts
+++ b/packages/compiler/src/frontend/lowering/union-retag.ts
@@ -86,6 +86,36 @@ export function planRecordUnionWrap(
   return { field: discriminant.field, fieldType, routes };
 }
 
+/** A record whose layout converts into more than one arm of a
+ * discriminated union. The IR keeps the discriminant field as a plain
+ * string, so its layout alone cannot say which variant it is; the value of
+ * the discriminant does, as in JavaScript. Every record arm the record
+ * converts into (by copy or width) becomes a route selected by that arm's
+ * discriminant values. A value no route names throws the catchable
+ * TypeError. */
+export function planRecordUnionLift(
+  source: IrRecordShape,
+  to: IrUnionDef,
+  shapeOf: (id: string) => IrRecordShape | undefined,
+  widthLift: (src: IrType, dst: IrType) => WidthLift | null,
+): RecordUnionWrapPlan | null {
+  const discriminant = to.discriminant;
+  if (!discriminant || source.tuple || source.indexValue || shapeHasAccessorSlots(source))
+    return null;
+  const fieldType = discriminantField(source, discriminant.field);
+  if (!fieldType || discriminantOwners(to, shapeOf) === null) return null;
+  const sourceType: IrType = { kind: "record", shapeId: source.id };
+  const routes: UnionRetagRoute[] = [];
+  for (const entry of discriminant.cases) {
+    const arm = to.arms[entry.tag];
+    if (!arm || arm.kind !== "record") continue;
+    const lift = arm.shapeId === source.id ? { how: "copy" as const } : widthLift(sourceType, arm);
+    if (lift === null) continue;
+    routes.push({ tag: entry.tag, lift, values: entry.values });
+  }
+  return routes.length > 0 ? { field: discriminant.field, fieldType, routes } : null;
+}
+
 /** Pure conversion planning. A source storage tag need not denote just
  * one semantic variant: refinements can coalesce recursive record layouts.
  * When both unions name the same discriminant, its values select target
diff --git a/packages/compiler/src/frontend/lowering/width-lift.ts b/packages/compiler/src/frontend/lowering/width-lift.ts
index 40c533d72..d90f9ed35 100644
--- a/packages/compiler/src/frontend/lowering/width-lift.ts
+++ b/packages/compiler/src/frontend/lowering/width-lift.ts
@@ -7,6 +7,7 @@ export type WidthLift =
   | { how: "copy" }
   | { how: "wrap"; tag: number }
   | { how: "discriminantWrap" }
+  | { how: "discriminantRoute" }
   | { how: "retag" }
   | { how: "liftWrap"; tag: number; arm: IrType }
   | { how: "width" }
diff --git a/packages/compiler/src/frontend/npm-static-subtyping.ts b/packages/compiler/src/frontend/npm-static-subtyping.ts
index a81cbf263..04c66a559 100644
--- a/packages/compiler/src/frontend/npm-static-subtyping.ts
+++ b/packages/compiler/src/frontend/npm-static-subtyping.ts
@@ -16,14 +16,12 @@ export function isNpmStaticSubclassArgument(
     const symbol = type.getSymbol();
     return (
       symbol !== undefined &&
-      checker
-        .declarationsOf(symbol)
-        .some(
-          (declaration) =>
-            (ts.isClassDeclaration(declaration) || ts.isClassExpression(declaration)) &&
-            /\.[cm]?js$/.test(declaration.getSourceFile().fileName) &&
-            npmStaticPackageOfPath(declaration.getSourceFile().fileName) !== null,
-        )
+      symbol.declarations.some(
+        (declaration) =>
+          (ts.isClassDeclaration(declaration) || ts.isClassExpression(declaration)) &&
+          /\.[cm]?js$/.test(declaration.getSourceFile().fileName) &&
+          npmStaticPackageOfPath(declaration.getSourceFile().fileName) !== null,
+      )
     );
   };
   const subtype = (actual: ts.Type, expected: ts.Type): boolean => {
diff --git a/packages/compiler/src/frontend/program.ts b/packages/compiler/src/frontend/program.ts
index bde168c38..d7c2ba66a 100644
--- a/packages/compiler/src/frontend/program.ts
+++ b/packages/compiler/src/frontend/program.ts
@@ -1225,9 +1225,9 @@ function pureCjsExport7(program: ts.Program, stmt: ts.Statement): boolean {
   const symbol = checker.getSymbolAtLocation(value);
   return (
     symbol !== undefined &&
-    checker
-      .declarationsOf(symbol)
-      .some((decl) => ts.isFunctionDeclaration(decl) && decl.parent === stmt.parent)
+    symbol.declarations.some(
+      (decl) => ts.isFunctionDeclaration(decl) && decl.parent === stmt.parent,
+    )
   );
 }
 
@@ -1236,9 +1236,9 @@ function sourceBinding7(program: ts.Program, ident: ts.Identifier): boolean {
   const symbol = checker.getSymbolAtLocation(ident);
   return (
     symbol !== undefined &&
-    checker
-      .declarationsOf(symbol)
-      .some((decl) => !decl.getSourceFile().isDeclarationFile && !ts.isSourceFile(decl))
+    symbol.declarations.some(
+      (decl) => !decl.getSourceFile().isDeclarationFile && !ts.isSourceFile(decl),
+    )
   );
 }
 
@@ -1953,7 +1953,7 @@ function stripRequireCasts7(expr: ts.Expression): ts.Expression {
 function isCreateRequireImport7(program: ts.Program, ident: ts.Identifier): boolean {
   const checker = program.getTypeChecker();
   const symbol = checker.getSymbolAtLocation(ident);
-  const decl = symbol ? checker.declarationsOf(symbol)[0] : undefined;
+  const decl = symbol ? symbol.declarations[0] : undefined;
   if (decl === undefined || !ts.isImportSpecifier(decl)) return false;
   const importDecl = decl.parent?.parent?.parent;
   if (ts.isImportDeclaration(importDecl) && ts.isStringLiteral(importDecl.moduleSpecifier)) {
@@ -1963,7 +1963,7 @@ function isCreateRequireImport7(program: ts.Program, ident: ts.Identifier): bool
   }
   if (symbol !== undefined && (symbol.flags & ts.SymbolFlags.Alias) !== 0) {
     const target = checker.getAliasedSymbol(symbol);
-    const targetDecl = checker.declarationsOf(target)[0];
+    const targetDecl = target.declarations[0];
     if (targetDecl !== undefined && targetDecl.getSourceFile().isDeclarationFile) {
       for (
         let p: ts.Node | undefined = targetDecl.parent;
@@ -1988,9 +1988,7 @@ export function isCreateRequireBinding7(program: ts.Program, callee: ts.Identifi
   const checker = program.getTypeChecker();
   const symbol = checker.getSymbolAtLocation(callee);
   const decl = symbol
-    ? checker
-        .declarationsOf(symbol)
-        .find((d): d is ts.VariableDeclaration => ts.isVariableDeclaration(d))
+    ? symbol.declarations.find((d): d is ts.VariableDeclaration => ts.isVariableDeclaration(d))
     : undefined;
   if (
     decl === undefined ||
@@ -2054,7 +2052,7 @@ function stableCreateRequireBindingReason7(
     }
     const checker = program.getTypeChecker();
     const symbol = checker.getSymbolAtLocation(decl.name);
-    if (!symbol || checker.declarationsOf(symbol).length !== 1)
+    if (!symbol || symbol.declarations.length !== 1)
       return "its createRequire binding is redeclared";
     if ((ts.getCombinedModifierFlags(decl) & ts.ModifierFlags.Export) !== 0)
       return "its createRequire result escapes through an exported binding";
@@ -2204,7 +2202,7 @@ function requireCallBindingKind7(program: ts.Program, node: ts.Node): RequireCal
   const checker = program.getTypeChecker();
   const symbol = checker.getSymbolAtLocation(call.expression);
   if (symbol === undefined) return "ambient";
-  const decls = checker.declarationsOf(symbol);
+  const decls = symbol.declarations;
   if (decls.every((d) => d.getSourceFile().isDeclarationFile)) return "ambient";
   return isCreateRequireBinding7(program, call.expression) ? "createRequire" : "source";
 }
@@ -2359,7 +2357,7 @@ function selfImportTdzFences7(
   // The aliased declaration's TDZ horizon: the position after which reads
   // are initialized. Hoisted functions have none.
   const tdzEndOf = (aliased: ts.Symbol): number | null => {
-    const d = checker.valueDeclarationOf(aliased) ?? checker.declarationsOf(aliased)[0];
+    const d = aliased.valueDeclaration ?? aliased.declarations[0];
     if (d === undefined || d.getSourceFile() !== sf) return null;
     if (ts.isFunctionDeclaration(d)) return null;
     return d.getEnd();
@@ -2616,7 +2614,7 @@ function topLevelInertness7(program: ts.Program): (stmt: ts.Statement) => ts.Nod
     let sym = checker.getSymbolAtLocation(root);
     if (sym === undefined) return false;
     if (sym.flags & ts.SymbolFlags.Alias) sym = checker.getAliasedSymbol(sym);
-    const decls = checker.declarationsOf(sym);
+    const decls = sym.declarations;
     return decls.length > 0 && decls.every((d) => d.getSourceFile().isDeclarationFile);
   };
   const hasDecorator = (n: ts.Node): boolean =>
@@ -3840,7 +3838,7 @@ function returnsOnlyClosuresOver7(
   if (symbol !== undefined && symbol.flags & ts.SymbolFlags.Alias) {
     symbol = checker.getAliasedSymbol(symbol);
   }
-  const decls = symbol === undefined ? [] : checker.declarationsOf(symbol);
+  const decls = symbol === undefined ? [] : symbol.declarations;
   if (decls.length !== 1) return false;
   const decl = decls[0]!;
   if (decl.getSourceFile().isDeclarationFile) return false;
@@ -3963,7 +3961,7 @@ function laterJobCallee7(checker: ts.TypeChecker, callee: ts.Expression): boolea
     symbol = checker.getAliasedSymbol(symbol);
   }
   if (symbol === undefined) return false;
-  const decls = checker.declarationsOf(symbol);
+  const decls = symbol.declarations;
   if (decls.length === 0 || !decls.every((d) => d.getSourceFile().isDeclarationFile)) return false;
   if (LATER_JOB_BUILTINS7.has(name.text)) return true;
   // The JavaScript standard library's callbacks mostly run synchronously;
@@ -4081,6 +4079,12 @@ function resolveNpmImport7(
   if (isRelativeSpecifier(specifier) || specifier.startsWith("node:")) {
     return null;
   }
+  // Node resolves a bare core-module name (`string_decoder`, `events`,
+  // `fs/promises`) to the builtin before it looks in node_modules, so an
+  // installed npm package of the same name never answers it. Prefix-only
+  // builtins (`node:test`) are listed with their prefix, so a bare `test`
+  // still names the package.
+  if (nodeBuiltinNames.has(specifier)) return null;
   // --provenance-sources: a registered specifier is NOT an npm import —
   // its attested source compiles as program modules (resolveProjectModule
 
@@ -5582,18 +5586,16 @@ function analyzeEsmNamedImportLinks(
       if (
         name === "default" &&
         hasNodeTsDefaultInterfacePlaceholder7(dep) &&
-        checker
-          .declarationsOf(resolved)
-          .some(
-            (declaration) =>
-              ts.isInterfaceDeclaration(declaration) &&
-              ts
-                .getModifiers(declaration)
-                ?.some((modifier) => modifier.kind === ts.SyntaxKind.DefaultKeyword) === true &&
-              ts
-                .getModifiers(declaration)
-                ?.some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword) === true,
-          )
+        resolved.declarations.some(
+          (declaration) =>
+            ts.isInterfaceDeclaration(declaration) &&
+            ts
+              .getModifiers(declaration)
+              ?.some((modifier) => modifier.kind === ts.SyntaxKind.DefaultKeyword) === true &&
+            ts
+              .getModifiers(declaration)
+              ?.some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword) === true,
+        )
       ) {
         return resolved;
       }
diff --git a/packages/compiler/src/frontend/threads-import.ts b/packages/compiler/src/frontend/threads-import.ts
index 12425c360..1944b2b81 100644
--- a/packages/compiler/src/frontend/threads-import.ts
+++ b/packages/compiler/src/frontend/threads-import.ts
@@ -11,7 +11,7 @@ export type ThreadsMember = "publish" | "sharesPublishedGraphs";
 export function threadsImportOf(program: ts.Program, ident: ts.Identifier): ThreadsMember | null {
   const checker = program.getTypeChecker();
   const symbol = checker.getSymbolAtLocation(ident);
-  const decl = symbol ? checker.declarationsOf(symbol)[0] : undefined;
+  const decl = symbol ? symbol.declarations[0] : undefined;
   if (decl === undefined || !ts.isImportSpecifier(decl)) return null;
   const importDecl = decl.parent?.parent?.parent;
   if (
diff --git a/packages/compiler/src/frontend/tier-analysis.ts b/packages/compiler/src/frontend/tier-analysis.ts
index 248b3f922..2ed5c8c9b 100644
--- a/packages/compiler/src/frontend/tier-analysis.ts
+++ b/packages/compiler/src/frontend/tier-analysis.ts
@@ -474,7 +474,7 @@ class UnitResolver {
     let symbol = this.checker.getSymbolAtLocation(root);
     if (symbol !== undefined && (symbol.flags & ts.SymbolFlags.Alias) !== 0)
       symbol = this.checker.getAliasedSymbol(symbol);
-    const decls = symbol === undefined ? [] : this.checker.declarationsOf(symbol);
+    const decls = symbol === undefined ? [] : symbol.declarations;
     const decl = decls.find((d) => !d.getSourceFile().isDeclarationFile);
     if (decl === undefined) {
       // CommonJS `exports`/`module` as values: the module object.
diff --git a/packages/compiler/src/frontend/ts7/checker-cache.ts b/packages/compiler/src/frontend/ts7/checker-cache.ts
index b9a455a0d..1613272e1 100644
--- a/packages/compiler/src/frontend/ts7/checker-cache.ts
+++ b/packages/compiler/src/frontend/ts7/checker-cache.ts
@@ -44,9 +44,6 @@ export class CheckerCache {
   readonly managedSymbols = new Set<SourceFile>();
   readonly intrinsics = new Map<string, Type>();
   readonly tupleTypeAnswer = new Map<Type, boolean>();
-  readonly declsOf = new Map<Ts7Symbol, readonly Node[]>();
-  readonly valueDeclOf = new Map<Ts7Symbol, Node | undefined>();
-  readonly sigDeclOf = new Map<Signature, Node | undefined>();
   readonly callSigsOf = new Map<Type, readonly Signature[]>();
   readonly ctorSigsOf = new Map<Type, readonly Signature[]>();
   readonly constantValueOf = new Map<Node, string | number | undefined>();
@@ -90,9 +87,6 @@ export class CheckerCache {
     this.managedSymbols.clear();
     this.intrinsics.clear();
     this.tupleTypeAnswer.clear();
-    this.declsOf.clear();
-    this.valueDeclOf.clear();
-    this.sigDeclOf.clear();
     this.callSigsOf.clear();
     this.ctorSigsOf.clear();
     this.constantValueOf.clear();
diff --git a/packages/compiler/src/frontend/ts7/checker.test.ts b/packages/compiler/src/frontend/ts7/checker.test.ts
index d9b6e44a1..7b3647b2d 100644
--- a/packages/compiler/src/frontend/ts7/checker.test.ts
+++ b/packages/compiler/src/frontend/ts7/checker.test.ts
@@ -80,7 +80,7 @@ test("unchanged AST identities receive independent semantic answers after a depe
     const oldType = old.getTypeAtLocation(name);
     const oldSymbol = old.getSymbolAtLocation(name)!;
     expect(old.typeToString(oldType)).toBe("number");
-    expect(old.valueDeclarationOf(oldSymbol)).toBe(declaration(root, "result"));
+    expect(oldSymbol.valueDeclaration).toBe(declaration(root, "result"));
 
     h.paths.set(h.path("dependency.ts"), 'export const value: string = "changed";');
     const second = h.session.updateSnapshot({
@@ -165,9 +165,6 @@ test("all public query and prefetch entry points reject a disposed facade before
     facade.typeToString(type);
     facade.prefetchSourceFile(root);
     const calls: Record<string, () => unknown> = {
-      declarationsOf: () => facade.declarationsOf(symbol),
-      valueDeclarationOf: () => facade.valueDeclarationOf(symbol),
-      signatureDeclaration: () => facade.signatureDeclaration(signature),
       getCallSignatures: () => facade.getCallSignatures(type),
       getConstructSignatures: () => facade.getConstructSignatures(type),
       getPropertyOfType: () => facade.getPropertyOfType(type, "missing"),
diff --git a/packages/compiler/src/frontend/ts7/checker.ts b/packages/compiler/src/frontend/ts7/checker.ts
index f3ef51a3d..41eb0d0b9 100644
--- a/packages/compiler/src/frontend/ts7/checker.ts
+++ b/packages/compiler/src/frontend/ts7/checker.ts
@@ -1,5 +1,4 @@
 import { CheckerCache } from "./checker-cache.js";
-import { InternalCompilerError } from "../../errors.js";
 /* The checker facade: 5.9.3-shaped TypeChecker methods over 7.0.2's sync
  * client, built around the survey's feasibility verdict. Naive per-call use
  * of the 7.0.2 client costs 0.1-0.3 ms of IPC per query; the census counted
@@ -238,60 +237,6 @@ export class CheckerFacade {
     this.cache.dispose();
   }
 
-  /* ── the symbol-declaration surface (phase 3) ─────────────────────────
-   * 7's Symbol carries declarations as NodeHandles (server references),
-   * where 5.9.3 handed out the nodes themselves. The lowering reads
-   * symbol.declarations/valueDeclaration pervasively, so the facade owns
-   * the resolve step (NodeHandle.resolve into the client AST — identity-
-   * stable, probe-verified) and memoizes per symbol. Requires the project
-   * the symbols came from (options.project — Ts7Program supplies it). */
-
-  private requireProject(): Project {
-    const project = this.options.project;
-    if (!project)
-      throw new InternalCompilerError(
-        "CheckerFacade built without a project cannot resolve declarations",
-      );
-    return project;
-  }
-
-  /** 5.9.3's symbol.declarations (never undefined here: 7 answers an empty
-   * array where 5.9.3 answered undefined — callers treat them alike). */
-  declarationsOf(symbol: Ts7Symbol): readonly Node[] {
-    this.ensureActive();
-    let decls = this.cache.declsOf.get(symbol);
-    if (decls === undefined) {
-      const project = this.requireProject();
-      const resolved: Node[] = [];
-      for (const handle of symbol.declarations) {
-        const node = handle.resolve(project);
-        if (node !== undefined) resolved.push(node);
-      }
-      decls = resolved;
-      this.cache.declsOf.set(symbol, decls);
-    }
-    return decls;
-  }
-
-  /** 5.9.3's symbol.valueDeclaration. */
-  valueDeclarationOf(symbol: Ts7Symbol): Node | undefined {
-    this.ensureActive();
-    if (this.cache.valueDeclOf.has(symbol)) return this.cache.valueDeclOf.get(symbol);
-    const decl = symbol.valueDeclaration?.resolve(this.requireProject());
-    this.cache.valueDeclOf.set(symbol, decl);
-    return decl;
-  }
-
-  /** 5.9.3's signature.getDeclaration() (undefined for synthesized
-   * signatures — same contract as sig.declaration there). */
-  signatureDeclaration(signature: Signature): Node | undefined {
-    this.ensureActive();
-    if (this.cache.sigDeclOf.has(signature)) return this.cache.sigDeclOf.get(signature);
-    const decl = signature.declaration?.resolve(this.requireProject());
-    this.cache.sigDeclOf.set(signature, decl);
-    return decl;
-  }
-
   /** 5.9.3's type.getCallSignatures(). */
   getCallSignatures(type: Type): readonly Signature[] {
     this.ensureActive();
diff --git a/packages/compiler/src/frontend/ts7/semantic-model.ts b/packages/compiler/src/frontend/ts7/semantic-model.ts
index 095021922..4920c96ae 100644
--- a/packages/compiler/src/frontend/ts7/semantic-model.ts
+++ b/packages/compiler/src/frontend/ts7/semantic-model.ts
@@ -294,8 +294,12 @@ export class SemanticSymbol {
   readonly name: string;
   readonly flags: number;
   readonly checkFlags: number;
-  readonly declarations: SemanticNodeHandle[];
-  readonly valueDeclaration: SemanticNodeHandle | undefined;
+  /** The declarations' node handles, as the server sends them. */
+  readonly declarationHandles: SemanticNodeHandle[];
+  readonly valueDeclarationHandle: SemanticNodeHandle | undefined;
+  private declarationNodes: readonly AstNode[] | undefined;
+  private valueDeclarationNode: AstNode | undefined;
+  private valueDeclarationResolved = false;
   private readonly parent: number | undefined;
   private readonly exportSymbol: number | undefined;
   private membersCache: Map<string, SemanticSymbol> | undefined;
@@ -310,16 +314,40 @@ export class SemanticSymbol {
     this.name = data.name.startsWith("___") ? data.name.slice(1) : data.name;
     this.flags = data.flags;
     this.checkFlags = data.checkFlags;
-    this.declarations = (data.declarations ?? []).map(
+    this.declarationHandles = (data.declarations ?? []).map(
       (handle) => new SemanticNodeHandle(handle, canonicalProject),
     );
-    this.valueDeclaration = data.valueDeclaration
+    this.valueDeclarationHandle = data.valueDeclaration
       ? new SemanticNodeHandle(data.valueDeclaration, canonicalProject)
       : undefined;
     this.parent = data.parent;
     this.exportSymbol = data.exportSymbol;
   }
 
+  /** The declaration nodes, resolved in the symbol's project. A handle whose
+   * file the project doesn't have resolves to nothing and is left out. */
+  get declarations(): readonly AstNode[] {
+    this.canonicalProject.ensureActive();
+    if (this.declarationNodes === undefined) {
+      const nodes: AstNode[] = [];
+      for (const handle of this.declarationHandles) {
+        const node = handle.resolve();
+        if (node !== undefined) nodes.push(node);
+      }
+      this.declarationNodes = nodes;
+    }
+    return this.declarationNodes;
+  }
+
+  get valueDeclaration(): AstNode | undefined {
+    this.canonicalProject.ensureActive();
+    if (!this.valueDeclarationResolved) {
+      this.valueDeclarationNode = this.valueDeclarationHandle?.resolve();
+      this.valueDeclarationResolved = true;
+    }
+    return this.valueDeclarationNode;
+  }
+
   getParent(): SemanticSymbol | undefined {
     return this.canonicalProject.fetchSymbol(this.id, "getParentOfSymbol", this.parent);
   }
@@ -603,7 +631,10 @@ export class SemanticType {
 export class SemanticSignature {
   readonly id: number;
   readonly flags: number;
-  readonly declaration: SemanticNodeHandle | undefined;
+  /** The declaration's node handle, as the server sends it. */
+  readonly declarationHandle: SemanticNodeHandle | undefined;
+  private declarationNode: AstNode | undefined;
+  private declarationResolved = false;
 
   constructor(
     private readonly data: SignatureResponse,
@@ -611,11 +642,22 @@ export class SemanticSignature {
   ) {
     this.id = data.id;
     this.flags = data.flags;
-    this.declaration = data.declaration
+    this.declarationHandle = data.declaration
       ? new SemanticNodeHandle(data.declaration, project)
       : undefined;
   }
 
+  /** The declaration node, resolved in the signature's project; undefined
+   * for a signature the checker synthesized. */
+  get declaration(): AstNode | undefined {
+    this.project.ensureActive();
+    if (!this.declarationResolved) {
+      this.declarationNode = this.declarationHandle?.resolve();
+      this.declarationResolved = true;
+    }
+    return this.declarationNode;
+  }
+
   getTypeParameters(): SemanticType[] {
     return this.project.fetchTypes(
       this.id,
diff --git a/packages/compiler/src/frontend/type-mapper.ts b/packages/compiler/src/frontend/type-mapper.ts
index 123a5d1a0..ea706992a 100644
--- a/packages/compiler/src/frontend/type-mapper.ts
+++ b/packages/compiler/src/frontend/type-mapper.ts
@@ -125,6 +125,19 @@ export function jsOpenObjectType(
     : type;
 }
 
+/** The WebCrypto interfaces whose values are checked-dynamic: the crypto
+ * global, SubtleCrypto, CryptoKey handles and the algorithm dictionaries
+ * (scr_webcrypto.c). */
+export const WEBCRYPTO_DYN_TYPES: ReadonlySet<string> = new Set([
+  "Crypto",
+  "SubtleCrypto",
+  "CryptoKey",
+  "Algorithm",
+  "KeyAlgorithm",
+  "HmacImportParams",
+  "HmacKeyAlgorithm",
+]);
+
 export const FETCH_AMBIENT_TYPES = [
   "Response",
   "Request",
@@ -635,6 +648,7 @@ export function formatIrType(
       case "bool":
         return append("boolean");
       case "dyn":
+      case "jsval":
         return append("unknown");
       case "caught":
         // What tsc calls the binding; the fence messages carry the real story.
@@ -930,13 +944,11 @@ export function isWebAssemblyType(
 ): boolean {
   const symbol = type.getAliasSymbol() ?? type.getSymbol();
   if (!symbol) return false;
-  return ctx.checker
-    .declarationsOf(symbol)
-    .some(
-      (d) =>
-        ctx.isStdlibFile(d.getSourceFile()) &&
-        isDeclaredInAmbientNamespace(d as ts.Declaration, "WebAssembly"),
-    );
+  return symbol.declarations.some(
+    (d) =>
+      ctx.isStdlibFile(d.getSourceFile()) &&
+      isDeclaredInAmbientNamespace(d as ts.Declaration, "WebAssembly"),
+  );
 }
 
 /** True when a type contains a record anywhere (the trigger for the
@@ -1208,7 +1220,7 @@ export function isLegacyUrlSymbol(
   ctx: Pick<TypeMapperCtx, "checker" | "isStdlibFile">,
 ): boolean {
   if (!symbol) return false;
-  for (const d of ctx.checker.declarationsOf(symbol)) {
+  for (const d of symbol.declarations) {
     if (!ctx.isStdlibFile(d.getSourceFile())) continue;
     let family = false;
     for (let n: ts.Node | undefined = d; n; n = n.parent) {
@@ -1245,7 +1257,7 @@ export function isOsConstantsSymbol(
   types = false,
 ): boolean {
   if (!symbol) return false;
-  for (const d of ctx.checker.declarationsOf(symbol)) {
+  for (const d of symbol.declarations) {
     const alias = types && ts.isTypeAliasDeclaration(d) && d.name.text === "SignalConstants";
     const signals =
       !types && ts.isVariableDeclaration(d) && ts.isIdentifier(d.name) && d.name.text === "signals";
@@ -1276,14 +1288,12 @@ function isWorkerHandleSymbol(
       symbol?.name === "MessagePort" ||
       symbol?.name === "MessageChannel" ||
       symbol?.name === "BroadcastChannel") &&
-    ctx.checker
-      .declarationsOf(symbol)
-      .some(
-        (d) =>
-          (ts.isClassDeclaration(d) || ts.isInterfaceDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "worker_threads"),
-      )
+    symbol.declarations.some(
+      (d) =>
+        (ts.isClassDeclaration(d) || ts.isInterfaceDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "worker_threads"),
+    )
   );
 }
 
@@ -1297,9 +1307,7 @@ function isReceiveMessageResult(
   let found = false;
   for (const member of members) {
     if (member.flags & ts.TypeFlags.Undefined) continue;
-    const decl = member.getSymbol()
-      ? ctx.checker.declarationsOf(member.getSymbol()!)[0]
-      : undefined;
+    const decl = member.getSymbol() ? member.getSymbol()!.declarations[0] : undefined;
     let fn: ts.Node | undefined = decl?.parent;
     while (fn && ts.isUnionTypeNode(fn)) fn = fn.parent;
     if (
@@ -1339,6 +1347,32 @@ export function isWorkerHandleType(
   return handle;
 }
 
+/** The return annotation of an `async *` declaration spelled with the
+ * protocol interfaces the generator object implements —
+ * `AsyncIterator<T>`, `AsyncIterableIterator<T>` or `AsyncIterable<T>` (pi's
+ * `async *[Symbol.asyncIterator](): AsyncIterator<T>`): the body always
+ * produces an async generator, so the declaration maps exactly like an
+ * `AsyncGenerator<T, TReturn, TNext>` annotation. Values of these types
+ * elsewhere stay unmapped (they can hold any object implementing the
+ * protocol). Null when the annotation is not one of them. */
+export function mapAsyncGeneratorAnnotation(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
+  const { checker } = ctx;
+  const symbol = type.getSymbol();
+  if (
+    !symbol ||
+    !["AsyncIterator", "AsyncIterableIterator", "AsyncIterable"].includes(symbol.name) ||
+    !symbol.declarations.some(
+      (d) => ts.isInterfaceDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()),
+    )
+  )
+    return null;
+  const args = checker.getTypeArguments(type as ts.TypeReference);
+  const channels = genChannels(args[0], args[1], args[2], ctx);
+  if (!channels) return null;
+  if (!genResultRecord(channels.yieldT, channels.retT, ctx.shapes, ctx.unions)) return null;
+  return { kind: "generator", async: true, ...channels };
+}
+
 /** The native fetch handles (Headers, Request, Response), optionally in
  * arrays or with null/undefined: checked-dynamic handles wherever they are
  * stored, like the worker handles above. */
@@ -1358,13 +1392,11 @@ export function isFetchHandleType(
       if (
         !symbol ||
         (symbol.name !== "Headers" && symbol.name !== "Request" && symbol.name !== "Response") ||
-        !ctx.checker
-          .declarationsOf(symbol)
-          .some(
-            (d) =>
-              (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-              ctx.isStdlibFile(d.getSourceFile()),
-          )
+        !symbol.declarations.some(
+          (d) =>
+            (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+            ctx.isStdlibFile(d.getSourceFile()),
+        )
       )
         return false;
     }
@@ -1439,15 +1471,14 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // TypeScript's intrinsic globalThis symbol has no declaration. A stored
   // reference needs native object identity, including var's undefined state.
   const intrinsic = type.getSymbol();
-  if (intrinsic?.name === "globalThis" && checker.declarationsOf(intrinsic).length === 0)
-    return DYN;
+  if (intrinsic?.name === "globalThis" && intrinsic.declarations.length === 0) return DYN;
   if (ctx.jsDynamicDeclaration !== undefined && intrinsic !== undefined) {
     const objectLiteral = (intrinsic.flags & ts.SymbolFlags.ObjectLiteral) !== 0;
     const classInstance =
       (intrinsic.flags & ts.SymbolFlags.Class) !== 0 && type.isClassOrInterface();
     if (
       (objectLiteral || classInstance) &&
-      checker.declarationsOf(intrinsic).some((decl) => ctx.jsDynamicDeclaration!(decl))
+      intrinsic.declarations.some((decl) => ctx.jsDynamicDeclaration!(decl))
     )
       return DYN;
   }
@@ -1465,7 +1496,7 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   const directAlias = type.getAliasSymbol();
   if (
     directAlias?.name === "ExecFileException" &&
-    checker.declarationsOf(directAlias).some((decl) => ctx.isStdlibFile(decl.getSourceFile()))
+    directAlias.declarations.some((decl) => ctx.isStdlibFile(decl.getSourceFile()))
   ) {
     return { kind: "object", className: "%Error" };
   }
@@ -1475,14 +1506,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   const execException = type.getSymbol();
   if (
     execException?.name === "ExecException" &&
-    checker
-      .declarationsOf(execException)
-      .some(
-        (decl) =>
-          ts.isInterfaceDeclaration(decl) &&
-          ctx.isStdlibFile(decl.getSourceFile()) &&
-          isDeclaredInAmbientModule(decl, "child_process"),
-      )
+    execException.declarations.some(
+      (decl) =>
+        ts.isInterfaceDeclaration(decl) &&
+        ctx.isStdlibFile(decl.getSourceFile()) &&
+        isDeclaredInAmbientModule(decl, "child_process"),
+    )
   ) {
     return { kind: "object", className: "%Error" };
   }
@@ -1578,7 +1607,7 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   const errorOptionsSymbol = widened.getSymbol();
   if (
     errorOptionsSymbol?.name === "ErrorOptions" &&
-    checker.declarationsOf(errorOptionsSymbol).some((d) => ctx.isStdlibFile(d.getSourceFile()))
+    errorOptionsSymbol.declarations.some((d) => ctx.isStdlibFile(d.getSourceFile()))
   ) {
     return DYN;
   }
@@ -1610,17 +1639,14 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
     if (
       parseArgsSym &&
       PARSE_ARGS_DYN_TYPES.has(parseArgsSym.name) &&
-      checker.declarationsOf(parseArgsSym).some(belongs)
+      parseArgsSym.declarations.some(belongs)
     )
       return DYN;
     // ReturnType and instantiated conditional types can erase the alias.
     // Require every member to retain the util declaration provenance so
     // unrelated records with similar property names keep their own layout.
     const members = checker.getPropertiesOfType(widened);
-    if (
-      members.length > 0 &&
-      members.every((member) => checker.declarationsOf(member).some(belongs))
-    )
+    if (members.length > 0 && members.every((member) => member.declarations.some(belongs)))
       return DYN;
   }
   // The lib's BOXED wrapper interfaces used as TYPES (`const n: Number =
@@ -1633,7 +1659,7 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
     if (
       boxSym &&
       (boxSym.name === "Number" || boxSym.name === "String" || boxSym.name === "Boolean") &&
-      checker.declarationsOf(boxSym).some((d) => ctx.isStdlibFile(d.getSourceFile()))
+      boxSym.declarations.some((d) => ctx.isStdlibFile(d.getSourceFile()))
     ) {
       return boxSym.name === "Number" ? F64 : boxSym.name === "String" ? STRING : BOOL;
     }
@@ -1656,7 +1682,7 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
       (ctorSym.name === "StringConstructor" ||
         ctorSym.name === "NumberConstructor" ||
         ctorSym.name === "BooleanConstructor") &&
-      checker.declarationsOf(ctorSym).some((d) => ctx.isStdlibFile(d.getSourceFile()))
+      ctorSym.declarations.some((d) => ctx.isStdlibFile(d.getSourceFile()))
     ) {
       return funcOf(
         [STRING],
@@ -1768,7 +1794,7 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
     const classSym = widened.getSymbol();
     const name = classSym?.name;
     if (name === "LifetimeRegion" || name === "InternTable" || name === "ThreadSlots") {
-      for (const d of checker.declarationsOf(classSym!)) {
+      for (const d of classSym!.declarations) {
         if (!ts.isClassDeclaration(d)) continue;
         const synthetic =
           name === "LifetimeRegion"
@@ -1790,7 +1816,7 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // types-only package), so it maps structurally like a local declaration.
   // Values the package itself would produce stay refused at their import.
   const packageOnly = (sym: ts.Symbol | undefined): readonly ts.Node[] | null => {
-    const decls = sym ? checker.declarationsOf(sym) : undefined;
+    const decls = sym ? sym.declarations : undefined;
     return decls &&
       decls.length > 0 &&
       decls.every((d) => {
@@ -2004,7 +2030,7 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // Class instances name a program class. The same symbol with construct
   // signatures names its static side, mapped to classval below.
   const widenedSym = widened.getSymbol();
-  const classDecl = widenedSym ? checker.valueDeclarationOf(widenedSym) : undefined;
+  const classDecl = widenedSym ? widenedSym.valueDeclaration : undefined;
   if (
     classDecl &&
     (ts.isClassDeclaration(classDecl) || ts.isClassExpression(classDecl)) &&
@@ -2012,12 +2038,16 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
     // {}` — classNamer spells them "%anon" (unique per file), the same
     // name their collection registered.
     !classDecl.getSourceFile().isDeclarationFile &&
-    checker.getConstructSignatures(widened).length === 0
+    checker.getConstructSignatures(widened).length === 0 &&
+    // A TypeScript class declared OUTSIDE the lowered program (reached
+    // through `import type` alone) never registers, and the program can
+    // hold no instance of it: its instance type maps below as the
+    // structural type it describes, like an interface.
+    (ctx.isProgramFile(classDecl.getSourceFile()) || isJsSourceFile(classDecl.getSourceFile()))
   ) {
-    // Declared OUTSIDE the lowered program (reached through the type world
-    // alone — jsdoc `typeof import()` over a never-required module): the
-    // class will never register, so the instance type is unmappable, not
-    // an object type naming a struct that cannot exist.
+    // A JavaScript class outside the lowered program (jsdoc `typeof
+    // import()` over a never-required module) stays unmappable: JSDoc
+    // types are not checked, so its slots fall back to the dynamic value.
     if (!ctx.isProgramFile(classDecl.getSourceFile())) return null;
     // The class inside a MIXIN function: per-call-site instantiations
     // share this one node — the CURRENT instantiation (collecting or
@@ -2132,9 +2162,9 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   const psym = widened.getSymbol();
   const isStdlibInterface = (name: string): boolean =>
     psym?.name === name &&
-    checker
-      .declarationsOf(psym)
-      .some((d) => ts.isInterfaceDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()));
+    psym.declarations.some(
+      (d) => ts.isInterfaceDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()),
+    );
   // The builtin Error classes: references to the lib's Error interfaces map to the runtime-provided class
   // hierarchy (provenance, not the name — a user's own `class Error`
   // resolved through the class-instance branch above, and a user
@@ -2148,9 +2178,7 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // fallback and in @types/node), not as a lib interface.
   if (
     psym?.name === "AssertionError" &&
-    checker
-      .declarationsOf(psym)
-      .some((d) => ts.isClassDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()))
+    psym.declarations.some((d) => ts.isClassDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()))
   )
     return { kind: "object", className: "%AssertionError" };
   // The lib's `Object` interface is a TOP type: tsc admits every
@@ -2168,16 +2196,14 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // included, while unrelated user interfaces named Module stay structural.
   if (
     (psym?.name === "ScriptcModule" || psym?.name === "Module") &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          (psym.name === "ScriptcModule" ||
-            isDeclaredInAmbientNamespace(d, "NodeJS") ||
-            isDeclaredInAmbientModule(d, "module")),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        (psym.name === "ScriptcModule" ||
+          isDeclaredInAmbientNamespace(d, "NodeJS") ||
+          isDeclaredInAmbientModule(d, "module")),
+    )
   ) {
     return F64;
   }
@@ -2190,14 +2216,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // et al. extend) is the same runtime value. Provenance-checked.
   if (
     psym?.name === "EventEmitter" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isClassDeclaration(d) || ts.isInterfaceDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          (isDeclaredInAmbientModule(d, "events") || isDeclaredInAmbientNamespace(d, "NodeJS")),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isClassDeclaration(d) || ts.isInterfaceDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        (isDeclaredInAmbientModule(d, "events") || isDeclaredInAmbientNamespace(d, "NodeJS")),
+    )
   ) {
     return { kind: "object", className: RUNTIME_EMITTER_CLASS };
   }
@@ -2207,15 +2231,13 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // enclosing ambient module, like net.Server.
   if (
     psym?.name === "Interface" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          (isDeclaredInAmbientModule(d, "readline") ||
-            isDeclaredInAmbientModule(d, "readline/promises")),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        (isDeclaredInAmbientModule(d, "readline") ||
+          isDeclaredInAmbientModule(d, "readline/promises")),
+    )
   ) {
     return F64;
   }
@@ -2224,29 +2246,25 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // code member).
   if (
     psym?.name === "Key" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          ts.isInterfaceDeclaration(d) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          (isDeclaredInAmbientModule(d, "readline") ||
-            isDeclaredInAmbientModule(d, "readline/promises")),
-      )
+    psym.declarations.some(
+      (d) =>
+        ts.isInterfaceDeclaration(d) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        (isDeclaredInAmbientModule(d, "readline") ||
+          isDeclaredInAmbientModule(d, "readline/promises")),
+    )
   ) {
     return DYN;
   }
   // readline/promises.Readline: an f64 handle the same way.
   if (
     psym?.name === "Readline" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "readline/promises"),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "readline/promises"),
+    )
   ) {
     return F64;
   }
@@ -2258,14 +2276,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // and @types/node's class Channel<StoreType, ContextType>.
   if (
     psym?.name === "Channel" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "diagnostics_channel"),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "diagnostics_channel"),
+    )
   ) {
     return F64;
   }
@@ -2274,14 +2290,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // process-lived; contexts ride the fiber machinery).
   if (
     psym?.name === "AsyncLocalStorage" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "async_hooks"),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "async_hooks"),
+    )
   ) {
     return F64;
   }
@@ -2289,21 +2303,19 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // runtime's tracing registry (five event channels per entry).
   if (
     psym?.name === "TracingChannel" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "diagnostics_channel"),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "diagnostics_channel"),
+    )
   ) {
     return F64;
   }
   // Node names this result; the ambient WHATWG declaration uses a type literal.
   const encodeResult =
     psym &&
-    checker.declarationsOf(psym).some((decl) => {
+    psym.declarations.some((decl) => {
       if (!ctx.isStdlibFile(decl.getSourceFile())) return false;
       if (ts.isInterfaceDeclaration(decl) && decl.name.text === "EncodeIntoResult") return true;
       const parent = decl.parent;
@@ -2330,13 +2342,11 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // Their private encoding slot is omitted from enumeration and JSON.
   if (
     (psym?.name === "TextEncoder" || psym?.name === "TextDecoder") &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     return {
       kind: "record",
@@ -2366,13 +2376,11 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // record shape never surfaces.
   if (
     psym?.name === "StringDecoder" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     return {
       kind: "record",
@@ -2392,7 +2400,7 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // record-holding binding forms compile. User-declared literals with
   // these member names keep the ordinary record path (their declarations
   // are not in declaration files).
-  const promiseDeclarations = psym ? checker.declarationsOf(psym) : [];
+  const promiseDeclarations = psym ? psym.declarations : [];
   if (
     flags & ts.TypeFlags.Object &&
     promiseDeclarations.length > 0 &&
@@ -2458,9 +2466,9 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
     const alias = widened.getAliasSymbol();
     if (
       alias?.name === "ReadableStreamReadResult" &&
-      checker
-        .declarationsOf(alias)
-        .some((d) => ts.isTypeAliasDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()))
+      alias.declarations.some(
+        (d) => ts.isTypeAliasDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()),
+      )
     ) {
       const elemTs = widened.getAliasTypeArguments()?.[0];
       const elem =
@@ -2473,9 +2481,9 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
     psym &&
     (psym.name === "ReadableStreamReadValueResult" ||
       psym.name === "ReadableStreamReadDoneResult") &&
-    checker
-      .declarationsOf(psym)
-      .some((d) => ts.isInterfaceDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()))
+    psym.declarations.some(
+      (d) => ts.isInterfaceDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     const elemTs = checker.getTypeArguments(widened as ts.TypeReference)[0];
     const elem =
@@ -2487,13 +2495,26 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // whose getters and methods dispatch through the handle.
   if (
     (psym?.name === "SocketAddress" || psym?.name === "BlockList") &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isClassDeclaration(d) || ts.isInterfaceDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isClassDeclaration(d) || ts.isInterfaceDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()),
+    )
+  ) {
+    return DYN;
+  }
+  // WebCrypto: the crypto global and its subtle object are dynamic
+  // objects, CryptoKey values are native handles (scr_webcrypto.c), and
+  // the algorithm dictionaries the methods take and keys report are plain
+  // checked-dynamic objects.
+  if (
+    psym &&
+    WEBCRYPTO_DYN_TYPES.has(psym.name) &&
+    psym.declarations.some(
+      (d) =>
+        (ts.isClassDeclaration(d) || ts.isInterfaceDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     return DYN;
   }
@@ -2502,13 +2523,11 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // that export() returns is a plain checked-dynamic object.
   if (
     (psym?.name === "KeyObject" || psym?.name === "JsonWebKey") &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isClassDeclaration(d) || ts.isInterfaceDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isClassDeclaration(d) || ts.isInterfaceDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     return DYN;
   }
@@ -2517,17 +2536,15 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
     (FETCH_AMBIENT_TYPES as readonly string[]).includes(psym.name) &&
     !(
       psym.name === "ReadableStream" &&
-      checker
-        .declarationsOf(psym)
-        .some((d) => ts.isInterfaceDeclaration(d) && isDeclaredInAmbientNamespace(d, "NodeJS"))
-    ) &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()),
+      psym.declarations.some(
+        (d) => ts.isInterfaceDeclaration(d) && isDeclaredInAmbientNamespace(d, "NodeJS"),
       )
+    ) &&
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     return DYN;
   }
@@ -2543,9 +2560,9 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
       psym?.name === "Disposable" ||
       psym?.name === "AsyncDisposable" ||
       psym?.name === "DisposableStack") &&
-    checker
-      .declarationsOf(psym)
-      .some((d) => ts.isInterfaceDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()))
+    psym.declarations.some(
+      (d) => ts.isInterfaceDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     return DYN;
   }
@@ -2555,7 +2572,7 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   if (
     psym !== undefined &&
     CIPHER_TYPE_NAMES.has(psym.name) &&
-    checker.declarationsOf(psym).some((d) => ctx.isStdlibFile(d.getSourceFile()))
+    psym.declarations.some((d) => ctx.isStdlibFile(d.getSourceFile()))
   ) {
     return DYN;
   }
@@ -2683,13 +2700,11 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // the same symbol); provenance-checked like URL.
   if (
     psym?.name === "Buffer" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     return bytesOf("u8");
   }
@@ -2700,13 +2715,11 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // record/class like any other.
   if (
     psym?.name === "URL" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     return { kind: "url" };
   }
@@ -2715,13 +2728,11 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // URLSearchParams` in the "url" module). Provenance-checked like URL.
   if (
     psym?.name === "URLSearchParams" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     return { kind: "searchParams" };
   }
@@ -2729,13 +2740,11 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // declarations' interface. Provenance-checked like URL.
   if (
     psym?.name === "Stats" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     return { kind: "stats" };
   }
@@ -2745,14 +2754,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
     (psym?.name === "StatsFs" ||
       psym?.name === "BigIntStatsFs" ||
       psym?.name === "StatFsOptions") &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "fs"),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "fs"),
+    )
   )
     return DYN;
   if (isWorkerHandleSymbol(psym, ctx)) return DYN;
@@ -2761,14 +2768,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // fallback and @types/node declare it in "fs/promises".
   if (
     psym?.name === "FileHandle" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          ts.isInterfaceDeclaration(d) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "fs/promises"),
-      )
+    psym.declarations.some(
+      (d) =>
+        ts.isInterfaceDeclaration(d) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "fs/promises"),
+    )
   ) {
     return { kind: "fileHandle" };
   }
@@ -2776,14 +2781,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // fallback and @types/node.
   if (
     psym?.name === "Dir" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "fs"),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "fs"),
+    )
   ) {
     return { kind: "dir" };
   }
@@ -2793,13 +2796,11 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // Provenance-checked like Stats.
   if (
     psym?.name === "SpawnSyncReturns" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     return { kind: "spawnRes" };
   }
@@ -2811,14 +2812,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
     (psym.name === "ChildProcess" ||
       psym.name === "ChildProcessWithoutNullStreams" ||
       psym.name === "ChildProcessByStdio") &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "child_process"),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "child_process"),
+    )
   ) {
     return { kind: "child" };
   }
@@ -2831,7 +2830,7 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // site.
   if (
     (psym?.name === "Server" || psym?.name === "Socket" || psym?.name === "TLSSocket") &&
-    checker.declarationsOf(psym).some(
+    psym.declarations.some(
       (d) =>
         (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
         ctx.isStdlibFile(d.getSourceFile()) &&
@@ -2857,14 +2856,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // "tls"`, and the shipped fallback mirrors it.
   if (
     psym?.name === "SecureContext" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "tls"),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "tls"),
+    )
   ) {
     return { kind: "secureCtx" };
   }
@@ -2872,14 +2869,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // checked values so presence probes and repeated getter reads match Node.
   if (
     psym?.name === "ScryptOptions" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          ts.isInterfaceDeclaration(d) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "crypto"),
-      )
+    psym.declarations.some(
+      (d) =>
+        ts.isInterfaceDeclaration(d) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "crypto"),
+    )
   )
     return DYN;
   // crypto.Hash / crypto.Hmac: native incremental digest handles. Keep
@@ -2887,14 +2882,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // retain their ordinary structural/class representation.
   if (
     (psym?.name === "Hash" || psym?.name === "Hmac") &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "crypto"),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "crypto"),
+    )
   ) {
     return psym.name === "Hash" ? CRYPTOHASH_T : CRYPTOHMAC_T;
   }
@@ -2904,14 +2897,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // mirrors it.
   if (
     psym?.name === "FSWatcher" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "fs"),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "fs"),
+    )
   ) {
     return { kind: "fsWatcher" };
   }
@@ -2934,25 +2925,20 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // scalar; the lowered surface is write(string).
   if (
     (psym?.name === "WriteStream" &&
-      checker
-        .declarationsOf(psym)
-        .some(
-          (d) =>
-            (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-            ctx.isStdlibFile(d.getSourceFile()) &&
-            (isDeclaredInAmbientModule(d, "tty") ||
-              (isDeclaredInAmbientModule(d, "process") &&
-                isDeclaredInAmbientNamespace(d, "NodeJS"))),
-        )) ||
+      psym.declarations.some(
+        (d) =>
+          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+          ctx.isStdlibFile(d.getSourceFile()) &&
+          (isDeclaredInAmbientModule(d, "tty") ||
+            (isDeclaredInAmbientModule(d, "process") && isDeclaredInAmbientNamespace(d, "NodeJS"))),
+      )) ||
     (psym?.name === "WritableStream" &&
-      checker
-        .declarationsOf(psym)
-        .some(
-          (d) =>
-            ts.isInterfaceDeclaration(d) &&
-            ctx.isStdlibFile(d.getSourceFile()) &&
-            isDeclaredInAmbientNamespace(d, "NodeJS"),
-        ))
+      psym.declarations.some(
+        (d) =>
+          ts.isInterfaceDeclaration(d) &&
+          ctx.isStdlibFile(d.getSourceFile()) &&
+          isDeclaredInAmbientNamespace(d, "NodeJS"),
+      ))
   ) {
     return PROCSTREAM_T;
   }
@@ -2962,24 +2948,20 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // of the broad @types class fence where they are constructed.
   if (
     (psym?.name === "ChildStdin" &&
-      checker
-        .declarationsOf(psym)
-        .some(
-          (d) =>
-            ts.isInterfaceDeclaration(d) &&
-            ctx.isStdlibFile(d.getSourceFile()) &&
-            isDeclaredInAmbientModule(d, "child_process"),
-        )) ||
+      psym.declarations.some(
+        (d) =>
+          ts.isInterfaceDeclaration(d) &&
+          ctx.isStdlibFile(d.getSourceFile()) &&
+          isDeclaredInAmbientModule(d, "child_process"),
+      )) ||
     (psym?.name === "Writable" &&
-      checker
-        .declarationsOf(psym)
-        .some(
-          (d) =>
-            (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-            ctx.isStdlibFile(d.getSourceFile()) &&
-            isNodeTypesPath(d.getSourceFile().fileName) &&
-            isDeclaredInAmbientModule(d, "stream"),
-        ))
+      psym.declarations.some(
+        (d) =>
+          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+          ctx.isStdlibFile(d.getSourceFile()) &&
+          isNodeTypesPath(d.getSourceFile().fileName) &&
+          isDeclaredInAmbientModule(d, "stream"),
+      ))
   ) {
     return { kind: "childWriter" };
   }
@@ -2993,15 +2975,13 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   for (const [irName, rec] of RUNTIME_STREAM_CLASSES) {
     if (
       psym?.name === rec.lib &&
-      checker
-        .declarationsOf(psym)
-        .some(
-          (d) =>
-            ts.isClassDeclaration(d) &&
-            ctx.isStdlibFile(d.getSourceFile()) &&
-            !isNodeTypesPath(d.getSourceFile().fileName) &&
-            isDeclaredInAmbientModule(d, "stream"),
-        )
+      psym.declarations.some(
+        (d) =>
+          ts.isClassDeclaration(d) &&
+          ctx.isStdlibFile(d.getSourceFile()) &&
+          !isNodeTypesPath(d.getSourceFile().fileName) &&
+          isDeclaredInAmbientModule(d, "stream"),
+      )
     ) {
       return { kind: "object", className: irName };
     }
@@ -3011,15 +2991,13 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   if (
     psym !== undefined &&
     ZLIB_STREAM_MODES.has(psym.name) &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          ts.isClassDeclaration(d) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          !isNodeTypesPath(d.getSourceFile().fileName) &&
-          isDeclaredInAmbientModule(d, "zlib"),
-      )
+    psym.declarations.some(
+      (d) =>
+        ts.isClassDeclaration(d) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        !isNodeTypesPath(d.getSourceFile().fileName) &&
+        isDeclaredInAmbientModule(d, "zlib"),
+    )
   ) {
     return { kind: "object", className: "%Transform" };
   }
@@ -3028,37 +3006,31 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // (scr_fs_stream.c).
   if (
     (psym?.name === "ReadStream" || psym?.name === "WriteStream") &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          ts.isClassDeclaration(d) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          !isNodeTypesPath(d.getSourceFile().fileName) &&
-          isDeclaredInAmbientModule(d, "fs"),
-      )
+    psym.declarations.some(
+      (d) =>
+        ts.isClassDeclaration(d) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        !isNodeTypesPath(d.getSourceFile().fileName) &&
+        isDeclaredInAmbientModule(d, "fs"),
+    )
   ) {
     return { kind: "object", className: psym.name === "ReadStream" ? "%Readable" : "%Writable" };
   }
   if (
     (psym?.name === "Readable" &&
-      checker
-        .declarationsOf(psym)
-        .some(
-          (d) =>
-            (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-            ctx.isStdlibFile(d.getSourceFile()) &&
-            isDeclaredInAmbientModule(d, "stream"),
-        )) ||
+      psym.declarations.some(
+        (d) =>
+          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+          ctx.isStdlibFile(d.getSourceFile()) &&
+          isDeclaredInAmbientModule(d, "stream"),
+      )) ||
     (psym?.name === "ReadableStream" &&
-      checker
-        .declarationsOf(psym)
-        .some(
-          (d) =>
-            ts.isInterfaceDeclaration(d) &&
-            ctx.isStdlibFile(d.getSourceFile()) &&
-            isDeclaredInAmbientNamespace(d, "NodeJS"),
-        ))
+      psym.declarations.some(
+        (d) =>
+          ts.isInterfaceDeclaration(d) &&
+          ctx.isStdlibFile(d.getSourceFile()) &&
+          isDeclaredInAmbientNamespace(d, "NodeJS"),
+      ))
   ) {
     return { kind: "childStream" };
   }
@@ -3068,14 +3040,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // inside `declare module "dgram"`.
   if (
     psym?.name === "Socket" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "dgram"),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "dgram"),
+    )
   ) {
     return { kind: "dgramSocket" };
   }
@@ -3087,14 +3057,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // both spellings).
   if (
     (psym?.name === "TestContext" || psym?.name === "SuiteContext") &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "test"),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "test"),
+    )
   ) {
     return { kind: "testCtx" };
   }
@@ -3103,14 +3071,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // { %call: F, mock } record through mapHybridCallableIntersection.
   if (
     (psym?.name === "MockFunctionContext" || psym?.name === "MockFunctionCall") &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          ts.isInterfaceDeclaration(d) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "test"),
-      )
+    psym.declarations.some(
+      (d) =>
+        ts.isInterfaceDeclaration(d) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "test"),
+    )
   ) {
     const fnTs = checker.getTypeArguments(widened as ts.TypeReference)[0];
     const fn = fnTs ? mapType(fnTs, ctx) : null;
@@ -3126,9 +3092,9 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // Provenance-checked like the rest.
   if (
     psym?.name === "ErrnoException" &&
-    checker
-      .declarationsOf(psym)
-      .some((d) => ts.isInterfaceDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()))
+    psym.declarations.some(
+      (d) => ts.isInterfaceDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     return { kind: "object", className: "%Error" };
   }
@@ -3140,14 +3106,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // Agent extends http's; both live in their ambient modules).
   if (
     psym?.name === "Agent" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          (isDeclaredInAmbientModule(d, "http") || isDeclaredInAmbientModule(d, "https")),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        (isDeclaredInAmbientModule(d, "http") || isDeclaredInAmbientModule(d, "https")),
+    )
   ) {
     return { kind: "dyn" };
   }
@@ -3156,14 +3120,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // rule).
   if (
     (psym?.name === "IncomingMessage" || psym?.name === "ServerResponse") &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "http"),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "http"),
+    )
   ) {
     return psym.name === "IncomingMessage" ? { kind: "httpReq" } : { kind: "httpRes" };
   }
@@ -3179,14 +3141,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
     (psym?.name === "Http2SecureServer" ||
       psym?.name === "Http2ServerRequest" ||
       psym?.name === "Http2ServerResponse") &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "http2"),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "http2"),
+    )
   ) {
     return psym.name === "Http2SecureServer"
       ? { kind: "netServer" }
@@ -3205,14 +3165,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
       psym?.name === "ServerHttp2Session" ||
       psym?.name === "ClientHttp2Stream" ||
       psym?.name === "ServerHttp2Stream") &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "http2"),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "http2"),
+    )
   ) {
     return psym.name === "Http2Server"
       ? { kind: "netServer" }
@@ -3224,14 +3182,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // like IncomingMessage.
   if (
     psym?.name === "ClientRequest" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "http"),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "http"),
+    )
   ) {
     return { kind: "httpClientReq" };
   }
@@ -3245,9 +3201,9 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // and interns the SAME shape.
   if (
     psym?.name === "ProcessEnv" &&
-    checker
-      .declarationsOf(psym)
-      .some((d) => ts.isInterfaceDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()))
+    psym.declarations.some(
+      (d) => ts.isInterfaceDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     const value = withUndefinedArm(STRING, ctx.unions);
     if (!value) return null;
@@ -3337,9 +3293,9 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
     const alias = widened.getAliasSymbol();
     if (
       alias?.name === "IteratorResult" &&
-      checker
-        .declarationsOf(alias)
-        .some((d) => ts.isTypeAliasDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()))
+      alias.declarations.some(
+        (d) => ts.isTypeAliasDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()),
+      )
     ) {
       const targs = widened.getAliasTypeArguments() ?? [];
       const channels = genChannels(targs[0], targs[1], undefined, ctx);
@@ -3474,14 +3430,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
       psym?.name === "ReadOptions" ||
       psym?.name === "ReadOptionsWithBuffer" ||
       psym?.name === "WriteOptions") &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          ts.isInterfaceDeclaration(d) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          (isDeclaredInAmbientModule(d, "fs/promises") || isDeclaredInAmbientModule(d, "fs")),
-      )
+    psym.declarations.some(
+      (d) =>
+        ts.isInterfaceDeclaration(d) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        (isDeclaredInAmbientModule(d, "fs/promises") || isDeclaredInAmbientModule(d, "fs")),
+    )
   ) {
     const fields: { name: string; type: IrType }[] = [];
     for (const property of checker.getPropertiesOfType(widened)) {
@@ -3505,16 +3459,14 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
       psym?.name === "FileWritevResult" ||
       psym?.name === "ReadVResult" ||
       psym?.name === "WriteVResult") &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          ts.isInterfaceDeclaration(d) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          (isDeclaredInAmbientModule(d, "fs/promises") ||
-            ((psym.name === "ReadVResult" || psym.name === "WriteVResult") &&
-              isDeclaredInAmbientModule(d, "fs"))),
-      )
+    psym.declarations.some(
+      (d) =>
+        ts.isInterfaceDeclaration(d) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        (isDeclaredInAmbientModule(d, "fs/promises") ||
+          ((psym.name === "ReadVResult" || psym.name === "WriteVResult") &&
+            isDeclaredInAmbientModule(d, "fs"))),
+    )
   ) {
     const args = checker.getTypeArguments(widened as ts.TypeReference);
     if (args.length !== 1) return null;
@@ -3572,13 +3524,11 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // provenance-checked, the Buffer/URL pattern).
   if (
     psym?.name === "Dirent" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     const args = checker.getTypeArguments(widened as ts.TypeReference);
     if (args.length > 1) return null;
@@ -3626,18 +3576,16 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   });
   if (
     psym &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          ts.isTypeLiteralNode(d) &&
-          ts.isPropertySignature(d.parent) &&
-          ts.isIdentifier(d.parent.name) &&
-          d.parent.name.text === "times" &&
-          ts.isInterfaceDeclaration(d.parent.parent) &&
-          d.parent.parent.name.text === "CpuInfo" &&
-          ctx.isStdlibFile(d.getSourceFile()),
-      )
+    psym.declarations.some(
+      (d) =>
+        ts.isTypeLiteralNode(d) &&
+        ts.isPropertySignature(d.parent) &&
+        ts.isIdentifier(d.parent.name) &&
+        d.parent.name.text === "times" &&
+        ts.isInterfaceDeclaration(d.parent.parent) &&
+        d.parent.parent.name.text === "CpuInfo" &&
+        ctx.isStdlibFile(d.getSourceFile()),
+    )
   )
     return cpuTimes();
   if (isStdlibInterface("CpuInfo")) {
@@ -3705,16 +3653,14 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // unmapped.
   if (
     psym &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          ts.isTypeLiteralNode(d) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          (isDeclaredInAmbientModule(d, "child_process") ||
-            isDeclaredInAmbientModule(d, "util") ||
-            isDeclaredInAmbientModule(d, "dns")),
-      )
+    psym.declarations.some(
+      (d) =>
+        ts.isTypeLiteralNode(d) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        (isDeclaredInAmbientModule(d, "child_process") ||
+          isDeclaredInAmbientModule(d, "util") ||
+          isDeclaredInAmbientModule(d, "dns")),
+    )
   ) {
     const props = checker.getPropertiesOfType(widened);
     const names =
@@ -3754,14 +3700,12 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
   // internal-slot object shows {} — the Dirent %dtype edge's cousin.
   if (
     psym?.name === "X509Certificate" &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()) &&
-          isDeclaredInAmbientModule(d, "crypto"),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()) &&
+        isDeclaredInAmbientModule(d, "crypto"),
+    )
   ) {
     return {
       kind: "record",
@@ -3789,13 +3733,11 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
     (psym?.name === "PerformanceEntry" ||
       psym?.name === "PerformanceMark" ||
       psym?.name === "PerformanceMeasure") &&
-    checker
-      .declarationsOf(psym)
-      .some(
-        (d) =>
-          (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
-          ctx.isStdlibFile(d.getSourceFile()),
-      )
+    psym.declarations.some(
+      (d) =>
+        (ts.isInterfaceDeclaration(d) || ts.isClassDeclaration(d)) &&
+        ctx.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     return { kind: "record", shapeId: perfEntryShape(ctx.shapes, ctx.unions) };
   }
@@ -4048,10 +3990,10 @@ function mapTypeInner(type: ts.Type, ctx: TypeMapperCtx): IrType | null {
     flags & ts.TypeFlags.Object &&
     callSigs.length === 0 &&
     psym !== undefined &&
-    checker.declarationsOf(psym).length > 0 &&
-    checker
-      .declarationsOf(psym)
-      .every((d) => ts.isInterfaceDeclaration(d) && !ctx.isStdlibFile(d.getSourceFile()))
+    psym.declarations.length > 0 &&
+    psym.declarations.every(
+      (d) => ts.isInterfaceDeclaration(d) && !ctx.isStdlibFile(d.getSourceFile()),
+    )
   ) {
     const CHILD_SURFACE = new Set([
       "pid",
@@ -4297,7 +4239,7 @@ function mapCallSignature(sig: ts.Signature, ctx: TypeMapperCtx): IrType | null
   // convention. Detected by the param-count mismatch against the
   // signature's own declaration, excluding an erased `this` parameter.
   {
-    const sigDecl = checker.signatureDeclaration(sig);
+    const sigDecl = sig.declaration;
     const declParams =
       sigDecl !== undefined && ts.isFunctionLike(sigDecl) ? sigDecl.parameters.nodes : undefined;
     if (
@@ -4317,7 +4259,7 @@ function mapCallSignature(sig: ts.Signature, ctx: TypeMapperCtx): IrType | null
   let typedRest = false;
   let dynRest = false;
   for (const p of sig.getParameters()) {
-    const decl = checker.valueDeclarationOf(p);
+    const decl = p.valueDeclaration;
     const rest = decl !== undefined && ts.isParameter(decl) && decl.dotDotDotToken !== undefined;
 
     // arity ABI selected by lambdaSignature. Treating an inferred any[]
@@ -4353,9 +4295,7 @@ function mapCallSignature(sig: ts.Signature, ctx: TypeMapperCtx): IrType | null
       ts.isIdentifier(construction.expression) &&
       construction.expression.text === "Promise" &&
       constructorSymbol &&
-      checker
-        .declarationsOf(constructorSymbol)
-        .some((site) => ctx.isStdlibFile(site.getSourceFile()));
+      constructorSymbol.declarations.some((site) => ctx.isStdlibFile(site.getSourceFile()));
     if (
       !nativeExecutor &&
       decl &&
@@ -4409,7 +4349,7 @@ function mapCallSignature(sig: ts.Signature, ctx: TypeMapperCtx): IrType | null
   // like declaredReturnType does for declarations. JS null/undefined
   // returns can read mutable fields, so callable values use the same
   // checked-native return ABI as their implementations.
-  const sigDecl = checker.signatureDeclaration(sig);
+  const sigDecl = sig.declaration;
   const jsUnitReturn =
     sigDecl !== undefined &&
     isJsSourceFile(sigDecl.getSourceFile()) &&
@@ -4550,7 +4490,7 @@ function mapClassView(
     bases = ts.constituentTypes(type);
   } else {
     const symbol = type.getSymbol();
-    const declarations = symbol ? checker.declarationsOf(symbol) : [];
+    const declarations = symbol ? symbol.declarations : [];
     if (
       declarations.length === 0 ||
       !declarations.every(
@@ -4588,7 +4528,7 @@ function mapClassView(
     let representation: IrType | undefined;
     for (const base of bases) {
       const symbol = base.getSymbol();
-      const declaration = symbol ? checker.valueDeclarationOf(symbol) : undefined;
+      const declaration = symbol ? symbol.valueDeclaration : undefined;
       const classBase =
         declaration &&
         (ts.isClassDeclaration(declaration) || ts.isClassExpression(declaration)) &&
@@ -4612,8 +4552,8 @@ function mapClassView(
       const original = checker.getPropertyOfType(baseType, property.name);
       if (!original) return null;
       if (original === property) continue;
-      const originalDeclarations = checker.declarationsOf(original);
-      const declarations = checker.declarationsOf(property);
+      const originalDeclarations = original.declarations;
+      const declarations = property.declarations;
       // Instantiating an inherited member can create a new symbol without
       // changing its declaration or ABI. Only refinements need validation.
       if (
@@ -4651,7 +4591,7 @@ function mapCollectionView(
   if (!type.isTypeReference()) return null;
   const { checker } = ctx;
   const symbol = type.getSymbol();
-  const declarations = symbol ? checker.declarationsOf(symbol) : [];
+  const declarations = symbol ? symbol.declarations : [];
   if (
     declarations.length === 0 ||
     !declarations.every(
@@ -4704,16 +4644,14 @@ function mapCollectionView(
     const native =
       baseSymbol &&
       ["Map", "ReadonlyMap", "Set", "ReadonlySet"].includes(baseSymbol.name) &&
-      checker
-        .declarationsOf(baseSymbol)
-        .some((decl) => ts.isInterfaceDeclaration(decl) && ctx.isStdlibFile(decl.getSourceFile()));
+      baseSymbol.declarations.some(
+        (decl) => ts.isInterfaceDeclaration(decl) && ctx.isStdlibFile(decl.getSourceFile()),
+      );
     const mapped = native ? mapType(base, baseCtx) : mapCollectionView(base, baseCtx, seen);
     if (mapped?.kind !== "map" && mapped?.kind !== "set") return null;
     const hasType = funcOf([mapped.kind === "map" ? mapped.key : mapped.elem], BOOL);
     for (const property of checker.getPropertiesOfType(type)) {
-      const own = checker
-        .declarationsOf(property)
-        .filter((decl) => !ctx.isStdlibFile(decl.getSourceFile()));
+      const own = property.declarations.filter((decl) => !ctx.isStdlibFile(decl.getSourceFile()));
       if (own.length === 0) continue;
       if (
         property.name !== "has" ||
@@ -4863,8 +4801,8 @@ export function underConstAssertion(n: ts.Node): boolean {
  * panic repair): a property symbol declared by a property assignment whose
  * initializer is an EMPTY array literal inside a const assertion — its
  * type is provably `readonly []`, whatever the panicked query answered. */
-function constAssertedEmptyArrayProp(p: ts.Symbol, ctx: TypeMapperCtx): boolean {
-  const d = ctx.checker.valueDeclarationOf(p);
+function constAssertedEmptyArrayProp(p: ts.Symbol): boolean {
+  const d = p.valueDeclaration;
   if (d === undefined || !ts.isPropertyAssignment(d)) return false;
   const init = d.initializer;
   // `a: [] as const` pins the field type by itself, wherever the literal sits.
@@ -4887,9 +4825,9 @@ function mapGenericAwaitedAlias(type: ts.Type, ctx: TypeMapperCtx): IrType | nul
   if (aliasArgs.length !== 1 || !arg) return null;
   if (!(arg.flags & ts.TypeFlags.TypeParameter)) return null;
   // Provenance: the STANDARD LIBRARY's alias, not a user's shadowing one.
-  const isLibAlias = ctx.checker
-    .declarationsOf(alias)
-    .some((d) => ts.isTypeAliasDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()));
+  const isLibAlias = alias.declarations.some(
+    (d) => ts.isTypeAliasDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()),
+  );
   if (!isLibAlias) return null;
   const bound = resolveTypeParam(arg);
   if (!bound) return null;
@@ -4953,7 +4891,7 @@ function mapBoundMappedType(widened: ts.Type, ctx: TypeMapperCtx): IrType | null
   if (!resolveTypeParamTs || !isMappedShape(widened)) return null;
   const symbol = widened.getSymbol();
   const node = symbol
-    ? checker.declarationsOf(symbol).find((d): d is ts.MappedTypeNode => ts.isMappedTypeNode(d))
+    ? symbol.declarations.find((d): d is ts.MappedTypeNode => ts.isMappedTypeNode(d))
     : undefined;
   const constraint = node?.typeParameter.constraint;
   if (
@@ -5039,9 +4977,7 @@ function evalMappedTemplate(
     const alias = type.getAliasSymbol();
     const aliasArgs = type.getAliasTypeArguments();
     const aliasDecl = alias
-      ? checker
-          .declarationsOf(alias)
-          .find((d): d is ts.TypeAliasDeclaration => ts.isTypeAliasDeclaration(d))
+      ? alias.declarations.find((d): d is ts.TypeAliasDeclaration => ts.isTypeAliasDeclaration(d))
       : undefined;
     if (
       aliasDecl?.typeParameters?.nodes &&
@@ -5099,9 +5035,7 @@ function matchInferReference(
     const want = wantArgs[i]!;
     const symbol = want.flags & ts.TypeFlags.TypeParameter ? want.getSymbol() : undefined;
     const isInfer = symbol
-      ? checker
-          .declarationsOf(symbol)
-          .some((d) => d.parent !== undefined && ts.isInferTypeNode(d.parent))
+      ? symbol.declarations.some((d) => d.parent !== undefined && ts.isInferTypeNode(d.parent))
       : false;
     if (isInfer && symbol) inferred.set(symbol, gotArgs[i]!);
     else if (want !== gotArgs[i]) return undefined;
@@ -5135,9 +5069,9 @@ function mapGenericUtilityAlias(widened: ts.Type, ctx: TypeMapperCtx): IrType |
   if (aliasArgs.length !== 1 || !arg) return null;
   if (!(arg.flags & ts.TypeFlags.TypeParameter)) return null;
   // Provenance: the STANDARD LIBRARY's alias, not a user's shadowing one.
-  const isLibAlias = ctx.checker
-    .declarationsOf(alias)
-    .some((d) => ts.isTypeAliasDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()));
+  const isLibAlias = alias.declarations.some(
+    (d) => ts.isTypeAliasDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()),
+  );
   if (!isLibAlias) return null;
   const bound = resolveTypeParam(arg);
   if (!bound || bound.kind !== "record") return null;
@@ -5390,7 +5324,7 @@ function mapErrorMetadataIntersection(type: ts.Type, ctx: TypeMapperCtx): IrType
         "AggregateError",
         "SuppressedError",
       ].includes(symbol.name) &&
-      ctx.checker.declarationsOf(symbol).some((decl) => ctx.isStdlibFile(decl.getSourceFile()))
+      symbol.declarations.some((decl) => ctx.isStdlibFile(decl.getSourceFile()))
     );
   });
   if (!hasError) return null;
@@ -5532,12 +5466,12 @@ function immutableSourceType(type: ts.Type, ctx: TypeMapperCtx): ts.Type | null
   if (!isMappedShape(type)) return null;
   const { checker } = ctx;
   const symbol = type.getSymbol();
-  const decl = symbol ? checker.declarationsOf(symbol)[0] : undefined;
+  const decl = symbol ? symbol.declarations[0] : undefined;
   if (decl === undefined || !CONTRACT_TYPES_FILE.test(decl.getSourceFile().fileName)) return null;
   const props = checker.getPropertiesOfType(type);
   const seen = new Set<ts.Node>();
   for (const prop of props) {
-    const owner = checker.declarationsOf(prop)[0]?.parent;
+    const owner = prop.declarations[0]?.parent;
     if (owner === undefined || seen.has(owner)) continue;
     seen.add(owner);
     let source: ts.Type | null = null;
@@ -5604,21 +5538,19 @@ function recordProvenanceOk(t: ts.Type, ctx: TypeMapperCtx): boolean {
   }
   if (isMappedShape(t)) return true;
   const tSym = t.getSymbol();
-  const decls = tSym ? checker.declarationsOf(tSym) : undefined;
+  const decls = tSym ? tSym.declarations : undefined;
   if (!decls || decls.length === 0) {
     // Inferred destructuring parameters can have a synthesized anonymous
     // shape with no declaration or member symbols to trace to a source.
     return checker
       .getPropertiesOfType(t)
       .every((property) =>
-        checker
-          .declarationsOf(property)
-          .every(
-            (decl) =>
-              !decl.getSourceFile().isDeclarationFile ||
-              ctx.isExternalTypeFile(decl.getSourceFile()) ||
-              packageTypeFile(decl.getSourceFile(), ctx),
-          ),
+        property.declarations.every(
+          (decl) =>
+            !decl.getSourceFile().isDeclarationFile ||
+            ctx.isExternalTypeFile(decl.getSourceFile()) ||
+            packageTypeFile(decl.getSourceFile(), ctx),
+        ),
       );
   }
   return !decls.some((d) => {
@@ -5727,7 +5659,7 @@ export function isOverloadedCallableMemberType(t: ts.Type, checker: ts.TypeCheck
   )
     return false;
   return sigs.every((sig) => {
-    const decl = checker.signatureDeclaration(sig);
+    const decl = sig.declaration;
     if (decl === undefined) return false;
     if (!ts.isMethodSignatureDeclaration(decl) && !ts.isCallSignatureDeclaration(decl))
       return false;
@@ -5851,7 +5783,7 @@ function describeOverloadSetBlocker(t: ts.Type, ctx: TypeMapperCtx): string {
           };
     const mapped = mapCallSignature(sig, sigCtx);
     if (mapped?.kind === "func" && mapped.rest !== true && mapped.argumentsAll !== true) continue;
-    const decl = checker.signatureDeclaration(sig);
+    const decl = sig.declaration;
     const spelled = decl ? decl.getText().replace(/\s+/g, " ").replace(/;$/, "") : "";
     const which = spelled ? `overload '${spelled}'` : "one overload";
     if (mapped?.kind === "func")
@@ -6123,7 +6055,7 @@ function mapRecordTypeInner(
   // representable.
   const anonSym = widened.getSymbol();
   const anonymousEmpty =
-    (anonSym === undefined || checker.declarationsOf(anonSym).length === 0) &&
+    (anonSym === undefined || anonSym.declarations.length === 0) &&
     !widened.isIntersectionType() &&
     indexValue === undefined &&
     checker.getPropertiesOfType(widened).length === 0;
@@ -6162,10 +6094,7 @@ function mapRecordTypeInner(
       indexValue === undefined &&
       checker.getCallSignatures(widened).length === 0 &&
       checker.getConstructSignatures(widened).length === 0 &&
-      !(
-        anonSym !== undefined &&
-        checker.declarationsOf(anonSym).some((d) => ts.isObjectLiteralExpression(d))
-      )
+      !(anonSym !== undefined && anonSym.declarations.some((d) => ts.isObjectLiteralExpression(d)))
     ) {
       return DYN;
     }
@@ -6186,7 +6115,7 @@ function mapRecordTypeInner(
         // their existing paths (the CJS export-table narrowing and the
         // checked-dynamic fallback), and .d.ts declarations stay out with
         // the rest of the lib's type worlds.
-        const decls = checker.declarationsOf(p);
+        const decls = p.declarations;
         const getDecl = decls.find((d) => ts.isGetAccessorDeclaration(d));
         const setDecl = decls.find((d) => ts.isSetAccessorDeclaration(d));
         const accessorOwned =
@@ -6236,7 +6165,7 @@ function mapRecordTypeInner(
       // declarations and pass.
       if (
         computed &&
-        checker.declarationsOf(p).some((d) => {
+        p.declarations.some((d) => {
           const sf = d.getSourceFile();
           return sf.isDeclarationFile && !ctx.isExternalTypeFile(sf) && !packageTypeFile(sf, ctx);
         })
@@ -6267,7 +6196,7 @@ function mapRecordTypeInner(
       if (
         pt === null &&
         (fieldTs.flags & ts.TypeFlags.Any) !== 0 &&
-        constAssertedEmptyArrayProp(p, ctx)
+        constAssertedEmptyArrayProp(p)
       ) {
         pt = arrayOf(unitOnlyUnion(ctx.unions));
       }
@@ -6436,9 +6365,9 @@ export function describeComponentBlocker(widened: ts.Type, ctx: TypeMapperCtx):
   const container =
     psym !== undefined &&
     Object.prototype.hasOwnProperty.call(STDLIB_CONTAINERS, psym.name) &&
-    checker
-      .declarationsOf(psym)
-      .some((d) => ts.isInterfaceDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()))
+    psym.declarations.some(
+      (d) => ts.isInterfaceDeclaration(d) && ctx.isStdlibFile(d.getSourceFile()),
+    )
       ? psym.name
       : undefined;
   if (container !== undefined) {
@@ -6569,7 +6498,7 @@ export function describeComponentBlocker(widened: ts.Type, ctx: TypeMapperCtx):
   if (callSigs.length === 1) {
     const sig = callSigs[0]!;
     if (sig.getTypeParameters().length > 0) return null;
-    const sigDecl = checker.signatureDeclaration(sig);
+    const sigDecl = sig.declaration;
     if (
       sigDecl !== undefined &&
       ts.isFunctionLike(sigDecl) &&
@@ -6619,7 +6548,7 @@ export function describeRecordMemberBlocker(widened: ts.Type, ctx: TypeMapperCtx
     // any one member's type — that story stays with the residual fence.
     if (
       computed &&
-      checker.declarationsOf(p).some((d) => {
+      p.declarations.some((d) => {
         const sf = d.getSourceFile();
         return sf.isDeclarationFile && !ctx.isExternalTypeFile(sf) && !packageTypeFile(sf, ctx);
       })
diff --git a/packages/compiler/src/frontend/worker-target.ts b/packages/compiler/src/frontend/worker-target.ts
index c395da593..99c97dded 100644
--- a/packages/compiler/src/frontend/worker-target.ts
+++ b/packages/compiler/src/frontend/worker-target.ts
@@ -25,7 +25,7 @@ function workerNamespace(program: ts.Program, expression: ts.Expression): boolea
   if (isBuiltinNamespaceImport(program, expression, "worker_threads")) return true;
   const checker = program.getTypeChecker(),
     symbol = checker.getSymbolAtLocation(expression);
-  const declaration = symbol ? checker.declarationsOf(symbol)[0] : undefined;
+  const declaration = symbol ? symbol.declarations[0] : undefined;
   return (
     declaration !== undefined &&
     ts.isVariableDeclaration(declaration) &&
@@ -53,7 +53,7 @@ export function isWorkerConstructor(program: ts.Program, expression: ts.Expressi
   if (isBuiltinMemberImport(program, expression, "worker_threads", "Worker")) return true;
   const checker = program.getTypeChecker(),
     symbol = checker.getSymbolAtLocation(expression);
-  const declaration = symbol ? checker.declarationsOf(symbol)[0] : undefined;
+  const declaration = symbol ? symbol.declarations[0] : undefined;
   if (
     declaration &&
     ts.isBindingElement(declaration) &&
diff --git a/packages/compiler/src/index.ts b/packages/compiler/src/index.ts
index ca9dc4d18..7d8d88889 100644
--- a/packages/compiler/src/index.ts
+++ b/packages/compiler/src/index.ts
@@ -528,12 +528,15 @@ async function compileExecutableNative(
     fileHandle: features.fileHandle,
     fetch: features.fetch,
     ...(features.eventTarget ? { eventTarget: true } : {}),
+    ...(features.warningReplace ? { warningReplace: true } : {}),
+    ...(features.stdioExtended ? { stdioExtended: true } : {}),
     zlib: features.zlib,
     assert: features.assert,
     inspect: features.inspect,
     dynInvoke: features.dynInvoke,
     dc: features.dc,
     dynAsync: features.dynAsync,
+    ...(features.dynTier ? { dynTier: true } : {}),
     events: features.events,
     emitter: features.emitter,
     symbol: features.symbol,
@@ -554,6 +557,7 @@ async function compileExecutableNative(
     tls: features.tls,
     tlsCa: features.tlsCa,
     cipher: features.cipher,
+    webcrypto: features.webcrypto,
     ...(onArtifactReady === undefined ? {} : { onArtifactReady }),
     ...(ffi === null
       ? {}
@@ -1343,6 +1347,7 @@ function libraryNativeFeatures(mod: IrModule, backend: "llvm"): EarlyLibraryNati
     copying: features.copying,
     textDecoderLegacy: features.legacyTextDecoder,
     dynInvoke: features.dynInvoke,
+    ...(features.dynTier ? { dynTier: true } : {}),
     ...(mod.lib?.identity !== undefined ? { buildId: mod.lib.identity.buildId } : {}),
   };
 }
@@ -1436,6 +1441,7 @@ async function compileLibraryNative(
     copying: features.copying,
     textDecoderLegacy: features.textDecoderLegacy,
     dynInvoke: features.dynInvoke,
+    ...(features.dynTier === true ? { dynTier: true } : {}),
   };
   if (packTarget !== null) await compilePackedLibrary(archiveOptions, packTarget);
   else await compileExternalCLibrary(archiveOptions);
diff --git a/packages/compiler/src/ir/analysis.ts b/packages/compiler/src/ir/analysis.ts
index 4fa2d8361..70ec381a1 100644
--- a/packages/compiler/src/ir/analysis.ts
+++ b/packages/compiler/src/ir/analysis.ts
@@ -150,6 +150,7 @@ export function dynDesc(
     case "undefinedT":
       return "undefined";
     case "dyn":
+    case "jsval":
       return "unknown";
     case "promise":
       return "Promise";
diff --git a/packages/compiler/src/ir/api.ts b/packages/compiler/src/ir/api.ts
index f61bb1054..600cdb051 100644
--- a/packages/compiler/src/ir/api.ts
+++ b/packages/compiler/src/ir/api.ts
@@ -18,6 +18,7 @@ export {
   moduleUsesAssert,
   moduleUsesDynInvoke,
   moduleUsesDynAsync,
+  moduleUsesDynTier,
   moduleUsesInspect,
   moduleUsesChildProcess,
   moduleUsesNet,
diff --git a/packages/compiler/src/ir/builtin-effects.ts b/packages/compiler/src/ir/builtin-effects.ts
index 82a463ae8..826151009 100644
--- a/packages/compiler/src/ir/builtin-effects.ts
+++ b/packages/compiler/src/ir/builtin-effects.ts
@@ -137,6 +137,9 @@ export const MAY_THROW_LIB_FNS: ReadonlySet<IrLibFn> = new Set([
   "fetch.streamNew",
   "fetch.streamFrom",
   "num.toFixed",
+  "num.toPrecision",
+  "num.toExponentialDigits",
+  "str.localeCase",
   "num.toStringRadix",
   "num.toStringRadixF64",
   "insp.jsonDyn",
@@ -380,6 +383,16 @@ export const MAY_THROW_LIB_FNS: ReadonlySet<IrLibFn> = new Set([
   "dyn.propertyKey",
   "dyn.toNumeric",
   "dyn.increment",
+  // The dynamic-tier operators run the same coercions (scr_js_value.c), and
+  // js.toF64 throws dynCheck's TypeError for a non-number.
+  "js.toF64",
+  "js.add",
+  "js.arithmetic",
+  "js.bitwise",
+  "js.compare",
+  "js.toNumeric",
+  "js.increment",
+  "js.toNumberCoerce",
   // Error messages use the same coercion protocol before installing cause.
   "error.newOptions",
   "error.ctorOptions",
@@ -575,6 +588,7 @@ export const MAY_THROW_LIB_FNS: ReadonlySet<IrLibFn> = new Set([
   "dyn.propertyIsEnumerableComputed",
   // the destructuring pack throws V8's TypeError on non-iterable dyn kinds
   "dyn.iterPack",
+  "dyn.destructureRest",
   "dyn.arrayFromIterator",
   "dyn.iterator",
   "dyn.iteratorResult",
@@ -683,6 +697,8 @@ export const MAY_THROW_LIB_FNS: ReadonlySet<IrLibFn> = new Set([
   "crypto.randomIntMax",
   "crypto.randomFillView",
   "crypto.randomFillViewRest",
+  "crypto.getRandomValues",
+  "crypto.getRandomValuesDyn",
   "crypto.randomFillSyncDyn",
   "crypto.randomFillCb",
   "crypto.randomFillCbDyn",
diff --git a/packages/compiler/src/ir/builtin-signatures.ts b/packages/compiler/src/ir/builtin-signatures.ts
index e85c45641..7675f9eec 100644
--- a/packages/compiler/src/ir/builtin-signatures.ts
+++ b/packages/compiler/src/ir/builtin-signatures.ts
@@ -22,6 +22,7 @@ import {
   HTTPCLIENTREQ_T,
   HTTPREQ_T,
   HTTPRES_T,
+  JSVAL,
   NETSERVER_T,
   NETSOCKET_T,
   PROCSTREAM_T,
@@ -176,12 +177,15 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
    * not iterable (cannot read property Symbol(Symbol.iterator))"). In the
    * may-throw seed set. */
   "dyn.iterPack": { argTypes: [DYN, STRING], result: DYN },
+  "dyn.destructureRest": { argTypes: [DYN, STRING], result: DYN },
   "dyn.arrayFromIterator": { argTypes: [DYN], result: DYN },
   "dyn.iterator": { argTypes: [DYN, STRING], result: DYN },
   "dyn.iteratorResult": { argTypes: [DYN], result: DYN },
   "dyn.iteratorCanStep": { argTypes: [DYN, DYN], result: BOOL },
   "dyn.iteratorStep": { argTypes: [DYN], result: DYN },
   "dyn.iteratorStepDone": { argTypes: [DYN], result: BOOL },
+  "dyn.setGeneratorMembers": { argTypes: [DYN, DYN], result: VOID },
+  "dyn.iteratorHelperMethod": { argTypes: [STRING], result: DYN },
   "dyn.collectionIteratorIndex": { argTypes: [DYN], result: F64 },
   "dyn.mapSeedEntries": { argTypes: [DYN], result: DYN },
   "dyn.mapSeedEntry": { argTypes: [DYN], result: DYN },
@@ -565,6 +569,8 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
   /** os.constants: the per-thread null-prototype constants object (dlopen,
    * errno, signals, priority, UV_UDP_REUSEADDR). Never throws. */
   "os.constants": { argTypes: [], result: DYN },
+  /** fs.constants: the target's cached null-prototype constants object. */
+  "fs.constants": { argTypes: [], result: DYN },
   /** The deprecated node:constants object (scr_os.c): the os groups and
    * fs.constants merged with the borrowed baked crypto.constants table,
    * frozen, one per thread. */
@@ -692,6 +698,13 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
   /** `a.localeCompare(b)`: -1/0/1 in Node's root-locale collation for
    * Latin-script text (scr_str_locale_compare). Never throws. */
   "str.localeCompare": { argTypes: [STRING, STRING], result: F64 },
+  /** Annex B substr(start, length) with start ToNumber'd and length's
+   * presence; never throws. */
+  "str.substr": { argTypes: [STRING, F64, F64, BOOL], result: STRING },
+  /** toLocaleLowerCase/toLocaleUpperCase (scr_regex.c): the locales value
+   * as written, upper=true for toLocaleUpperCase. Throws for null and for
+   * locale forms with no native rules. */
+  "str.localeCase": { argTypes: [STRING, DYN, BOOL], result: STRING },
   "str.replaceLiteral": { argTypes: [STRING, STRING, STRING, BOOL], result: STRING },
   // (subject, characters, NUL-separated replacement texts): the fused
   // chain of global one-character replacements.
@@ -756,6 +769,11 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
   "num.toExponential": { argTypes: [F64], result: STRING },
   "num.toFixed0": { argTypes: [F64], result: STRING },
   "num.toFixed": { argTypes: [F64, F64], result: STRING },
+  /** toPrecision(precision) with the argument ToNumber'd and its presence
+   * (undefined answers ToString); toExponential with a DEFINED
+   * fractionDigits. Both throw V8's RangeError for out-of-range digits. */
+  "num.toPrecision": { argTypes: [F64, F64, BOOL], result: STRING },
+  "num.toExponentialDigits": { argTypes: [F64, F64], result: STRING },
   "num.toStringRadix": { argTypes: [F64, DYN], result: STRING },
   /** toString(radix) with a number radix (scr_lib.c): truncates it as
    * ToIntegerOrInfinity does, THROWS RangeError outside 2..36. */
@@ -2602,6 +2620,11 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
    * whether min was given. */
   "crypto.randomFillView": { argTypes: [null, F64, F64], result: BYTES_U8 },
   "crypto.randomFillViewRest": { argTypes: [null, F64], result: BYTES_U8 },
+  /** crypto.getRandomValues: a view returns itself at its own type (the
+   * float/size DOMExceptions are thrown at run time); any other value
+   * takes the checked form. */
+  "crypto.getRandomValues": { argTypes: [null], result: BYTES_U8 },
+  "crypto.getRandomValuesDyn": { argTypes: [DYN], result: DYN },
   "crypto.randomFillSyncDyn": { argTypes: [DYN, DYN, DYN], result: DYN },
   "crypto.randomFillCb": { argTypes: [null, F64, F64, F64, null], result: VOID },
   "crypto.randomFillCbDyn": { argTypes: [DYN, DYN, DYN, F64, null], result: VOID },
@@ -2614,6 +2637,14 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
   "crypto.generateKeyCb": { argTypes: [DYN, DYN, null], result: VOID },
   "crypto.keyObjectInput": { argTypes: [DYN], result: BYTES_U8 },
   "crypto.isKeyObject": { argTypes: [DYN], result: BOOL },
+  /** WebCrypto (scr_webcrypto.c): each method takes its argument vector as
+   * one dyn array and answers a promise that argument and validation
+   * failures reject. CryptoKey values are native handles. */
+  "webcrypto.importKey": { argTypes: [DYN], result: { kind: "promise", inner: DYN } },
+  "webcrypto.sign": { argTypes: [DYN], result: { kind: "promise", inner: DYN } },
+  "webcrypto.verify": { argTypes: [DYN], result: { kind: "promise", inner: BOOL } },
+  "webcrypto.digest": { argTypes: [DYN], result: { kind: "promise", inner: DYN } },
+  "webcrypto.isCryptoKey": { argTypes: [DYN], result: BOOL },
   "crypto.randomUUIDv7": { argTypes: [DYN], result: STRING },
   "crypto.pbkdf2": { argTypes: [BYTES_U8, BYTES_U8, F64, F64, STRING], result: BYTES_U8 },
   "crypto.randomBytesCb": { argTypes: [F64, null], result: VOID },
@@ -2652,6 +2683,9 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
   "buffer.fromStr": { argTypes: [STRING, STRING], result: BYTES_U8 },
   "buffer.fromStrChecked": { argTypes: [STRING, STRING], result: BYTES_U8 },
   "buffer.brand": { argTypes: [BYTES_U8], result: BYTES_U8 },
+  /** Buffer.isBuffer over a typed view: whether the view carries the
+   * Buffer brand (any element kind; only Buffers do). Never throws. */
+  "buffer.isBranded": { argTypes: [null], result: BOOL },
   /** Buffer.from on checked-native strings, bytes, arrays and data-only
    * array-like/Buffer-JSON objects. The encoding is a normalized literal;
    * non-string inputs ignore it. Copies the input and may throw during
@@ -3116,6 +3150,29 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
   "dyn.compare": { argTypes: [DYN, DYN, STRING], result: BOOL },
   "dyn.bitwise": { argTypes: [DYN, DYN, STRING], result: DYN },
   "dyn.proxyNew": { argTypes: [DYN, DYN], result: DYN },
+  /* Dynamic-tier values (jsval; two-tier design stage S3). The jsval pass
+   * (ir/jsval.ts) introduces these in dynamic-tier functions only; the
+   * runtime is scr_js_value.c. Arguments are borrowed and results owned,
+   * like every libCall. Boundary conversions: js.fromDyn (a cell keeps its
+   * identity), js.toDyn (an immediate is boxed), js.fromF64/fromBool/
+   * fromStr/fromBigInt (the design's toJs: immediates, and strings and
+   * BigInts under a tag without a copy) and js.toF64 (fromJs to number: dynCheck's
+   * number check and TypeError). The operators are the dyn.* operators
+   * over jsvals, with identical JS semantics. */
+  "js.fromDyn": { argTypes: [DYN], result: JSVAL },
+  "js.toDyn": { argTypes: [JSVAL], result: DYN },
+  "js.fromF64": { argTypes: [F64], result: JSVAL },
+  "js.fromBool": { argTypes: [BOOL], result: JSVAL },
+  "js.fromStr": { argTypes: [STRING], result: JSVAL },
+  "js.fromBigInt": { argTypes: [BIGINT_T], result: JSVAL },
+  "js.toF64": { argTypes: [JSVAL], result: F64 },
+  "js.add": { argTypes: [JSVAL, JSVAL], result: JSVAL },
+  "js.arithmetic": { argTypes: [JSVAL, JSVAL, STRING], result: JSVAL },
+  "js.bitwise": { argTypes: [JSVAL, JSVAL, STRING], result: JSVAL },
+  "js.compare": { argTypes: [JSVAL, JSVAL, STRING], result: BOOL },
+  "js.toNumeric": { argTypes: [JSVAL], result: JSVAL },
+  "js.increment": { argTypes: [JSVAL, BOOL], result: JSVAL },
+  "js.toNumberCoerce": { argTypes: [JSVAL], result: F64 },
   // Always throws; the result is the READ's declared type (a typed dummy
   // the unwind abandons) — the libCall case skips the result check.
   /** A read of a `declare`d const NOTHING defines (the bundler-define
@@ -4168,6 +4225,7 @@ export const LIB_FN_SIGS = defineLibFnSignatures({
    * warnings and DeprecationWarning emissions read their truthiness. */
   "process.deprecationFlag": { argTypes: [F64], result: DYN },
   "process.setDeprecationFlag": { argTypes: [F64, DYN], result: VOID },
+  "process.setEmitWarning": { argTypes: [DYN], result: VOID },
   /** AsyncLocalStorage (node:async_hooks — scr_async.c): stores are f64
    * handles; contexts are immutable fiber-carried snapshots (spawned
    * fibers inherit the spawner's — Node's init-time capture). run/exit
diff --git a/packages/compiler/src/ir/callback-specialization.test.ts b/packages/compiler/src/ir/callback-specialization.test.ts
index ec0a8d1a3..7a8d0fd64 100644
--- a/packages/compiler/src/ir/callback-specialization.test.ts
+++ b/packages/compiler/src/ir/callback-specialization.test.ts
@@ -63,7 +63,7 @@ function fixture(targets: string[]): IrModule {
     loc,
   };
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [...new Set(targets)].map(predicate).concat([consumer, entry]),
diff --git a/packages/compiler/src/ir/constant-globals.test.ts b/packages/compiler/src/ir/constant-globals.test.ts
index 18ee0f17b..15b88c065 100644
--- a/packages/compiler/src/ir/constant-globals.test.ts
+++ b/packages/compiler/src/ir/constant-globals.test.ts
@@ -30,7 +30,7 @@ const global = (id: string, extra: object = {}) => ({
 
 test("immutable globals stored once with a literal read as that literal", () => {
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: "constant-globals.ts",
     entry: "%init",
     functions: [
diff --git a/packages/compiler/src/ir/constant-tables.test.ts b/packages/compiler/src/ir/constant-tables.test.ts
index 0f9673791..13e8e2970 100644
--- a/packages/compiler/src/ir/constant-tables.test.ts
+++ b/packages/compiler/src/ir/constant-tables.test.ts
@@ -20,7 +20,7 @@ const expr = (value: IrExpr): IrStmt => ({ kind: "exprStmt", expr: value, loc })
 
 function fixture(): IrModule {
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     globals: [{ id, name: "table", type, mutable: false }],
diff --git a/packages/compiler/src/ir/field-values.test.ts b/packages/compiler/src/ir/field-values.test.ts
index 1b66d1a30..d2b1d3e9a 100644
--- a/packages/compiler/src/ir/field-values.test.ts
+++ b/packages/compiler/src/ir/field-values.test.ts
@@ -74,7 +74,7 @@ const grid: IrClassDef = {
   methods: [],
 } as unknown as IrClassDef;
 const moduleOf = (functions: IrFunction[]): IrModule => ({
-  irVersion: 16,
+  irVersion: 17,
   sourceFile: "field-values.ts",
   entry: "%init",
   classes: [grid],
diff --git a/packages/compiler/src/ir/final-fields.test.ts b/packages/compiler/src/ir/final-fields.test.ts
index 7f9fd06ca..fe6f0cd9b 100644
--- a/packages/compiler/src/ir/final-fields.test.ts
+++ b/packages/compiler/src/ir/final-fields.test.ts
@@ -39,7 +39,7 @@ const cls = (name: string, fields: string[], base?: string): IrClassDef => ({
   fields: fields.map((field) => ({ name: field, type: STRING })),
 });
 const mod = (classes: IrClassDef[], functions: IrFunction[]): IrModule => ({
-  irVersion: 16,
+  irVersion: 17,
   sourceFile: "final-fields.ts",
   entry: "%main",
   classes,
diff --git a/packages/compiler/src/ir/function-references.test.ts b/packages/compiler/src/ir/function-references.test.ts
index 117bba24a..c2d461e09 100644
--- a/packages/compiler/src/ir/function-references.test.ts
+++ b/packages/compiler/src/ir/function-references.test.ts
@@ -232,7 +232,7 @@ const entry = (body: IrStmt[] = []): IrFunction => ({
   loc,
 });
 const module = (body: IrStmt[] = []): IrModule => ({
-  irVersion: 16,
+  irVersion: 17,
   sourceFile: loc.file,
   entry: "%main",
   functions: [target, entry(body)],
diff --git a/packages/compiler/src/ir/init-only-globals.test.ts b/packages/compiler/src/ir/init-only-globals.test.ts
index e7f5c7dba..9fec0cd0f 100644
--- a/packages/compiler/src/ir/init-only-globals.test.ts
+++ b/packages/compiler/src/ir/init-only-globals.test.ts
@@ -58,7 +58,7 @@ const guarded = (body: IrStmt[]): IrStmt[] => [
   ...body,
 ];
 const moduleOf = (globals: IrGlobal[], functions: IrFunction[]): IrModule => ({
-  irVersion: 16,
+  irVersion: 17,
   sourceFile: "init-only-globals.ts",
   entry: "%init",
   globals: [guard, ...globals],
diff --git a/packages/compiler/src/ir/initializer-bindings.test.ts b/packages/compiler/src/ir/initializer-bindings.test.ts
index b76f7a1d9..bed4aeefe 100644
--- a/packages/compiler/src/ir/initializer-bindings.test.ts
+++ b/packages/compiler/src/ir/initializer-bindings.test.ts
@@ -50,7 +50,7 @@ function fixture(): IrModule {
     ],
   };
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: fn.name,
     functions: [fn],
diff --git a/packages/compiler/src/ir/int32-slots.test.ts b/packages/compiler/src/ir/int32-slots.test.ts
index afe500b60..446b3512d 100644
--- a/packages/compiler/src/ir/int32-slots.test.ts
+++ b/packages/compiler/src/ir/int32-slots.test.ts
@@ -105,7 +105,7 @@ const newOf = (className: string, args: IrExpr[]): IrExpr => ({
   type: obj(className),
 });
 const mod = (classes: IrClassDef[], functions: IrFunction[]): IrModule => ({
-  irVersion: 16,
+  irVersion: 17,
   sourceFile: "test.ts",
   entry: "%main",
   classes,
diff --git a/packages/compiler/src/ir/int32-slots.ts b/packages/compiler/src/ir/int32-slots.ts
index 903823358..fe0467fac 100644
--- a/packages/compiler/src/ir/int32-slots.ts
+++ b/packages/compiler/src/ir/int32-slots.ts
@@ -311,7 +311,7 @@ export class Int32Slots {
   }
 }
 
-const DYN_KINDS = new Set<IrType["kind"]>(["dyn", "caught"]);
+const DYN_KINDS = new Set<IrType["kind"]>(["dyn", "jsval", "caught"]);
 /** Expressions that hand their operands (or produce results) to runtime
  * helpers, reflection, promises or other code the IR does not show. */
 const BOUNDARY_KINDS = new Set<IrExpr["kind"]>([
@@ -403,6 +403,19 @@ const DYN_READ_ONLY = new Set<string>([
   "fs.utimesSync",
   "insp.dyn",
   "insp.dynS",
+  // The dynamic-tier operators run their dyn twins (scr_js_value.c); the
+  // conversions move a value between dyn and jsval, and js.toF64 is
+  // dynCheck's number check.
+  "js.add",
+  "js.arithmetic",
+  "js.bitwise",
+  "js.compare",
+  "js.fromDyn",
+  "js.increment",
+  "js.toDyn",
+  "js.toF64",
+  "js.toNumberCoerce",
+  "js.toNumeric",
   "json.stringifyReplacer",
   "json.stringifyValue",
   "num.toStringRadix",
diff --git a/packages/compiler/src/ir/ir.ts b/packages/compiler/src/ir/ir.ts
index 6c8df7733..b84c0594e 100644
--- a/packages/compiler/src/ir/ir.ts
+++ b/packages/compiler/src/ir/ir.ts
@@ -337,6 +337,17 @@ export type IrType =
    * <type>' first" hint — or, in JavaScript sources, met with per-site
    * checked lowerings (SEMANTICS.md 115-117). */
   | { kind: "dyn" }
+  /** A dynamic-tier value (two-tier design §5.1, stage S3): one 64-bit
+   * NaN-boxed word. Numbers, booleans, undefined and null are immediates
+   * (no allocation); strings and BigInts are the static tier's own objects
+   * under a pointer tag; every other value is a `dyn` cell under the cell
+   * tag. Only dynamic-tier functions operate on it (ir/tiers.ts, I1), and
+   * only through the `js.*` builtins, locals and moves: the jsval pass
+   * (ir/jsval.ts) introduces it after lowering, never the frontend. Static
+   * functions see it only as the operand or result of a boundary
+   * conversion. Refcounted: retain/release skip immediates. 32-bit targets
+   * represent it as a boxed `dyn` cell. */
+  | { kind: "jsval" }
   /** A catch binding or its closure capture (never parameters, returns,
    * fields, arms or elements). The one global form is a module's recorded
    * evaluation error, written only from that module's catch binding and
@@ -437,6 +448,7 @@ const POINTER_KIND_LIST = [
   "record",
   "union",
   "dyn",
+  "jsval",
   "caught",
   "promise",
   "generator",
@@ -490,6 +502,7 @@ export const RUNTIME_RC_STEMS: Record<IrType["kind"], string> = {
   record: "",
   union: "scr_union",
   dyn: "scr_dyn",
+  jsval: "scr_js",
   caught: "scr_caught",
   promise: "scr_promise",
   generator: "scr_gen",
@@ -595,6 +608,7 @@ export const CHILDWRITER_T: IrType = { kind: "childWriter" };
 export const PROCSTREAM_T: IrType = { kind: "procStream" };
 export const VOID: IrType = { kind: "void" };
 export const DYN: IrType = { kind: "dyn" };
+export const JSVAL: IrType = { kind: "jsval" };
 export const CAUGHT: IrType = { kind: "caught" };
 export const UNDEFINED_T: IrType = { kind: "undefinedT" };
 export const NULL_T: IrType = { kind: "nullT" };
@@ -840,6 +854,7 @@ export function typeKey(t: IrType): string {
     case "searchParams":
     case "symbol":
     case "dyn":
+    case "jsval":
     case "caught":
     case "void":
       return t.kind;
@@ -967,7 +982,7 @@ export function isRefCounted(t: IrType): boolean {
 
 export interface IrModule {
   /** Bumped on any breaking IR change; serialize.ts refuses mismatches. */
-  irVersion: 16;
+  irVersion: 17;
   sourceFile: string;
   functions: IrFunction[];
   /** Class shapes. Constructors and methods are ordinary module functions
@@ -2591,18 +2606,8 @@ export type IrExpr =
   | { kind: "logical"; op: "&&" | "||"; left: IrExpr; right: IrExpr; type: IrType; loc: SrcLoc }
   | { kind: "strConcat"; left: IrExpr; right: IrExpr; type: IrType; loc: SrcLoc }
   | { kind: "strEq"; negated: boolean; left: IrExpr; right: IrExpr; type: IrType; loc: SrcLoc }
-  /** String ordering. Ordinary source comparisons omit `utf16` and retain
-   * scriptc's documented code-point order; the default Array sort comparator
-   * sets it to request ECMAScript's UTF-16 code-unit order. */
-  | {
-      kind: "strCmp";
-      op: IrStrCmpOp;
-      left: IrExpr;
-      right: IrExpr;
-      utf16?: boolean;
-      type: IrType;
-      loc: SrcLoc;
-    }
+  /** String ordering in ECMAScript's UTF-16 code-unit order. */
+  | { kind: "strCmp"; op: IrStrCmpOp; left: IrExpr; right: IrExpr; type: IrType; loc: SrcLoc }
   /** f64|bool → string, JS-exact (Number::toString / "true"/"false").
    * Union operands dispatch through the per-union ToString helper (arms
    * fenced to unit/string/f64/bool by the frontend); a CAUGHT operand is
@@ -3976,6 +3981,7 @@ function isJsonSafeAt(
     // diagnostic.
     case "symbol":
     case "caught":
+    case "jsval":
     case "promise":
     case "generator":
     case "moduleNs":
diff --git a/packages/compiler/src/ir/jsval.test.ts b/packages/compiler/src/ir/jsval.test.ts
new file mode 100644
index 000000000..89c7327bc
--- /dev/null
+++ b/packages/compiler/src/ir/jsval.test.ts
@@ -0,0 +1,279 @@
+import { expect, test } from "vitest";
+import {
+  BOOL,
+  DYN,
+  F64,
+  JSVAL,
+  STRING,
+  VOID,
+  type IrExpr,
+  type IrFunction,
+  type IrModule,
+  type IrStmt,
+} from "./ir.js";
+import { promoteJsvals } from "./jsval.js";
+import { assignLegacyTiers } from "./tiers.js";
+import { validateModule } from "./validate.js";
+
+const loc = { file: "jsval.ts", start: 0, end: 0 };
+const ref = (id: string, type = DYN): IrExpr => ({ kind: "varRef", localId: id, type, loc });
+const num = (value: number): IrExpr => ({
+  kind: "dynFrom",
+  value: { kind: "numLit", value, type: F64, loc },
+  type: DYN,
+  loc,
+});
+const op = (fn: "dyn.add" | "dyn.arithmetic", l: IrExpr, r: IrExpr, symbol?: string): IrExpr => ({
+  kind: "libCall",
+  fn,
+  args:
+    symbol === undefined ? [l, r] : [l, r, { kind: "strLit", value: symbol, type: STRING, loc }],
+  type: DYN,
+  loc,
+});
+const keyGet = (from: IrExpr, key: string): IrExpr => ({
+  kind: "dynKeyGet",
+  key: { kind: "strLit", value: key, type: STRING, loc },
+  value: from,
+  type: DYN,
+  loc,
+});
+
+function fn(name: string, body: IrStmt[], locals: string[] = [], returnType = DYN): IrFunction {
+  return {
+    name,
+    params: [{ localId: "o", name: "o", type: DYN }],
+    returnType,
+    locals: [
+      { id: "o", name: "o", type: DYN, mutable: false },
+      ...locals.map((id) => ({ id, name: id, type: DYN, mutable: true })),
+    ],
+    body,
+    loc,
+  };
+}
+
+function moduleOf(...functions: IrFunction[]): IrModule {
+  const main: IrFunction = {
+    name: "%main",
+    params: [],
+    returnType: VOID,
+    locals: [],
+    body: [],
+    loc,
+  };
+  const mod: IrModule = {
+    irVersion: 17,
+    sourceFile: "jsval.ts",
+    functions: [main, ...functions],
+    entry: "%main",
+  };
+  assignLegacyTiers(mod.functions);
+  return mod;
+}
+
+/** The js.* calls of a body, in source order. */
+function jsCalls(body: IrStmt[]): string[] {
+  const out: string[] = [];
+  const visit = (value: unknown): void => {
+    if (Array.isArray(value)) value.forEach(visit);
+    else if (value !== null && typeof value === "object") {
+      const node = value as { kind?: string; fn?: string };
+      if (node.kind === "libCall" && node.fn?.startsWith("js.")) out.push(node.fn);
+      Object.values(value).forEach(visit);
+    }
+  };
+  visit(body);
+  return out;
+}
+
+test("operator chains compute with jsvals and box only where a dyn value is needed", () => {
+  // return o.x * o.y + 1
+  const chain = fn("chain", [
+    {
+      kind: "return",
+      value: op(
+        "dyn.add",
+        op("dyn.arithmetic", keyGet(ref("o"), "x"), keyGet(ref("o"), "y"), "*"),
+        num(1),
+      ),
+      loc,
+    },
+  ]);
+  const mod = moduleOf(chain);
+  expect(chain.tier).toBe("dynamic");
+  // A static caller keeps the dyn ABI: one box at the end of the chain,
+  // none in between; the static 1 is an immediate and the reads keep their
+  // cells.
+  const caller = fn("caller", [
+    {
+      kind: "return",
+      value: { kind: "call", callee: "chain", args: [ref("o")], type: DYN, loc },
+      loc,
+    },
+  ]);
+  mod.functions.push(caller);
+  expect(caller.tier).toBeUndefined();
+  expect(promoteJsvals(mod)).toBe(1);
+  expect(chain.returnType).toEqual(DYN);
+  expect(jsCalls(chain.body)).toEqual([
+    "js.toDyn",
+    "js.add",
+    "js.arithmetic",
+    "js.fromDyn",
+    "js.fromDyn",
+    "js.fromF64",
+  ]);
+  expect(jsCalls(caller.body)).toEqual([]);
+  expect(validateModule(mod)).toEqual([]);
+});
+
+test("a dynamic function called only by dynamic functions returns a jsval", () => {
+  const twice = fn("twice", [
+    { kind: "return", value: op("dyn.arithmetic", keyGet(ref("o"), "n"), num(2), "*"), loc },
+  ]);
+  // return twice(o) + twice(o): no box between the calls and the add.
+  const sum = fn("sum", [
+    {
+      kind: "return",
+      value: op(
+        "dyn.add",
+        { kind: "call", callee: "twice", args: [ref("o")], type: DYN, loc },
+        { kind: "call", callee: "twice", args: [ref("o")], type: DYN, loc },
+      ),
+      loc,
+    },
+  ]);
+  const user = fn("user", [
+    {
+      kind: "exprStmt",
+      expr: keyGet({ kind: "call", callee: "sum", args: [ref("o")], type: DYN, loc }, "x"),
+      loc,
+    },
+    { kind: "return", value: ref("o"), loc },
+  ]);
+  const mod = moduleOf(twice, sum, user);
+  promoteJsvals(mod);
+  expect(twice.returnType).toEqual(JSVAL);
+  expect(sum.returnType).toEqual(JSVAL);
+  expect(jsCalls(twice.body)).toEqual(["js.arithmetic", "js.fromDyn", "js.fromF64"]);
+  expect(jsCalls(sum.body)).toEqual(["js.add"]);
+  // A dyn consumer boxes the jsval result once.
+  expect(jsCalls(user.body)).toEqual(["js.toDyn", "js.fromDyn"]);
+  expect(validateModule(mod)).toEqual([]);
+});
+
+test("a number check of an operator result reads the jsval, and comparisons take jsvals", () => {
+  const checked = fn(
+    "checked",
+    [
+      {
+        kind: "if",
+        cond: {
+          kind: "libCall",
+          fn: "dyn.compare",
+          args: [keyGet(ref("o"), "a"), num(3), { kind: "strLit", value: "<", type: STRING, loc }],
+          type: BOOL,
+          loc,
+        },
+        then: [{ kind: "return", value: { kind: "numLit", value: 0, type: F64, loc }, loc }],
+        else_: null,
+        loc,
+      },
+      {
+        kind: "return",
+        value: {
+          kind: "dynCheck",
+          value: op("dyn.arithmetic", keyGet(ref("o"), "a"), num(2), "%"),
+          type: F64,
+          loc,
+        },
+        loc,
+      },
+    ],
+    [],
+    F64,
+  );
+  const mod = moduleOf(checked);
+  promoteJsvals(mod);
+  expect(jsCalls(checked.body)).toEqual([
+    "js.compare",
+    "js.fromDyn",
+    "js.fromF64",
+    "js.toF64",
+    "js.arithmetic",
+    "js.fromDyn",
+    "js.fromF64",
+  ]);
+  expect(validateModule(mod)).toEqual([]);
+});
+
+test("a dyn local written by operators in a loop becomes a jsval local", () => {
+  // acc = o.start; for (...) acc = acc + o.step; return acc
+  const loop = fn(
+    "loop",
+    [
+      { kind: "varDecl", localId: "acc", init: keyGet(ref("o"), "start"), loc },
+      {
+        kind: "while",
+        cond: { kind: "boolLit", value: false, type: BOOL, loc },
+        body: [
+          {
+            kind: "assign",
+            localId: "acc",
+            value: op("dyn.add", ref("acc"), keyGet(ref("o"), "step")),
+            loc,
+          },
+        ],
+        loc,
+      },
+      { kind: "return", value: ref("acc"), loc },
+    ],
+    ["acc"],
+  );
+  const mod = moduleOf(loop);
+  promoteJsvals(mod);
+  expect(loop.locals.find((l) => l.id === "acc")!.type).toEqual(JSVAL);
+  expect(loop.returnType).toEqual(JSVAL);
+  expect(jsCalls(loop.body)).toEqual(["js.fromDyn", "js.add", "js.fromDyn"]);
+  expect(validateModule(mod)).toEqual([]);
+});
+
+test("a dyn local mostly read by dyn consumers stays dyn", () => {
+  // t = o.a + 1; for (...) use(t)
+  const reader = fn(
+    "reader",
+    [
+      { kind: "varDecl", localId: "t", init: op("dyn.add", keyGet(ref("o"), "a"), num(1)), loc },
+      {
+        kind: "while",
+        cond: { kind: "boolLit", value: false, type: BOOL, loc },
+        body: [{ kind: "exprStmt", expr: keyGet(ref("t"), "x"), loc }],
+        loc,
+      },
+      { kind: "return", value: ref("t"), loc },
+    ],
+    ["t"],
+  );
+  const mod = moduleOf(reader);
+  promoteJsvals(mod);
+  expect(reader.locals.find((l) => l.id === "t")!.type).toEqual(DYN);
+  expect(validateModule(mod)).toEqual([]);
+});
+
+test("static functions keep their dyn values; async functions keep their dyn result", () => {
+  const plain = fn("plain", [{ kind: "return", value: ref("o"), loc }]);
+  const asyncChain = fn("asyncChain", [
+    { kind: "return", value: op("dyn.add", keyGet(ref("o"), "x"), num(1)), loc },
+  ]);
+  asyncChain.async = true;
+  const mod = moduleOf(plain, asyncChain);
+  expect(plain.tier).toBeUndefined();
+  expect(asyncChain.tier).toBe("dynamic");
+  const before = JSON.stringify(plain);
+  expect(promoteJsvals(mod)).toBe(1);
+  expect(JSON.stringify(plain)).toBe(before);
+  expect(asyncChain.returnType).toEqual(DYN);
+  expect(jsCalls(asyncChain.body)).toEqual(["js.toDyn", "js.add", "js.fromDyn", "js.fromF64"]);
+  expect(validateModule(mod)).toEqual([]);
+});
diff --git a/packages/compiler/src/ir/jsval.ts b/packages/compiler/src/ir/jsval.ts
new file mode 100644
index 000000000..1939531f1
--- /dev/null
+++ b/packages/compiler/src/ir/jsval.ts
@@ -0,0 +1,384 @@
+/* The jsval pass (two-tier design stage S3): dynamic-tier functions compute
+ * with jsval values instead of dyn cells.
+ *
+ * Lowering builds every dynamic operation over `dyn`, the checked-dynamic
+ * cell (ScrDyn), where a number is a heap node: each dyn operator result
+ * allocates one. This pass rewrites the operator chains of dynamic-tier
+ * functions (ir/tiers.ts) to the `js.*` builtins over `jsval`, the
+ * NaN-boxed word whose numbers, booleans, undefined and null are
+ * immediates:
+ *
+ * - every dyn operator (`dyn.add`, `dyn.arithmetic`, `dyn.bitwise`,
+ *   `dyn.toNumeric`, `dyn.increment`) becomes its `js.*` twin, whose
+ *   operands are rewritten as jsvals too, so a chain `a * b + c` allocates
+ *   nothing for its intermediate results;
+ * - the operator consumers `dyn.compare` and `dyn.toNumberCoerce` take
+ *   jsval operands, a number check `dynCheck<f64>` of an operator result
+ *   becomes `js.toF64`, and a truthiness test of one tests the jsval;
+ * - a static number or boolean operand (`dynFrom<f64>`) becomes an
+ *   immediate (`js.fromF64`), a static string or BigInt the same object
+ *   under a tag (`js.fromStr`, `js.fromBigInt`: no cell), and any other dyn
+ *   operand a cell under the cell tag (`js.fromDyn`: no copy, identity
+ *   kept);
+ * - an operator result that flows anywhere else (a property store, a call
+ *   argument, a dyn local) is boxed back into a cell (`js.toDyn`), exactly
+ *   the allocation the dyn operator made before;
+ * - a dynamic function whose only references are direct calls from
+ *   dynamic functions returns a jsval, so a number it returns is not boxed
+ *   (static callers, function values, exports and class members keep the
+ *   dyn ABI);
+ * - a dyn local becomes a jsval local when the boxing it saves on writes
+ *   of operator results outweighs the boxing its reads by dyn consumers add
+ *   (loop depth weights both).
+ *
+ * The rewrite changes representation only: every js builtin implements its
+ * dyn twin's JS semantics, including ToPrimitive order and error messages
+ * (scr_js_value.c delegates every non-number case to the dyn operator).
+ * Static functions are never touched (invariant I1). Parameters, captures
+ * and containers still hold cells until the shaped object model and the
+ * dynamic call ABI (stages S4 and S5) replace them.
+ *
+ * Async functions and generators are rewritten like other functions (their
+ * suspensions keep jsvals like any pointer) but keep the dyn result ABI. */
+import { exprFunctionReference, moduleFunctionReferences } from "./function-references.js";
+import { DYN, JSVAL, type IrExpr, type IrFunction, type IrModule, type IrStmt } from "./ir.js";
+import {
+  everyExprChild,
+  everyStmtChild,
+  everyStmtList,
+  mapExprChildren,
+  mapStmtChildren,
+} from "./traverse.js";
+
+/** dyn operators whose result is a fresh dynamic value, with their jsval
+ * twins. Every argument typed dyn is an operand. */
+const PRODUCERS: Readonly<Record<string, string>> = {
+  "dyn.add": "js.add",
+  "dyn.arithmetic": "js.arithmetic",
+  "dyn.bitwise": "js.bitwise",
+  "dyn.toNumeric": "js.toNumeric",
+  "dyn.increment": "js.increment",
+};
+
+/** dyn operators with a static result, with their jsval twins. */
+const CONSUMERS: Readonly<Record<string, string>> = {
+  "dyn.compare": "js.compare",
+  "dyn.toNumberCoerce": "js.toNumberCoerce",
+};
+
+function isProducerCall(e: IrExpr): boolean {
+  return e.kind === "libCall" && Object.hasOwn(PRODUCERS, e.fn);
+}
+
+function isConsumerCall(e: IrExpr): boolean {
+  return e.kind === "libCall" && Object.hasOwn(CONSUMERS, e.fn);
+}
+
+/** The jsval conversion of a static value that crosses without a cell:
+ * numbers and booleans as immediates, strings and BigInts as the static
+ * tier's own objects under a tag. */
+const STATIC_SOURCES: Readonly<Record<string, string>> = {
+  f64: "js.fromF64",
+  bool: "js.fromBool",
+  string: "js.fromStr",
+  bigint: "js.fromBigInt",
+};
+
+function isImmediateSource(e: IrExpr): boolean {
+  return (
+    e.kind === "dynFrom" &&
+    e.liveRef === undefined &&
+    e.fnName === undefined &&
+    Object.hasOwn(STATIC_SOURCES, e.value.type.kind)
+  );
+}
+
+/** Whether a function's operators are rewritten: every dynamic-tier
+ * function. Async functions and generators suspend through LLVM coroutines
+ * or fibers, which keep jsval temporaries and locals like any pointer. */
+export function jsvalEligible(fn: IrFunction): boolean {
+  return fn.tier === "dynamic";
+}
+
+/** Rewrite every eligible dynamic-tier function of a module in place.
+ * Returns the number of functions that now use jsval. */
+export function promoteJsvals(mod: IrModule): number {
+  const results = jsvalResults(mod);
+  let count = 0;
+  for (const fn of mod.functions) if (jsvalEligible(fn) && promoteFunction(fn, results)) count++;
+  for (const fn of mod.functions) if (results.has(fn.name)) fn.returnType = JSVAL;
+  return count;
+}
+
+/** Dynamic-tier functions whose dyn result becomes a jsval result, so a
+ * number they return is not boxed: eligible functions whose every
+ * reference is a direct call from a dynamic-tier function (static callers
+ * keep their exact code, I1). Function values, library exports, the entry
+ * and class members (`%<class>.<member>`, which vtables and the runtime
+ * reach by name) keep the dyn ABI. */
+function jsvalResults(mod: IrModule): Set<string> {
+  const classPrefixes = (mod.classes ?? []).map((cls) => `%${cls.name}.`);
+  const results = new Set<string>();
+  for (const fn of mod.functions) {
+    // An async function's callers receive a promise and a generator's a
+    // generator object: only synchronous functions return their result.
+    if (!jsvalEligible(fn) || fn.async !== undefined || fn.generator !== undefined) continue;
+    if (fn.returnType.kind !== "dyn") continue;
+    if (fn.name.includes(".") && !fn.name.startsWith("%dyn.")) continue;
+    if (classPrefixes.some((prefix) => fn.name.startsWith(prefix))) continue;
+    results.add(fn.name);
+  }
+  if (results.size === 0) return results;
+  for (const name of moduleFunctionReferences(mod)) results.delete(name);
+  for (const fn of mod.functions) {
+    const dynamic = fn.tier === "dynamic";
+    everyStmtList(fn.body, {
+      expr: (e) => {
+        if (e.kind === "call" && !dynamic) results.delete(e.callee);
+        const referenced = exprFunctionReference(e);
+        if (referenced !== undefined) results.delete(referenced);
+        if (e.kind === "dynFrom" && e.fnName !== undefined) results.delete(e.fnName);
+        return true;
+      },
+      stmt: () => true,
+    });
+  }
+  return results;
+}
+
+/* ── local promotion ─────────────────────────────────────────────────── */
+
+const LOOP_WEIGHT = 8;
+const MAX_WEIGHT = 8 ** 6;
+
+interface LocalCost {
+  /** Boxing a jsval local saves: writes of operator results (and
+   * immediates), weighted by loop depth. */
+  saved: number;
+  /** Boxing it adds: reads by dyn consumers, weighted the same way. */
+  added: number;
+}
+
+/** The dyn locals of a function that become jsval locals. `producer`
+ * tells which dyn expressions the rewrite computes as jsvals. */
+function promotableLocals(
+  fn: IrFunction,
+  producer: (e: IrExpr) => boolean,
+  jsResult: boolean,
+): Set<string> {
+  const candidates = new Map<string, LocalCost>();
+  for (const local of fn.locals) {
+    if (local.type.kind === "dyn" && local.boxed === undefined && local.tdz === undefined)
+      candidates.set(local.id, { saved: 0, added: 0 });
+  }
+  for (const p of fn.params) candidates.delete(p.localId);
+  for (const c of fn.captures ?? []) candidates.delete(c.localId);
+  for (const c of fn.classCaptures ?? []) candidates.delete(c.localId);
+  if (candidates.size === 0) return new Set();
+  const blocked = new Set<string>();
+  const write = (id: string, value: IrExpr | null, weight: number): void => {
+    const cost = candidates.get(id);
+    if (cost === undefined) return;
+    if (value === null) {
+      // A declared-only dyn binding is an uninitialized trap (ir/build.ts).
+      blocked.add(id);
+      return;
+    }
+    if (producer(value) || isImmediateSource(value)) cost.saved += weight;
+  };
+  /* `js`: the expression is an operand the rewrite turns into a jsval. */
+  const expr = (e: IrExpr, js: boolean, weight: number): void => {
+    switch (e.kind) {
+      case "varRef": {
+        const cost = candidates.get(e.localId);
+        if (cost !== undefined && !js) cost.added += weight;
+        return;
+      }
+      case "assignExpr":
+        write(e.localId, e.value, weight);
+        expr(e.value, false, weight);
+        // The assignment's own value is read where it stands.
+        if (!js && candidates.has(e.localId)) candidates.get(e.localId)!.added += weight;
+        return;
+      case "libCall":
+        if (isProducerCall(e) || isConsumerCall(e)) {
+          for (const arg of e.args) expr(arg, arg.type.kind === "dyn", weight);
+          return;
+        }
+        break;
+      case "dynCheck":
+        if (e.type.kind === "f64" && e.preserveRefs === undefined) {
+          expr(e.value, true, weight);
+          return;
+        }
+        break;
+      case "toBool":
+        if (e.operand.type.kind === "dyn") {
+          expr(e.operand, true, weight);
+          return;
+        }
+        break;
+      default:
+        break;
+    }
+    blockExprReferences(e);
+    everyExprChild(
+      e,
+      (child) => {
+        expr(child, false, weight);
+        return true;
+      },
+      (s) => {
+        stmt(s, weight);
+        return true;
+      },
+    );
+  };
+  /** Locals referenced other than by reads and plain writes (increments,
+   * loop and catch bindings, rethrows, closure captures) keep dyn. */
+  const blockExprReferences = (e: IrExpr): void => {
+    if (e.kind === "incDec") blocked.add(e.localId);
+    else if (e.kind === "closure") for (const id of e.captures) blocked.add(id);
+    else if (e.kind === "classRef") for (const id of e.captures ?? []) blocked.add(id);
+  };
+  const blockStmtReferences = (s: IrStmt): void => {
+    if (s.kind === "forOf" || s.kind === "rethrow") blocked.add(s.localId);
+    else if (s.kind === "tryCatch" && s.catchLocalId !== null) blocked.add(s.catchLocalId);
+  };
+  const stmt = (s: IrStmt, weight: number): void => {
+    switch (s.kind) {
+      case "return":
+        if (s.value !== null) expr(s.value, jsResult && s.value.type.kind === "dyn", weight);
+        return;
+      case "varDecl":
+        write(s.localId, s.init, weight);
+        if (s.init !== null) expr(s.init, false, weight);
+        return;
+      case "assign":
+        if (s.initializes !== undefined) blocked.add(s.localId);
+        write(s.localId, s.value, weight);
+        expr(s.value, false, weight);
+        return;
+      case "while":
+      case "doWhile":
+      case "for":
+      case "forOf": {
+        blockStmtReferences(s);
+        const inner = Math.min(weight * LOOP_WEIGHT, MAX_WEIGHT);
+        everyStmtChild(
+          s,
+          (child) => {
+            expr(child, false, inner);
+            return true;
+          },
+          (child) => {
+            stmt(child, inner);
+            return true;
+          },
+        );
+        return;
+      }
+      default:
+        blockStmtReferences(s);
+        everyStmtChild(
+          s,
+          (child) => {
+            expr(child, false, weight);
+            return true;
+          },
+          (child) => {
+            stmt(child, weight);
+            return true;
+          },
+        );
+    }
+  };
+  for (const s of fn.body) stmt(s, 1);
+  const promoted = new Set<string>();
+  for (const [id, cost] of candidates)
+    if (!blocked.has(id) && cost.saved > cost.added) promoted.add(id);
+  return promoted;
+}
+
+/* ── the rewrite ─────────────────────────────────────────────────────── */
+
+function promoteFunction(fn: IrFunction, results: ReadonlySet<string>): boolean {
+  const resultCall = (e: IrExpr): boolean => e.kind === "call" && results.has(e.callee);
+  const operatorCall = (e: IrExpr): boolean => isProducerCall(e);
+  const promoted = promotableLocals(
+    fn,
+    (e) => operatorCall(e) || resultCall(e),
+    results.has(fn.name),
+  );
+  const ownResult = results.has(fn.name);
+  let changed = false;
+  const producesJs = (e: IrExpr): boolean =>
+    operatorCall(e) ||
+    resultCall(e) ||
+    ((e.kind === "varRef" || e.kind === "assignExpr") && promoted.has(e.localId));
+  const libCall = (fn: string, args: IrExpr[], e: IrExpr, type = JSVAL): IrExpr => ({
+    kind: "libCall",
+    fn: fn as Extract<IrExpr, { kind: "libCall" }>["fn"],
+    args,
+    type,
+    loc: e.loc,
+  });
+  /** A dyn-typed expression as a jsval. */
+  const toJs = (e: IrExpr): IrExpr => {
+    changed = true;
+    if (e.kind === "call" && results.has(e.callee))
+      return { ...e, args: e.args.map(rewrite), type: JSVAL };
+    if (e.kind === "libCall" && Object.hasOwn(PRODUCERS, e.fn)) {
+      return libCall(
+        PRODUCERS[e.fn]!,
+        e.args.map((arg) => (arg.type.kind === "dyn" ? toJs(arg) : rewrite(arg))),
+        e,
+      );
+    }
+    if (isImmediateSource(e) && e.kind === "dynFrom") {
+      const value = rewrite(e.value);
+      return libCall(STATIC_SOURCES[value.type.kind]!, [value], e);
+    }
+    if (e.kind === "varRef" && promoted.has(e.localId)) return { ...e, type: JSVAL };
+    if (e.kind === "assignExpr" && promoted.has(e.localId))
+      return { ...e, value: toJs(e.value), type: JSVAL };
+    return libCall("js.fromDyn", [rewrite(e)], e);
+  };
+  /** Any expression, in a position expecting its own type. */
+  const rewrite = (e: IrExpr): IrExpr => {
+    if (e.kind === "libCall" && Object.hasOwn(CONSUMERS, e.fn)) {
+      changed = true;
+      return libCall(
+        CONSUMERS[e.fn]!,
+        e.args.map((arg) => (arg.type.kind === "dyn" ? toJs(arg) : rewrite(arg))),
+        e,
+        e.type,
+      );
+    }
+    if (
+      e.kind === "dynCheck" &&
+      e.type.kind === "f64" &&
+      e.preserveRefs === undefined &&
+      producesJs(e.value)
+    )
+      return libCall("js.toF64", [toJs(e.value)], e, e.type);
+    if (e.kind === "toBool" && e.operand.type.kind === "dyn" && producesJs(e.operand))
+      return { ...e, operand: toJs(e.operand) };
+    if (e.type.kind === "dyn" && producesJs(e)) return libCall("js.toDyn", [toJs(e)], e, DYN);
+    return mapExprChildren(e, rewrite, rewriteStmt);
+  };
+  const rewriteStmt = (s: IrStmt): IrStmt => {
+    if (s.kind === "return" && ownResult && s.value !== null) return { ...s, value: toJs(s.value) };
+    // A discarded result stays a jsval: nothing boxes it.
+    if (s.kind === "exprStmt" && producesJs(s.expr)) return { ...s, expr: toJs(s.expr) };
+    if (s.kind === "varDecl" && promoted.has(s.localId) && s.init !== null)
+      return { ...s, init: toJs(s.init) };
+    if (s.kind === "assign" && promoted.has(s.localId)) return { ...s, value: toJs(s.value) };
+    return mapStmtChildren(s, rewrite, rewriteStmt);
+  };
+  const body = fn.body.map(rewriteStmt);
+  if (!changed) return false;
+  fn.body = body;
+  for (const local of fn.locals) if (promoted.has(local.id)) local.type = JSVAL;
+  return true;
+}
diff --git a/packages/compiler/src/ir/runtime-features.ts b/packages/compiler/src/ir/runtime-features.ts
index 5fcb66055..9abe15345 100644
--- a/packages/compiler/src/ir/runtime-features.ts
+++ b/packages/compiler/src/ir/runtime-features.ts
@@ -9,48 +9,6 @@ import {
 } from "./ir.js";
 import { everyModuleNode } from "./traverse.js";
 
-export interface RuntimeFeatures {
-  regex: boolean;
-  copying: boolean;
-  legacyTextDecoder: boolean;
-  fileHandle: boolean;
-  fetch: boolean;
-  eventTarget: boolean;
-  processEvents: boolean;
-  emitter: boolean;
-  stream: boolean;
-  zlib: boolean;
-  dc: boolean;
-  assert: boolean;
-  dynInvoke: boolean;
-  dynAsync: boolean;
-  /** The program enters AsyncLocalStorage stores (store.run, enterWith,
-   * a diagnostics_channel store binding) or reads the test runner's
-   * context (getTestContext): its timer, immediate, tick and
-   * queueMicrotask scheduling goes through the runtime's *_als entry
-   * points, which carry the active stores into each callback. */
-  asyncContext: boolean;
-  inspect: boolean;
-  childProcess: boolean;
-  net: boolean;
-  symbol: boolean;
-  bigint: boolean;
-  searchParams: boolean;
-  qs: boolean;
-  parseArgs: boolean;
-  fsWatch: boolean;
-  nodeTest: boolean;
-  /** The program calls mock.timers members: its timer calls go through
-   * scr_test.c's mock-aware entry points. */
-  mockTimers: boolean;
-  dgram: boolean;
-  http: boolean;
-  http2: boolean;
-  tls: boolean;
-  tlsCa: boolean;
-  cipher: boolean;
-}
-
 const DYN_ASYNC_LIB_FNS: ReadonlySet<IrLibFn> = new Set([
   // DEP0040 rides the dyn-async unit's warning machinery.
   "punycode.warn",
@@ -75,6 +33,7 @@ const DYN_ASYNC_LIB_FNS: ReadonlySet<IrLibFn> = new Set([
   "process.emitWarningText",
   "process.deprecationFlag",
   "process.setDeprecationFlag",
+  "process.setEmitWarning",
   // The performance timeline (scr_perf.c, linked with this unit for its
   // MaxPerformanceEntryBufferExceededWarning).
   "perf.mark",
@@ -301,9 +260,6 @@ const COPYING_BYTES_METHODS: ReadonlySet<string> = new Set([
   "with",
 ]);
 
-const startsWithAny = (fn: string, prefixes: readonly string[]): boolean =>
-  prefixes.some((prefix) => fn.startsWith(prefix));
-
 /** Inspect types and expressions together in one traversal. This is a fresh
  * snapshot: callers may mutate an IR module between compilation passes. */
 /** The checked-dynamic undefined value (dynUndefinedExpr). */
@@ -352,300 +308,37 @@ function boxesPromise(t: IrType, tables: TypeTables, seen: Set<string>): boolean
     }
     case "object": {
       // A boxed class instance exposes its fields as dyn values (Object.keys,
-      // spread, inspection), boxing a promise any field holds.
+      // spread, inspection), boxing a promise any field holds. It
+      // materializes inherited fields too, and the instance can be any
+      // subclass.
       const key = `class:${t.className}`;
       if (seen.has(key)) return false;
       seen.add(key);
-      const def = tables.classes.get(t.className);
-      return def?.fields.some((f) => boxesPromise(f.type, tables, seen)) ?? false;
+      const related = (def: IrClassDef): boolean => {
+        for (
+          let c: IrClassDef | undefined = def;
+          c;
+          c = c.base ? tables.classes.get(c.base) : undefined
+        )
+          if (c.name === t.className) return true;
+        return false;
+      };
+      for (const def of tables.classes.values()) {
+        if (!related(def)) continue;
+        for (
+          let c: IrClassDef | undefined = def;
+          c;
+          c = c.base ? tables.classes.get(c.base) : undefined
+        )
+          if (c.fields.some((f) => boxesPromise(f.type, tables, seen))) return true;
+      }
+      return false;
     }
     default:
       return false;
   }
 }
 
-function scanRuntimeFeatures(mod: IrModule, stopAt?: keyof RuntimeFeatures): RuntimeFeatures {
-  const features: RuntimeFeatures = {
-    regex: false,
-    copying: false,
-    legacyTextDecoder: false,
-    fileHandle: false,
-    fetch: false,
-    // Subclasses of the runtime EventTarget/Event bases tear down and box
-    // through the EventTarget unit even when no event.* libCall survives.
-    eventTarget: (mod.classes ?? []).some(
-      (c) => c.name === RUNTIME_EVENT_TARGET_CLASS || c.name === RUNTIME_EVENT_CLASS,
-    ),
-    processEvents: false,
-    emitter:
-      mod.workers === true || (mod.classes ?? []).some((c) => c.name === RUNTIME_EMITTER_CLASS),
-    stream: (mod.classes ?? []).some((c) => RUNTIME_STREAM_CLASSES.has(c.name)),
-    zlib: false,
-    dc: false,
-    assert: false,
-    dynInvoke: mod.workers === true,
-    dynAsync:
-      mod.workers === true ||
-      mod.functions.some(
-        (fn) => fn.async === true && fn.generator === undefined && fn.returnType.kind === "dyn",
-      ),
-    asyncContext: false,
-    inspect: false,
-    childProcess: false,
-    net: false,
-    // A Dirent row converted to dyn carries Node's Symbol(type) key
-    // (scr_dyn_dirent_finish, defined in scr_symbol.c).
-    symbol: (mod.records ?? []).some(isDirentShape),
-    bigint: false,
-    searchParams: false,
-    qs: false,
-    parseArgs: false,
-    fsWatch: false,
-    nodeTest: false,
-    mockTimers: false,
-    dgram: false,
-    http: false,
-    http2: false,
-    tls: false,
-    tlsCa: false,
-    cipher: false,
-  };
-  const keepGoing = (): boolean => stopAt === undefined || !features[stopAt];
-  let tables: TypeTables | undefined;
-  const typeTables = (): TypeTables =>
-    (tables ??= {
-      records: new Map((mod.records ?? []).map((r) => [r.id, r])),
-      unions: new Map((mod.unions ?? []).map((u) => [u.id, u])),
-      classes: new Map((mod.classes ?? []).map((c) => [c.name, c])),
-    });
-  const expr = (node: IrExpr): boolean => {
-    if (node.kind === "libCall") {
-      const fn = node.fn;
-      if (REGEX_LIB_FNS.has(fn)) features.regex = true;
-      if (LEGACY_TEXT_DECODER_LIB_FNS.has(fn)) features.legacyTextDecoder = true;
-      if (fn.startsWith("fetch.")) features.fetch = true;
-      if (fn.startsWith("event.") || fn === "events.addAbortListener") features.eventTarget = true;
-      if (ABORT_SIGNAL_LIB_FNS.has(fn)) features.eventTarget = true;
-      if (PROCESS_EVENT_LIB_FNS.has(fn)) features.processEvents = true;
-      // With a completer, readline's terminal unit prints completion errors
-      // through the inspect unit.
-      if (fn === "rl.terminal") {
-        features.regex = true;
-        if (!isDynUndefined(node.args[3]!)) features.inspect = true;
-      }
-      if (fn.startsWith("emitter.")) features.emitter = true;
-      if (STREAM_LIB_FNS.has(fn) || startsWithAny(fn, STREAM_LIB_PREFIXES)) {
-        // the stream unit emits through the emitter unit, also when the
-        // program constructs no stream (a pipeline of functions)
-        features.stream = true;
-        features.emitter = true;
-      }
-      if (fn.startsWith("zlib.")) features.zlib = true;
-      if (READABLE_DYN_ASYNC_LIB_FNS.has(fn) || startsWithAny(fn, READABLE_DYN_ASYNC_PREFIXES))
-        features.dynAsync = true;
-      if (fn.startsWith("dc.")) features.dc = true;
-      if (fn.startsWith("assert.")) features.assert = true;
-      if (DYN_INVOKE_LIB_FNS.has(fn)) features.dynInvoke = true;
-      if (DYN_ASYNC_LIB_FNS.has(fn)) features.dynAsync = true;
-      if (ASYNC_CONTEXT_LIB_FNS.has(fn)) features.asyncContext = true;
-      if (
-        fn.startsWith("insp.") ||
-        fn.startsWith("console.") ||
-        fn === "global.native" ||
-        fn === "util.styleText"
-      )
-        features.inspect = true;
-      if (CHILD_PROCESS_LIB_FNS.has(fn) || startsWithAny(fn, CHILD_PROCESS_LIB_PREFIXES))
-        features.childProcess = true;
-      if (fn.startsWith("net.")) features.net = true;
-      if (fn.startsWith("http.")) {
-        features.net = true;
-        features.http = true;
-      }
-      if (fn.startsWith("tls.") || fn.startsWith("https.") || fn.startsWith("http2.")) {
-        features.net = true;
-        features.http = true;
-        features.tls = true;
-      }
-      if (fn.startsWith("http2.") && !HTTP2_LEGACY_FNS.has(fn)) features.http2 = true;
-      if (fn.startsWith("sym.") || fn.startsWith("disposable.") || SYMBOL_LIB_FNS.has(fn))
-        features.symbol = true;
-      if (fn === "process.hrtimeValue") features.bigint = true;
-      if (fn.startsWith("bigint.")) features.bigint = true;
-      if (fn.startsWith("sp.") || fn === "url.searchParams") features.searchParams = true;
-      if (QS_LIB_FNS.has(fn)) features.qs = true;
-      // scr_url_legacy.c lowercases and normalizes hostnames (the regex
-      // unit's libunicode), parses and stringifies queries, and emits its
-      // deprecation warnings through the dyn-async unit.
-      if (LEGACY_URL_LIB_FNS.has(fn)) {
-        features.regex = true;
-        features.qs = true;
-        features.dynAsync = true;
-      }
-      if (PARSE_ARGS_LIB_FNS.has(fn)) features.parseArgs = true;
-      if (fn === "util.styleText") features.processEvents = true;
-      // scr_util_callable.c: dyn wrappers over the descriptor, inspect,
-      // regex (NODE_DEBUG matching) and terminal-color units.
-      if (UTIL_CALLABLE_LIB_FNS.has(fn)) {
-        features.parseArgs = true;
-        features.inspect = true;
-        features.dynInvoke = true;
-        features.regex = true;
-      }
-      if (fn.startsWith("fs.watch") || fn.startsWith("watcher.")) features.fsWatch = true;
-      // scr_test.c renders thrown strings in the failing-tests section with
-      // the inspect unit's string formatting.
-      if (fn.startsWith("test.")) {
-        features.nodeTest = true;
-        features.inspect = true;
-        if (fn.startsWith("test.mockTimers") || fn.startsWith("test.ctxMockTimers")) {
-          features.mockTimers = true;
-        }
-      }
-      if (fn.startsWith("dgram.") || fn.startsWith("dns.")) features.dgram = true;
-      if (fn.startsWith("tlsca.")) features.tlsCa = true;
-      // scr_cipher.c over the mbedTLS archive; DEP0182 reports through the
-      // process-warning unit, and unknown output encodings render through
-      // the inspect unit.
-      if (fn === "crypto.cipherNew") {
-        features.cipher = true;
-        features.dynAsync = true;
-        features.inspect = true;
-      }
-    } else {
-      switch (node.kind) {
-        case "regexLit":
-        case "regexIntrinsic":
-          features.regex = true;
-          break;
-        case "strIntrinsic":
-          if (CASE_MAPPING_STR_METHODS.has(node.method)) features.regex = true;
-          break;
-        case "arrIntrinsic":
-          if (COPYING_ARR_METHODS.has(node.method)) features.copying = true;
-          break;
-        case "bytesIntrinsic":
-          if (COPYING_BYTES_METHODS.has(node.method)) features.copying = true;
-          break;
-        case "dynInvoke":
-          features.dynInvoke = true;
-          break;
-        case "awaitExpr":
-          if (node.type.kind === "dyn") features.dynAsync = true;
-          break;
-        case "intrinsic":
-          // Rejection reasons cross as dyn values (allSettled's records,
-          // any's AggregateError list).
-          if (node.name === "promise.allSettled" || node.name === "promise.any")
-            features.dynAsync = true;
-          break;
-        case "dynFrom":
-          if (!features.dynAsync && boxesPromise(node.value.type, typeTables(), new Set()))
-            features.dynAsync = true;
-          break;
-      }
-    }
-    return keepGoing();
-  };
-  const type = (node: IrType): boolean => {
-    switch (node.kind) {
-      case "regex":
-        features.regex = true;
-        break;
-      case "fileHandle":
-        features.fileHandle = true;
-        break;
-      case "procStream":
-        features.processEvents = true;
-        break;
-      case "child":
-      case "childStream":
-      case "childWriter":
-      case "spawnRes":
-        features.childProcess = true;
-        break;
-      case "netServer":
-      case "netSocket":
-        features.net = true;
-        break;
-      case "http2Session":
-      case "http2Stream":
-        features.net = true;
-        features.http2 = true;
-        break;
-      case "httpReq":
-      case "httpRes":
-      case "httpClientReq":
-        features.net = true;
-        features.http = true;
-        break;
-      case "secureCtx":
-        features.net = true;
-        features.http = true;
-        features.tls = true;
-        break;
-      case "symbol":
-        features.symbol = true;
-        break;
-      case "bigint":
-        features.bigint = true;
-        break;
-      case "searchParams":
-        features.searchParams = true;
-        break;
-      case "fsWatcher":
-        features.fsWatch = true;
-        break;
-      case "testCtx":
-        features.nodeTest = true;
-        break;
-      case "dgramSocket":
-        features.dgram = true;
-        break;
-    }
-    return keepGoing();
-  };
-  if (keepGoing()) everyModuleNode(mod, { expr, stmt: keepGoing, type });
-  return features;
-}
-
-/** True when the module contains any regex construct — a regexLit /
- * regexIntrinsic node or a regex-typed slot anywhere. This is the link
- * switch that pulls scr_regex.c + the vendored libregexp into the binary
- * (native-toolchain.ts); regex-free programs keep the historical command line. The
- * typed traversal visits type slots as well as executable nodes. */
-export function moduleUsesRegex(mod: IrModule): boolean {
-  return scanRuntimeFeatures(mod, "regex").regex;
-}
-
-/** True when the module contains an intrinsic whose implementation lives
- * in scr_copying.c. This is the link switch that keeps the optional
- * Array-copying and typed-array bridge TU out of unrelated binaries. */
-export function moduleUsesCopying(mod: IrModule): boolean {
-  return scanRuntimeFeatures(mod, "copying").copying;
-}
-
-/** True when a non-UTF-8 TextDecoder call survives lowering. This gates the
- * generated legacy mapping tables inside scr_bytes.c; the default UTF-8
- * decoder and unrelated Buffer users keep their prior runtime object. */
-export function moduleUsesLegacyTextDecoder(mod: IrModule): boolean {
-  return scanRuntimeFeatures(mod, "legacyTextDecoder").legacyTextDecoder;
-}
-
-/** True when a FileHandle type survives in the module. This is the link
- * switch for scr_file_handle.c; fs/promises.open carries the type inside its
- * promise result even when no handle method is called. */
-export function moduleUsesFileHandle(mod: IrModule): boolean {
-  return scanRuntimeFeatures(mod, "fileHandle").fileHandle;
-}
-
-/** True when native fetch operations survive lowering. This links
- * scr_fetch.c and its socket/tls/zlib dependencies and makes the emitted
- * main call scr_fetch_install. Fetch-free graphs keep their link lines. */
-export function moduleUsesFetch(mod: IrModule): boolean {
-  return scanRuntimeFeatures(mod, "fetch").fetch;
-}
-
 /** The libCall fns served by the OPTIONAL events unit (scr_events.c):
  * process signal/exit listeners and the piped-stdin surface. */
 const PROCESS_EVENT_LIB_FNS: ReadonlySet<IrLibFn> = new Set([
@@ -709,6 +402,370 @@ const PROCESS_EVENT_LIB_FNS: ReadonlySet<IrLibFn> = new Set([
   "rl.uiCommit",
 ]);
 
+/** The legacy http2.* libCalls implemented by scr_http.c/scr_tls.c (the
+ * allowHTTP1 compatibility slice) — they must NOT pull scr_http2.c, so
+ * divergence-57 binaries keep their exact link line. */
+const HTTP2_LEGACY_FNS: ReadonlySet<IrLibFn> = new Set([
+  "http2.streamNoop",
+  "http2.streamUndefCall",
+]);
+
+/** Names that reach the extended process-stream surface (the
+ * SCR_STDIO_EXTENDED events unit): stdin.setEncoding and 'resize'. */
+const STDIO_EXTENDED_NAMES: ReadonlySet<string> = new Set(["setEncoding", "resize"]);
+
+/** The libCall nodes the rules below test. */
+type LibCallNode = IrExpr & { kind: "libCall" };
+
+/** What makes a program need one optional runtime unit. The feature is set
+ * when any condition holds: `initial` from the module's declarations, a
+ * libCall named in `fns` or starting with one of `prefixes`, a libCall
+ * `libCall` accepts, another expression node `expr` accepts, or a type
+ * slot of one of the `types` kinds. A libCall or type that needs several
+ * units appears in each unit's rule. */
+interface RuntimeFeatureRule {
+  initial?: (mod: IrModule) => boolean;
+  fns?: readonly IrLibFn[];
+  prefixes?: readonly string[];
+  libCall?: (node: LibCallNode) => boolean;
+  expr?: (node: IrExpr, tables: () => TypeTables) => boolean;
+  types?: readonly IrType["kind"][];
+}
+
+/** Gives every rule in the table one type. */
+const rule = (r: RuntimeFeatureRule): RuntimeFeatureRule => r;
+
+/* The HTTP, HTTPS, HTTP/2 and TLS surfaces, which link the net unit. */
+const NET_PREFIXES: readonly string[] = ["net.", "http.", "tls.", "https.", "http2."];
+
+/** One rule per runtime feature, sorted by name. A new feature is an
+ * entry here and its line in noRuntimeFeatures; RuntimeFeatures, the scan
+ * and its early exit derive from this table. */
+const RUNTIME_FEATURE_RULES = {
+  assert: rule({ prefixes: ["assert."] }),
+  /** The program enters AsyncLocalStorage stores (store.run, enterWith,
+   * a diagnostics_channel store binding) or reads the test runner's
+   * context (getTestContext): its timer, immediate, tick and
+   * queueMicrotask scheduling goes through the runtime's *_als entry
+   * points, which carry the active stores into each callback. */
+  asyncContext: rule({ fns: [...ASYNC_CONTEXT_LIB_FNS] }),
+  bigint: rule({ fns: ["process.hrtimeValue"], prefixes: ["bigint."], types: ["bigint"] }),
+  childProcess: rule({
+    fns: [...CHILD_PROCESS_LIB_FNS],
+    prefixes: CHILD_PROCESS_LIB_PREFIXES,
+    types: ["child", "childStream", "childWriter", "spawnRes"],
+  }),
+  /** scr_cipher.c over the mbedTLS archive; DEP0182 reports through the
+   * process-warning unit, and unknown output encodings render through the
+   * inspect unit. */
+  cipher: rule({ fns: ["crypto.cipherNew"] }),
+  copying: rule({
+    expr: (node, _tables) =>
+      (node.kind === "arrIntrinsic" && COPYING_ARR_METHODS.has(node.method)) ||
+      (node.kind === "bytesIntrinsic" && COPYING_BYTES_METHODS.has(node.method)),
+  }),
+  dc: rule({ prefixes: ["dc."] }),
+  /** dns.lookup lives in the dgram unit. */
+  dgram: rule({ prefixes: ["dgram.", "dns."], types: ["dgramSocket"] }),
+  dynAsync: rule({
+    initial: (mod) =>
+      mod.workers === true ||
+      mod.functions.some(
+        (fn) => fn.async === true && fn.generator === undefined && fn.returnType.kind === "dyn",
+      ),
+    // The legacy url functions and crypto.createCipheriv emit their
+    // deprecation warnings through the dyn-async unit.
+    fns: [
+      ...DYN_ASYNC_LIB_FNS,
+      ...READABLE_DYN_ASYNC_LIB_FNS,
+      ...LEGACY_URL_LIB_FNS,
+      "crypto.cipherNew",
+    ],
+    prefixes: READABLE_DYN_ASYNC_PREFIXES,
+    expr: (node, tables) =>
+      (node.kind === "awaitExpr" && node.type.kind === "dyn") ||
+      // Rejection reasons cross as dyn values (allSettled's records, any's
+      // AggregateError list).
+      (node.kind === "intrinsic" &&
+        (node.name === "promise.allSettled" || node.name === "promise.any")) ||
+      (node.kind === "dynFrom" && boxesPromise(node.value.type, tables(), new Set())),
+  }),
+  dynInvoke: rule({
+    initial: (mod) => mod.workers === true,
+    fns: [...DYN_INVOKE_LIB_FNS, ...UTIL_CALLABLE_LIB_FNS],
+    expr: (node, _tables) => node.kind === "dynInvoke",
+  }),
+  /** The program has dynamic-tier jsval operations (js.* builtins, the
+   * jsval pass): links the scr_js_* units (two-tier design I3). */
+  dynTier: rule({ prefixes: ["js."] }),
+  /** The stream unit emits through the emitter unit, also when the
+   * program constructs no stream (a pipeline of functions). */
+  emitter: rule({
+    initial: (mod) =>
+      mod.workers === true || (mod.classes ?? []).some((c) => c.name === RUNTIME_EMITTER_CLASS),
+    fns: [...STREAM_LIB_FNS],
+    prefixes: ["emitter.", ...STREAM_LIB_PREFIXES],
+  }),
+  /** Subclasses of the runtime EventTarget/Event bases tear down and box
+   * through the EventTarget unit even when no event.* libCall survives. */
+  eventTarget: rule({
+    initial: (mod) =>
+      (mod.classes ?? []).some(
+        (c) => c.name === RUNTIME_EVENT_TARGET_CLASS || c.name === RUNTIME_EVENT_CLASS,
+      ),
+    fns: ["events.addAbortListener", ...ABORT_SIGNAL_LIB_FNS],
+    prefixes: ["event."],
+  }),
+  fetch: rule({ prefixes: ["fetch."] }),
+  fileHandle: rule({ types: ["fileHandle"] }),
+  fsWatch: rule({ prefixes: ["fs.watch", "watcher."], types: ["fsWatcher"] }),
+  http: rule({
+    prefixes: ["http.", "tls.", "https.", "http2."],
+    types: ["httpReq", "httpRes", "httpClientReq", "secureCtx"],
+  }),
+  /** The real h2 surface (scr_http2.c); the legacy http2.* libCalls of the
+   * allowHTTP1 slice are served by scr_http.c and scr_tls.c. */
+  http2: rule({
+    libCall: (node) => node.fn.startsWith("http2.") && !HTTP2_LEGACY_FNS.has(node.fn),
+    types: ["http2Session", "http2Stream"],
+  }),
+  /** scr_test.c renders thrown strings with the inspect unit's string
+   * formatting; scr_util_callable.c wraps the inspect unit; readline's
+   * terminal unit prints completion errors through it when there is a
+   * completer. */
+  inspect: rule({
+    fns: ["global.native", "util.styleText", "crypto.cipherNew", ...UTIL_CALLABLE_LIB_FNS],
+    prefixes: ["insp.", "console.", "test."],
+    libCall: (node) => node.fn === "rl.terminal" && !isDynUndefined(node.args[3]!),
+  }),
+  legacyTextDecoder: rule({ fns: [...LEGACY_TEXT_DECODER_LIB_FNS] }),
+  /** The program calls mock.timers members: its timer calls go through
+   * scr_test.c's mock-aware entry points. */
+  mockTimers: rule({ prefixes: ["test.mockTimers", "test.ctxMockTimers"] }),
+  net: rule({
+    prefixes: NET_PREFIXES,
+    types: [
+      "netServer",
+      "netSocket",
+      "http2Session",
+      "http2Stream",
+      "httpReq",
+      "httpRes",
+      "httpClientReq",
+      "secureCtx",
+    ],
+  }),
+  nodeTest: rule({ prefixes: ["test."], types: ["testCtx"] }),
+  /** scr_util_callable.c reads options through the parseArgs unit's
+   * descriptors. */
+  parseArgs: rule({ fns: [...PARSE_ARGS_LIB_FNS, ...UTIL_CALLABLE_LIB_FNS] }),
+  processEvents: rule({ fns: [...PROCESS_EVENT_LIB_FNS, "util.styleText"], types: ["procStream"] }),
+  /** scr_url_legacy.c parses and stringifies queries. */
+  qs: rule({ fns: [...QS_LIB_FNS, ...LEGACY_URL_LIB_FNS] }),
+  /** scr_url_legacy.c lowercases and normalizes hostnames with the regex
+   * unit's libunicode, NODE_DEBUG matching in scr_util_callable.c and
+   * readline's terminal unit use the regex unit, and locale case mapping
+   * runs its default conversion. */
+  regex: rule({
+    fns: [
+      ...REGEX_LIB_FNS,
+      ...LEGACY_URL_LIB_FNS,
+      ...UTIL_CALLABLE_LIB_FNS,
+      "rl.terminal",
+      "str.localeCase",
+    ],
+    expr: (node, _tables) =>
+      node.kind === "regexLit" ||
+      node.kind === "regexIntrinsic" ||
+      (node.kind === "strIntrinsic" && CASE_MAPPING_STR_METHODS.has(node.method)),
+    types: ["regex"],
+  }),
+  searchParams: rule({ fns: ["url.searchParams"], prefixes: ["sp."], types: ["searchParams"] }),
+  /** stdin setEncoding / string data listeners / stdio 'resize' events. A
+   * typed string 'data' listener takes setEncoding-decoded chunks; the
+   * process stream object's setEncoding and 'resize' members are reached
+   * by name (dynamic member calls and event-name strings). */
+  stdioExtended: rule({
+    libCall: (node) =>
+      node.fn === "stdin.onData" &&
+      node.args[0]?.type.kind === "func" &&
+      node.args[0].type.params[0]?.kind === "string",
+    expr: (node, _tables) =>
+      (node.kind === "dynInvoke" && STDIO_EXTENDED_NAMES.has(node.method)) ||
+      (node.kind === "strLit" && STDIO_EXTENDED_NAMES.has(node.value)),
+  }),
+  stream: rule({
+    initial: (mod) => (mod.classes ?? []).some((c) => RUNTIME_STREAM_CLASSES.has(c.name)),
+    fns: [...STREAM_LIB_FNS],
+    prefixes: STREAM_LIB_PREFIXES,
+  }),
+  /** A Dirent row converted to dyn carries Node's Symbol(type) key
+   * (scr_dyn_dirent_finish, defined in scr_symbol.c). */
+  symbol: rule({
+    initial: (mod) => (mod.records ?? []).some(isDirentShape),
+    fns: [...SYMBOL_LIB_FNS],
+    prefixes: ["sym.", "disposable."],
+    types: ["symbol"],
+  }),
+  tls: rule({ prefixes: ["tls.", "https.", "http2."], types: ["secureCtx"] }),
+  tlsCa: rule({ prefixes: ["tlsca."] }),
+  /** process.emitWarning is assigned (process.setEmitWarning). */
+  warningReplace: rule({ fns: ["process.setEmitWarning"] }),
+  /** crypto.subtle importKey/sign/verify/digest and CryptoKey:
+   * scr_webcrypto.c. */
+  webcrypto: rule({ prefixes: ["webcrypto."] }),
+  zlib: rule({ prefixes: ["zlib."] }),
+};
+
+type RuntimeFeatureName = keyof typeof RUNTIME_FEATURE_RULES;
+
+export type RuntimeFeatures = Record<RuntimeFeatureName, boolean>;
+
+const RUNTIME_FEATURE_NAMES: RuntimeFeatureName[] = [];
+for (const name in RUNTIME_FEATURE_RULES) RUNTIME_FEATURE_NAMES.push(name as RuntimeFeatureName);
+
+/** Every feature off, in the table's order. TypeScript rejects this
+ * literal when it misses a feature or names one without a rule. */
+function noRuntimeFeatures(): RuntimeFeatures {
+  return {
+    assert: false,
+    asyncContext: false,
+    bigint: false,
+    childProcess: false,
+    cipher: false,
+    copying: false,
+    dc: false,
+    dgram: false,
+    dynAsync: false,
+    dynInvoke: false,
+    dynTier: false,
+    emitter: false,
+    eventTarget: false,
+    fetch: false,
+    fileHandle: false,
+    fsWatch: false,
+    http: false,
+    http2: false,
+    inspect: false,
+    legacyTextDecoder: false,
+    mockTimers: false,
+    net: false,
+    nodeTest: false,
+    parseArgs: false,
+    processEvents: false,
+    qs: false,
+    regex: false,
+    searchParams: false,
+    stdioExtended: false,
+    stream: false,
+    symbol: false,
+    tls: false,
+    tlsCa: false,
+    warningReplace: false,
+    webcrypto: false,
+    zlib: false,
+  };
+}
+
+const ruleOf = (name: RuntimeFeatureName): RuntimeFeatureRule => RUNTIME_FEATURE_RULES[name];
+
+/** The rules indexed for the scan: features by libCall name and by type
+ * kind, and the prefix and predicate conditions in rule order. */
+const FEATURES_BY_FN = new Map<string, RuntimeFeatureName[]>();
+const FEATURES_BY_TYPE = new Map<string, RuntimeFeatureName[]>();
+const FEATURE_PREFIXES: { prefix: string; name: RuntimeFeatureName }[] = [];
+const FEATURE_LIBCALL_TESTS: RuntimeFeatureName[] = [];
+const FEATURE_EXPR_TESTS: RuntimeFeatureName[] = [];
+for (const name of RUNTIME_FEATURE_NAMES) {
+  const rule = ruleOf(name);
+  for (const fn of rule.fns ?? []) {
+    const names = FEATURES_BY_FN.get(fn);
+    if (names) names.push(name);
+    else FEATURES_BY_FN.set(fn, [name]);
+  }
+  for (const kind of rule.types ?? []) {
+    const names = FEATURES_BY_TYPE.get(kind);
+    if (names) names.push(name);
+    else FEATURES_BY_TYPE.set(kind, [name]);
+  }
+  for (const prefix of rule.prefixes ?? []) FEATURE_PREFIXES.push({ prefix, name });
+  if (rule.libCall) FEATURE_LIBCALL_TESTS.push(name);
+  if (rule.expr) FEATURE_EXPR_TESTS.push(name);
+}
+
+function scanRuntimeFeatures(mod: IrModule, stopAt?: RuntimeFeatureName): RuntimeFeatures {
+  const features = noRuntimeFeatures();
+  for (const name of RUNTIME_FEATURE_NAMES) {
+    const initial = ruleOf(name).initial;
+    if (initial && initial(mod)) features[name] = true;
+  }
+  const keepGoing = (): boolean => stopAt === undefined || !features[stopAt];
+  let tables: TypeTables | undefined;
+  const typeTables = (): TypeTables =>
+    (tables ??= {
+      records: new Map((mod.records ?? []).map((r) => [r.id, r])),
+      unions: new Map((mod.unions ?? []).map((u) => [u.id, u])),
+      classes: new Map((mod.classes ?? []).map((c) => [c.name, c])),
+    });
+  const expr = (node: IrExpr): boolean => {
+    if (node.kind === "libCall") {
+      const fn = node.fn;
+      for (const name of FEATURES_BY_FN.get(fn) ?? []) features[name] = true;
+      for (const { prefix, name } of FEATURE_PREFIXES)
+        if (!features[name] && fn.startsWith(prefix)) features[name] = true;
+      for (const name of FEATURE_LIBCALL_TESTS)
+        if (!features[name] && ruleOf(name).libCall!(node)) features[name] = true;
+    } else {
+      for (const name of FEATURE_EXPR_TESTS)
+        if (!features[name] && ruleOf(name).expr!(node, typeTables)) features[name] = true;
+    }
+    return keepGoing();
+  };
+  const type = (node: IrType): boolean => {
+    for (const name of FEATURES_BY_TYPE.get(node.kind) ?? []) features[name] = true;
+    return keepGoing();
+  };
+  if (keepGoing()) everyModuleNode(mod, { expr, stmt: keepGoing, type });
+  return features;
+}
+
+/** True when the module contains any regex construct — a regexLit /
+ * regexIntrinsic node or a regex-typed slot anywhere. This is the link
+ * switch that pulls scr_regex.c + the vendored libregexp into the binary
+ * (native-toolchain.ts); regex-free programs keep the historical command line. The
+ * typed traversal visits type slots as well as executable nodes. */
+export function moduleUsesRegex(mod: IrModule): boolean {
+  return scanRuntimeFeatures(mod, "regex").regex;
+}
+
+/** True when the module contains an intrinsic whose implementation lives
+ * in scr_copying.c. This is the link switch that keeps the optional
+ * Array-copying and typed-array bridge TU out of unrelated binaries. */
+export function moduleUsesCopying(mod: IrModule): boolean {
+  return scanRuntimeFeatures(mod, "copying").copying;
+}
+
+/** True when a non-UTF-8 TextDecoder call survives lowering. This gates the
+ * generated legacy mapping tables inside scr_bytes.c; the default UTF-8
+ * decoder and unrelated Buffer users keep their prior runtime object. */
+export function moduleUsesLegacyTextDecoder(mod: IrModule): boolean {
+  return scanRuntimeFeatures(mod, "legacyTextDecoder").legacyTextDecoder;
+}
+
+/** True when a FileHandle type survives in the module. This is the link
+ * switch for scr_file_handle.c; fs/promises.open carries the type inside its
+ * promise result even when no handle method is called. */
+export function moduleUsesFileHandle(mod: IrModule): boolean {
+  return scanRuntimeFeatures(mod, "fileHandle").fileHandle;
+}
+
+/** True when native fetch operations survive lowering. This links
+ * scr_fetch.c and its socket/tls/zlib dependencies and makes the emitted
+ * main call scr_fetch_install. Fetch-free graphs keep their link lines. */
+export function moduleUsesFetch(mod: IrModule): boolean {
+  return scanRuntimeFeatures(mod, "fetch").fetch;
+}
+
 /** True when the module uses the process-events surface — the link switch
  * that pulls scr_events.c into the binary and has the emitted main call
  * scr_events_install (native-toolchain.ts + emitter; the scr_regex/scr_fetch/scr_zlib
@@ -898,14 +955,6 @@ export function moduleUsesHttpServer(mod: IrModule): boolean {
   return scanRuntimeFeatures(mod, "http").http;
 }
 
-/** The legacy http2.* libCalls implemented by scr_http.c/scr_tls.c (the
- * allowHTTP1 compatibility slice) — they must NOT pull scr_http2.c, so
- * divergence-57 binaries keep their exact link line. */
-const HTTP2_LEGACY_FNS: ReadonlySet<IrLibFn> = new Set([
-  "http2.streamNoop",
-  "http2.streamUndefCall",
-]);
-
 /** True when the module uses the REAL h2 surface (scr_http2.c): any core
  * http2.* libCall, or an h2 handle type left behind by a fenced statement
  * (its emitted release call needs the unit — the moduleUsesNet story). */
@@ -932,3 +981,10 @@ export function moduleUsesTls(mod: IrModule): boolean {
 export function moduleUsesTlsCa(mod: IrModule): boolean {
   return scanRuntimeFeatures(mod, "tlsCa").tlsCa;
 }
+
+/** True when the module has dynamic-tier jsval operations: the link switch
+ * for the scr_js_* runtime units (two-tier design I3). Programs without
+ * them never link a scr_js_ symbol. */
+export function moduleUsesDynTier(mod: IrModule): boolean {
+  return scanRuntimeFeatures(mod, "dynTier").dynTier;
+}
diff --git a/packages/compiler/src/ir/scalar-records.test.ts b/packages/compiler/src/ir/scalar-records.test.ts
index 551e7567a..e3132088d 100644
--- a/packages/compiler/src/ir/scalar-records.test.ts
+++ b/packages/compiler/src/ir/scalar-records.test.ts
@@ -40,7 +40,7 @@ const read = (localId: string, field = "a"): IrExpr => ({
 
 function fixture(): IrModule {
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     records: [
diff --git a/packages/compiler/src/ir/serialize.ts b/packages/compiler/src/ir/serialize.ts
index 1d0e5364e..ca5eb955e 100644
--- a/packages/compiler/src/ir/serialize.ts
+++ b/packages/compiler/src/ir/serialize.ts
@@ -7,11 +7,10 @@
  * text parts and decoded from bytes one function at a time; neither direction
  * materializes the complete document as a single string. */
 import type { IrExpr, IrFunction, IrModule, IrStmt } from "./ir.js";
-import { deriveModuleTiers } from "./tiers.js";
 
-// Version 16 removes embedded-engine types, operations, and module metadata.
-// Older modules can require runtime support that no longer exists.
-export const IR_VERSION = 16 as const;
+// Version 17 adds the dynamic tier's jsval type and js.* builtins (two-tier
+// design stage S3) and serializes each function's execution tier.
+export const IR_VERSION = 17 as const;
 
 /** IR artifacts are plain data. Scan each function once before deciding
  * whether its JSON encoding needs the complete-number-domain replacer. */
@@ -43,16 +42,7 @@ function encodeNumber(_key: string, value: unknown): unknown {
   return value;
 }
 
-/** Stage S2 of the two-tier design keeps function tiers out of IR
- * artifacts, so a report-only release changes no serialized byte; loaders
- * derive them again (deriveModuleTiers). No IR node other than a function
- * carries a `tier` key. */
-function encodeWithoutTier(key: string, value: unknown): unknown {
-  return key === "tier" ? undefined : encodeNumber(key, value);
-}
-
 function encodeFunction(fn: IrFunction): string | undefined {
-  if (fn.tier !== undefined) return JSON.stringify(fn, encodeWithoutTier);
   return ordinaryNumbers(fn) ? JSON.stringify(fn) : JSON.stringify(fn, encodeNumber);
 }
 
@@ -82,7 +72,7 @@ export function serializeModuleParts(mod: IrModule): string[] {
  * readable default. Both return one string, so modules whose encoding
  * exceeds the host's string limit must use `serializeModuleParts`. */
 export function serializeModule(mod: IrModule, compact = false): string {
-  if (!compact) return JSON.stringify(mod, encodeWithoutTier, 2);
+  if (!compact) return JSON.stringify(mod, encodeNumber, 2);
   return serializeModuleParts(mod).join("");
 }
 
@@ -108,7 +98,7 @@ function checkedVersion(mod: IrModule): IrModule {
 }
 
 export function deserializeModule(json: string): IrModule {
-  return deriveModuleTiers(checkedVersion(JSON.parse(json, decodeNumber) as IrModule));
+  return checkedVersion(JSON.parse(json, decodeNumber) as IrModule);
 }
 
 /** A node as it reads back from the compact encoding: a fresh object, as
@@ -261,5 +251,5 @@ export function deserializeModuleBytes(bytes: Buffer): IrModule {
     );
   }
   mod.functions = functions;
-  return deriveModuleTiers(mod);
+  return mod;
 }
diff --git a/packages/compiler/src/ir/tiers.test.ts b/packages/compiler/src/ir/tiers.test.ts
index c5f1ad4b8..6f2f0c395 100644
--- a/packages/compiler/src/ir/tiers.test.ts
+++ b/packages/compiler/src/ir/tiers.test.ts
@@ -1,5 +1,15 @@
 import { expect, test } from "vitest";
-import { BOOL, DYN, F64, STRING, VOID, type IrExpr, type IrFunction, type IrModule } from "./ir.js";
+import {
+  BOOL,
+  DYN,
+  F64,
+  JSVAL,
+  STRING,
+  VOID,
+  type IrExpr,
+  type IrFunction,
+  type IrModule,
+} from "./ir.js";
 import {
   deserializeModule,
   deserializeModuleBytes,
@@ -37,7 +47,7 @@ function moduleOf(...functions: IrFunction[]): IrModule {
     body: [],
     loc,
   };
-  return { irVersion: 16, sourceFile: "tiers.ts", functions: [main, ...functions], entry: "%main" };
+  return { irVersion: 17, sourceFile: "tiers.ts", functions: [main, ...functions], entry: "%main" };
 }
 
 const keyGet: IrExpr = {
@@ -123,20 +133,56 @@ test("the validator enforces I1: static functions perform no dynamic operation",
   ]);
 });
 
-test("serialized IR carries no tiers in stage S2, and loading derives them again", () => {
+test("serialized IR carries each function's tier", () => {
   const reader = fn("reader", keyGet);
   const mod = moduleOf(reader);
-  const untiered = serializeModule(mod, true);
   assignLegacyTiers(mod.functions);
   expect(reader.tier).toBe("dynamic");
-  expect(serializeModule(mod, true)).toBe(untiered);
-  expect(serializeModuleParts(mod).join("")).toBe(untiered);
-  expect(serializeModule(mod)).not.toContain('"tier"');
-  for (const loaded of [
-    deserializeModule(untiered),
-    deserializeModuleBytes(Buffer.from(untiered)),
-  ]) {
+  const tiered = serializeModule(mod, true);
+  expect(serializeModuleParts(mod).join("")).toBe(tiered);
+  expect(tiered).toContain('"tier":"dynamic"');
+  for (const loaded of [deserializeModule(tiered), deserializeModuleBytes(Buffer.from(tiered))]) {
     expect(loaded.functions.map(functionTier)).toEqual(["static", "dynamic"]);
     expect(validateModule(loaded)).toEqual([]);
   }
+  // A loader trusts the serialized tier: the validator then checks I1.
+  const stripped = deserializeModule(tiered.replace(',"tier":"dynamic"', ""));
+  expect(validateModule(stripped).map((e) => e.message)).toEqual([
+    "in reader: static-tier function performs the dynamic operation dynKeyGet",
+  ]);
+});
+
+test("jsval operators are dynamic operations and jsval conversions are boundaries", () => {
+  const js: IrExpr = { kind: "libCall", fn: "js.fromDyn", args: [dynParam], type: JSVAL, loc };
+  expect(dynamicOperationOf(js)).toBeNull();
+  expect(
+    dynamicOperationOf({ kind: "libCall", fn: "js.toDyn", args: [js], type: DYN, loc }),
+  ).toBeNull();
+  expect(
+    dynamicOperationOf({ kind: "libCall", fn: "js.toF64", args: [js], type: F64, loc }),
+  ).toBeNull();
+  expect(
+    dynamicOperationOf({
+      kind: "libCall",
+      fn: "js.fromF64",
+      args: [{ kind: "numLit", value: 1, type: F64, loc }],
+      type: JSVAL,
+      loc,
+    }),
+  ).toBeNull();
+  expect(
+    dynamicOperationOf({ kind: "libCall", fn: "js.add", args: [js, js], type: JSVAL, loc }),
+  ).toBe("js.add");
+  const sum = fn("sum", {
+    kind: "libCall",
+    fn: "js.toDyn",
+    args: [{ kind: "libCall", fn: "js.add", args: [js, js], type: JSVAL, loc }],
+    type: DYN,
+    loc,
+  });
+  expect(validateModule(moduleOf(sum)).map((e) => e.message)).toEqual([
+    "in sum: static-tier function performs the dynamic operation js.add",
+  ]);
+  sum.tier = "dynamic";
+  expect(validateModule(moduleOf(sum))).toEqual([]);
 });
diff --git a/packages/compiler/src/ir/tiers.ts b/packages/compiler/src/ir/tiers.ts
index 201bc2a58..ce2fdf0f4 100644
--- a/packages/compiler/src/ir/tiers.ts
+++ b/packages/compiler/src/ir/tiers.ts
@@ -24,6 +24,11 @@
  * - calls of non-`dyn.*` builtins whose signatures take or return `dyn`
  *   (typed APIs implemented through dyn, leak L6 of the design). They stay
  *   boundaries until stage S1 gives them typed signatures.
+ * - the jsval conversions (stage S3): `js.fromF64`, `js.fromBool`,
+ *   `js.fromStr` and `js.fromBigInt` (static to jsval), `js.toF64` (jsval to number), and
+ *   `js.fromDyn`/`js.toDyn`, which move a value between the two dynamic
+ *   representations. Every other `js.*` builtin (the jsval operators) is a
+ *   dynamic operation.
  *
  * Classification of existing code. The `dyn` vocabulary is today's
  * dynamic tier (`ScrDyn`): `any`, untyped JavaScript, unschematized
@@ -34,10 +39,9 @@
  * do not follow from a body; until then the classification is exact, and
  * the validator guards it against later passes and hand-written IR.
  *
- * Serialization. Stage S2 must not change any artifact, so serialized IR
- * omits `tier` (serialize.ts) and loaders derive it again with the same
- * classification. The next IR version serializes the field. */
-import type { IrExpr, IrFunction, IrModule, SrcLoc } from "./ir.js";
+ * Serialization. Since IR version 17 (stage S3) serialized IR carries
+ * `tier` like any other function field. */
+import type { IrExpr, IrFunction, SrcLoc } from "./ir.js";
 import { everyStmtList, type IrVisitor } from "./traverse.js";
 
 export type IrTier = "static" | "dynamic";
@@ -46,6 +50,18 @@ export function functionTier(fn: IrFunction): IrTier {
   return fn.tier === "dynamic" ? "dynamic" : "static";
 }
 
+/** `js.*` builtins that convert at the boundary instead of operating on a
+ * dynamic value. */
+const JS_BOUNDARY: ReadonlySet<string> = new Set([
+  "js.fromDyn",
+  "js.toDyn",
+  "js.fromF64",
+  "js.fromBool",
+  "js.fromStr",
+  "js.fromBigInt",
+  "js.toF64",
+]);
+
 /** `dyn.*` builtins that only inspect a dynamic value's kind: the tag test
  * half of a dynamic-to-static conversion. */
 const DYN_KIND_TESTS: ReadonlySet<string> = new Set([
@@ -87,6 +103,7 @@ export function dynamicOperationOf(e: IrExpr): string | null {
       // `a || b` over dyn operands applies ToBoolean to a dynamic value.
       return e.type.kind === "dyn" ? "logical" : null;
     case "libCall":
+      if (e.fn.startsWith("js.")) return JS_BOUNDARY.has(e.fn) ? null : e.fn;
       return e.fn.startsWith("dyn.") && !DYN_KIND_TESTS.has(e.fn) ? e.fn : null;
     case "call":
       // Generated `%dyn.*` helpers are dynamic operations lowered out of
@@ -148,10 +165,3 @@ export function assignLegacyTiers(functions: readonly IrFunction[]): DynamicFunc
   }
   return dynamic;
 }
-
-/** Loaders call this on deserialized modules (stage S2 serializes no
- * tiers). */
-export function deriveModuleTiers(mod: IrModule): IrModule {
-  assignLegacyTiers(mod.functions);
-  return mod;
-}
diff --git a/packages/compiler/src/ir/traverse.ts b/packages/compiler/src/ir/traverse.ts
index 1ef70bdb2..3e27cdc36 100644
--- a/packages/compiler/src/ir/traverse.ts
+++ b/packages/compiler/src/ir/traverse.ts
@@ -52,6 +52,7 @@ export function everyTypeChild(node: IrType, visit: (node: IrType) => boolean):
     case "record":
     case "union":
     case "dyn":
+    case "jsval":
     case "caught":
     case "undefinedT":
     case "nullT":
@@ -127,21 +128,54 @@ export function everyExprChild(
   expr: (expr: IrExpr) => boolean,
   stmt: (stmt: IrStmt) => boolean,
 ): boolean {
+  // The most common node kinds come first: the engine tests string cases
+  // one after another, in source order.
   switch (node.kind) {
-    case "numLit":
+    case "varRef":
       return true;
+    case "call":
+      return node.args.every((child) => expr(child));
+    case "dynFrom":
+      return expr(node.value);
     case "strLit":
       return true;
-    case "moduleNsRef":
+    case "libCall":
+      return node.args.every((child) => expr(child));
+    case "dynCheck":
+      return expr(node.value);
+    case "strEq":
+      return expr(node.left) && expr(node.right);
+    case "fieldGet":
+      return expr(node.obj);
+    case "ternary":
+      return expr(node.cond) && expr(node.then) && expr(node.else_);
+    case "closure":
       return true;
     case "boolLit":
       return true;
+    case "numLit":
+      return true;
     case "unitLit":
       return true;
-    case "varRef":
-      return true;
+    case "seqExpr":
+      return node.stmts.every((child) => stmt(child)) && expr(node.result);
+    case "dynCall":
+      return (
+        expr(node.callee) &&
+        (node.receiver === undefined || expr(node.receiver)) &&
+        (node.calleeNameValue === undefined || expr(node.calleeNameValue)) &&
+        node.args.every((child) => expr(child))
+      );
+    case "dynTest":
+      return expr(node.value);
+    case "dynScalarEq":
+      return expr(node.left) && expr(node.right);
+    case "upcast":
+      return expr(node.value);
     case "bin":
       return expr(node.left) && expr(node.right);
+    case "moduleNsRef":
+      return true;
     case "unary":
       return expr(node.operand);
     case "incDec":
@@ -156,14 +190,10 @@ export function everyExprChild(
       return expr(node.left) && expr(node.right);
     case "strConcat":
       return expr(node.left) && expr(node.right);
-    case "strEq":
-      return expr(node.left) && expr(node.right);
     case "strCmp":
       return expr(node.left) && expr(node.right);
     case "toString":
       return expr(node.operand);
-    case "ternary":
-      return expr(node.cond) && expr(node.then) && expr(node.else_);
     case "nullish":
       return expr(node.left) && expr(node.right);
     case "orDefault":
@@ -206,12 +236,8 @@ export function everyExprChild(
       return node.seed === undefined || expr(node.seed);
     case "setIntrinsic":
       return expr(node.receiver) && node.args.every((child) => expr(child));
-    case "call":
-      return node.args.every((child) => expr(child));
     case "ffiCall":
       return node.args.every((child) => expr(child));
-    case "closure":
-      return true;
     case "callValue":
       return (
         expr(node.callee) &&
@@ -240,8 +266,6 @@ export function everyExprChild(
       return expr(node.callee) && node.args.every((child) => expr(child));
     case "instanceOfValue":
       return expr(node.value) && expr(node.classValue);
-    case "upcast":
-      return expr(node.value);
     case "promiseVoidWiden":
       return expr(node.value);
     case "downcast":
@@ -250,8 +274,6 @@ export function everyExprChild(
       return expr(node.value);
     case "virtualCall":
       return node.args.every((child) => expr(child));
-    case "fieldGet":
-      return expr(node.obj);
     case "recordLit":
       return node.fields.every((child) => expr(child.value));
     case "recordClone":
@@ -260,15 +282,6 @@ export function everyExprChild(
       return expr(node.obj);
     case "recordKeyGet":
       return expr(node.obj) && expr(node.key);
-    case "dynFrom":
-      return expr(node.value);
-    case "dynCall":
-      return (
-        expr(node.callee) &&
-        (node.receiver === undefined || expr(node.receiver)) &&
-        (node.calleeNameValue === undefined || expr(node.calleeNameValue)) &&
-        node.args.every((child) => expr(child))
-      );
     case "dynInvoke":
       return (
         expr(node.recv) &&
@@ -282,16 +295,10 @@ export function everyExprChild(
         node.fields === undefined ||
         node.fields.every((child) => expr(child.key) && expr(child.value))
       );
-    case "dynTest":
-      return expr(node.value);
     case "dynKeyGet":
       return expr(node.key) && expr(node.value);
     case "dynHasKey":
       return expr(node.value);
-    case "dynScalarEq":
-      return expr(node.left) && expr(node.right);
-    case "seqExpr":
-      return node.stmts.every((child) => stmt(child)) && expr(node.result);
     case "dynDestrCheck":
       return expr(node.value);
     case "dynIterN":
@@ -332,12 +339,8 @@ export function everyExprChild(
       return expr(node.left) && expr(node.right);
     case "intrinsic":
       return node.args.every((child) => expr(child));
-    case "libCall":
-      return node.args.every((child) => expr(child));
     case "jsonStringify":
       return expr(node.value);
-    case "dynCheck":
-      return expr(node.value);
   }
   node satisfies never;
   throw new Error("unhandled IR node");
@@ -349,19 +352,27 @@ export function everyStmtChild(
   expr: (expr: IrExpr) => boolean,
   stmt: (stmt: IrStmt) => boolean,
 ): boolean {
+  // The most common node kinds come first: the engine tests string cases
+  // one after another, in source order.
   switch (node.kind) {
-    case "varDecl":
-      return node.init === null || expr(node.init);
-    case "assign":
-      return expr(node.value);
-    case "exprStmt":
-      return expr(node.expr);
+    case "return":
+      return node.value === null || expr(node.value);
     case "if":
       return (
         expr(node.cond) &&
         node.then.every((child) => stmt(child)) &&
         (node.else_ === null || node.else_.every((child) => stmt(child)))
       );
+    case "varDecl":
+      return node.init === null || expr(node.init);
+    case "exprStmt":
+      return expr(node.expr);
+    case "assign":
+      return expr(node.value);
+    case "block":
+      return node.body.every((child) => stmt(child));
+    case "fieldSet":
+      return expr(node.obj) && expr(node.value);
     case "while":
       return expr(node.cond) && node.body.every((child) => stmt(child));
     case "doWhile":
@@ -393,10 +404,6 @@ export function everyStmtChild(
       return expr(node.arr) && expr(node.index) && expr(node.value);
     case "forOf":
       return expr(node.iterable) && node.body.every((child) => stmt(child));
-    case "return":
-      return node.value === null || expr(node.value);
-    case "fieldSet":
-      return expr(node.obj) && expr(node.value);
     case "recordSet":
       return expr(node.obj) && expr(node.value);
     case "recordKeySet":
@@ -407,8 +414,6 @@ export function everyStmtChild(
       return true;
     case "continue":
       return true;
-    case "block":
-      return node.body.every((child) => stmt(child));
     case "throw":
       return expr(node.value);
     case "runtimeFence":
@@ -432,21 +437,54 @@ export function mapExprChildren(
   expr: (expr: IrExpr) => IrExpr,
   stmt: (stmt: IrStmt) => IrStmt,
 ): IrExpr {
+  // The most common node kinds come first: the engine tests string cases
+  // one after another, in source order.
   switch (node.kind) {
-    case "numLit":
+    case "varRef":
       return node;
+    case "call":
+      return { ...node, args: node.args.map((child) => expr(child)) };
+    case "dynFrom":
+      return { ...node, value: expr(node.value) };
     case "strLit":
       return node;
-    case "moduleNsRef":
+    case "libCall":
+      return { ...node, args: node.args.map((child) => expr(child)) };
+    case "dynCheck":
+      return { ...node, value: expr(node.value) };
+    case "strEq":
+      return { ...node, left: expr(node.left), right: expr(node.right) };
+    case "fieldGet":
+      return { ...node, obj: expr(node.obj) };
+    case "ternary":
+      return { ...node, cond: expr(node.cond), then: expr(node.then), else_: expr(node.else_) };
+    case "closure":
       return node;
     case "boolLit":
       return node;
+    case "numLit":
+      return node;
     case "unitLit":
       return node;
-    case "varRef":
-      return node;
+    case "seqExpr":
+      return { ...node, stmts: node.stmts.map((child) => stmt(child)), result: expr(node.result) };
+    case "dynCall": {
+      const result: Extract<IrExpr, { kind: "dynCall" }> = { ...node, callee: expr(node.callee) };
+      if (node.receiver !== undefined) result.receiver = expr(node.receiver);
+      if (node.calleeNameValue !== undefined) result.calleeNameValue = expr(node.calleeNameValue);
+      result.args = node.args.map((child) => expr(child));
+      return result;
+    }
+    case "dynTest":
+      return { ...node, value: expr(node.value) };
+    case "dynScalarEq":
+      return { ...node, left: expr(node.left), right: expr(node.right) };
+    case "upcast":
+      return { ...node, value: expr(node.value) };
     case "bin":
       return { ...node, left: expr(node.left), right: expr(node.right) };
+    case "moduleNsRef":
+      return node;
     case "unary":
       return { ...node, operand: expr(node.operand) };
     case "incDec":
@@ -461,14 +499,10 @@ export function mapExprChildren(
       return { ...node, left: expr(node.left), right: expr(node.right) };
     case "strConcat":
       return { ...node, left: expr(node.left), right: expr(node.right) };
-    case "strEq":
-      return { ...node, left: expr(node.left), right: expr(node.right) };
     case "strCmp":
       return { ...node, left: expr(node.left), right: expr(node.right) };
     case "toString":
       return { ...node, operand: expr(node.operand) };
-    case "ternary":
-      return { ...node, cond: expr(node.cond), then: expr(node.then), else_: expr(node.else_) };
     case "nullish":
       return { ...node, left: expr(node.left), right: expr(node.right) };
     case "orDefault":
@@ -542,12 +576,8 @@ export function mapExprChildren(
         receiver: expr(node.receiver),
         args: node.args.map((child) => expr(child)),
       };
-    case "call":
-      return { ...node, args: node.args.map((child) => expr(child)) };
     case "ffiCall":
       return { ...node, args: node.args.map((child) => expr(child)) };
-    case "closure":
-      return node;
     case "callValue": {
       const callee = expr(node.callee);
       if (node.receiver === undefined)
@@ -581,8 +611,6 @@ export function mapExprChildren(
       return { ...node, callee: expr(node.callee), args: node.args.map((child) => expr(child)) };
     case "instanceOfValue":
       return { ...node, value: expr(node.value), classValue: expr(node.classValue) };
-    case "upcast":
-      return { ...node, value: expr(node.value) };
     case "promiseVoidWiden":
       return { ...node, value: expr(node.value) };
     case "downcast":
@@ -591,8 +619,6 @@ export function mapExprChildren(
       return { ...node, value: expr(node.value) };
     case "virtualCall":
       return { ...node, args: node.args.map((child) => expr(child)) };
-    case "fieldGet":
-      return { ...node, obj: expr(node.obj) };
     case "recordLit":
       return {
         ...node,
@@ -608,15 +634,6 @@ export function mapExprChildren(
       return { ...node, obj: expr(node.obj) };
     case "recordKeyGet":
       return { ...node, obj: expr(node.obj), key: expr(node.key) };
-    case "dynFrom":
-      return { ...node, value: expr(node.value) };
-    case "dynCall": {
-      const result: Extract<IrExpr, { kind: "dynCall" }> = { ...node, callee: expr(node.callee) };
-      if (node.receiver !== undefined) result.receiver = expr(node.receiver);
-      if (node.calleeNameValue !== undefined) result.calleeNameValue = expr(node.calleeNameValue);
-      result.args = node.args.map((child) => expr(child));
-      return result;
-    }
     case "dynInvoke": {
       const result: Extract<IrExpr, { kind: "dynInvoke" }> = { ...node, recv: expr(node.recv) };
       if (node.calleeNameValue !== undefined) result.calleeNameValue = expr(node.calleeNameValue);
@@ -636,16 +653,10 @@ export function mapExprChildren(
               value: expr(child.value),
             })),
           };
-    case "dynTest":
-      return { ...node, value: expr(node.value) };
     case "dynKeyGet":
       return { ...node, key: expr(node.key), value: expr(node.value) };
     case "dynHasKey":
       return { ...node, value: expr(node.value) };
-    case "dynScalarEq":
-      return { ...node, left: expr(node.left), right: expr(node.right) };
-    case "seqExpr":
-      return { ...node, stmts: node.stmts.map((child) => stmt(child)), result: expr(node.result) };
     case "dynDestrCheck":
       return { ...node, value: expr(node.value) };
     case "dynIterN":
@@ -686,12 +697,8 @@ export function mapExprChildren(
       return { ...node, left: expr(node.left), right: expr(node.right) };
     case "intrinsic":
       return { ...node, args: node.args.map((child) => expr(child)) };
-    case "libCall":
-      return { ...node, args: node.args.map((child) => expr(child)) };
     case "jsonStringify":
       return { ...node, value: expr(node.value) };
-    case "dynCheck":
-      return { ...node, value: expr(node.value) };
   }
   node satisfies never;
   throw new Error("unhandled IR node");
@@ -703,13 +710,11 @@ export function mapStmtChildren(
   expr: (expr: IrExpr) => IrExpr,
   stmt: (stmt: IrStmt) => IrStmt,
 ): IrStmt {
+  // The most common node kinds come first: the engine tests string cases
+  // one after another, in source order.
   switch (node.kind) {
-    case "varDecl":
-      return { ...node, init: node.init === null ? null : expr(node.init) };
-    case "assign":
-      return { ...node, value: expr(node.value) };
-    case "exprStmt":
-      return { ...node, expr: expr(node.expr) };
+    case "return":
+      return { ...node, value: node.value === null ? null : expr(node.value) };
     case "if":
       return {
         ...node,
@@ -717,6 +722,16 @@ export function mapStmtChildren(
         then: node.then.map((child) => stmt(child)),
         else_: node.else_ === null ? null : node.else_.map((child) => stmt(child)),
       };
+    case "varDecl":
+      return { ...node, init: node.init === null ? null : expr(node.init) };
+    case "exprStmt":
+      return { ...node, expr: expr(node.expr) };
+    case "assign":
+      return { ...node, value: expr(node.value) };
+    case "block":
+      return { ...node, body: node.body.map((child) => stmt(child)) };
+    case "fieldSet":
+      return { ...node, obj: expr(node.obj), value: expr(node.value) };
     case "while":
       return { ...node, cond: expr(node.cond), body: node.body.map((child) => stmt(child)) };
     case "doWhile":
@@ -755,10 +770,6 @@ export function mapStmtChildren(
         iterable: expr(node.iterable),
         body: node.body.map((child) => stmt(child)),
       };
-    case "return":
-      return { ...node, value: node.value === null ? null : expr(node.value) };
-    case "fieldSet":
-      return { ...node, obj: expr(node.obj), value: expr(node.value) };
     case "recordSet":
       return { ...node, obj: expr(node.obj), value: expr(node.value) };
     case "recordKeySet":
@@ -769,8 +780,6 @@ export function mapStmtChildren(
       return node;
     case "continue":
       return node;
-    case "block":
-      return { ...node, body: node.body.map((child) => stmt(child)) };
     case "throw":
       return { ...node, value: expr(node.value) };
     case "runtimeFence":
diff --git a/packages/compiler/src/ir/unshare.test.ts b/packages/compiler/src/ir/unshare.test.ts
index fdbd2619c..40368a836 100644
--- a/packages/compiler/src/ir/unshare.test.ts
+++ b/packages/compiler/src/ir/unshare.test.ts
@@ -57,7 +57,7 @@ function sharedRead(): { mod: IrModule; read: IrExpr } {
     },
   ];
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [
diff --git a/packages/compiler/src/ir/unshare.ts b/packages/compiler/src/ir/unshare.ts
index df697baa9..36dd6176f 100644
--- a/packages/compiler/src/ir/unshare.ts
+++ b/packages/compiler/src/ir/unshare.ts
@@ -1,4 +1,5 @@
 import type { IrExpr, IrFunction, IrModule, IrStmt } from "./ir.js";
+import { reparseExpr, reparseStmt } from "./serialize.js";
 import { everyExprChild, everyStmtChild, mapExprChildren, mapStmtChildren } from "./traverse.js";
 
 /** Give every occurrence of an executable node its own object.
@@ -41,15 +42,14 @@ export function unshareNodes(mod: IrModule): IrModule {
   }
   if (affected.size === 0) return mod;
   // Rebuilding a function copies every node that has children; a repeated
-  // childless node gets its own shallow copy at each of its sites there.
-  // Both kinds of copy keep sharing the type and location objects.
+  // childless node reads back as a fresh object at each of its sites there.
   const expr = (node: IrExpr): IrExpr => {
     const copy = mapExprChildren(node, expr, stmt);
-    return copy !== node || !repeated.has(node) ? copy : { ...node };
+    return copy !== node || !repeated.has(node) ? copy : reparseExpr(node);
   };
   const stmt = (node: IrStmt): IrStmt => {
     const copy = mapStmtChildren(node, expr, stmt);
-    return copy !== node || !repeated.has(node) ? copy : { ...node };
+    return copy !== node || !repeated.has(node) ? copy : reparseStmt(node);
   };
   return {
     ...mod,
diff --git a/packages/compiler/src/ir/validate.test.ts b/packages/compiler/src/ir/validate.test.ts
index e4f423411..059391590 100644
--- a/packages/compiler/src/ir/validate.test.ts
+++ b/packages/compiler/src/ir/validate.test.ts
@@ -146,6 +146,7 @@ test("class prototype data helpers retain their ABI after serialization", () =>
     body: [{ kind: "return", value: { kind: "dynObjLit", fields: [], type: DYN, loc }, loc }],
     loc,
   });
+  assignLegacyTiers(mod.functions);
   expect(validateModule(deserializeModule(serializeModule(mod)))).toEqual([]);
   for (const variant of ["missing", "params", "return", "captures"]) {
     const bad = structuredClone(mod);
@@ -178,6 +179,7 @@ test("instance prototype helpers require the class receiver ABI", () => {
     body: [{ kind: "return", value: { kind: "dynObjLit", fields: [], type: DYN, loc }, loc }],
     loc,
   });
+  assignLegacyTiers(mod.functions);
   expect(validateModule(deserializeModule(serializeModule(mod)))).toEqual([]);
   for (const variant of ["missing", "params", "receiver", "return", "captures"]) {
     const bad = structuredClone(mod);
@@ -325,7 +327,7 @@ function numericReadModule(overrides: Partial<IrExpr & { kind: "arrIntrinsic" }>
     ...overrides,
   };
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [
@@ -409,7 +411,7 @@ test.each(["sortPrimitive", "toSortedPrimitive"] as const)(
 
 function expressionModule(expr: IrExpr, unions: IrUnionDef[]): IrModule {
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     unions,
@@ -1322,7 +1324,7 @@ test.each([
 function tdzModule(mutable = true): IrModule {
   const value: IrExpr = { kind: "numLit", value: 0, type: F64, loc };
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [
@@ -1615,7 +1617,7 @@ test("TDZ locals require a shared box", () => {
 
 function discriminatedModule(): IrModule {
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     functions: [{ name: "main", params: [], locals: [], returnType: VOID, body: [], loc }],
@@ -2132,7 +2134,7 @@ test("a caught-typed global records a module error only from a catch binding", (
   const caught: IrType = { kind: "caught" };
   const errorId = "%g.e.%loaded%error";
   const module = (value: IrExpr): IrModule => ({
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "main",
     unions: [],
diff --git a/packages/compiler/src/ir/validate.ts b/packages/compiler/src/ir/validate.ts
index 5cf262e1f..4a961dfca 100644
--- a/packages/compiler/src/ir/validate.ts
+++ b/packages/compiler/src/ir/validate.ts
@@ -5103,7 +5103,8 @@ function validateFunction(
       let ok = cbT?.kind === "func" && cbT.ret.kind === "void" && cbT.params.length <= 1;
       if (ok && cbT?.kind === "func" && cbT.params.length === 1) {
         const p = cbT.params[0]!;
-        if (e.fn === "stdin.onData") ok = p.kind === "bytes" && p.elem === "u8";
+        if (e.fn === "stdin.onData")
+          ok = (p.kind === "bytes" && p.elem === "u8") || p.kind === "string";
         else if (e.fn === "stdin.onError") ok = p.kind === "object" && p.className === "%Error";
         else ok = p.kind === "f64";
       }
@@ -5242,7 +5243,11 @@ function validateFunction(
   }
 
   function checkLibSpecialCall(e: IrExpr & { kind: "libCall" }): boolean {
-    if (e.fn === "crypto.randomFillView" || e.fn === "crypto.randomFillViewRest") {
+    if (
+      e.fn === "crypto.randomFillView" ||
+      e.fn === "crypto.randomFillViewRest" ||
+      e.fn === "crypto.getRandomValues"
+    ) {
       // The filled view is the result, at its own element type.
       const view = e.args[0]?.type;
       if (view?.kind !== "bytes" || !typeEquals(e.type, view)) {
diff --git a/packages/compiler/src/library/fence-eval.test.ts b/packages/compiler/src/library/fence-eval.test.ts
index 7b4f03434..bac54c5bb 100644
--- a/packages/compiler/src/library/fence-eval.test.ts
+++ b/packages/compiler/src/library/fence-eval.test.ts
@@ -15,7 +15,7 @@ function program(member: string): IrModule {
     loc,
   };
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "probe",
     functions: [
diff --git a/packages/compiler/src/library/int-infer.test.ts b/packages/compiler/src/library/int-infer.test.ts
index 250bdc6d8..e5283c56e 100644
--- a/packages/compiler/src/library/int-infer.test.ts
+++ b/packages/compiler/src/library/int-infer.test.ts
@@ -97,7 +97,7 @@ const sink = (name: string): IrFunction => ({
 /** A module holding the case function plus the two declared sinks. */
 function caseModule(params: string[], locals: string[], body: IrStmt[]): IrModule {
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: "corpus.ts",
     functions: [
       sink("send"),
@@ -196,7 +196,7 @@ const RECORD_CFG: IntSlotConfig = {
 
 function recordCase(body: IrStmt[], names = ["m"], extraFns: IrFunction[] = []): IrModule {
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: "fields.ts",
     functions: [
       ...extraFns,
@@ -237,7 +237,7 @@ const classCountRead = (): IrExpr => ({
 
 function onlyOrdinaryClass(body: IrStmt[]): IntVerdict {
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: "class-fields.ts",
     functions: [
       sink("send"),
@@ -581,7 +581,7 @@ describe("the domain's edges beyond the corpus", () => {
       loc,
     };
     const mod: IrModule = {
-      irVersion: 16,
+      irVersion: 17,
       sourceFile: "optional.ts",
       functions: [
         {
diff --git a/packages/compiler/src/library/ir-policy.ts b/packages/compiler/src/library/ir-policy.ts
index 3c3855e5c..2d1bc85d4 100644
--- a/packages/compiler/src/library/ir-policy.ts
+++ b/packages/compiler/src/library/ir-policy.ts
@@ -51,6 +51,7 @@ const LIB_MODE_REFUSED_PREFIXES: readonly [string, string][] = [
   ["dns.", "the node:dns surface"],
   ["tls.", "the node:tls surface"],
   ["crypto.cipherNew", "crypto.createCipheriv and createDecipheriv"],
+  ["webcrypto.", "WebCrypto (crypto.subtle)"],
   ["fs.watch", "fs.watch"],
   ["watcher.", "fs.watch"],
   ["test.", "the node:test surface"],
diff --git a/packages/compiler/src/library/library-cache.test.ts b/packages/compiler/src/library/library-cache.test.ts
index 9a3e4e4cf..846d90272 100644
--- a/packages/compiler/src/library/library-cache.test.ts
+++ b/packages/compiler/src/library/library-cache.test.ts
@@ -261,7 +261,7 @@ test("semantic library cache restores and rebases IR after a comment-only edit",
   const sourceBefore = await readFile(f.source, "utf8");
   const returnStart = sourceBefore.indexOf("return");
   const semanticMod = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: f.source,
     functions: [
       {
@@ -324,7 +324,7 @@ test("semantic library cache refuses token and directive edits", async () => {
   const f = await fixture();
   const sourceBefore = await readFile(f.source, "utf8");
   const semanticMod = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: f.source,
     functions: [
       {
@@ -372,7 +372,7 @@ test("semantic LLVM cache accepts comment edits that shift source lines", async
   const f = await fixture();
   const sourceBefore = await readFile(f.source, "utf8");
   const semanticMod = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: f.source,
     functions: [
       {
@@ -447,7 +447,7 @@ test("semantic LLVM cache accepts line separator normalization", async () => {
       frontend: tracker.snapshot(),
       semantic: {
         mod: {
-          irVersion: 16,
+          irVersion: 17,
           sourceFile: f.source,
           functions: [],
           entry: "__main",
@@ -468,7 +468,7 @@ test("semantic LLVM cache rebases comment edits in multi-source graphs", async (
   const importedSource = "export function helper(): number { return 1; }\n";
   await writeFile(imported, importedSource);
   const semanticMod = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: f.source,
     functions: [
       {
diff --git a/packages/compiler/src/library/library-cache.ts b/packages/compiler/src/library/library-cache.ts
index 1b65024e0..356056dd8 100644
--- a/packages/compiler/src/library/library-cache.ts
+++ b/packages/compiler/src/library/library-cache.ts
@@ -63,6 +63,7 @@ interface EarlyLibraryCacheStamp {
 export interface EarlyLibraryNativeFeatures {
   backend: "llvm";
   dynInvoke: boolean;
+  dynTier?: boolean;
   regex: boolean;
   assert: boolean;
   inspect: boolean;
diff --git a/packages/compiler/src/native/cli.ts b/packages/compiler/src/native/cli.ts
index c0d89bbbf..7d00acbc8 100644
--- a/packages/compiler/src/native/cli.ts
+++ b/packages/compiler/src/native/cli.ts
@@ -100,6 +100,7 @@ async function main(): Promise<number> {
               nodeTest: false,
               tls: false,
               cipher: false,
+              webcrypto: false,
               tlsCa: false,
             },
             options.optimization ?? "release",
diff --git a/packages/compiler/src/native/compiler.test.ts b/packages/compiler/src/native/compiler.test.ts
index 8203271eb..7a1cee62a 100644
--- a/packages/compiler/src/native/compiler.test.ts
+++ b/packages/compiler/src/native/compiler.test.ts
@@ -60,7 +60,7 @@ test.each([
   writeFileSync(output, "previous executable");
   writeFileSync(llvmPath, "previous LLVM");
   const module: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: entry,
     entry: "%main",
     functions: [
@@ -197,7 +197,7 @@ test.each([false, true])(
     writeFileSync(output, "previous object");
     writeFileSync(llvmPath, "previous LLVM");
     const module: IrModule = {
-      irVersion: 16,
+      irVersion: 17,
       sourceFile: entry,
       entry: "%main",
       functions: [
diff --git a/packages/compiler/src/native/prepare.ts b/packages/compiler/src/native/prepare.ts
index bb901a674..54100a413 100644
--- a/packages/compiler/src/native/prepare.ts
+++ b/packages/compiler/src/native/prepare.ts
@@ -155,6 +155,7 @@ function validFeatures(value: unknown): value is NativeLinkFeatures {
     "tls",
     "tlsCa",
     "cipher",
+    "webcrypto",
   ].every((name) => typeof features[name] === "boolean");
 }
 
diff --git a/packages/compiler/src/native/sanitizer.test.ts b/packages/compiler/src/native/sanitizer.test.ts
index 79984d6c5..6ca84af6f 100644
--- a/packages/compiler/src/native/sanitizer.test.ts
+++ b/packages/compiler/src/native/sanitizer.test.ts
@@ -75,6 +75,9 @@ test.skipIf(process.platform !== "linux" && process.platform !== "darwin")(
               workers: false,
               youngNursery: false,
               eventTarget: false,
+              dynTier: false,
+              warningReplace: false,
+              stdioExtended: false,
               regex: true,
               copying: false,
               textDecoderLegacy: false,
@@ -104,6 +107,7 @@ test.skipIf(process.platform !== "linux" && process.platform !== "darwin")(
               tls: false,
               tlsCa: false,
               cipher: false,
+              webcrypto: false,
               nativeFetch: false,
               netEffective: false,
               httpEffective: false,
diff --git a/packages/compiler/surface-manifest.json b/packages/compiler/surface-manifest.json
index 5cea78586..01d12dedc 100644
--- a/packages/compiler/surface-manifest.json
+++ b/packages/compiler/surface-manifest.json
@@ -618,6 +618,12 @@
       "code": "SC2020",
       "note": "asymmetric-key operations need a public-key stack (bignum, RSA/EC/EdDSA math) and public and private KeyObjects — neither exists in the static runtime, so no faithful lowering can be small; the lowered crypto surface is hashing, randomness, secret KeyObjects, and the introspection statics"
     },
+    {
+      "id": "node-builtin.crypto.getRandomValues",
+      "kind": "node-builtin",
+      "name": "crypto.getRandomValues",
+      "status": "static"
+    },
     {
       "id": "node-builtin.crypto.hash",
       "kind": "node-builtin",
@@ -868,6 +874,13 @@
       "name": "fs.closeSync",
       "status": "static"
     },
+    {
+      "id": "node-builtin.fs.constants",
+      "kind": "node-builtin",
+      "name": "fs.constants",
+      "status": "static",
+      "note": "node_constants.cc's fs group under the target libc's macros; members a platform lacks read as undefined"
+    },
     {
       "id": "node-builtin.fs.copyFileSync",
       "kind": "node-builtin",
@@ -4849,8 +4862,8 @@
       "id": "stdlib.number.toPrecision",
       "kind": "stdlib",
       "name": "number.prototype.toPrecision",
-      "status": "unsupported",
-      "code": "SC2012"
+      "status": "static",
+      "note": "the lowered call form takes 0 to 1 arguments"
     },
     {
       "id": "stdlib.number.toString",
@@ -5663,6 +5676,20 @@
       "code": "SC2020",
       "note": "WebAssembly support is planned as translation of each module whose bytes the build can see (an inline literal, or a file read from a path the compiler resolves) into native code; 'scriptc coverage' lists the modules this program would load (https://scriptc.dev/limitations)"
     },
+    {
+      "id": "stdlib.webcrypto.CryptoKey",
+      "kind": "stdlib",
+      "name": "CryptoKey",
+      "status": "static",
+      "note": "secret HMAC keys with type, extractable, algorithm and usages, and instanceof CryptoKey"
+    },
+    {
+      "id": "stdlib.webcrypto.subtle",
+      "kind": "stdlib",
+      "name": "globalThis.crypto.subtle",
+      "status": "static",
+      "note": "importKey('raw') for HMAC keys, HMAC sign and verify, and SHA-1/SHA-2 digest; other methods, algorithms and key formats are refused"
+    },
     {
       "id": "syntax.async-generators",
       "kind": "syntax",
diff --git a/packages/compiler/test/bytes-element-emission.test.ts b/packages/compiler/test/bytes-element-emission.test.ts
index ad47cc2a7..9a241b854 100644
--- a/packages/compiler/test/bytes-element-emission.test.ts
+++ b/packages/compiler/test/bytes-element-emission.test.ts
@@ -75,7 +75,7 @@ function fixture(): IrModule {
   );
 
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "__main",
     functions: [{ name: "__main", params: [], returnType: VOID, locals, body, loc }],
@@ -145,7 +145,7 @@ function receiverReassignmentFixture(): IrModule {
   ];
 
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "__main",
     functions: [{ name: "__main", params: [], returnType: VOID, locals, body, loc }],
@@ -212,7 +212,7 @@ function integerLoopFixture(mutatesIndex = false): IrModule {
     { kind: "bytesSet", arr: bytesRef(), index: indexRef(), value: ref("sum"), loc },
   );
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "__main",
     functions: [
@@ -365,7 +365,7 @@ test("large record clones stay outlined while small clones remain inlineable", (
     const fields = Array.from({ length: count }, (_, i) => ({ name: `f${i}`, type: F64 }));
     const type = { kind: "record", shapeId: id } as const;
     return {
-      irVersion: 16,
+      irVersion: 17,
       sourceFile: "record-clone.ts",
       entry: "__main",
       records: [{ id, fields }],
diff --git a/packages/compiler/test/emit-llvm.test.ts b/packages/compiler/test/emit-llvm.test.ts
index 2f1366b43..73689d541 100644
--- a/packages/compiler/test/emit-llvm.test.ts
+++ b/packages/compiler/test/emit-llvm.test.ts
@@ -35,7 +35,7 @@ test("strings: literals, concat in a loop, toString, RC-clean under audit", asyn
   // while (i < 3) { acc = acc + ("-" + i); i = i + 1; }
   // console.log(acc, acc === "x-0-1-2", "α∂" < "β");
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: "s.ts",
     entry: "__main",
     functions: [
@@ -137,7 +137,7 @@ test("short-circuit: right operand of && only evaluates when left is true", asyn
   // if (false && sideEffect()) {} ; if (true || sideEffect()) {}
   // console.log("done")
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: "l.ts",
     entry: "__main",
     functions: [
@@ -227,7 +227,7 @@ test("string params: callee owns and releases; returns transfer ownership", asyn
   // function greet(who: string): string { return "hi " + who; }
   // console.log(greet("world"));
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: "p.ts",
     entry: "__main",
     functions: [
diff --git a/packages/compiler/test/fixtures/fib-ir.ts b/packages/compiler/test/fixtures/fib-ir.ts
index 8daaa91d5..5be37a8bb 100644
--- a/packages/compiler/test/fixtures/fib-ir.ts
+++ b/packages/compiler/test/fixtures/fib-ir.ts
@@ -17,7 +17,7 @@ const n = (localId: string): IrExpr => ({ kind: "varRef", localId, type: F64, lo
 const num = (value: number): IrExpr => ({ kind: "numLit", value, type: F64, loc });
 
 export const fibModule: IrModule = {
-  irVersion: 16,
+  irVersion: 17,
   sourceFile: "fib.ts",
   entry: "__main",
   functions: [
diff --git a/packages/compiler/test/fromcharcode-emission.test.ts b/packages/compiler/test/fromcharcode-emission.test.ts
index bab64ce3e..2df4131e8 100644
--- a/packages/compiler/test/fromcharcode-emission.test.ts
+++ b/packages/compiler/test/fromcharcode-emission.test.ts
@@ -7,7 +7,7 @@ test("scalar fromCharCode avoids a heap argument pack in LLVM", () => {
   const loc = { file: "scalar-char.ts", start: 0, end: 0 };
   const value: IrExpr = { kind: "numLit", value: 65, type: F64, loc };
   const mod: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "__main",
     globals: [],
diff --git a/packages/compiler/test/ir.test.ts b/packages/compiler/test/ir.test.ts
index 7d7efdb01..7f1a1ef78 100644
--- a/packages/compiler/test/ir.test.ts
+++ b/packages/compiler/test/ir.test.ts
@@ -22,7 +22,7 @@ test("fib module JSON round-trips", () => {
 test("validator rejects type mismatches and bad references", () => {
   const loc = { file: "t.ts", start: 0, end: 0 };
   const bad: IrModule = {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: "t.ts",
     entry: "__main",
     functions: [
@@ -108,7 +108,7 @@ test("serializer round-trips ±Infinity and NaN", () => {
 });
 
 test("deserializer rejects the previous IR version", () => {
-  const json = serializeModule(fibModule).replace('"irVersion": 16', '"irVersion": 13');
+  const json = serializeModule(fibModule).replace('"irVersion": 17', '"irVersion": 13');
   expect(() => deserializeModule(json)).toThrow(/version mismatch/);
 });
 
diff --git a/packages/compiler/test/llvm-lib-dispatch.test.ts b/packages/compiler/test/llvm-lib-dispatch.test.ts
index 174c54afa..d417fd5b4 100644
--- a/packages/compiler/test/llvm-lib-dispatch.test.ts
+++ b/packages/compiler/test/llvm-lib-dispatch.test.ts
@@ -19,7 +19,7 @@ const dyn = (): IrExpr => ({ kind: "dynFrom", value: str("value"), type: DYN, lo
 
 function libCallModule(fn: IrLibFn, args: IrExpr[], type: IrType): IrModule {
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "__main",
     functions: [
diff --git a/packages/compiler/test/llvm-runtime-abi.test.ts b/packages/compiler/test/llvm-runtime-abi.test.ts
index 9a7ccbb2f..6cfd862b7 100644
--- a/packages/compiler/test/llvm-runtime-abi.test.ts
+++ b/packages/compiler/test/llvm-runtime-abi.test.ts
@@ -176,7 +176,10 @@ async function readRuntimeHeader(
  * no linkage symbol the emitter could declare, so a declare against one
  * must report as missing. */
 async function parseHeader(): Promise<{ protos: Map<string, CProto>; dataSyms: Set<string> }> {
-  const raw = await readRuntimeHeader();
+  // The dynamic tier's units declare their entry points in scr_js.h, which
+  // static runtime units never include (packages/runtime/test/headers).
+  const seen = new Set<string>();
+  const raw = `${await readRuntimeHeader("scr_runtime.h", seen)}\n${await readRuntimeHeader("scr_js.h", seen)}`;
   const src = raw
     .replace(/\\\r?\n/g, "")
     .replace(/\/\*[\s\S]*?\*\//g, " ")
@@ -192,6 +195,12 @@ async function parseHeader(): Promise<{ protos: Map<string, CProto>; dataSyms: S
   for (const m of src.matchAll(/typedef\s+[^;{()]*\(\s*\*\s*([A-Za-z_][A-Za-z0-9_]*)\s*\)\s*\(/g)) {
     ptrTypedefs.add(m[1]!);
   }
+  // Object-pointer typedefs (ScrJsVal).
+  for (const m of src.matchAll(
+    /typedef\s+[A-Za-z_][A-Za-z0-9_ ]*\*\s*([A-Za-z_][A-Za-z0-9_]*)\s*;/g,
+  )) {
+    ptrTypedefs.add(m[1]!);
+  }
   const types: HeaderTypes = { enums, ptrTypedefs };
   const protos = new Map<string, CProto>();
   for (const m of src.matchAll(/\b(scr_[a-z0-9_]+)\s*\(/g)) {
diff --git a/packages/compiler/test/local-class-private-boundaries.test.ts b/packages/compiler/test/local-class-private-boundaries.test.ts
new file mode 100644
index 000000000..fdbe2e8f8
--- /dev/null
+++ b/packages/compiler/test/local-class-private-boundaries.test.ts
@@ -0,0 +1,63 @@
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { expect, test } from "vitest";
+import { analyze } from "../src/index.js";
+
+function refusals(file: string, source: string): string[] {
+  const dir = mkdtempSync(join(tmpdir(), "scriptc-local-class-private-"));
+  try {
+    const entry = join(dir, file);
+    writeFileSync(entry, source);
+    const { coverage } = analyze(entry);
+    return [...coverage.diagnostics, ...(coverage.runtimeFences ?? [])].map((d) => d.message);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+// Function-local JavaScript classes compile private fields used only on
+// `this` when the class is a named declaration: each evaluation's prototype
+// methods check the receiver's evaluation against that binding. Private
+// methods and accessors, class expressions, private names on other objects,
+// and TypeScript classes keep the refusal.
+test.each([
+  [
+    "a private method",
+    "main.js",
+    "function make() { class Box { #read() { return 1; } read() { return this.#read(); } } return new Box(); } console.log(make().read());",
+  ],
+  [
+    "a private accessor",
+    "main.js",
+    "function make() { class Box { get #value() { return 1; } read() { return this.#value; } } return new Box(); } console.log(make().read());",
+  ],
+  [
+    "a class expression",
+    "main.js",
+    "function make() { const Box = class { #value = 1; read() { return this.#value; } }; return new Box(); } console.log(make().read());",
+  ],
+  [
+    "a private name on another object",
+    "main.js",
+    "function make() { class Box { #value = 1; has(other) { return #value in other; } } return new Box(); } console.log(make().has({}));",
+  ],
+  [
+    "a TypeScript class",
+    "main.ts",
+    "function make() { class Box { #value = 1; read(): number { return this.#value; } } return new Box(); } console.log(make().read());",
+  ],
+] as const)("function-local private names keep the refusal with %s", (_name, file, source) => {
+  expect(refusals(file, source)).toContainEqual(
+    expect.stringContaining("function-local classes with private brands"),
+  );
+});
+
+test("function-local private fields used on this compile", () => {
+  expect(
+    refusals(
+      "main.js",
+      "function make() { class Box { #value = 1; read() { return this.#value; } has() { return #value in this; } } return new Box(); } const box = make(); console.log(box.read(), box.has());",
+    ),
+  ).toEqual([]);
+});
diff --git a/packages/compiler/test/string-accumulation-emission.test.ts b/packages/compiler/test/string-accumulation-emission.test.ts
index 36652c912..c58c8c0e3 100644
--- a/packages/compiler/test/string-accumulation-emission.test.ts
+++ b/packages/compiler/test/string-accumulation-emission.test.ts
@@ -86,7 +86,7 @@ function fixture(): IrModule {
     .find((fn) => fn.name === "negative")!
     .body.splice(1, 0, { kind: "varDecl", localId: "other", init: str("other"), loc });
   return {
-    irVersion: 16,
+    irVersion: 17,
     sourceFile: loc.file,
     entry: "__main",
     globals: [{ id: "%g.e.acc", name: "globalAccumulator", type: STRING, mutable: true }],
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/1112-number-methods.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/1112-number-methods.ts.json
new file mode 100644
index 000000000..c95861fe3
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/1112-number-methods.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/1112-number-methods.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/5639-union-arm-by-discriminant.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/5639-union-arm-by-discriminant.ts.json
new file mode 100644
index 000000000..58a162c8f
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/5639-union-arm-by-discriminant.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/5639-union-arm-by-discriminant.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/5640-generic-structural-class-narrowing.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/5640-generic-structural-class-narrowing.ts.json
new file mode 100644
index 000000000..091c37141
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/5640-generic-structural-class-narrowing.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/5640-generic-structural-class-narrowing.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/5730-thread-slots-widened-values.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/5730-thread-slots-widened-values.ts.json
new file mode 100644
index 000000000..001c7ea32
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/5730-thread-slots-widened-values.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/5730-thread-slots-widened-values.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6023-string-compare-utf16.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6023-string-compare-utf16.ts.json
new file mode 100644
index 000000000..365709f61
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6023-string-compare-utf16.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6023-string-compare-utf16.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6061-type-only-class-fields/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6061-type-only-class-fields/main.ts.json
new file mode 100644
index 000000000..68bdcec61
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6061-type-only-class-fields/main.ts.json
@@ -0,0 +1,7 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6061-type-only-class-fields/holder.ts",
+  "<repo>/tests/corpus/6061-type-only-class-fields/main.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6063-union-class-field-checks.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6063-union-class-field-checks.ts.json
new file mode 100644
index 000000000..9e48b2910
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6063-union-class-field-checks.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6063-union-class-field-checks.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6064-protocol-subinterface-assertions.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6064-protocol-subinterface-assertions.ts.json
new file mode 100644
index 000000000..e81d7e9e7
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6064-protocol-subinterface-assertions.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6064-protocol-subinterface-assertions.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6077-generator-helpers-untyped.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6077-generator-helpers-untyped.js.json
new file mode 100644
index 000000000..3d3c69f19
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6077-generator-helpers-untyped.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6077-generator-helpers-untyped.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6078-destructure-untyped-iterables.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6078-destructure-untyped-iterables.js.json
new file mode 100644
index 000000000..6feb69d8e
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6078-destructure-untyped-iterables.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6078-destructure-untyped-iterables.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6079-generator-helpers-any.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6079-generator-helpers-any.ts.json
new file mode 100644
index 000000000..3d94dc336
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6079-generator-helpers-any.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6079-generator-helpers-any.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6080-take-then-flatmap.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6080-take-then-flatmap.ts.json
new file mode 100644
index 000000000..ff4454b22
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6080-take-then-flatmap.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6080-take-then-flatmap.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6146-jsval-operators.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6146-jsval-operators.js.json
new file mode 100644
index 000000000..f3c7509d3
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6146-jsval-operators.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6146-jsval-operators.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6147-jsval-any-operators.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6147-jsval-any-operators.ts.json
new file mode 100644
index 000000000..5abd88146
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6147-jsval-any-operators.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6147-jsval-any-operators.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6200-string-annexb-locale-methods.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6200-string-annexb-locale-methods.ts.json
new file mode 100644
index 000000000..17a5c1e30
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6200-string-annexb-locale-methods.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6200-string-annexb-locale-methods.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6201-number-precision-exponential.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6201-number-precision-exponential.ts.json
new file mode 100644
index 000000000..b80384ada
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6201-number-precision-exponential.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6201-number-precision-exponential.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6202-dyn-string-number-methods.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6202-dyn-string-number-methods.js.json
new file mode 100644
index 000000000..dbf5146ed
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6202-dyn-string-number-methods.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6202-dyn-string-number-methods.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6203-any-string-number-methods.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6203-any-string-number-methods.ts.json
new file mode 100644
index 000000000..42b17b7bb
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6203-any-string-number-methods.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6203-any-string-number-methods.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6204-crypto-get-random-values.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6204-crypto-get-random-values.ts.json
new file mode 100644
index 000000000..86fcbcf58
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6204-crypto-get-random-values.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6204-crypto-get-random-values.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6205-crypto-get-random-values.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6205-crypto-get-random-values.js.json
new file mode 100644
index 000000000..42d90fd62
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6205-crypto-get-random-values.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6205-crypto-get-random-values.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6206-buffer-is-buffer-views.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6206-buffer-is-buffer-views.ts.json
new file mode 100644
index 000000000..7a9c25279
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6206-buffer-is-buffer-views.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6206-buffer-is-buffer-views.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6207-fs-constants-object.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6207-fs-constants-object.ts.json
new file mode 100644
index 000000000..6f24442b0
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6207-fs-constants-object.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6207-fs-constants-object.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6208-fs-constants-require.cjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6208-fs-constants-require.cjs.json
new file mode 100644
index 000000000..eac8fa544
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6208-fs-constants-require.cjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6208-fs-constants-require.cjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6209-buffer-module-alias.cjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6209-buffer-module-alias.cjs.json
new file mode 100644
index 000000000..3d3c194b2
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6209-buffer-module-alias.cjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6209-buffer-module-alias.cjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6210-typeof-global-static-members.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6210-typeof-global-static-members.js.json
new file mode 100644
index 000000000..33ccb2715
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6210-typeof-global-static-members.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6210-typeof-global-static-members.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6231-process-emit-warning-assign.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6231-process-emit-warning-assign.ts.json
new file mode 100644
index 000000000..ac7be42ac
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6231-process-emit-warning-assign.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6231-process-emit-warning-assign.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6232-process-builtin-module-typed/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6232-process-builtin-module-typed/main.ts.json
new file mode 100644
index 000000000..8adab38b7
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6232-process-builtin-module-typed/main.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6232-process-builtin-module-typed/main.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6233-for-await-class-async-generator.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6233-for-await-class-async-generator.ts.json
new file mode 100644
index 000000000..89f131b0f
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6233-for-await-class-async-generator.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6233-for-await-class-async-generator.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6234-weak-collection-class-fields.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6234-weak-collection-class-fields.ts.json
new file mode 100644
index 000000000..e7e18883a
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6234-weak-collection-class-fields.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6234-weak-collection-class-fields.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6235-bare-builtin-shadowed-package/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6235-bare-builtin-shadowed-package/main.ts.json
new file mode 100644
index 000000000..eee3db81a
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6235-bare-builtin-shadowed-package/main.ts.json
@@ -0,0 +1,7 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6235-bare-builtin-shadowed-package/helper.cjs",
+  "<repo>/tests/corpus/6235-bare-builtin-shadowed-package/main.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6236-stdin-encoding-tty-probes/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6236-stdin-encoding-tty-probes/main.ts.json
new file mode 100644
index 000000000..c7546dd63
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6236-stdin-encoding-tty-probes/main.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6236-stdin-encoding-tty-probes/main.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6237-error-subclass-delete-stack/main.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6237-error-subclass-delete-stack/main.js.json
new file mode 100644
index 000000000..a48385871
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6237-error-subclass-delete-stack/main.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6237-error-subclass-delete-stack/main.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6260-js-var-dyn-identity.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6260-js-var-dyn-identity.js.json
new file mode 100644
index 000000000..bcd9bcf0f
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6260-js-var-dyn-identity.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6260-js-var-dyn-identity.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6261-js-destructure-for-of-identity.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6261-js-destructure-for-of-identity.js.json
new file mode 100644
index 000000000..3733ef399
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6261-js-destructure-for-of-identity.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6261-js-destructure-for-of-identity.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6262-js-file-scope-var-identity.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6262-js-file-scope-var-identity.js.json
new file mode 100644
index 000000000..2db0c3083
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6262-js-file-scope-var-identity.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6262-js-file-scope-var-identity.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6263-js-factory-return-identity.cjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6263-js-factory-return-identity.cjs.json
new file mode 100644
index 000000000..d0e4d3fcb
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6263-js-factory-return-identity.cjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6263-js-factory-return-identity.cjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6291-webcrypto-hmac-sign-verify.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6291-webcrypto-hmac-sign-verify.ts.json
new file mode 100644
index 000000000..6b7a65b24
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6291-webcrypto-hmac-sign-verify.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6291-webcrypto-hmac-sign-verify.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6292-webcrypto-hmac-errors.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6292-webcrypto-hmac-errors.ts.json
new file mode 100644
index 000000000..a1b096f32
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6292-webcrypto-hmac-errors.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6292-webcrypto-hmac-errors.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6293-webcrypto-digest.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6293-webcrypto-digest.ts.json
new file mode 100644
index 000000000..7200349f0
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6293-webcrypto-digest.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6293-webcrypto-digest.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6294-webcrypto-js-values.mjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6294-webcrypto-js-values.mjs.json
new file mode 100644
index 000000000..c68b4b49c
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6294-webcrypto-js-values.mjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6294-webcrypto-js-values.mjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6295-jose-hs256/main.mjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6295-jose-hs256/main.mjs.json
new file mode 100644
index 000000000..286b2c4bf
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6295-jose-hs256/main.mjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6295-jose-hs256/main.mjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6296-array-position-patterns.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6296-array-position-patterns.ts.json
new file mode 100644
index 000000000..05d9557e7
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6296-array-position-patterns.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6296-array-position-patterns.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6297-library-runtime-idioms.mjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6297-library-runtime-idioms.mjs.json
new file mode 100644
index 000000000..3c3818490
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6297-library-runtime-idioms.mjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6297-library-runtime-idioms.mjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6331-jose-root-entry/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6331-jose-root-entry/main.ts.json
new file mode 100644
index 000000000..ad7513645
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6331-jose-root-entry/main.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6331-jose-root-entry/main.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6332-fluent-this-declaration/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6332-fluent-this-declaration/main.ts.json
new file mode 100644
index 000000000..d848dd493
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6332-fluent-this-declaration/main.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6332-fluent-this-declaration/main.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6333-fluent-this-declaration-js/main.mjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6333-fluent-this-declaration-js/main.mjs.json
new file mode 100644
index 000000000..4bde02942
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6333-fluent-this-declaration-js/main.mjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6333-fluent-this-declaration-js/main.mjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6334-discarded-logical-statements.mjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6334-discarded-logical-statements.mjs.json
new file mode 100644
index 000000000..e510d9e2c
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6334-discarded-logical-statements.mjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6334-discarded-logical-statements.mjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6335-discarded-logical-statements.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6335-discarded-logical-statements.ts.json
new file mode 100644
index 000000000..fd7b159a5
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6335-discarded-logical-statements.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6335-discarded-logical-statements.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6340-prototype-reflection-optional-view-param.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6340-prototype-reflection-optional-view-param.ts.json
new file mode 100644
index 000000000..89aef0f85
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6340-prototype-reflection-optional-view-param.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6340-prototype-reflection-optional-view-param.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6341-throw-array-identity.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6341-throw-array-identity.ts.json
new file mode 100644
index 000000000..b2ecfcfa8
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6341-throw-array-identity.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6341-throw-array-identity.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6342-throw-builtin-identity.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6342-throw-builtin-identity.ts.json
new file mode 100644
index 000000000..09b036461
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6342-throw-builtin-identity.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6342-throw-builtin-identity.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6345-inspect-dyn-holes.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6345-inspect-dyn-holes.ts.json
new file mode 100644
index 000000000..d9027a759
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6345-inspect-dyn-holes.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6345-inspect-dyn-holes.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6350-globalthis-assertion-state.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6350-globalthis-assertion-state.ts.json
new file mode 100644
index 000000000..e4f556b43
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6350-globalthis-assertion-state.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6350-globalthis-assertion-state.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6352-globalthis-state-modules/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6352-globalthis-state-modules/main.ts.json
new file mode 100644
index 000000000..2d11062c1
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6352-globalthis-state-modules/main.ts.json
@@ -0,0 +1,8 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6352-globalthis-state-modules/boot.ts",
+  "<repo>/tests/corpus/6352-globalthis-state-modules/state.ts",
+  "<repo>/tests/corpus/6352-globalthis-state-modules/main.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6416-tls-session-reused.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6416-tls-session-reused.ts.json
new file mode 100644
index 000000000..8b84ce6d3
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6416-tls-session-reused.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6416-tls-session-reused.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6417-object-assign-class-target.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6417-object-assign-class-target.ts.json
new file mode 100644
index 000000000..5832b91f9
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6417-object-assign-class-target.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6417-object-assign-class-target.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6418-nullish-assign-index-record.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6418-nullish-assign-index-record.ts.json
new file mode 100644
index 000000000..7a030cd19
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/6418-nullish-assign-index-record.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/6418-nullish-assign-index-record.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/bound-constructor-inspect-names.cjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/bound-constructor-inspect-names.cjs.json
new file mode 100644
index 000000000..b6046aead
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/bound-constructor-inspect-names.cjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/bound-constructor-inspect-names.cjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/builtin-function-record-values/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/builtin-function-record-values/main.ts.json
new file mode 100644
index 000000000..eb79fc63a
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/builtin-function-record-values/main.ts.json
@@ -0,0 +1,7 @@
+{
+ "order": [
+  "<repo>/tests/corpus/builtin-function-record-values/native.js",
+  "<repo>/tests/corpus/builtin-function-record-values/main.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/builtin-function-values.mjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/builtin-function-values.mjs.json
new file mode 100644
index 000000000..f13bd6642
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/builtin-function-values.mjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/builtin-function-values.mjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/cjs-class-hierarchy-npm/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/cjs-class-hierarchy-npm/main.ts.json
new file mode 100644
index 000000000..f44d1965c
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/cjs-class-hierarchy-npm/main.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/cjs-class-hierarchy-npm/main.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/cjs-open-options-npm/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/cjs-open-options-npm/main.ts.json
new file mode 100644
index 000000000..3c3043a09
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/cjs-open-options-npm/main.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/cjs-open-options-npm/main.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/cjs-strict-arguments.cjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/cjs-strict-arguments.cjs.json
new file mode 100644
index 000000000..4e52c7e57
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/cjs-strict-arguments.cjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/cjs-strict-arguments.cjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/cjs-symbol-key-collisions/main.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/cjs-symbol-key-collisions/main.js.json
new file mode 100644
index 000000000..205da46f3
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/cjs-symbol-key-collisions/main.js.json
@@ -0,0 +1,10 @@
+{
+ "order": [
+  "<repo>/tests/corpus/cjs-symbol-key-collisions/core-symbols.js",
+  "<repo>/tests/corpus/cjs-symbol-key-collisions/client.js",
+  "<repo>/tests/corpus/cjs-symbol-key-collisions/mock-symbols.js",
+  "<repo>/tests/corpus/cjs-symbol-key-collisions/mock-client.js",
+  "<repo>/tests/corpus/cjs-symbol-key-collisions/main.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/cjs-symbol-key-table/main.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/cjs-symbol-key-table/main.js.json
new file mode 100644
index 000000000..3975cce3a
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/cjs-symbol-key-table/main.js.json
@@ -0,0 +1,9 @@
+{
+ "order": [
+  "<repo>/tests/corpus/cjs-symbol-key-table/symbols.js",
+  "<repo>/tests/corpus/cjs-symbol-key-table/queue.js",
+  "<repo>/tests/corpus/cjs-symbol-key-table/upper-queue.js",
+  "<repo>/tests/corpus/cjs-symbol-key-table/main.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/cjs-unmapped-arguments.cjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/cjs-unmapped-arguments.cjs.json
new file mode 100644
index 000000000..bff6dd797
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/cjs-unmapped-arguments.cjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/cjs-unmapped-arguments.cjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-chained-this.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-chained-this.js.json
new file mode 100644
index 000000000..ad1317aa6
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-chained-this.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/constructor-returns-chained-this.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-chained-this.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-chained-this.ts.json
new file mode 100644
index 000000000..9fb2595c4
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-chained-this.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/constructor-returns-chained-this.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-instance.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-instance.js.json
new file mode 100644
index 000000000..a85c33c1a
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-instance.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/constructor-returns-instance.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-instance.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-instance.ts.json
new file mode 100644
index 000000000..e01b6a426
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-instance.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/constructor-returns-instance.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-this-super.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-this-super.js.json
new file mode 100644
index 000000000..fa81da713
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-this-super.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/constructor-returns-this-super.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/es5-constructor-inspect-names.cjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/es5-constructor-inspect-names.cjs.json
new file mode 100644
index 000000000..b5e8ba087
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/es5-constructor-inspect-names.cjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/es5-constructor-inspect-names.cjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/exponent-unit-base.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/exponent-unit-base.ts.json
new file mode 100644
index 000000000..b8de10f6a
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/exponent-unit-base.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/exponent-unit-base.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/function-local-detached-methods.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/function-local-detached-methods.js.json
new file mode 100644
index 000000000..9eb8fdf73
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/function-local-detached-methods.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/function-local-detached-methods.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/function-local-detached-methods.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/function-local-detached-methods.ts.json
new file mode 100644
index 000000000..6ef52390d
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/function-local-detached-methods.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/function-local-detached-methods.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/function-local-private-evaluations.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/function-local-private-evaluations.js.json
new file mode 100644
index 000000000..0216d2c2f
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/function-local-private-evaluations.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/function-local-private-evaluations.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/function-local-private-fields.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/function-local-private-fields.js.json
new file mode 100644
index 000000000..d63dfd6a6
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/function-local-private-fields.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/function-local-private-fields.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/key-order-late-optional.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/key-order-late-optional.ts.json
new file mode 100644
index 000000000..5975cbb40
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/key-order-late-optional.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/key-order-late-optional.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/key-order-literal-flows.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/key-order-literal-flows.ts.json
new file mode 100644
index 000000000..7b99fa5f6
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/key-order-literal-flows.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/key-order-literal-flows.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/key-order-spread-copies.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/key-order-spread-copies.ts.json
new file mode 100644
index 000000000..43b336a1b
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/key-order-spread-copies.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/key-order-spread-copies.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/let-uninitialized-function-binding.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/let-uninitialized-function-binding.ts.json
new file mode 100644
index 000000000..f5706acaa
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/let-uninitialized-function-binding.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/let-uninitialized-function-binding.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/logical-and-truthy-index.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/logical-and-truthy-index.ts.json
new file mode 100644
index 000000000..2e7388984
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/logical-and-truthy-index.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/logical-and-truthy-index.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/private-in-checked-primitives.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/private-in-checked-primitives.js.json
new file mode 100644
index 000000000..1e5b83999
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/private-in-checked-primitives.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/private-in-checked-primitives.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/constructor-returns-instance-super.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/constructor-returns-instance-super.ts.json
new file mode 100644
index 000000000..86b15f680
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/constructor-returns-instance-super.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/diagnostics/constructor-returns-instance-super.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/constructor-returns-object.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/constructor-returns-object.ts.json
new file mode 100644
index 000000000..f3415a937
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/constructor-returns-object.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/diagnostics/constructor-returns-object.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/object-assign-class-copy.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/object-assign-class-copy.ts.json
new file mode 100644
index 000000000..085f01796
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/object-assign-class-copy.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/diagnostics/object-assign-class-copy.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/retired-engine-1112-number-methods.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/retired-engine-1112-number-methods.ts.json
deleted file mode 100644
index 27b24a99a..000000000
--- a/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/retired-engine-1112-number-methods.ts.json
+++ /dev/null
@@ -1,6 +0,0 @@
-{
- "order": [
-  "<repo>/tests/diagnostics/retired-engine-1112-number-methods.ts"
- ],
- "diags": []
-}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/webcrypto-refusals.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/webcrypto-refusals.ts.json
new file mode 100644
index 000000000..5f9d95858
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/webcrypto-refusals.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/diagnostics/webcrypto-refusals.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/node-types/navigator.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/node-types/navigator.ts.json
new file mode 100644
index 000000000..27fe582a8
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/node-types/navigator.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/fixtures/node-types/navigator.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/node-types/tls-session-timings.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/node-types/tls-session-timings.ts.json
new file mode 100644
index 000000000..953193649
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/node-types/tls-session-timings.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/fixtures/node-types/tls-session-timings.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/node-types/webcrypto-hmac.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/node-types/webcrypto-hmac.ts.json
new file mode 100644
index 000000000..af889405d
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/fixtures/node-types/webcrypto-hmac.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/fixtures/node-types/webcrypto-hmac.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/parity.test.ts b/packages/compiler/test/ts7/parity.test.ts
index 872676c81..4904f2720 100644
--- a/packages/compiler/test/ts7/parity.test.ts
+++ b/packages/compiler/test/ts7/parity.test.ts
@@ -488,7 +488,7 @@ test("symbol declarations resolve back into the same client AST", () => {
   expect(sym7).toBeDefined();
   const aliased = w.c7.getAliasedSymbol(sym7!);
   expect(aliased.name).toBe("answer");
-  const declHandle = aliased.declarations[0];
+  const declHandle = aliased.declarationHandles[0];
   expect(declHandle).toBeDefined();
   const decl = declHandle!.resolve(w.p7.project);
   expect(decl).toBeDefined();
diff --git a/packages/compiler/test/ts7/rpc-api.test.ts b/packages/compiler/test/ts7/rpc-api.test.ts
index d323bd901..28b63ec34 100644
--- a/packages/compiler/test/ts7/rpc-api.test.ts
+++ b/packages/compiler/test/ts7/rpc-api.test.ts
@@ -2,7 +2,7 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { expect, test } from "vitest";
-import { API, type Snapshot } from "typescript/unstable/sync";
+import { API, type Snapshot, type Symbol as SdkSymbol } from "typescript/unstable/sync";
 import { Ts7Api, ts7Executable } from "../../src/frontend/ts7/rpc-api.js";
 import { Ts7RpcClient } from "../../src/frontend/ts7/rpc-client.js";
 import type { Ts7FileSystem } from "../../src/frontend/ts7/rpc-filesystem.js";
@@ -16,6 +16,15 @@ import {
   SemanticType,
 } from "../../src/frontend/ts7/semantic-model.js";
 
+// scriptc's symbols keep their declarations' node handles in
+// `declarationHandles`, and the SDK's in `declarations`.
+function declarationHandlesOf(symbol: SdkSymbol): SdkSymbol["declarations"] {
+  return (
+    (symbol as unknown as { declarationHandles?: SdkSymbol["declarations"] }).declarationHandles ??
+    symbol.declarations
+  );
+}
+
 function tsgoPath(path: string): string {
   return process.platform === "win32" ? path.replaceAll("\\", "/") : path;
 }
@@ -43,7 +52,7 @@ function programFacts(snapshot: Snapshot, config: string, path: string) {
     text: file.text,
     type: checker.typeToString(type),
     symbol: symbol.name,
-    declaration: symbol.declarations[0]!.resolve()!.getText(file),
+    declaration: declarationHandlesOf(symbol)[0]!.resolve()!.getText(file),
     syntactic: project.program.getSyntacticDiagnostics(path),
     semantic: project.program.getSemanticDiagnostics(path),
     globals: project.program.getGlobalDiagnostics(),
@@ -83,10 +92,10 @@ test("production RPC bridge preserves pinned SDK parser/checker behavior", () =>
     expect(project.checker.getTypeAtPosition(path, source.text.indexOf("answer"))).toBe(first);
     const symbol = project.checker.getSymbolAtPosition(path, source.text.indexOf("answer"));
     expect(symbol).toBeInstanceOf(SemanticSymbol);
-    expect(symbol!.declarations[0]).toBeInstanceOf(SemanticNodeHandle);
+    expect(symbol!.declarationHandles[0]).toBeInstanceOf(SemanticNodeHandle);
     expect(project.checker.getSymbolAtPosition(path, source.text.indexOf("answer"))).toBe(symbol);
-    expect(symbol!.declarations[0]!.resolve()).toBe(symbol!.declarations[0]!.resolve());
-    const declaration = symbol!.declarations[0]!.resolve()!;
+    expect(symbol!.declarationHandles[0]!.resolve()).toBe(symbol!.declarationHandles[0]!.resolve());
+    const declaration = symbol!.declarationHandles[0]!.resolve()!;
     expect(declaration).toBeInstanceOf(AstNode);
     const variable = source.statements
       .nodes[0]! as import("../../src/frontend/ts7/ast-types.js").VariableStatement;
@@ -205,9 +214,11 @@ test("native semantic registries preserve project scope and snapshot lifetimes",
         sharedSymbol: symbolA === symbolB,
         sharedType: typeA === typeB,
         sharedSignature: signatureA === signatureB,
-        sameDeclaration: symbolA.declarations[0]!.resolve() === symbolB.declarations[0]!.resolve(),
+        sameDeclaration:
+          declarationHandlesOf(symbolA)[0]!.resolve() ===
+          declarationHandlesOf(symbolB)[0]!.resolve(),
         explicitDeclaration:
-          symbolB.declarations[0]!.resolve(b) ===
+          declarationHandlesOf(symbolB)[0]!.resolve(b) ===
           nodesOf(
             (nodesOf(fileB.statements)[1] as import("typescript/unstable/ast").VariableStatement)
               .declarationList.declarations,
@@ -237,7 +248,7 @@ test("native semantic registries preserve project scope and snapshot lifetimes",
     expect(next.signatureA).not.toBe(actual.signatureA);
     first.dispose();
     expect(() => actual.typeA.getSymbol()).toThrow("disposed");
-    expect(() => actual.symbolA.declarations[0]!.resolve()).toThrow("disposed");
+    expect(() => declarationHandlesOf(actual.symbolA)[0]!.resolve()).toThrow("disposed");
     expect(next.signatureA.getParameters()[0]!.name).toBe("value");
     expect(second.getProject(firstConfig)!.checker.typeToString(next.typeA)).toBe("42");
     second.dispose();
diff --git a/packages/runtime-darwin-arm64/runtime-pack-matrix.mjs b/packages/runtime-darwin-arm64/runtime-pack-matrix.mjs
index 5eec9b142..3fdfd7ff5 100644
--- a/packages/runtime-darwin-arm64/runtime-pack-matrix.mjs
+++ b/packages/runtime-darwin-arm64/runtime-pack-matrix.mjs
@@ -1,5 +1,10 @@
 import { withWorkerRuntimeVariants } from "../runtime-pack-common/worker-matrix.mjs";
 import { withLibraryRuntimeFlavors } from "../runtime-pack-common/library-matrix.mjs";
+import {
+  BASE_RUNTIME_SOURCES,
+  OPTIONAL_RUNTIME_SOURCES,
+  variantsFor,
+} from "../runtime-pack-common/runtime-pack-matrix.mjs";
 
 /**
  * The executable runtime-pack matrix. This is the single source of truth for
@@ -9,45 +14,6 @@ import { withLibraryRuntimeFlavors } from "../runtime-pack-common/library-matrix
  */
 
 const any = (...features) => ({ any: features });
-const all = (...features) => ({ all: features });
-
-const BASE_RUNTIME_SOURCES = [
-  "scr_context.c",
-  "scr_shared.c",
-  "scr_number.c",
-  "scr_bigint.c",
-  "scr_string.c",
-  "scr_grapheme.c",
-  "scr_array.c",
-  "scr_bytes.c",
-  "scr_bytes_io.c",
-  "scr_fs_cp.c",
-  "scr_map.c",
-  "scr_closure.c",
-  "scr_ffi.c",
-  "scr_object.c",
-  "scr_union.c",
-  "scr_exception.c",
-  "scr_error.c",
-  "scr_console.c",
-  "scr_lib.c",
-  "scr_hash.c",
-  "scr_path.c",
-  "scr_os.c",
-  "scr_url.c",
-  "scr_url_params.c",
-  "scr_json.c",
-  "scr_node_builtin.c",
-  "scr_async.c",
-  "scr_crypto_async.c",
-  "scr_child.c",
-  "scr_cycle.c",
-  "scr_publish.c",
-  "scr_region.c",
-  "scr_itable.c",
-  "scr_slots.c",
-  "scr_alloc.c",
-];
 
 // ld64 dead-strips Mach-O symbol subsections without an ELF-style compile
 // flag. Keep this checked-in metadata alongside the matrix so pack build and
@@ -57,86 +23,6 @@ export const EXECUTABLE_SECTION_ELIMINATION = {
   link_flags: ["-Wl,-dead_strip"],
 };
 
-const optional = [
-  ["scr_copying.c", "copying"],
-  ["scr_file_handle.c", "fileHandle"],
-  ["scr_regex.c", "regex"],
-  ["scr_glob.c", "regex"],
-  ["scr_idna.c", "regex"],
-  ["scr_assert.c", any("assert", "regex", "symbol")],
-  ["scr_inspect.c", "inspect"],
-  ["scr_console_native.c", "inspect"],
-  ["scr_dyn_invoke.c", any("dynInvoke", "nativeFetch")],
-  ["scr_dc.c", "dc"],
-  ["scr_event_target.c", any("eventTarget", "nativeFetch")],
-  ["scr_async_dyn.c", any("dynAsync", "dynInvoke", "dc", "fileHandle", "nativeFetch")],
-  // The performance timeline emits its buffer warning through scr_async_dyn.c.
-  ["scr_perf.c", "dynAsync"],
-  // Blob and File box their reads as dyn promises through scr_async_dyn.c.
-  ["scr_blob.c", "dynAsync"],
-  ["scr_zlib.c", "zlib"],
-  ["scr_events.c", "events"],
-  ["scr_readline.c", "events"],
-  ["scr_readline_tty.c", all("events", "regex")],
-  ["scr_events_emitter.c", "emitter"],
-  ["scr_dyn_handle.c", any("emitter", "netEffective")],
-  ["scr_symbol.c", "symbol"],
-  ["scr_bigint_assert.c", all("assert", "bigint")],
-  ["scr_qs.c", "qs"],
-  // The legacy url unit lowercases and normalizes through the regex unit
-  // and warns through the dyn-async one.
-  ["scr_url_legacy.c", all("regex", "qs", "dynAsync")],
-  ["scr_util.c", "parseArgs"],
-  // Utility objects must only reference runtime families selected with them.
-  ["scr_util_compare.c", all("parseArgs", "symbol")],
-  ["scr_util_style.c", all("parseArgs", "inspect", "dynAsync")],
-  ["scr_util_callable.c", all("parseArgs", "inspect", "dynAsync", "dynInvoke", "regex")],
-  ["scr_stream.c", "stream"],
-  // The zlib stream classes reference both the zlib engine and the stream unit.
-  ["scr_zlib_stream.c", all("zlib", "stream")],
-  // The Readable operators await through the dyn-async unit.
-  ["scr_stream_ops.c", all("stream", "dynAsync")],
-  // fs.ReadStream / fs.WriteStream reference only the stream unit and base units.
-  ["scr_fs_stream.c", "stream"],
-  // FileHandle streams reference both the stream unit and FileHandle.
-  ["scr_fs_stream_fh.c", all("stream", "fileHandle")],
-  ["scr_loop_kqueue.c", any("netEffective", "dgram")],
-  ["scr_loop_epoll.c", any("netEffective", "dgram")],
-  ["scr_loop_wsapoll.c", any("netEffective", "dgram")],
-  ["scr_net.c", "netEffective"],
-  ["scr_http.c", "httpEffective"],
-  ["scr_http2.c", "http2"],
-  ["scr_dgram.c", "dgram"],
-  ["scr_watch.c", "watch"],
-  ["scr_ffi_queue.c", "foreignFfi"],
-  ["scr_test.c", "nodeTest"],
-  ["scr_tls_ca.c", "tlsCaEffective"],
-  ["scr_tls.c", "tlsEffective"],
-  ["scr_cipher.c", "cipher"],
-  ["scr_fetch.c", "nativeFetch"],
-];
-
-function variantsFor(source) {
-  const variants = [{ id: "default", when: {}, defines: [] }];
-  if (source === "scr_bytes.c") {
-    variants.push({
-      id: "text-decoder-legacy",
-      when: { textDecoderLegacy: true },
-      defines: ["SCR_TEXT_DECODER_LEGACY"],
-    });
-  }
-  if (source === "scr_cycle.c") {
-    // The young-in nursery (SCRIPTC_YOUNG_NURSERY=1): the collector with
-    // nursery collections; programs built without it link the default.
-    variants.push({
-      id: "young-nursery",
-      when: { youngNursery: true },
-      defines: ["SCR_YIN"],
-    });
-  }
-  return variants;
-}
-
 export const RUNTIME_PACK_MATRIX = withLibraryRuntimeFlavors(
   withWorkerRuntimeVariants({
     schema: "scriptc.runtime-pack-matrix.v1",
@@ -151,7 +37,7 @@ export const RUNTIME_PACK_MATRIX = withLibraryRuntimeFlavors(
     executable_section_elimination: EXECUTABLE_SECTION_ELIMINATION,
     runtime_units: [
       ...BASE_RUNTIME_SOURCES.map((source) => ({ source, predicate: true })),
-      ...optional.map(([source, predicate]) => ({ source, predicate })),
+      ...OPTIONAL_RUNTIME_SOURCES.map(([source, predicate]) => ({ source, predicate })),
     ].map((unit) => ({ ...unit, variants: variantsFor(unit.source) })),
     archives: [
       { id: "quickjs", predicate: false },
diff --git a/packages/runtime-darwin-arm64/scripts/build.mjs b/packages/runtime-darwin-arm64/scripts/build.mjs
index 18ee441e6..dbde1564f 100644
--- a/packages/runtime-darwin-arm64/scripts/build.mjs
+++ b/packages/runtime-darwin-arm64/scripts/build.mjs
@@ -343,7 +343,12 @@ async function build() {
         ...(unitHelper === null ? {} : { speed_codegen: unitHelper.identity }),
       },
       macros: {
-        executable: ["SCR_TEXT_DECODER_LEGACY", "SCR_YIN"],
+        executable: [
+          "SCR_TEXT_DECODER_LEGACY",
+          "SCR_WARNING_REPLACE",
+          "SCR_STDIO_EXTENDED",
+          "SCR_YIN",
+        ],
         excluded: ["SCR_RC_AUDIT", "SCR_ASAN_FIBERS"],
         sanitizer: "external-toolchain-required",
       },
diff --git a/packages/runtime-pack-common/library-matrix.mjs b/packages/runtime-pack-common/library-matrix.mjs
index 106950941..e42d8874c 100644
--- a/packages/runtime-pack-common/library-matrix.mjs
+++ b/packages/runtime-pack-common/library-matrix.mjs
@@ -15,6 +15,7 @@ export function withLibraryRuntimeFlavors(matrix) {
     "scr_zlib.c",
     "scr_copying.c",
     "scr_dyn_invoke.c",
+    "scr_js_value.c",
   ]);
   const libraryUnits = [
     ...matrix.runtime_units.filter(
diff --git a/packages/runtime-pack-common/runtime-pack-matrix.mjs b/packages/runtime-pack-common/runtime-pack-matrix.mjs
index eab680a55..1e959eccc 100644
--- a/packages/runtime-pack-common/runtime-pack-matrix.mjs
+++ b/packages/runtime-pack-common/runtime-pack-matrix.mjs
@@ -9,7 +9,11 @@ import { withLibraryRuntimeFlavors } from "./library-matrix.mjs";
 const any = (...features) => ({ any: features });
 const all = (...features) => ({ all: features });
 
-const BASE_RUNTIME_SOURCES = [
+/* Every runtime pack matrix uses these lists, so a new runtime source is
+ * one line here. Their order is the link order of the units an executable
+ * selects: keep a new unit next to the units it references, and treat any
+ * reordering as a change to every executable's layout. */
+export const BASE_RUNTIME_SOURCES = [
   "scr_context.c",
   "scr_shared.c",
   "scr_number.c",
@@ -47,7 +51,7 @@ const BASE_RUNTIME_SOURCES = [
   "scr_alloc.c",
 ];
 
-const OPTIONAL = [
+export const OPTIONAL_RUNTIME_SOURCES = [
   ["scr_copying.c", "copying"],
   ["scr_file_handle.c", "fileHandle"],
   ["scr_regex.c", "regex"],
@@ -58,6 +62,9 @@ const OPTIONAL = [
   ["scr_console_native.c", "inspect"],
   ["scr_dyn_invoke.c", any("dynInvoke", "nativeFetch")],
   ["scr_dc.c", "dc"],
+  // The dynamic tier's jsval values (two-tier design I3): linked only into
+  // programs whose IR has dynamic-tier operations.
+  ["scr_js_value.c", "dynTier"],
   ["scr_event_target.c", any("eventTarget", "nativeFetch")],
   ["scr_async_dyn.c", any("dynAsync", "dynInvoke", "dc", "fileHandle", "nativeFetch")],
   // The performance timeline emits its buffer warning through scr_async_dyn.c.
@@ -103,10 +110,11 @@ const OPTIONAL = [
   ["scr_tls_ca.c", "tlsCaEffective"],
   ["scr_tls.c", "tlsEffective"],
   ["scr_cipher.c", "cipher"],
+  ["scr_webcrypto.c", "webcrypto"],
   ["scr_fetch.c", "nativeFetch"],
 ];
 
-function variantsFor(source) {
+export function variantsFor(source) {
   const variants = [{ id: "default", when: {}, defines: [] }];
   if (source === "scr_bytes.c") {
     variants.push({
@@ -115,6 +123,23 @@ function variantsFor(source) {
       defines: ["SCR_TEXT_DECODER_LEGACY"],
     });
   }
+  // Programs that assign process.emitWarning link the replacement-aware
+  // warning paths; every other program keeps the default object.
+  if (source === "scr_async_dyn.c") {
+    variants.push({
+      id: "warning-replace",
+      when: { warningReplace: true },
+      defines: ["SCR_WARNING_REPLACE"],
+    });
+  }
+  // stdin setEncoding, string data listeners and stdio 'resize' events.
+  if (source === "scr_events.c") {
+    variants.push({
+      id: "stdio-extended",
+      when: { stdioExtended: true },
+      defines: ["SCR_STDIO_EXTENDED"],
+    });
+  }
   if (source === "scr_cycle.c") {
     // The young-in nursery (SCRIPTC_YOUNG_NURSERY=1): the collector with
     // nursery collections; programs built without it link the default.
@@ -154,7 +179,7 @@ export function createRuntimePackMatrix({
           (source) => ({ source, predicate: true }),
         ),
         ...extraRuntimeSources.map((source) => ({ source, predicate: true })),
-        ...OPTIONAL.filter(([source]) => !omitOptionalSources.includes(source)).map(
+        ...OPTIONAL_RUNTIME_SOURCES.filter(([source]) => !omitOptionalSources.includes(source)).map(
           ([source, predicate]) => ({ source, predicate }),
         ),
       ].map((unit) => ({ ...unit, variants: variantsFor(unit.source) })),
diff --git a/packages/runtime-pack-common/scripts/build.mjs b/packages/runtime-pack-common/scripts/build.mjs
index 1bcd7455d..a0f117cec 100644
--- a/packages/runtime-pack-common/scripts/build.mjs
+++ b/packages/runtime-pack-common/scripts/build.mjs
@@ -440,7 +440,12 @@ async function build() {
         ...(unitHelper === null ? {} : { speed_codegen: unitHelper.identity }),
       },
       macros: {
-        executable: ["SCR_TEXT_DECODER_LEGACY", "SCR_YIN"],
+        executable: [
+          "SCR_TEXT_DECODER_LEGACY",
+          "SCR_WARNING_REPLACE",
+          "SCR_STDIO_EXTENDED",
+          "SCR_YIN",
+        ],
         excluded: ["SCR_RC_AUDIT", "SCR_ASAN_FIBERS"],
         sanitizer: "external-toolchain-required",
       },
diff --git a/packages/runtime/src/scr_async.h b/packages/runtime/src/scr_async.h
index d16fd8b9c..6f56758ce 100644
--- a/packages/runtime/src/scr_async.h
+++ b/packages/runtime/src/scr_async.h
@@ -216,6 +216,12 @@ void scr_process_on_warning(ScrDyn *fn);
 void scr_process_off_warning(ScrDyn *fn);
 void scr_process_emit_warning(ScrDyn *args);
 void scr_emit_warning(const char *name, const char *code, ScrStr *message);
+/* process.emitWarning = fn (borrowed; the runtime keeps its own
+ * reference). Later process.emitWarning(...) calls apply the replacement
+ * to their arguments, and runtime-built warnings (Node's own modules call
+ * process.emitWarning) reach it as (message, type[, code]) instead of the
+ * report and the 'warning' listeners. */
+void scr_process_set_emit_warning(ScrDyn *fn);
 /* node:punycode's first load (scr_async_dyn.c): later calls are module
  * cache hits. The first reports DEP0040 when `report` (false for a require
  * made from node_modules) — at once for a static ES import, which Node
diff --git a/packages/runtime/src/scr_async_dyn.c b/packages/runtime/src/scr_async_dyn.c
index dbddc5b18..1cdd466c3 100644
--- a/packages/runtime/src/scr_async_dyn.c
+++ b/packages/runtime/src/scr_async_dyn.c
@@ -822,10 +822,59 @@ ScrDyn *scr_warning_new(ScrStr *message, const char *type, const ScrStr *code) {
   return w;
 }
 
+#ifdef SCR_WARNING_REPLACE
+/* The program's process.emitWarning replacement, or NULL while the
+ * property holds Node's own function. Compiled only into the
+ * SCR_WARNING_REPLACE variant, which programs assigning process.emitWarning
+ * link: every other executable keeps the plain warning paths. */
+static SCR_TL ScrDyn *scr_emit_warning_override = NULL;
+
+static void scr_emit_warning_override_teardown(void) {
+  scr_dyn_release(scr_emit_warning_override);
+  scr_emit_warning_override = NULL;
+}
+
+void scr_process_set_emit_warning(ScrDyn *fn) {
+  if (scr_emit_warning_override == NULL) scr_atexit(scr_emit_warning_override_teardown);
+  ScrDyn *previous = scr_emit_warning_override;
+  scr_emit_warning_override = scr_dyn_retain(fn);
+  scr_dyn_release(previous);
+  /* Units that report their own warnings without a listener route them
+   * here once a replacement exists. */
+  scr_warning_emit_hook = scr_emit_warning;
+}
+
+/* A runtime-built warning while a replacement is installed: Node's modules
+ * call process.emitWarning(message, type, code), so the replacement sees
+ * those arguments; nothing is reported. A throw stays pending. */
+static void scr_emit_warning_replaced(ScrStr *message, ScrStr *type, ScrStr *code) {
+  ScrDyn *args[3];
+  size_t argc = 0;
+  args[argc++] = scr_dyn_new_str(message);
+  ScrStr *fallback = type ? NULL : scr_str_new("Warning", 7);
+  args[argc++] = scr_dyn_new_str(type ? type : fallback);
+  scr_str_release(fallback);
+  if (code) args[argc++] = scr_dyn_new_str(code);
+  ScrDyn *r = scr_dyn_call(scr_emit_warning_override, args, argc, "process.emitWarning");
+  scr_dyn_release(r);
+  for (size_t i = 0; i < argc; i++) scr_dyn_release(args[i]);
+}
+#endif /* SCR_WARNING_REPLACE */
+
 /* A warning built from C parts (the runtime deprecation sites): name
  * defaults to "Warning"; code/detail optional. Reported synchronously.
  * Borrows message. */
 void scr_emit_warning(const char *name, const char *code, ScrStr *message) {
+#ifdef SCR_WARNING_REPLACE
+  if (scr_emit_warning_override != NULL) {
+    ScrStr *type_text = scr_str_new(name ? name : "Warning", strlen(name ? name : "Warning"));
+    ScrStr *code_text = code ? scr_str_new(code, strlen(code)) : NULL;
+    scr_emit_warning_replaced(message, type_text, code_text);
+    scr_str_release(type_text);
+    scr_str_release(code_text);
+    return;
+  }
+#endif
   ScrStr *code_text = code ? scr_str_new(code, strlen(code)) : NULL;
   ScrDyn *w = scr_warning_new(message, name ? name : "Warning", code_text);
   scr_str_release(code_text);
@@ -856,6 +905,18 @@ static void scr_warning_defer(ScrDyn *w, void (*fire)(ScrClosure *)) {
 }
 
 void scr_warning_emit_deferred(ScrDyn *w) {
+#ifdef SCR_WARNING_REPLACE
+  if (scr_emit_warning_override != NULL) {
+    const ScrDyn *em = scr_dyn_obj_get(w, "message", 7);
+    const ScrDyn *ec = scr_dyn_obj_get(w, "code", 4);
+    ScrStr *name = scr_warning_name(w);
+    ScrStr *message = em && em->kind == SCR_DYN_STR ? scr_str_retain(em->v.str) : scr_str_new("", 0);
+    scr_emit_warning_replaced(message, name, ec && ec->kind == SCR_DYN_STR ? ec->v.str : NULL);
+    scr_str_release(message);
+    scr_str_release(name);
+    return;
+  }
+#endif
   if (scr_warning_is_deprecation(w)) {
     if (scr_process_deprecation_flag_on(0)) return;
     if (scr_process_deprecation_flag_on(1)) {
@@ -942,6 +1003,13 @@ static void scr_warn_bad_arg(const char *arg, const char *want) {
  * ERR_INVALID_ARG_TYPE TypeErrors at the call; non-string details are
  * ignored. The warning itself is emitted on the next tick. */
 void scr_process_emit_warning(ScrDyn *args) {
+#ifdef SCR_WARNING_REPLACE
+  if (scr_emit_warning_override != NULL) {
+    ScrDyn *r = scr_dyn_apply(scr_emit_warning_override, args, "process.emitWarning");
+    scr_dyn_release(r);
+    return;
+  }
+#endif
   size_t argc = args->kind == SCR_DYN_ARR ? args->v.arr.len : 0;
   ScrDyn *const *items = args->kind == SCR_DYN_ARR ? args->v.arr.items : NULL;
   ScrDyn *warning = argc >= 1 ? items[0] : NULL;
diff --git a/packages/runtime/src/scr_bytes.c b/packages/runtime/src/scr_bytes.c
index d33f32a97..64fc36484 100644
--- a/packages/runtime/src/scr_bytes.c
+++ b/packages/runtime/src/scr_bytes.c
@@ -293,6 +293,9 @@ ScrBytes *scr_bytes_as_buffer(ScrBytes *bytes) {
   return scr_bytes_retain(bytes);
 }
 
+/* Nothing on an existing path calls this. */
+bool scr_bytes_is_buffer(const ScrBytes *bytes) { return bytes->is_buffer; }
+
 void scr_bytes_release(ScrBytes *b) {
   if (!b || b->rc == SIZE_MAX) return; /* NULL: an uninitialized `let` local */
   if (--b->rc == 0) {
diff --git a/packages/runtime/src/scr_bytes.h b/packages/runtime/src/scr_bytes.h
index 993921043..b7b913d7f 100644
--- a/packages/runtime/src/scr_bytes.h
+++ b/packages/runtime/src/scr_bytes.h
@@ -159,6 +159,8 @@ ScrBytes *scr_bytes_new(ScrBytesElem elem, double n); /* +1 */
 /* Shared u8 view over exactly the source view's raw bytes. Borrows; +1. */
 ScrBytes *scr_bytes_raw_view(ScrBytes *bytes);
 ScrBytes *scr_bytes_as_buffer(ScrBytes *bytes); /* borrows; +1, Buffer factory only */
+/* Buffer.isBuffer over a typed view: the view's Buffer brand. Borrows. */
+bool scr_bytes_is_buffer(const ScrBytes *bytes);
 /* Views retain the root allocation; offsets are relative to its complete
  * byte storage, including when src is itself a subarray. */
 ScrBytes *scr_bytes_buffer_view(ScrBytes *src, ScrBytesElem elem,
diff --git a/packages/runtime/src/scr_crypto.h b/packages/runtime/src/scr_crypto.h
index 70fa94dd2..4b6b6a6a6 100644
--- a/packages/runtime/src/scr_crypto.h
+++ b/packages/runtime/src/scr_crypto.h
@@ -1,4 +1,5 @@
-/* scriptc runtime — node:crypto (scr_lib.c, scr_crypto_async.c). Included by
+/* scriptc runtime — node:crypto (scr_lib.c, scr_crypto_async.c) and the
+ * WebCrypto HMAC slice (scr_webcrypto.c). Included by
  * scr_runtime.h, which says where new declarations go. */
 #ifndef SCR_CRYPTO_H
 #define SCR_CRYPTO_H
@@ -50,6 +51,10 @@ ScrBytes *scr_crypto_random_fill_rest(ScrBytes *bytes, double offset);
 double scr_crypto_random_int(double min, double max);
 double scr_crypto_random_int_max(double max);
 ScrDyn *scr_crypto_random_fill_sync_dyn(ScrDyn *buf, ScrDyn *offset, ScrDyn *size);
+/* crypto.getRandomValues over a view (returned +1) or any value (the
+ * value itself, +1); NULL with Node's DOMException pending. */
+ScrBytes *scr_crypto_get_random_values(ScrBytes *view);
+ScrDyn *scr_crypto_get_random_values_dyn(ScrDyn *value);
 double scr_crypto_random_fill_args(ScrBytes *view, bool typed_array, double offset, double size,
                                    int form);
 void scr_crypto_random_int_refill(void);
@@ -189,6 +194,22 @@ size_t scr_crypto_digest_raw(const char *alg, const unsigned char *data, size_t
                              unsigned char out[64]);
 size_t scr_crypto_hmac_raw(const char *alg, const unsigned char *key, size_t keylen,
                            const unsigned char *data, size_t len, unsigned char out[64]);
+/* ── WebCrypto (scr_webcrypto.c) ─────────────────────────────────────
+ * crypto.subtle.importKey (raw HMAC keys), sign and verify (HMAC) and
+ * digest (SHA-1/SHA-2) over node:crypto's digest core. Each takes the
+ * call's argument vector as one dyn array (borrowed) and answers a +1
+ * promise that every argument or validation failure rejects with Node's
+ * TypeError or DOMException; algorithms and formats outside the slice
+ * reject with a coded SC2020 Error. importKey settles at once with a
+ * CryptoKey handle; sign and digest fulfill with an ArrayBuffer and
+ * verify with a boolean on a later loop turn. scr_webcrypto_is_crypto_key
+ * answers `value instanceof CryptoKey`. */
+ScrPromise *scr_webcrypto_import_key(ScrDyn *args);
+ScrPromise *scr_webcrypto_sign(ScrDyn *args);
+ScrPromise *scr_webcrypto_verify(ScrDyn *args);
+ScrPromise *scr_webcrypto_digest(ScrDyn *args);
+bool scr_webcrypto_is_crypto_key(const ScrDyn *value);
+
 /* The composed `new crypto.X509Certificate(data).fingerprint` read (the
  * handle never materializes): the SHA-1 of the DER, uppercase
  * colon-separated — PEM or raw-DER input; anything else throws Node's
diff --git a/packages/runtime/src/scr_dyn.h b/packages/runtime/src/scr_dyn.h
index 1ab857e57..a3d506a10 100644
--- a/packages/runtime/src/scr_dyn.h
+++ b/packages/runtime/src/scr_dyn.h
@@ -114,77 +114,6 @@ typedef enum {
   SCR_DYN_SYMBOL, /* native symbol identity, retained by the box */
 } ScrDynKind;
 
-/* The handle-type tags the checked-dynamic tree can carry. The set is deliberately the
- * HANDLE kinds whose member surfaces already have complete static
- * lowerings (the http/net receiver surface); new kinds join by adding a
- * tag + an ops registration in their owning unit.
- *
- * Tags are sorted by name and every value is explicit and permanent: the
- * LLVM backend hardcodes some of them (DYN_HANDLE_TAG_NUM in
- * packages/compiler/src/backend/llvm/dyn.ts). A new tag goes in its sorted
- * place with the next value after the largest one in use, below
- * SCR_DYNH_CAPACITY. packages/compiler/src/backend/llvm/dyn-handle-tags.test.ts
- * checks that values are unique and in range and that the backend's
- * numbers match. */
-typedef enum {
-  SCR_DYNH_ABORT_CONTROLLER = 15, /* native static-fetch AbortController */
-  SCR_DYNH_ABORT_SIGNAL = 8, /* native static-fetch AbortSignal */
-  SCR_DYNH_ARRAY_BUFFER = 18, /* fixed-length ArrayBuffer storage */
-  SCR_DYNH_BLOB = 41, /* ScrBlob — new Blob() and Blob#slice() */
-  SCR_DYNH_BROADCAST_CHANNEL = 51, /* worker_threads BroadcastChannel (scr_worker_events.c) */
-  SCR_DYNH_BUILTIN_MODULE = 21, /* native builtin export object */
-  SCR_DYNH_CHILD = 16, /* child_process.ChildProcess */
-  SCR_DYNH_CIPHER = 45, /* node:crypto Cipheriv (scr_cipher.c) */
-  SCR_DYNH_CONSOLE = 32, /* stored global console value */
-  SCR_DYNH_CONSOLE_INSTANCE = 38, /* node:console Console instance */
-  SCR_DYNH_CUSTOM_EVENT = 40, /* ScrEvent with detail — new CustomEvent() */
-  SCR_DYNH_DATE = 30, /* JavaScript Date with stable native identity */
-  SCR_DYNH_DECIPHER = 46, /* node:crypto Decipheriv (scr_cipher.c) */
-  SCR_DYNH_DIR = 44, /* fs.Dir (scr_lib.c) */
-  SCR_DYNH_DISPOSABLE_STACK = 49, /* DisposableStack (scr_symbol.c) */
-  SCR_DYNH_EVENT = 14, /* ScrEvent — new Event() and AbortSignal's abort events */
-  SCR_DYNH_EVENT_TARGET = 39, /* ScrEventTarget — new EventTarget() */
-  SCR_DYNH_FETCH_HEADERS = 13, /* native static-fetch response Headers */
-  SCR_DYNH_FETCH_REQUEST = 34,
-  SCR_DYNH_FETCH_RESPONSE = 12, /* native static-fetch Response */
-  SCR_DYNH_FILE = 42, /* ScrBlob with a name — new File() */
-  SCR_DYNH_FILE_HANDLE = 17, /* fs/promises.FileHandle */
-  SCR_DYNH_GLOBAL = 22, /* native global object identity */
-  SCR_DYNH_H2_SESSION = 4, /* ScrH2Session — Http2Session (client & server) */
-  SCR_DYNH_H2_STREAM = 5, /* ScrH2Stream — Http2Stream (client & server) */
-  SCR_DYNH_HASH = 52, /* node:crypto Hash (scr_lib.c) */
-  SCR_DYNH_HMAC = 53, /* node:crypto Hmac (scr_lib.c) */
-  SCR_DYNH_HTTP_AGENT = 7, /* ScrHttpAgent — http.Agent / https.Agent */
-  SCR_DYNH_HTTP_CLIENT = 6, /* ScrHttpClientReq — http.ClientRequest */
-  SCR_DYNH_HTTP_REQ = 0, /* ScrHttpReq — IncomingMessage (server req & client res) */
-  SCR_DYNH_HTTP_RES = 1, /* ScrHttpRes — ServerResponse */
-  SCR_DYNH_ITERATOR = 31, /* live native array/string/byte iterator */
-  SCR_DYNH_ITERATOR_HELPER = 54, /* an iterator helper object over a checked iterator (scr_json.c) */
-  SCR_DYNH_KEY_OBJECT = 43, /* node:crypto secret KeyObject (scr_lib.c) */
-  SCR_DYNH_MAP = 29, /* native Map<unknown, unknown>, shared backing */
-  SCR_DYNH_MATCH_SOURCE = 55, /* a match result's pending metadata (scr_regex.c) */
-  SCR_DYNH_MESSAGE_EVENT = 50, /* ScrEvent with data — BroadcastChannel's 'message' */
-  SCR_DYNH_MESSAGE_PORT = 36,
-  SCR_DYNH_NET_BLOCK_LIST = 48, /* net.BlockList (scr_net.c) */
-  SCR_DYNH_NET_SERVER = 3, /* ScrNetServer — net.Server (http.Server rides the same handle) */
-  SCR_DYNH_NET_SOCKET = 2, /* ScrNetSocket — net.Socket */
-  SCR_DYNH_NET_SOCKET_ADDRESS = 47, /* net.SocketAddress (scr_net.c) */
-  SCR_DYNH_REGEXP = 26, /* native RegExp, shared compiled pattern */
-  SCR_DYNH_SEARCH_PARAMS = 33, /* live WHATWG URLSearchParams */
-  SCR_DYNH_SEGMENTER = 19, /* default Unicode grapheme segmentation */
-  SCR_DYNH_SEGMENTS = 20, /* iterable immutable segmentation result */
-  SCR_DYNH_SET = 25, /* native Set<unknown>, shared backing map */
-  SCR_DYNH_SHARED_ARRAY_BUFFER = 37,
-  SCR_DYNH_STDIO = 27, /* stable process stdin/stdout/stderr values */
-  SCR_DYNH_URL = 28, /* native WHATWG URL */
-  SCR_DYNH_WEAK_MAP = 23, /* native weak-key metadata */
-  SCR_DYNH_WEAK_SET = 24, /* native weak membership */
-  SCR_DYNH_WEB_CONTROLLER = 11, /* native ReadableStreamDefaultController */
-  SCR_DYNH_WEB_READER = 10, /* native ReadableStreamDefaultReader */
-  SCR_DYNH_WEB_STREAM = 9, /* native WHATWG ReadableStream */
-  SCR_DYNH_WORKER = 35,
-} ScrDynHandleTag;
-
 /* Every per-tag table (scr_dynh_ops in scr_json.c, the message clone hooks
  * in scr_message.c) is sized by this fixed capacity, never by the number of
  * tags. Adding a tag for a link-gated unit therefore changes no
@@ -194,6 +123,103 @@ typedef enum {
  * only when the tags outgrow it. */
 #define SCR_DYNH_CAPACITY 128
 
+/* The handle-type tags the checked-dynamic tree can carry. The set is deliberately the
+ * HANDLE kinds whose member surfaces already have complete static
+ * lowerings (the http/net receiver surface); new kinds join by adding a
+ * tag + an ops registration in their owning unit.
+ *
+ * SCR_DYNH_TAGS is the one list of tags: X(NAME, value) declares
+ * SCR_DYNH_NAME. Rows are sorted by name and every value is explicit and
+ * permanent: the LLVM backend hardcodes some of them (DYN_HANDLE_TAG_NUM in
+ * packages/compiler/src/backend/llvm/dyn.ts). A new tag goes in its sorted
+ * place with the next value after the largest one in use, below
+ * SCR_DYNH_CAPACITY. Two changes that add tags therefore edit different
+ * lines and merge without a textual conflict; when they picked the same
+ * value, scr_dynh_tags_distinct below has a duplicate case label and every
+ * runtime unit fails to compile, and a value at or above the capacity
+ * fails its _Static_assert. packages/compiler/src/backend/llvm/dyn-handle-tags.test.ts
+ * checks the same properties and that the backend's numbers match. */
+#define SCR_DYNH_TAGS(X) \
+  X(ABORT_CONTROLLER, 15) /* native static-fetch AbortController */ \
+  X(ABORT_SIGNAL, 8) /* native static-fetch AbortSignal */ \
+  X(ARRAY_BUFFER, 18) /* fixed-length ArrayBuffer storage */ \
+  X(BLOB, 41) /* ScrBlob — new Blob() and Blob#slice() */ \
+  X(BROADCAST_CHANNEL, 51) /* worker_threads BroadcastChannel (scr_worker_events.c) */ \
+  X(BUILTIN_MODULE, 21) /* native builtin export object */ \
+  X(CHILD, 16) /* child_process.ChildProcess */ \
+  X(CIPHER, 45) /* node:crypto Cipheriv (scr_cipher.c) */ \
+  X(CONSOLE, 32) /* stored global console value */ \
+  X(CONSOLE_INSTANCE, 38) /* node:console Console instance */ \
+  X(CRYPTO_KEY, 56) /* WebCrypto CryptoKey (scr_webcrypto.c) */ \
+  X(CUSTOM_EVENT, 40) /* ScrEvent with detail — new CustomEvent() */ \
+  X(DATE, 30) /* JavaScript Date with stable native identity */ \
+  X(DECIPHER, 46) /* node:crypto Decipheriv (scr_cipher.c) */ \
+  X(DIR, 44) /* fs.Dir (scr_lib.c) */ \
+  X(DISPOSABLE_STACK, 49) /* DisposableStack (scr_symbol.c) */ \
+  X(EVENT, 14) /* ScrEvent — new Event() and AbortSignal's abort events */ \
+  X(EVENT_TARGET, 39) /* ScrEventTarget — new EventTarget() */ \
+  X(FETCH_HEADERS, 13) /* native static-fetch response Headers */ \
+  X(FETCH_REQUEST, 34) \
+  X(FETCH_RESPONSE, 12) /* native static-fetch Response */ \
+  X(FILE, 42) /* ScrBlob with a name — new File() */ \
+  X(FILE_HANDLE, 17) /* fs/promises.FileHandle */ \
+  X(GLOBAL, 22) /* native global object identity */ \
+  X(H2_SESSION, 4) /* ScrH2Session — Http2Session (client & server) */ \
+  X(H2_STREAM, 5) /* ScrH2Stream — Http2Stream (client & server) */ \
+  X(HASH, 52) /* node:crypto Hash (scr_lib.c) */ \
+  X(HMAC, 53) /* node:crypto Hmac (scr_lib.c) */ \
+  X(HTTP_AGENT, 7) /* ScrHttpAgent — http.Agent / https.Agent */ \
+  X(HTTP_CLIENT, 6) /* ScrHttpClientReq — http.ClientRequest */ \
+  X(HTTP_REQ, 0) /* ScrHttpReq — IncomingMessage (server req & client res) */ \
+  X(HTTP_RES, 1) /* ScrHttpRes — ServerResponse */ \
+  X(ITERATOR, 31) /* live native array/string/byte iterator */ \
+  X(ITERATOR_HELPER, 54) /* an iterator helper object over a checked iterator (scr_json.c) */ \
+  X(KEY_OBJECT, 43) /* node:crypto secret KeyObject (scr_lib.c) */ \
+  X(MAP, 29) /* native Map<unknown, unknown>, shared backing */ \
+  X(MATCH_SOURCE, 55) /* a match result's pending metadata (scr_regex.c) */ \
+  X(MESSAGE_EVENT, 50) /* ScrEvent with data — BroadcastChannel's 'message' */ \
+  X(MESSAGE_PORT, 36) \
+  X(NET_BLOCK_LIST, 48) /* net.BlockList (scr_net.c) */ \
+  X(NET_SERVER, 3) /* ScrNetServer — net.Server (http.Server rides the same handle) */ \
+  X(NET_SOCKET, 2) /* ScrNetSocket — net.Socket */ \
+  X(NET_SOCKET_ADDRESS, 47) /* net.SocketAddress (scr_net.c) */ \
+  X(REGEXP, 26) /* native RegExp, shared compiled pattern */ \
+  X(SEARCH_PARAMS, 33) /* live WHATWG URLSearchParams */ \
+  X(SEGMENTER, 19) /* default Unicode grapheme segmentation */ \
+  X(SEGMENTS, 20) /* iterable immutable segmentation result */ \
+  X(SET, 25) /* native Set<unknown>, shared backing map */ \
+  X(SHARED_ARRAY_BUFFER, 37) \
+  X(STDIO, 27) /* stable process stdin/stdout/stderr values */ \
+  X(URL, 28) /* native WHATWG URL */ \
+  X(WEAK_MAP, 23) /* native weak-key metadata */ \
+  X(WEAK_SET, 24) /* native weak membership */ \
+  X(WEB_CONTROLLER, 11) /* native ReadableStreamDefaultController */ \
+  X(WEB_READER, 10) /* native ReadableStreamDefaultReader */ \
+  X(WEB_STREAM, 9) /* native WHATWG ReadableStream */ \
+  X(WORKER, 35)
+
+typedef enum {
+#define SCR_DYNH_ENUM_ROW(name, value) SCR_DYNH_##name = value,
+  SCR_DYNH_TAGS(SCR_DYNH_ENUM_ROW)
+#undef SCR_DYNH_ENUM_ROW
+} ScrDynHandleTag;
+
+#define SCR_DYNH_RANGE_ROW(name, value) \
+  _Static_assert((value) < SCR_DYNH_CAPACITY, "SCR_DYNH_" #name " is not below SCR_DYNH_CAPACITY");
+SCR_DYNH_TAGS(SCR_DYNH_RANGE_ROW)
+#undef SCR_DYNH_RANGE_ROW
+
+/* Never called: a case label per tag, so two tags with one value are a
+ * duplicate case value and the header does not compile. */
+static inline void scr_dynh_tags_distinct(ScrDynHandleTag tag) {
+  switch (tag) {
+#define SCR_DYNH_CASE_ROW(name, value) case SCR_DYNH_##name:
+    SCR_DYNH_TAGS(SCR_DYNH_CASE_ROW)
+#undef SCR_DYNH_CASE_ROW
+    break;
+  }
+}
+
 typedef struct ScrDyn ScrDyn;
 typedef struct ScrBytes ScrBytes; /* full definition below (C11 repeat) */
 typedef struct ScrClosure ScrClosure; /* full definition below (C11 repeat) */
@@ -713,6 +739,22 @@ double scr_dyn_collection_iterator_index(const ScrDyn *iterator);
  * than 2 and 3) and the index its next step reads from. */
 void scr_dyn_native_iterator_state(const ScrDyn *iterator, unsigned *kind, unsigned *selection,
                                    ScrMap **collection, double *index);
+/* A compiled program that boxes generators and calls iterator helpers on
+ * untyped values registers the checked functions that read a generator
+ * capsule's next and return methods (each takes the capsule). The
+ * iterator helpers below then drive compiled generators. */
+void scr_dyn_set_generator_members(ScrDyn *next_getter, ScrDyn *return_getter);
+/* An iterator helper method called on a synchronous generator capsule:
+ * true with *out set (+1, or NULL with the exception pending) when
+ * `method` is one. NULL until the program registers its generator
+ * members. */
+extern SCR_TL bool (*scr_dyn_generator_helper_hook)(ScrDyn *recv, const char *method,
+                                                    ScrDyn *const *args, size_t argc,
+                                                    ScrDyn **out);
+/* The Iterator.prototype helper method `name` as a function value (+1),
+ * the value a compiled generator's helper property reads; undefined for
+ * other names. */
+ScrDyn *scr_dyn_iterator_helper_method(const ScrStr *name);
 /* The ordinary object snapshot plus a retained typed source. source_access
  * releases that source when materialize=false and returns a fresh snapshot
  * when true. */
@@ -857,6 +899,19 @@ void scr_dyn_arr_push_spread(ScrDyn *arr, const ScrDyn *src, const char *what);
  * compile-time source spelling), else the runtime kind wording. Borrows
  * both; NULL with the exception pending on the throw. */
 ScrDyn *scr_dyn_iter_pack(const ScrDyn *src, const ScrStr *msg);
+/* A rest element's pack (`const [a, ...rest] = d`): scr_dyn_iter_pack's
+ * kinds pack as there, and other iterables step through the iterator
+ * protocol to the end. +1, or NULL with the error pending. */
+ScrDyn *scr_dyn_destructure_rest(const ScrDyn *src, const ScrStr *msg);
+/* Destructuring's first `n` values (`const [a, b] = d`) of a dyn source
+ * other than an array, string or bytes (the emitted walk packs those),
+ * through the iterator protocol: an iterator with values left closes.
+ * `spell` is the compile-time not-iterable wording, or NULL. +1, or NULL
+ * with the error pending. */
+ScrDyn *scr_dyn_iter_take(const ScrDyn *src, size_t n, const char *spell);
+/* True for typed capsules that iterate through the protocol (a compiled
+ * synchronous generator) rather than through their materialized view. */
+bool scr_dyn_iterates_by_protocol(const ScrDyn *value);
 /* Map constructor seeds: retain array inputs for live iteration, accept
  * nullish inputs as empty, and validate each entry before reading 0/1. */
 ScrDyn *scr_dyn_map_seed_entries(const ScrDyn *src);
@@ -897,6 +952,10 @@ void scr_dyn_key_set(ScrDyn *recv, ScrStr *key, ScrDyn *value);
 void scr_dyn_arr_named_put(ScrDyn *arr, const char *key, size_t key_len, ScrDyn *value);
 void scr_dyn_key_set_computed(ScrDyn *recv, ScrDyn *key, ScrDyn *value);
 void scr_dyn_key_delete(ScrDyn *recv, const ScrStr *key, bool strict);
+/* This thread's global object box (borrowed). Every spelling of the global
+ * object answers it; its symbol-keyed properties are the global object's
+ * (scr_node_builtin.c). */
+ScrDyn *scr_global_object(void);
 ScrDyn *scr_dyn_global_symbol_get(ScrSym *key); /* borrowed key; +1 value */
 void scr_dyn_global_symbol_set(ScrSym *key, ScrDyn *value); /* both borrowed */
 bool scr_dyn_global_symbol_has(ScrSym *key);
diff --git a/packages/runtime/src/scr_dyn_invoke.c b/packages/runtime/src/scr_dyn_invoke.c
index a3085399f..8a1bfa728 100644
--- a/packages/runtime/src/scr_dyn_invoke.c
+++ b/packages/runtime/src/scr_dyn_invoke.c
@@ -559,10 +559,8 @@ static ScrDyn *scr_dynh_dispatch(ScrDyn *recv, const char *method, ScrDyn *const
  * reaching the comparator. The ordered list writes back index by index, so
  * a comparator that mutates the receiver mid-sort never dangles the items
  * being ordered. The default comparator compares ToString images
- * (scr_dyn_display_buf — join's conversion) bytewise: code-POINT order,
- * where JS orders UTF-16 code units — identical through the BMP, divergent
- * only across the surrogate boundary (SEMANTICS.md). A comparator result
- * converts with ToNumber; NaN counts as 0. */
+ * (scr_dyn_display_buf — join's conversion) in UTF-16 code-unit order. A
+ * comparator result converts with ToNumber; NaN counts as 0. */
 static ScrStr *dyn_sort_str(const ScrDyn *e) {
   ScrJsonBuf b;
   scr_jb_init(&b);
@@ -584,7 +582,7 @@ static bool dyn_sort_less(void *ctx, uint64_t xs, uint64_t ys, bool *failed) {
   }
   ScrStr *xstr = dyn_sort_str(x);
   ScrStr *ystr = dyn_sort_str(y);
-  int c = scr_str_cmp(xstr, ystr);
+  int c = scr_str_cmp_u16(xstr, ystr);
   scr_str_release(xstr);
   scr_str_release(ystr);
   return c < 0;
@@ -815,6 +813,10 @@ static ScrDyn *scr_dyn_invoke_impl(
     bool handled = false;
     ScrDyn *fast = dyn_live_array_method(recv, method, args, argc, what, &handled);
     if (handled) return fast;
+    /* Iterator helpers on a compiled generator. */
+    if (scr_dyn_generator_helper_hook &&
+        scr_dyn_generator_helper_hook(recv, method, args, argc, &fast))
+      return fast;
     if (scr_event_ref_hooks &&
         scr_event_ref_hooks->invoke(recv, method, args, argc, what, &fast))
       return fast;
diff --git a/packages/runtime/src/scr_events.c b/packages/runtime/src/scr_events.c
index 54eb87a0d..3391f54b1 100644
--- a/packages/runtime/src/scr_events.c
+++ b/packages/runtime/src/scr_events.c
@@ -345,9 +345,23 @@ static void scr_signals_drain(void) {
  * listener it is treated as EOF (piped fd 0 read errors are not
  * meaningfully reachable). */
 
+#ifdef SCR_STDIO_EXTENDED
+/* What a 'data' listener receives (the SCR_STDIO_EXTENDED variant, linked
+ * by programs that use setEncoding, string data listeners or 'resize'):
+ * raw chunks (typed Buffer listeners and the runtime's own consumers), the
+ * decoded string (typed string listeners, which need setEncoding), or
+ * whichever Node delivers (checked-dynamic listeners: the string once an
+ * encoding is set, else the Buffer). */
+enum { SCR_STDIN_DATA_BYTES, SCR_STDIN_DATA_STRING, SCR_STDIN_DATA_DYN };
+
+#endif
 typedef struct {
   ScrClosure *cb; /* owned */
   void (*fn)(ScrClosure *cb, ScrBytes *chunk); /* adapter: chunk borrowed */
+#ifdef SCR_STDIO_EXTENDED
+  void (*str_fn)(ScrClosure *cb, ScrStr *text); /* STRING/DYN: text borrowed */
+  unsigned char kind;
+#endif
   bool once;
 } ScrStdinDataL;
 
@@ -377,6 +391,57 @@ static SCR_TL bool scr_stdin_read_eof = false;
 static SCR_TL ScrBytes *scr_stdin_buffer;
 static SCR_TL size_t scr_stdin_read_demand;
 
+#ifdef SCR_STDIO_EXTENDED
+/* process.stdin.setEncoding(enc): the canonical encoding name (NULL until
+ * set) and the StringDecoder's packed pending partial sequence, so a
+ * multibyte character split across reads decodes whole, as Node's
+ * decoder does. */
+static SCR_TL ScrStr *scr_stdin_encoding = NULL;
+static SCR_TL double scr_stdin_dec_pending = 0;
+
+static void scr_stdin_add_data(ScrClosure *cb /*moves*/, void (*fn)(ScrClosure *, ScrBytes *),
+                               void (*str_fn)(ScrClosure *, ScrStr *), unsigned char kind,
+                               bool once) {
+  if (scr_stdin_eof || scr_stdin_destroyed) {
+    scr_closure_release(cb); /* never fires again, like Node post-'end' */
+    return;
+  }
+  if (scr_stdin_ndata == scr_stdin_data_cap) {
+    scr_stdin_data_cap = scr_stdin_data_cap ? scr_stdin_data_cap * 2 : 2;
+    scr_stdin_data = realloc(scr_stdin_data, scr_stdin_data_cap * sizeof *scr_stdin_data);
+    if (!scr_stdin_data) scr_events_oom();
+  }
+  scr_stdin_data[scr_stdin_ndata].cb = cb;
+  scr_stdin_data[scr_stdin_ndata].fn = fn;
+  scr_stdin_data[scr_stdin_ndata].str_fn = str_fn;
+  scr_stdin_data[scr_stdin_ndata].kind = kind;
+  scr_stdin_data[scr_stdin_ndata].once = once;
+  scr_stdin_ndata++;
+}
+
+void scr_stdin_on_data(ScrClosure *cb /*moves*/, void (*fn)(ScrClosure *, ScrBytes *),
+                        bool once) {
+  scr_stdin_add_data(cb, fn, NULL, SCR_STDIN_DATA_BYTES, once);
+}
+
+void scr_stdin_on_data_str(ScrClosure *cb /*moves*/, void (*fn)(ScrClosure *, ScrStr *),
+                            bool once) {
+  scr_stdin_add_data(cb, NULL, fn, SCR_STDIN_DATA_STRING, once);
+}
+
+static void scr_stdin_encoding_teardown(void) {
+  scr_str_release(scr_stdin_encoding);
+  scr_stdin_encoding = NULL;
+}
+
+void scr_stdin_set_encoding(ScrStr *enc) {
+  if (scr_stdin_encoding == NULL) scr_atexit(scr_stdin_encoding_teardown);
+  ScrStr *previous = scr_stdin_encoding;
+  scr_stdin_encoding = scr_str_retain(enc);
+  scr_str_release(previous);
+  scr_stdin_dec_pending = 0;
+}
+#else
 void scr_stdin_on_data(ScrClosure *cb /*moves*/, void (*fn)(ScrClosure *, ScrBytes *),
                         bool once) {
   if (scr_stdin_eof || scr_stdin_destroyed) {
@@ -393,6 +458,7 @@ void scr_stdin_on_data(ScrClosure *cb /*moves*/, void (*fn)(ScrClosure *, ScrByt
   scr_stdin_data[scr_stdin_ndata].once = once;
   scr_stdin_ndata++;
 }
+#endif
 
 void scr_stdin_on_end(ScrClosure *cb /*moves*/, bool once) {
   if (scr_stdin_eof || scr_stdin_destroyed) {
@@ -487,7 +553,20 @@ static void scr_stdin_settle_done(void) {
 /* EOF/teardown shared tail: 'end' fires (snapshot; once semantics are
  * moot — everything drops right after), the parked promise settles done,
  * and every listener is released. */
+#ifdef SCR_STDIO_EXTENDED
+static void scr_stdin_deliver_parts(ScrBytes *chunk, ScrStr *text);
+#endif
 static void scr_stdin_finish(bool fire_end) {
+#ifdef SCR_STDIO_EXTENDED
+  if (fire_end && scr_stdin_encoding != NULL && scr_stdin_ndata > 0) {
+    /* The decoder's end() flush reaches the string listeners before 'end'. */
+    ScrStr *tail = scr_strdec_end(scr_stdin_encoding, scr_stdin_dec_pending);
+    scr_stdin_dec_pending = 0;
+    if (tail->len > 0) scr_stdin_deliver_parts(NULL, tail);
+    scr_str_release(tail);
+    if (scr_exc_pending()) fire_end = false;
+  }
+#endif
   scr_stdin_eof = true;
   if (fire_end) {
     size_t n = scr_stdin_nend;
@@ -657,7 +736,25 @@ static void scr_stdin_service(void) {
   scr_stdin_arrived(chunk);
 }
 
+#ifdef SCR_STDIO_EXTENDED
 static void scr_stdin_deliver(ScrBytes *chunk) {
+  if (scr_stdin_ndata > 0 && scr_stdin_encoding != NULL) {
+    /* Node's readable decodes once, in the stream: every listener sees
+     * the same string, and a read holding only a partial sequence emits
+     * nothing. */
+    ScrStr *text = scr_strdec_write(scr_stdin_encoding, scr_stdin_dec_pending, chunk);
+    scr_stdin_dec_pending = scr_strdec_next(scr_stdin_encoding, scr_stdin_dec_pending, chunk);
+    if (text->len > 0) scr_stdin_deliver_parts(chunk, text);
+    scr_str_release(text);
+    return;
+  }
+  scr_stdin_deliver_parts(chunk, NULL);
+}
+
+static void scr_stdin_deliver_parts(ScrBytes *chunk, ScrStr *text) {
+#else
+static void scr_stdin_deliver(ScrBytes *chunk) {
+#endif
   if (scr_stdin_ndata > 0) {
     size_t nd = scr_stdin_ndata;
     ScrStdinDataL *snap = malloc(nd * sizeof *snap);
@@ -678,11 +775,31 @@ static void scr_stdin_deliver(ScrBytes *chunk) {
           }
         }
       }
+#ifdef SCR_STDIO_EXTENDED
+      if (!scr_exc_pending()) {
+        if (snap[i].kind == SCR_STDIN_DATA_BYTES) {
+          if (chunk != NULL) snap[i].fn(snap[i].cb, chunk);
+        } else if (text != NULL) {
+          snap[i].str_fn(snap[i].cb, text);
+        } else if (snap[i].kind == SCR_STDIN_DATA_DYN) {
+          if (chunk != NULL) snap[i].fn(snap[i].cb, chunk);
+        } else {
+          static const char msg[] =
+              "stdin data listener type does not match setEncoding state";
+          scr_throw_error_msg(SCR_ERR_TYPE, msg, sizeof msg - 1);
+        }
+      }
+      scr_closure_release(snap[i].cb);
+    }
+    free(snap);
+  } else if (scr_stdin_waiter && chunk != NULL) {
+#else
       if (!scr_exc_pending()) snap[i].fn(snap[i].cb, chunk);
       scr_closure_release(snap[i].cb);
     }
     free(snap);
   } else if (scr_stdin_waiter) {
+#endif
     ScrPromise *p = scr_stdin_waiter;
     scr_stdin_waiter = NULL;
     scr_promise_fulfill_ref(p, scr_bytes_retain(chunk), scr_bytes_retain_v,
@@ -701,14 +818,31 @@ typedef struct {
   bool *error_once;
   size_t nerrors;
   ScrDyn *write_error;
+#ifdef SCR_STDIO_EXTENDED
+  /* 'resize' listeners (stdout/stderr) and the size they last saw. */
+  ScrDyn **resizes;
+  bool *resize_once;
+  size_t nresizes;
+  double columns, rows;
+#endif
 } ScrStdio;
 
 static SCR_TL ScrStdio scr_stdio_streams[3] = {{.fd = 0}, {.fd = 1}, {.fd = 2}};
+#ifdef SCR_STDIO_EXTENDED
+enum { STDIO_WRITE, STDIO_ON, STDIO_ONCE, STDIO_OFF, STDIO_PAUSE, STDIO_RESUME,
+       STDIO_IS_PAUSED, STDIO_READ, STDIO_RAW, STDIO_DESTROY, STDIO_WINDOW_SIZE,
+       STDIO_SET_ENCODING, STDIO_METHOD_COUNT };
+static const char *const scr_stdio_names[] = {
+  "write", "on", "once", "removeListener", "pause", "resume", "isPaused", "read", "setRawMode", "destroy", "getWindowSize",
+  "setEncoding"
+};
+#else
 enum { STDIO_WRITE, STDIO_ON, STDIO_ONCE, STDIO_OFF, STDIO_PAUSE, STDIO_RESUME,
        STDIO_IS_PAUSED, STDIO_READ, STDIO_RAW, STDIO_DESTROY, STDIO_WINDOW_SIZE, STDIO_METHOD_COUNT };
 static const char *const scr_stdio_names[] = {
   "write", "on", "once", "removeListener", "pause", "resume", "isPaused", "read", "setRawMode", "destroy", "getWindowSize"
 };
+#endif
 static SCR_TL ScrDyn *scr_stdio_methods[STDIO_METHOD_COUNT];
 static SCR_TL bool scr_stdio_initialized;
 static SCR_TL bool scr_stdio_raw;
@@ -736,6 +870,13 @@ static void scr_stdio_data(ScrClosure *cb, ScrBytes *bytes) {
   scr_stdio_fire(cb, chunk, 1);
   scr_dyn_release(chunk);
 }
+#ifdef SCR_STDIO_EXTENDED
+static void scr_stdio_data_text(ScrClosure *cb, ScrStr *text) {
+  ScrDyn *chunk = scr_dyn_new_str(text);
+  scr_stdio_fire(cb, chunk, 1);
+  scr_dyn_release(chunk);
+}
+#endif
 static void scr_stdio_end(ScrClosure *cb) { scr_stdio_fire(cb, NULL, 0); }
 static void scr_stdio_error(ScrClosure *cb, ScrStr *message) {
   ScrError *error = scr_error_new(SCR_ERR_ERROR, message);
@@ -861,6 +1002,95 @@ static ScrDyn *scr_stdio_read(ScrDyn *size) {
   return result;
 }
 
+#ifdef SCR_STDIO_EXTENDED
+/* 'resize' on a TTY stdout/stderr: Node's tty.WriteStream listens for
+ * SIGWINCH and emits 'resize' when the window size changed. The signal
+ * listener does not keep the loop alive, and a non-TTY stream never
+ * emits. */
+static SCR_TL ScrDyn *scr_stdio_winch = NULL;
+
+static void scr_stdio_resize_emit(ScrStdio *stream) {
+  size_t n = stream->nresizes;
+  if (n == 0) return;
+  ScrDyn **snap = malloc(n * sizeof *snap);
+  bool *once = malloc(n * sizeof *once);
+  if (!snap || !once) scr_events_oom();
+  for (size_t i = 0; i < n; i++) {
+    snap[i] = scr_dyn_retain(stream->resizes[i]);
+    once[i] = stream->resize_once[i];
+  }
+  for (size_t i = 0; i < n; i++) {
+    if (once[i]) {
+      for (size_t j = 0; j < stream->nresizes; j++) {
+        if (stream->resizes[j] == snap[i]) {
+          scr_dyn_release(stream->resizes[j]);
+          memmove(stream->resizes + j, stream->resizes + j + 1, (stream->nresizes - j - 1) * sizeof *stream->resizes);
+          memmove(stream->resize_once + j, stream->resize_once + j + 1, (stream->nresizes - j - 1) * sizeof *stream->resize_once);
+          stream->nresizes--;
+          break;
+        }
+      }
+    }
+    if (!scr_exc_pending()) {
+      scr_dyn_this_push(stream, SCR_DYNH_STDIO);
+      ScrDyn *r = scr_dyn_call(snap[i], NULL, 0, "listener");
+      scr_dyn_this_pop();
+      scr_dyn_release(r);
+    }
+    scr_dyn_release(snap[i]);
+  }
+  free(snap);
+  free(once);
+}
+
+static ScrDyn *scr_stdio_winch_fire(ScrClosure *cb, ScrDyn *const *args, size_t argc) {
+  (void)cb; (void)args; (void)argc;
+  for (int fd = 1; fd <= 2 && !scr_exc_pending(); fd++) {
+    ScrStdio *stream = &scr_stdio_streams[fd];
+    if (stream->nresizes == 0 || !scr_process_is_tty(fd)) continue;
+    double columns = scr_process_columns(fd), rows = scr_process_rows(fd);
+    if (columns == stream->columns && rows == stream->rows) continue;
+    stream->columns = columns;
+    stream->rows = rows;
+    scr_stdio_resize_emit(stream);
+  }
+  return scr_exc_pending() ? NULL : scr_dyn_retain(scr_dyn_undefined());
+}
+
+static void scr_stdio_resize_listener(ScrStdio *stream, ScrDyn *listener, bool remove, bool once) {
+  if (remove) {
+    for (size_t i = stream->nresizes; i > 0; i--) {
+      if (scr_dyn_strict_eq(stream->resizes[i - 1], listener)) {
+        scr_dyn_release(stream->resizes[i - 1]);
+        memmove(stream->resizes + i - 1, stream->resizes + i, (stream->nresizes - i) * sizeof *stream->resizes);
+        memmove(stream->resize_once + i - 1, stream->resize_once + i, (stream->nresizes - i) * sizeof *stream->resize_once);
+        stream->nresizes--;
+        break;
+      }
+    }
+    return;
+  }
+  if (stream->nresizes == 0) {
+    stream->columns = scr_process_columns(stream->fd);
+    stream->rows = scr_process_rows(stream->fd);
+  }
+  stream->resizes = realloc(stream->resizes, (stream->nresizes + 1) * sizeof *stream->resizes);
+  stream->resize_once = realloc(stream->resize_once, (stream->nresizes + 1) * sizeof *stream->resize_once);
+  if (!stream->resizes || !stream->resize_once) scr_events_oom();
+  stream->resizes[stream->nresizes] = scr_dyn_retain(listener);
+  stream->resize_once[stream->nresizes++] = once;
+#if !defined(_WIN32) && !defined(__wasi__)
+  if (scr_stdio_winch == NULL && scr_context_is_main()) {
+    ScrClosure *cb = scr_closure_new(NULL, 0);
+    scr_stdio_winch = scr_dyn_new_func(cb, scr_stdio_winch_fire, 0, "", "refreshSize");
+    ScrStr *name = scr_str_new("SIGWINCH", 8);
+    scr_signal_on(name, scr_stdio_winch, false);
+    scr_str_release(name);
+  }
+#endif
+}
+
+#endif
 static ScrDyn *scr_stdio_method(ScrClosure *cb, ScrDyn *const *args, size_t argc) {
   int method = (int)scr_box_get_f64(cb->caps[0]);
   ScrDyn *self = scr_dyn_this_get();
@@ -920,14 +1150,30 @@ static ScrDyn *scr_stdio_method(ScrClosure *cb, ScrDyn *const *args, size_t argc
     bool data = arg->kind == SCR_DYN_STR && arg->v.str->len == 4 && memcmp(event, "data", 4) == 0;
     bool end = arg->kind == SCR_DYN_STR && arg->v.str->len == 3 && memcmp(event, "end", 3) == 0;
     bool error = arg->kind == SCR_DYN_STR && arg->v.str->len == 5 && memcmp(event, "error", 5) == 0;
+#ifdef SCR_STDIO_EXTENDED
+    bool resize = stream->fd != 0 && arg->kind == SCR_DYN_STR && arg->v.str->len == 6 &&
+                  memcmp(event, "resize", 6) == 0;
+    if ((!data && !end && !error && !resize) || (stream->fd != 0 && !error && !resize)) {
+#else
     if ((!data && !end && !error) || (stream->fd != 0 && !error)) {
+#endif
       result = scr_stdio_refusal("event");
       goto done;
     }
     bool remove = method == STDIO_OFF, once = method == STDIO_ONCE;
+#ifdef SCR_STDIO_EXTENDED
+    if (resize) {
+      scr_stdio_resize_listener(stream, listener, remove, once);
+    } else if (stream->fd == 0) {
+      if (!remove) {
+        if (data)
+          scr_stdin_add_data(scr_stdio_callback(listener, (void *)scr_stdio_data), scr_stdio_data,
+                             scr_stdio_data_text, SCR_STDIN_DATA_DYN, once);
+#else
     if (stream->fd == 0) {
       if (!remove) {
         if (data) scr_stdin_on_data(scr_stdio_callback(listener, (void *)scr_stdio_data), scr_stdio_data, once);
+#endif
         if (end) scr_stdin_on_end(scr_stdio_callback(listener, (void *)scr_stdio_end), once);
         if (error) scr_stdin_on_error(scr_stdio_callback(listener, (void *)scr_stdio_error), scr_stdio_error, once);
       } else {
@@ -972,6 +1218,15 @@ static ScrDyn *scr_stdio_method(ScrClosure *cb, ScrDyn *const *args, size_t argc
   } else if (stream->fd == 0 && method == STDIO_RAW) {
     scr_process_stdin_set_raw_mode(scr_dyn_truthy(arg));
     if (!scr_exc_pending()) { scr_stdio_raw = scr_dyn_truthy(arg); result = scr_dyn_retain(self); }
+#ifdef SCR_STDIO_EXTENDED
+  } else if (stream->fd == 0 && method == STDIO_SET_ENCODING) {
+    ScrStr *enc = scr_strdec_encoding(arg);
+    if (enc) {
+      scr_stdin_set_encoding(enc);
+      scr_str_release(enc);
+      result = scr_dyn_retain(self);
+    }
+#endif
   } else if (stream->fd == 0 && method == STDIO_DESTROY && argc == 0) {
     scr_stdin_destroy();
     result = scr_dyn_retain(self);
@@ -1069,7 +1324,16 @@ static void scr_stdio_cleanup(void) {
     for (size_t j = 0; j < stream->nerrors; j++) scr_dyn_release(stream->errors[j]);
     free(stream->errors); free(stream->error_once);
     stream->errors = NULL; stream->error_once = NULL; stream->nerrors = 0;
+#ifdef SCR_STDIO_EXTENDED
+    for (size_t j = 0; j < stream->nresizes; j++) scr_dyn_release(stream->resizes[j]);
+    free(stream->resizes); free(stream->resize_once);
+    stream->resizes = NULL; stream->resize_once = NULL; stream->nresizes = 0;
+#endif
   }
+#ifdef SCR_STDIO_EXTENDED
+  scr_dyn_release(scr_stdio_winch);
+  scr_stdio_winch = NULL;
+#endif
   for (int i = 0; i < STDIO_METHOD_COUNT; i++) {
     scr_dyn_release(scr_stdio_methods[i]);
     scr_stdio_methods[i] = NULL;
@@ -1213,6 +1477,11 @@ void scr_stdin_data_thunk_bytes(ScrClosure *cb, ScrBytes *chunk) {
   /* The listener owns its +1 param per the universal convention. */
   ((void (*)(ScrClosure *, ScrBytes *))cb->fn)(cb, scr_bytes_retain(chunk));
 }
+#ifdef SCR_STDIO_EXTENDED
+void scr_stdin_data_thunk_str(ScrClosure *cb, ScrStr *text) {
+  ((void (*)(ScrClosure *, ScrStr *))cb->fn)(cb, scr_str_retain(text));
+}
+#endif
 
 
 /* ── the loop hooks (see scr_async.c) ─────────────────────────────────── */
diff --git a/packages/runtime/src/scr_events.h b/packages/runtime/src/scr_events.h
index 7dcf9cda0..a0025783e 100644
--- a/packages/runtime/src/scr_events.h
+++ b/packages/runtime/src/scr_events.h
@@ -42,6 +42,13 @@ void scr_run_exit_listeners(double code);
 void scr_exit_thunk0(ScrClosure *cb, double code);
 void scr_exit_thunk_code(ScrClosure *cb, double code);
 void scr_stdin_on_data(ScrClosure *cb, void (*fn)(ScrClosure *, ScrBytes *), bool once);
+/* A string 'data' listener (moves cb): receives each chunk decoded by the
+ * stdin's setEncoding decoder; with no encoding set, a delivery throws
+ * the setEncoding-state TypeError instead (Node would pass a Buffer). */
+void scr_stdin_on_data_str(ScrClosure *cb, void (*fn)(ScrClosure *, ScrStr *), bool once);
+/* process.stdin.setEncoding: the canonical encoding (borrowed). */
+void scr_stdin_set_encoding(ScrStr *enc);
+void scr_stdin_data_thunk_str(ScrClosure *cb, ScrStr *text);
 void scr_stdin_on_end(ScrClosure *cb, bool once);
 void scr_stdin_on_error(ScrClosure *cb, ScrChildErrFn fn, bool once);
 ScrPromise *scr_stdin_next_chunk(void); /* +1 */
diff --git a/packages/runtime/src/scr_exception.c b/packages/runtime/src/scr_exception.c
index 3a79cf85b..c7ff71349 100644
--- a/packages/runtime/src/scr_exception.c
+++ b/packages/runtime/src/scr_exception.c
@@ -459,9 +459,10 @@ ScrStr *scr_caught_to_string(const ScrCaught *c) {
   case SCR_EXC_REF:
   case SCR_EXC_PRIMITIVE_REF:
     if (c->retain_fn == scr_dyn_retain_v) return scr_dyn_string_constructor(c->payload);
-    /* Object.prototype.toString — exact for thrown records and class
-     * instances without a toString override; thrown arrays/closures/union
-     * boxes print this too where Node would vary (SEMANTICS.md). */
+    /* Object.prototype.toString — exact for thrown class instances
+     * without a toString override; thrown closures and union boxes print
+     * this too where Node would vary. Thrown records and arrays arrive as
+     * checked-dynamic values (above). */
     return scr_str_new("[object Object]", 15);
   case SCR_EXC_NONE:
   case SCR_EXC_TERMINATE:
diff --git a/packages/runtime/src/scr_exception.h b/packages/runtime/src/scr_exception.h
index 3c8261561..e99f84243 100644
--- a/packages/runtime/src/scr_exception.h
+++ b/packages/runtime/src/scr_exception.h
@@ -195,9 +195,10 @@ bool scr_caught_is_object(const ScrCaught *c);
 /* `String(e)` / `${e}` on a catch binding: JS's String() over the snapshot
  * — numbers/booleans/strings by value, Error payloads via
  * scr_error_to_string ("name: message" — String(e) carries no stack in
- * Node either), every other ref payload "[object Object]" (exact for
- * records and toString-less class instances; a documented approximation
- * for thrown arrays/closures/union boxes). Borrows the box; returns +1. */
+ * Node either), checked-dynamic payloads (thrown records, arrays and
+ * unions over them) by String() over the value, every other ref payload
+ * "[object Object]" (exact for toString-less class instances; an
+ * approximation for closures and union boxes). Borrows the box; returns +1. */
 ScrStr *scr_caught_to_string(const ScrCaught *c);
 /* `e as C` on a catch binding (scr_lib.c): an OBJ payload inside C's
  * preorder interval extracts (retained, +1); every other payload THROWS a
diff --git a/packages/runtime/src/scr_inspect.c b/packages/runtime/src/scr_inspect.c
index 3194528d3..e38c7eb9b 100644
--- a/packages/runtime/src/scr_inspect.c
+++ b/packages/runtime/src/scr_inspect.c
@@ -1362,20 +1362,35 @@ ScrStr *scr_insp_dyn(ScrDyn *d, double recurse, double depth) {
     case SCR_DYN_STR:
       return scr_insp_str(d->v.str);
     case SCR_DYN_ARR: {
-      if (d->v.arr.len == 0) return scr_str_new("[]", 2);
+      size_t len = d->v.arr.len;
+      if (len == 0) return scr_str_new("[]", 2);
       if (recurse > depth) return scr_str_new("[Array]", 7);
       scr_insp_begin(recurse + 1);
-      size_t shown = d->v.arr.len < 100 ? d->v.arr.len : 100;
-      for (size_t i = 0; i < shown; i++) {
-        ScrDyn *item = d->v.arr.items[i];
+      /* Node's maxArrayLength (100) counts output entries; a run of holes
+       * is one `<n empty items>` entry (formatSpecialArray). */
+      const unsigned char *presence = d->v.arr.presence;
+      size_t i = 0;
+      for (size_t shown = 0; i < len && shown < 100; shown++) {
+        if (presence && !presence[i]) {
+          size_t next = i + 1;
+          while (next < len && !presence[next]) next++;
+          char hole[48];
+          int hn = snprintf(hole, sizeof hole, "<%zu empty item%s>", next - i, next - i == 1 ? "" : "s");
+          ScrStr *s = scr_str_new(hole, (size_t)hn);
+          scr_insp_entry(s, false);
+          scr_str_release(s);
+          i = next;
+          continue;
+        }
+        ScrDyn *item = d->v.arr.items[i++];
         ScrStr *s = scr_insp_dyn(item, recurse + 1, depth);
         scr_insp_entry(s, item->kind == SCR_DYN_NUM);
         scr_str_release(s);
       }
-      bool more = d->v.arr.len > 100;
+      bool more = i < len;
       if (more) {
-        ScrStr *m = scr_insp_more_items((double)(d->v.arr.len - 100));
-        scr_insp_entry(m, d->v.arr.items[100]->kind == SCR_DYN_NUM);
+        ScrStr *m = scr_insp_more_items((double)(len - i));
+        scr_insp_entry(m, d->v.arr.items[i]->kind == SCR_DYN_NUM);
         scr_str_release(m);
       }
       ScrStr *base = scr_str_new("", 0);
diff --git a/packages/runtime/src/scr_js.h b/packages/runtime/src/scr_js.h
new file mode 100644
index 000000000..5af849757
--- /dev/null
+++ b/packages/runtime/src/scr_js.h
@@ -0,0 +1,183 @@
+/* scriptc runtime — dynamic-tier values (jsval): the value representation of
+ * the two-tier design's dynamic tier (scr_js_value.c). Only dynamic-tier
+ * units (scr_js_*.c) include this header: static runtime units never see a
+ * jsval, and the compiler links these units only into programs whose IR has
+ * a dynamic-tier operation (the dynTier runtime feature). The header test
+ * enforces the include rule.
+ *
+ * A jsval is one 64-bit NaN-boxed word. The compiler passes it as an LLVM
+ * `ptr`, so the C API spells it `ScrJsVal` (void *) and reads the bits
+ * through scr_js_bits:
+ *
+ *   bits below SCR_JS_DOUBLE_LIMIT   an IEEE double; every NaN is the
+ *                                    canonical 0x7FF8000000000000
+ *   0xFFF9 << 48 | n                 undefined (0), null (1), false (2),
+ *                                    true (3)
+ *   0xFFFA << 48 | ptr               a ScrDyn cell (objects, arrays,
+ *                                    functions, capsules and every other
+ *                                    checked-dynamic value; a NUM, BOOL,
+ *                                    NULL or UNDEF cell is a valid jsval and
+ *                                    means its value)
+ *   0xFFFB << 48 | ptr               a string: the static tier's ScrStr
+ *   0xFFFC << 48 | ptr               a BigInt: the static tier's ScrBigInt
+ *   0xFFFD, 0xFFFE                   reserved (symbols; int32 immediates)
+ *
+ * The three heap tags are contiguous, so "does this word own a reference"
+ * is one subtract and one compare. Pointers fit in 48 bits on every 64-bit
+ * target scriptc supports. On 32-bit targets (wasm32) a pointer cannot hold
+ * a double, so a jsval there is a ScrDyn cell pointer: every number is a
+ * cell, and these helpers keep the same API over that boxed form.
+ *
+ * Ownership follows the dyn conventions: arguments are borrowed, results
+ * are owned (+1), and a call that throws leaves the exception pending and
+ * returns undefined. */
+#ifndef SCR_JS_H
+#define SCR_JS_H
+
+#include "scr_dyn.h"
+#include "scr_number.h"
+
+#include <math.h>
+#include <stdint.h>
+#include <string.h>
+
+typedef void *ScrJsVal;
+
+#if UINTPTR_MAX > 0xFFFFFFFFu
+#define SCR_JS_IMMEDIATES 1
+#else
+#define SCR_JS_IMMEDIATES 0
+#endif
+
+#if SCR_JS_IMMEDIATES
+
+#define SCR_JS_TAG_SHIFT 48
+#define SCR_JS_TAG_SPECIAL UINT64_C(0xFFF9)
+#define SCR_JS_TAG_CELL UINT64_C(0xFFFA)
+#define SCR_JS_TAG_STR UINT64_C(0xFFFB)
+#define SCR_JS_TAG_BIGINT UINT64_C(0xFFFC)
+#define SCR_JS_DOUBLE_LIMIT (SCR_JS_TAG_SPECIAL << SCR_JS_TAG_SHIFT)
+#define SCR_JS_PAYLOAD_MASK ((UINT64_C(1) << SCR_JS_TAG_SHIFT) - 1)
+#define SCR_JS_CANONICAL_NAN UINT64_C(0x7FF8000000000000)
+#define SCR_JS_UNDEFINED_BITS (SCR_JS_DOUBLE_LIMIT | 0)
+#define SCR_JS_NULL_BITS (SCR_JS_DOUBLE_LIMIT | 1)
+#define SCR_JS_FALSE_BITS (SCR_JS_DOUBLE_LIMIT | 2)
+#define SCR_JS_TRUE_BITS (SCR_JS_DOUBLE_LIMIT | 3)
+
+static inline uint64_t scr_js_bits(ScrJsVal v) { return (uint64_t)(uintptr_t)v; }
+static inline ScrJsVal scr_js_of_bits(uint64_t bits) { return (ScrJsVal)(uintptr_t)bits; }
+static inline uint64_t scr_js_tag(ScrJsVal v) { return scr_js_bits(v) >> SCR_JS_TAG_SHIFT; }
+static inline void *scr_js_payload(ScrJsVal v) {
+  return (void *)(uintptr_t)(scr_js_bits(v) & SCR_JS_PAYLOAD_MASK);
+}
+
+static inline bool scr_js_is_double(ScrJsVal v) { return scr_js_bits(v) < SCR_JS_DOUBLE_LIMIT; }
+static inline double scr_js_double(ScrJsVal v) {
+  double d;
+  uint64_t bits = scr_js_bits(v);
+  memcpy(&d, &bits, sizeof d);
+  return d;
+}
+static inline ScrJsVal scr_js_from_double(double d) {
+  uint64_t bits;
+  memcpy(&bits, &d, sizeof bits);
+  return scr_js_of_bits(d != d ? SCR_JS_CANONICAL_NAN : bits);
+}
+static inline bool scr_js_is_heap(ScrJsVal v) {
+  return scr_js_tag(v) - SCR_JS_TAG_CELL <= SCR_JS_TAG_BIGINT - SCR_JS_TAG_CELL;
+}
+static inline bool scr_js_is_cell(ScrJsVal v) { return scr_js_tag(v) == SCR_JS_TAG_CELL; }
+static inline ScrDyn *scr_js_cell(ScrJsVal v) { return (ScrDyn *)scr_js_payload(v); }
+static inline ScrJsVal scr_js_of_cell(ScrDyn *d) {
+  return scr_js_of_bits((SCR_JS_TAG_CELL << SCR_JS_TAG_SHIFT) | (uint64_t)(uintptr_t)d);
+}
+static inline bool scr_js_is_str(ScrJsVal v) { return scr_js_tag(v) == SCR_JS_TAG_STR; }
+static inline ScrStr *scr_js_str(ScrJsVal v) { return (ScrStr *)scr_js_payload(v); }
+static inline ScrJsVal scr_js_of_str(ScrStr *s) {
+  return scr_js_of_bits((SCR_JS_TAG_STR << SCR_JS_TAG_SHIFT) | (uint64_t)(uintptr_t)s);
+}
+static inline bool scr_js_is_bigint(ScrJsVal v) { return scr_js_tag(v) == SCR_JS_TAG_BIGINT; }
+static inline ScrBigInt *scr_js_bigint(ScrJsVal v) { return (ScrBigInt *)scr_js_payload(v); }
+static inline ScrJsVal scr_js_of_bigint(ScrBigInt *b) {
+  return scr_js_of_bits((SCR_JS_TAG_BIGINT << SCR_JS_TAG_SHIFT) | (uint64_t)(uintptr_t)b);
+}
+static inline ScrJsVal scr_js_undefined(void) { return scr_js_of_bits(SCR_JS_UNDEFINED_BITS); }
+static inline ScrJsVal scr_js_null(void) { return scr_js_of_bits(SCR_JS_NULL_BITS); }
+static inline ScrJsVal scr_js_bool(bool b) {
+  return scr_js_of_bits(b ? SCR_JS_TRUE_BITS : SCR_JS_FALSE_BITS);
+}
+
+#else /* boxed: every jsval is a ScrDyn cell */
+
+static inline bool scr_js_is_double(ScrJsVal v) {
+  (void)v;
+  return false;
+}
+static inline double scr_js_double(ScrJsVal v) { return ((ScrDyn *)v)->v.num; }
+static inline ScrJsVal scr_js_from_double(double d) { return scr_dyn_new_num(d); }
+static inline bool scr_js_is_heap(ScrJsVal v) { return v != NULL; }
+static inline bool scr_js_is_cell(ScrJsVal v) { return v != NULL; }
+static inline ScrDyn *scr_js_cell(ScrJsVal v) { return (ScrDyn *)v; }
+static inline ScrJsVal scr_js_of_cell(ScrDyn *d) { return d; }
+static inline bool scr_js_is_str(ScrJsVal v) {
+  (void)v;
+  return false;
+}
+static inline ScrStr *scr_js_str(ScrJsVal v) { return ((ScrDyn *)v)->v.str; }
+static inline bool scr_js_is_bigint(ScrJsVal v) {
+  (void)v;
+  return false;
+}
+static inline ScrBigInt *scr_js_bigint(ScrJsVal v) { return ((ScrDyn *)v)->v.bigint; }
+static inline ScrJsVal scr_js_undefined(void) { return scr_dyn_undefined(); }
+static inline ScrJsVal scr_js_null(void) { return scr_dyn_new_null(); }
+static inline ScrJsVal scr_js_bool(bool b) { return scr_dyn_new_bool(b); }
+
+#endif
+
+/* Whether a jsval is a number (an immediate double or a NUM cell), and its
+ * value. */
+static inline bool scr_js_number(ScrJsVal v, double *out) {
+  if (scr_js_is_double(v)) {
+    *out = scr_js_double(v);
+    return true;
+  }
+  if (scr_js_is_cell(v)) {
+    const ScrDyn *d = scr_js_cell(v);
+    if (d && d->kind == SCR_DYN_NUM) {
+      *out = d->v.num;
+      return true;
+    }
+  }
+  return false;
+}
+
+/* ── reference counting (NULL-tolerant; immediates are unchanged) ───── */
+ScrJsVal scr_js_retain(ScrJsVal v);
+void scr_js_release(ScrJsVal v);
+void *scr_js_retain_v(void *v);
+void scr_js_release_v(void *v);
+
+/* ── boundary conversions ──────────────────────────────────────────────
+ * dyn → jsval keeps a cell's identity under the cell tag (from_dyn
+ * consumes the cell); jsval → dyn boxes an immediate into a cell, a number
+ * through scr_dyn_new_num (to_dyn consumes, to_dyn_borrow borrows). */
+ScrJsVal scr_js_from_dyn(ScrDyn *d);
+ScrDyn *scr_js_to_dyn(ScrJsVal v);
+ScrDyn *scr_js_to_dyn_borrow(ScrJsVal v);
+ScrJsVal scr_js_from_str(ScrStr *s);       /* borrows and retains s */
+ScrJsVal scr_js_from_bigint(ScrBigInt *b); /* borrows and retains b */
+
+/* ── operators (the dyn.* operators of scr_json.c over jsvals) ──────────
+ * Each implements its dyn twin's JS semantics exactly, including
+ * ToPrimitive order; the compiler inlines the number cases. */
+ScrJsVal scr_js_add(ScrJsVal left, ScrJsVal right);
+ScrJsVal scr_js_arithmetic(ScrJsVal left, ScrJsVal right, const ScrStr *operation);
+ScrJsVal scr_js_bitwise(ScrJsVal left, ScrJsVal right, const ScrStr *operation);
+bool scr_js_compare(ScrJsVal left, ScrJsVal right, const ScrStr *operation);
+ScrJsVal scr_js_to_numeric(ScrJsVal value);
+ScrJsVal scr_js_increment(ScrJsVal value, bool increment);
+double scr_js_to_number(ScrJsVal value);
+bool scr_js_truthy(ScrJsVal value);
+
+#endif
diff --git a/packages/runtime/src/scr_js_value.c b/packages/runtime/src/scr_js_value.c
new file mode 100644
index 000000000..0313fb0cd
--- /dev/null
+++ b/packages/runtime/src/scr_js_value.c
@@ -0,0 +1,318 @@
+/* scriptc runtime — dynamic-tier values (scr_js.h): reference counting,
+ * the dyn boundary conversions, and the generic operators over jsvals.
+ *
+ * Linked only into programs with dynamic-tier operations (the dynTier
+ * runtime feature). The compiler inlines the number cases of every
+ * operator and calls these entry points for the rest, so the generic
+ * paths reuse the checked-dynamic operators of scr_json.c: operands are
+ * lent to them as cells (an immediate is boxed for the call) and a number
+ * result comes back as an immediate. Every JS-visible behavior (ToPrimitive
+ * order, the object protocol, error messages) is therefore the dyn
+ * operator's own. */
+#include "scr_js.h"
+
+/* ── reference counting ──────────────────────────────────────────────── */
+
+ScrJsVal scr_js_retain(ScrJsVal v) {
+  if (!scr_js_is_heap(v)) return v;
+#if SCR_JS_IMMEDIATES
+  if (scr_js_is_str(v)) {
+    scr_str_retain(scr_js_str(v));
+    return v;
+  }
+  if (scr_js_is_bigint(v)) {
+    scr_bigint_retain(scr_js_bigint(v));
+    return v;
+  }
+#endif
+  ScrDyn *d = scr_js_cell(v);
+  if (d) scr_dyn_retain(d);
+  return v;
+}
+
+void scr_js_release(ScrJsVal v) {
+  if (!scr_js_is_heap(v)) return;
+#if SCR_JS_IMMEDIATES
+  if (scr_js_is_str(v)) {
+    scr_str_release(scr_js_str(v));
+    return;
+  }
+  if (scr_js_is_bigint(v)) {
+    scr_bigint_release(scr_js_bigint(v));
+    return;
+  }
+#endif
+  scr_dyn_release(scr_js_cell(v));
+}
+
+void *scr_js_retain_v(void *v) { return scr_js_retain(v); }
+
+void scr_js_release_v(void *v) { scr_js_release(v); }
+
+/* ── boundary conversions ────────────────────────────────────────────── */
+
+ScrJsVal scr_js_from_str(ScrStr *s) {
+#if SCR_JS_IMMEDIATES
+  return scr_js_of_str(scr_str_retain(s));
+#else
+  return scr_dyn_new_str(s);
+#endif
+}
+
+ScrJsVal scr_js_from_bigint(ScrBigInt *b) {
+#if SCR_JS_IMMEDIATES
+  return scr_js_of_bigint(scr_bigint_retain(b));
+#else
+  return scr_dyn_new_bigint(b);
+#endif
+}
+
+ScrJsVal scr_js_from_dyn(ScrDyn *d) { return scr_js_of_cell(d); }
+
+ScrDyn *scr_js_to_dyn(ScrJsVal v) {
+#if SCR_JS_IMMEDIATES
+  if (scr_js_is_double(v)) return scr_dyn_new_num(scr_js_double(v));
+  switch (scr_js_tag(v)) {
+  case SCR_JS_TAG_CELL: return scr_js_cell(v);
+  case SCR_JS_TAG_STR: {
+    ScrStr *s = scr_js_str(v);
+    ScrDyn *d = scr_dyn_new_str(s);
+    scr_str_release(s);
+    return d;
+  }
+  case SCR_JS_TAG_BIGINT: {
+    ScrBigInt *b = scr_js_bigint(v);
+    ScrDyn *d = scr_dyn_new_bigint(b);
+    scr_bigint_release(b);
+    return d;
+  }
+  default:
+    switch (scr_js_bits(v)) {
+    case SCR_JS_NULL_BITS: return scr_dyn_new_null();
+    case SCR_JS_FALSE_BITS: return scr_dyn_new_bool(false);
+    case SCR_JS_TRUE_BITS: return scr_dyn_new_bool(true);
+    default: return scr_dyn_undefined();
+    }
+  }
+#else
+  return scr_js_cell(v);
+#endif
+}
+
+ScrDyn *scr_js_to_dyn_borrow(ScrJsVal v) { return scr_js_to_dyn(scr_js_retain(v)); }
+
+/* An owned operator result as a jsval: a number, boolean or unit cell
+ * without own properties becomes its immediate (number results stay
+ * allocation-free downstream); every other cell keeps its identity. NULL
+ * (a pending throw) becomes undefined, which the caller's pending check
+ * discards. */
+static ScrJsVal scr_js_adopt(ScrDyn *d) {
+  if (!d) return scr_js_undefined();
+#if SCR_JS_IMMEDIATES
+  if (!d->prototype && !d->symbol_properties && !d->symbol_keys) {
+    ScrJsVal out;
+    switch (d->kind) {
+    case SCR_DYN_NUM: out = scr_js_from_double(d->v.num); break;
+    case SCR_DYN_BOOL: out = scr_js_bool(d->v.b); break;
+    case SCR_DYN_NULL: out = scr_js_null(); break;
+    case SCR_DYN_UNDEF: out = scr_js_undefined(); break;
+    default: return scr_js_of_cell(d);
+    }
+    scr_dyn_release(d);
+    return out;
+  }
+#endif
+  return scr_js_of_cell(d);
+}
+
+/* ── operators ───────────────────────────────────────────────────────── */
+
+#if SCR_JS_IMMEDIATES
+/* The string a jsval is (a string or a STR cell), borrowed; NULL otherwise. */
+static ScrStr *scr_js_string_of(ScrJsVal v) {
+  if (scr_js_is_str(v)) return scr_js_str(v);
+  if (scr_js_is_cell(v)) {
+    const ScrDyn *d = scr_js_cell(v);
+    if (d && d->kind == SCR_DYN_STR) return d->v.str;
+  }
+  return NULL;
+}
+
+/* ToString of a primitive that ToPrimitive leaves unchanged (number,
+ * boolean, undefined, null, string): +1, or NULL for every other value
+ * (objects take the dyn operator's protocol, BigInts and symbols too). */
+static ScrStr *scr_js_primitive_string(ScrJsVal v) {
+  ScrStr *s = scr_js_string_of(v);
+  if (s) return scr_str_retain(s);
+  double n;
+  if (scr_js_number(v, &n)) return scr_f64_to_scrstr(n);
+  switch (scr_js_bits(v)) {
+  case SCR_JS_UNDEFINED_BITS: return scr_str_new("undefined", 9);
+  case SCR_JS_NULL_BITS: return scr_str_new("null", 4);
+  case SCR_JS_FALSE_BITS: return scr_str_new("false", 5);
+  case SCR_JS_TRUE_BITS: return scr_str_new("true", 4);
+  default: return NULL;
+  }
+}
+
+/* The BigInt a jsval is (a BigInt or a BIGINT cell), borrowed; NULL
+ * otherwise. */
+static ScrBigInt *scr_js_bigint_of(ScrJsVal v) {
+  if (scr_js_is_bigint(v)) return scr_js_bigint(v);
+  if (scr_js_is_cell(v)) {
+    const ScrDyn *d = scr_js_cell(v);
+    if (d && d->kind == SCR_DYN_BIGINT) return d->v.bigint;
+  }
+  return NULL;
+}
+
+/* A +1 BigInt result as a jsval, or undefined when the operation threw. */
+static ScrJsVal scr_js_adopt_bigint(ScrBigInt *b) {
+  return b ? scr_js_of_bigint(b) : scr_js_undefined();
+}
+#endif
+
+ScrJsVal scr_js_add(ScrJsVal left, ScrJsVal right) {
+  double a, b;
+  if (scr_js_number(left, &a) && scr_js_number(right, &b)) return scr_js_from_double(a + b);
+#if SCR_JS_IMMEDIATES
+  /* A string with a primitive concatenates without boxing either side:
+   * ToPrimitive leaves both unchanged, so no user code can run. */
+  if (scr_js_string_of(left) || scr_js_string_of(right)) {
+    ScrStr *ls = scr_js_primitive_string(left);
+    ScrStr *rs = ls ? scr_js_primitive_string(right) : NULL;
+    if (ls && rs) {
+      ScrStr *joined = scr_str_concat(ls, rs);
+      scr_str_release(ls);
+      scr_str_release(rs);
+      return scr_js_of_str(joined);
+    }
+    scr_str_release(ls);
+  }
+  ScrBigInt *lb = scr_js_bigint_of(left), *rb = scr_js_bigint_of(right);
+  if (lb && rb) return scr_js_adopt_bigint(scr_bigint_add(lb, rb));
+#endif
+  ScrDyn *l = scr_js_to_dyn_borrow(left);
+  ScrDyn *r = scr_js_to_dyn_borrow(right);
+  ScrDyn *out = scr_dyn_add(l, r);
+  scr_dyn_release(l);
+  scr_dyn_release(r);
+  return scr_js_adopt(out);
+}
+
+/* The number case of scr_dyn_arithmetic: the compiler inlines - * / %, so
+ * this mostly serves `**` (ECMAScript differs from libm for ±1 ** ±Infinity
+ * and 1 ** NaN). */
+static double scr_js_number_arithmetic(double a, double b, const ScrStr *operation) {
+  switch (operation->data[0]) {
+  case '-': return a - b;
+  case '/': return a / b;
+  case '%': return fmod(a, b);
+  default:
+    if (operation->len == 2) return (fabs(a) == 1 && !isfinite(b)) ? NAN : pow(a, b);
+    return a * b;
+  }
+}
+
+ScrJsVal scr_js_arithmetic(ScrJsVal left, ScrJsVal right, const ScrStr *operation) {
+  double a, b;
+  if (scr_js_number(left, &a) && scr_js_number(right, &b))
+    return scr_js_from_double(scr_js_number_arithmetic(a, b, operation));
+#if SCR_JS_IMMEDIATES
+  ScrBigInt *lb = scr_js_bigint_of(left), *rb = scr_js_bigint_of(right);
+  if (lb && rb) {
+    switch (operation->data[0]) {
+    case '-': return scr_js_adopt_bigint(scr_bigint_sub(lb, rb));
+    case '/': return scr_js_adopt_bigint(scr_bigint_div(lb, rb));
+    case '%': return scr_js_adopt_bigint(scr_bigint_mod(lb, rb));
+    default:
+      return scr_js_adopt_bigint(operation->len == 2 ? scr_bigint_pow(lb, rb)
+                                                     : scr_bigint_mul(lb, rb));
+    }
+  }
+#endif
+  ScrDyn *l = scr_js_to_dyn_borrow(left);
+  ScrDyn *r = scr_js_to_dyn_borrow(right);
+  ScrDyn *out = scr_dyn_arithmetic(l, r, operation);
+  scr_dyn_release(l);
+  scr_dyn_release(r);
+  return scr_js_adopt(out);
+}
+
+ScrJsVal scr_js_bitwise(ScrJsVal left, ScrJsVal right, const ScrStr *operation) {
+  /* The number case of scr_dyn_bitwise; unary `~` ignores its right
+   * operand (undefined). */
+  double a, b = 0;
+  bool unary = operation->len == 1 && operation->data[0] == '~';
+  if (scr_js_number(left, &a) && (unary || scr_js_number(right, &b))) {
+    double result;
+    char op = operation->data[0];
+    if (unary) result = scr_bit_not(a);
+    else if (op == '&') result = scr_bit_and(a, b);
+    else if (op == '|') result = scr_bit_or(a, b);
+    else if (op == '^') result = scr_bit_xor(a, b);
+    else if (op == '<') result = scr_bit_shl(a, b);
+    else if (operation->len == 2) result = scr_bit_shr(a, b);
+    else result = scr_bit_ushr(a, b);
+    return scr_js_from_double(result);
+  }
+  ScrDyn *l = scr_js_to_dyn_borrow(left);
+  ScrDyn *r = scr_js_to_dyn_borrow(right);
+  ScrDyn *out = scr_dyn_bitwise(l, r, operation);
+  scr_dyn_release(l);
+  scr_dyn_release(r);
+  return scr_js_adopt(out);
+}
+
+bool scr_js_compare(ScrJsVal left, ScrJsVal right, const ScrStr *operation) {
+  ScrDyn *l = scr_js_to_dyn_borrow(left);
+  ScrDyn *r = scr_js_to_dyn_borrow(right);
+  bool out = scr_dyn_compare(l, r, operation);
+  scr_dyn_release(l);
+  scr_dyn_release(r);
+  return out;
+}
+
+ScrJsVal scr_js_to_numeric(ScrJsVal value) {
+  double n;
+  if (scr_js_number(value, &n)) return scr_js_from_double(n);
+  ScrDyn *d = scr_js_to_dyn_borrow(value);
+  ScrDyn *out = scr_dyn_to_numeric(d);
+  scr_dyn_release(d);
+  return scr_js_adopt(out);
+}
+
+ScrJsVal scr_js_increment(ScrJsVal value, bool increment) {
+  double n;
+  if (scr_js_number(value, &n)) return scr_js_from_double(n + (increment ? 1 : -1));
+  ScrDyn *d = scr_js_to_dyn_borrow(value);
+  ScrDyn *out = scr_dyn_increment(d, increment);
+  scr_dyn_release(d);
+  return scr_js_adopt(out);
+}
+
+double scr_js_to_number(ScrJsVal value) {
+  double n;
+  if (scr_js_number(value, &n)) return n;
+  ScrDyn *d = scr_js_to_dyn_borrow(value);
+  double out = scr_dyn_number_coerce(d);
+  scr_dyn_release(d);
+  return out;
+}
+
+bool scr_js_truthy(ScrJsVal value) {
+#if SCR_JS_IMMEDIATES
+  if (scr_js_is_double(value)) {
+    double d = scr_js_double(value);
+    return d == d && d != 0;
+  }
+  switch (scr_js_tag(value)) {
+  case SCR_JS_TAG_CELL: return scr_dyn_truthy(scr_js_cell(value));
+  case SCR_JS_TAG_STR: return scr_js_str(value)->len != 0;
+  case SCR_JS_TAG_BIGINT: return scr_bigint_truthy(scr_js_bigint(value));
+  default: return scr_js_bits(value) == SCR_JS_TRUE_BITS;
+  }
+#else
+  return scr_dyn_truthy(scr_js_cell(value));
+#endif
+}
diff --git a/packages/runtime/src/scr_json.c b/packages/runtime/src/scr_json.c
index 525b6a192..83b56bea4 100644
--- a/packages/runtime/src/scr_json.c
+++ b/packages/runtime/src/scr_json.c
@@ -4356,6 +4356,60 @@ bool scr_dyn_data_view_is(const ScrDyn *value) {
   return value->kind == SCR_DYN_BYTES && value->v.bytes->is_data_view;
 }
 
+/* util.inspect names an object after the function held by the first own
+ * `constructor` data property on its prototype chain (Node's
+ * getConstructorName). The dyn printer reads runtime class names
+ * (v.obj.class_name, set only on prototypes that stay alive), so a
+ * construction through a plain function stamps that prototype with a copy
+ * of the function's name and keeps it alive. The copy is the stamp's own: a
+ * function's name can live in storage the function owns (a bound
+ * function's "bound <name>"), and the function is released when the
+ * writable `constructor` property is replaced. The stamps are cleared and
+ * their copies freed before release at exit, so freelist reuse never sees
+ * them. */
+typedef struct {
+  ScrDyn *prototype;
+  char *name;
+} ScrDynNamedPrototype;
+static SCR_TL ScrDynNamedPrototype *scr_dyn_named_prototypes;
+static SCR_TL size_t scr_dyn_named_count, scr_dyn_named_cap;
+
+static void scr_dyn_named_prototypes_cleanup(void) {
+  for (size_t i = 0; i < scr_dyn_named_count; i++) {
+    scr_dyn_named_prototypes[i].prototype->v.obj.class_name = NULL;
+    scr_dyn_release(scr_dyn_named_prototypes[i].prototype);
+    free(scr_dyn_named_prototypes[i].name);
+  }
+  free(scr_dyn_named_prototypes);
+  scr_dyn_named_prototypes = NULL;
+  scr_dyn_named_count = scr_dyn_named_cap = 0;
+}
+
+static void scr_dyn_name_prototype_chain(const ScrDyn *object) {
+  for (ScrDyn *p = object->prototype; p; p = p->prototype) {
+    if (p->kind != SCR_DYN_OBJ || p->v.obj.class_name) return;
+    ScrDynEntry *entry = scr_dyn_find_entry(p, "constructor", 11);
+    if (!entry || entry->accessor || !entry->value || entry->value->kind != SCR_DYN_FUNC) continue;
+    const char *name = entry->value->v.fn.name;
+    if (!name || !name[0]) continue;
+    if (scr_dyn_named_count == scr_dyn_named_cap) {
+      if (scr_dyn_named_cap == 0) scr_atexit(scr_dyn_named_prototypes_cleanup);
+      size_t cap = scr_dyn_named_cap ? scr_dyn_named_cap * 2 : 8;
+      ScrDynNamedPrototype *grown = realloc(scr_dyn_named_prototypes, cap * sizeof *grown);
+      if (!grown) scr_json_oom();
+      scr_dyn_named_prototypes = grown;
+      scr_dyn_named_cap = cap;
+    }
+    size_t len = strlen(name);
+    char *copy = malloc(len + 1);
+    if (!copy) scr_json_oom();
+    memcpy(copy, name, len + 1);
+    p->v.obj.class_name = copy;
+    scr_dyn_named_prototypes[scr_dyn_named_count++] = (ScrDynNamedPrototype){ scr_dyn_retain(p), copy };
+    return;
+  }
+}
+
 /* Ordinary native function constructors retain their live prototype table.
  * A constructor may replace the fresh receiver with another object. */
 ScrDyn *scr_dyn_construct(const ScrDyn *callee, const ScrDyn *args, const ScrStr *what) {
@@ -4366,6 +4420,7 @@ ScrDyn *scr_dyn_construct(const ScrDyn *callee, const ScrDyn *args, const ScrStr
   ScrDyn *receiver = scr_iterator_object(prototype) ? scr_dyn_obj_create(prototype) : scr_dyn_new_obj();
   scr_dyn_release(prototype);
   if (!receiver) return NULL;
+  scr_dyn_name_prototype_chain(receiver);
   scr_dyn_this_push_dyn(receiver);
   ScrDyn *result = scr_dyn_call(callee, args->v.arr.items, args->v.arr.len, what->data);
   scr_dyn_this_pop();
@@ -4704,6 +4759,19 @@ static int scr_ih_method_index(const char *name, size_t len);
 static ScrDyn *scr_iterator_helper_method(ScrDyn *self, int index, ScrDyn *const *args, size_t argc);
 static ScrDyn *scr_ih_method_function(int index);
 
+static bool scr_dyn_sync_generator(const ScrDyn *value);
+extern SCR_TL ScrDyn *(*scr_generator_member_hook)(const ScrDyn *, const char *, size_t);
+
+/* scr_iterator_read of an iterator's own next or return method: a
+ * compiled generator answers through the program's registered getters. */
+static ScrDyn *scr_iterator_member(const ScrDyn *iterator, const char *key, size_t len) {
+  if (scr_generator_member_hook && scr_dyn_sync_generator(iterator)) {
+    ScrDyn *member = scr_generator_member_hook(iterator, key, len);
+    if (member) return member;
+  }
+  return scr_iterator_read(iterator, key, len);
+}
+
 static ScrDyn *scr_native_iterator_get(void *ptr, const char *key, size_t len) {
   if (len != 4 || memcmp(key, "next", 4)) {
     /* The Iterator.prototype helper methods. */
@@ -4893,7 +4961,7 @@ static bool scr_ih_budget(const ScrDyn *limit, double *out) {
  * Node's TypeError. Answers false when an exception is pending after. */
 static bool scr_ih_close(ScrDyn *iterator, bool abrupt) {
   ScrCaught *first = abrupt ? scr_exc_take() : NULL;
-  ScrDyn *method = scr_iterator_read(iterator, "return", 6);
+  ScrDyn *method = scr_iterator_member(iterator, "return", 6);
   bool ok = method != NULL;
   if (ok && method->kind != SCR_DYN_UNDEF && method->kind != SCR_DYN_NULL) {
     ScrDyn *result = scr_iterator_call(method, iterator, "return");
@@ -4960,7 +5028,7 @@ static ScrDyn *scr_ih_direct(const ScrDyn *self, const char *method) {
     scr_throw_error(SCR_ERR_TYPE, scr_jb_finish(&b));
     return NULL;
   }
-  return scr_iterator_read(self, "next", 4);
+  return scr_iterator_member(self, "next", 4);
 }
 
 static ScrDyn *scr_ih_result(ScrDyn *value, bool done) {
@@ -5017,7 +5085,7 @@ static ScrDyn *scr_ih_flattenable(ScrDyn *value, ScrDyn **next_out) {
   }
   scr_dyn_release(method);
   if (!iterator) return NULL;
-  ScrDyn *next = scr_iterator_read(iterator, "next", 4);
+  ScrDyn *next = scr_iterator_member(iterator, "next", 4);
   if (!next) {
     scr_dyn_release(iterator);
     return NULL;
@@ -13967,3 +14035,115 @@ ScrDyn *scr_caught_to_dyn(const ScrCaught *c) {
     return scr_dyn_new_obj();
   }
 }
+
+/* ── compiled generators through untyped values ─────────────────────── */
+
+static SCR_TL ScrDyn *scr_generator_next_getter;
+static SCR_TL ScrDyn *scr_generator_return_getter;
+/* Set with the getters, so only programs that register them link the
+ * iterator helpers through these paths. External, so the compiler keeps
+ * the calls through them indirect. */
+SCR_TL ScrDyn *(*scr_generator_member_hook)(const ScrDyn *, const char *, size_t) = NULL;
+SCR_TL bool (*scr_dyn_generator_helper_hook)(ScrDyn *, const char *, ScrDyn *const *, size_t,
+                                             ScrDyn **) = NULL;
+static ScrDyn *scr_generator_member(const ScrDyn *capsule, const char *key, size_t len);
+static bool scr_generator_helper_invoke(ScrDyn *recv, const char *method, ScrDyn *const *args,
+                                        size_t argc, ScrDyn **out);
+
+static void scr_generator_members_cleanup(void) {
+  scr_dyn_release(scr_generator_next_getter);
+  scr_dyn_release(scr_generator_return_getter);
+  scr_generator_next_getter = NULL;
+  scr_generator_return_getter = NULL;
+  scr_generator_member_hook = NULL;
+  scr_dyn_generator_helper_hook = NULL;
+}
+
+void scr_dyn_set_generator_members(ScrDyn *next_getter, ScrDyn *return_getter) {
+  if (!scr_generator_next_getter) scr_atexit(scr_generator_members_cleanup);
+  scr_dyn_release(scr_generator_next_getter);
+  scr_dyn_release(scr_generator_return_getter);
+  scr_generator_next_getter = scr_dyn_retain(next_getter);
+  scr_generator_return_getter = scr_dyn_retain(return_getter);
+  scr_generator_member_hook = &scr_generator_member;
+  scr_dyn_generator_helper_hook = &scr_generator_helper_invoke;
+}
+
+static bool scr_dyn_sync_generator(const ScrDyn *value) {
+  return scr_dyn_generator(value) && value->v.typed_ref.type_key[0] == 'g';
+}
+
+/* A synchronous generator capsule's next or return method (+1), read
+ * through the program's registered getters. NULL for other keys. */
+static ScrDyn *scr_generator_member(const ScrDyn *capsule, const char *key, size_t len) {
+  ScrDyn *getter = len == 4 && !memcmp(key, "next", 4) ? scr_generator_next_getter
+    : len == 6 && !memcmp(key, "return", 6) ? scr_generator_return_getter : NULL;
+  if (!getter) return NULL;
+  ScrDyn *args[1] = { (ScrDyn *)capsule };
+  return scr_dyn_call(getter, args, 1, "next");
+}
+
+static bool scr_generator_helper_invoke(ScrDyn *recv, const char *method, ScrDyn *const *args,
+                                        size_t argc, ScrDyn **out) {
+  if (!scr_dyn_sync_generator(recv)) return false;
+  int index = scr_ih_method_index(method, strlen(method));
+  if (index < 0) return false;
+  *out = scr_iterator_helper_method(recv, index, args, argc);
+  return true;
+}
+
+ScrDyn *scr_dyn_iterator_helper_method(const ScrStr *name) {
+  int index = scr_ih_method_index(name->data, name->len);
+  return index >= 0 ? scr_ih_method_function(index) : scr_dyn_retain(scr_dyn_undefined());
+}
+
+/* Destructuring over an iterable the pack walk cannot list (a compiled
+ * generator, an iterator or iterator helper, a Map or Set): GetIterator,
+ * then the first `n` values through the iterator protocol, or every value
+ * when `all`, into a fresh array. Positions past the end read undefined,
+ * and an iterator with values left closes. `spell` is the compile-time
+ * not-iterable wording, or NULL. +1, or NULL with the error pending. */
+static ScrDyn *scr_dyn_iter_steps(const ScrDyn *src, const ScrStr *spell, size_t n, bool all) {
+  ScrDyn *iterator = scr_dyn_iterator(src, spell);
+  if (!iterator) return NULL;
+  ScrDyn *next = scr_iterator_member(iterator, "next", 4);
+  if (!next) {
+    scr_dyn_release(iterator);
+    return NULL;
+  }
+  ScrDyn *out = scr_dyn_new_arr();
+  bool done = false;
+  for (size_t i = 0; all ? !done : i < n; i++) {
+    ScrDyn *value = done ? scr_dyn_retain(scr_dyn_undefined()) : scr_ih_step(iterator, next, &done);
+    if (!value) goto fail;
+    if (all && done) scr_dyn_release(value);
+    else scr_dyn_arr_push(out, value);
+  }
+  if (!done && !scr_ih_close(iterator, false)) goto fail;
+  scr_dyn_release(next);
+  scr_dyn_release(iterator);
+  return out;
+fail:
+  scr_dyn_release(out);
+  scr_dyn_release(next);
+  scr_dyn_release(iterator);
+  return NULL;
+}
+
+ScrDyn *scr_dyn_destructure_rest(const ScrDyn *src, const ScrStr *msg) {
+  bool packs = src->kind == SCR_DYN_ARR || src->kind == SCR_DYN_STR || src->kind == SCR_DYN_BYTES ||
+    (src->kind == SCR_DYN_HANDLE && scr_dyn_handle_ops_of(src)->iter_pack) ||
+    (src->kind == SCR_DYN_TYPED_REF && !scr_dyn_iterates_by_protocol(src));
+  return packs ? scr_dyn_iter_pack(src, msg) : scr_dyn_iter_steps(src, msg, 0, true);
+}
+
+ScrDyn *scr_dyn_iter_take(const ScrDyn *src, size_t n, const char *spell) {
+  ScrStr *spelling = spell && *spell ? scr_str_new(spell, strlen(spell)) : NULL;
+  ScrDyn *out = scr_dyn_iter_steps(src, spelling, n, false);
+  scr_str_release(spelling);
+  return out;
+}
+
+bool scr_dyn_iterates_by_protocol(const ScrDyn *value) {
+  return scr_dyn_sync_generator(value);
+}
diff --git a/packages/runtime/src/scr_lib.c b/packages/runtime/src/scr_lib.c
index ae9c5c2b1..930d44818 100644
--- a/packages/runtime/src/scr_lib.c
+++ b/packages/runtime/src/scr_lib.c
@@ -11408,6 +11408,137 @@ ScrStr *scr_num_to_fixed(double x, double fraction_digits) {
   return scr_str_new(out, len);
 }
 
+/* String.prototype.substr (Annex B.2.2.1) over substring's UTF-16
+ * clamp: -Infinity and other starts below -size clamp to 0, an Infinity
+ * length to the end. Comparisons only (no floating-point literal other
+ * than zero, which would join the constant pool every binary links).
+ * Nothing on an existing path calls this. */
+ScrStr *scr_str_substr(ScrStr *s, double start, double length, bool has_length) {
+  double size = scr_str_utf16_len(s);
+  double first = isnan(start) ? 0 : trunc(start);
+  if (first < 0) {
+    first = size + first;
+    if (first < 0) first = 0;
+  } else if (first > size) {
+    first = size;
+  }
+  double count = has_length ? (isnan(length) ? 0 : trunc(length)) : size;
+  if (count < 0) count = 0;
+  double end = first + count;
+  if (end > size) end = size;
+  return scr_str_substring(s, first, end);
+}
+
+/* The exponent suffix of toPrecision/toExponential: "e+5", "e-7". */
+static size_t scr_num_exp_suffix(char *o, int e) {
+  size_t n = 0;
+  o[n++] = 'e';
+  o[n++] = e < 0 ? '-' : '+';
+  int a = e < 0 ? -e : e;
+  char rev[8];
+  int k = 0;
+  do {
+    rev[k++] = (char)('0' + a % 10);
+    a /= 10;
+  } while (a != 0);
+  while (k > 0) o[n++] = rev[--k];
+  return n;
+}
+
+/* Number.prototype.toPrecision(precision) (ECMA-262 §21.1.3.5): undefined
+ * precision is ToString(x); ToIntegerOrInfinity runs (in the caller's
+ * coercion) before the non-finite arm, which precedes the 1..100 range
+ * check. Digits are the exact-value, ties-up n of
+ * scr_f64_precision_digits; exponential form when e < -6 or e >= p.
+ * Nothing on an existing path calls this. */
+ScrStr *scr_num_to_precision(double x, double precision, bool has_precision) {
+  if (!has_precision || !isfinite(x)) return scr_f64_to_scrstr(x);
+  double p = isnan(precision) ? 0 : trunc(precision);
+  if (!(p >= 1 && p <= 100)) {
+    static const char msg[] = "toPrecision() argument must be between 1 and 100";
+    scr_throw_error_msg(SCR_ERR_RANGE, msg, sizeof msg - 1);
+    return NULL;
+  }
+  int digits_count = (int)p;
+  char out[160];
+  size_t o = 0;
+  double a = x;
+  if (x < 0) {
+    out[o++] = '-';
+    a = -x;
+  }
+  char d[104];
+  int e = 0;
+  if (a == 0) {
+    memset(d, '0', (size_t)digits_count);
+    d[digits_count] = '\0';
+  } else {
+    scr_f64_precision_digits(a, digits_count, d, &e);
+  }
+  if (e < -6 || e >= digits_count) {
+    out[o++] = d[0];
+    if (digits_count != 1) {
+      out[o++] = '.';
+      memcpy(out + o, d + 1, (size_t)(digits_count - 1));
+      o += (size_t)(digits_count - 1);
+    }
+    o += scr_num_exp_suffix(out + o, e);
+  } else if (e >= 0) {
+    memcpy(out + o, d, (size_t)(e + 1));
+    o += (size_t)(e + 1);
+    if (e + 1 < digits_count) {
+      out[o++] = '.';
+      memcpy(out + o, d + e + 1, (size_t)(digits_count - e - 1));
+      o += (size_t)(digits_count - e - 1);
+    }
+  } else {
+    out[o++] = '0';
+    out[o++] = '.';
+    for (int i = 0; i < -(e + 1); i++) out[o++] = '0';
+    memcpy(out + o, d, (size_t)digits_count);
+    o += (size_t)digits_count;
+  }
+  return scr_str_new(out, o);
+}
+
+/* Number.prototype.toExponential(fractionDigits) with a DEFINED argument
+ * (the undefined form is scr_num_to_exponential's shortest mantissa):
+ * f + 1 exact-value, ties-up digits, "d.ddde±X". Nothing on an existing
+ * path calls this. */
+ScrStr *scr_num_to_exponential_digits(double x, double fraction_digits) {
+  if (!isfinite(x)) return scr_f64_to_scrstr(x);
+  double f = isnan(fraction_digits) ? 0 : trunc(fraction_digits);
+  if (!(f >= 0 && f <= 100)) {
+    static const char msg[] = "toExponential() argument must be between 0 and 100";
+    scr_throw_error_msg(SCR_ERR_RANGE, msg, sizeof msg - 1);
+    return NULL;
+  }
+  int count = (int)f + 1;
+  char out[160];
+  size_t o = 0;
+  double a = x;
+  if (x < 0) {
+    out[o++] = '-';
+    a = -x;
+  }
+  char d[104];
+  int e = 0;
+  if (a == 0) {
+    memset(d, '0', (size_t)count);
+    d[count] = '\0';
+  } else {
+    scr_f64_precision_digits(a, count, d, &e);
+  }
+  out[o++] = d[0];
+  if (count != 1) {
+    out[o++] = '.';
+    memcpy(out + o, d + 1, (size_t)(count - 1));
+    o += (size_t)(count - 1);
+  }
+  o += scr_num_exp_suffix(out + o, e);
+  return scr_str_new(out, o);
+}
+
 /* Increment a decimal digit string in place. Returns true on overflow —
  * the value becomes 1 followed by len zeros (the caller folds the zeros
  * into its scale); an EMPTY string increments to "1" the same way (the
@@ -11739,3 +11870,52 @@ ScrDyn *scr_dyn_native_date_from_ms(double ms) {
   scr_native_date_release(date);
   return result;
 }
+
+/* crypto.getRandomValues(typedArray) (WebCrypto, also node:crypto's
+ * export): integer typed arrays only (Node's TypeMismatchError DOMException
+ * for float arrays, DataViews and every other value), at most 65536 bytes
+ * (QuotaExceededError), filled in place and returned. Nothing on an
+ * existing path calls these. They stay at the end of the unit: clang emits
+ * a static helper (scr_random_write) where its first emitted caller
+ * appears, and an earlier caller would move it in every binary that links
+ * the random fills. */
+ScrBytes *scr_crypto_get_random_values(ScrBytes *view) {
+  static const char mismatch[] = "TypeMismatchError";
+  static const char mismatch_msg[] = "The data argument must be an integer-type TypedArray";
+  static const char quota[] = "QuotaExceededError";
+  static const char quota_msg[] = "The requested length exceeds 65,536 bytes";
+  if (view->is_data_view || view->elem == SCR_BYTES_F32 || view->elem == SCR_BYTES_F64 ||
+      view->elem == SCR_BYTES_F16) {
+    scr_throw_domex(mismatch, mismatch_msg);
+    return NULL;
+  }
+  /* Integer arithmetic: a new floating-point literal would land in the
+   * merged constant pool every binary links. */
+  size_t length = view->len * (size_t)scr_bytes_elem_size(view->elem);
+  if (length > 65536u) {
+    scr_throw_domex(quota, quota_msg);
+    return NULL;
+  }
+  scr_random_write(view, 0, length);
+  return scr_bytes_retain(view);
+}
+
+ScrDyn *scr_crypto_get_random_values_dyn(ScrDyn *value) {
+  if (value->kind == SCR_DYN_TYPED_REF) {
+    ScrDyn *materialized = scr_dyn_typed_ref_materialize(value);
+    if (!materialized) return NULL;
+    ScrDyn *result = scr_crypto_get_random_values_dyn(materialized);
+    scr_dyn_release(materialized);
+    return result ? scr_dyn_retain(value) : NULL;
+  }
+  if (value->kind != SCR_DYN_BYTES) {
+    static const char mismatch[] = "TypeMismatchError";
+    static const char mismatch_msg[] = "The data argument must be an integer-type TypedArray";
+    scr_throw_domex(mismatch, mismatch_msg);
+    return NULL;
+  }
+  ScrBytes *filled = scr_crypto_get_random_values(value->v.bytes);
+  if (!filled) return NULL;
+  scr_bytes_release(filled);
+  return scr_dyn_retain(value);
+}
diff --git a/packages/runtime/src/scr_node_builtin.c b/packages/runtime/src/scr_node_builtin.c
index 34c700350..233617092 100644
--- a/packages/runtime/src/scr_node_builtin.c
+++ b/packages/runtime/src/scr_node_builtin.c
@@ -86,6 +86,10 @@ ScrDyn *scr_util_system_error_entries(void) {
 
 static SCR_TL ScrDyn *scr_global_known;
 static SCR_TL ScrDyn *scr_global_own;
+/* The one box denoting this thread's global object. Symbol-keyed properties
+ * live on the box (string-keyed ones in scr_global_own), so every spelling
+ * of the global object answers this box. */
+static SCR_TL ScrDyn *scr_global_box;
 static SCR_TL bool scr_global_cleanup_registered;
 static SCR_TL ScrDyn *(*scr_global_console_get)(void);
 static SCR_TL ScrDyn *(*scr_global_fetch_get)(void);
@@ -180,6 +184,8 @@ ScrDyn *scr_process_hrtime_value(void) {
 }
 
 static void scr_global_cleanup(void) {
+  scr_dyn_release(scr_global_box);
+  scr_global_box = NULL;
   scr_dyn_release(scr_global_known);
   scr_dyn_release(scr_global_own);
   scr_global_known = NULL;
@@ -195,7 +201,7 @@ static ScrDyn *scr_global_get(void *handle, const char *key, size_t length) {
   if (own) return scr_dyn_retain(own);
   if ((length == 10 && memcmp(key, "globalThis", length) == 0) ||
       (length == 6 && memcmp(key, "global", length) == 0))
-    return scr_dyn_new_handle(&scr_global_known, SCR_DYNH_GLOBAL);
+    return scr_dyn_retain(scr_global_box);
   if (length == 7 && memcmp(key, "console", length) == 0 && scr_global_console_get)
     return scr_global_console_get();
   if (length == 5 && memcmp(key, "fetch", length) == 0 && scr_global_fetch_get) return scr_global_fetch_get();
@@ -223,26 +229,32 @@ static bool scr_global_set(void *handle, const char *key, size_t length, const S
   return true;
 }
 
-ScrDyn *scr_global_native_init(ScrArr *known, ScrDyn *(*console_get)(void)) {
+ScrDyn *scr_global_object(void) {
   static const ScrDynHandleOps ops = {
     .cls = "Object", .retain = scr_global_retain, .release = scr_global_release,
     .get = scr_global_get, .set = scr_global_set,
   };
   scr_dyn_handle_install(SCR_DYNH_GLOBAL, &ops);
-  scr_global_console_get = console_get;
   if (!scr_global_known) scr_global_known = scr_dyn_new_obj();
   if (!scr_global_own) scr_global_own = scr_dyn_new_obj();
+  if (!scr_global_box) scr_global_box = scr_dyn_new_handle(&scr_global_known, SCR_DYNH_GLOBAL);
   if (!scr_global_cleanup_registered) {
     scr_atexit(scr_global_cleanup);
     scr_global_cleanup_registered = true;
   }
+  return scr_global_box;
+}
+
+ScrDyn *scr_global_native_init(ScrArr *known, ScrDyn *(*console_get)(void)) {
+  ScrDyn *global = scr_global_object();
+  scr_global_console_get = console_get;
   for (size_t i = 0; i < known->len; i++) {
     ScrStr *key = (ScrStr *)scr_arr_get_ref(known, (double)i);
     if (!scr_dyn_obj_get(scr_global_known, key->data, key->len))
       scr_dyn_obj_set(scr_global_known, key->data, key->len, scr_dyn_new_bool(true));
     scr_str_release(key);
   }
-  return scr_dyn_new_handle(&scr_global_known, SCR_DYNH_GLOBAL);
+  return scr_dyn_retain(global);
 }
 
 typedef struct ScrBuiltinModule {
diff --git a/packages/runtime/src/scr_number.c b/packages/runtime/src/scr_number.c
index 1ccc414b7..dc8743e14 100644
--- a/packages/runtime/src/scr_number.c
+++ b/packages/runtime/src/scr_number.c
@@ -654,3 +654,163 @@ size_t scr_f64_to_fixed(double x, int f, char *buf) {
   *o = '\0';
   return (size_t)(o - buf);
 }
+
+/* ── toPrecision / toExponential(fractionDigits) digit engine ──────────
+ * The spec's n and e for p significant digits: the integer n with
+ * 10^(p-1) <= n < 10^p for which n × 10^(e-p+1) - x is closest to zero,
+ * ties picking the LARGER n (half-up on the exact binary value). Exact
+ * big-integer arithmetic over the double's mantissa: the value scaled by
+ * 10^(p-1-e) is mantissa × 2^(binary_exp + f) × 5^f, and
+ * round_half_up(v) = floor((floor(2v) + 1) / 2) composes from floor
+ * divisions alone. Values reach ~1100 bits (5e-324 at 100 digits and
+ * 1.8e308), so the limbs are wider than toFixed's. Nothing on an existing
+ * path calls this. */
+#define SCR_PREC_LIMBS 40
+typedef struct {
+  uint32_t limb[SCR_PREC_LIMBS]; /* little-endian */
+  int len;
+} ScrPrecInt;
+
+static void scr_prec_normalize(ScrPrecInt *v) {
+  while (v->len > 1 && v->limb[v->len - 1] == 0) v->len--;
+}
+
+static void scr_prec_mul_small(ScrPrecInt *v, uint32_t m) {
+  uint64_t carry = 0;
+  for (int i = 0; i < v->len; i++) {
+    uint64_t p = (uint64_t)v->limb[i] * m + carry;
+    v->limb[i] = (uint32_t)p;
+    carry = p >> 32;
+  }
+  if (carry != 0) v->limb[v->len++] = (uint32_t)carry;
+}
+
+static uint32_t scr_prec_div_small(ScrPrecInt *v, uint32_t d) {
+  uint64_t rem = 0;
+  for (int i = v->len - 1; i >= 0; i--) {
+    uint64_t cur = (rem << 32) | v->limb[i];
+    v->limb[i] = (uint32_t)(cur / d);
+    rem = cur % d;
+  }
+  scr_prec_normalize(v);
+  return (uint32_t)rem;
+}
+
+static void scr_prec_shl(ScrPrecInt *v, int bits) {
+  uint32_t out[SCR_PREC_LIMBS] = {0};
+  int words = bits / 32;
+  int rem = bits % 32;
+  for (int i = 0; i < v->len; i++) {
+    int at = i + words;
+    out[at] |= v->limb[i] << rem;
+    if (rem != 0 && at + 1 < SCR_PREC_LIMBS) out[at + 1] |= v->limb[i] >> (32 - rem);
+  }
+  int n = v->len + words + 1;
+  if (n > SCR_PREC_LIMBS) n = SCR_PREC_LIMBS;
+  memcpy(v->limb, out, sizeof out);
+  v->len = n;
+  scr_prec_normalize(v);
+}
+
+static void scr_prec_shr(ScrPrecInt *v, int bits) {
+  int words = bits / 32;
+  int rem = bits % 32;
+  if (words >= v->len) {
+    v->limb[0] = 0;
+    v->len = 1;
+    return;
+  }
+  int n = v->len - words;
+  for (int i = 0; i < n; i++) {
+    uint32_t lo = v->limb[i + words] >> rem;
+    uint32_t hi = rem != 0 && i + words + 1 < v->len ? v->limb[i + words + 1] << (32 - rem) : 0;
+    v->limb[i] = lo | hi;
+  }
+  v->len = n;
+  scr_prec_normalize(v);
+}
+
+/* round_half_up(a × 10^f) for positive finite a, as a decimal digit
+ * string written right-aligned ending at `end`; returns the first digit. */
+static char *scr_prec_scaled_digits(double a, int f, char *end) {
+  uint64_t bits;
+  memcpy(&bits, &a, sizeof bits);
+  uint64_t mantissa = bits & ((UINT64_C(1) << 52) - 1);
+  int ieee_exp = (int)((bits >> 52) & 0x7ffu);
+  int binary_exp;
+  if (ieee_exp == 0) {
+    binary_exp = -1074;
+  } else {
+    mantissa |= UINT64_C(1) << 52;
+    binary_exp = ieee_exp - 1023 - 52;
+  }
+  ScrPrecInt v = {{(uint32_t)mantissa, (uint32_t)(mantissa >> 32)}, 2};
+  scr_prec_normalize(&v);
+  for (int i = 0; i < f; i++) scr_prec_mul_small(&v, 5);
+  int twos = binary_exp + f + 1; /* the +1 doubles: floor(2v) */
+  if (twos > 0) scr_prec_shl(&v, twos);
+  for (int i = 0; i < -f; i++) scr_prec_div_small(&v, 5);
+  if (twos < 0) scr_prec_shr(&v, -twos);
+  /* (floor(2v) + 1) / 2 */
+  uint64_t carry = 1;
+  for (int i = 0; i < v.len && carry != 0; i++) {
+    uint64_t s = (uint64_t)v.limb[i] + carry;
+    v.limb[i] = (uint32_t)s;
+    carry = s >> 32;
+  }
+  if (carry != 0) v.limb[v.len++] = (uint32_t)carry;
+  scr_prec_shr(&v, 1);
+  char *p = end;
+  for (;;) {
+    uint32_t chunk = scr_prec_div_small(&v, 1000000000u);
+    bool last = v.len == 1 && v.limb[0] == 0;
+    for (int i = 0; i < 9 && (chunk != 0 || !last || p == end); i++) {
+      *--p = (char)('0' + chunk % 10);
+      chunk /= 10;
+    }
+    if (last) break;
+  }
+  return p;
+}
+
+int scr_f64_precision_digits(double a, int p, char *digits, int *e_out) {
+  char shortest[18];
+  int n;
+  scr_f64_digits(a, shortest, &n);
+  int e = n - 1;
+  char buf[400];
+  char *end = buf + sizeof buf;
+  for (int attempt = 0; attempt < 3; attempt++) {
+    char *first = scr_prec_scaled_digits(a, p - 1 - e, end);
+    int len = (int)(end - first);
+    if (len == p) {
+      memcpy(digits, first, (size_t)p);
+      digits[p] = '\0';
+      *e_out = e;
+      return p;
+    }
+    if (len > p) {
+      /* Rounding carried into a new digit (or the estimate was low). */
+      if (len == p + 1 && first[0] == '1') {
+        bool zeros = true;
+        for (int i = 1; i < len; i++) zeros = zeros && first[i] == '0';
+        if (zeros) {
+          digits[0] = '1';
+          memset(digits + 1, '0', (size_t)(p - 1));
+          digits[p] = '\0';
+          *e_out = e + 1;
+          return p;
+        }
+      }
+      e++;
+    } else {
+      e--;
+    }
+  }
+  /* Unreachable for finite positive doubles: the estimate is off by at
+   * most one decade. */
+  memset(digits, '0', (size_t)p);
+  digits[p] = '\0';
+  *e_out = e;
+  return p;
+}
diff --git a/packages/runtime/src/scr_number.h b/packages/runtime/src/scr_number.h
index 2d95d95f5..f43195116 100644
--- a/packages/runtime/src/scr_number.h
+++ b/packages/runtime/src/scr_number.h
@@ -37,6 +37,12 @@ int scr_decimal_scan(const char *p, size_t n, double *out);
  * the length. */
 size_t scr_f64_to_fixed(double x, int f, char *buf);
 
+/* toPrecision / toExponential(fractionDigits) digits for POSITIVE finite
+ * a and 1 <= p <= 101: the spec's p-digit n (ties to the larger n on the
+ * exact binary value) into digits (NUL-terminated, >= p + 1 bytes) and its
+ * decimal exponent e (value ~ d.ddd x 10^e) into *e_out. Returns p. */
+int scr_f64_precision_digits(double a, int p, char *digits, int *e_out);
+
 /* ToString for template literals / string coercion. Returns +1. */
 ScrStr *scr_f64_to_scrstr(double x);
 ScrStr *scr_bool_to_scrstr(bool b); /* interned "true"/"false" */
@@ -73,6 +79,11 @@ bool scr_num_is_safe_integer(double x);
 ScrStr *scr_num_to_exponential(double x);
 ScrStr *scr_num_to_fixed0(double x);
 ScrStr *scr_num_to_fixed(double x, double fraction_digits);
+/* Number.prototype.toPrecision(precision) and toExponential(fractionDigits)
+ * with the argument already coerced (has_precision false = undefined).
+ * Invalid digit counts throw V8's RangeError (NULL). Result +1. */
+ScrStr *scr_num_to_precision(double x, double precision, bool has_precision);
+ScrStr *scr_num_to_exponential_digits(double x, double fraction_digits);
 ScrStr *scr_num_to_string_radix_f64(double value, double radix);
 
 /* Object.is over two numbers — the spec's SameValue on doubles: NaN
diff --git a/packages/runtime/src/scr_os.c b/packages/runtime/src/scr_os.c
index 2e70d0d85..500283995 100644
--- a/packages/runtime/src/scr_os.c
+++ b/packages/runtime/src/scr_os.c
@@ -1526,3 +1526,178 @@ ScrDyn *scr_node_constants(const ScrDyn *crypto_table) {
   scr_atexit(scr_node_constants_clear);
   return scr_dyn_retain(o);
 }
+
+/* fs.constants as a value: node_constants.cc's fs group (the set
+ * node:constants merges above), in its order and under its #ifdef guards,
+ * on its own cached null-prototype object with read-only members. It keeps
+ * its own table instead of calling the scr_fs_constants fill: a second
+ * caller would stop that static from inlining into scr_node_constants and
+ * change every binary that links node:constants. The names live inside
+ * the table entries, so the table is one data object section GC drops.
+ * Nothing on an existing path calls this. */
+typedef struct {
+  char name[32];
+  double value;
+} ScrFsConstant;
+#define SCR_FS_C(n) {#n, (double)(n)}
+static const ScrFsConstant scr_fs_constant_table[] = {
+    {"UV_FS_SYMLINK_DIR", 1},
+    {"UV_FS_SYMLINK_JUNCTION", 2},
+#ifdef O_RDONLY
+    SCR_FS_C(O_RDONLY),
+#endif
+#ifdef O_WRONLY
+    SCR_FS_C(O_WRONLY),
+#endif
+#ifdef O_RDWR
+    SCR_FS_C(O_RDWR),
+#endif
+    {"UV_DIRENT_UNKNOWN", 0},
+    {"UV_DIRENT_FILE", 1},
+    {"UV_DIRENT_DIR", 2},
+    {"UV_DIRENT_LINK", 3},
+    {"UV_DIRENT_FIFO", 4},
+    {"UV_DIRENT_SOCKET", 5},
+    {"UV_DIRENT_CHAR", 6},
+    {"UV_DIRENT_BLOCK", 7},
+#ifdef S_IFMT
+    SCR_FS_C(S_IFMT),
+#endif
+#ifdef S_IFREG
+    SCR_FS_C(S_IFREG),
+#endif
+#ifdef S_IFDIR
+    SCR_FS_C(S_IFDIR),
+#endif
+#ifdef S_IFCHR
+    SCR_FS_C(S_IFCHR),
+#endif
+#ifdef S_IFBLK
+    SCR_FS_C(S_IFBLK),
+#endif
+#ifdef S_IFIFO
+    SCR_FS_C(S_IFIFO),
+#endif
+#ifdef S_IFLNK
+    SCR_FS_C(S_IFLNK),
+#endif
+#ifdef S_IFSOCK
+    SCR_FS_C(S_IFSOCK),
+#endif
+#ifdef O_CREAT
+    SCR_FS_C(O_CREAT),
+#endif
+#ifdef O_EXCL
+    SCR_FS_C(O_EXCL),
+#endif
+    {"UV_FS_O_FILEMAP", 0},
+    {"UV_FS_O_TEMPORARY", 0},
+    {"UV_FS_O_SHORT_LIVED", 0},
+    {"UV_FS_O_SEQUENTIAL", 0},
+    {"UV_FS_O_RANDOM", 0},
+#ifdef O_NOCTTY
+    SCR_FS_C(O_NOCTTY),
+#endif
+#ifdef O_TRUNC
+    SCR_FS_C(O_TRUNC),
+#endif
+#ifdef O_APPEND
+    SCR_FS_C(O_APPEND),
+#endif
+#ifdef O_DIRECTORY
+    SCR_FS_C(O_DIRECTORY),
+#endif
+#ifdef O_NOATIME
+    SCR_FS_C(O_NOATIME),
+#endif
+#ifdef O_NOFOLLOW
+    SCR_FS_C(O_NOFOLLOW),
+#endif
+#ifdef O_SYNC
+    SCR_FS_C(O_SYNC),
+#endif
+#ifdef O_DSYNC
+    SCR_FS_C(O_DSYNC),
+#endif
+#ifdef O_SYMLINK
+    SCR_FS_C(O_SYMLINK),
+#endif
+#ifdef O_DIRECT
+    SCR_FS_C(O_DIRECT),
+#endif
+#ifdef O_NONBLOCK
+    SCR_FS_C(O_NONBLOCK),
+#endif
+#ifdef S_IRWXU
+    SCR_FS_C(S_IRWXU),
+#endif
+#ifdef S_IRUSR
+    SCR_FS_C(S_IRUSR),
+#endif
+#ifdef S_IWUSR
+    SCR_FS_C(S_IWUSR),
+#endif
+#ifdef S_IXUSR
+    SCR_FS_C(S_IXUSR),
+#endif
+#ifdef S_IRWXG
+    SCR_FS_C(S_IRWXG),
+#endif
+#ifdef S_IRGRP
+    SCR_FS_C(S_IRGRP),
+#endif
+#ifdef S_IWGRP
+    SCR_FS_C(S_IWGRP),
+#endif
+#ifdef S_IXGRP
+    SCR_FS_C(S_IXGRP),
+#endif
+#ifdef S_IRWXO
+    SCR_FS_C(S_IRWXO),
+#endif
+#ifdef S_IROTH
+    SCR_FS_C(S_IROTH),
+#endif
+#ifdef S_IWOTH
+    SCR_FS_C(S_IWOTH),
+#endif
+#ifdef S_IXOTH
+    SCR_FS_C(S_IXOTH),
+#endif
+#ifdef F_OK
+    SCR_FS_C(F_OK),
+#endif
+#ifdef R_OK
+    SCR_FS_C(R_OK),
+#endif
+#ifdef W_OK
+    SCR_FS_C(W_OK),
+#endif
+#ifdef X_OK
+    SCR_FS_C(X_OK),
+#endif
+    {"UV_FS_COPYFILE_EXCL", 1},
+    {"COPYFILE_EXCL", 1},
+    {"UV_FS_COPYFILE_FICLONE", 2},
+    {"COPYFILE_FICLONE", 2},
+    {"UV_FS_COPYFILE_FICLONE_FORCE", 4},
+    {"COPYFILE_FICLONE_FORCE", 4},
+};
+#undef SCR_FS_C
+
+static SCR_TL ScrDyn *scr_fs_constants_value;
+static void scr_fs_constants_clear(void) {
+  ScrDyn *value = scr_fs_constants_value;
+  scr_fs_constants_value = NULL;
+  scr_dyn_release(value);
+}
+
+ScrDyn *scr_fs_constants_object(void) {
+  if (scr_fs_constants_value) return scr_dyn_retain(scr_fs_constants_value);
+  ScrDyn *o = scr_dyn_new_obj_null_proto();
+  for (size_t i = 0; i < sizeof scr_fs_constant_table / sizeof scr_fs_constant_table[0]; i++)
+    scr_os_constant(o, scr_fs_constant_table[i].name, scr_fs_constant_table[i].value);
+  scr_fs_constants_value = o;
+  scr_atexit(scr_fs_constants_clear);
+  return scr_dyn_retain(o);
+}
diff --git a/packages/runtime/src/scr_os.h b/packages/runtime/src/scr_os.h
index 219726660..57f219ad1 100644
--- a/packages/runtime/src/scr_os.h
+++ b/packages/runtime/src/scr_os.h
@@ -38,6 +38,8 @@ ScrStr *scr_os_cpus_model(double i);
 double scr_os_cpus_field(double i, double field);
 /* os.constants: the per-thread null-prototype constants object (+1). */
 ScrDyn *scr_os_constants(void);
+/* fs.constants: the target's null-prototype constants object (cached, +1). */
+ScrDyn *scr_fs_constants_object(void);
 /* The deprecated node:constants module object (scr_os.c): the os groups,
  * fs.constants and the crypto table the borrowed function answers, merged
  * and frozen (+1). */
diff --git a/packages/runtime/src/scr_regex.c b/packages/runtime/src/scr_regex.c
index 44a91410b..fa104058f 100644
--- a/packages/runtime/src/scr_regex.c
+++ b/packages/runtime/src/scr_regex.c
@@ -2020,6 +2020,222 @@ static ScrStr *scr_str_case_conv(const ScrStr *s, int to_lower) {
 ScrStr *scr_str_to_lower(const ScrStr *s) { return scr_str_case_conv(s, 1); }
 ScrStr *scr_str_to_upper(const ScrStr *s) { return scr_str_case_conv(s, 0); }
 
+/* ── String.prototype.toLocaleLowerCase / toLocaleUpperCase ────────────
+ * V8 decides the case mapping from the FIRST requested locale only
+ * (probed: ["en", 5] maps like "en", [5] throws, a non-object primitive
+ * requests nothing). ICU tailors case mapping for Turkic (tr, az: dotted
+ * and dotless I), Lithuanian (dot above retention) and Greek uppercasing
+ * (accent removal); every other language uses the default conversion.
+ * The Turkic rules are SpecialCasing's: lowercase I → ı unless a
+ * U+0307 follows (then I + U+0307 → i), İ → i; uppercase i → İ. Tags are
+ * checked against the unicode_locale_id structure; anything this unit
+ * cannot decide exactly (malformed tags, whose V8 RangeError texts vary,
+ * objects, lt, el uppercasing, I before other combining marks) throws a
+ * 'not supported yet' Error rather than guess. Nothing on an existing
+ * path calls this. */
+
+static bool scr_tag_alpha(const char *p, size_t n) {
+  for (size_t i = 0; i < n; i++)
+    if (!((p[i] >= 'a' && p[i] <= 'z') || (p[i] >= 'A' && p[i] <= 'Z'))) return false;
+  return true;
+}
+
+static bool scr_tag_digit(const char *p, size_t n) {
+  for (size_t i = 0; i < n; i++)
+    if (!(p[i] >= '0' && p[i] <= '9')) return false;
+  return true;
+}
+
+static bool scr_tag_alnum(const char *p, size_t n) {
+  for (size_t i = 0; i < n; i++)
+    if (!scr_tag_alpha(p + i, 1) && !scr_tag_digit(p + i, 1)) return false;
+  return true;
+}
+
+static bool scr_tag_same(const char *a, size_t an, const char *b, size_t bn) {
+  if (an != bn) return false;
+  for (size_t i = 0; i < an; i++) {
+    char x = a[i] >= 'A' && a[i] <= 'Z' ? (char)(a[i] + 32) : a[i];
+    char y = b[i] >= 'A' && b[i] <= 'Z' ? (char)(b[i] + 32) : b[i];
+    if (x != y) return false;
+  }
+  return true;
+}
+
+/* 0 default, 1 Turkic, 2 Lithuanian, 3 Greek; -1 when the tag is outside
+ * the structural grammar handled here. */
+static int scr_locale_case_rules(const char *tag, size_t len) {
+  const char *subtags[64];
+  size_t lens[64];
+  size_t count = 0;
+  size_t start = 0;
+  for (size_t i = 0; i <= len; i++) {
+    if (i < len && tag[i] != '-') continue;
+    if (i == start || count == 64) return -1;
+    subtags[count] = tag + start;
+    lens[count++] = i - start;
+    start = i + 1;
+  }
+  size_t k = 0;
+  size_t lang = lens[0];
+  if (!scr_tag_alpha(subtags[0], lang) || !((lang >= 2 && lang <= 3) || (lang >= 5 && lang <= 8)))
+    return -1;
+  k = 1;
+  if (k < count && lens[k] == 4 && scr_tag_alpha(subtags[k], 4)) k++;
+  if (k < count && ((lens[k] == 2 && scr_tag_alpha(subtags[k], 2)) ||
+                    (lens[k] == 3 && scr_tag_digit(subtags[k], 3))))
+    k++;
+  size_t variants = k;
+  while (k < count && scr_tag_alnum(subtags[k], lens[k]) &&
+         ((lens[k] >= 5 && lens[k] <= 8) || (lens[k] == 4 && scr_tag_digit(subtags[k], 1)))) {
+    for (size_t j = variants; j < k; j++)
+      if (scr_tag_same(subtags[j], lens[j], subtags[k], lens[k])) return -1;
+    k++;
+  }
+  size_t singletons = k;
+  while (k < count) {
+    if (lens[k] != 1 || !scr_tag_alnum(subtags[k], 1)) return -1;
+    for (size_t j = singletons; j < k; j++)
+      if (lens[j] == 1 && scr_tag_same(subtags[j], 1, subtags[k], 1)) return -1;
+    bool private_use = subtags[k][0] == 'x' || subtags[k][0] == 'X';
+    size_t min = private_use ? 1 : 2;
+    size_t first = ++k;
+    while (k < count && lens[k] >= min && lens[k] <= 8 && scr_tag_alnum(subtags[k], lens[k]) &&
+           (private_use || lens[k] > 1))
+      k++;
+    if (k == first) return -1;
+    if (private_use && k != count) return -1;
+  }
+  if (lang > 3) return 0;
+  char l[3] = {0, 0, 0};
+  for (size_t i = 0; i < lang; i++)
+    l[i] = subtags[0][i] >= 'A' && subtags[0][i] <= 'Z' ? (char)(subtags[0][i] + 32) : subtags[0][i];
+  bool two = lang == 2;
+  if ((two && l[0] == 't' && l[1] == 'r') || (two && l[0] == 'a' && l[1] == 'z') ||
+      (!two && l[0] == 't' && l[1] == 'u' && l[2] == 'r') ||
+      (!two && l[0] == 'a' && l[1] == 'z' && l[2] == 'e'))
+    return 1;
+  if ((two && l[0] == 'l' && l[1] == 't') || (!two && l[0] == 'l' && l[1] == 'i' && l[2] == 't'))
+    return 2;
+  if ((two && l[0] == 'e' && l[1] == 'l') || (!two && l[0] == 'e' && l[1] == 'l' && l[2] == 'l') ||
+      (!two && l[0] == 'g' && l[1] == 'r' && l[2] == 'e'))
+    return 3;
+  return 0;
+}
+
+static ScrStr *scr_locale_case_unsupported(bool upper) {
+  static const char lower_msg[] =
+      "String.prototype.toLocaleLowerCase with this locale argument is not supported yet";
+  static const char upper_msg[] =
+      "String.prototype.toLocaleUpperCase with this locale argument is not supported yet";
+  /* The unit's existing "SC2020" literal: a separate constant array would
+   * absorb it (LLVM merges identical constants) and move it out of the
+   * string section every regex-linking binary keeps. */
+  if (upper) scr_throw_error_msg_code(SCR_ERR_ERROR, upper_msg, sizeof upper_msg - 1, "SC2020");
+  else scr_throw_error_msg_code(SCR_ERR_ERROR, lower_msg, sizeof lower_msg - 1, "SC2020");
+  return NULL;
+}
+
+static ScrStr *scr_turkic_case(const ScrStr *s, bool upper) {
+  ScrJsonBuf b;
+  scr_jb_init(&b);
+  for (size_t i = 0; i < s->len; i++) {
+    unsigned char c = (unsigned char)s->data[i];
+    if (upper && c == 'i') {
+      scr_jb_putc(&b, (char)0xC4); /* İ */
+      scr_jb_putc(&b, (char)0xB0);
+      continue;
+    }
+    if (!upper && c == 'I') {
+      unsigned char n0 = i + 1 < s->len ? (unsigned char)s->data[i + 1] : 0;
+      unsigned char n1 = i + 2 < s->len ? (unsigned char)s->data[i + 2] : 0;
+      if (n0 == 0xCC && n1 == 0x87) { /* I + U+0307 → i */
+        scr_jb_putc(&b, 'i');
+        i += 2;
+        continue;
+      }
+      /* Another combining mark (U+0300..U+036F) may precede a U+0307. */
+      if ((n0 == 0xCC && n1 >= 0x80) || (n0 == 0xCD && n1 >= 0x80 && n1 <= 0xAF)) {
+        scr_str_release(scr_jb_finish(&b));
+        return scr_locale_case_unsupported(upper);
+      }
+      scr_jb_putc(&b, (char)0xC4); /* ı */
+      scr_jb_putc(&b, (char)0xB1);
+      continue;
+    }
+    if (!upper && c == 0xC4 && i + 1 < s->len && (unsigned char)s->data[i + 1] == 0xB0) {
+      scr_jb_putc(&b, 'i'); /* İ → i */
+      i++;
+      continue;
+    }
+    scr_jb_putc(&b, (char)c);
+  }
+  ScrStr *mapped = scr_jb_finish(&b);
+  ScrStr *result = scr_str_case_conv(mapped, upper ? 0 : 1);
+  scr_str_release(mapped);
+  return result;
+}
+
+ScrStr *scr_str_locale_case(const ScrStr *s, ScrDyn *locales, bool upper) {
+  ScrDyn *owned = NULL;
+  if (locales->kind == SCR_DYN_TYPED_REF) {
+    owned = scr_dyn_typed_ref_materialize(locales);
+    if (!owned) return NULL;
+    locales = owned;
+  }
+  const ScrDyn *tag = NULL;
+  int rules = 0;
+  switch (locales->kind) {
+  case SCR_DYN_NULL: {
+    static const char msg[] = "Cannot convert undefined or null to object";
+    scr_throw_error_msg(SCR_ERR_TYPE, msg, sizeof msg - 1);
+    return NULL;
+  }
+  case SCR_DYN_UNDEF:
+  case SCR_DYN_NUM:
+  case SCR_DYN_BOOL:
+  case SCR_DYN_SYMBOL:
+  case SCR_DYN_BIGINT:
+    break;
+  case SCR_DYN_STR:
+    tag = locales;
+    break;
+  case SCR_DYN_ARR:
+    if (locales->v.arr.len == 0) break;
+    if (locales->v.arr.presence && !locales->v.arr.presence[0]) {
+      static const char msg[] = "Language ID should be string or object.";
+      scr_throw_error_msg(SCR_ERR_TYPE, msg, sizeof msg - 1);
+      scr_dyn_release(owned);
+      return NULL;
+    }
+    tag = locales->v.arr.items[0];
+    if (tag->kind != SCR_DYN_STR) {
+      bool primitive = tag->kind == SCR_DYN_UNDEF || tag->kind == SCR_DYN_NULL ||
+                       tag->kind == SCR_DYN_NUM || tag->kind == SCR_DYN_BOOL ||
+                       tag->kind == SCR_DYN_BIGINT || tag->kind == SCR_DYN_SYMBOL;
+      scr_dyn_release(owned);
+      if (!primitive) return scr_locale_case_unsupported(upper);
+      static const char msg[] = "Language ID should be string or object.";
+      scr_throw_error_msg(SCR_ERR_TYPE, msg, sizeof msg - 1);
+      return NULL;
+    }
+    break;
+  default:
+    scr_dyn_release(owned);
+    return scr_locale_case_unsupported(upper);
+  }
+  if (tag) {
+    rules = scr_locale_case_rules(tag->v.str->data, tag->v.str->len);
+    if (rules < 0 || rules == 2 || (rules == 3 && upper)) {
+      scr_dyn_release(owned);
+      return scr_locale_case_unsupported(upper);
+    }
+  }
+  scr_dyn_release(owned);
+  if (rules == 1) return scr_turkic_case(s, upper);
+  return scr_str_case_conv(s, upper ? 0 : 1);
+}
+
 static void *scr_normalize_realloc(void *opaque, void *ptr, size_t size) {
   (void)opaque;
   if (!size) { free(ptr); return NULL; }
diff --git a/packages/runtime/src/scr_string.c b/packages/runtime/src/scr_string.c
index 43cf21b0c..8358658b5 100644
--- a/packages/runtime/src/scr_string.c
+++ b/packages/runtime/src/scr_string.c
@@ -6,6 +6,11 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#if defined(__SSE2__)
+#include <emmintrin.h>
+#elif defined(__ARM_NEON) && defined(__aarch64__)
+#include <arm_neon.h>
+#endif
 
 /* Live heap-string count for the RC audit lane (-DSCR_RC_AUDIT): the test
  * harness builds with it to prove the emitted retain/release discipline
@@ -836,24 +841,93 @@ static __attribute__((noinline)) int scr_str_cmp_u16_units(const ScrStr *a, cons
   }
 }
 
+/* The memory index of the first differing byte of two words; x is their
+ * xor and is not zero. */
+static inline size_t scr_word_mismatch(uint64_t x) {
+#if defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
+  return (size_t)__builtin_clzll(x) >> 3;
+#else
+  return (size_t)__builtin_ctzll(x) >> 3;
+#endif
+}
+
+static inline size_t scr_word32_mismatch(uint32_t x) {
+#if defined(__BYTE_ORDER__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
+  return (size_t)__builtin_clz(x) >> 3;
+#else
+  return (size_t)__builtin_ctz(x) >> 3;
+#endif
+}
+
+/* The index of the first byte where the n-byte spans a and b differ, or n
+ * when they are equal. Spans of at least 8 bytes compare words up to byte
+ * 32, then 32-byte blocks with SSE2 or NEON where the target has them,
+ * then words; the last word overlaps bytes already compared. Shorter
+ * spans compare two overlapping 4-byte halves, or bytes. */
+static inline size_t scr_span_mismatch(const char *a, const char *b, size_t n) {
+  size_t i = 0;
+  uint64_t l, r;
+  if (n < sizeof(uint64_t)) {
+    if (n >= sizeof(uint32_t)) {
+      uint32_t l4, r4;
+      memcpy(&l4, a, 4);
+      memcpy(&r4, b, 4);
+      if (l4 != r4) return scr_word32_mismatch(l4 ^ r4);
+      memcpy(&l4, a + n - 4, 4);
+      memcpy(&r4, b + n - 4, 4);
+      return l4 != r4 ? n - 4 + scr_word32_mismatch(l4 ^ r4) : n;
+    }
+    while (i < n && a[i] == b[i]) i++;
+    return i;
+  }
+  memcpy(&l, a, 8);
+  memcpy(&r, b, 8);
+  if (l != r) return scr_word_mismatch(l ^ r);
+  size_t head = n < 32 ? n & ~(size_t)7 : 32;
+  for (i = sizeof(uint64_t); i < head; i += sizeof(uint64_t)) {
+    memcpy(&l, a + i, 8);
+    memcpy(&r, b + i, 8);
+    if (l != r) return i + scr_word_mismatch(l ^ r);
+  }
+#if defined(__SSE2__)
+  for (; n - i >= 32; i += 32) {
+    __m128i e0 = _mm_cmpeq_epi8(_mm_loadu_si128((const __m128i *)(a + i)),
+                                _mm_loadu_si128((const __m128i *)(b + i)));
+    __m128i e1 = _mm_cmpeq_epi8(_mm_loadu_si128((const __m128i *)(a + i + 16)),
+                                _mm_loadu_si128((const __m128i *)(b + i + 16)));
+    uint32_t equal = (uint32_t)_mm_movemask_epi8(e0) | (uint32_t)_mm_movemask_epi8(e1) << 16;
+    if (equal != UINT32_MAX) return i + (size_t)__builtin_ctz(~equal);
+  }
+#elif defined(__ARM_NEON) && defined(__aarch64__)
+  /* A differing block leaves the loop; the word loop below finds the byte. */
+  for (; n - i >= 32; i += 32) {
+    uint8x16_t e0 = vceqq_u8(vld1q_u8((const uint8_t *)a + i), vld1q_u8((const uint8_t *)b + i));
+    uint8x16_t e1 =
+        vceqq_u8(vld1q_u8((const uint8_t *)a + i + 16), vld1q_u8((const uint8_t *)b + i + 16));
+    if (vminvq_u8(vandq_u8(e0, e1)) != 0xff) break;
+  }
+#endif
+  for (; n - i >= sizeof(uint64_t); i += sizeof(uint64_t)) {
+    memcpy(&l, a + i, 8);
+    memcpy(&r, b + i, 8);
+    if (l != r) return i + scr_word_mismatch(l ^ r);
+  }
+  if (i == n) return n;
+  size_t j = n - sizeof(uint64_t);
+  memcpy(&l, a + j, 8);
+  memcpy(&r, b + j, 8);
+  return l != r ? j + scr_word_mismatch(l ^ r) : n;
+}
+
 /* UTF-16 ordering over canonical WTF-8. Equal bytes can be skipped even
  * inside a multibyte character: unequal continuation bytes preserve code
  * point order. Differing lead bytes for U+E000..U+FFFF versus a
  * supplementary character reverse byte order, because the latter starts
  * with a UTF-16 high surrogate below U+E000. A lone surrogate against a
  * supplementary character compares their units. */
-int scr_str_cmp_u16(ScrStr *a, ScrStr *b) {
-  if (a == b) return 0;
+__attribute__((noinline)) int scr_str_cmp_u16_bytes(const ScrStr *a, const ScrStr *b) {
   size_t common = a->len < b->len ? a->len : b->len;
-  size_t i = 0;
-  while (common - i >= sizeof(uint64_t)) {
-    uint64_t left, right;
-    memcpy(&left, a->data + i, sizeof(left));
-    memcpy(&right, b->data + i, sizeof(right));
-    if (left != right) break;
-    i += sizeof(left);
-  }
-  while (i < common && a->data[i] == b->data[i]) i++;
+  size_t i = scr_span_mismatch(a->data, b->data, common);
   if (i == common) return (a->len > b->len) - (a->len < b->len);
   unsigned char left = (unsigned char)a->data[i];
   unsigned char right = (unsigned char)b->data[i];
@@ -866,6 +940,16 @@ int scr_str_cmp_u16(ScrStr *a, ScrStr *b) {
   return left < right ? -1 : 1;
 }
 
+/* Byte order differs from UTF-16 order only where both differing bytes are
+ * at least 0xED, which a proven-ASCII string never has: such pairs compare
+ * with memcmp. The scan stays out of line in a global function, so program
+ * builds can import this body. */
+int scr_str_cmp_u16(ScrStr *a, ScrStr *b) {
+  if (a == b) return 0;
+  if (scr_str_known_ascii(a) || scr_str_known_ascii(b)) return scr_str_cmp(a, b);
+  return scr_str_cmp_u16_bytes(a, b);
+}
+
 /* ── interned strings ─────────────────────────────────────────────────
  * The empty string and every single-character ASCII string are immortal
  * statics (same layout the emitter uses for literals): charAt/slice churn
diff --git a/packages/runtime/src/scr_string.h b/packages/runtime/src/scr_string.h
index 425dfaabf..fc2f15562 100644
--- a/packages/runtime/src/scr_string.h
+++ b/packages/runtime/src/scr_string.h
@@ -290,16 +290,19 @@ ScrStr *scr_str_concat_f64(ScrStr *a, double x);
 
 bool scr_str_eq(ScrStr *a, ScrStr *b);
 
-/* memcmp byte order == code-point order (see SEMANTICS.md: diverges from
- * JS UTF-16 code-unit order only for non-BMP vs U+E000..U+FFFF). Returns
- * <0, 0, >0. */
+/* memcmp byte order == code-point order, which differs from JS UTF-16
+ * code-unit order for non-BMP characters against U+E000..U+FFFF and for
+ * lone surrogates. Returns <0, 0, >0. Relational string operators use
+ * scr_str_cmp_u16. */
 int scr_str_cmp(ScrStr *a, ScrStr *b);
 /* a.localeCompare(b) with no locales/options: Node's root-locale order for
  * Latin-script text, code-point order outside it (scr_string.c). */
 double scr_str_locale_compare(ScrStr *a, ScrStr *b);
 
-/* ECMAScript string-list ordering: compare UTF-16 code units even though
- * ScrStr stores WTF-8. Returns <0, 0, >0. */
+/* ECMAScript string ordering: compare UTF-16 code units even though ScrStr
+ * stores WTF-8. Returns <0, 0, >0. */
 int scr_str_cmp_u16(ScrStr *a, ScrStr *b);
+/* scr_str_cmp_u16 for two distinct strings that are not proven ASCII. */
+int scr_str_cmp_u16_bytes(const ScrStr *a, const ScrStr *b);
 
 #endif /* SCR_STRING_H */
diff --git a/packages/runtime/src/scr_string_methods.h b/packages/runtime/src/scr_string_methods.h
index 62354142e..6ed2e09df 100644
--- a/packages/runtime/src/scr_string_methods.h
+++ b/packages/runtime/src/scr_string_methods.h
@@ -73,6 +73,10 @@ bool scr_str_ends_with_from(ScrStr *s, ScrStr *needle, double end_position);
 ScrStr *scr_str_slice(ScrStr *s, double start, double end);
 /* substring: clamp-and-swap (negatives clamp to 0, start > end swaps). */
 ScrStr *scr_str_substring(ScrStr *s, double start, double end);
+/* Annex B substr(start, length): start already ToNumber'd (NaN → 0), a
+ * negative start counts from the end, length absent (has_length false)
+ * runs to the end. Returns +1. */
+ScrStr *scr_str_substr(ScrStr *s, double start, double length, bool has_length);
 
 /* Scalar-only local slices retain their original owner without copying.
  * Bounds and split-surrogate replacements are snapshotted at construction. */
@@ -111,6 +115,13 @@ ScrStr *scr_str_trim(ScrStr *s);
 ScrStr *scr_str_to_lower(const ScrStr *s);
 ScrStr *scr_str_to_upper(const ScrStr *s);
 ScrStr *scr_str_normalize(const ScrStr *s, const ScrStr *form);
+/* toLocaleLowerCase/toLocaleUpperCase(locales) (scr_regex.c): undefined,
+ * empty lists, and primitives other than strings use the default case
+ * conversion; the first requested tag selects the Turkic (tr, az) rules or
+ * the default ones. Lithuanian, Greek uppercasing and tags outside the
+ * structural grammar throw a 'not supported yet' Error; null throws Node's
+ * TypeError. Borrows both; +1 or NULL with an exception pending. */
+ScrStr *scr_str_locale_case(const ScrStr *s, struct ScrDyn *locales, bool upper);
 /* NFC over a code point buffer (scr_regex.c, beside normalize): a fresh
  * malloc'd buffer the caller frees, its length in *out_len. Borrows input. */
 uint32_t *scr_nfc_code_points(const uint32_t *input, size_t length, size_t *out_len);
diff --git a/packages/runtime/src/scr_symbol.c b/packages/runtime/src/scr_symbol.c
index 383b95986..304f2544f 100644
--- a/packages/runtime/src/scr_symbol.c
+++ b/packages/runtime/src/scr_symbol.c
@@ -181,72 +181,33 @@ void scr_assert_eq_sym(ScrSym *a, ScrSym *b, bool negated, bool deep,
   scr_str_release(ib);
 }
 
-/* Symbol-keyed globals share the symbol unit's link gate. The always-linked
- * JSON unit must not depend on optional symbol retain/release functions. */
-typedef struct ScrGlobalSymbolProperty {
-  ScrSym *key;
-  ScrDyn *value;
-  struct ScrGlobalSymbolProperty *next;
-} ScrGlobalSymbolProperty;
-
-static SCR_TL ScrGlobalSymbolProperty *scr_global_symbols = NULL;
-static SCR_TL bool scr_global_symbols_cleanup_registered = false;
-
-static void scr_global_symbols_cleanup(void) {
-  while (scr_global_symbols) {
-    ScrGlobalSymbolProperty *entry = scr_global_symbols;
-    scr_global_symbols = entry->next;
-    scr_sym_release(entry->key);
-    scr_dyn_release(entry->value);
-    free(entry);
-  }
-}
-
+/* Direct `globalThis[symbol]` accesses use the symbol-keyed properties of
+ * the global object's box (scr_global_object), the storage every other
+ * spelling of the global object reaches, so all of them see one property. */
 ScrDyn *scr_dyn_global_symbol_get(ScrSym *key) {
-  for (ScrGlobalSymbolProperty *entry = scr_global_symbols; entry; entry = entry->next) {
-    if (entry->key == key) return scr_dyn_retain(entry->value);
-  }
-  return scr_dyn_retain(scr_dyn_undefined());
+  ScrDyn *k = scr_dyn_new_symbol(key);
+  ScrDyn *value = scr_dyn_symbol_key_get(scr_global_object(), k, false);
+  scr_dyn_release(k);
+  return value;
 }
 
 void scr_dyn_global_symbol_set(ScrSym *key, ScrDyn *value) {
-  for (ScrGlobalSymbolProperty *entry = scr_global_symbols; entry; entry = entry->next) {
-    if (entry->key != key) continue;
-    ScrDyn *previous = entry->value;
-    entry->value = scr_dyn_retain(value);
-    scr_dyn_release(previous);
-    return;
-  }
-  if (!scr_global_symbols_cleanup_registered) {
-    scr_atexit(scr_global_symbols_cleanup);
-    scr_global_symbols_cleanup_registered = true;
-  }
-  ScrGlobalSymbolProperty *entry = malloc(sizeof *entry);
-  if (!entry) scr_trap("scriptc: out of memory\n");
-  entry->key = scr_sym_retain(key);
-  entry->value = scr_dyn_retain(value);
-  entry->next = scr_global_symbols;
-  scr_global_symbols = entry;
+  ScrDyn *k = scr_dyn_new_symbol(key);
+  scr_dyn_symbol_key_set(scr_global_object(), k, value);
+  scr_dyn_release(k);
 }
 
 bool scr_dyn_global_symbol_has(ScrSym *key) {
-  for (ScrGlobalSymbolProperty *entry = scr_global_symbols; entry; entry = entry->next) {
-    if (entry->key == key) return true;
-  }
-  return false;
+  ScrDyn *k = scr_dyn_new_symbol(key);
+  bool present = scr_dyn_has_own_computed(scr_global_object(), k);
+  scr_dyn_release(k);
+  return present;
 }
 
 void scr_dyn_global_symbol_delete(ScrSym *key) {
-  ScrGlobalSymbolProperty **slot = &scr_global_symbols;
-  while (*slot) {
-    ScrGlobalSymbolProperty *entry = *slot;
-    if (entry->key != key) { slot = &entry->next; continue; }
-    *slot = entry->next;
-    scr_sym_release(entry->key);
-    scr_dyn_release(entry->value);
-    free(entry);
-    return;
-  }
+  ScrDyn *k = scr_dyn_new_symbol(key);
+  scr_dyn_key_delete_computed(scr_global_object(), k, false);
+  scr_dyn_release(k);
 }
 
 /* ── fs.Dirent as a dynamic value ────────────────────────────────────
diff --git a/packages/runtime/src/scr_test.c b/packages/runtime/src/scr_test.c
index 7c5c243d8..762e25c61 100644
--- a/packages/runtime/src/scr_test.c
+++ b/packages/runtime/src/scr_test.c
@@ -983,9 +983,23 @@ static void scr_test_print_failure(ScrTestCtx *t) {
   }
   fputc('\n', stdout);
   if (t->err) {
-    /* Node prints the failure inspected: a thrown string is quoted. */
-    ScrStr *msg = t->err->kind == SCR_EXC_STR ? scr_insp_str(t->err->payload)
-                                              : scr_caught_to_string(t->err);
+    /* Node prints the failure inspected: a thrown string is quoted, and
+     * numbers, booleans and checked-dynamic values (thrown records, arrays,
+     * null and undefined) print as util.inspect renders them. Errors and
+     * other payloads print their string form. */
+    const ScrCaught *err = t->err;
+    ScrStr *msg;
+    if (err->kind == SCR_EXC_STR) {
+      msg = scr_insp_str(err->payload);
+    } else if (err->kind == SCR_EXC_F64 || err->kind == SCR_EXC_BOOL ||
+               ((err->kind == SCR_EXC_REF || err->kind == SCR_EXC_PRIMITIVE_REF) &&
+                err->retain_fn == scr_dyn_retain_v)) {
+      ScrDyn *value = scr_caught_to_dyn(err);
+      msg = scr_insp_dyn(value, 0, 2);
+      scr_dyn_release(value);
+    } else {
+      msg = scr_caught_to_string(err);
+    }
     if (msg) {
       const char *p = msg->data;
       const char *end = msg->data + msg->len;
diff --git a/packages/runtime/src/scr_webcrypto.c b/packages/runtime/src/scr_webcrypto.c
new file mode 100644
index 000000000..546b24151
--- /dev/null
+++ b/packages/runtime/src/scr_webcrypto.c
@@ -0,0 +1,829 @@
+/* WebCrypto's HMAC slice: crypto.subtle.importKey (raw HMAC keys),
+ * sign, verify and the SHA-1/SHA-2 digests, plus the CryptoKey values
+ * importKey answers.
+ *
+ * This unit is only the WebCrypto layer, modeled on Node 24's
+ * lib/internal/crypto/webcrypto.js and mac.js: Web IDL argument
+ * conversion, algorithm normalization, the CryptoKey handle, promise
+ * wrapping and Node's error shapes. The MACs and digests themselves come
+ * from node:crypto's digest core (scr_crypto_hmac_raw and
+ * scr_crypto_digest_raw in scr_lib.c), and results settle through the
+ * deferred crypto queue that node:crypto's callback forms use, so sign,
+ * verify and digest settle on a later loop turn like Node's thread-pool
+ * jobs while importKey settles at once.
+ *
+ * Every argument and validation failure rejects the returned promise.
+ * Algorithms Node recognizes but this slice does not implement (RSA,
+ * ECDSA, AES, SHA-3, ...) and the 'jwk' key format reject with a coded
+ * SC2020 Error instead of silently diverging. The compiler links the unit
+ * only into programs that call these methods (the webcrypto feature). */
+#include "scr_runtime.h"
+
+#include <math.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* ── algorithm registry ───────────────────────────────────────────────
+ * The names Node 24 registers per operation (util.js's
+ * kAlgorithmDefinitions with the conditional algorithms its OpenSSL
+ * build enables), matched case-insensitively. Only HMAC and the SHA-1/
+ * SHA-2 digests are implemented. */
+static const char *const scr_wc_import_names[] = {
+    "AES-CBC",       "AES-CTR",         "AES-GCM",        "AES-KW",       "AES-OCB",
+    "Argon2d",       "Argon2i",         "Argon2id",       "ChaCha20-Poly1305",
+    "ECDH",          "ECDSA",           "Ed25519",        "Ed448",        "HKDF",
+    "HMAC",          "KMAC128",         "KMAC256",        "ML-DSA-44",    "ML-DSA-65",
+    "ML-DSA-87",     "ML-KEM-512",      "ML-KEM-768",     "ML-KEM-1024",  "MLKEM768-P256",
+    "MLKEM768-X25519", "MLKEM1024-P384", "PBKDF2",        "RSA-OAEP",     "RSA-PSS",
+    "RSASSA-PKCS1-v1_5", "X25519",      "X448",
+};
+static const char *const scr_wc_sign_names[] = {
+    "ECDSA",     "Ed25519",   "Ed448",   "HMAC",    "KMAC128",           "KMAC256",
+    "ML-DSA-44", "ML-DSA-65", "ML-DSA-87", "RSA-PSS", "RSASSA-PKCS1-v1_5",
+};
+static const char *const scr_wc_digest_names[] = {
+    "SHA-1",     "SHA-256",   "SHA-384",   "SHA-512",   "SHA3-256",      "SHA3-384",
+    "SHA3-512",  "cSHAKE128", "cSHAKE256", "KT128",     "KT256",         "TurboSHAKE128",
+    "TurboSHAKE256",
+};
+
+#define SCR_WC_COUNT(names) (sizeof(names) / sizeof((names)[0]))
+
+/* The implemented hashes: WebCrypto name and node:crypto digest name. */
+static const struct {
+  const char *name;
+  const char *native;
+} scr_wc_hashes[] = {
+    {"SHA-1", "sha1"},
+    {"SHA-256", "sha256"},
+    {"SHA-384", "sha384"},
+    {"SHA-512", "sha512"},
+};
+
+static bool scr_wc_ascii_ieq(const ScrStr *s, const char *name) {
+  size_t n = strlen(name);
+  if (s->len != n) return false;
+  for (size_t i = 0; i < n; i++) {
+    unsigned char a = (unsigned char)s->data[i], b = (unsigned char)name[i];
+    if (a >= 'a' && a <= 'z') a = (unsigned char)(a - 32);
+    if (b >= 'a' && b <= 'z') b = (unsigned char)(b - 32);
+    if (a != b) return false;
+  }
+  return true;
+}
+
+/* The canonical registered spelling of `name`, or NULL. */
+static const char *scr_wc_lookup(const char *const *names, size_t count, const ScrStr *name) {
+  for (size_t i = 0; i < count; i++)
+    if (scr_wc_ascii_ieq(name, names[i])) return names[i];
+  return NULL;
+}
+
+static const char *scr_wc_native_hash(const char *name) {
+  for (size_t i = 0; i < SCR_WC_COUNT(scr_wc_hashes); i++)
+    if (strcmp(scr_wc_hashes[i].name, name) == 0) return scr_wc_hashes[i].native;
+  return NULL;
+}
+
+/* ── errors ────────────────────────────────────────────────────────── */
+
+static const char *const scr_wc_ordinals[] = {"1st", "2nd", "3rd", "4th", "5th"};
+
+static void scr_wc_type_error(const char *code, const char *fmt, ...)
+    __attribute__((format(printf, 2, 3)));
+static void scr_wc_type_error(const char *code, const char *fmt, ...) {
+  char message[512];
+  va_list ap;
+  va_start(ap, fmt);
+  int n = vsnprintf(message, sizeof message, fmt, ap);
+  va_end(ap);
+  if (n < 0) n = 0;
+  if ((size_t)n >= sizeof message) n = (int)sizeof message - 1;
+  scr_throw_error_msg_code(SCR_ERR_TYPE, message, (size_t)n, code);
+}
+
+/* An operation or algorithm Node supports that this slice does not. */
+static void scr_wc_unsupported(const char *method, const char *what) {
+  char message[256];
+  int n = snprintf(message, sizeof message, "crypto.subtle.%s with %s is not supported yet", method,
+                   what);
+  if ((size_t)n >= sizeof message) n = (int)sizeof message - 1;
+  scr_throw_error_msg_code(SCR_ERR_ERROR, message, (size_t)n, "SC2020");
+}
+
+static void scr_wc_unsupported_algorithm(const char *method, const char *name) {
+  char what[96];
+  snprintf(what, sizeof what, "the %s algorithm", name);
+  scr_wc_unsupported(method, what);
+}
+
+/* ── Web IDL conversions ──────────────────────────────────────────────
+ * Each answers NULL/false with the TypeError pending. `prefix` is
+ * "Failed to execute '<method>' on 'SubtleCrypto'". */
+
+static bool scr_wc_is_object(const ScrDyn *v) {
+  switch (v->kind) {
+  case SCR_DYN_UNDEF:
+  case SCR_DYN_NULL:
+  case SCR_DYN_BOOL:
+  case SCR_DYN_NUM:
+  case SCR_DYN_STR:
+  case SCR_DYN_BIGINT:
+  case SCR_DYN_SYMBOL:
+    return false;
+  default:
+    return true;
+  }
+}
+
+/* A typed reference capsule as its plain view; other values retained. */
+static ScrDyn *scr_wc_plain(ScrDyn *v) {
+  if (v->kind == SCR_DYN_TYPED_REF) return scr_dyn_typed_ref_materialize(v);
+  return scr_dyn_retain(v);
+}
+
+/* BufferSource: the bytes of a TypedArray, DataView, Buffer or
+ * ArrayBuffer as a u8 view (+1). */
+static ScrBytes *scr_wc_buffer_source(const char *prefix, size_t index, ScrDyn *value) {
+  ScrDyn *plain = scr_wc_plain(value);
+  if (!plain) return NULL;
+  ScrBytes *view = NULL;
+  if (plain->kind == SCR_DYN_BYTES || scr_array_buffer_is(plain)) {
+    view = scr_bytes_buffer_source(plain);
+  } else {
+    scr_wc_type_error("ERR_INVALID_ARG_TYPE",
+                      "%s: %s argument is not instance of ArrayBuffer, Buffer, TypedArray, or "
+                      "DataView.",
+                      prefix, scr_wc_ordinals[index]);
+  }
+  scr_dyn_release(plain);
+  return view;
+}
+
+/* DOMString conversion (+1). */
+static ScrStr *scr_wc_dom_string(const ScrDyn *value) { return scr_dyn_string_coerce_js(value); }
+
+static const char *const scr_wc_key_formats[] = {
+    "raw", "raw-public", "raw-seed", "raw-secret", "raw-private", "pkcs8", "spki", "jwk",
+};
+
+/* KeyFormat: the canonical enum spelling, or NULL. */
+static const char *scr_wc_key_format(const char *prefix, ScrDyn *value) {
+  ScrStr *s = scr_wc_dom_string(value);
+  if (!s) return NULL;
+  for (size_t i = 0; i < SCR_WC_COUNT(scr_wc_key_formats); i++) {
+    if (s->len == strlen(scr_wc_key_formats[i]) &&
+        memcmp(s->data, scr_wc_key_formats[i], s->len) == 0) {
+      scr_str_release(s);
+      return scr_wc_key_formats[i];
+    }
+  }
+  scr_wc_type_error("ERR_INVALID_ARG_VALUE",
+                    "%s: 1st argument '%.*s' is not a valid enum value of type KeyFormat.", prefix,
+                    (int)(s->len > 200 ? 200 : s->len), s->data);
+  scr_str_release(s);
+  return NULL;
+}
+
+/* Node's canonical usage order; the bit is the index. */
+static const char *const scr_wc_usages[] = {
+    "encrypt",        "decrypt",         "sign",           "verify",
+    "deriveKey",      "deriveBits",      "wrapKey",        "unwrapKey",
+    "encapsulateKey", "encapsulateBits", "decapsulateKey", "decapsulateBits",
+};
+enum { SCR_WC_USAGE_SIGN = 1u << 2, SCR_WC_USAGE_VERIFY = 1u << 3 };
+
+/* sequence<KeyUsage> over an array: the usage mask (-1 on failure). */
+static long scr_wc_key_usages(const char *prefix, size_t index, ScrDyn *value) {
+  ScrDyn *plain = scr_wc_plain(value);
+  if (!plain) return -1;
+  if (plain->kind != SCR_DYN_ARR) {
+    scr_wc_type_error("ERR_INVALID_ARG_TYPE", "%s: %s argument cannot be converted to sequence.",
+                      prefix, scr_wc_ordinals[index]);
+    scr_dyn_release(plain);
+    return -1;
+  }
+  long mask = 0;
+  double n = scr_dyn_arr_len(plain);
+  for (double i = 0; i < n; i++) {
+    ScrDyn *item = scr_dyn_arr_at(plain, i);
+    ScrStr *s = scr_wc_dom_string(item);
+    scr_dyn_release(item);
+    if (!s) {
+      scr_dyn_release(plain);
+      return -1;
+    }
+    size_t k = 0;
+    while (k < SCR_WC_COUNT(scr_wc_usages) &&
+           !(s->len == strlen(scr_wc_usages[k]) && memcmp(s->data, scr_wc_usages[k], s->len) == 0))
+      k++;
+    if (k == SCR_WC_COUNT(scr_wc_usages)) {
+      scr_wc_type_error("ERR_INVALID_ARG_VALUE",
+                        "%s: %s argument[%.0f] '%.*s' is not a valid enum value of type KeyUsage.",
+                        prefix, scr_wc_ordinals[index], i, (int)(s->len > 200 ? 200 : s->len),
+                        s->data);
+      scr_str_release(s);
+      scr_dyn_release(plain);
+      return -1;
+    }
+    scr_str_release(s);
+    mask |= 1L << k;
+  }
+  scr_dyn_release(plain);
+  return mask;
+}
+
+/* ── algorithm normalization ──────────────────────────────────────────
+ * normalizeAlgorithm(algorithm, op) for the members this slice reads:
+ * the canonical name, and for HMAC imports the hash and length. */
+typedef struct {
+  const char *name;   /* canonical registered name */
+  const char *hash;   /* HMAC import: the normalized hash name */
+  bool has_length;
+  double length;
+} ScrWcAlgorithm;
+
+static const char scr_wc_normalize_prefix[] = "Failed to normalize algorithm";
+
+static void scr_wc_missing_member(const char *dict, const char *member) {
+  scr_wc_type_error("ERR_MISSING_OPTION",
+                    "%s: passed algorithm cannot be converted to '%s' because '%s' is required in "
+                    "'%s'.",
+                    scr_wc_normalize_prefix, dict, member, dict);
+}
+
+/* Reads `key` off an algorithm dictionary (+1; undefined when absent). */
+static ScrDyn *scr_wc_member(const ScrDyn *dict, const char *key) {
+  if (dict->kind != SCR_DYN_OBJ) return scr_dyn_retain(scr_dyn_undefined());
+  ScrDyn *v = scr_dyn_obj_read(dict, key, strlen(key));
+  return v ? v : scr_dyn_retain(scr_dyn_undefined());
+}
+
+/* The name an AlgorithmIdentifier carries (+1), with the Algorithm
+ * dictionary's missing-name TypeError. `dict` names the dictionary the
+ * value converts to. */
+static ScrStr *scr_wc_algorithm_name(ScrDyn *identifier, const char *dict) {
+  if (!scr_wc_is_object(identifier)) return scr_wc_dom_string(identifier);
+  ScrDyn *plain = scr_wc_plain(identifier);
+  if (!plain) return NULL;
+  ScrDyn *name = scr_wc_member(plain, "name");
+  scr_dyn_release(plain);
+  ScrStr *out = NULL;
+  if (name->kind == SCR_DYN_UNDEF) scr_wc_missing_member(dict, "name");
+  else out = scr_wc_dom_string(name);
+  scr_dyn_release(name);
+  return out;
+}
+
+/* The digest a HashAlgorithmIdentifier names: canonical name, or NULL
+ * with NotSupportedError / the SC2020 refusal pending. */
+static const char *scr_wc_digest_algorithm(ScrDyn *identifier, const char *method) {
+  ScrStr *name = scr_wc_algorithm_name(identifier, "Algorithm");
+  if (!name) return NULL;
+  const char *canonical = scr_wc_lookup(scr_wc_digest_names, SCR_WC_COUNT(scr_wc_digest_names), name);
+  scr_str_release(name);
+  if (!canonical) {
+    scr_throw_domex("NotSupportedError", "Unrecognized algorithm name");
+    return NULL;
+  }
+  if (!scr_wc_native_hash(canonical)) {
+    scr_wc_unsupported_algorithm(method, canonical);
+    return NULL;
+  }
+  return canonical;
+}
+
+/* HmacImportParams over an object: hash (required, a SHA name), then the
+ * optional [EnforceRange] unsigned long length. */
+static bool scr_wc_hmac_import_params(ScrDyn *identifier, ScrWcAlgorithm *out) {
+  if (!scr_wc_is_object(identifier)) {
+    scr_wc_missing_member("HmacImportParams", "hash");
+    return false;
+  }
+  ScrDyn *plain = scr_wc_plain(identifier);
+  if (!plain) return false;
+  ScrDyn *hash = scr_wc_member(plain, "hash");
+  bool ok = true;
+  if (hash->kind == SCR_DYN_UNDEF) {
+    scr_wc_missing_member("HmacImportParams", "hash");
+    ok = false;
+  }
+  ScrDyn *hash_value = NULL;
+  if (ok) {
+    /* HashAlgorithmIdentifier converts to an object or a DOMString, then
+     * ensureSHA reads the name: a string, or the object's name member. */
+    ScrStr *hash_name = NULL;
+    if (scr_wc_is_object(hash)) {
+      hash_value = scr_dyn_retain(hash);
+      ScrDyn *hp = scr_wc_plain(hash);
+      ScrDyn *member = hp ? scr_wc_member(hp, "name") : NULL;
+      if (hp) scr_dyn_release(hp);
+      if (!member) ok = false;
+      else {
+        if (member->kind == SCR_DYN_STR) hash_name = scr_str_retain(member->v.str);
+        scr_dyn_release(member);
+      }
+    } else {
+      hash_name = scr_wc_dom_string(hash);
+      if (!hash_name) ok = false;
+      else hash_value = scr_dyn_new_str(hash_name);
+    }
+    bool sha = hash_name && hash_name->len >= 3 &&
+               (hash_name->data[0] | 32) == 's' && (hash_name->data[1] | 32) == 'h' &&
+               (hash_name->data[2] | 32) == 'a';
+    if (hash_name) scr_str_release(hash_name);
+    if (ok && !sha) {
+      scr_throw_domex("NotSupportedError", "Only SHA hashes are supported in HmacImportParams");
+      ok = false;
+    }
+  }
+  if (ok) {
+    ScrDyn *length = scr_wc_member(plain, "length");
+    if (length->kind != SCR_DYN_UNDEF) {
+      double x;
+      if (!scr_dyn_number_coerce_js(length, &x)) ok = false;
+      else if (x != x || x == 1.0 / 0.0 || x == -1.0 / 0.0) {
+        scr_wc_type_error("ERR_INVALID_ARG_TYPE",
+                          "%s: length in passed algorithm is not a finite number.",
+                          scr_wc_normalize_prefix);
+        ok = false;
+      } else {
+        x = trunc(x);
+        if (x == 0) x = 0;
+        if (x < 0 || x > 4294967295.0) {
+          scr_wc_type_error("ERR_OUT_OF_RANGE",
+                            "%s: length in passed algorithm is outside the expected range of 0 to "
+                            "4294967295.",
+                            scr_wc_normalize_prefix);
+          ok = false;
+        } else if (x == 0) {
+          scr_throw_domex("DataError", "HmacImportParams.length cannot be 0");
+          ok = false;
+        } else {
+          out->has_length = true;
+          out->length = x;
+        }
+      }
+    }
+    scr_dyn_release(length);
+  }
+  if (ok) {
+    out->hash = scr_wc_digest_algorithm(hash_value, "importKey");
+    if (!out->hash) ok = false;
+  }
+  if (hash_value) scr_dyn_release(hash_value);
+  scr_dyn_release(hash);
+  scr_dyn_release(plain);
+  return ok;
+}
+
+/* normalizeAlgorithm for importKey, sign/verify (`names`) — false with
+ * the error pending. Only HMAC parameters are read; any other recognized
+ * algorithm is refused by the caller. */
+static bool scr_wc_normalize(ScrDyn *identifier, const char *const *names, size_t count,
+                             bool import, ScrWcAlgorithm *out) {
+  memset(out, 0, sizeof *out);
+  ScrStr *name = scr_wc_algorithm_name(identifier, "Algorithm");
+  if (!name) return false;
+  out->name = scr_wc_lookup(names, count, name);
+  scr_str_release(name);
+  if (!out->name) {
+    scr_throw_domex("NotSupportedError", "Unrecognized algorithm name");
+    return false;
+  }
+  if (import && strcmp(out->name, "HMAC") == 0) return scr_wc_hmac_import_params(identifier, out);
+  return true;
+}
+
+/* ── CryptoKey ─────────────────────────────────────────────────────────
+ * A secret HMAC key: the bytes, the hash, the bit length, the usage mask
+ * and the extractable flag. The algorithm and usages getters answer the
+ * same object on every read (Node caches its clones), built on first
+ * read. The bytes are cleared when the last reference goes. */
+typedef struct ScrCryptoKey {
+  size_t rc;
+  const char *hash; /* WebCrypto hash name */
+  double length;    /* bits */
+  unsigned usages;
+  bool extractable;
+  ScrDyn *algorithm; /* cached getter results, or NULL */
+  ScrDyn *usage_list;
+  size_t len;
+  unsigned char data[];
+} ScrCryptoKey;
+
+static void *scr_crypto_key_retain(void *p) {
+  ((ScrCryptoKey *)p)->rc++;
+  return p;
+}
+
+static void scr_crypto_key_release(void *p) {
+  ScrCryptoKey *key = p;
+  if (!key || --key->rc != 0) return;
+  volatile unsigned char *bytes = key->data;
+  for (size_t i = 0; i < key->len; i++) bytes[i] = 0;
+  if (key->algorithm) scr_dyn_release(key->algorithm);
+  if (key->usage_list) scr_dyn_release(key->usage_list);
+  free(key);
+}
+
+static ScrCryptoKey *scr_crypto_key_of(const ScrDyn *value) {
+  if (value->kind != SCR_DYN_HANDLE || value->v.handle.tag != SCR_DYNH_CRYPTO_KEY) return NULL;
+  return value->v.handle.ptr;
+}
+
+bool scr_webcrypto_is_crypto_key(const ScrDyn *value) {
+  if (value->kind == SCR_DYN_TYPED_REF) return false;
+  return scr_crypto_key_of(value) != NULL;
+}
+
+static ScrDyn *scr_wc_cstr(const char *s) {
+  ScrStr *str = scr_str_new(s, strlen(s));
+  ScrDyn *out = scr_dyn_new_str(str);
+  scr_str_release(str);
+  return out;
+}
+
+static ScrDyn *scr_crypto_key_algorithm(ScrCryptoKey *key) {
+  if (!key->algorithm) {
+    ScrDyn *hash = scr_dyn_new_obj();
+    scr_dyn_obj_set(hash, "name", 4, scr_wc_cstr(key->hash));
+    ScrDyn *algorithm = scr_dyn_new_obj();
+    scr_dyn_obj_set(algorithm, "name", 4, scr_wc_cstr("HMAC"));
+    scr_dyn_obj_set(algorithm, "length", 6, scr_dyn_new_num(key->length));
+    scr_dyn_obj_set(algorithm, "hash", 4, hash);
+    key->algorithm = algorithm;
+  }
+  return scr_dyn_retain(key->algorithm);
+}
+
+static ScrDyn *scr_crypto_key_usages(ScrCryptoKey *key) {
+  if (!key->usage_list) {
+    ScrDyn *list = scr_dyn_new_arr();
+    for (size_t i = 0; i < SCR_WC_COUNT(scr_wc_usages); i++)
+      if (key->usages & (1u << i)) scr_dyn_arr_push(list, scr_wc_cstr(scr_wc_usages[i]));
+    key->usage_list = list;
+  }
+  return scr_dyn_retain(key->usage_list);
+}
+
+static bool scr_wc_name_is(const char *name, size_t len, const char *literal) {
+  return len == strlen(literal) && memcmp(name, literal, len) == 0;
+}
+
+static ScrDyn *scr_crypto_key_get(void *h, const char *name, size_t len) {
+  ScrCryptoKey *key = h;
+  if (scr_wc_name_is(name, len, "type")) return scr_wc_cstr("secret");
+  if (scr_wc_name_is(name, len, "extractable")) return scr_dyn_new_bool(key->extractable);
+  if (scr_wc_name_is(name, len, "algorithm")) return scr_crypto_key_algorithm(key);
+  if (scr_wc_name_is(name, len, "usages")) return scr_crypto_key_usages(key);
+  return NULL;
+}
+
+/* The four members are prototype getters without setters: an assignment
+ * in strict code throws Node's TypeError. */
+static bool scr_crypto_key_set(void *h, const char *name, size_t len, const ScrDyn *value) {
+  (void)h;
+  (void)value;
+  if (!scr_wc_name_is(name, len, "type") && !scr_wc_name_is(name, len, "extractable") &&
+      !scr_wc_name_is(name, len, "algorithm") && !scr_wc_name_is(name, len, "usages"))
+    return false;
+  char message[128];
+  int n = snprintf(message, sizeof message,
+                   "Cannot set property %.*s of #<CryptoKey> which has only a getter", (int)len,
+                   name);
+  scr_throw_error_msg(SCR_ERR_TYPE, message, (size_t)n);
+  return true;
+}
+
+static ScrDyn *scr_crypto_key_invoke(void *h, ScrDyn *self, const char *method, ScrDyn *const *args,
+                                     size_t argc, const char *what) {
+  (void)h;
+  (void)self;
+  (void)args;
+  (void)argc;
+  if (strcmp(method, "toString") == 0) return scr_wc_cstr("[object CryptoKey]");
+  ScrJsonBuf b;
+  scr_jb_init(&b);
+  scr_jb_puts(&b, what);
+  scr_jb_puts(&b, " is not a function");
+  scr_throw_error(SCR_ERR_TYPE, scr_jb_finish(&b));
+  return NULL;
+}
+
+/* key[Symbol.toStringTag] answers "CryptoKey". */
+static ScrDyn *scr_crypto_key_symbol_get(void *h, const ScrDyn *key) {
+  (void)h;
+  if (key->kind != SCR_DYN_SYMBOL || !key->v.symbol.description) return NULL;
+  ScrStr *description = key->v.symbol.description(key->v.symbol.value);
+  bool tag = description && description->len == 18 &&
+             memcmp(description->data, "Symbol.toStringTag", 18) == 0;
+  if (description) scr_str_release(description);
+  return tag ? scr_wc_cstr("CryptoKey") : NULL;
+}
+
+/* No inspect_view: Node's custom inspector prints the members one level
+ * deeper than a plain object would, which the shared handle inspection
+ * cannot reproduce, so util.inspect refuses a CryptoKey ('not supported
+ * yet') rather than printing a different shape. */
+static const ScrDynHandleOps scr_crypto_key_ops = {
+    .cls = "CryptoKey",
+    .retain = scr_crypto_key_retain,
+    .release = scr_crypto_key_release,
+    .invoke = scr_crypto_key_invoke,
+    .get = scr_crypto_key_get,
+    .set = scr_crypto_key_set,
+    .json_empty_object = true,
+    .to_string_tag = "CryptoKey",
+    .symbol_get = scr_crypto_key_symbol_get,
+};
+
+static ScrDyn *scr_crypto_key_new(const unsigned char *data, size_t len, const char *hash,
+                                  double length, unsigned usages, bool extractable) {
+  static SCR_TL bool installed;
+  if (!installed) {
+    installed = true;
+    scr_dyn_handle_install(SCR_DYNH_CRYPTO_KEY, &scr_crypto_key_ops);
+  }
+  ScrCryptoKey *key = malloc(sizeof *key + (len ? len : 1));
+  if (!key) scr_trap("scriptc: out of memory\n");
+  key->rc = 1;
+  key->hash = hash;
+  key->length = length;
+  key->usages = usages;
+  key->extractable = extractable;
+  key->algorithm = NULL;
+  key->usage_list = NULL;
+  key->len = len;
+  if (len) memcpy(key->data, data, len);
+  ScrDyn *box = scr_dyn_new_handle(key, SCR_DYNH_CRYPTO_KEY);
+  scr_crypto_key_release(key);
+  return box;
+}
+
+/* ── the operations ───────────────────────────────────────────────────
+ * Each takes its argument vector as one dyn array (borrowed) and answers
+ * a +1 promise. */
+
+static ScrPromise *scr_wc_rejected(void) {
+  ScrPromise *p = scr_promise_new();
+  scr_promise_reject_pending(p);
+  return p;
+}
+
+/* The argument count check every method starts with (after the receiver
+ * check the compiler's call shape already guarantees). */
+static bool scr_wc_required(const char *prefix, const ScrDyn *args, size_t required) {
+  size_t argc = (size_t)scr_dyn_arr_len(args);
+  if (argc >= required) return true;
+  scr_wc_type_error("ERR_MISSING_ARGS", "%s: %zu arguments required, but only %zu present.", prefix,
+                    required, argc);
+  return false;
+}
+
+typedef struct {
+  ScrDyn *v[5];
+} ScrWcArgs;
+
+static void scr_wc_args_take(ScrWcArgs *a, const ScrDyn *args, size_t n) {
+  for (size_t i = 0; i < n; i++) a->v[i] = scr_dyn_arr_at(args, (double)i);
+}
+
+static void scr_wc_args_drop(ScrWcArgs *a, size_t n) {
+  for (size_t i = 0; i < n; i++) scr_dyn_release(a->v[i]);
+}
+
+/* importKey(format, keyData, algorithm, extractable, keyUsages): Node's
+ * conversion order, then macImportKey's checks and importKeySync's empty
+ * usage check. */
+static ScrDyn *scr_wc_import(const ScrDyn *args) {
+  static const char prefix[] = "Failed to execute 'importKey' on 'SubtleCrypto'";
+  if (!scr_wc_required(prefix, args, 5)) return NULL;
+  ScrWcArgs a;
+  scr_wc_args_take(&a, args, 5);
+  ScrDyn *result = NULL;
+  ScrBytes *data = NULL;
+  const char *format = scr_wc_key_format(prefix, a.v[0]);
+  if (!format) goto done;
+  bool jwk = strcmp(format, "jwk") == 0;
+  /* The JsonWebKey dictionary is not implemented; that format is refused
+   * after the remaining arguments convert. */
+  if (!jwk) {
+    data = scr_wc_buffer_source(prefix, 1, a.v[1]);
+    if (!data) goto done;
+  }
+  if (!scr_wc_is_object(a.v[2])) {
+    ScrStr *s = scr_wc_dom_string(a.v[2]);
+    if (!s) goto done;
+    scr_str_release(s);
+  }
+  bool extractable = scr_dyn_truthy(a.v[3]);
+  long usages = scr_wc_key_usages(prefix, 4, a.v[4]);
+  if (usages < 0) goto done;
+  ScrWcAlgorithm algorithm;
+  if (!scr_wc_normalize(a.v[2], scr_wc_import_names, SCR_WC_COUNT(scr_wc_import_names), true,
+                        &algorithm))
+    goto done;
+  if (strcmp(algorithm.name, "HMAC") != 0) {
+    scr_wc_unsupported_algorithm("importKey", algorithm.name);
+    goto done;
+  }
+  if (usages & ~(long)(SCR_WC_USAGE_SIGN | SCR_WC_USAGE_VERIFY)) {
+    scr_throw_domex("SyntaxError", "Unsupported key usage for HMAC key");
+    goto done;
+  }
+  if (jwk) {
+    scr_wc_unsupported("importKey", "the 'jwk' key format");
+    goto done;
+  }
+  if (strcmp(format, "raw") != 0 && strcmp(format, "raw-secret") != 0) {
+    char message[96];
+    snprintf(message, sizeof message, "Unable to import HMAC using %s format", format);
+    scr_throw_domex("NotSupportedError", message);
+    goto done;
+  }
+  {
+    ScrBytes *view = data;
+    SCR_BYTES_SNAPSHOT(view);
+    size_t len = (size_t)scr_bytes_byte_len(view);
+    if (len == 0) {
+      scr_throw_domex("DataError", "Zero-length key is not supported");
+      goto done;
+    }
+    double length = (double)len * 8;
+    unsigned char last = view->data[len - 1];
+    if (algorithm.has_length) {
+      double bytes = floor(algorithm.length / 8) + floor((7 + fmod(algorithm.length, 8)) / 8);
+      if (bytes != (double)len) {
+        scr_throw_domex("DataError", "Invalid key length");
+        goto done;
+      }
+      /* A length that is not a whole number of bytes clears the unused
+       * low bits of the final byte (truncateToBitLength). */
+      int extra = (int)fmod(algorithm.length, 8);
+      if (extra) last = (unsigned char)(last & (0xff << (8 - extra)));
+      length = algorithm.length;
+    }
+    if (usages == 0) {
+      scr_throw_domex("SyntaxError", "Usages cannot be empty when importing a secret key.");
+      goto done;
+    }
+    result = scr_crypto_key_new(view->data, len, algorithm.hash, length, (unsigned)usages,
+                                extractable);
+    scr_crypto_key_of(result)->data[len - 1] = last;
+  }
+done:
+  if (data) scr_bytes_release(data);
+  scr_wc_args_drop(&a, 5);
+  return result;
+}
+
+ScrPromise *scr_webcrypto_import_key(ScrDyn *args) {
+  ScrDyn *key = scr_wc_import(args);
+  if (!key) return scr_wc_rejected();
+  return scr_promise_settled_ref(key, &scr_dyn_retain_v, &scr_dyn_release_v, NULL);
+}
+
+/* sign(algorithm, key, data) / verify(algorithm, key, signature, data):
+ * the HMAC over `data`, or NULL with the error pending. *mac_len is the
+ * digest length. */
+static bool scr_wc_sign_verify(const ScrDyn *args, bool verify, unsigned char mac[64],
+                               size_t *mac_len, ScrBytes **signature) {
+  const char *prefix = verify ? "Failed to execute 'verify' on 'SubtleCrypto'"
+                              : "Failed to execute 'sign' on 'SubtleCrypto'";
+  const char *method = verify ? "verify" : "sign";
+  size_t n = verify ? 4 : 3;
+  if (!scr_wc_required(prefix, args, n)) return false;
+  ScrWcArgs a;
+  scr_wc_args_take(&a, args, n);
+  bool ok = false;
+  ScrBytes *data = NULL;
+  if (!scr_wc_is_object(a.v[0])) {
+    ScrStr *s = scr_wc_dom_string(a.v[0]);
+    if (!s) goto done;
+    scr_str_release(s);
+  }
+  ScrCryptoKey *key = scr_crypto_key_of(a.v[1]);
+  if (!key) {
+    scr_wc_type_error("ERR_INVALID_ARG_TYPE", "%s: 2nd argument is not of type CryptoKey.", prefix);
+    goto done;
+  }
+  if (verify) {
+    *signature = scr_wc_buffer_source(prefix, 2, a.v[2]);
+    if (!*signature) goto done;
+  }
+  data = scr_wc_buffer_source(prefix, verify ? 3 : 2, a.v[verify ? 3 : 2]);
+  if (!data) goto done;
+  ScrWcAlgorithm algorithm;
+  if (!scr_wc_normalize(a.v[0], scr_wc_sign_names, SCR_WC_COUNT(scr_wc_sign_names), false,
+                        &algorithm))
+    goto done;
+  if (strcmp(algorithm.name, "HMAC") != 0) {
+    scr_wc_unsupported_algorithm(method, algorithm.name);
+    goto done;
+  }
+  if (!(key->usages & (verify ? SCR_WC_USAGE_VERIFY : SCR_WC_USAGE_SIGN))) {
+    char message[64];
+    snprintf(message, sizeof message, "Unable to use this key to %s", method);
+    scr_throw_domex("InvalidAccessError", message);
+    goto done;
+  }
+  {
+    ScrBytes *view = data;
+    SCR_BYTES_SNAPSHOT(view);
+    *mac_len = scr_crypto_hmac_raw(scr_wc_native_hash(key->hash), key->data, key->len, view->data,
+                                   (size_t)scr_bytes_byte_len(view), mac);
+  }
+  ok = true;
+done:
+  if (data) scr_bytes_release(data);
+  scr_wc_args_drop(&a, n);
+  return ok;
+}
+
+ScrPromise *scr_webcrypto_sign(ScrDyn *args) {
+  unsigned char mac[64];
+  size_t mac_len = 0;
+  if (!scr_wc_sign_verify(args, false, mac, &mac_len, NULL)) return scr_wc_rejected();
+  ScrBytes *out = scr_bytes_new(SCR_BYTES_U8, (double)mac_len);
+  memcpy(out->data, mac, mac_len);
+  ScrPromise *p = scr_promise_new();
+  scr_crypto_defer_bytes(out, NULL, scr_crypto_promise_callback(p),
+                         scr_crypto_promise_settle_array_buffer);
+  return p;
+}
+
+/* The verify result's adapter: the deferred value is a dyn boolean. */
+static void scr_wc_settle_verified(ScrClosure *cb, ScrError *error, ScrBytes *value) {
+  (void)error;
+  ScrPromise *p;
+  memcpy(&p, &cb->caps[0]->slot, sizeof p);
+  ScrDyn *verified = (ScrDyn *)value;
+  scr_promise_fulfill_bool(p, scr_dyn_truthy(verified));
+  scr_dyn_release(verified);
+}
+
+ScrPromise *scr_webcrypto_verify(ScrDyn *args) {
+  unsigned char mac[64];
+  size_t mac_len = 0;
+  ScrBytes *signature = NULL;
+  if (!scr_wc_sign_verify(args, true, mac, &mac_len, &signature)) {
+    if (signature) scr_bytes_release(signature);
+    return scr_wc_rejected();
+  }
+  bool equal;
+  {
+    ScrBytes *view = signature;
+    SCR_BYTES_SNAPSHOT(view);
+    /* A signature of another length is simply not valid; equal lengths
+     * compare in constant time. */
+    size_t sig_len = (size_t)scr_bytes_byte_len(view);
+    equal = sig_len == mac_len;
+    unsigned char diff = 0;
+    for (size_t i = 0; equal && i < mac_len; i++) diff |= (unsigned char)(view->data[i] ^ mac[i]);
+    equal = equal && diff == 0;
+  }
+  scr_bytes_release(signature);
+  ScrPromise *p = scr_promise_new();
+  scr_crypto_defer_dyn(scr_dyn_new_bool(equal), NULL, scr_crypto_promise_callback(p),
+                       scr_wc_settle_verified);
+  return p;
+}
+
+/* digest(algorithm, data). */
+ScrPromise *scr_webcrypto_digest(ScrDyn *args) {
+  static const char prefix[] = "Failed to execute 'digest' on 'SubtleCrypto'";
+  if (!scr_wc_required(prefix, args, 2)) return scr_wc_rejected();
+  ScrWcArgs a;
+  scr_wc_args_take(&a, args, 2);
+  ScrBytes *data = NULL;
+  ScrBytes *out = NULL;
+  if (!scr_wc_is_object(a.v[0])) {
+    ScrStr *s = scr_wc_dom_string(a.v[0]);
+    if (!s) goto done;
+    scr_str_release(s);
+  }
+  data = scr_wc_buffer_source(prefix, 1, a.v[1]);
+  if (!data) goto done;
+  const char *hash = scr_wc_digest_algorithm(a.v[0], "digest");
+  if (!hash) goto done;
+  {
+    ScrBytes *view = data;
+    SCR_BYTES_SNAPSHOT(view);
+    unsigned char digest[64];
+    size_t len = scr_crypto_digest_raw(scr_wc_native_hash(hash), view->data,
+                                       (size_t)scr_bytes_byte_len(view), digest);
+    out = scr_bytes_new(SCR_BYTES_U8, (double)len);
+    memcpy(out->data, digest, len);
+  }
+done:
+  if (data) scr_bytes_release(data);
+  scr_wc_args_drop(&a, 2);
+  if (!out) return scr_wc_rejected();
+  ScrPromise *p = scr_promise_new();
+  scr_crypto_defer_bytes(out, NULL, scr_crypto_promise_callback(p),
+                         scr_crypto_promise_settle_array_buffer);
+  return p;
+}
diff --git a/packages/runtime/test/headers.test.ts b/packages/runtime/test/headers.test.ts
index 4555e658b..fc6ea737e 100644
--- a/packages/runtime/test/headers.test.ts
+++ b/packages/runtime/test/headers.test.ts
@@ -1,5 +1,5 @@
 import { execFile } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { readdirSync, readFileSync } from "node:fs";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -66,3 +66,14 @@ test("scr_runtime.h holds no declarations of its own", () => {
     [],
   );
 });
+
+// Two-tier invariant I3: the dynamic tier's value representation stays in
+// the scr_js_* units. A static runtime unit or module header never includes
+// scr_js.h, so no static runtime function can take or return a jsval.
+test("only dynamic-tier units include scr_js.h", () => {
+  const includers = readdirSync(srcDir)
+    .filter((name) => /\.(c|h)$/.test(name))
+    .filter((name) => /^#include "scr_js\.h"/m.test(readFileSync(join(srcDir, name), "utf8")));
+  expect(includers.filter((name) => !/^scr_js_\w+\.c$/.test(name))).toEqual([]);
+  expect(includers).toContain("scr_js_value.c");
+});
diff --git a/scripts/zero-cost-compare.mjs b/scripts/zero-cost-compare.mjs
index a89fe4650..871754258 100644
--- a/scripts/zero-cost-compare.mjs
+++ b/scripts/zero-cost-compare.mjs
@@ -388,6 +388,38 @@ export function dynamicTierSymbols(names) {
     .sort();
 }
 
+/* Bench workloads whose release binaries link dynamic-tier symbols on
+ * b14377864: JSON.parse trees, worker messages, regex exec metadata
+ * (two-tier §3.3 L5), and a shared scr_dyn_call/scr_dyn_define_property core
+ * not yet traced to its typed root. bench/thread-slots, added later, links
+ * them through worker messages: node:worker_threads values are dyn objects.
+ * Every other bench workload is fully typed and must link none. The gate and
+ * tests/harness/bench-dynamic-tier.test.ts enforce that, and the test also
+ * fails when a listed workload stops linking them, so remove a workload here
+ * when a leak fix makes its binary clean. */
+export const DYNAMIC_WORKLOADS = new Set([
+  "bench/json-records",
+  "bench/cli-config",
+  "bench/http-api",
+  "bench/validate-errors",
+  "bench/regex-logs",
+  "bench/atomics-contended",
+  "bench/intern-table",
+  "bench/thread-slots",
+  "bench/typed-array-scan-workers",
+  "bench/log-summary",
+  "bench/inventory-report",
+]);
+
+/** Names of the functions (text and weak symbols) in `nm` output. Mach-O
+ * prefixes C names with an underscore; on Darwin it is dropped so the names
+ * match DYNAMIC_TIER_PREFIXES as they do on ELF. */
+export function definedFunctionNames(text, platform = process.platform) {
+  return parseNm(text)
+    .filter((s) => /^[tTwW]$/.test(s.type))
+    .map((s) => (platform === "darwin" && s.name.startsWith("_") ? s.name.slice(1) : s.name));
+}
+
 /* ── cachegrind ────────────────────────────────────────────────────────── */
 
 /** Background threads whose instruction counts depend on scheduling: the
diff --git a/scripts/zero-cost-gate.mjs b/scripts/zero-cost-gate.mjs
index 297e741e5..de3c0d0fc 100644
--- a/scripts/zero-cost-gate.mjs
+++ b/scripts/zero-cost-gate.mjs
@@ -32,10 +32,11 @@ import {
   compareArtifact,
   compareCounts,
   compareExecutables,
+  DYNAMIC_WORKLOADS,
+  definedFunctionNames,
   dynamicTierSymbols,
   median,
   nmOutput,
-  parseNm,
   programVerdict,
   timeRatio,
 } from "./zero-cost-compare.mjs";
@@ -96,7 +97,7 @@ that straddles it is reported as inconclusive.
 Dynamic-tier symbols (two-tier invariant I3): no executable may gain
 symbols under DYNAMIC_TIER_PREFIXES (scripts/zero-cost-compare.mjs) unless
 it matches --allow, and fully typed bench workloads (all but
-DYNAMIC_WORKLOADS in this script) may define none.
+DYNAMIC_WORKLOADS in scripts/zero-cost-compare.mjs) may define none.
 
 --cachegrind (Linux, valgrind on PATH) runs differing executables under
 cachegrind (bench workloads with their arguments, corpus programs without)
@@ -307,32 +308,7 @@ function nm(binary) {
 }
 
 /** Names of the functions an executable defines. */
-const definedFunctions = (binary) =>
-  parseNm(nm(binary))
-    .filter((s) => /^[tTwW]$/.test(s.type))
-    .map((s) => s.name);
-
-/* Bench workloads whose release binaries link dynamic-tier symbols on
- * b14377864 (DYNAMIC_TIER_PREFIXES in zero-cost-compare.mjs): JSON.parse
- * trees, worker messages, regex exec metadata (two-tier §3.3 L5), and a
- * shared scr_dyn_call/scr_dyn_define_property core not yet traced to its
- * typed root. bench/thread-slots, added later, links them through worker
- * messages: node:worker_threads values are dyn objects. Every other bench
- * workload is fully typed and must link none.
- * Remove a workload here when a leak fix makes its binary clean. */
-const DYNAMIC_WORKLOADS = new Set([
-  "bench/json-records",
-  "bench/cli-config",
-  "bench/http-api",
-  "bench/validate-errors",
-  "bench/regex-logs",
-  "bench/atomics-contended",
-  "bench/intern-table",
-  "bench/thread-slots",
-  "bench/typed-array-scan-workers",
-  "bench/log-summary",
-  "bench/inventory-report",
-]);
+const definedFunctions = (binary) => definedFunctionNames(nm(binary));
 
 /** The I3 symbol check. Every executable may not gain dynamic-tier symbols
  * over the baseline (unless the program matches --allow); a fully typed
diff --git a/tests/diagnostics/retired-engine-1112-number-methods.ts b/tests/corpus/1112-number-methods.ts
similarity index 73%
rename from tests/diagnostics/retired-engine-1112-number-methods.ts
rename to tests/corpus/1112-number-methods.ts
index c96f9df00..510850dca 100644
--- a/tests/diagnostics/retired-engine-1112-number-methods.ts
+++ b/tests/corpus/1112-number-methods.ts
@@ -1,7 +1,5 @@
-// Explicit toFixed is static; toPrecision/toString(radix) execute in the
-// island. The receiver marshals by value there and the engine auto-boxes
-// it, so `this` binds the number exactly as in JS. All stay byte-exact
-// differential.
+// Number.prototype.toFixed, toPrecision and toString(radix) on typed
+// numbers all compile statically and stay byte-exact differential.
 const n = 1234.5678;
 console.log(n.toFixed(0), n.toFixed(2), n.toFixed(6));
 console.log((0.1 + 0.2).toFixed(17), (-3.7).toFixed(1), (0).toFixed(2));
diff --git a/tests/corpus/1536-string-array-sweep.ts b/tests/corpus/1536-string-array-sweep.ts
index 0e5c12ebc..e3d5259ff 100644
--- a/tests/corpus/1536-string-array-sweep.ts
+++ b/tests/corpus/1536-string-array-sweep.ts
@@ -1,8 +1,7 @@
 // The surface-tail sweep trio: string.substring (clamp-and-swap, the
 // port-suffix idiom), array findIndex (first match or -1, index-aware
 // callbacks), and the comparator-less sort() on string[] (JS's default
-// UTF-16 ordering — a dedicated comparator because relational operators use
-// scriptc's documented code-point order).
+// UTF-16 code-unit ordering).
 const localAddr = "127.0.0.1.51823";
 const lastColon = localAddr.lastIndexOf(".");
 console.log(localAddr.substring(lastColon + 1));
diff --git a/tests/corpus/5639-union-arm-by-discriminant.ts b/tests/corpus/5639-union-arm-by-discriminant.ts
new file mode 100644
index 000000000..3c29273c5
--- /dev/null
+++ b/tests/corpus/5639-union-arm-by-discriminant.ts
@@ -0,0 +1,48 @@
+// A record that converts into several arms of a discriminated union takes
+// the arm its discriminant names. The `map` callback below builds statement
+// records whose `value` is an expression literal; that literal also fits the
+// shorter `ref` expression, and the statement also fits `brk` (by dropping
+// fields), but the `kind` values pick `get` and `set`, as in Node.
+type Expr =
+  | { kind: "get"; obj: Expr | null; field: string }
+  | { kind: "ref"; obj: Expr | null }
+  | { kind: "num"; n: number };
+type Stmt =
+  | { kind: "set"; obj: Expr; field: string; value: Expr }
+  | { kind: "brk"; label?: string };
+
+function fill(target: Expr, names: string[]): Stmt[] {
+  return names.map((name) => ({
+    kind: "set",
+    obj: target,
+    field: name,
+    value: { kind: "get", obj: target, field: name },
+  }));
+}
+
+function describe(s: Stmt): string {
+  switch (s.kind) {
+    case "set":
+      return `set ${s.field} = ${s.value.kind}${s.value.kind === "get" ? `.${s.value.field}` : ""} on ${s.obj.kind}`;
+    case "brk":
+      return `brk ${s.label ?? "-"}`;
+  }
+}
+
+for (const s of fill({ kind: "num", n: 1 }, ["a", "b"])) console.log(describe(s));
+
+// The same records with the other discriminant value take the other arm.
+function pick(kind: "set" | "brk", label: string): Stmt[] {
+  return [label].map((l) =>
+    kind === "set"
+      ? { kind: "set" as const, obj: { kind: "num" as const, n: 2 }, field: l, value: { kind: "ref" as const, obj: null } }
+      : { kind: "brk" as const, label: l },
+  );
+}
+console.log(pick("set", "x").map(describe).join("; "));
+console.log(pick("brk", "y").map(describe).join("; "));
+
+// A record that fits one arm only, by dropping a field, still takes it.
+const extra = { kind: "brk" as const, label: "z", note: 1 };
+const stmts: Stmt[] = [extra];
+console.log(stmts.map(describe).join("; "));
diff --git a/tests/corpus/5640-generic-structural-class-narrowing.ts b/tests/corpus/5640-generic-structural-class-narrowing.ts
new file mode 100644
index 000000000..a4144c5df
--- /dev/null
+++ b/tests/corpus/5640-generic-structural-class-narrowing.ts
@@ -0,0 +1,78 @@
+// In a generic function, `node instanceof Identifier || node instanceof
+// PrivateIdentifier` narrows `node` to `T & PrivateIdentifier`: Identifier
+// has every member PrivateIdentifier has, so TypeScript reduces the union of
+// the two intersections to one. The narrowed read still holds either class,
+// as in Node, when it is stored, read or called.
+abstract class Node {
+  kind: number;
+  constructor(kind: number) {
+    this.kind = kind;
+  }
+}
+class Identifier extends Node {
+  text: string;
+  flow: number | undefined;
+  constructor(text: string) {
+    super(1);
+    this.text = text;
+    this.flow = undefined;
+  }
+  describe(): string {
+    return `identifier ${this.text}`;
+  }
+}
+class PrivateIdentifier extends Node {
+  text: string;
+  constructor(text: string) {
+    super(2);
+    this.text = text;
+  }
+  describe(): string {
+    return `private ${this.text}`;
+  }
+}
+class Keyword extends Node {
+  constructor() {
+    super(3);
+  }
+}
+
+const names = new Map<Node, string>();
+
+function clone<T extends Node>(node: T, copy: T): T {
+  if (node instanceof Identifier || node instanceof PrivateIdentifier) {
+    const name = names.get(node);
+    if (name !== undefined) names.set(copy, name + "'");
+  }
+  return copy;
+}
+
+function label<T extends Node>(node: T): string {
+  if (node instanceof Identifier || node instanceof PrivateIdentifier)
+    return `${node.kind} ${node.text} (${node.describe()})`;
+  return `${node.kind} -`;
+}
+
+// One instanceof test names one class.
+function privateText<T extends Node>(node: T): string {
+  if (node instanceof PrivateIdentifier) return node.text;
+  return "-";
+}
+
+const id = new Identifier("a");
+const hash = new PrivateIdentifier("#b");
+const keyword = new Keyword();
+const asNode: Node = id;
+names.set(id, "A");
+names.set(hash, "B");
+
+console.log(names.get(clone(id, new Identifier("a2"))));
+console.log(names.get(clone(hash, new PrivateIdentifier("#b2"))));
+console.log(names.get(clone(asNode, new Identifier("a3"))));
+console.log(names.get(clone<Node>(hash, new PrivateIdentifier("#b3"))));
+console.log(names.get(clone<Node>(keyword, new Keyword())));
+console.log(names.size);
+
+for (const node of [id, hash, keyword] as Node[]) console.log(label(node));
+console.log(label(id), "|", label(hash));
+console.log(privateText<Node>(id), privateText<Node>(hash), privateText(hash));
diff --git a/tests/corpus/5730-thread-slots-widened-values.ts b/tests/corpus/5730-thread-slots-widened-values.ts
new file mode 100644
index 000000000..88a1803e7
--- /dev/null
+++ b/tests/corpus/5730-thread-slots-widened-values.ts
@@ -0,0 +1,45 @@
+import { ThreadSlots } from "@scriptc/experimental";
+
+// A ThreadSlots const annotated with a structurally wider value type than
+// its constructor's: the values are stored with the constructor's layout and
+// read back through the annotation's. Node.js prints the same.
+
+class Key {
+  readonly id: number;
+  constructor(id: number) {
+    this.id = id;
+  }
+}
+
+interface Counted {
+  count: number;
+  label: string;
+}
+
+interface Labeled {
+  label: string;
+}
+
+interface Tagged {
+  label: string;
+  tag?: string;
+}
+
+const counted: ThreadSlots<Key, Labeled> = new ThreadSlots<Key, Counted>("widened.counted");
+const tagged: ThreadSlots<Key, Tagged> = new ThreadSlots<Key, Counted>("widened.tagged");
+
+const first = new Key(1);
+const second = new Key(2);
+const value: Counted = { count: 7, label: "seven" };
+counted.set(first, value);
+const read = counted.get(first)!;
+console.log(read.label, counted.get(second), counted.has(first));
+
+tagged.set(second, { count: 2, label: "two" } as Counted);
+const t = tagged.get(second);
+console.log(t?.label, t?.tag, tagged.get(first));
+
+function labelOf(slots: Labeled | undefined): string {
+  return slots === undefined ? "none" : slots.label;
+}
+console.log(labelOf(counted.get(first)), labelOf(counted.get(second)));
diff --git a/tests/corpus/6023-string-compare-utf16.ts b/tests/corpus/6023-string-compare-utf16.ts
new file mode 100644
index 000000000..c4b9ccf91
--- /dev/null
+++ b/tests/corpus/6023-string-compare-utf16.ts
@@ -0,0 +1,72 @@
+// Relational string comparisons order strings by UTF-16 code units, as in
+// Node: characters above U+FFFF (surrogate pairs) sort before U+E000..U+FFFF,
+// lone surrogates sort by their own code unit, and ASCII and other BMP text
+// keep their ordinary order. Typed comparisons, sort comparators and
+// comparisons of untyped values agree.
+const astral = "😀"; // U+1F600: D83D DE00
+const privateUse = "\ue000";
+const last = "\uffff";
+const highSurrogate = "\ud83d";
+const lowSurrogate = "\ude00";
+const hex = (s: string): string => {
+  const units: string[] = [];
+  for (let i = 0; i < s.length; i++) units.push(s.charCodeAt(i).toString(16));
+  return units.join(" ");
+};
+
+const pairs: [string, string][] = [
+  [astral, last],
+  [astral, privateUse],
+  ["\ud7ff", astral],
+  [highSurrogate, astral],
+  [lowSurrogate, astral],
+  [lowSurrogate, last],
+  ["é", "e"],
+  ["abc😀", "abc\uffff"],
+  ["same", "same"],
+  ["prefix", "prefix😀"],
+];
+for (const [a, b] of pairs)
+  console.log(hex(a), "|", hex(b), a < b, a <= b, a > b, a >= b);
+
+const words = ["\uffff", "😀", "é", "e", "\ue000", "z", "\ud83d", "A"];
+const byOperator = [...words].sort((x, y) => (x < y ? -1 : x > y ? 1 : 0));
+const byDefault = [...words].sort();
+console.log(byOperator.map(hex).join(", "));
+console.log(byDefault.map(hex).join(", "));
+console.log(byOperator.join("") === byDefault.join(""));
+
+const untyped: unknown[] = JSON.parse('["\\uffff", "\\ud83d\\ude00", "a"]');
+const [u0, u1] = untyped as string[];
+console.log(u1! < u0!, [...untyped].sort().map((v) => hex(String(v))).join(", "));
+
+let smallest = words[0]!;
+for (const word of words) if (word < smallest) smallest = word;
+console.log(hex(smallest), words.filter((w) => w > "\ud7ff").length);
+
+// Every pair of these characters after shared prefixes of 0 to 24 bytes,
+// ASCII and multibyte, with and without a suffix: the first differing byte
+// falls in the first word, the tail word, the first byte or past 16 bytes.
+const chars = ["a", "z", "é", "한", "中", "\ud7ff", "\ue000", "\uffff"];
+chars.push(astral, highSurrogate, lowSurrogate, "\u{10ffff}");
+const hashOf = (text: string): number => {
+  let h = 0;
+  for (let i = 0; i < text.length; i++) h = (Math.imul(h, 31) + text.charCodeAt(i)) | 0;
+  return h >>> 0;
+};
+for (const unit of ["p", "é", "中"]) {
+  const rows: string[] = [];
+  for (let n = 0; n <= 24; n += 3) {
+    const prefix = unit.repeat(n);
+    let marks = "";
+    for (const x of chars)
+      for (const y of chars)
+        for (const suffix of ["", "q", "tail-of-text"]) {
+          const a = prefix + x + suffix;
+          const b = prefix + y;
+          marks += a < b ? "<" : a > b ? ">" : "=";
+        }
+    rows.push(`${n}:${marks.split("<").length - 1}:${hashOf(marks)}`);
+  }
+  console.log(hex(unit), rows.join(" "));
+}
diff --git a/tests/corpus/6061-type-only-class-fields/emitted.ts b/tests/corpus/6061-type-only-class-fields/emitted.ts
new file mode 100644
index 000000000..aa2ebb2df
--- /dev/null
+++ b/tests/corpus/6061-type-only-class-fields/emitted.ts
@@ -0,0 +1,23 @@
+export class Emitted {
+  readonly count: number;
+  readonly files: string[];
+  constructor(count: number, files: string[]) {
+    this.count = count;
+    this.files = files;
+  }
+  summary(): string {
+    return `${this.count} files`;
+  }
+}
+
+export class Sealed {
+  #secret = 1;
+  read(): number {
+    return this.#secret;
+  }
+}
+
+export class Totals {
+  emitted = 0;
+  skipped = 0;
+}
diff --git a/tests/corpus/6061-type-only-class-fields/holder.ts b/tests/corpus/6061-type-only-class-fields/holder.ts
new file mode 100644
index 000000000..d3cc1d1ab
--- /dev/null
+++ b/tests/corpus/6061-type-only-class-fields/holder.ts
@@ -0,0 +1,13 @@
+import type { Emitted, Sealed, Totals } from "./emitted.ts";
+
+export class Holder {
+  items: Emitted | undefined = undefined;
+  sealed: Sealed | undefined = undefined;
+  history: Emitted[] = [];
+  totals: Totals = { emitted: 0, skipped: 0 };
+  record(result: Emitted): void {
+    this.items = result;
+    this.history.push(result);
+    this.totals.emitted += result.count;
+  }
+}
diff --git a/tests/corpus/6061-type-only-class-fields/main.ts b/tests/corpus/6061-type-only-class-fields/main.ts
new file mode 100644
index 000000000..264bd4c6b
--- /dev/null
+++ b/tests/corpus/6061-type-only-class-fields/main.ts
@@ -0,0 +1,17 @@
+// Classes that the program reaches only through `import type`: no module
+// loads emitted.ts, so no instance of its classes exists, and their types
+// describe the object shapes the program does hold, as an interface would.
+// Fields of those types hold undefined, object literals, and arrays of them.
+import { Holder } from "./holder.ts";
+import type { Emitted } from "./emitted.ts";
+
+const holder = new Holder();
+console.log(holder.items === undefined, holder.sealed === undefined);
+const result: Emitted = { count: 2, files: ["a.js", "b.js"], summary: () => "two files" };
+holder.record(result);
+holder.record({ count: 0, files: [], summary: () => "none" });
+console.log(holder.items?.count, holder.items?.summary(), holder.history.length);
+console.log(holder.history[0] === result, holder.history[0]!.files.join(","));
+console.log(JSON.stringify(holder.history.map((entry) => entry.count)));
+holder.totals.skipped++;
+console.log(holder.totals, JSON.stringify(holder.totals));
diff --git a/tests/corpus/6063-union-class-field-checks.ts b/tests/corpus/6063-union-class-field-checks.ts
new file mode 100644
index 000000000..426182b28
--- /dev/null
+++ b/tests/corpus/6063-union-class-field-checks.ts
@@ -0,0 +1,65 @@
+// A checked conversion of a dynamic value to a union of object types picks
+// the member whose fields match, including a field of type `C | undefined`
+// that holds an instance of the class C: workerData read as such a union,
+// and an unknown value asserted to it, give the instance or undefined.
+import { isMainThread, parentPort, Worker, workerData } from "node:worker_threads";
+import { publish } from "@scriptc/threads";
+
+class Job {
+  readonly name: string;
+  constructor(name: string) {
+    this.name = name;
+  }
+}
+
+interface WithJob {
+  readonly kind: "job";
+  readonly job: Job | undefined;
+}
+interface Plain {
+  readonly kind: "plain";
+  readonly note: string;
+}
+interface Counted {
+  readonly kind: "counted";
+  readonly count: number;
+  readonly last: Job | undefined;
+}
+type Data = WithJob | Plain | Counted;
+
+function describe(data: Data): string {
+  switch (data.kind) {
+    case "job":
+      return data.job === undefined ? "job none" : `job ${data.job.name}`;
+    case "plain":
+      return `plain ${data.note}`;
+    case "counted":
+      return `counted ${data.count} ${data.last?.name ?? "none"}`;
+  }
+}
+
+function run(data: Data): Promise<void> {
+  return new Promise((resolve) => {
+    const worker = new Worker(new URL(import.meta.url), { workerData: data });
+    worker.on("message", (message) => console.log("worker:", message));
+    worker.on("error", (error) => console.log("worker failed:", String(error)));
+    worker.on("exit", () => resolve());
+  });
+}
+
+if (isMainThread) {
+  const values: unknown[] = [
+    { kind: "job", job: new Job("local") },
+    { kind: "job", job: undefined },
+    { kind: "plain", note: "text" },
+    { kind: "counted", count: 2, last: new Job("tail") },
+  ];
+  for (const value of values) console.log("local:", describe(value as Data));
+  const shared = publish(new Job("shared"));
+  await run({ kind: "job", job: shared });
+  await run({ kind: "job", job: undefined });
+  await run({ kind: "plain", note: "worker" });
+  await run({ kind: "counted", count: 3, last: shared });
+} else {
+  parentPort!.postMessage(describe(workerData as Data));
+}
diff --git a/tests/corpus/6064-protocol-subinterface-assertions.ts b/tests/corpus/6064-protocol-subinterface-assertions.ts
new file mode 100644
index 000000000..1d1656c5c
--- /dev/null
+++ b/tests/corpus/6064-protocol-subinterface-assertions.ts
@@ -0,0 +1,80 @@
+// An interface that extends a class-backed protocol holds values of that
+// protocol, so asserting a base-typed value to it (`type as
+// TupleTypeReference`, where TupleTypeReference redeclares `getTarget():
+// TupleType`) keeps the class instance: its methods run and its fields read
+// as on the base type.
+interface Type {
+  readonly flags: number;
+  getTarget(): Type | undefined;
+  isTypeReference(): this is TypeReference;
+  isTupleType(): this is TupleType;
+}
+interface ObjectType extends Type {}
+interface TypeReference extends ObjectType {
+  getTarget(): Type;
+}
+interface InterfaceType extends TypeReference {}
+interface TupleType extends InterfaceType {
+  readonly elementFlags: readonly number[];
+  readonly fixedLength: number;
+}
+interface TupleTypeReference extends TypeReference {
+  getTarget(): TupleType;
+}
+class CompilerType {
+  flags: number;
+  target: CompilerType | undefined;
+  elementFlags: number[] = [];
+  fixedLength = 0;
+  constructor(flags: number, target?: CompilerType) {
+    this.flags = flags;
+    this.target = target;
+  }
+  getTarget(): CompilerType | undefined {
+    return this.target;
+  }
+  isTypeReference(): boolean {
+    return (this.flags & 4) !== 0;
+  }
+  isTupleType(): boolean {
+    return (this.flags & 8) !== 0;
+  }
+}
+const tuple = new CompilerType(8);
+tuple.elementFlags = [1, 1, 2];
+tuple.fixedLength = 2;
+const reference = new CompilerType(4, tuple);
+const publicType = (t: CompilerType): Type => t as unknown as Type;
+function describe(type: Type): string {
+  if (type.isTypeReference() && type.getTarget().isTupleType()) {
+    const ref = type as TupleTypeReference;
+    const target = ref.getTarget();
+    return `tuple ${target.fixedLength} [${target.elementFlags.join(",")}]`;
+  }
+  return `flags ${type.flags}`;
+}
+const seen = new Set<Type>([publicType(tuple)]);
+console.log(describe(publicType(reference)), describe(publicType(tuple)), seen.has(publicType(tuple)));
+
+interface Shape {
+  readonly sides: number;
+  area(): number;
+}
+interface Square extends Shape {
+  readonly side: number;
+}
+class SquareImpl implements Shape {
+  readonly sides = 4;
+  readonly side: number;
+  constructor(side: number) {
+    this.side = side;
+  }
+  area(): number {
+    return this.side * this.side;
+  }
+}
+const shapes: Shape[] = [new SquareImpl(3), new SquareImpl(5)];
+for (const shape of shapes) {
+  const square = shape as Square;
+  console.log(square.sides, square.side, square.area(), square === shape);
+}
diff --git a/tests/corpus/6077-generator-helpers-untyped.js b/tests/corpus/6077-generator-helpers-untyped.js
new file mode 100644
index 000000000..381595d9d
--- /dev/null
+++ b/tests/corpus/6077-generator-helpers-untyped.js
@@ -0,0 +1,81 @@
+// Iterator helpers on compiled generators that reach untyped parameters:
+// the runtime's helpers step the generator through its own next() and
+// close it through return().
+const log = [];
+const flush = () => log.splice(0).join(" ");
+function* count(n) {
+  try {
+    for (let i = 1; i <= n; i++) {
+      log.push("y" + i);
+      yield i;
+    }
+    return "done";
+  } finally {
+    log.push("closed");
+  }
+}
+function twice(it) { return it.map((x) => x * 2).toArray(); }
+console.log(twice(count(3)), flush());
+function firstOver(it, k) { return it.find((x) => x > k); }
+console.log(firstOver(count(9), 3), flush());
+function stepper(it) {
+  const h = it.filter((x) => x % 2 === 1);
+  return [h.next(), h.next(), h.return(), h.next()];
+}
+console.log(stepper(count(9)), flush());
+function sum(it) { return it.reduce((a, b) => a + b, 0); }
+console.log(sum(count(4)), flush());
+function product(it) { return it.reduce((a, b) => a * b); }
+console.log(product(count(4)), flush());
+function lazy(it) { return it.drop(1).take(2); }
+console.log([...lazy(count(9))], flush());
+function each(it) { const out = []; it.forEach((x, i) => out.push(x + ":" + i)); return out; }
+console.log(each(count(3)), flush());
+function some(it) { return it.some((x) => x === 2); }
+console.log(some(count(5)), flush());
+function every(it) { return it.every((x) => x < 3); }
+console.log(every(count(5)), flush());
+function flat(it) { return it.flatMap((x) => [x, -x]).toArray(); }
+console.log(flat(count(2)), flush());
+function chain(it) { return it.map((x) => x + 1).filter((x) => x % 2 === 0).map(String).toArray(); }
+console.log(chain(count(6)), flush());
+function loop(it) {
+  const out = [];
+  for (const x of it.map((x) => x * 10)) {
+    out.push(x);
+    if (x >= 20) break;
+  }
+  return out;
+}
+console.log(loop(count(5)), flush());
+function from(it) { return Array.from(it.take(2)); }
+console.log(from(count(5)), flush());
+function zeroTake(it) { return it.take(0).toArray(); }
+console.log(zeroTake(count(5)), flush());
+function after(it) { const a = it.take(1).toArray(); return [a, it.next()]; }
+console.log(after(count(3)), flush());
+function failing(it) {
+  try {
+    it.map((x) => { if (x === 2) throw new Error("boom " + x); return x; }).toArray();
+  } catch (e) {
+    return e.message;
+  }
+}
+console.log(failing(count(5)), flush());
+function errorOf(run) { try { run(); } catch (e) { return e.name + ": " + e.message; } }
+function check(it) {
+  return [
+    errorOf(() => it.map(42)),
+    errorOf(() => it.take(-1)),
+    errorOf(() => it.reduce((a, b) => a + b)),
+  ];
+}
+console.log(check(count(0)), flush());
+function kinds(it) { return [typeof it.map, typeof it.toArray, typeof it.next]; }
+console.log(kinds(count(1)));
+function readNext(it) { const next = it.next; return [next.call(it), next.call(it)]; }
+console.log(readNext(count(5)), flush());
+function first(it) { for (const x of it) return x; }
+console.log(first(count(3)), flush());
+function closeEarly(it) { it.next(); return it.return(); }
+console.log(closeEarly(count(3)), flush());
diff --git a/tests/corpus/6078-destructure-untyped-iterables.js b/tests/corpus/6078-destructure-untyped-iterables.js
new file mode 100644
index 000000000..cf8435cba
--- /dev/null
+++ b/tests/corpus/6078-destructure-untyped-iterables.js
@@ -0,0 +1,60 @@
+// Array destructuring of untyped iterables: Map and Set objects, their
+// iterators, compiled generators and objects with a Symbol.iterator method
+// step through the iterator protocol, and an iterator with values left
+// closes.
+const m = new Map([["a", 1], ["b", 2], ["c", 3]]);
+function two(it) { const [x, y] = it; return [x, y]; }
+console.log(two(m), two(new Set([7, 8, 9])), two(m.keys()), two("hey"), two([1]));
+function rest(it) { const [x, ...more] = it; return [x, more]; }
+console.log(rest(m.values()), rest(new Set([1, 2, 3])), rest(m.entries()));
+function* g() {
+  try {
+    yield 1;
+    yield 2;
+    yield 3;
+  } finally {
+    console.log("finally");
+  }
+}
+console.log(two(g()), rest(g()));
+function holes(it) { const [, b, , d] = it; return [b, d]; }
+console.log(holes(g()));
+function none(it) { const [] = it; return "none"; }
+console.log(none(g()));
+function* short() { yield "only"; }
+console.log(two(short()));
+const custom = {
+  [Symbol.iterator]() {
+    let i = 0;
+    return {
+      next: () => ({ value: i++, done: i > 5 }),
+      return() {
+        console.log("return called");
+        return {};
+      },
+    };
+  },
+};
+console.log(two(custom));
+const helper = [1, 2, 3, 4].values().map((x) => x * 3);
+console.log(two(helper), [...helper]);
+for (const bad of [1, null, undefined, {}, true]) {
+  try {
+    two(bad);
+  } catch (e) {
+    console.log(e.name, e.message);
+  }
+}
+const throwing = {
+  [Symbol.iterator]() {
+    return {
+      next() { throw new Error("next failed"); },
+      return() { console.log("not called"); return {}; },
+    };
+  },
+};
+try {
+  two(throwing);
+} catch (e) {
+  console.log(e.message);
+}
diff --git a/tests/corpus/6079-generator-helpers-any.ts b/tests/corpus/6079-generator-helpers-any.ts
new file mode 100644
index 000000000..f72fd55ef
--- /dev/null
+++ b/tests/corpus/6079-generator-helpers-any.ts
@@ -0,0 +1,24 @@
+// Iterator helpers on generators passed through `any` and `unknown`.
+function* letters(): Generator<string, void, unknown> {
+  yield "a";
+  yield "b";
+  yield "c";
+}
+function upper(it: any): string[] {
+  return it.map((s: string) => s.toUpperCase()).toArray();
+}
+console.log(upper(letters()));
+const boxed: unknown = letters();
+console.log((boxed as any).filter((s: string) => s !== "b").toArray());
+const held: any[] = [letters(), letters()];
+console.log(held.map((h) => h.drop(1).toArray()));
+function* numbered(): Generator<number, string, unknown> {
+  yield 1;
+  yield 2;
+  return "end";
+}
+function firstTwo(it: any): number[] {
+  return it.take(2).toArray();
+}
+const later: any = numbered();
+console.log(firstTwo(numbered()), later.some((n: number) => n > 1));
diff --git a/tests/corpus/6080-take-then-flatmap.ts b/tests/corpus/6080-take-then-flatmap.ts
new file mode 100644
index 000000000..1db6edbb4
--- /dev/null
+++ b/tests/corpus/6080-take-then-flatmap.ts
@@ -0,0 +1,19 @@
+// take(n) followed by flatMap counts n source values: the last value
+// taken still flattens in full, and nothing is pulled after it.
+const log: string[] = [];
+function* gen(): Generator<number> { for (let i = 0; i < 4; i++) { log.push("y" + i); yield i; } }
+const flush = (): string => log.splice(0).join(" ");
+console.log(gen().take(2).flatMap((x) => [x, x + 10]).toArray(), flush());
+console.log([0, 1, 2, 3].values().take(2).flatMap((x) => [x, x + 10]).toArray());
+console.log(gen().take(3).flatMap((x) => new Set([x, -x])).toArray(), flush());
+console.log(gen().take(2).flatMap((x) => [x, x + 10]).take(3).toArray(), flush());
+console.log(gen().take(2).flatMap((x) => [x, x + 10]).find((v) => v === 10), flush());
+console.log(gen().take(2).flatMap((x) => [x, x + 10]).some((v) => v > 10), flush());
+console.log(gen().filter((x) => x > 0).take(2).flatMap((x) => [x, x]).map((v) => v * 2).toArray(), flush());
+const out: number[] = [];
+for (const v of gen().take(2).flatMap((x) => [x, x + 10])) out.push(v);
+console.log(out, flush());
+const h = gen().take(1).flatMap((x) => [x, x + 1, x + 2]);
+console.log(h.next(), h.next(), h.next(), h.next(), flush());
+console.log(gen().take(0).flatMap((x) => [x]).toArray(), flush());
+console.log(gen().take(2).flatMap((x) => [x]).flatMap((x) => [x, -x]).toArray(), flush());
diff --git a/tests/corpus/6146-jsval-operators.js b/tests/corpus/6146-jsval-operators.js
new file mode 100644
index 000000000..a41b0bd76
--- /dev/null
+++ b/tests/corpus/6146-jsval-operators.js
@@ -0,0 +1,151 @@
+// Dynamic-tier operators over jsval values: untyped JavaScript computes
+// with NaN-boxed immediates, and every result keeps Node's semantics when
+// it flows back into objects, arrays, calls and comparisons.
+function dyn(value) {
+  return value;
+}
+
+function show(label, value) {
+  console.log(label, typeof value, Object.is(value, -0) ? "-0" : String(value));
+}
+
+function chain(a, b, c) {
+  return (a * b + c) / (a - c) % 7;
+}
+
+var point = dyn({ x: 3, y: 4.5, z: -0, big: 2n ** 70n, nothing: null, missing: undefined, one: 1 });
+show("chain", chain(point.x, point.y, 1));
+show("chain-float", chain(0.1, 0.2, 0.3));
+show("neg-zero", point.z * 1);
+show("neg-zero-sum", point.z + -0);
+show("neg-zero-mod", -4 % point.x + 1 - 1 === 0 ? -4 % 2 : 0);
+show("nan", point.x * point.missing + 1);
+show("inf", point.y / point.z);
+show("pow", point.x ** 2 ** 2);
+show("pow-edge", point.one ** (point.y / 0));
+show("big", point.big * 3n + 1n);
+show("big-div", point.big / 7n);
+show("mixed-string", point.x + point.y + "!" + point.x * 2);
+show("string-first", "n=" + point.x + point.y);
+show("bool", true + point.x + point.nothing);
+show("unary", -point.y + +"12" + ~point.x);
+show("bitwise", (point.x | 8) ^ (point.y << 2) & 255);
+show("shift", -1 >>> point.x);
+
+// Results stored into dynamic containers and read back.
+var bag = dyn({ total: 0, items: [] });
+for (var i = 0; i < 5; i++) {
+  bag.total = bag.total + i * point.y;
+  bag.items.push(bag.total % 4, -i * 0);
+}
+console.log(bag.total, bag.items.join(","), Object.is(bag.items[1], -0));
+
+// A local accumulator that only operators write.
+function accumulate(o, n) {
+  var acc = o.start;
+  for (var k = 0; k < n; k++) acc = acc + o.step * k - 0.5;
+  return acc;
+}
+show("acc", accumulate(dyn({ start: 10, step: 0.25 }), 100));
+show("acc-string", accumulate(dyn({ start: "s", step: 2 }), 3));
+
+// Strings and BigInts cross into the dynamic tier without a cell.
+var texts = dyn({ name: "w", n: 3, big: 10n });
+var label = texts.name;
+for (var w = 0; w < 4; w++) label = label + "-" + w + (w % 2 === 0);
+console.log(label, texts.name + undefined, texts.name + null, 1 + texts.n + "x");
+console.log(texts.big + 5n, texts.big * -2n, 7n % texts.big, texts.big ** 3n, texts.big - texts.big);
+try {
+  console.log(texts.big / 0n);
+} catch (error) {
+  console.log(error instanceof RangeError, error.message);
+}
+
+// Increments and decrements of dynamic values.
+var counters = dyn({ n: "5", b: 9007199254740993n, f: 1.5 });
+counters.n++;
+counters.b--;
+counters.f += 1;
+var post = counters.f++;
+console.log(counters.n, counters.b, counters.f, post, typeof counters.n);
+
+// Comparisons, including NaN and strings.
+var cmp = dyn({ a: 2, b: "10", c: "9", nan: NaN });
+console.log(cmp.a < cmp.b, cmp.b < cmp.c, cmp.a >= cmp.nan, cmp.nan <= cmp.nan);
+console.log(cmp.a + 1 > cmp.c - 7, cmp.b * 1 <= cmp.c * 1, 3n > cmp.a, "a" < cmp.c);
+
+// Truthiness of operator results.
+var t = dyn({ a: 5, b: 5 });
+if (t.a - t.b) console.log("nonzero");
+else console.log("zero");
+var countdown = t.a;
+var seen = [];
+while (countdown--) seen.push(countdown);
+console.log(seen.join(" "), countdown);
+console.log(t.a * 0 || "fallback", (t.a - 5) / 0 ? "nan-truthy" : "nan-falsy");
+
+// ToPrimitive order: left before right, valueOf before toString.
+var log = [];
+function wrap(name, value) {
+  return dyn({
+    valueOf: function () {
+      log.push(name + ".valueOf");
+      return value;
+    },
+    toString: function () {
+      log.push(name + ".toString");
+      return "<" + name + ">";
+    },
+  });
+}
+var l = wrap("l", 3);
+var r = wrap("r", 4);
+console.log(l * r + l, l + "|" + r, l < r, l - r * 2);
+console.log(log.join(" "));
+
+// A throw in the middle of a chain leaves no partial state behind.
+var bomb = dyn({
+  valueOf: function () {
+    throw new Error("boom");
+  },
+});
+try {
+  var partial = point.x * 2 + bomb * 3;
+  console.log("unreachable", partial);
+} catch (error) {
+  console.log("caught", error.message);
+}
+try {
+  console.log(point.big + point.x);
+} catch (error) {
+  console.log(error instanceof TypeError, error.message);
+}
+try {
+  console.log(dyn(Symbol("s")) * point.x);
+} catch (error) {
+  console.log(error instanceof TypeError, error.message);
+}
+
+// A NaN with an arbitrary payload, read from a typed array, stays NaN.
+var words = new Uint32Array([0xffffffff, 0xffffffff]);
+var odd = dyn({ v: new Float64Array(words.buffer)[0] });
+show("payload-nan", odd.v * 2 + 1);
+console.log(odd.v + 1 === odd.v + 1, [odd.v + 1].includes(NaN));
+
+// Async functions and generators compute with jsvals across suspensions.
+async function asyncSum(o) {
+  var t = 0;
+  for (var i = 0; i < 3; i++) t = t + (await o.p) * i + o.q;
+  return t;
+}
+function* steps(o) {
+  var x = o.start;
+  while (x < o.end) {
+    yield x * 2;
+    x = x + o.step;
+  }
+}
+asyncSum(dyn({ p: 2, q: 0.25 })).then(function (v) {
+  show("async", v);
+});
+console.log(Array.from(steps(dyn({ start: 1, end: 4, step: 1.5 }))).join(","));
diff --git a/tests/corpus/6147-jsval-any-operators.ts b/tests/corpus/6147-jsval-any-operators.ts
new file mode 100644
index 000000000..96fe2695f
--- /dev/null
+++ b/tests/corpus/6147-jsval-any-operators.ts
@@ -0,0 +1,48 @@
+// TypeScript `any` operators compile in the dynamic tier: numbers are jsval
+// immediates between operators, and results cross back into typed code and
+// dynamic objects exactly as before.
+function scale(value: any, factor: any): any {
+  return value * factor + 1;
+}
+
+function mean(values: any): number {
+  let total: any = 0;
+  for (let i = 0; i < values.length; i++) total = total + values[i];
+  return total / values.length;
+}
+
+function describe(input: any): string {
+  const doubled = input + input;
+  return `${typeof doubled}:${doubled}`;
+}
+
+console.log(scale(20, 2), scale("3", "4"), scale(1.5, -0), scale(true, null));
+console.log(mean([1, 2, 3, 4]), mean(JSON.parse("[0.5, 0.25, 0.125]")));
+console.log(describe(21), describe("ab"), describe(true), describe(null));
+
+const stats: any = { hits: 0, misses: 0, ratio: 0 };
+for (let i = 0; i < 1000; i++) {
+  if (i % 3 === 0) stats.hits = stats.hits + 1;
+  else stats.misses += 1;
+}
+stats.ratio = stats.hits / (stats.hits + stats.misses);
+console.log(JSON.stringify(stats));
+
+let counter: any = JSON.parse("41");
+counter++;
+const before: number = counter--;
+console.log(counter, before, counter < before, counter * 2 >= 82);
+
+const weird: any = { valueOf: () => 7 };
+const fromObject: number = weird * 6;
+console.log(fromObject, weird + 1, weird > 6);
+
+function guarded(x: any): string {
+  try {
+    const n: number = x - 1;
+    return `ok ${n}`;
+  } catch (error) {
+    return `threw ${(error as Error).message}`;
+  }
+}
+console.log(guarded(5), guarded("5"), guarded(5n));
diff --git a/tests/corpus/6200-string-annexb-locale-methods.ts b/tests/corpus/6200-string-annexb-locale-methods.ts
new file mode 100644
index 000000000..8c0c2f66b
--- /dev/null
+++ b/tests/corpus/6200-string-annexb-locale-methods.ts
@@ -0,0 +1,33 @@
+// String.prototype.substr, the locale case pair and the Annex B HTML
+// methods on typed strings. substr counts a negative start from the end
+// and clamps its length; toLocaleLowerCase/toLocaleUpperCase use the
+// default case conversion except for the Turkic languages, decided by the
+// first requested locale only; the HTML methods escape '"' in attribute
+// values.
+const s = "Hello, World";
+console.log(s.substr(0), s.substr(7), s.substr(-5), s.substr(-50, 3), s.substr(3, 4));
+console.log(JSON.stringify([s.substr(20), s.substr(2, -1), s.substr(NaN, 2), s.substr(1, Infinity)]));
+console.log(JSON.stringify([s.substr(-Infinity, 2), s.substr(1.9, 2.9), "😀ab".substr(1, 2)]));
+function tail(from: number, length?: number): string {
+  return s.substr(from, length);
+}
+console.log(tail(2), tail(2, 3), tail(-3, undefined));
+
+function lower(text: string, locale?: string | string[]): string {
+  return text.toLocaleLowerCase(locale);
+}
+function upper(text: string, locale?: string | string[]): string {
+  return text.toLocaleUpperCase(locale);
+}
+const sample = "IİiıÍ ΣΑΣ Straße";
+for (const locale of [undefined, "en", "en-US", "de-DE", "TR", "tr-TR", "az", "tur", "zh-Hant-TW", "und", "en-u-co-phonebk", "en-x-tr"]) {
+  console.log(String(locale), lower(sample, locale), upper(sample, locale));
+}
+console.log(lower(sample, ["tr", "en"]), lower(sample, ["en", "tr"]), lower(sample, []));
+console.log(upper("istanbul", ["az"]), lower("DİYARBAKIR"), lower("İx", "tr").length);
+console.log("Dž".toLocaleUpperCase(), "ß".toLocaleUpperCase("de"), "ffi".toLocaleUpperCase("en"));
+
+
+console.log(s.anchor('a"b'), s.big(), s.blink(), s.bold(), s.fixed());
+console.log(s.fontcolor("red"), s.fontsize(7), s.italics(), s.link("https://x/?q=\"1\""));
+console.log(s.small(), s.strike(), s.sub(), s.sup(), "".anchor(""));
diff --git a/tests/corpus/6201-number-precision-exponential.ts b/tests/corpus/6201-number-precision-exponential.ts
new file mode 100644
index 000000000..7c3d4eff8
--- /dev/null
+++ b/tests/corpus/6201-number-precision-exponential.ts
@@ -0,0 +1,34 @@
+// Number.prototype.toPrecision and toExponential(fractionDigits): the
+// exact binary value rounds half up at the requested digit, exponential
+// form takes over when the exponent is below -6 or reaches the precision,
+// and the non-finite answers come before the digit-range RangeError.
+const values = [0, -0, 1, -1, 2.5, -2.5, 0.5, 1.005, 1.45, 123.456, 0.000001234, 0.0000001234, 1e21, 1e-7, 5e-324, 1.7976931348623157e308, 123456789012345680000, 0.1, 99.99, 9.995, 1e23, -1234.5678];
+for (const v of values) {
+  const p = [1, 2, 3, 5, 10, 21].map((d) => v.toPrecision(d));
+  const e = [0, 1, 2, 6, 20].map((d) => v.toExponential(d));
+  console.log(String(v), p.join(" "), e.join(" "));
+}
+console.log((123.456).toPrecision(), (123.456).toPrecision(undefined), (1 / 3).toPrecision(100));
+console.log((1 / 3).toExponential(100), (2 ** 70).toPrecision(25), (2 ** -30).toExponential(30));
+console.log(NaN.toPrecision(200), Infinity.toPrecision(0), (-Infinity).toExponential(-1), NaN.toExponential(101));
+console.log((15).toPrecision(1.9), (15).toExponential(1.9), (0.00001).toPrecision(1), (1e-6).toPrecision(2));
+for (const bad of [0, 101, -1, Infinity]) {
+  try {
+    console.log((1).toPrecision(bad));
+  } catch (e) {
+    console.log((e as Error).name, (e as Error).message);
+  }
+}
+for (const bad of [-1, 101, Infinity]) {
+  try {
+    console.log((1).toExponential(bad));
+  } catch (e) {
+    console.log((e as Error).name, (e as Error).message);
+  }
+}
+let n = 0;
+for (let i = 1; i < 2000; i++) {
+  const x = i / 7 + i * 1e-9;
+  if (x.toPrecision(7) !== Number(x.toPrecision(7)).toPrecision(7)) n++;
+}
+console.log("stable", n);
diff --git a/tests/corpus/6202-dyn-string-number-methods.js b/tests/corpus/6202-dyn-string-number-methods.js
new file mode 100644
index 000000000..3f50a4636
--- /dev/null
+++ b/tests/corpus/6202-dyn-string-number-methods.js
@@ -0,0 +1,92 @@
+// String and Number methods on JS-inferred receivers: string receivers run
+// the real method (string-width's codePointAt, camelcase's
+// toLocaleLowerCase, toml's substr, pretty-bytes' toPrecision); other
+// receivers keep JavaScript's answer for the name, an object's own method
+// or Node's TypeError; arrays keep the runtime dispatch of shared names.
+function width(text) {
+  let total = 0;
+  for (const character of text) {
+    const code = character.codePointAt(0);
+    total += code >= 0x1100 ? 2 : 1;
+  }
+  return total;
+}
+console.log(width("abc"), width("古"), width("👍x"));
+
+function describe(input) {
+  return [
+    input.codePointAt(0),
+    input.codePointAt(-1),
+    input.codePointAt("1"),
+    input.substr(1),
+    input.substr(-2, 1),
+    input.toLocaleLowerCase(),
+    input.toLocaleUpperCase("en-US"),
+    input.toLocaleLowerCase("tr"),
+    input.trimLeft(),
+    input.trimRight(),
+    input.isWellFormed(),
+    input.toWellFormed().length,
+  ];
+}
+console.log(JSON.stringify(describe("  Iİ😀 ")));
+console.log(JSON.stringify(describe("\ud800Ab")));
+const parsed = JSON.parse('["  I\\u0130\\ud83d\\ude00 ", 1337, 0.000123456, [1, 2, 3]]');
+console.log(JSON.stringify(describe(parsed[0])));
+
+function number(value, digits) {
+  return [value.toPrecision(digits), value.toExponential(digits), value.toPrecision()];
+}
+console.log(JSON.stringify(number(1337, 3)), JSON.stringify(number(0.000123456, 2)));
+console.log(JSON.stringify(number(-1.5, "4")), JSON.stringify(number(2.5, undefined)));
+console.log(JSON.stringify(number(parsed[1], 3)), JSON.stringify(number(parsed[2], parsed[1] - 1335)));
+
+function prettyBytes(n) {
+  const units = ["B", "kB", "MB", "GB"];
+  const exponent = Math.min(Math.floor(Math.log10(n) / 3), units.length - 1);
+  return Number((n / 1000 ** exponent).toPrecision(3)) + " " + units[exponent];
+}
+console.log(prettyBytes(1337), prettyBytes(100), prettyBytes(12345678));
+
+const own = { codePointAt(i) { return "own " + i; }, substr() { return "own substr"; }, toPrecision(d) { return "own " + d; } };
+console.log(describeOwn(own));
+function describeOwn(value) {
+  return [value.codePointAt(3), value.substr(), value.toPrecision(2)].join("|");
+}
+function arrays(list) {
+  return JSON.stringify([list.at(-1), list.concat([4], 5)]);
+}
+console.log(arrays([1, 2, 3]), arrays(parsed[3]));
+
+function attempt(f) {
+  try {
+    return String(f());
+  } catch (e) {
+    return e.name + ": " + e.message;
+  }
+}
+function fail(value) {
+  return [
+    attempt(() => value.codePointAt(0)),
+    attempt(() => value.substr(0)),
+    attempt(() => value.toPrecision(2)),
+    attempt(() => value.toLocaleLowerCase()),
+  ].join(" / ");
+}
+for (const value of [42, "str", undefined, null, {}, parsed[3]]) console.log(fail(value));
+for (const value of JSON.parse('[42, "str", null, {}, true]')) console.log(fail(value));
+console.log(attempt(() => number(1, 200)));
+console.log(attempt(() => "x".toLocaleUpperCase(null)));
+
+// A helper whose parameter the checker leaves untyped answers `string |
+// undefined` natively; the guarded receiver still runs String methods.
+function afterX(segment) {
+  const index = segment.indexOf("x");
+  return index === -1 ? undefined : segment.slice(index + 1);
+}
+function tailCode(text) {
+  const rest = afterX(text);
+  if (rest === undefined) return -1;
+  return [rest.codePointAt(0), rest.substr(1), rest.toUpperCase(), rest.slice(1)].join(",");
+}
+console.log(tailCode("axé😀"), tailCode("abc"));
diff --git a/tests/corpus/6203-any-string-number-methods.ts b/tests/corpus/6203-any-string-number-methods.ts
new file mode 100644
index 000000000..202365e5e
--- /dev/null
+++ b/tests/corpus/6203-any-string-number-methods.ts
@@ -0,0 +1,15 @@
+// String and Number methods through 'any'-typed values: string and number
+// receivers run the real methods, other values keep JavaScript's answer.
+const values: any[] = JSON.parse('["Straße İx", 1234.5678, {"substr": 1}, [1, 2]]');
+const [text, num, obj, list] = values;
+console.log(text.codePointAt(7), text.substr(-2), text.toLocaleUpperCase(), text.toLocaleLowerCase("az"));
+console.log(text.trimRight(), text.isWellFormed(), text.toLocaleLowerCase(["TR"]));
+console.log(num.toPrecision(6), num.toExponential(3), num.toPrecision(), num.toExponential());
+console.log(list.at(-1), JSON.stringify(list.concat([3])));
+for (const call of [() => obj.substr(0), () => num.codePointAt(0), () => text.toPrecision(2)]) {
+  try {
+    console.log(call());
+  } catch (e) {
+    console.log((e as Error).name + ": " + (e as Error).message);
+  }
+}
diff --git a/tests/corpus/6204-crypto-get-random-values.ts b/tests/corpus/6204-crypto-get-random-values.ts
new file mode 100644
index 000000000..fae3c4049
--- /dev/null
+++ b/tests/corpus/6204-crypto-get-random-values.ts
@@ -0,0 +1,36 @@
+// crypto.getRandomValues through node:crypto's export and webcrypto:
+// integer typed arrays fill in place and come back as the same object;
+// views over 65536 bytes throw QuotaExceededError. (The global spelling and
+// the float/DataView TypeMismatchError are 6205's.)
+import { getRandomValues, webcrypto } from "node:crypto";
+import * as nodeCrypto from "node:crypto";
+
+const bytes = new Uint8Array(4096);
+const same = webcrypto.getRandomValues(bytes);
+function nonzero(view: Uint8Array): boolean {
+  for (let i = 0; i < view.length; i++) if (view[i] !== 0) return true;
+  return false;
+}
+function nonzeroWords(view: Uint32Array): boolean {
+  for (let i = 0; i < view.length; i++) if (view[i] !== 0) return true;
+  return false;
+}
+console.log(same === bytes, bytes.length, nonzero(bytes));
+const words = new Uint32Array(256);
+console.log(getRandomValues(words) === words, nonzeroWords(words));
+const shorts = new Int16Array(8);
+console.log(webcrypto.getRandomValues(shorts) === shorts, nodeCrypto.getRandomValues(new Uint8ClampedArray(3)).length);
+console.log(nodeCrypto.webcrypto.getRandomValues(new Int8Array(65536)).length, getRandomValues(new Uint8Array(0)).length);
+const buf = Buffer.alloc(16);
+console.log(Buffer.isBuffer(getRandomValues(buf)), buf.subarray(4, 8).length);
+
+function attempt(label: string, f: () => unknown): void {
+  try {
+    f();
+    console.log(label, "ok");
+  } catch (e) {
+    console.log(label, (e as DOMException).name, (e as DOMException).code, (e as Error).message, e instanceof DOMException);
+  }
+}
+attempt("big", () => getRandomValues(new Uint8Array(65537)));
+attempt("big32", () => webcrypto.getRandomValues(new Uint32Array(16385)));
diff --git a/tests/corpus/6205-crypto-get-random-values.js b/tests/corpus/6205-crypto-get-random-values.js
new file mode 100644
index 000000000..97d3e67d5
--- /dev/null
+++ b/tests/corpus/6205-crypto-get-random-values.js
@@ -0,0 +1,38 @@
+// nanoid's fillRandom: crypto.getRandomValues over Buffer windows of an
+// untyped helper, plus non-view values that throw TypeMismatchError.
+import { getRandomValues } from "node:crypto";
+const GET_RANDOM_LIMIT = 65536;
+function fillRandom(buffer) {
+  let from = 0;
+  while (from < buffer.length) {
+    const to = Math.min(from + GET_RANDOM_LIMIT, buffer.length);
+    crypto.getRandomValues(buffer.subarray(from, to));
+    from = to;
+  }
+}
+const alphabet = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict";
+function nanoid(size = 21) {
+  const bytes = Buffer.allocUnsafe(size);
+  fillRandom(bytes);
+  let id = "";
+  for (let i = 0; i < size; i++) id += alphabet[bytes[i] & 63];
+  return id;
+}
+const id = nanoid();
+console.log(id.length, /^[A-Za-z0-9_-]+$/.test(id), nanoid(10).length, nanoid(70000).length);
+const filled = globalThis.crypto.getRandomValues(new Uint16Array(3));
+console.log(filled.length);
+for (const value of [new Float64Array(1), new Float32Array(2), new DataView(new ArrayBuffer(2)), new Uint8Array(65537), [1, 2], "x", 5, {}]) {
+  try {
+    crypto.getRandomValues(value);
+    console.log("ok");
+  } catch (e) {
+    console.log(e.name, e.message);
+  }
+}
+const untyped = JSON.parse("[1]");
+try {
+  getRandomValues(untyped);
+} catch (e) {
+  console.log(e.name, e.code, e.message);
+}
diff --git a/tests/corpus/6206-buffer-is-buffer-views.ts b/tests/corpus/6206-buffer-is-buffer-views.ts
new file mode 100644
index 000000000..55e9fd49c
--- /dev/null
+++ b/tests/corpus/6206-buffer-is-buffer-views.ts
@@ -0,0 +1,16 @@
+// Buffer.isBuffer over Uint8Array-typed values reads the view's Buffer
+// brand: Buffer factories, Buffer subarrays and slices are Buffers, plain
+// typed arrays and copies into them are not.
+function check(view: Uint8Array): boolean {
+  return Buffer.isBuffer(view);
+}
+const plain = new Uint8Array([1, 2, 3]);
+const buffer = Buffer.from(plain);
+console.log(check(plain), check(buffer), check(Buffer.alloc(2)), check(Buffer.from("hey").subarray(1)));
+console.log(check(plain.subarray(1)), check(new Uint8Array(buffer)), check(buffer.slice(1)), check(Buffer.concat([plain])));
+const views: Uint8Array[] = [plain, buffer, new TextEncoder().encode("x"), Buffer.allocUnsafe(1)];
+console.log(views.map((v) => Buffer.isBuffer(v)).join(","));
+function words(view: Uint32Array): boolean {
+  return Buffer.isBuffer(view);
+}
+console.log(words(new Uint32Array(2)), Buffer.from(plain).toString("hex"), Buffer.from(views[2]!).toString());
diff --git a/tests/corpus/6207-fs-constants-object.ts b/tests/corpus/6207-fs-constants-object.ts
new file mode 100644
index 000000000..860cc4708
--- /dev/null
+++ b/tests/corpus/6207-fs-constants-object.ts
@@ -0,0 +1,19 @@
+// fs.constants as a value and every member: the target platform's flags,
+// file-type bits and permission bits, in Node's order, on a null-prototype
+// object whose members are read-only. The access-mode bits keep their
+// baked literals.
+import * as fs from "node:fs";
+import { constants } from "node:fs";
+
+// libuv's Windows-only open flags (0 elsewhere) joined the object in later
+// Node 24 releases; the rest is the same in every one.
+const windowsOnly = ["UV_FS_O_TEMPORARY", "UV_FS_O_SHORT_LIVED", "UV_FS_O_SEQUENTIAL", "UV_FS_O_RANDOM"];
+console.log(JSON.stringify(Object.entries(fs.constants).filter(([k]) => !windowsOnly.includes(k))));
+console.log(fs.constants.O_RDONLY, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_TRUNC, constants.S_IFMT, constants.S_IFDIR);
+console.log(constants.W_OK, fs.constants.F_OK, constants.COPYFILE_EXCL, fs.constants.UV_FS_O_FILEMAP);
+const c: unknown = fs.constants;
+console.log(typeof c, c === (fs.constants as unknown), Object.getPrototypeOf(c as object) === null, Object.keys(fs.constants).length > 40);
+const mode = fs.statSync(".").mode;
+console.log((mode & constants.S_IFMT) === constants.S_IFDIR, (mode & fs.constants.S_IRUSR) !== 0);
+const descriptor = Object.getOwnPropertyDescriptor(c as object, "O_RDONLY");
+console.log(JSON.stringify(descriptor));
diff --git a/tests/corpus/6208-fs-constants-require.cjs b/tests/corpus/6208-fs-constants-require.cjs
new file mode 100644
index 000000000..c8488a8bf
--- /dev/null
+++ b/tests/corpus/6208-fs-constants-require.cjs
@@ -0,0 +1,8 @@
+// graceful-fs's reads of require('fs').constants: own-property probes for
+// platform-specific flags and member reads through a stored binding.
+var fs = require("fs");
+var constants = fs.constants;
+console.log(typeof constants.O_RDONLY, constants.O_RDWR, Object.prototype.hasOwnProperty.call(constants, "O_SYMLINK") === ("O_SYMLINK" in constants), typeof constants.hasOwnProperty);
+console.log(Object.prototype.hasOwnProperty.call(constants, "S_IFREG"), constants.O_EXCL > 0, typeof require("fs").constants.S_IFLNK);
+var names = Object.keys(constants).filter(function (k) { return k.indexOf("UV_DIRENT_") === 0; });
+console.log(names.join(","), constants.NOT_A_CONSTANT);
diff --git a/tests/corpus/6209-buffer-module-alias.cjs b/tests/corpus/6209-buffer-module-alias.cjs
new file mode 100644
index 000000000..cec2d06d8
--- /dev/null
+++ b/tests/corpus/6209-buffer-module-alias.cjs
@@ -0,0 +1,25 @@
+// The buffer module's Buffer through CommonJS bindings — `var Buffer =
+// require('buffer').Buffer` and a member of a stored require — is the
+// global Buffer constructor, with its statics.
+var Buffer = require("buffer").Buffer;
+var buffer = require("buffer");
+var B2 = buffer.Buffer;
+const B3 = require("node:buffer").Buffer;
+console.log(Buffer.from("hi").toString("hex"), Buffer.isBuffer(Buffer.alloc(1)), B2.byteLength("héllo"), B2.isBuffer("x"));
+console.log(B3.concat([B2.from("a"), Buffer.from([98])]).toString(), B3.alloc(2, 1).toString("base64"));
+function toBuffer(chunk) {
+  return Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+}
+console.log(toBuffer("abc").length, toBuffer(Buffer.from("xyz")).toString());
+
+// Buffer.from over a JS-inferred `string | Uint8Array | undefined` result
+// dispatches on the runtime kind, Node's TypeError for undefined included.
+function make(flag) {
+  return flag ? "ab" : flag === false ? new Uint8Array([99, 100]) : undefined;
+}
+console.log(Buffer.from(make(true)).toString(), Buffer.from(make(false)).toString("hex"));
+try {
+  Buffer.from(make(null));
+} catch (e) {
+  console.log(e.name, e.code);
+}
diff --git a/tests/corpus/6210-typeof-global-static-members.js b/tests/corpus/6210-typeof-global-static-members.js
new file mode 100644
index 000000000..88c3c40a1
--- /dev/null
+++ b/tests/corpus/6210-typeof-global-static-members.js
@@ -0,0 +1,11 @@
+// ky's feature probes: typeof Node's Web-platform constructor globals and
+// their static methods answers "function" without materializing the value.
+export const supportsAbortController = typeof globalThis.AbortController === "function";
+export const supportsAbortSignal =
+  typeof globalThis.AbortSignal === "function" && typeof globalThis.AbortSignal.any === "function";
+console.log(supportsAbortController, supportsAbortSignal);
+console.log(typeof AbortSignal.timeout, typeof AbortSignal.abort, typeof globalThis.AbortSignal.any);
+console.log(typeof Response.json, typeof Response.error, typeof URL.canParse, typeof Promise.withResolvers);
+console.log(typeof AbortSignal, typeof globalThis.URL, typeof Headers, typeof globalThis.TextEncoder, typeof URLSearchParams);
+const signal = AbortSignal.abort("stop");
+console.log(signal.aborted, signal.reason);
diff --git a/tests/corpus/6231-process-emit-warning-assign.ts b/tests/corpus/6231-process-emit-warning-assign.ts
new file mode 100644
index 000000000..1cae44f82
--- /dev/null
+++ b/tests/corpus/6231-process-emit-warning-assign.ts
@@ -0,0 +1,35 @@
+// process.emitWarning and process.title are ordinary writable properties
+// (pi's CLI setup assigns both). After the replacement, process.emitWarning
+// calls reach it with their own arguments, no report reaches stderr, and
+// the warnings Node's own modules emit through process.emitWarning (a
+// util.deprecate wrapper's first call) reach it too.
+import { deprecate } from "node:util";
+
+process.title = "pi";
+console.log("title", process.title);
+process.env.PI_CODING_AGENT = "true";
+console.log("env", process.env.PI_CODING_AGENT);
+
+const seen: string[] = [];
+process.on("warning", (w) => seen.push(`listener ${w.name}`));
+function show(a: unknown): string {
+  if (a instanceof Error) return `Error(${a.message})`;
+  return typeof a === "object" ? JSON.stringify(a) : String(a);
+}
+process.emitWarning = ((warning: unknown, type: unknown, code: unknown) => {
+  seen.push(`${show(warning)}|${show(type)}|${show(code)}`);
+}) as typeof process.emitWarning;
+
+process.emitWarning("plain");
+process.emitWarning("typed", "CustomWarning", "CW_1");
+process.emitWarning("options", { type: "OptWarning", code: "OW_1", detail: "d" });
+process.emitWarning(new Error("as error"));
+const old = deprecate(() => "result", "old() is deprecated", "DEP_SCRIPTC_1");
+console.log("deprecated call", old());
+console.log("second call", old());
+console.log("sync", seen.join(" ; "));
+
+// A replacement that does nothing silences warnings entirely.
+process.emitWarning = (() => {}) as typeof process.emitWarning;
+process.emitWarning("silenced");
+setTimeout(() => console.log("after tick", seen.length), 0);
diff --git a/tests/corpus/6232-process-builtin-module-typed/main.ts b/tests/corpus/6232-process-builtin-module-typed/main.ts
new file mode 100644
index 000000000..7765bd228
--- /dev/null
+++ b/tests/corpus/6232-process-builtin-module-typed/main.ts
@@ -0,0 +1,28 @@
+// process.getBuiltinModule and process.features under @types/node: a
+// literal id types as the module namespace, so the result is the same
+// object `import * as os` binds (pi's user-agent probe casts process and
+// calls the member optionally), and process.features is an object a
+// feature probe can test with `in` (pi's single-executable check).
+import * as os from "node:os";
+import type * as NodeOs from "node:os";
+
+const direct = process.getBuiltinModule("node:os");
+console.log("direct", direct.platform() === os.platform(), direct.EOL === os.EOL);
+console.log("bare id", process.getBuiltinModule("os").arch() === os.arch());
+
+type ProcessWithOsBuiltinModule = typeof process & {
+  getBuiltinModule?: (id: "node:os") => typeof NodeOs;
+};
+function loadNodeOs(): typeof NodeOs | null {
+  if (typeof process === "undefined" || !(process.versions?.node || process.versions?.bun)) {
+    return null;
+  }
+  return (process as ProcessWithOsBuiltinModule).getBuiltinModule?.("node:os") ?? null;
+}
+const nodeOs = loadNodeOs();
+const agent = nodeOs ? `pi (${nodeOs.platform()} ${nodeOs.release()}; ${nodeOs.arch()})` : "pi (browser)";
+console.log("agent", agent === `pi (${os.platform()} ${os.release()}; ${os.arch()})`);
+console.log("present", nodeOs !== null, nodeOs ? typeof nodeOs.homedir() : "none");
+
+const isNodeSeaBinary = "sea" in process.features && process.features.sea === true;
+console.log("sea", isNodeSeaBinary, "sea" in process.features);
diff --git a/tests/corpus/6232-process-builtin-module-typed/package.json b/tests/corpus/6232-process-builtin-module-typed/package.json
new file mode 100644
index 000000000..5ffd9800b
--- /dev/null
+++ b/tests/corpus/6232-process-builtin-module-typed/package.json
@@ -0,0 +1 @@
+{ "type": "module" }
diff --git a/tests/corpus/6232-process-builtin-module-typed/tsconfig.json b/tests/corpus/6232-process-builtin-module-typed/tsconfig.json
new file mode 100644
index 000000000..ae4eda194
--- /dev/null
+++ b/tests/corpus/6232-process-builtin-module-typed/tsconfig.json
@@ -0,0 +1,7 @@
+{
+  "compilerOptions": {
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true
+  }
+}
diff --git a/tests/corpus/6233-for-await-class-async-generator.ts b/tests/corpus/6233-for-await-class-async-generator.ts
new file mode 100644
index 000000000..1a88df7e8
--- /dev/null
+++ b/tests/corpus/6233-for-await-class-async-generator.ts
@@ -0,0 +1,168 @@
+// `for await` over a class instance whose [Symbol.asyncIterator] is an
+// async generator method — pi-ai's EventStream, which is how every
+// provider stream is consumed: a generic push/end queue, a subclass, the
+// protocol-interface return annotations, producers that run between
+// iterations, early exit (the generator's finally runs), and errors.
+class FifoQueue<T> {
+  private incoming: T[] = [];
+  private outgoing: T[] = [];
+
+  get length(): number {
+    return this.incoming.length + this.outgoing.length;
+  }
+
+  enqueue(value: T): void {
+    this.incoming.push(value);
+  }
+
+  dequeue(): T | undefined {
+    if (this.outgoing.length === 0) {
+      while (this.incoming.length > 0) {
+        this.outgoing.push(this.incoming.pop()!);
+      }
+    }
+    return this.outgoing.pop();
+  }
+}
+
+class EventStream<T, R = T> implements AsyncIterable<T> {
+  private queue = new FifoQueue<T>();
+  private waiting = new FifoQueue<(value: IteratorResult<T>) => void>();
+  protected done = false;
+  private finalResultPromise: Promise<R>;
+  private resolveFinalResult!: (result: R) => void;
+  private isComplete: (event: T) => boolean;
+  private extractResult: (event: T) => R;
+
+  constructor(isComplete: (event: T) => boolean, extractResult: (event: T) => R) {
+    this.isComplete = isComplete;
+    this.extractResult = extractResult;
+    this.finalResultPromise = new Promise((resolve) => {
+      this.resolveFinalResult = resolve;
+    });
+  }
+
+  push(event: T): void {
+    if (this.done) return;
+    if (this.isComplete(event)) {
+      this.done = true;
+      this.resolveFinalResult(this.extractResult(event));
+    }
+    const waiter = this.waiting.dequeue();
+    if (waiter) {
+      waiter({ value: event, done: false });
+    } else {
+      this.queue.enqueue(event);
+    }
+  }
+
+  end(result?: R): void {
+    this.done = true;
+    if (result !== undefined) {
+      this.resolveFinalResult(result);
+    }
+    while (this.waiting.length > 0) {
+      const waiter = this.waiting.dequeue()!;
+      waiter({ value: undefined as any, done: true });
+    }
+  }
+
+  async *[Symbol.asyncIterator](): AsyncIterator<T> {
+    while (true) {
+      if (this.queue.length > 0) {
+        yield this.queue.dequeue()!;
+      } else if (this.done) {
+        return;
+      } else {
+        const result = await new Promise<IteratorResult<T>>((resolve) => this.waiting.enqueue(resolve));
+        if (result.done) return;
+        yield result.value;
+      }
+    }
+  }
+
+  result(): Promise<R> {
+    return this.finalResultPromise;
+  }
+}
+
+type Event = { type: "text"; delta: string } | { type: "done"; text: string };
+
+class TextStream extends EventStream<Event, string> {
+  constructor() {
+    super(
+      (event) => event.type === "done",
+      (event) => (event.type === "done" ? event.text : ""),
+    );
+  }
+}
+
+function produce(stream: TextStream, words: string[]): void {
+  let i = 0;
+  const step = (): void => {
+    if (i < words.length) {
+      stream.push({ type: "text", delta: words[i]! });
+      i++;
+      setTimeout(step, 1);
+    } else {
+      stream.push({ type: "done", text: words.join("") });
+    }
+  };
+  step();
+}
+
+class Ticker {
+  log: string[] = [];
+  async *[Symbol.asyncIterator](): AsyncIterableIterator<number> {
+    try {
+      for (let n = 1; n <= 5; n++) {
+        this.log.push(`yield ${n}`);
+        yield n;
+      }
+    } finally {
+      this.log.push("closed");
+    }
+  }
+}
+
+class Failing {
+  async *[Symbol.asyncIterator](): AsyncGenerator<string> {
+    yield "first";
+    throw new Error("stream failed");
+  }
+}
+
+async function main(): Promise<void> {
+  const stream = new TextStream();
+  produce(stream, ["Hello", " from", " the", " stub"]);
+  let text = "";
+  for await (const event of stream) {
+    if (event.type === "text") text += event.delta;
+    else console.log("done event", event.text);
+  }
+  console.log("streamed", JSON.stringify(text), "result", await stream.result());
+
+  // Events queued before iteration starts, then end() with no consumer waiting.
+  const early = new TextStream();
+  early.push({ type: "text", delta: "a" });
+  early.push({ type: "text", delta: "b" });
+  early.end("ab");
+  const seen: string[] = [];
+  for await (const event of early) seen.push(event.type === "text" ? event.delta : "?");
+  console.log("queued", seen.join(","), await early.result());
+
+  // break closes the generator: its finally runs before the loop exits.
+  const ticker = new Ticker();
+  for await (const n of ticker) {
+    if (n === 3) break;
+  }
+  console.log("ticker", ticker.log.join(" | "));
+
+  // A throw from the generator rejects the loop.
+  try {
+    for await (const s of new Failing()) console.log("got", s);
+  } catch (e) {
+    console.log("caught", (e as Error).message);
+  }
+}
+main();
diff --git a/tests/corpus/6234-weak-collection-class-fields.ts b/tests/corpus/6234-weak-collection-class-fields.ts
new file mode 100644
index 000000000..d7a085921
--- /dev/null
+++ b/tests/corpus/6234-weak-collection-class-fields.ts
@@ -0,0 +1,39 @@
+// WeakMap- and WeakSet-typed class fields (pi's AgentSession keys entry ids by
+// message object): initialized, optional, and constructor-assigned fields hold
+// the native weak collections like locals of those types.
+class Session {
+  private readonly _entryIdsByMessage = new WeakMap<object, string>();
+  private seen = new WeakSet<object>();
+  cache: WeakMap<object, number> | undefined;
+  record(message: object, id: string): void {
+    this._entryIdsByMessage.set(message, id);
+    this.seen.add(message);
+  }
+  idOf(message: object): string | undefined {
+    return this._entryIdsByMessage.get(message);
+  }
+  has(message: object): boolean {
+    return this.seen.has(message) && this._entryIdsByMessage.has(message);
+  }
+}
+const s = new Session();
+const a = { role: "user" };
+const b = { role: "assistant" };
+s.record(a, "e1");
+console.log(s.idOf(a), s.idOf(b), s.has(a), s.has(b));
+s.cache = new WeakMap();
+s.cache.set(a, 1);
+console.log(s.cache.get(a), s.cache.has(b), s.cache instanceof WeakMap);
+class Registry {
+  private readonly names: WeakMap<object, string>;
+  constructor(names: WeakMap<object, string>) {
+    this.names = names;
+  }
+  name(o: object): string {
+    return this.names.get(o) ?? "(unnamed)";
+  }
+}
+const names = new WeakMap<object, string>();
+names.set(a, "alice");
+const registry = new Registry(names);
+console.log(registry.name(a), registry.name(b));
diff --git a/tests/corpus/6235-bare-builtin-shadowed-package/helper.cjs b/tests/corpus/6235-bare-builtin-shadowed-package/helper.cjs
new file mode 100644
index 000000000..8e0a0457c
--- /dev/null
+++ b/tests/corpus/6235-bare-builtin-shadowed-package/helper.cjs
@@ -0,0 +1,6 @@
+// A CommonJS require of the bare names resolves to the builtins too.
+const { StringDecoder } = require("string_decoder");
+exports.decodeEuro = () => {
+  const d = new StringDecoder("utf8");
+  return d.write(Buffer.from([0xe2, 0x82])) + d.end(Buffer.from([0xac]));
+};
diff --git a/tests/corpus/6235-bare-builtin-shadowed-package/main.ts b/tests/corpus/6235-bare-builtin-shadowed-package/main.ts
new file mode 100644
index 000000000..e9e83ea87
--- /dev/null
+++ b/tests/corpus/6235-bare-builtin-shadowed-package/main.ts
@@ -0,0 +1,17 @@
+// A bare core-module specifier names the Node builtin even when an npm
+// package of the same name is installed (pi depends on string_decoder
+// transitively): Node checks its builtins before node_modules.
+import { StringDecoder } from "string_decoder";
+import { EventEmitter } from "events";
+import { createRequire } from "node:module";
+
+const decoder = new StringDecoder("utf8");
+console.log(decoder.write(Buffer.from([0xe2, 0x82])) + decoder.end(Buffer.from([0xac])));
+
+const emitter = new EventEmitter();
+emitter.on("ping", (n: number) => console.log("ping", n));
+emitter.emit("ping", 1);
+
+const require = createRequire(import.meta.url);
+const helper = require("./helper.cjs") as { decodeEuro(): string };
+console.log("cjs", helper.decodeEuro());
diff --git a/tests/corpus/6235-bare-builtin-shadowed-package/node_modules/events/events.js b/tests/corpus/6235-bare-builtin-shadowed-package/node_modules/events/events.js
new file mode 100644
index 000000000..f1a344ef1
--- /dev/null
+++ b/tests/corpus/6235-bare-builtin-shadowed-package/node_modules/events/events.js
@@ -0,0 +1 @@
+throw new Error("the npm events package was loaded");
diff --git a/tests/corpus/6235-bare-builtin-shadowed-package/node_modules/events/package.json b/tests/corpus/6235-bare-builtin-shadowed-package/node_modules/events/package.json
new file mode 100644
index 000000000..0fb1a3c8a
--- /dev/null
+++ b/tests/corpus/6235-bare-builtin-shadowed-package/node_modules/events/package.json
@@ -0,0 +1 @@
+{ "name": "events", "version": "3.3.0", "main": "events.js" }
diff --git a/tests/corpus/6235-bare-builtin-shadowed-package/node_modules/string_decoder/index.js b/tests/corpus/6235-bare-builtin-shadowed-package/node_modules/string_decoder/index.js
new file mode 100644
index 000000000..02af46d5a
--- /dev/null
+++ b/tests/corpus/6235-bare-builtin-shadowed-package/node_modules/string_decoder/index.js
@@ -0,0 +1,3 @@
+// An installed package named like the core module: Node never loads it
+// for the bare specifier.
+throw new Error("the npm string_decoder package was loaded");
diff --git a/tests/corpus/6235-bare-builtin-shadowed-package/node_modules/string_decoder/package.json b/tests/corpus/6235-bare-builtin-shadowed-package/node_modules/string_decoder/package.json
new file mode 100644
index 000000000..ad07adde8
--- /dev/null
+++ b/tests/corpus/6235-bare-builtin-shadowed-package/node_modules/string_decoder/package.json
@@ -0,0 +1 @@
+{ "name": "string_decoder", "version": "1.3.0", "main": "index.js" }
diff --git a/tests/corpus/6235-bare-builtin-shadowed-package/package.json b/tests/corpus/6235-bare-builtin-shadowed-package/package.json
new file mode 100644
index 000000000..5ffd9800b
--- /dev/null
+++ b/tests/corpus/6235-bare-builtin-shadowed-package/package.json
@@ -0,0 +1 @@
+{ "type": "module" }
diff --git a/tests/corpus/6236-stdin-encoding-tty-probes/main.ts b/tests/corpus/6236-stdin-encoding-tty-probes/main.ts
new file mode 100644
index 000000000..0fbe7eb99
--- /dev/null
+++ b/tests/corpus/6236-stdin-encoding-tty-probes/main.ts
@@ -0,0 +1,62 @@
+// pi-tui's terminal setup on a piped stdin: the `if (process.stdin.setRawMode)`
+// presence check (the method exists only on a TTY), setEncoding with a
+// string 'data' listener whose chunks keep multibyte characters split
+// across writes whole, and stdout 'resize' listeners (registered,
+// removed, never fired off a TTY). The program re-runs itself with a
+// pipe so the parent controls the write boundaries.
+import { spawn } from "node:child_process";
+
+if (process.argv[2] === "child") {
+  console.log("raw present", typeof process.stdin.setRawMode, Boolean(process.stdin.setRawMode));
+  if (process.stdin.setRawMode) process.stdin.setRawMode(true);
+  process.stdin.setEncoding("utf8");
+  const onResize = (): void => console.log("resize", process.stdout.columns);
+  process.stdout.on("resize", onResize);
+  process.stdout.once("resize", onResize);
+  process.stdout.removeListener("resize", onResize);
+  let total = "";
+  let replacement = false;
+  process.stdin.on("data", (data: string) => {
+    if (typeof data !== "string") console.log("not a string");
+    if (data.includes("�")) replacement = true;
+    total += data;
+  });
+  process.stdin.on("end", () => {
+    console.log("end", JSON.stringify(total), "replacement", replacement);
+    process.stdout.removeListener("resize", onResize);
+  });
+  process.stdin.resume();
+  // Off a TTY no stream listens for SIGWINCH and its default is to ignore.
+  process.kill(process.pid, "SIGWINCH");
+} else {
+  const child = spawn(process.execPath, [process.argv[1]!, "child"], {
+    stdio: ["pipe", "pipe", "inherit"],
+  });
+  let out = "";
+  child.stdout!.setEncoding("utf8");
+  child.stdout!.on("data", (chunk: string) => {
+    out += chunk;
+  });
+  child.on("close", (code: number | null) => {
+    process.stdout.write(out);
+    console.log("child exit", code);
+  });
+  const parts = [
+    Buffer.from([0x68, 0xc3]),
+    Buffer.from([0xa9, 0x6c, 0x6c, 0x6f, 0x20, 0xe2, 0x82]),
+    Buffer.from([0xac, 0x20, 0xf0, 0x9f]),
+    Buffer.from([0x98, 0x80, 0x21]),
+  ];
+  let i = 0;
+  const next = (): void => {
+    if (i < parts.length) {
+      const part: Buffer = parts[i]!;
+      i++;
+      child.stdin!.write(part);
+      setTimeout(next, 30);
+    } else {
+      child.stdin!.end();
+    }
+  };
+  next();
+}
diff --git a/tests/corpus/6236-stdin-encoding-tty-probes/package.json b/tests/corpus/6236-stdin-encoding-tty-probes/package.json
new file mode 100644
index 000000000..5ffd9800b
--- /dev/null
+++ b/tests/corpus/6236-stdin-encoding-tty-probes/package.json
@@ -0,0 +1 @@
+{ "type": "module" }
diff --git a/tests/corpus/6236-stdin-encoding-tty-probes/tsconfig.json b/tests/corpus/6236-stdin-encoding-tty-probes/tsconfig.json
new file mode 100644
index 000000000..ae4eda194
--- /dev/null
+++ b/tests/corpus/6236-stdin-encoding-tty-probes/tsconfig.json
@@ -0,0 +1,7 @@
+{
+  "compilerOptions": {
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true
+  }
+}
diff --git a/tests/corpus/6237-error-subclass-delete-stack/main.js b/tests/corpus/6237-error-subclass-delete-stack/main.js
new file mode 100644
index 000000000..96ca7593d
--- /dev/null
+++ b/tests/corpus/6237-error-subclass-delete-stack/main.js
@@ -0,0 +1,12 @@
+// Deleting `stack` on an Error subclass that declares a stack accessor
+// lets reads reach the accessor (the package's guest exceptions).
+import { GuestError } from "guest-error";
+
+try {
+  throw new GuestError(7);
+} catch (e) {
+  console.log(e instanceof GuestError, e instanceof Error, e.handle, e.message);
+  console.log(e.stack);
+  e.stack = "rewritten";
+  console.log(e.stack, Object.keys(e));
+}
diff --git a/tests/corpus/6237-error-subclass-delete-stack/node_modules/guest-error/index.d.ts b/tests/corpus/6237-error-subclass-delete-stack/node_modules/guest-error/index.d.ts
new file mode 100644
index 000000000..7f3b83f94
--- /dev/null
+++ b/tests/corpus/6237-error-subclass-delete-stack/node_modules/guest-error/index.d.ts
@@ -0,0 +1,6 @@
+export declare class GuestError extends Error {
+  handle: number;
+  constructor(handle: number);
+  get stack(): string;
+  set stack(v: string);
+}
diff --git a/tests/corpus/6237-error-subclass-delete-stack/node_modules/guest-error/index.js b/tests/corpus/6237-error-subclass-delete-stack/node_modules/guest-error/index.js
new file mode 100644
index 000000000..693c06b51
--- /dev/null
+++ b/tests/corpus/6237-error-subclass-delete-stack/node_modules/guest-error/index.js
@@ -0,0 +1,18 @@
+// quickjs-wasi's JSException shape: an Error subclass whose stack
+// accessor pair the constructor exposes by deleting V8's own `stack`.
+export class GuestError extends Error {
+  handle;
+  #stack;
+  constructor(handle) {
+    super("guest error " + handle);
+    this.handle = handle;
+    delete this.stack;
+    this.#stack = "guest stack " + handle;
+  }
+  get stack() {
+    return this.#stack;
+  }
+  set stack(v) {
+    this.#stack = v;
+  }
+}
diff --git a/tests/corpus/6237-error-subclass-delete-stack/node_modules/guest-error/package.json b/tests/corpus/6237-error-subclass-delete-stack/node_modules/guest-error/package.json
new file mode 100644
index 000000000..99f59d07b
--- /dev/null
+++ b/tests/corpus/6237-error-subclass-delete-stack/node_modules/guest-error/package.json
@@ -0,0 +1 @@
+{"name": "guest-error", "version": "1.0.0", "type": "module", "main": "index.js", "types": "index.d.ts"}
diff --git a/tests/corpus/6237-error-subclass-delete-stack/package.json b/tests/corpus/6237-error-subclass-delete-stack/package.json
new file mode 100644
index 000000000..5ffd9800b
--- /dev/null
+++ b/tests/corpus/6237-error-subclass-delete-stack/package.json
@@ -0,0 +1 @@
+{ "type": "module" }
diff --git a/tests/corpus/6260-js-var-dyn-identity.js b/tests/corpus/6260-js-var-dyn-identity.js
new file mode 100644
index 000000000..f22ce2888
--- /dev/null
+++ b/tests/corpus/6260-js-var-dyn-identity.js
@@ -0,0 +1,103 @@
+// JavaScript: a function-scoped `var` initialized with an object that
+// already exists (an element of an array built with push, a find result,
+// a member of another object) holds that object, not a copy: writes
+// through the binding are visible through the array, and `===` holds.
+function make(i) {
+  return { id: i, x: i % 17 };
+}
+
+function updateInPlace() {
+  var all = [];
+  for (var i = 0; i < 3; i++) all.push(make(i));
+  var same = 0;
+  for (var j = 0; j < all.length; j++) {
+    var o = all[j];
+    o.x += 1;
+    if (o === all[j]) same++;
+  }
+  console.log(JSON.stringify(all), same);
+}
+updateInPlace();
+
+function literalElements() {
+  var all = [];
+  for (var i = 0; i < 3; i++) all.push({ id: i, x: i });
+  for (var j = 0; j < all.length; j++) {
+    var o = all[j];
+    o.x *= 10;
+  }
+  console.log(JSON.stringify(all));
+}
+literalElements();
+
+function initializerForms(flag) {
+  var all = [];
+  all.push({ n: 0, inner: { v: 1 } });
+  all.push({ n: 1, inner: { v: 2 } });
+  var found = all.find(function (e) {
+    return e.n === 1;
+  });
+  found.n = 11;
+  var picked = flag ? all[0] : null;
+  picked.n = 10;
+  var either = all[5] || all[0];
+  either.inner.v += 100;
+  var inner = all[1].inner;
+  inner.v = 20;
+  var last = all.pop();
+  console.log(JSON.stringify(all), last === found, picked === either);
+  console.log(JSON.stringify(last));
+}
+initializerForms(true);
+
+function arraysAndClosures() {
+  var grid = [];
+  grid.push([1, 2]);
+  var row = grid[0];
+  row[0] = 9;
+  row.push(3);
+  var list = [];
+  list.push({ count: 0 });
+  var target = list[0];
+  var bump = function () {
+    target.count++;
+  };
+  bump();
+  bump();
+  console.log(JSON.stringify(grid), JSON.stringify(list), target === list[0]);
+}
+arraysAndClosures();
+
+function redeclaredAndReassigned() {
+  var all = [];
+  all.push({ x: 1 });
+  all.push({ x: 2 });
+  var o = all[0];
+  o.x = 10;
+  var o = all[1];
+  o.x = 20;
+  o = { x: 30 };
+  all.push(o);
+  o.x = 40;
+  console.log(JSON.stringify(all), o === all[2]);
+}
+redeclaredAndReassigned();
+
+const arrow = () => {
+  var all = [];
+  all.push({ x: 1 });
+  var o = all[0];
+  o.x = 5;
+  console.log(JSON.stringify(all));
+};
+arrow();
+
+// An annotated binding keeps its declared type.
+function annotated() {
+  var all = [];
+  all.push({ x: 1 });
+  /** @type {{ x: number }} */
+  var o = all[0];
+  console.log(o.x);
+}
+annotated();
diff --git a/tests/corpus/6261-js-destructure-for-of-identity.js b/tests/corpus/6261-js-destructure-for-of-identity.js
new file mode 100644
index 000000000..a8821b3b4
--- /dev/null
+++ b/tests/corpus/6261-js-destructure-for-of-identity.js
@@ -0,0 +1,46 @@
+// JavaScript: array destructuring (var, let and const) and `for (var ...
+// of ...)` bind the existing element objects of an array built with push,
+// so writes through the bindings reach the array's objects.
+function destructure() {
+  var all = [];
+  all.push({ x: 1 });
+  all.push({ x: 2 });
+  var [first] = all;
+  first.x = 10;
+  let [, second] = all;
+  second.x = 20;
+  const [again] = all;
+  again.x += 1;
+  console.log(JSON.stringify(all), first === all[0], again === first, second === all[1]);
+}
+destructure();
+
+function forVarOf() {
+  var all = [];
+  all.push({ x: 1 });
+  all.push({ x: 2 });
+  var seen = [];
+  for (var o of all) {
+    o.x *= 10;
+    seen.push(o === all[seen.length]);
+  }
+  console.log(JSON.stringify(all), seen.join());
+  for (let p of all) p.x += 1;
+  console.log(JSON.stringify(all));
+}
+forVarOf();
+
+function* tagged(list) {
+  for (var o of list) {
+    o.seen = true;
+    yield o;
+  }
+}
+function generators() {
+  var items = [];
+  items.push({ seen: false });
+  items.push({ seen: false });
+  for (var it of tagged(items)) it.extra = items.indexOf(it);
+  console.log(JSON.stringify(items));
+}
+generators();
diff --git a/tests/corpus/6262-js-file-scope-var-identity.js b/tests/corpus/6262-js-file-scope-var-identity.js
new file mode 100644
index 000000000..cb8678b5f
--- /dev/null
+++ b/tests/corpus/6262-js-file-scope-var-identity.js
@@ -0,0 +1,40 @@
+// JavaScript: file-scope `var` and `let` bindings initialized with an
+// existing object (an element of an array built with push) hold that
+// object, including bindings declared in a loop body, by destructuring or
+// by for-of, and functions declared above them read the same object.
+function show() {
+  return typeof o === "undefined" ? "unset" : o.x;
+}
+console.log(show());
+
+var all = [];
+all.push({ x: 1 });
+all.push({ x: 2 });
+
+var o = all[0];
+o.x = 10;
+console.log(show(), JSON.stringify(all), o === all[0]);
+
+var same = 0;
+for (var j = 0; j < all.length; j++) {
+  var item = all[j];
+  item.x += 5;
+  if (item === all[j]) same++;
+}
+console.log(JSON.stringify(all), same);
+
+var [head] = all;
+head.x = 100;
+for (var each of all) {
+  each.x += 1;
+  if (each === all[1]) console.log("last", each.x);
+}
+console.log(JSON.stringify(all), head === o);
+
+let current = all[1];
+current.x = 7;
+function touch() {
+  current.x++;
+}
+touch();
+console.log(JSON.stringify(all), current === all[1]);
diff --git a/tests/corpus/6263-js-factory-return-identity.cjs b/tests/corpus/6263-js-factory-return-identity.cjs
new file mode 100644
index 000000000..eb3f77557
--- /dev/null
+++ b/tests/corpus/6263-js-factory-return-identity.cjs
@@ -0,0 +1,56 @@
+// JavaScript: an object a function returns is the object the function
+// holds elsewhere (a cache entry, a registry element). Bindings that
+// receive it and array or object literals built from those bindings keep
+// that object, so writes through them reach the cache and registry.
+'use strict';
+const cache = { n: 0 };
+function get() {
+  return cache;
+}
+
+const registry = [];
+function make(name) {
+  const o = { name: name, hits: 0 };
+  registry.push(o);
+  return o;
+}
+
+function identity(v) {
+  return v;
+}
+function wrapped(i) {
+  return identity({ id: i, x: i % 17 });
+}
+
+function main() {
+  var a = get();
+  a.n = 5;
+  console.log(cache.n, a === cache);
+  var list = [a];
+  list[0].n = 6;
+  var holder = { item: a };
+  holder.item.n += 1;
+  console.log(cache.n, list[0] === cache, holder.item === cache);
+
+  var x = make("x");
+  let y = make("y");
+  const z = make("z");
+  x.hits++;
+  y.hits += 2;
+  z.hits += 3;
+  var group = [x, y, z];
+  for (var j = 0; j < group.length; j++) group[j].hits *= 10;
+  console.log(JSON.stringify(registry), group[0] === registry[0]);
+
+  var all = [];
+  for (var i = 0; i < 4; i++) all.push(wrapped(i));
+  var sum = 0;
+  for (var r = 0; r < 3; r++)
+    for (var k = 0; k < all.length; k++) {
+      var e = all[k];
+      e.x += 1;
+      sum += e.x;
+    }
+  console.log(all.length, sum, JSON.stringify(all.slice(0, 2)));
+}
+main();
diff --git a/tests/corpus/6291-webcrypto-hmac-sign-verify.ts b/tests/corpus/6291-webcrypto-hmac-sign-verify.ts
new file mode 100644
index 000000000..ddb480a4d
--- /dev/null
+++ b/tests/corpus/6291-webcrypto-hmac-sign-verify.ts
@@ -0,0 +1,94 @@
+// WebCrypto HMAC through the crypto global: importKey('raw') for SHA-1 and
+// SHA-2 keys, sign and verify (a wrong or short signature answers false),
+// the CryptoKey members, instanceof CryptoKey, the key sources importKey
+// and sign accept, and that results settle asynchronously.
+const encoder = new TextEncoder();
+const secret = encoder.encode("scriptc-webcrypto-secret");
+const data = encoder.encode("header.payload");
+
+function hex(buffer: ArrayBuffer): string {
+  return Buffer.from(buffer).toString("hex");
+}
+
+const key = await crypto.subtle.importKey(
+  "raw",
+  secret,
+  { name: "HMAC", hash: "SHA-256" },
+  false,
+  ["sign", "verify"],
+);
+console.log(key.type, key.extractable, key.usages.join(","));
+const algorithm = key.algorithm as HmacKeyAlgorithm;
+console.log(algorithm.name, algorithm.length, algorithm.hash.name);
+console.log(key instanceof CryptoKey, key.algorithm === key.algorithm, key.usages === key.usages);
+
+const signature = await crypto.subtle.sign("HMAC", key, data);
+console.log(signature.byteLength, hex(signature));
+console.log(await crypto.subtle.verify("HMAC", key, signature, data));
+console.log(await crypto.subtle.verify({ name: "HMAC" }, key, signature, encoder.encode("header.payloaD")));
+const tampered = new Uint8Array(signature);
+tampered[0] ^= 1;
+console.log(await crypto.subtle.verify("HMAC", key, tampered, data));
+console.log(await crypto.subtle.verify("HMAC", key, signature.slice(0, 16), data));
+console.log(await crypto.subtle.verify("HMAC", key, new Uint8Array(0), data));
+
+for (const hash of ["SHA-1", "SHA-384", "SHA-512"]) {
+  const k = await crypto.subtle.importKey("raw", secret, { name: "HMAC", hash }, true, ["sign"]);
+  const a = k.algorithm as HmacKeyAlgorithm;
+  const mac = await crypto.subtle.sign({ name: "hmac" }, k, data);
+  console.log(hash, a.hash.name, a.length, k.extractable, k.usages.join(","), mac.byteLength, hex(mac));
+}
+
+// Names normalize case-insensitively; usages come back in Node's order.
+const lower = await crypto.subtle.importKey(
+  "raw",
+  secret,
+  { name: "hmac", hash: { name: "sha-256" } },
+  true,
+  ["verify", "sign"],
+);
+const lowerAlgorithm = lower.algorithm as HmacKeyAlgorithm;
+console.log(lowerAlgorithm.name, lowerAlgorithm.hash.name, lower.usages.join(","));
+
+// An explicit length in bits must match the key bytes.
+const sized = await crypto.subtle.importKey(
+  "raw",
+  secret,
+  { name: "HMAC", hash: "SHA-256", length: secret.length * 8 },
+  false,
+  ["verify"],
+);
+console.log((sized.algorithm as HmacKeyAlgorithm).length, sized.usages.join(","));
+
+// Key and data sources: ArrayBuffer, Buffer, DataView and subarray views.
+const fromBuffer = await crypto.subtle.importKey(
+  "raw",
+  secret.slice().buffer,
+  { name: "HMAC", hash: "SHA-256" },
+  false,
+  ["sign"],
+);
+console.log(hex(await crypto.subtle.sign("HMAC", fromBuffer, Buffer.from("header.payload"))) === hex(signature));
+const padded = encoder.encode("xxheader.payloadyy");
+console.log(hex(await crypto.subtle.sign("HMAC", key, padded.subarray(2, 16))) === hex(signature));
+console.log(hex(await crypto.subtle.sign("HMAC", key, new DataView(data.buffer))) === hex(signature));
+
+// The data is read when sign is called.
+const mutable = encoder.encode("header.payload");
+const pending = crypto.subtle.sign("HMAC", key, mutable);
+mutable[0] = 0;
+console.log(hex(await pending) === hex(signature));
+
+// Results settle after the synchronous code that started them.
+const order: string[] = [];
+const signed = crypto.subtle.sign("HMAC", key, data).then(() => {
+  order.push("sign");
+});
+const imported = crypto.subtle
+  .importKey("raw", secret, { name: "HMAC", hash: "SHA-256" }, false, ["sign"])
+  .then(() => {
+    order.push("importKey");
+  });
+order.push("sync");
+await Promise.all([signed, imported]);
+console.log(order.join(","));
diff --git a/tests/corpus/6292-webcrypto-hmac-errors.ts b/tests/corpus/6292-webcrypto-hmac-errors.ts
new file mode 100644
index 000000000..95e33ae84
--- /dev/null
+++ b/tests/corpus/6292-webcrypto-hmac-errors.ts
@@ -0,0 +1,83 @@
+// WebCrypto HMAC failures reject with Node's TypeErrors (argument count,
+// enum values, buffer sources, CryptoKey arguments, required members) and
+// DOMExceptions (usages, key length, algorithm names, key access).
+const encoder = new TextEncoder();
+const secret = encoder.encode("scriptc-webcrypto-secret");
+const data = encoder.encode("payload");
+
+function report(label: string, error: Error): void {
+  if (error instanceof DOMException) {
+    const dom = error as DOMException;
+    console.log(label, dom.name, dom.code, dom.message, "DOMException");
+  } else {
+    const coded = error as Error & { code?: string };
+    console.log(label, coded.name, coded.code, coded.message);
+  }
+}
+
+async function attempt(label: string, run: () => Promise<unknown>): Promise<void> {
+  try {
+    await run();
+    console.log(label, "resolved");
+  } catch (e) {
+    report(label, e as Error);
+  }
+}
+
+async function attemptVerify(label: string, run: () => Promise<boolean>): Promise<void> {
+  try {
+    console.log(label, "resolved", await run());
+  } catch (e) {
+    report(label, e as Error);
+  }
+}
+
+const signOnly = await crypto.subtle.importKey("raw", secret, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+const verifyOnly = await crypto.subtle.importKey("raw", secret, { name: "HMAC", hash: "SHA-384" }, false, ["verify"]);
+
+await attempt("usage", () =>
+  crypto.subtle.importKey("raw", secret, { name: "HMAC", hash: "SHA-256" }, false, ["sign", "encrypt"]),
+);
+await attempt("empty usages", () =>
+  crypto.subtle.importKey("raw", secret, { name: "HMAC", hash: "SHA-256" }, false, []),
+);
+await attempt("zero-length key", () =>
+  crypto.subtle.importKey("raw", new Uint8Array(0), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]),
+);
+await attempt("length mismatch", () =>
+  crypto.subtle.importKey("raw", secret, { name: "HMAC", hash: "SHA-256", length: 64 }, false, ["sign"]),
+);
+await attempt("length zero", () =>
+  crypto.subtle.importKey("raw", secret, { name: "HMAC", hash: "SHA-256", length: 0 }, false, ["sign"]),
+);
+await attempt("missing hash", () =>
+  crypto.subtle.importKey("raw", secret, "HMAC", false, ["sign"]),
+);
+await attempt("md5 hash", () =>
+  crypto.subtle.importKey("raw", secret, { name: "HMAC", hash: "MD5" }, false, ["sign"]),
+);
+await attempt("unknown sha", () =>
+  crypto.subtle.importKey("raw", secret, { name: "HMAC", hash: "SHA-999" }, false, ["sign"]),
+);
+await attempt("unknown algorithm", () =>
+  crypto.subtle.importKey("raw", secret, { name: "NOPE", hash: "SHA-256" }, false, ["sign"]),
+);
+await attempt("pkcs8 format", () =>
+  crypto.subtle.importKey("pkcs8", secret, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]),
+);
+await attempt("string key", () =>
+  crypto.subtle.importKey("raw", "secret" as unknown as BufferSource, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]),
+);
+
+await attempt("sign with verify key", () => crypto.subtle.sign("HMAC", verifyOnly, data));
+await attemptVerify("verify with sign key", () => crypto.subtle.verify("HMAC", signOnly, new Uint8Array(32), data));
+await attempt("sign without key", () =>
+  crypto.subtle.sign("HMAC", secret as unknown as CryptoKey, data),
+);
+await attempt("sign unknown algorithm", () => crypto.subtle.sign("HMAC-SHA256", signOnly, data));
+await attempt("sign string data", () =>
+  crypto.subtle.sign("HMAC", signOnly, "payload" as unknown as BufferSource),
+);
+await attemptVerify("verify string signature", () =>
+  crypto.subtle.verify("HMAC", verifyOnly, "sig" as unknown as BufferSource, data),
+);
diff --git a/tests/corpus/6293-webcrypto-digest.ts b/tests/corpus/6293-webcrypto-digest.ts
new file mode 100644
index 000000000..ae107c6f0
--- /dev/null
+++ b/tests/corpus/6293-webcrypto-digest.ts
@@ -0,0 +1,35 @@
+// crypto.subtle.digest over the SHA-1 and SHA-2 hashes: string and object
+// algorithm identifiers, typed-array, Buffer and ArrayBuffer input, and
+// Node's rejections for unknown names and non-buffer data.
+const encoder = new TextEncoder();
+const input = encoder.encode("scriptc digest input");
+
+function hex(buffer: ArrayBuffer): string {
+  return Buffer.from(buffer).toString("hex");
+}
+
+for (const name of ["SHA-1", "SHA-256", "SHA-384", "SHA-512"]) {
+  const digest = await crypto.subtle.digest(name, input);
+  console.log(name, digest.byteLength, hex(digest));
+}
+console.log(hex(await crypto.subtle.digest({ name: "sha-256" }, Buffer.from("scriptc digest input"))));
+console.log(hex(await crypto.subtle.digest("SHA-256", input.slice().buffer)));
+console.log(hex(await crypto.subtle.digest("SHA-256", new Uint8Array(0))));
+
+async function attempt(label: string, run: () => Promise<unknown>): Promise<void> {
+  try {
+    await run();
+    console.log(label, "resolved");
+  } catch (e) {
+    if (e instanceof DOMException) {
+      const error = e as DOMException;
+      console.log(label, error.name, error.code, error.message, "DOMException");
+    } else {
+      const error = e as Error & { code?: string };
+      console.log(label, error.name, error.code, error.message);
+    }
+  }
+}
+
+await attempt("md5", () => crypto.subtle.digest("MD5", input));
+await attempt("string data", () => crypto.subtle.digest("SHA-256", "text" as unknown as BufferSource));
diff --git a/tests/corpus/6294-webcrypto-js-values.mjs b/tests/corpus/6294-webcrypto-js-values.mjs
new file mode 100644
index 000000000..93071b39d
--- /dev/null
+++ b/tests/corpus/6294-webcrypto-js-values.mjs
@@ -0,0 +1,52 @@
+// WebCrypto from JavaScript: keys and algorithms carried as dynamic
+// values, the CryptoKey brand checks libraries use (Symbol.toStringTag,
+// Object.prototype.toString and instanceof), JSON.stringify of a key, and
+// rejections for missing arguments and non-key values.
+const encoder = new TextEncoder();
+const secret = encoder.encode("dynamic-secret");
+const table = {
+  HS256: { name: "HMAC", hash: "SHA-256" },
+  HS512: { name: "HMAC", hash: "SHA-512" },
+};
+
+async function importFor(alg, usage) {
+  const params = table[alg];
+  return crypto.subtle.importKey("raw", secret, params, false, [usage]);
+}
+
+const key = await importFor("HS256", "sign");
+console.log(key[Symbol.toStringTag], Object.prototype.toString.call(key), String(key));
+console.log(key instanceof CryptoKey, secret instanceof CryptoKey, {} instanceof CryptoKey);
+console.log(JSON.stringify(key), typeof key, key.type, key.algorithm.hash.name, key.usages.includes("sign"));
+const sig = new Uint8Array(await crypto.subtle.sign(table.HS256, key, encoder.encode("a.b")));
+console.log(sig.length, Buffer.from(sig).toString("base64url"));
+const verifier = await importFor("HS256", "verify");
+let verified = false;
+try {
+  verified = await crypto.subtle.verify(table.HS256, verifier, sig, encoder.encode("a.b"));
+} catch {}
+console.log(verified);
+const other = await importFor("HS512", "verify");
+console.log(await crypto.subtle.verify(table.HS512, other, sig, encoder.encode("a.b")));
+
+async function attempt(label, run) {
+  try {
+    await run();
+    console.log(label, "resolved");
+  } catch (e) {
+    console.log(label, e.name, e.code, e.message);
+  }
+}
+await attempt("too few", () => crypto.subtle.sign("HMAC", key));
+await attempt("import too few", () => crypto.subtle.importKey("raw", secret, table.HS256, false));
+await attempt("verify too few", () => crypto.subtle.verify("HMAC", key, sig));
+await attempt("digest too few", () => crypto.subtle.digest("SHA-256"));
+const lookalike = JSON.parse('{"type":"secret","usages":["sign"]}');
+await attempt("not a key", () => crypto.subtle.sign("HMAC", lookalike, secret));
+await attempt("bad format", () => crypto.subtle.importKey("nope", secret, table.HS256, false, ["sign"]));
+await attempt("bad usage", () => crypto.subtle.importKey("raw", secret, table.HS256, false, ["bogus"]));
+await attempt("usages not a sequence", () => crypto.subtle.importKey("raw", secret, table.HS256, false, "sign"));
+await attempt("algorithm without name", () => crypto.subtle.sign({ hash: "SHA-256" }, key, secret));
+await attempt("hash object without name", () =>
+  crypto.subtle.importKey("raw", secret, { name: "HMAC", hash: {} }, false, ["sign"]),
+);
diff --git a/tests/corpus/6295-jose-hs256/main.mjs b/tests/corpus/6295-jose-hs256/main.mjs
new file mode 100644
index 000000000..a8a669a57
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/main.mjs
@@ -0,0 +1,103 @@
+// The real jose@6.2.12 HS256 path: SignJWT and jwtVerify from jose's
+// public jose/jwt/sign, jose/jwt/verify and jose/errors entry points, over
+// crypto.subtle importKey, sign and verify. node_modules/jose vendors the
+// dist/webapi files those entry points load and their declarations,
+// unmodified (MIT, LICENSE.md), with a package.json that exports only
+// those entry points.
+import { SignJWT } from "jose/jwt/sign";
+import { jwtVerify } from "jose/jwt/verify";
+import * as errors from "jose/errors";
+
+const encoder = new TextEncoder();
+const secret = encoder.encode("scriptc-jose-hs256-shared-secret");
+const now = new Date(1_800_000_000_000);
+const iat = 1_799_999_000;
+
+async function sign(claims, alg = "HS256", key = secret) {
+  const jwt = new SignJWT(claims);
+  jwt.setProtectedHeader({ alg, typ: "JWT" });
+  jwt.setIssuedAt(iat);
+  jwt.setIssuer("urn:scriptc:issuer");
+  jwt.setAudience("urn:scriptc:audience");
+  jwt.setSubject("alice");
+  return jwt.sign(key);
+}
+
+async function verify(label, token, options = {}, key = secret) {
+  try {
+    const { payload, protectedHeader } = await jwtVerify(token, key, {
+      algorithms: ["HS256"],
+      currentDate: now,
+      ...options,
+    });
+    console.log(label, "ok", JSON.stringify(protectedHeader), JSON.stringify(payload));
+  } catch (e) {
+    console.log(label, e.code, e.message, e instanceof errors.JOSEError, e.name, e.claim, e.reason);
+  }
+}
+
+const token = await sign({ role: "admin", exp: iat + 3600 });
+console.log(token);
+await verify("valid", token, { issuer: "urn:scriptc:issuer", audience: "urn:scriptc:audience" });
+await verify("bytes token", encoder.encode(token));
+await verify("wrong secret", token, {}, encoder.encode("another-secret"));
+const [header, body, signature] = token.split(".");
+const forged = Buffer.from(JSON.stringify({ role: "root", sub: "mallory" })).toString("base64url");
+await verify("tampered payload", `${header}.${forged}.${signature}`);
+await verify("tampered signature", `${header}.${body}.${signature.slice(0, -2)}AA`);
+await verify("malformed", "not-a-jwt");
+await verify("bad signature encoding", `${header}.${body}.***`);
+await verify("expired", token, { currentDate: new Date((iat + 7200) * 1000) });
+await verify("clock tolerance", token, { currentDate: new Date((iat + 3610) * 1000), clockTolerance: 30 });
+await verify("not yet valid", await sign({ nbf: iat + 600 }));
+await verify("issuer", token, { issuer: "urn:other" });
+await verify("audience", token, { audience: "urn:other" });
+await verify("required claim", token, { requiredClaims: ["jti"] });
+await verify("alg not allowed", token, { algorithms: ["HS512"] });
+await verify("max token age", token, { maxTokenAge: 600 });
+
+const hs384 = await sign({ scope: "read" }, "HS384");
+await verify("hs384", hs384, { algorithms: ["HS384"] });
+const hs512 = await sign({ scope: "write" }, "HS512");
+await verify("hs512", hs512, { algorithms: ["HS256", "HS512"] });
+await verify("hs512 as hs256 only", hs512);
+await verify("none", `${Buffer.from('{"alg":"none"}').toString("base64url")}.${body}.`, { algorithms: ["none"] });
+
+// The same key imported once and reused as a CryptoKey.
+const cryptoKey = await crypto.subtle.importKey("raw", secret, { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
+await verify("crypto key", token, {}, cryptoKey);
+const signingKey = await crypto.subtle.importKey("raw", secret, { name: "HMAC", hash: "SHA-512" }, false, ["sign"]);
+await verify("wrong key hash", token, {}, signingKey);
+
+// Chained builder calls: jose's declarations type every setter's result as
+// `this`, implemented by the JWTClaimsBuilder base SignJWT extends.
+const chained = await new SignJWT({ role: "reader" })
+  .setProtectedHeader({ alg: "HS256", typ: "JWT" })
+  .setIssuedAt(iat)
+  .setIssuer("urn:scriptc:issuer")
+  .setAudience(["urn:scriptc:audience", "urn:other"])
+  .setSubject("bob")
+  .setJti("jti-2")
+  .setNotBefore(iat - 60)
+  .setExpirationTime(iat + 60)
+  .sign(secret);
+console.log(chained);
+await verify("chained", chained, { audience: "urn:scriptc:audience" });
+
+// String durations: jose's secs() parses them.
+for (const maxTokenAge of ["10 minutes", "1 hour", "1.5h", "2 days", "+20m", "1 week", "1y", "900 secs", "3 HOURS", "2h ago", "-2h ago", "10 fortnights", ""]) {
+  await verify(`max token age ${JSON.stringify(maxTokenAge)}`, token, { maxTokenAge });
+}
+for (const clockTolerance of ["30s", "5 sec", "1 min from now", "1 min ago"]) {
+  await verify(`clock tolerance ${clockTolerance}`, token, { currentDate: new Date((iat + 3620) * 1000), clockTolerance });
+}
+const relative = new SignJWT({ role: "reader" });
+relative.setProtectedHeader({ alg: "HS256" }).setIssuedAt("-1 minute").setExpirationTime("2h");
+const claims = JSON.parse(Buffer.from((await relative.sign(secret)).split(".")[1], "base64url").toString());
+const clock = Math.floor(Date.now() / 1000);
+console.log(Math.abs(claims.exp - clock - 7200) <= 2, Math.abs(claims.iat - clock + 60) <= 2);
+try {
+  new SignJWT({}).setExpirationTime("soon");
+} catch (e) {
+  console.log(e.name, e.message);
+}
diff --git a/tests/corpus/6295-jose-hs256/node_modules/jose/LICENSE.md b/tests/corpus/6295-jose-hs256/node_modules/jose/LICENSE.md
new file mode 100644
index 000000000..d0ec038a8
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/node_modules/jose/LICENSE.md
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2018 Filip Skokan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/tests/corpus/6295-jose-hs256/node_modules/jose/dist/types/jwt/sign.d.ts b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/types/jwt/sign.d.ts
new file mode 100644
index 000000000..67ce10434
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/types/jwt/sign.d.ts
@@ -0,0 +1,21 @@
+import type * as t from '../types.d.ts';
+/** @param payload Initial JWT Claims Set. Defaults to an empty object. */
+declare const SignJWT_base: new (payload?: t.JWTPayload) => t.ProduceJWT;
+/** Builds and signs Compact JWS-formatted JSON Web Tokens. */
+export declare class SignJWT extends SignJWT_base {
+    #private;
+    /**
+     * Sets the JWS Protected Header. May only be called once.
+     *
+     * @param protectedHeader JWS Protected Header. Must contain an "alg" (JWS Algorithm) property.
+     */
+    setProtectedHeader(protectedHeader: t.JWTHeaderParameters): this;
+    /**
+     * Signs and returns the JWT.
+     *
+     * @param key Private key or shared secret to sign the JWT with. See
+     *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+     */
+    sign(key: t.KeyInput, options?: t.SignOptions): Promise<string>;
+}
+export {};
diff --git a/tests/corpus/6295-jose-hs256/node_modules/jose/dist/types/jwt/verify.d.ts b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/types/jwt/verify.d.ts
new file mode 100644
index 000000000..6c8b2f32b
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/types/jwt/verify.d.ts
@@ -0,0 +1,35 @@
+import type * as t from '../types.d.ts';
+/** JWS verification and JWT Claims Set validation options. */
+export interface JWTVerifyOptions extends t.VerifyOptions, t.JWTClaimVerificationOptions {
+}
+/**
+ * Resolves a JWT verification key. No token components have been authenticated when this function
+ * is called.
+ */
+export interface JWTVerifyGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.CompactJWSHeaderParameters, t.FlattenedJWSInput, KeyType | t.KeyObject | t.JWK> {
+}
+/**
+ * Verifies a Compact JWS-formatted JWT and validates its Claims Set.
+ *
+ * @param key Public key or shared secret to verify the JWT with. See
+ *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param options JWT Verification and JWT Claims Set validation options.
+ */
+export declare function jwtVerify<PayloadType = t.JWTPayload>(jwt: string | Uint8Array, key: t.KeyInput, options?: JWTVerifyOptions): Promise<t.JWTVerifyResult<PayloadType>>;
+/**
+ * Verifies the JWT signature and claims, returning the resolved key.
+ *
+ * @param getKey Function resolving a public key or shared secret to verify the JWT with. See
+ *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param options JWT Verification and JWT Claims Set validation options.
+ */
+export declare function jwtVerify<PayloadType = t.JWTPayload, KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwt: string | Uint8Array, getKey: JWTVerifyGetKey<KeyType>, options?: JWTVerifyOptions): Promise<t.JWTVerifyResult<PayloadType> & t.ResolvedKey<KeyType>>;
+/**
+ * Accepts a key or key resolver. Use this overload when forwarding either form; the result includes
+ * `key` only when a resolver was used.
+ *
+ * @param key Key, or function resolving a key, to verify the JWT with. See
+ *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param options JWT Verification and JWT Claims Set validation options.
+ */
+export declare function jwtVerify<PayloadType = t.JWTPayload>(jwt: string | Uint8Array, key: t.KeyInput | JWTVerifyGetKey, options?: JWTVerifyOptions): Promise<t.JWTVerifyResult<PayloadType> & Partial<t.ResolvedKey>>;
diff --git a/tests/corpus/6295-jose-hs256/node_modules/jose/dist/types/types.d.ts b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/types/types.d.ts
new file mode 100644
index 000000000..9815c018d
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/types/types.d.ts
@@ -0,0 +1,736 @@
+/** Supported JWS "alg" (Algorithm) Header Parameter values. Availability depends on the runtime. */
+export type JWSAlgorithm =
+  | 'HS256'
+  | 'HS384'
+  | 'HS512'
+  | 'RS256'
+  | 'RS384'
+  | 'RS512'
+  | 'PS256'
+  | 'PS384'
+  | 'PS512'
+  | 'ES256'
+  | 'ES384'
+  | 'ES512'
+  | 'EdDSA'
+  | 'Ed25519'
+  | 'ML-DSA-44'
+  | 'ML-DSA-65'
+  | 'ML-DSA-87'
+  | (string & {})
+
+/** Supported JWE "alg" (Algorithm) Header Parameter values. Availability depends on the runtime. */
+export type JWEKeyManagementAlgorithm =
+  | 'dir'
+  | 'A128KW'
+  | 'A192KW'
+  | 'A256KW'
+  | 'A128GCMKW'
+  | 'A192GCMKW'
+  | 'A256GCMKW'
+  | 'ECDH-ES'
+  | 'ECDH-ES+A128KW'
+  | 'ECDH-ES+A192KW'
+  | 'ECDH-ES+A256KW'
+  | 'RSA-OAEP'
+  | 'RSA-OAEP-256'
+  | 'RSA-OAEP-384'
+  | 'RSA-OAEP-512'
+  | 'PBES2-HS256+A128KW'
+  | 'PBES2-HS384+A192KW'
+  | 'PBES2-HS512+A256KW'
+  | (string & {})
+
+/**
+ * Supported JWE "enc" (Encryption Algorithm) Header Parameter values. Availability depends on the
+ * runtime.
+ */
+export type JWEContentEncryptionAlgorithm =
+  | 'A128CBC-HS256'
+  | 'A192CBC-HS384'
+  | 'A256CBC-HS512'
+  | 'A128GCM'
+  | 'A192GCM'
+  | 'A256GCM'
+  | (string & {})
+
+/** JWK "kty" (Key Type) Parameter values supported by this module. */
+export type JWKKeyType = 'EC' | 'RSA' | 'OKP' | 'AKP' | 'oct' | (string & {})
+
+/**
+ * Generic JSON Web Key Parameters.
+ *
+ * > Note: This is declared as a type alias rather than an interface so that it satisfies the implicit index
+ * > signature of the `JsonWebKey` types shipped by `@types/node` and `lib.dom`.
+ */
+export type JWKParameters = {
+  /** JWK "kty" (Key Type) Parameter */
+  kty?: JWKKeyType
+  /** JWK "alg" (Algorithm) Parameter */
+  alg?: JWSAlgorithm | JWEKeyManagementAlgorithm | JWEContentEncryptionAlgorithm
+  /** Permitted key operations. */
+  key_ops?: string[]
+  /** Whether the key may be exported. */
+  ext?: boolean
+
+  /** JWK "use" (Public Key Use) Parameter */
+  use?: 'sig' | 'enc' | (string & {})
+  /** X.509 certificate chain. */
+  x5c?: string[]
+  /** X.509 certificate SHA-1 thumbprint. */
+  x5t?: string
+  /** X.509 certificate SHA-256 thumbprint. */
+  'x5t#S256'?: string
+  /** X.509 certificate URL. */
+  x5u?: string
+
+  /** JWK "kid" (Key ID) Parameter */
+  kid?: string
+}
+
+/** Convenience interface for public OKP JSON Web Keys. */
+export interface JWK_OKP_Public extends JWKParameters {
+  /** Key pair subtype. */
+  crv: string
+  /** Public key. */
+  x: string
+}
+
+/** Convenience interface for private OKP JSON Web Keys. */
+export interface JWK_OKP_Private extends JWK_OKP_Public {
+  /** Private key. */
+  d: string
+}
+
+/** Convenience interface for public AKP JSON Web Keys. */
+export interface JWK_AKP_Public extends JWKParameters {
+  /** JWK "alg" (Algorithm) Parameter */
+  alg: string
+
+  /** AKP JWK "pub" (The Public key) Parameter */
+  pub: string
+}
+
+/** Convenience interface for private AKP JSON Web Keys. */
+export interface JWK_AKP_Private extends JWK_AKP_Public {
+  /** AKP JWK "priv" (The Private Key) Parameter */
+  priv: string
+}
+
+/** Convenience interface for public EC JSON Web Keys. */
+export interface JWK_EC_Public extends JWKParameters {
+  /** Curve. */
+  crv: string
+  /** Public key X coordinate. */
+  x: string
+  /** Public key Y coordinate. */
+  y: string
+}
+
+/** Convenience interface for private EC JSON Web Keys. */
+export interface JWK_EC_Private extends JWK_EC_Public {
+  /** Private key. */
+  d: string
+}
+
+/** Convenience interface for public RSA JSON Web Keys. */
+export interface JWK_RSA_Public extends JWKParameters {
+  /** Public exponent. */
+  e: string
+  /** Modulus. */
+  n: string
+}
+
+/** Convenience interface for private RSA JSON Web Keys. */
+export interface JWK_RSA_Private extends JWK_RSA_Public {
+  /** Private exponent. */
+  d: string
+  /** First factor CRT exponent. */
+  dp: string
+  /** Second factor CRT exponent. */
+  dq: string
+  /** First prime factor. */
+  p: string
+  /** Second prime factor. */
+  q: string
+  /** First CRT coefficient. */
+  qi: string
+}
+
+/** Convenience interface for "oct" JSON Web Keys. */
+export interface JWK_oct extends JWKParameters {
+  /** Symmetric key value. */
+  k: string
+}
+
+/**
+ * JSON Web Key ({@link https://www.rfc-editor.org/info/rfc7517/ JWK}). "RSA", "EC", "OKP", "AKP",
+ * and "oct" key types are supported.
+ *
+ * > Note: This is declared as a type alias rather than an interface so that it satisfies the implicit index
+ * > signature of the `JsonWebKey` types shipped by `@types/node` and `lib.dom`. It spells out the
+ * > {@link JWKParameters} members rather than intersecting them so that every JWK member is documented
+ * > in one place.
+ */
+export type JWK = {
+  /** JWK "kty" (Key Type) Parameter */
+  kty?: JWKKeyType
+  /** JWK "alg" (Algorithm) Parameter */
+  alg?: JWSAlgorithm | JWEKeyManagementAlgorithm | JWEContentEncryptionAlgorithm
+  /** Permitted key operations. */
+  key_ops?: string[]
+  /** Whether the key may be exported. */
+  ext?: boolean
+
+  /** JWK "use" (Public Key Use) Parameter */
+  use?: 'sig' | 'enc' | (string & {})
+  /** X.509 certificate chain. */
+  x5c?: string[]
+  /** X.509 certificate SHA-1 thumbprint. */
+  x5t?: string
+  /** X.509 certificate SHA-256 thumbprint. */
+  'x5t#S256'?: string
+  /** X.509 certificate URL. */
+  x5u?: string
+
+  /** JWK "kid" (Key ID) Parameter */
+  kid?: string
+  /** EC curve or OKP key pair subtype. */
+  crv?: string
+  /** Private RSA exponent, EC key, or OKP key. */
+  d?: string
+  /** RSA first factor CRT exponent. */
+  dp?: string
+  /** RSA second factor CRT exponent. */
+  dq?: string
+  /** RSA public exponent. */
+  e?: string
+  /** Symmetric key value. */
+  k?: string
+  /** RSA modulus. */
+  n?: string
+  /** RSA first prime factor. */
+  p?: string
+  /** RSA second prime factor. */
+  q?: string
+  /** RSA first CRT coefficient. */
+  qi?: string
+  /** EC public key X coordinate or OKP public key. */
+  x?: string
+  /** EC public key Y coordinate. */
+  y?: string
+
+  /** AKP JWK "pub" (Public Key) Parameter */
+  pub?: string
+
+  /** AKP JWK "priv" (Private key) Parameter */
+  priv?: string
+  /** Additional RSA prime factors. */
+  oth?: Array<{
+    /** Factor CRT exponent. */
+    d?: string
+    /** Prime factor. */
+    r?: string
+    /** Factor CRT coefficient. */
+    t?: string
+  }>
+}
+
+/** Discriminated union of supported JSON Web Key shapes, narrowed by the "kty" (Key Type) Parameter. */
+// Intersect "kty" into each member separately: typedoc omits the parentheses in `X & (A | B)`.
+export type AnyJWK =
+  | (JWK_EC_Private & { kty: 'EC' })
+  | (JWK_EC_Public & { kty: 'EC' })
+  | (JWK_RSA_Private & { kty: 'RSA' })
+  | (JWK_RSA_Public & { kty: 'RSA' })
+  | (JWK_OKP_Private & { kty: 'OKP' })
+  | (JWK_OKP_Public & { kty: 'OKP' })
+  | (JWK_AKP_Private & { kty: 'AKP' })
+  | (JWK_AKP_Public & { kty: 'AKP' })
+  | (JWK_oct & { kty: 'oct' })
+
+/** Key or secret input accepted by all sign, verify, encrypt, and decrypt operations. */
+export type KeyInput = CryptoKey | KeyObject | JWK | Uint8Array
+
+/** Dynamic key resolver for consuming operations. */
+export interface GetKeyFunction<IProtectedHeader, IToken, KeyTypes extends KeyInput = KeyInput> {
+  /**
+   * Resolves a key for an unverified token. Throw if no suitable key can be resolved.
+   *
+   * @param token The consumed JWE or JWS token; none of its components have been verified.
+   */
+  (protectedHeader: IProtectedHeader, token: IToken): Promise<KeyTypes> | KeyTypes
+}
+
+/** Flattened JWS verification input. */
+export interface FlattenedJWSInput {
+  /** JWS Unprotected Header as a JSON object. Not integrity protected; omit when empty. */
+  header?: JWSHeaderParameters
+
+  /** Base64url-encoded payload; with `b64: false`, supply an unencoded string or Uint8Array. */
+  payload: string | Uint8Array
+
+  /** Base64url-encoded UTF-8 JWS Protected Header. Integrity protected; omit when empty. */
+  protected?: string
+
+  /** Base64url-encoded signature or MAC. */
+  signature: string
+}
+
+/** General JWS verification input. */
+export interface GeneralJWSInput {
+  /** Base64url-encoded payload; with `b64: false`, supply an unencoded string or Uint8Array. */
+  payload: string | Uint8Array
+
+  /**
+   * The "signatures" member value MUST be an array of JSON objects. Each object represents a
+   * signature or MAC over the JWS Payload and the JWS Protected Header.
+   */
+  signatures: Omit<FlattenedJWSInput, 'payload'>[]
+}
+
+/**
+ * Flattened JWS JSON Serialization token. The payload is an empty string when the
+ * {@link https://www.rfc-editor.org/info/rfc7797/ unencoded payload option} is used.
+ */
+export interface FlattenedJWS extends Partial<FlattenedJWSInput> {
+  payload: string
+  signature: string
+}
+
+/**
+ * General JWS JSON Serialization token. The payload is an empty string when the
+ * {@link https://www.rfc-editor.org/info/rfc7797/ unencoded payload option} is used.
+ */
+export interface GeneralJWS {
+  payload: string
+  signatures: Omit<FlattenedJWSInput, 'payload'>[]
+}
+
+/** Header Parameters common to JWE and JWS. */
+export interface JoseHeaderParameters {
+  /** "kid" (Key ID) Header Parameter */
+  kid?: string
+
+  /** X.509 certificate SHA-1 thumbprint. */
+  x5t?: string
+
+  /** X.509 certificate chain. */
+  x5c?: string[]
+
+  /** X.509 certificate URL. */
+  x5u?: string
+
+  /** JWK Set URL. */
+  jku?: string
+
+  /** Public JWK only; private and symmetric key parameters are not permitted. */
+  jwk?: Omit<JWK, 'd' | 'dp' | 'dq' | 'k' | 'p' | 'q' | 'qi' | 'priv' | 'oth'>
+
+  /** "typ" (Type) Header Parameter */
+  typ?: string
+
+  /** Content type. */
+  cty?: string
+}
+
+/** Recognized JWS Header Parameters; additional members may also be present. */
+export interface JWSHeaderParameters extends JoseHeaderParameters {
+  /** JWS "alg" (Algorithm) Header Parameter */
+  alg?: JWSAlgorithm
+
+  /**
+   * Controls payload encoding and the JWS signing input as defined by
+   * {@link https://www.rfc-editor.org/info/rfc7797/ RFC7797}. Set to `false` and list `b64` in
+   * `crit` to use an unencoded payload.
+   */
+  b64?: boolean
+
+  /** Extension parameters that must be recognized. */
+  crit?: string[]
+
+  /** Any other JWS Header member. */
+  [propName: string]: unknown
+}
+
+/** Recognized JWE Key Management-related Header Parameters. */
+export interface JWEKeyManagementHeaderParameters {
+  /** ECDH-ES Agreement PartyUInfo bytes, used in ConcatKDF and added to the JOSE header. */
+  apu?: Uint8Array
+
+  /** ECDH-ES Agreement PartyVInfo bytes, used in ConcatKDF and added to the JOSE header. */
+  apv?: Uint8Array
+
+  /** PBES2 PBKDF2 iteration count, added to the JOSE header. */
+  p2c?: number
+
+  /** @deprecated For testing and vector validation only. */
+  p2s?: Uint8Array
+  /** @deprecated For testing and vector validation only. */
+  iv?: Uint8Array
+  /** @deprecated For testing and vector validation only. */
+  epk?: CryptoKey | KeyObject
+}
+
+/** Flattened JWE JSON Serialization token. */
+export interface FlattenedJWE {
+  /**
+   * Base64url-encoded additional authenticated data; integrity protected but not encrypted. Omit
+   * when empty.
+   */
+  aad?: string
+
+  /** Base64url-encoded ciphertext. */
+  ciphertext: string
+
+  /** Base64url-encoded encrypted key. Omit when empty. */
+  encrypted_key?: string
+
+  /**
+   * JWE Per-Recipient Unprotected Header as a JSON object. Not integrity protected; omit when
+   * empty.
+   */
+  header?: JWEHeaderParameters
+
+  /** Base64url-encoded initialization vector. Omit when empty. */
+  iv?: string
+
+  /** Base64url-encoded UTF-8 JWE Protected Header. Integrity protected; omit when empty. */
+  protected?: string
+
+  /** Base64url-encoded authentication tag. Omit when empty. */
+  tag?: string
+
+  /** JWE Shared Unprotected Header as a JSON object. Not integrity protected; omit when empty. */
+  unprotected?: JWEHeaderParameters
+}
+
+/** General JWE JSON Serialization token. */
+export interface GeneralJWE extends Omit<FlattenedJWE, 'encrypted_key' | 'header'> {
+  recipients: Pick<FlattenedJWE, 'encrypted_key' | 'header'>[]
+}
+
+/** Recognized JWE Header Parameters; additional members may also be present. */
+export interface JWEHeaderParameters extends JoseHeaderParameters {
+  /** JWE "alg" (Algorithm) Header Parameter */
+  alg?: JWEKeyManagementAlgorithm
+
+  /** JWE "enc" (Encryption Algorithm) Header Parameter */
+  enc?: JWEContentEncryptionAlgorithm
+
+  /** Extension parameters that must be recognized. */
+  crit?: string[]
+
+  /**
+   * JWE compression algorithm. Only `"DEF"` (DEFLATE) is supported, requiring the runtime's
+   * `CompressionStream` / `DecompressionStream` APIs.
+   */
+  zip?: 'DEF' | (string & {})
+
+  /** Any other JWE Header member. */
+  [propName: string]: unknown
+}
+
+/** Shared "crit" option for signing, verification, encryption, and decryption. */
+export interface CritOption {
+  /**
+   * Recognized "crit" (Critical) Header Parameter names. Set each value to `true` to require
+   * integrity protection, or `false` when protection is optional. The JWS `b64` extension is always
+   * recognized and processed.
+   *
+   * > Warning: Other extensions are only checked for syntax and optional integrity protection. Their presence
+   * > is not required by this option. You must check their presence and process them according to the
+   * > profile's validation steps after the operation succeeds.
+   */
+  crit?: {
+    [propName: string]: boolean
+  }
+}
+
+/** JWE Decryption options. */
+export interface DecryptOptions extends CritOption {
+  /**
+   * Accepted JWE "alg" (Algorithm) Header Parameter values. Defaults to all algorithms applicable
+   * to the key or secret except PBES2, which must be explicitly allowed.
+   */
+  keyManagementAlgorithms?: JWEKeyManagementAlgorithm[]
+
+  /**
+   * Accepted JWE "enc" (Encryption Algorithm) Header Parameter values. Defaults to all algorithms
+   * applicable to the key or secret.
+   */
+  contentEncryptionAlgorithms?: JWEContentEncryptionAlgorithm[]
+
+  /**
+   * Maximum "p2c" (PBES2 Count) Header Parameter value, limiting PBKDF2 iterations and their
+   * computational expense. Defaults to 10000; must be a positive safe integer or `Infinity` to
+   * disable the limit.
+   */
+  maxPBES2Count?: number
+
+  /**
+   * Maximum decompressed plaintext size in bytes. Defaults to 250000; `0` rejects compressed JWEs,
+   * and `Infinity` disables the limit. Other values must be positive safe integers.
+   */
+  maxDecompressedLength?: number
+}
+
+/** JWE Encryption options. */
+export interface EncryptOptions extends CritOption {}
+
+/** JWT Claims Set verification options. */
+export interface JWTClaimVerificationOptions {
+  /** Expected JWT "aud" (Audience) Claim value(s). Requires the claim to be present. */
+  audience?: string | string[]
+
+  /**
+   * Clock skew tolerance in seconds or a duration string (e.g. "5 seconds"). Applies to the "nbf"
+   * (Not Before) and "exp" (Expiration Time) claims, and to "iat" (Issued At) when
+   * {@link maxTokenAge} is set.
+   */
+  clockTolerance?: string | number
+
+  /** Expected JWT "iss" (Issuer) Claim value(s). Requires the claim to be present. */
+  issuer?: string | string[]
+
+  /**
+   * Maximum time since the JWT "iat" (Issued At) Claim, in seconds or a duration string (e.g. "2
+   * hours"). Requires the claim to be present.
+   */
+  maxTokenAge?: string | number
+
+  /** Expected JWT "sub" (Subject) Claim value. Requires the claim to be present. */
+  subject?: string
+
+  /** Expected JWT "typ" (Type) Header Parameter value. Requires the parameter to be present. */
+  typ?: string
+
+  /** Date for NumericDate comparisons. Defaults to `new Date()`. */
+  currentDate?: Date
+
+  /**
+   * Additional claim names required in the JWT Claims Set. The {@link issuer}, {@link audience},
+   * {@link subject}, and {@link maxTokenAge} options independently require "iss", "aud", "sub", and
+   * "iat", respectively.
+   */
+  requiredClaims?: string[]
+}
+
+/** JWS Verification options. */
+export interface VerifyOptions extends CritOption {
+  /**
+   * Accepted JWS "alg" (Algorithm) Header Parameter values. Defaults to all algorithms applicable
+   * to the key or secret. Unsecured JWTs (`alg: "none"`) are never accepted.
+   */
+  algorithms?: JWSAlgorithm[]
+}
+
+/** JWS Signing options. */
+export interface SignOptions extends CritOption {}
+
+/** Recognized JWT Claims Set members; additional members may also be present. */
+export interface JWTPayload {
+  /** JWT Issuer */
+  iss?: string
+
+  /** JWT Subject */
+  sub?: string
+
+  /** JWT Audience */
+  aud?: string | string[]
+
+  /** JWT ID */
+  jti?: string
+
+  /** Not valid before this Unix timestamp in seconds. */
+  nbf?: number
+
+  /** Expiration Unix timestamp in seconds. */
+  exp?: number
+
+  /** Issued-at Unix timestamp in seconds. */
+  iat?: number
+
+  /** Any other JWT Claim Set member. */
+  [propName: string]: unknown
+}
+
+/** Flattened JWE JSON Serialization decryption result. */
+export interface FlattenedDecryptResult {
+  /** JWE Additional Authenticated Data, integrity protected but not encrypted. */
+  additionalAuthenticatedData?: Uint8Array
+
+  /** Plaintext. */
+  plaintext: Uint8Array
+
+  /** JWE Protected Header. */
+  protectedHeader?: JWEHeaderParameters
+
+  /** JWE Shared Unprotected Header. Not integrity protected. */
+  sharedUnprotectedHeader?: JWEHeaderParameters
+
+  /** JWE Per-Recipient Unprotected Header. Not integrity protected. */
+  unprotectedHeader?: JWEHeaderParameters
+}
+
+/** General JWE JSON Serialization decryption result. */
+export interface GeneralDecryptResult extends FlattenedDecryptResult {}
+
+/** Compact JWE decryption result. */
+export interface CompactDecryptResult {
+  /** Plaintext. */
+  plaintext: Uint8Array
+
+  /** JWE Protected Header. */
+  protectedHeader: CompactJWEHeaderParameters
+}
+
+/** Flattened JWS JSON Serialization verification result. */
+export interface FlattenedVerifyResult {
+  /** JWS Payload. */
+  payload: Uint8Array
+
+  /** JWS Protected Header. */
+  protectedHeader?: JWSHeaderParameters
+
+  /** JWS Unprotected Header. Not integrity protected. */
+  unprotectedHeader?: JWSHeaderParameters
+}
+
+/** General JWS JSON Serialization verification result. */
+export interface GeneralVerifyResult extends FlattenedVerifyResult {}
+
+/** Compact JWS verification result. */
+export interface CompactVerifyResult {
+  /** JWS Payload. */
+  payload: Uint8Array
+
+  /** JWS Protected Header. */
+  protectedHeader: CompactJWSHeaderParameters
+}
+
+/** Signed JSON Web Token (JWT) verification result. */
+export interface JWTVerifyResult<PayloadType = JWTPayload> {
+  /** JWT Claims Set. */
+  payload: PayloadType &
+    JWTPayload &
+    ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never)
+
+  /** JWS Protected Header. */
+  protectedHeader: JWTHeaderParameters
+}
+
+/** Encrypted JSON Web Token (JWT) decryption result. */
+export interface JWTDecryptResult<PayloadType = JWTPayload> {
+  /** JWT Claims Set. */
+  payload: PayloadType &
+    JWTPayload &
+    ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never)
+
+  /** JWE Protected Header. */
+  protectedHeader: CompactJWEHeaderParameters
+}
+
+/** Key resolver result metadata. */
+export interface ResolvedKey<KeyType extends CryptoKey | Uint8Array = CryptoKey | Uint8Array> {
+  /** The resolved key, present only when a key resolver is used. */
+  key: KeyType
+}
+
+/** Recognized Compact JWS Header Parameters; additional members may also be present. */
+export interface CompactJWSHeaderParameters extends JWSHeaderParameters {
+  alg: JWSAlgorithm
+}
+
+/** Recognized signed JWT Header Parameters; additional members may also be present. */
+export interface JWTHeaderParameters extends CompactJWSHeaderParameters {
+  b64?: boolean
+}
+
+/** Recognized Compact JWE Header Parameters; additional members may also be present. */
+export interface CompactJWEHeaderParameters extends JWEHeaderParameters {
+  alg: JWEKeyManagementAlgorithm
+  enc: JWEContentEncryptionAlgorithm
+}
+
+/** JSON Web Key Set. */
+export interface JSONWebKeySet {
+  keys: JWK[]
+}
+
+/** Node.js {@link !KeyObject} representation accepted as key input. */
+export interface KeyObject {
+  type: string
+}
+
+/** The runtime's Web Crypto {@link !CryptoKey} representation accepted as key input. */
+export type CryptoKey = typeof globalThis extends {
+  crypto: { subtle: { generateKey(...args: any[]): Promise<infer R> } }
+}
+  ? Extract<R, { type: string }>
+  : CryptoKeyStructuralFallback
+
+/** Structural fallback used when the host {@link !CryptoKey} type cannot be inferred. */
+export interface CryptoKeyStructuralFallback {
+  readonly algorithm: { name: string }
+  readonly extractable: boolean
+  readonly type: string
+  readonly usages: string[]
+}
+
+/** Shared fluent API for JWT-producing classes. */
+export interface ProduceJWT {
+  /**
+   * Set the "iss" (Issuer) Claim.
+   *
+   * @param issuer "Issuer" Claim value to set on the JWT Claims Set.
+   */
+  setIssuer(issuer: string): this
+
+  /**
+   * Set the "sub" (Subject) Claim.
+   *
+   * @param subject "sub" (Subject) Claim value to set on the JWT Claims Set.
+   */
+  setSubject(subject: string): this
+
+  /**
+   * Set the "aud" (Audience) Claim.
+   *
+   * @param audience "aud" (Audience) Claim value to set on the JWT Claims Set.
+   */
+  setAudience(audience: string | string[]): this
+
+  /**
+   * Set the "jti" (JWT ID) Claim.
+   *
+   * @param jwtId "jti" (JWT ID) Claim value to set on the JWT Claims Set.
+   */
+  setJti(jwtId: string): this
+
+  /**
+   * Set the "nbf" (Not Before) Claim. Numbers are Unix timestamps in seconds; Dates are converted
+   * to seconds. Strings are relative to now, using seconds, minutes, hours, days, weeks, or years
+   * (365.25 days; no months). Prefix `-` or suffix `ago` subtracts the duration.
+   *
+   * @param input "nbf" (Not Before) Claim value as a timestamp, Date, or relative duration.
+   */
+  setNotBefore(input: number | string | Date): this
+
+  /**
+   * Set the "exp" (Expiration Time) Claim. Accepts a Unix timestamp in seconds, a Date, or a
+   * duration relative to now using the same formats as {@link setNotBefore}.
+   *
+   * @param input "exp" (Expiration Time) Claim value as a timestamp, Date, or relative duration.
+   */
+  setExpirationTime(input: number | string | Date): this
+
+  /**
+   * Set the "iat" (Issued At) Claim. Defaults to the current Unix timestamp in seconds. Accepts a
+   * Unix timestamp in seconds, a Date, or a duration relative to now using the same formats as
+   * {@link setNotBefore}.
+   *
+   * @param input "iat" (Issued At) Claim value as a timestamp, Date, or relative duration.
+   */
+  setIssuedAt(input?: number | string | Date): this
+}
diff --git a/tests/corpus/6295-jose-hs256/node_modules/jose/dist/types/util/errors.d.ts b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/types/util/errors.d.ts
new file mode 100644
index 000000000..930a29b9f
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/types/util/errors.d.ts
@@ -0,0 +1,182 @@
+import type * as t from '../types.d.ts';
+/** Stable error codes used by this module. */
+export type JOSEErrorCode = 'ERR_JOSE_ALG_NOT_ALLOWED' | 'ERR_JOSE_GENERIC' | 'ERR_JOSE_NOT_SUPPORTED' | 'ERR_JWE_DECRYPTION_FAILED' | 'ERR_JWE_INVALID' | 'ERR_JWK_INVALID' | 'ERR_JWKS_INVALID' | 'ERR_JWKS_MULTIPLE_MATCHING_KEYS' | 'ERR_JWKS_NO_MATCHING_KEY' | 'ERR_JWKS_TIMEOUT' | 'ERR_JWS_INVALID' | 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED' | 'ERR_JWT_CLAIM_VALIDATION_FAILED' | 'ERR_JWT_EXPIRED' | 'ERR_JWT_INVALID';
+/** Shared details of JWT claim or header validation failures. */
+export interface JWTClaimValidationFailure {
+    /** Claim or header that failed validation. */
+    claim: string;
+    /** Reason code for the validation failure. */
+    reason: JWTClaimValidationReason;
+    /** The parsed JWT Claims Set; validation of other claims may be incomplete. */
+    payload: t.JWTPayload;
+}
+/** Reason codes produced by JWT Claims Set validation. */
+export type JWTClaimValidationReason = 'check_failed' | 'invalid' | 'mismatch' | 'missing' | 'unspecified' | (string & {});
+/** Base class for JOSE errors. */
+export declare class JOSEError extends Error {
+    /** Stable code identifying the error class. */
+    static code: JOSEErrorCode | (string & {});
+    /** Stable code identifying the error class. Use {@link AnyJOSEError} to narrow subclasses by code. */
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * Thrown when JWT claim or header validation fails. Expiration is reported separately as
+ * {@link JWTExpired}.
+ */
+export declare class JWTClaimValidationFailed extends JOSEError implements JWTClaimValidationFailure {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    /** The {@link JWTClaimValidationFailure} details carried by this error. */
+    cause: JWTClaimValidationFailure;
+    /** Claim or header that failed validation. */
+    claim: string;
+    /** Reason code for the validation failure. */
+    reason: JWTClaimValidationReason;
+    /**
+     * The parsed JWT Claims Set; validation of other claims may be incomplete. With
+     * {@link jwt/verify.jwtVerify jwtVerify} and {@link jwt/decrypt.jwtDecrypt jwtDecrypt}, token
+     * authentication precedes claim validation. {@link jwt/unsecured.UnsecuredJWT.decode} does not
+     * authenticate tokens.
+     */
+    payload: t.JWTPayload;
+    constructor(message: string, payload: t.JWTPayload, claim?: string, reason?: JWTClaimValidationReason);
+}
+/** Thrown when a JWT has expired or exceeds the configured maximum token age. */
+export declare class JWTExpired extends JOSEError implements JWTClaimValidationFailure {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    /** The {@link JWTClaimValidationFailure} details carried by this error. */
+    cause: JWTClaimValidationFailure;
+    /** Claim or header that failed validation. */
+    claim: string;
+    /** Reason code for the validation failure. */
+    reason: JWTClaimValidationReason;
+    /**
+     * The parsed JWT Claims Set; validation of other claims may be incomplete. With
+     * {@link jwt/verify.jwtVerify jwtVerify} and {@link jwt/decrypt.jwtDecrypt jwtDecrypt}, token
+     * authentication precedes claim validation. {@link jwt/unsecured.UnsecuredJWT.decode} does not
+     * authenticate tokens.
+     */
+    payload: t.JWTPayload;
+    constructor(message: string, payload: t.JWTPayload, claim?: string, reason?: JWTClaimValidationReason);
+}
+/** Thrown when an algorithm is disallowed by configuration. */
+export declare class JOSEAlgNotAllowed extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when a feature or algorithm is unsupported. */
+export declare class JOSENotSupported extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when JWE ciphertext decryption or authentication fails. */
+export declare class JWEDecryptionFailed extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Thrown when a JWE is invalid. */
+export declare class JWEInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when a JWS is invalid. */
+export declare class JWSInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when a JWT is invalid. */
+export declare class JWTInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when a JWK is invalid. */
+export declare class JWKInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when a JWKS is invalid. */
+export declare class JWKSInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when no keys match in a JWKS. */
+export declare class JWKSNoMatchingKey extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Thrown when multiple keys match in a JWKS. */
+export declare class JWKSMultipleMatchingKeys extends JOSEError {
+    /**
+     * Yields public keys matching the JWS Header so verification can be attempted with each. See the
+     * {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} and
+     * {@link jwks/local.createLocalJWKSet createLocalJWKSet} examples. Empty on manually constructed
+     * errors.
+     */
+    [Symbol.asyncIterator]: () => AsyncIterableIterator<t.CryptoKey>;
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Thrown when fetching a remote JWKS times out. */
+export declare class JWKSTimeout extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Thrown when JWS signature verification fails. */
+export declare class JWSSignatureVerificationFailed extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Errors thrown during JWT Claims Set validation. */
+export type JWTClaimValidationError = JWTClaimValidationFailed | JWTExpired;
+/**
+ * Discriminated union of specific {@link JOSEError} subclasses, narrowed by `code`. Excludes base
+ * {@link JOSEError} instances; use `instanceof JOSEError` to catch all module errors.
+ */
+export type AnyJOSEError = (JOSEAlgNotAllowed & {
+    code: 'ERR_JOSE_ALG_NOT_ALLOWED';
+}) | (JOSENotSupported & {
+    code: 'ERR_JOSE_NOT_SUPPORTED';
+}) | (JWEDecryptionFailed & {
+    code: 'ERR_JWE_DECRYPTION_FAILED';
+}) | (JWEInvalid & {
+    code: 'ERR_JWE_INVALID';
+}) | (JWKInvalid & {
+    code: 'ERR_JWK_INVALID';
+}) | (JWKSInvalid & {
+    code: 'ERR_JWKS_INVALID';
+}) | (JWKSMultipleMatchingKeys & {
+    code: 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
+}) | (JWKSNoMatchingKey & {
+    code: 'ERR_JWKS_NO_MATCHING_KEY';
+}) | (JWKSTimeout & {
+    code: 'ERR_JWKS_TIMEOUT';
+}) | (JWSInvalid & {
+    code: 'ERR_JWS_INVALID';
+}) | (JWSSignatureVerificationFailed & {
+    code: 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
+}) | (JWTClaimValidationFailed & {
+    code: 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+}) | (JWTExpired & {
+    code: 'ERR_JWT_EXPIRED';
+}) | (JWTInvalid & {
+    code: 'ERR_JWT_INVALID';
+});
diff --git a/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/jwt/sign.js b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/jwt/sign.js
new file mode 100644
index 000000000..4d5e51c99
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/jwt/sign.js
@@ -0,0 +1,19 @@
+import { createCompactSignature } from "../lib/jws_sign.js";
+import { JWTInvalid } from "../util/errors.js";
+import { JWTClaimsBuilder, jwtData } from "../lib/jwt_claims_set.js";
+import { assertNotSet } from "../lib/validate.js";
+const SignJWT_base = JWTClaimsBuilder;
+class SignJWT extends SignJWT_base {
+  #protectedHeader;
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+  }
+  async sign(key, options) {
+    return createCompactSignature(jwtData(this), this.#protectedHeader, options?.crit, key, () => {
+      throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+    });
+  }
+}
+export {
+  SignJWT
+};
diff --git a/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/jwt/verify.js b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/jwt/verify.js
new file mode 100644
index 000000000..8e02f3a8d
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/jwt/verify.js
@@ -0,0 +1,13 @@
+import { prepareVerify, verifyCompact } from "../lib/jws_verify.js";
+import { validateClaimsSet } from "../lib/jwt_claims_set.js";
+import { JWTInvalid } from "../util/errors.js";
+async function jwtVerify(jwt, key, options) {
+  const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
+  if (!b64)
+    throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+  const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
+  return { ...verified, payload };
+}
+export {
+  jwtVerify
+};
diff --git a/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/buffer_utils.js b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/buffer_utils.js
new file mode 100644
index 000000000..b3cad85a9
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -0,0 +1,75 @@
+const encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder("utf-8", { fatal: !0 }), MAX_INT32 = 2 ** 32;
+function concat(...buffers) {
+  const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
+  let i = 0;
+  for (const buffer of buffers)
+    buf.set(buffer, i), i += buffer.length;
+  return buf;
+}
+function writeUInt32BE(buf, value, offset) {
+  if (value < 0 || value >= MAX_INT32)
+    throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);
+  buf.set([value >>> 24, value >>> 16, value >>> 8, value & 255], offset);
+}
+function uint64be(value) {
+  const high = Math.floor(value / MAX_INT32), low = value % MAX_INT32, buf = new Uint8Array(8);
+  return writeUInt32BE(buf, high, 0), writeUInt32BE(buf, low, 4), buf;
+}
+function uint32be(value) {
+  const buf = new Uint8Array(4);
+  return writeUInt32BE(buf, value), buf;
+}
+const NON_ASCII = /[^\x00-\x7f]/;
+function encode(string) {
+  if (typeof string == "string" && string.length >= 128) {
+    if (NON_ASCII.test(string))
+      throw new TypeError("non-ASCII string encountered in encode()");
+    return encoder.encode(string);
+  }
+  const bytes = new Uint8Array(string.length);
+  for (let i = 0; i < string.length; i++) {
+    const code = string.charCodeAt(i);
+    if (code > 127)
+      throw new TypeError("non-ASCII string encountered in encode()");
+    bytes[i] = code;
+  }
+  return bytes;
+}
+function encodeBase64(input, url = !1) {
+  if (Uint8Array.prototype.toBase64)
+    return input.toBase64({ alphabet: url ? "base64url" : "base64", omitPadding: url });
+  const CHUNK_SIZE = 32768, arr = [];
+  for (let i = 0; i < input.length; i += CHUNK_SIZE)
+    arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+  const encoded = btoa(arr.join(""));
+  return url ? encoded.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : encoded;
+}
+function decodeBase64(encoded, url = !1) {
+  if (Uint8Array.fromBase64)
+    return Uint8Array.fromBase64(encoded, { alphabet: url ? "base64url" : "base64" });
+  if (url) {
+    if (encoded.includes("+") || encoded.includes("/"))
+      throw new TypeError("Invalid base64url");
+    encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+  }
+  const binary = atob(encoded), bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++)
+    bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+async function digest(algorithm, data) {
+  const subtleDigest = `SHA-${algorithm.slice(-3)}`;
+  return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
+}
+export {
+  concat,
+  decodeBase64,
+  decoder,
+  digest,
+  encode,
+  encodeBase64,
+  encoder,
+  strictDecoder,
+  uint32be,
+  uint64be
+};
diff --git a/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/jws_algorithms.js b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/jws_algorithms.js
new file mode 100644
index 000000000..08e2e22ac
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/jws_algorithms.js
@@ -0,0 +1,74 @@
+import { JOSENotSupported } from "../util/errors.js";
+import { table } from "./key_descriptor.js";
+const sig = [["verify"], ["sign"]];
+function hmac(bits) {
+  const subtle = { name: "HMAC", hash: `SHA-${bits}` };
+  return { kty: ["oct"], secret: !0, subtle, signing: subtle, usages: sig };
+}
+function rsa(bits, saltLength) {
+  const subtle = { name: saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5", hash: `SHA-${bits}` };
+  return {
+    kty: ["RSA"],
+    subtle,
+    signing: saltLength ? { ...subtle, saltLength } : subtle,
+    usages: sig,
+    minRsaBits: 2048
+  };
+}
+function ecdsa(crv, bits) {
+  return {
+    kty: ["EC"],
+    crv,
+    subtle: { name: "ECDSA", namedCurve: crv },
+    signing: { name: "ECDSA", hash: `SHA-${bits}` },
+    usages: sig
+  };
+}
+function eddsa() {
+  const subtle = { name: "Ed25519" };
+  return {
+    kty: ["OKP"],
+    crv: "Ed25519",
+    subtle,
+    signing: subtle,
+    usages: sig
+  };
+}
+function mldsa(bits) {
+  const subtle = { name: `ML-DSA-${bits}` };
+  return {
+    kty: ["AKP"],
+    subtle,
+    signing: subtle,
+    usages: sig
+  };
+}
+const JWS = table({
+  HS256: hmac(256),
+  HS384: hmac(384),
+  HS512: hmac(512),
+  RS256: rsa(256),
+  RS384: rsa(384),
+  RS512: rsa(512),
+  PS256: rsa(256, 32),
+  PS384: rsa(384, 48),
+  PS512: rsa(512, 64),
+  ES256: ecdsa("P-256", 256),
+  ES384: ecdsa("P-384", 384),
+  ES512: ecdsa("P-521", 512),
+  EdDSA: eddsa(),
+  Ed25519: eddsa(),
+  "ML-DSA-44": mldsa(44),
+  "ML-DSA-65": mldsa(65),
+  "ML-DSA-87": mldsa(87)
+});
+function jwsAlgorithm(alg) {
+  const entry = typeof alg == "string" ? JWS[alg] : void 0;
+  if (!entry)
+    throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+  return entry;
+}
+export {
+  JWS,
+  jwsAlgorithm
+};
diff --git a/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/jws_sign.js b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/jws_sign.js
new file mode 100644
index 000000000..76e6e02dd
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/jws_sign.js
@@ -0,0 +1,46 @@
+import { encode as b64u } from "../util/base64url.js";
+import { jwsAlgorithm } from "./jws_algorithms.js";
+import { isDisjoint, serializeJoseHeader, validateB64, validateCrit, validateCritDuplicates, JWS_RECOGNIZED } from "./validate.js";
+import { JWSInvalid } from "../util/errors.js";
+import { concat, encode, encoder } from "./buffer_utils.js";
+import { prepareKey, rawKey, checkModulusLength } from "./key.js";
+async function createSignature(input, key, rejectUnencoded) {
+  let [payload, protectedHeader, unprotectedHeader, crit] = input, protectedHeaderString = "";
+  if (protectedHeader !== void 0) {
+    const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
+    protectedHeader = normalized[0], protectedHeaderString = b64u(normalized[1]);
+  }
+  if (unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0]), !protectedHeader && !unprotectedHeader)
+    throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
+  if (!isDisjoint(protectedHeader, unprotectedHeader))
+    throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+  const joseHeader = { ...protectedHeader, ...unprotectedHeader };
+  validateCritDuplicates(JWSInvalid, protectedHeader);
+  const b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
+  b64 || rejectUnencoded?.();
+  const { alg } = joseHeader;
+  if (typeof alg != "string" || !alg)
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  const entry = jwsAlgorithm(alg);
+  let payloadS = "", payloadB = payload, data;
+  if (b64) {
+    const encoded = input[4];
+    encoded ? (payloadS = encoded[0] ??= b64u(payload), payloadB = encoded[1] ??= encode(payloadS)) : (payloadS = b64u(payload), data = encoder.encode(`${protectedHeaderString}.${payloadS}`));
+  }
+  data ??= concat(encode(protectedHeaderString), encode("."), payloadB);
+  const k = await rawKey(await prepareKey(entry, key, "sign"), entry.subtle, "sign");
+  entry.minRsaBits && checkModulusLength(entry.alg, k);
+  const jws = {
+    signature: b64u(new Uint8Array(await crypto.subtle.sign(entry.signing, k, data))),
+    payload: payloadS
+  };
+  return protectedHeader && (jws.protected = protectedHeaderString), unprotectedHeader && (jws.header = unprotectedHeader), [jws, b64];
+}
+async function createCompactSignature(payload, protectedHeader, crit, key, rejectUnencoded) {
+  const [jws] = await createSignature([payload, protectedHeader, void 0, crit], key, rejectUnencoded);
+  return `${jws.protected}.${jws.payload}.${jws.signature}`;
+}
+export {
+  createCompactSignature,
+  createSignature
+};
diff --git a/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/jws_verify.js b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/jws_verify.js
new file mode 100644
index 000000000..7337b9c8e
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/jws_verify.js
@@ -0,0 +1,86 @@
+import { jwsAlgorithm } from "./jws_algorithms.js";
+import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from "../util/errors.js";
+import { concat, decoder, encoder, encode } from "./buffer_utils.js";
+import { decodeBase64url, encodeBase64url, parseJoseHeader, isDisjoint, isObject, validateB64, validateCrit, validateAlgorithms, JWS_RECOGNIZED } from "./validate.js";
+import { prepareKey, rawKey, checkModulusLength } from "./key.js";
+function snapshotJws(jws, sharedPayload) {
+  const encodedProtected = jws.protected, inputHeader = jws.header, header = isObject(inputHeader) ? { ...inputHeader } : inputHeader;
+  let payload = sharedPayload ? sharedPayload[0] : jws.payload;
+  !sharedPayload && payload instanceof Uint8Array && (payload = new Uint8Array(payload));
+  const signature = jws.signature, snapshot = { payload, signature };
+  if (encodedProtected !== void 0 && (snapshot.protected = encodedProtected), inputHeader !== void 0 && (snapshot.header = header), encodedProtected === void 0 && header === void 0)
+    throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
+  if (encodedProtected !== void 0 && typeof encodedProtected != "string")
+    throw new JWSInvalid("JWS Protected Header incorrect type");
+  if (payload === void 0)
+    throw new JWSInvalid("JWS Payload missing");
+  if (typeof signature != "string")
+    throw new JWSInvalid("JWS Signature missing or incorrect type");
+  if (header !== void 0 && !isObject(header))
+    throw new JWSInvalid("JWS Unprotected Header incorrect type");
+  return snapshot;
+}
+function prepareVerify(options) {
+  return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
+}
+function parseProtectedHeader(encodedProtected) {
+  return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
+}
+function encodeJsonUnencodedPayload(payload) {
+  const invalid = /[\p{Cs}\p{Cn}]/u.exec(payload)?.[0];
+  if (invalid !== void 0)
+    throw new JWSInvalid(/\p{Cs}/u.test(invalid) ? "JWS Payload must be a well-formed Unicode string" : "JWS Payload must not contain unassigned Unicode code points");
+  return encoder.encode(payload);
+}
+function encodeCompactUnencodedPayload(payload) {
+  try {
+    return encode(payload);
+  } catch {
+    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
+  }
+}
+async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
+  const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
+  if (!isDisjoint(parsedProt, header))
+    throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+  const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
+  if (typeof alg != "string" || !alg)
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  if (shared[0] && !shared[0].has(alg))
+    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+  if (b64) {
+    if (typeof inputPayload != "string")
+      throw new JWSInvalid("JWS Payload must be a string");
+  } else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array))
+    throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+  const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
+  let resolvedKey = !1;
+  typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = !0);
+  const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
+  entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
+  let verified = !1;
+  try {
+    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
+  } catch {
+  }
+  if (!verified)
+    throw new JWSSignatureVerificationFailed();
+  const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
+  return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];
+}
+async function verifyCompact(jws, shared, key) {
+  if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != "string")
+    throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
+  const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
+  if (length !== 3)
+    throw new JWSInvalid("Invalid Compact JWS");
+  return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);
+}
+export {
+  encodeJsonUnencodedPayload,
+  parseProtectedHeader,
+  prepareVerify,
+  snapshotJws,
+  verifyCompact,
+  verifySignature
+};
diff --git a/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/jwt_claims_set.js b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/jwt_claims_set.js
new file mode 100644
index 000000000..b99943f9c
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/jwt_claims_set.js
@@ -0,0 +1,146 @@
+import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from "../util/errors.js";
+import { encoder, strictDecoder } from "./buffer_utils.js";
+import { isObject } from "./validate.js";
+const epoch = (date) => Math.floor(date.getTime() / 1e3), multipliers = {
+  s: 1,
+  m: 60,
+  h: 3600,
+  d: 86400,
+  w: 604800,
+  y: 31557600
+}, REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i, checkFailed = "check_failed";
+function invalidDuration() {
+  throw new TypeError("Invalid time period format");
+}
+function secs(str) {
+  typeof str != "string" && invalidDuration();
+  const matched = REGEX.exec(str);
+  (!matched || matched[4] && matched[1]) && invalidDuration();
+  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
+}
+function validateInput(label, input) {
+  if (!Number.isFinite(input))
+    throw new TypeError(`Invalid ${label} input`);
+  return input;
+}
+function validateStringClaim(claim, value) {
+  if (typeof value != "string")
+    throw new TypeError(`"${claim}" claim must be a string`);
+}
+function validateAudienceClaim(value) {
+  if (typeof value != "string" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member != "string")))
+    throw new TypeError('"aud" claim must be a string or an array of strings');
+}
+function numericDate(value, label) {
+  return typeof value == "number" ? validateInput(label, value) : value instanceof Date ? validateInput(label, epoch(value)) : epoch(/* @__PURE__ */ new Date()) + secs(value);
+}
+const normalizeTyp = (value) => {
+  const normalized = value.toLowerCase();
+  return value.includes("/") ? normalized : `application/${normalized}`;
+}, checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : !1;
+function validateNumericDate(payload, claim, required = !1) {
+  const value = payload[claim];
+  if (!(value === void 0 && !required)) {
+    if (typeof value != "number")
+      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
+    return value;
+  }
+}
+function unexpectedClaim(payload, claim) {
+  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+}
+function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
+  let payload;
+  try {
+    payload = JSON.parse(strictDecoder.decode(encodedPayload));
+  } catch {
+  }
+  if (!isObject(payload))
+    throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
+  const { typ } = options;
+  if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))
+    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
+  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
+  maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
+  for (const claim of new Set(presenceCheck.reverse()))
+    if (!Object.hasOwn(payload, claim))
+      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
+  issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
+  const { clockTolerance } = options;
+  let tolerance = 0;
+  if (typeof clockTolerance == "string")
+    tolerance = secs(clockTolerance);
+  else if (clockTolerance !== void 0) {
+    if (typeof clockTolerance != "number")
+      throw new TypeError("Invalid clockTolerance option type");
+    tolerance = clockTolerance;
+  }
+  validateInput("clockTolerance option", tolerance);
+  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload, "nbf");
+  if (nbf !== void 0 && nbf > now + tolerance)
+    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
+  const exp = validateNumericDate(payload, "exp");
+  if (exp !== void 0 && exp <= now - tolerance)
+    throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
+  if (maxTokenAge !== void 0) {
+    const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
+    if (age - tolerance > max)
+      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
+    if (age < -tolerance)
+      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
+  }
+  return payload;
+}
+let producerPayloads;
+function producerPayload(producer) {
+  return producerPayloads.get(producer);
+}
+function jwtData(producer) {
+  const payload = producerPayload(producer);
+  for (const claim of ["iat", "nbf", "exp"]) {
+    const value = payload[claim];
+    if (typeof value == "number" && !Number.isFinite(value))
+      throw new TypeError(`"${claim}" claim must be a finite number`);
+  }
+  return encoder.encode(JSON.stringify(payload));
+}
+function jwtClaim(producer, claim) {
+  return producerPayload(producer)[claim];
+}
+class JWTClaimsBuilder {
+  constructor(payload = {}) {
+    if (!isObject(payload))
+      throw new TypeError("JWT Claims Set MUST be an object");
+    (producerPayloads ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(payload));
+  }
+  setIssuer(value) {
+    return validateStringClaim("iss", value), producerPayload(this).iss = value, this;
+  }
+  setSubject(value) {
+    return validateStringClaim("sub", value), producerPayload(this).sub = value, this;
+  }
+  setAudience(value) {
+    return validateAudienceClaim(value), producerPayload(this).aud = value, this;
+  }
+  setJti(value) {
+    return validateStringClaim("jti", value), producerPayload(this).jti = value, this;
+  }
+  setNotBefore(value) {
+    return producerPayload(this).nbf = numericDate(value, "setNotBefore"), this;
+  }
+  setExpirationTime(value) {
+    return producerPayload(this).exp = numericDate(value, "setExpirationTime"), this;
+  }
+  setIssuedAt(value) {
+    const payload = producerPayload(this);
+    return value === void 0 ? payload.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == "string" ? payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value)) : payload.iat = numericDate(value, "setIssuedAt"), this;
+  }
+}
+export {
+  JWTClaimsBuilder,
+  jwtClaim,
+  jwtData,
+  secs,
+  validateClaimsSet
+};
diff --git a/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/key.js b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/key.js
new file mode 100644
index 000000000..7dc5602f1
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/key.js
@@ -0,0 +1,155 @@
+import { isObject } from "./validate.js";
+import { decode } from "../util/base64url.js";
+import { JOSENotSupported } from "../util/errors.js";
+const tag = (key) => key[Symbol.toStringTag], jwkMatchesOp = (entry, key, usage) => {
+  const { alg } = entry;
+  if (key.use !== void 0) {
+    const expected = usage === "sign" || usage === "verify" ? "sig" : "enc";
+    if (key.use !== expected)
+      throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
+  }
+  if (key.alg !== void 0 && key.alg !== alg)
+    throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+  if (Array.isArray(key.key_ops)) {
+    const expectedKeyOp = usage === "encrypt" || usage === "decrypt" ? entry.ops?.[usage === "encrypt" ? 0 : 1] : usage;
+    if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))
+      throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
+  }
+};
+async function prepareKey(entry, key, usage) {
+  const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
+  if (secret && key instanceof Uint8Array)
+    return key;
+  let normalized, keyObject;
+  if (isObject(key)) {
+    if (normalized = normalizeJwk(key), typeof normalized.kty != "string")
+      throw invalidKeyType(alg, key, secret);
+    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0)))
+      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+    if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct")
+      return decode(normalized.k);
+    if (!Object.isFrozen(key)) {
+      const { key_ops } = key;
+      Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);
+    }
+  } else {
+    if (!isKeyLike(key))
+      throw invalidKeyType(alg, key, secret);
+    const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+    if (key.type !== expectedType && (secret || ["secret", "public", "private"].includes(key.type)))
+      throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
+    if (isCryptoKey(key))
+      return key;
+    if (keyObject = key, keyObject.type === "secret")
+      return keyObject.export();
+  }
+  cache ||= /* @__PURE__ */ new WeakMap();
+  const cacheKey = key;
+  let cached = cache.get(cacheKey);
+  if (cached?.[alg])
+    return cached[alg];
+  if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == "function") {
+    const isPublic = keyObject.type === "public", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;
+    return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);
+  }
+  return normalized ??= keyObject.export({ format: "jwk" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);
+}
+let cache;
+const nist = {
+  __proto__: null,
+  prime256v1: "P-256",
+  secp384r1: "P-384",
+  secp521r1: "P-521"
+};
+function assertCryptoKey(key) {
+  if (!isCryptoKey(key))
+    throw new Error("CryptoKey instance expected");
+}
+const isCryptoKey = (key) => {
+  if (key?.[Symbol.toStringTag] === "CryptoKey")
+    return !0;
+  try {
+    return key instanceof CryptoKey;
+  } catch {
+    return !1;
+  }
+}, isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject", isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+function message(msg, actual, ...types) {
+  if (types.length > 2) {
+    const last = types.pop();
+    msg += `one of type ${types.join(", ")}, or ${last}.`;
+  } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
+  return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
+}
+const invalidKeyInput = (actual, ...types) => message("Key must be ", actual, ...types);
+function invalidKeyType(alg, actual, secret) {
+  const types = ["CryptoKey", "KeyObject", "JSON Web Key"];
+  return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
+}
+const unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+function checkUsage(key, usage) {
+  if (usage && !key.usages.includes(usage))
+    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+function checkModulusLength(alg, key) {
+  const { modulusLength } = key.algorithm;
+  if (typeof modulusLength != "number" || modulusLength < 2048)
+    throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+}
+function checkCryptoKey(key, expected, usage) {
+  const algorithm = key.algorithm;
+  if (algorithm.name !== expected.name)
+    throw unusable(expected.name);
+  if (expected.hash && algorithm.hash?.name !== expected.hash)
+    throw unusable(expected.hash, "algorithm.hash");
+  if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)
+    throw unusable(expected.namedCurve, "algorithm.namedCurve");
+  if (expected.length !== void 0 && algorithm.length !== expected.length)
+    throw unusable(expected.length, "algorithm.length");
+  checkUsage(key, usage);
+}
+function snapshotJwk(jwk) {
+  return { __proto__: null, ...jwk };
+}
+function normalizeJwk(jwk) {
+  const normalized = snapshotJwk(jwk);
+  if (normalized.ext !== void 0 && typeof normalized.ext != "boolean")
+    throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
+  if (normalized.key_ops !== void 0) {
+    const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;
+    if (!keyOps || keyOps.some((operation) => typeof operation != "string") || new Set(keyOps).size !== keyOps.length)
+      throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
+    normalized.key_ops = keyOps;
+  }
+  return normalized;
+}
+function validateExtractableOption(extractable) {
+  if (extractable !== void 0 && typeof extractable != "boolean")
+    throw new TypeError('"extractable" option must be a boolean');
+  return extractable;
+}
+async function jwkToKey(entry, jwk, extractable) {
+  if (!entry.kty.includes(jwk.kty))
+    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+  const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };
+  return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
+}
+async function rawKey(key, expected, usage, extractable = !1) {
+  return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
+}
+export {
+  assertCryptoKey,
+  checkCryptoKey,
+  checkModulusLength,
+  checkUsage,
+  invalidKeyInput,
+  isCryptoKey,
+  isKeyLike,
+  isKeyObject,
+  jwkToKey,
+  normalizeJwk,
+  prepareKey,
+  rawKey,
+  snapshotJwk,
+  validateExtractableOption
+};
diff --git a/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/key_descriptor.js b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/key_descriptor.js
new file mode 100644
index 000000000..cf0afbd90
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/key_descriptor.js
@@ -0,0 +1,9 @@
+function table(entries) {
+  const out = { __proto__: null };
+  for (const alg in entries)
+    out[alg] = { ...entries[alg], alg };
+  return out;
+}
+export {
+  table
+};
diff --git a/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/validate.js b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/validate.js
new file mode 100644
index 000000000..51b7dfe89
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/lib/validate.js
@@ -0,0 +1,122 @@
+import { JOSENotSupported, JWSInvalid } from "../util/errors.js";
+import { decode } from "../util/base64url.js";
+import { encode, strictDecoder } from "./buffer_utils.js";
+function assertUint8Array(input, label) {
+  if (!(input instanceof Uint8Array))
+    throw new TypeError(`${label} must be an instance of Uint8Array`);
+}
+function isObject(input) {
+  if (typeof input != "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]")
+    return !1;
+  const prototype = Object.getPrototypeOf(input);
+  return prototype === null || Object.getPrototypeOf(prototype) === null;
+}
+function isJwkSet(input) {
+  return isObject(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject);
+}
+function isDisjoint(...headers) {
+  const parameters = /* @__PURE__ */ new Set();
+  for (const header of headers)
+    if (header)
+      for (const parameter of Object.keys(header)) {
+        if (parameters.has(parameter))
+          return !1;
+        parameters.add(parameter);
+      }
+  return !0;
+}
+function assertNotSet(value, name) {
+  if (value !== void 0)
+    throw new TypeError(`${name} can only be called once`);
+}
+function decodeBase64url(value, label, ErrorClass) {
+  try {
+    return decode(value);
+  } catch {
+    throw new ErrorClass(`Failed to base64url decode the ${label}`);
+  }
+}
+function encodeBase64url(value, label, ErrorClass) {
+  try {
+    return encode(value);
+  } catch {
+    throw new ErrorClass(`The ${label} is not a valid base64url string`);
+  }
+}
+function parseJoseHeader(b64, ErrorClass, message) {
+  let parsed;
+  try {
+    parsed = JSON.parse(strictDecoder.decode(decode(b64)));
+  } catch {
+    throw new ErrorClass(message);
+  }
+  if (!isObject(parsed))
+    throw new ErrorClass(message);
+  return parsed;
+}
+const JWS_RECOGNIZED = { __proto__: null, b64: !0 }, JWE_RECOGNIZED = { __proto__: null };
+function validateAlgorithms(option, algorithms) {
+  if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != "string")))
+    throw new TypeError(`"${option}" option must be an array of strings`);
+  return algorithms === void 0 ? void 0 : new Set(algorithms);
+}
+function validateCritDuplicates(Err, protectedHeader) {
+  const { crit } = protectedHeader ?? {};
+  if (Array.isArray(crit) && new Set(crit).size !== crit.length)
+    throw new Err('"crit" (Critical) Header Parameter MUST NOT contain duplicate values');
+}
+function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+  if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0)
+    throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
+  if (!protectedHeader || protectedHeader.crit === void 0)
+    return [];
+  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != "string" || input.length === 0))
+    throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
+  const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };
+  for (const parameter of protectedHeader.crit) {
+    if (!(parameter in recognized))
+      throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+    if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0)
+      throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+    if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0))
+      throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
+  }
+  return protectedHeader.crit;
+}
+function validateB64(protectedHeader, extensions) {
+  if (extensions.includes("b64")) {
+    const b64 = protectedHeader.b64;
+    if (typeof b64 != "boolean")
+      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+    return b64;
+  }
+  return !0;
+}
+function serializeJoseHeader(Err, header) {
+  let serialized, parsed;
+  try {
+    serialized = JSON.stringify(header), parsed = JSON.parse(serialized);
+  } catch (cause) {
+    throw new Err("JOSE Header is not valid JSON", { cause });
+  }
+  if (!isObject(parsed))
+    throw new Err("JOSE Header is not a JSON object");
+  return [parsed, serialized];
+}
+export {
+  JWE_RECOGNIZED,
+  JWS_RECOGNIZED,
+  assertNotSet,
+  assertUint8Array,
+  decodeBase64url,
+  encodeBase64url,
+  isDisjoint,
+  isJwkSet,
+  isObject,
+  parseJoseHeader,
+  serializeJoseHeader,
+  validateAlgorithms,
+  validateB64,
+  validateCrit,
+  validateCritDuplicates
+};
diff --git a/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/util/base64url.js b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/util/base64url.js
new file mode 100644
index 000000000..4447baa6d
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/util/base64url.js
@@ -0,0 +1,16 @@
+import { encoder, decoder, encodeBase64, decodeBase64 } from "../lib/buffer_utils.js";
+const invalid = "The input to be decoded is not correctly encoded.";
+function decode(input) {
+  try {
+    return decodeBase64(typeof input == "string" ? input : decoder.decode(input), !0);
+  } catch (cause) {
+    throw new TypeError(invalid, { cause });
+  }
+}
+function encode(input) {
+  return encodeBase64(typeof input == "string" ? encoder.encode(input) : input, !0);
+}
+export {
+  decode,
+  encode
+};
diff --git a/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/util/errors.js b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/util/errors.js
new file mode 100644
index 000000000..b7d579f51
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/node_modules/jose/dist/webapi/util/errors.js
@@ -0,0 +1,109 @@
+class JOSEError extends Error {
+  static code = "ERR_JOSE_GENERIC";
+  code = "ERR_JOSE_GENERIC";
+  constructor(message, options) {
+    super(message, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
+  }
+}
+class JWTClaimValidationFailed extends JOSEError {
+  static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  claim;
+  reason;
+  payload;
+  constructor(message, payload, claim = "unspecified", reason = "unspecified") {
+    super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;
+  }
+}
+class JWTExpired extends JOSEError {
+  static code = "ERR_JWT_EXPIRED";
+  code = "ERR_JWT_EXPIRED";
+  claim;
+  reason;
+  payload;
+  constructor(message, payload, claim = "unspecified", reason = "unspecified") {
+    super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;
+  }
+}
+class JOSEAlgNotAllowed extends JOSEError {
+  static code = "ERR_JOSE_ALG_NOT_ALLOWED";
+  code = "ERR_JOSE_ALG_NOT_ALLOWED";
+}
+class JOSENotSupported extends JOSEError {
+  static code = "ERR_JOSE_NOT_SUPPORTED";
+  code = "ERR_JOSE_NOT_SUPPORTED";
+}
+class JWEDecryptionFailed extends JOSEError {
+  static code = "ERR_JWE_DECRYPTION_FAILED";
+  code = "ERR_JWE_DECRYPTION_FAILED";
+  constructor(message = "decryption operation failed", options) {
+    super(message, options);
+  }
+}
+class JWEInvalid extends JOSEError {
+  static code = "ERR_JWE_INVALID";
+  code = "ERR_JWE_INVALID";
+}
+class JWSInvalid extends JOSEError {
+  static code = "ERR_JWS_INVALID";
+  code = "ERR_JWS_INVALID";
+}
+class JWTInvalid extends JOSEError {
+  static code = "ERR_JWT_INVALID";
+  code = "ERR_JWT_INVALID";
+}
+class JWKInvalid extends JOSEError {
+  static code = "ERR_JWK_INVALID";
+  code = "ERR_JWK_INVALID";
+}
+class JWKSInvalid extends JOSEError {
+  static code = "ERR_JWKS_INVALID";
+  code = "ERR_JWKS_INVALID";
+}
+class JWKSNoMatchingKey extends JOSEError {
+  static code = "ERR_JWKS_NO_MATCHING_KEY";
+  code = "ERR_JWKS_NO_MATCHING_KEY";
+  constructor(message = "no applicable key found in the JSON Web Key Set", options) {
+    super(message, options);
+  }
+}
+class JWKSMultipleMatchingKeys extends JOSEError {
+  [Symbol.asyncIterator] = async function* () {
+  };
+  static code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+  code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+  constructor(message = "multiple matching keys found in the JSON Web Key Set", options) {
+    super(message, options);
+  }
+}
+class JWKSTimeout extends JOSEError {
+  static code = "ERR_JWKS_TIMEOUT";
+  code = "ERR_JWKS_TIMEOUT";
+  constructor(message = "request timed out", options) {
+    super(message, options);
+  }
+}
+class JWSSignatureVerificationFailed extends JOSEError {
+  static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  constructor(message = "signature verification failed", options) {
+    super(message, options);
+  }
+}
+export {
+  JOSEAlgNotAllowed,
+  JOSEError,
+  JOSENotSupported,
+  JWEDecryptionFailed,
+  JWEInvalid,
+  JWKInvalid,
+  JWKSInvalid,
+  JWKSMultipleMatchingKeys,
+  JWKSNoMatchingKey,
+  JWKSTimeout,
+  JWSInvalid,
+  JWSSignatureVerificationFailed,
+  JWTClaimValidationFailed,
+  JWTExpired,
+  JWTInvalid
+};
diff --git a/tests/corpus/6295-jose-hs256/node_modules/jose/package.json b/tests/corpus/6295-jose-hs256/node_modules/jose/package.json
new file mode 100644
index 000000000..bcb353430
--- /dev/null
+++ b/tests/corpus/6295-jose-hs256/node_modules/jose/package.json
@@ -0,0 +1,17 @@
+{
+  "name": "jose",
+  "version": "6.2.12",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    "./jwt/*": {
+      "types": "./dist/types/jwt/*.d.ts",
+      "default": "./dist/webapi/jwt/*.js"
+    },
+    "./errors": {
+      "types": "./dist/types/util/errors.d.ts",
+      "default": "./dist/webapi/util/errors.js"
+    }
+  }
+}
diff --git a/tests/corpus/6296-array-position-patterns.ts b/tests/corpus/6296-array-position-patterns.ts
new file mode 100644
index 000000000..8c55b6152
--- /dev/null
+++ b/tests/corpus/6296-array-position-patterns.ts
@@ -0,0 +1,23 @@
+// Object patterns over arrays that name positions and `length` (jose's
+// `const { 0: header, 1: payload, 2: signature, length } = jws.split(".")`):
+// each position is the element or undefined past the end, defaults apply
+// to missing positions, and `length` is the array's length.
+const { 0: header, 1: payload, 2: signature, length } = "aaa.bbb.ccc".split(".");
+console.log(header, payload, signature, length);
+
+const short = "aaa.bbb".split(".");
+const { 0: first, 2: third, length: count } = short;
+console.log(first, third === undefined, count);
+
+const { 1: second = "fallback", 3: fourth = "missing" } = short;
+console.log(second, fourth);
+
+function parts(values: number[]): string {
+  const { 0: a, 1: b, length: n } = values;
+  return `${a}:${b}:${n}`;
+}
+console.log(parts([1, 2, 3]), parts([7]));
+
+let renamed = "";
+for (const { 0: key, 1: value } of [["x", "1"], ["y", "2"]]) renamed += `${key}=${value};`;
+console.log(renamed);
diff --git a/tests/corpus/6297-library-runtime-idioms.mjs b/tests/corpus/6297-library-runtime-idioms.mjs
new file mode 100644
index 000000000..11d5d5e67
--- /dev/null
+++ b/tests/corpus/6297-library-runtime-idioms.mjs
@@ -0,0 +1,34 @@
+// Runtime idioms from jose's dist build: the Uint8Array base64/hex
+// feature probes (absent in Node 24), String.fromCharCode.apply over byte
+// chunks and number lists (the btoa fallback), and structuredClone of a
+// parameter whose default is `{}` called with differently shaped objects.
+console.log(typeof Uint8Array.prototype.toBase64, typeof Uint8Array.prototype.toHex);
+console.log(typeof Uint8Array.prototype.setFromBase64, typeof Uint8Array.prototype.setFromHex);
+
+function encodeBase64(input) {
+  if (Uint8Array.prototype.toBase64) return input.toBase64();
+  const CHUNK_SIZE = 4, arr = [];
+  for (let i = 0; i < input.length; i += CHUNK_SIZE)
+    arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+  return btoa(arr.join(""));
+}
+console.log(encodeBase64(new TextEncoder().encode("hello, base64 chunks")));
+console.log(encodeBase64(new Uint8Array([0, 255, 128, 1, 2])));
+
+const bytes = new Uint8Array([104, 105]);
+console.log(String.fromCharCode.apply(null, bytes), String.fromCharCode.apply(undefined, [72, 73]));
+const untyped = JSON.parse("[79, 75]");
+console.log(String.fromCharCode.apply(null, untyped), String.fromCharCode.apply(null, []).length);
+
+let store;
+class Builder {
+  constructor(payload = {}) {
+    (store ||= new WeakMap()).set(this, structuredClone(payload));
+  }
+  claims() {
+    return JSON.stringify(store.get(this));
+  }
+}
+console.log(new Builder({ role: "admin", exp: 5 }).claims());
+console.log(new Builder({ scope: "read" }).claims());
+console.log(new Builder().claims());
diff --git a/tests/corpus/6331-jose-root-entry/main.ts b/tests/corpus/6331-jose-root-entry/main.ts
new file mode 100644
index 000000000..598154040
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/main.ts
@@ -0,0 +1,110 @@
+// The real jose@6.2.12 through its root entry, from TypeScript, the way a
+// Next.js proxy uses it: `import { jwtVerify, errors } from "jose"`.
+// node_modules/jose vendors the published package's dist/ (every webapi
+// module the root entry loads, and its declarations), package.json and
+// LICENSE.md unmodified (MIT). Loading the root runs jwks/remote.js, which
+// reads Node's navigator global at module load. Covers chained SignJWT
+// builders, string durations (jose's secs()), destructured jwtVerify
+// results and `instanceof errors.JOSEError` brand checks.
+import { SignJWT, jwtVerify, errors, cryptoRuntime, decodeJwt } from "jose";
+
+const encoder = new TextEncoder();
+const secret = encoder.encode("scriptc-jose-root-shared-secret");
+const now = 1_800_000_000;
+const iat = 1_799_999_000;
+
+interface Options {
+  issuer?: string;
+  audience?: string;
+  algorithms?: string[];
+  at?: number;
+  maxTokenAge?: string;
+  clockTolerance?: string;
+}
+
+async function check(label: string, token: string, options: Options = {}): Promise<void> {
+  try {
+    const { payload, protectedHeader } = await jwtVerify(token, secret, {
+      algorithms: options.algorithms ?? ["HS256"],
+      currentDate: new Date((options.at ?? now) * 1000),
+      issuer: options.issuer,
+      audience: options.audience,
+      maxTokenAge: options.maxTokenAge,
+      clockTolerance: options.clockTolerance,
+    });
+    const role = payload.role;
+    console.log(label, "ok", protectedHeader.alg, payload.sub ?? null, role, payload.exp ?? null);
+  } catch (error) {
+    if (error instanceof errors.JOSEError) {
+      console.log(label, error.code, error.message, error instanceof errors.JWTExpired);
+    } else if (error instanceof TypeError) {
+      console.log(label, "TypeError", error.message);
+    } else {
+      throw error;
+    }
+  }
+}
+
+console.log(cryptoRuntime, errors.JWTExpired.code, errors.JWSSignatureVerificationFailed.code);
+
+const token = await new SignJWT({ role: "admin" })
+  .setProtectedHeader({ alg: "HS256", typ: "JWT" })
+  .setIssuedAt(iat)
+  .setIssuer("urn:scriptc:issuer")
+  .setAudience("urn:scriptc:audience")
+  .setSubject("alice")
+  .setJti("jti-1")
+  .setNotBefore(iat - 60)
+  .setExpirationTime(iat + 3600)
+  .sign(secret);
+console.log(token);
+console.log(JSON.stringify(decodeJwt(token)));
+
+await check("valid", token, { issuer: "urn:scriptc:issuer", audience: "urn:scriptc:audience" });
+await check("issuer", token, { issuer: "urn:other" });
+await check("audience", token, { audience: "urn:other" });
+await check("expired", token, { at: iat + 7200 });
+await check("wrong secret", await new SignJWT({ role: "admin" }).setProtectedHeader({ alg: "HS256" }).sign(encoder.encode("x")));
+await check("malformed", "not.a.jwt");
+await check("alg", token, { algorithms: ["HS512"] });
+
+// String durations: maxTokenAge and clockTolerance against the fixed date.
+await check("max age 10 minutes", token, { maxTokenAge: "10 minutes" });
+await check("max age 1 hour", token, { maxTokenAge: "1 hour" });
+await check("max age 2 days", token, { maxTokenAge: "2 days" });
+await check("max age 1.5h", token, { maxTokenAge: "1.5h" });
+await check("max age +20m", token, { maxTokenAge: "+20m" });
+await check("max age 1 week", token, { maxTokenAge: "1 week" });
+await check("max age 1y", token, { maxTokenAge: "1y" });
+await check("max age 900 secs", token, { maxTokenAge: "900 secs" });
+await check("max age 3 HOURS", token, { maxTokenAge: "3 HOURS" });
+await check("tolerance 30s", token, { at: iat + 3620, clockTolerance: "30s" });
+await check("tolerance 5 sec", token, { at: iat + 3620, clockTolerance: "5 sec" });
+await check("tolerance 1 min from now", token, { at: iat + 3620, clockTolerance: "1 min from now" });
+await check("tolerance 1 min ago", token, { at: iat + 3620, clockTolerance: "1 min ago" });
+await check("bad duration", token, { maxTokenAge: "10 fortnights" });
+await check("signed ago", token, { maxTokenAge: "-2h ago" });
+await check("empty duration", token, { maxTokenAge: "" });
+
+// String durations on the builder are relative to the clock: check the
+// distance from now instead of printing it.
+const relative = await new SignJWT({ role: "reader" })
+  .setProtectedHeader({ alg: "HS256" })
+  .setIssuedAt("-1 minute")
+  .setNotBefore("0s")
+  .setExpirationTime("2h")
+  .sign(secret);
+const claims = decodeJwt(relative);
+const clock = Math.floor(Date.now() / 1000);
+console.log(
+  Math.abs((claims.exp ?? 0) - clock - 7200) <= 2,
+  Math.abs((claims.iat ?? 0) - clock + 60) <= 2,
+  Math.abs((claims.nbf ?? 0) - clock) <= 2,
+);
+const { payload } = await jwtVerify(relative, secret, { maxTokenAge: "5 minutes" });
+console.log(payload.role);
+try {
+  new SignJWT({}).setExpirationTime("soon");
+} catch (error) {
+  console.log((error as Error).name, (error as Error).message);
+}
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/LICENSE.md b/tests/corpus/6331-jose-root-entry/node_modules/jose/LICENSE.md
new file mode 100644
index 000000000..d0ec038a8
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/LICENSE.md
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2018 Filip Skokan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/index.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/index.d.ts
new file mode 100644
index 000000000..730247dd1
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/index.d.ts
@@ -0,0 +1,55 @@
+export { compactDecrypt } from './jwe/compact/decrypt.js';
+export type { CompactDecryptGetKey } from './jwe/compact/decrypt.js';
+export { flattenedDecrypt } from './jwe/flattened/decrypt.js';
+export type { FlattenedDecryptGetKey } from './jwe/flattened/decrypt.js';
+export { generalDecrypt } from './jwe/general/decrypt.js';
+export type { GeneralDecryptGetKey } from './jwe/general/decrypt.js';
+export { GeneralEncrypt } from './jwe/general/encrypt.js';
+export type { Recipient } from './jwe/general/encrypt.js';
+export { compactVerify } from './jws/compact/verify.js';
+export type { CompactVerifyGetKey } from './jws/compact/verify.js';
+export { flattenedVerify } from './jws/flattened/verify.js';
+export type { FlattenedVerifyGetKey } from './jws/flattened/verify.js';
+export { generalVerify } from './jws/general/verify.js';
+export type { GeneralVerifyGetKey } from './jws/general/verify.js';
+export { jwtVerify } from './jwt/verify.js';
+export type { JWTVerifyOptions, JWTVerifyGetKey } from './jwt/verify.js';
+export { jwtDecrypt } from './jwt/decrypt.js';
+export type { JWTDecryptOptions, JWTDecryptGetKey } from './jwt/decrypt.js';
+export { CompactEncrypt } from './jwe/compact/encrypt.js';
+export { FlattenedEncrypt } from './jwe/flattened/encrypt.js';
+export { CompactSign } from './jws/compact/sign.js';
+export { FlattenedSign } from './jws/flattened/sign.js';
+export { GeneralSign } from './jws/general/sign.js';
+export type { Signature } from './jws/general/sign.js';
+export { SignJWT } from './jwt/sign.js';
+export { EncryptJWT } from './jwt/encrypt.js';
+export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint.js';
+export { EmbeddedJWK } from './jwk/embedded.js';
+export { createLocalJWKSet } from './jwks/local.js';
+export type { LocalJWKSet } from './jwks/local.js';
+export { createRemoteJWKSet, jwksCache, customFetch } from './jwks/remote.js';
+export type { RemoteJWKSet, RemoteJWKSetOptions, JWKSCacheInput, ExportedJWKSCache, FetchImplementation, } from './jwks/remote.js';
+export { UnsecuredJWT } from './jwt/unsecured.js';
+export type { UnsecuredResult } from './jwt/unsecured.js';
+export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
+export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';
+export type { KeyImportOptions } from './key/import.js';
+export { decodeProtectedHeader } from './util/decode_protected_header.js';
+export { decodeJwt } from './util/decode_jwt.js';
+export type { ProtectedHeaderParameters } from './util/decode_protected_header.js';
+import * as errors from './util/errors.js';
+export { errors };
+export { generateKeyPair } from './key/generate_key_pair.js';
+export type { GenerateKeyPairAlgorithm, GenerateKeyPairResult, GenerateKeyPairOptions, } from './key/generate_key_pair.js';
+export { generateSecret } from './key/generate_secret.js';
+export type { GenerateSecretAlgorithm, GenerateSecretOptions } from './key/generate_secret.js';
+import * as base64url from './util/base64url.js';
+export { base64url };
+export type { AnyJWK, CompactDecryptResult, CompactJWEHeaderParameters, CompactJWSHeaderParameters, CompactVerifyResult, CritOption, CryptoKey, DecryptOptions, EncryptOptions, FlattenedDecryptResult, FlattenedJWE, FlattenedJWS, FlattenedJWSInput, FlattenedVerifyResult, GeneralDecryptResult, GeneralJWE, GeneralJWS, GeneralJWSInput, GeneralVerifyResult, GetKeyFunction, JoseHeaderParameters, JSONWebKeySet, JWEContentEncryptionAlgorithm, JWEHeaderParameters, JWEKeyManagementAlgorithm, JWEKeyManagementHeaderParameters, JWK_AKP_Private, JWK_AKP_Public, JWK_EC_Private, JWK_EC_Public, JWK_oct, JWK_OKP_Private, JWK_OKP_Public, JWK_RSA_Private, JWK_RSA_Public, JWK, JWKKeyType, JWKParameters, JWSAlgorithm, JWSHeaderParameters, JWTClaimVerificationOptions, JWTDecryptResult, JWTHeaderParameters, JWTPayload, JWTVerifyResult, KeyInput, KeyObject, ProduceJWT, ResolvedKey, SignOptions, VerifyOptions, } from './types.d.ts';
+/**
+ * Identified the loaded runtime-specific build in prior releases; now always `"WebCryptoAPI"`.
+ *
+ * @deprecated Remove any runtime branching on this value; it is always `"WebCryptoAPI"`.
+ */
+export declare const cryptoRuntime = "WebCryptoAPI";
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwe/compact/decrypt.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwe/compact/decrypt.d.ts
new file mode 100644
index 000000000..abbac7ac2
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwe/compact/decrypt.d.ts
@@ -0,0 +1,24 @@
+import type * as t from '../../types.d.ts';
+/** Resolves a key for Compact JWE decryption from unverified headers and token data. */
+export interface CompactDecryptGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.CompactJWEHeaderParameters, t.FlattenedJWE, KeyType | t.KeyObject | t.JWK> {
+}
+/**
+ * Decrypts a Compact JWE.
+ *
+ * @param key Private key or shared secret. See
+ *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ */
+export declare function compactDecrypt(jwe: string | Uint8Array, key: t.KeyInput, options?: t.DecryptOptions): Promise<t.CompactDecryptResult>;
+/**
+ * Decrypts a Compact JWE with a dynamically resolved key, included in the result.
+ *
+ * @param getKey Resolves a private key or shared secret from unverified token data.
+ */
+export declare function compactDecrypt<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwe: string | Uint8Array, getKey: CompactDecryptGetKey<KeyType>, options?: t.DecryptOptions): Promise<t.CompactDecryptResult & t.ResolvedKey<KeyType>>;
+/**
+ * Decrypts a Compact JWE with a key or key resolver. The result includes `key` only when a resolver
+ * is used.
+ *
+ * @param key Private key or shared secret, or a function resolving one.
+ */
+export declare function compactDecrypt(jwe: string | Uint8Array, key: t.KeyInput | CompactDecryptGetKey, options?: t.DecryptOptions): Promise<t.CompactDecryptResult & Partial<t.ResolvedKey>>;
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwe/compact/encrypt.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwe/compact/encrypt.d.ts
new file mode 100644
index 000000000..966f65c3f
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwe/compact/encrypt.d.ts
@@ -0,0 +1,40 @@
+import type * as t from '../../types.d.ts';
+/** Builds and encrypts Compact JWE strings. */
+export declare class CompactEncrypt {
+    #private;
+    /**
+     * Creates a Compact JWE encryptor.
+     *
+     * @param plaintext Binary representation of the plaintext to encrypt.
+     */
+    constructor(plaintext: Uint8Array);
+    /**
+     * Sets a content encryption key instead of generating a random one for the JWE "enc" algorithm.
+     * May only be called once.
+     *
+     * @deprecated Use only for testing and vector validation.
+     */
+    setContentEncryptionKey(cek: Uint8Array): this;
+    /**
+     * Sets the content encryption IV instead of generating a random one for the JWE "enc" algorithm.
+     * May only be called once.
+     *
+     * @deprecated Use only for testing and vector validation.
+     */
+    setInitializationVector(iv: Uint8Array): this;
+    /** Sets the JWE Protected Header. May only be called once. */
+    setProtectedHeader(protectedHeader: t.CompactJWEHeaderParameters): this;
+    /**
+     * Sets key management inputs such as ECDH-ES "apu"/"apv" or PBES2 "p2c". Use this method instead
+     * of header setters; the resulting parameters are added to the JOSE header. May only be called
+     * once.
+     */
+    setKeyManagementParameters(parameters: t.JWEKeyManagementHeaderParameters): this;
+    /**
+     * Encrypts the plaintext as a Compact JWE.
+     *
+     * @param key Public key or shared secret. See
+     *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+     */
+    encrypt(key: t.KeyInput, options?: t.EncryptOptions): Promise<string>;
+}
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwe/flattened/decrypt.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwe/flattened/decrypt.d.ts
new file mode 100644
index 000000000..b166f8f40
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwe/flattened/decrypt.d.ts
@@ -0,0 +1,24 @@
+import type * as t from '../../types.d.ts';
+/** Resolves a key for Flattened JWE decryption from unverified headers and token data. */
+export interface FlattenedDecryptGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.JWEHeaderParameters | undefined, t.FlattenedJWE, KeyType | t.KeyObject | t.JWK> {
+}
+/**
+ * Decrypts a Flattened JWE.
+ *
+ * @param key Private key or shared secret. See
+ *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ */
+export declare function flattenedDecrypt(jwe: t.FlattenedJWE, key: t.KeyInput, options?: t.DecryptOptions): Promise<t.FlattenedDecryptResult>;
+/**
+ * Decrypts a Flattened JWE with a dynamically resolved key, included in the result.
+ *
+ * @param getKey Resolves a private key or shared secret from unverified token data.
+ */
+export declare function flattenedDecrypt<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwe: t.FlattenedJWE, getKey: FlattenedDecryptGetKey<KeyType>, options?: t.DecryptOptions): Promise<t.FlattenedDecryptResult & t.ResolvedKey<KeyType>>;
+/**
+ * Decrypts a Flattened JWE with a key or key resolver. The result includes `key` only when a
+ * resolver is used.
+ *
+ * @param key Private key or shared secret, or a function resolving one.
+ */
+export declare function flattenedDecrypt(jwe: t.FlattenedJWE, key: t.KeyInput | FlattenedDecryptGetKey, options?: t.DecryptOptions): Promise<t.FlattenedDecryptResult & Partial<t.ResolvedKey>>;
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwe/flattened/encrypt.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwe/flattened/encrypt.d.ts
new file mode 100644
index 000000000..9d1d3e3fa
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwe/flattened/encrypt.d.ts
@@ -0,0 +1,46 @@
+import type * as t from '../../types.d.ts';
+/** Builds and encrypts Flattened JWE objects. */
+export declare class FlattenedEncrypt {
+    #private;
+    /**
+     * Creates a Flattened JWE encryptor.
+     *
+     * @param plaintext Binary representation of the plaintext to encrypt.
+     */
+    constructor(plaintext: Uint8Array);
+    /**
+     * Sets key management inputs such as ECDH-ES "apu"/"apv" or PBES2 "p2c". Use this method instead
+     * of header setters; the resulting parameters are added to the JOSE header. May only be called
+     * once.
+     */
+    setKeyManagementParameters(parameters: t.JWEKeyManagementHeaderParameters): this;
+    /** Sets the JWE Protected Header. May only be called once. */
+    setProtectedHeader(protectedHeader: t.JWEHeaderParameters): this;
+    /** Sets the JWE Shared Unprotected Header. May only be called once. */
+    setSharedUnprotectedHeader(sharedUnprotectedHeader: t.JWEHeaderParameters): this;
+    /** Sets the JWE Per-Recipient Unprotected Header. May only be called once. */
+    setUnprotectedHeader(unprotectedHeader: t.JWEHeaderParameters): this;
+    /** Sets additional data to authenticate without encrypting it. */
+    setAdditionalAuthenticatedData(aad: Uint8Array): this;
+    /**
+     * Sets a content encryption key instead of generating a random one for the JWE "enc" algorithm.
+     * May only be called once.
+     *
+     * @deprecated Use only for testing and vector validation.
+     */
+    setContentEncryptionKey(cek: Uint8Array): this;
+    /**
+     * Sets the content encryption IV instead of generating a random one for the JWE "enc" algorithm.
+     * May only be called once.
+     *
+     * @deprecated Use only for testing and vector validation.
+     */
+    setInitializationVector(iv: Uint8Array): this;
+    /**
+     * Encrypts the plaintext as a Flattened JWE.
+     *
+     * @param key Public key or shared secret. See
+     *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+     */
+    encrypt(key: t.KeyInput, options?: t.EncryptOptions): Promise<t.FlattenedJWE>;
+}
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwe/general/decrypt.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwe/general/decrypt.d.ts
new file mode 100644
index 000000000..67a396c16
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwe/general/decrypt.d.ts
@@ -0,0 +1,28 @@
+import type * as t from '../../types.d.ts';
+/** Resolves a key for General JWE decryption from unverified headers and token data. */
+export interface GeneralDecryptGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.JWEHeaderParameters | undefined, t.FlattenedJWE, KeyType | t.KeyObject | t.JWK> {
+}
+/**
+ * Decrypts a General JWE.
+ *
+ * > Note: Returns plaintext and headers from the first recipient that decrypts successfully. Other
+ * > recipients may be inspected to enforce serialization rules, but their headers are not included in
+ * > the result. Rely only on the returned data.
+ *
+ * @param key Private key or shared secret. See
+ *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ */
+export declare function generalDecrypt(jwe: t.GeneralJWE, key: t.KeyInput, options?: t.DecryptOptions): Promise<t.GeneralDecryptResult>;
+/**
+ * Decrypts a General JWE with a dynamically resolved key, included in the result.
+ *
+ * @param getKey Resolves a private key or shared secret from unverified token data.
+ */
+export declare function generalDecrypt<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwe: t.GeneralJWE, getKey: GeneralDecryptGetKey<KeyType>, options?: t.DecryptOptions): Promise<t.GeneralDecryptResult & t.ResolvedKey<KeyType>>;
+/**
+ * Decrypts a General JWE with a key or key resolver. The result includes `key` only when a resolver
+ * is used.
+ *
+ * @param key Private key or shared secret, or a function resolving one.
+ */
+export declare function generalDecrypt(jwe: t.GeneralJWE, key: t.KeyInput | GeneralDecryptGetKey, options?: t.DecryptOptions): Promise<t.GeneralDecryptResult & Partial<t.ResolvedKey>>;
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwe/general/encrypt.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwe/general/encrypt.d.ts
new file mode 100644
index 000000000..e738a3a14
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwe/general/encrypt.d.ts
@@ -0,0 +1,51 @@
+import type * as t from '../../types.d.ts';
+/** Configures an individual recipient in a General JWE. */
+export interface Recipient {
+    /** Sets the JWE Per-Recipient Unprotected Header. May only be called once. */
+    setUnprotectedHeader(unprotectedHeader: t.JWEHeaderParameters): Recipient;
+    /**
+     * Sets key management inputs such as ECDH-ES "apu"/"apv" or PBES2 "p2c". Use this method instead
+     * of header setters; the resulting parameters are added to the JOSE header. May only be called
+     * once.
+     */
+    setKeyManagementParameters(parameters: t.JWEKeyManagementHeaderParameters): Recipient;
+    /**
+     * Adds another recipient to the enclosing {@link GeneralEncrypt} and returns its configuration.
+     *
+     * @param key Public key or shared secret. See
+     *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+     */
+    addRecipient(key: t.KeyInput, options?: t.CritOption): Recipient;
+    /**
+     * Encrypts for all recipients on the enclosing {@link GeneralEncrypt}, using their configured
+     * keys.
+     */
+    encrypt(): Promise<t.GeneralJWE>;
+    /** Returns the enclosing {@link GeneralEncrypt} instance. */
+    done(): GeneralEncrypt;
+}
+/** Builds and encrypts General JWE objects. */
+export declare class GeneralEncrypt {
+    #private;
+    /**
+     * Creates a General JWE encryptor.
+     *
+     * @param plaintext Binary representation of the plaintext to encrypt.
+     */
+    constructor(plaintext: Uint8Array);
+    /**
+     * Adds a recipient and returns its configuration.
+     *
+     * @param key Public key or shared secret. See
+     *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+     */
+    addRecipient(key: t.KeyInput, options?: t.CritOption): Recipient;
+    /** Sets the JWE Protected Header. May only be called once. */
+    setProtectedHeader(protectedHeader: t.JWEHeaderParameters): this;
+    /** Sets the JWE Shared Unprotected Header. May only be called once. */
+    setSharedUnprotectedHeader(sharedUnprotectedHeader: t.JWEHeaderParameters): this;
+    /** Sets additional data to authenticate without encrypting it. */
+    setAdditionalAuthenticatedData(aad: Uint8Array): this;
+    /** Encrypts the plaintext as a General JWE. */
+    encrypt(): Promise<t.GeneralJWE>;
+}
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwk/embedded.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwk/embedded.d.ts
new file mode 100644
index 000000000..d02ffcd49
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwk/embedded.d.ts
@@ -0,0 +1,10 @@
+import type * as t from '../types.d.ts';
+/**
+ * Resolves a verification key from an embedded "jwk" (JSON Web Key) Header Parameter. This key
+ * resolver opts JWS and JWT verification into trusting a public key supplied by the token. Use the
+ * verification function's `algorithms` option to restrict accepted algorithms.
+ *
+ * @param token The consumed JWS token.
+ * @returns The public key from the JWS "jwk" (JSON Web Key) Header Parameter.
+ */
+export declare function EmbeddedJWK(protectedHeader?: t.JWSHeaderParameters, token?: t.FlattenedJWSInput): Promise<t.CryptoKey>;
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwk/thumbprint.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwk/thumbprint.d.ts
new file mode 100644
index 000000000..674d7cbe6
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwk/thumbprint.d.ts
@@ -0,0 +1,15 @@
+import type * as t from '../types.d.ts';
+/**
+ * Calculates a base64url-encoded JWK Thumbprint. CryptoKey inputs must be extractable.
+ *
+ * @param key Key to calculate the thumbprint for.
+ * @param digestAlgorithm Digest algorithm. Defaults to "sha256".
+ */
+export declare function calculateJwkThumbprint(key: t.JWK | t.CryptoKey | t.KeyObject, digestAlgorithm?: 'sha256' | 'sha384' | 'sha512'): Promise<string>;
+/**
+ * Calculates a JWK Thumbprint URI. CryptoKey inputs must be extractable.
+ *
+ * @param key Key to calculate the thumbprint for.
+ * @param digestAlgorithm Digest algorithm. Defaults to "sha256".
+ */
+export declare function calculateJwkThumbprintUri(key: t.CryptoKey | t.KeyObject | t.JWK, digestAlgorithm?: 'sha256' | 'sha384' | 'sha512'): Promise<string>;
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwks/local.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwks/local.d.ts
new file mode 100644
index 000000000..57057c105
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwks/local.d.ts
@@ -0,0 +1,17 @@
+import type * as t from '../types.d.ts';
+/** A key resolver created by {@link createLocalJWKSet}. */
+export interface LocalJWKSet {
+    (protectedHeader?: t.JWSHeaderParameters, token?: t.FlattenedJWSInput): Promise<t.CryptoKey>;
+    /** Returns a structured clone of the original JSON Web Key Set. */
+    jwks: () => t.JSONWebKeySet;
+}
+/**
+ * Creates a resolver for a locally available JSON Web Key Set. Selection uses the header's "alg"
+ * (Algorithm) and "kid" (Key ID), and respects the JWK's "use" (Public Key Use) and "key_ops" (Key
+ * Operations). Exactly one key must match.
+ *
+ * > Note: Only public signature verification keys are supported, not public encryption keys.
+ *
+ * @param jwks JSON Web Key Set formatted object.
+ */
+export declare function createLocalJWKSet(jwks: t.JSONWebKeySet): LocalJWKSet;
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwks/remote.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwks/remote.d.ts
new file mode 100644
index 000000000..0b7055e84
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwks/remote.d.ts
@@ -0,0 +1,94 @@
+import type * as t from '../types.d.ts';
+/**
+ * Configures a custom fetch implementation for remote JWKS retrieval.
+ *
+ * > Note: Fetch-like libraries may have incompatible TypeScript signatures even when they accept the
+ * > supplied arguments at runtime.
+ */
+export declare const customFetch: unique symbol;
+/** Custom fetch function. Must return HTTP 200 with a JSON JWKS. See {@link customFetch}. */
+export type FetchImplementation = (
+/** JWKS URL, passed as the fetch resource. */
+url: string, 
+/** Options passed to fetch. */
+options: {
+    headers: Headers;
+    method: 'GET';
+    /** See {@link !Request.redirect} */
+    redirect: 'manual';
+    signal: AbortSignal;
+}) => Promise<Response>;
+/**
+ * Symbol used to configure an externally persisted remote JWKS cache.
+ *
+ * > Warning: Only trusted application code must be allowed to write this cache; its keys are trusted for
+ * > signature verification.
+ */
+export declare const jwksCache: unique symbol;
+/** Remote JWKS resolver options. */
+export interface RemoteJWKSetOptions {
+    /**
+     * Timeout (in milliseconds) for the HTTP request. When reached the request will be aborted and
+     * the verification will fail. Must be a non-negative integer. Default is 5000 (5 seconds).
+     */
+    timeoutDuration?: number;
+    /**
+     * Time in milliseconds after a successful fetch before a missing key can trigger another fetch.
+     * Must not be `NaN`. Defaults to 30000 (30 seconds).
+     */
+    cooldownDuration?: number;
+    /**
+     * Maximum age of cached keys in milliseconds. Defaults to 600000 (10 minutes); `Infinity`
+     * disables expiry. Must not be `NaN`.
+     */
+    cacheMaxAge?: number | typeof Infinity;
+    /** Headers to be sent with the HTTP request. */
+    headers?: Record<string, string>;
+    /** See {@link jwksCache}. */
+    [jwksCache]?: JWKSCacheInput;
+    /** See {@link customFetch}. */
+    [customFetch]?: FetchImplementation;
+}
+/** Shape of an externally persisted remote JWKS cache. */
+export interface ExportedJWKSCache {
+    /** Current cached JSON Web Key Set */
+    jwks: t.JSONWebKeySet;
+    /** Last successful fetch, in milliseconds since Unix epoch. */
+    uat: number;
+}
+/** Values accepted by the {@link jwksCache} option. */
+export type JWKSCacheInput = ExportedJWKSCache | Record<string, never>;
+/** A key resolver created by {@link createRemoteJWKSet}. */
+export interface RemoteJWKSet {
+    (protectedHeader?: t.JWSHeaderParameters, token?: t.FlattenedJWSInput): Promise<t.CryptoKey>;
+    /** Whether the cooldown window following the last successful fetch is still in effect. */
+    readonly coolingDown: boolean;
+    /**
+     * Whether the currently cached JSON Web Key Set is within its
+     * {@link RemoteJWKSetOptions.cacheMaxAge}.
+     */
+    readonly fresh: boolean;
+    /** Whether a JSON Web Key Set fetch is currently in flight. */
+    readonly reloading: boolean;
+    /**
+     * Triggers a JSON Web Key Set fetch, bypassing
+     * {@link RemoteJWKSetOptions.cooldownDuration the cooldown}.
+     */
+    reload: () => Promise<void>;
+    /**
+     * Returns a structured clone of the cached JSON Web Key Set, or `undefined` before keys have been
+     * fetched or seeded via {@link jwksCache}.
+     */
+    jwks: () => t.JSONWebKeySet | undefined;
+}
+/**
+ * Creates a resolver for a JSON Web Key Set available at an HTTP(S) URL. Fetches the JSON Web Key
+ * Set when the cache is missing or stale. An unmatched key triggers another fetch only when
+ * `cooldownDuration` has elapsed since the last successful fetch. Selection uses the header's "alg"
+ * and "kid" and respects the JWK's "use" and "key_ops". Exactly one key must match.
+ *
+ * > Note: Only public signature verification keys are supported, not public encryption keys.
+ *
+ * @param url URL to fetch the JSON Web Key Set from.
+ */
+export declare function createRemoteJWKSet(url: URL, options?: RemoteJWKSetOptions): RemoteJWKSet;
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jws/compact/sign.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jws/compact/sign.d.ts
new file mode 100644
index 000000000..15d7e062b
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jws/compact/sign.d.ts
@@ -0,0 +1,20 @@
+import type * as t from '../../types.d.ts';
+/** Builds and signs Compact JWS strings. */
+export declare class CompactSign {
+    #private;
+    /**
+     * Creates a Compact JWS signer.
+     *
+     * @param payload Binary representation of the payload to sign.
+     */
+    constructor(payload: Uint8Array);
+    /** Sets the JWS Protected Header. May only be called once. */
+    setProtectedHeader(protectedHeader: t.CompactJWSHeaderParameters): this;
+    /**
+     * Signs the payload as a Compact JWS.
+     *
+     * @param key Private key or shared secret. See
+     *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+     */
+    sign(key: t.KeyInput, options?: t.SignOptions): Promise<string>;
+}
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jws/compact/verify.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jws/compact/verify.d.ts
new file mode 100644
index 000000000..0f21744cb
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jws/compact/verify.d.ts
@@ -0,0 +1,25 @@
+import type * as t from '../../types.d.ts';
+/** Resolves a key for Compact JWS verification from unverified headers and token data. */
+export interface CompactVerifyGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.CompactJWSHeaderParameters, t.FlattenedJWSInput, KeyType | t.KeyObject | t.JWK> {
+}
+/**
+ * Verifies a Compact JWS signature and decodes its payload.
+ *
+ * @param key Public key or shared secret. See
+ *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ */
+export declare function compactVerify(jws: string | Uint8Array, key: t.KeyInput, options?: t.VerifyOptions): Promise<t.CompactVerifyResult>;
+/**
+ * Verifies a Compact JWS signature and decodes its payload with a dynamically resolved key,
+ * included in the result.
+ *
+ * @param getKey Resolves a public key or shared secret from unverified token data.
+ */
+export declare function compactVerify<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jws: string | Uint8Array, getKey: CompactVerifyGetKey<KeyType>, options?: t.VerifyOptions): Promise<t.CompactVerifyResult & t.ResolvedKey<KeyType>>;
+/**
+ * Verifies a Compact JWS and decodes its payload using a key or key resolver. The result includes
+ * `key` only when a resolver is used.
+ *
+ * @param key Public key or shared secret, or a function resolving one.
+ */
+export declare function compactVerify(jws: string | Uint8Array, key: t.KeyInput | CompactVerifyGetKey, options?: t.VerifyOptions): Promise<t.CompactVerifyResult & Partial<t.ResolvedKey>>;
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jws/flattened/sign.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jws/flattened/sign.d.ts
new file mode 100644
index 000000000..3bc861803
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jws/flattened/sign.d.ts
@@ -0,0 +1,22 @@
+import type * as t from '../../types.d.ts';
+/** Builds and signs Flattened JWS objects. */
+export declare class FlattenedSign {
+    #private;
+    /**
+     * Creates a Flattened JWS signer.
+     *
+     * @param payload Binary representation of the payload to sign.
+     */
+    constructor(payload: Uint8Array);
+    /** Sets the JWS Protected Header. May only be called once. */
+    setProtectedHeader(protectedHeader: t.JWSHeaderParameters): this;
+    /** Sets the JWS Unprotected Header. May only be called once. */
+    setUnprotectedHeader(unprotectedHeader: t.JWSHeaderParameters): this;
+    /**
+     * Signs the payload as a Flattened JWS.
+     *
+     * @param key Private key or shared secret. See
+     *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+     */
+    sign(key: t.KeyInput, options?: t.SignOptions): Promise<t.FlattenedJWS>;
+}
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jws/flattened/verify.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jws/flattened/verify.d.ts
new file mode 100644
index 000000000..151c59b9a
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jws/flattened/verify.d.ts
@@ -0,0 +1,25 @@
+import type * as t from '../../types.d.ts';
+/** Resolves a key for Flattened JWS verification from unverified headers and token data. */
+export interface FlattenedVerifyGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.JWSHeaderParameters, t.FlattenedJWSInput, KeyType | t.KeyObject | t.JWK> {
+}
+/**
+ * Verifies a Flattened JWS signature and decodes its payload.
+ *
+ * @param key Public key or shared secret. See
+ *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ */
+export declare function flattenedVerify(jws: t.FlattenedJWSInput, key: t.KeyInput, options?: t.VerifyOptions): Promise<t.FlattenedVerifyResult>;
+/**
+ * Verifies a Flattened JWS signature and decodes its payload with a dynamically resolved key,
+ * included in the result.
+ *
+ * @param getKey Resolves a public key or shared secret from unverified token data.
+ */
+export declare function flattenedVerify<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jws: t.FlattenedJWSInput, getKey: FlattenedVerifyGetKey<KeyType>, options?: t.VerifyOptions): Promise<t.FlattenedVerifyResult & t.ResolvedKey<KeyType>>;
+/**
+ * Verifies a Flattened JWS and decodes its payload using a key or key resolver. The result includes
+ * `key` only when a resolver is used.
+ *
+ * @param key Public key or shared secret, or a function resolving one.
+ */
+export declare function flattenedVerify(jws: t.FlattenedJWSInput, key: t.KeyInput | FlattenedVerifyGetKey, options?: t.VerifyOptions): Promise<t.FlattenedVerifyResult & Partial<t.ResolvedKey>>;
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jws/general/sign.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jws/general/sign.d.ts
new file mode 100644
index 000000000..ad1cd73dd
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jws/general/sign.d.ts
@@ -0,0 +1,38 @@
+import type * as t from '../../types.d.ts';
+/** Configures an individual signature in a General JWS. */
+export interface Signature {
+    /** Sets the JWS Protected Header. May only be called once. */
+    setProtectedHeader(protectedHeader: t.JWSHeaderParameters): Signature;
+    /** Sets the JWS Unprotected Header. May only be called once. */
+    setUnprotectedHeader(unprotectedHeader: t.JWSHeaderParameters): Signature;
+    /**
+     * Adds another signature to the enclosing {@link GeneralSign} and returns its configuration.
+     *
+     * @param key Private key or shared secret. See
+     *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+     */
+    addSignature(key: t.KeyInput, options?: t.SignOptions): Signature;
+    /** Creates all signatures on the enclosing {@link GeneralSign}, using their configured keys. */
+    sign(): Promise<t.GeneralJWS>;
+    /** Returns the enclosing {@link GeneralSign} instance. */
+    done(): GeneralSign;
+}
+/** Builds and signs General JWS objects. */
+export declare class GeneralSign {
+    #private;
+    /**
+     * Creates a General JWS signer.
+     *
+     * @param payload Binary representation of the payload to sign.
+     */
+    constructor(payload: Uint8Array);
+    /**
+     * Adds a signature and returns its configuration.
+     *
+     * @param key Private key or shared secret. See
+     *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+     */
+    addSignature(key: t.KeyInput, options?: t.SignOptions): Signature;
+    /** Signs the payload as a General JWS. */
+    sign(): Promise<t.GeneralJWS>;
+}
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jws/general/verify.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jws/general/verify.d.ts
new file mode 100644
index 000000000..620325d00
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jws/general/verify.d.ts
@@ -0,0 +1,29 @@
+import type * as t from '../../types.d.ts';
+/** Resolves a key for General JWS verification from unverified headers and token data. */
+export interface GeneralVerifyGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.JWSHeaderParameters, t.FlattenedJWSInput, KeyType | t.KeyObject | t.JWK> {
+}
+/**
+ * Verifies a General JWS signature and decodes its payload.
+ *
+ * > Note: Returns payload and headers from the first signature that verifies successfully. Other entries'
+ * > headers may be inspected to reject inconsistent use of the JWS Unencoded Payload Option, but are
+ * > not included in the result. Rely only on the returned data.
+ *
+ * @param key Public key or shared secret. See
+ *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ */
+export declare function generalVerify(jws: t.GeneralJWSInput, key: t.KeyInput, options?: t.VerifyOptions): Promise<t.GeneralVerifyResult>;
+/**
+ * Verifies a General JWS signature and decodes its payload with a dynamically resolved key,
+ * included in the result.
+ *
+ * @param getKey Resolves a public key or shared secret from unverified token data.
+ */
+export declare function generalVerify<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jws: t.GeneralJWSInput, getKey: GeneralVerifyGetKey<KeyType>, options?: t.VerifyOptions): Promise<t.GeneralVerifyResult & t.ResolvedKey<KeyType>>;
+/**
+ * Verifies a General JWS and decodes its payload using a key or key resolver. The result includes
+ * `key` only when a resolver is used.
+ *
+ * @param key Public key or shared secret, or a function resolving one.
+ */
+export declare function generalVerify(jws: t.GeneralJWSInput, key: t.KeyInput | GeneralVerifyGetKey, options?: t.VerifyOptions): Promise<t.GeneralVerifyResult & Partial<t.ResolvedKey>>;
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwt/decrypt.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwt/decrypt.d.ts
new file mode 100644
index 000000000..cdf6a372a
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwt/decrypt.d.ts
@@ -0,0 +1,34 @@
+import type * as t from '../types.d.ts';
+/** JWE decryption and JWT Claims Set validation options. */
+export interface JWTDecryptOptions extends t.DecryptOptions, t.JWTClaimVerificationOptions {
+}
+/**
+ * Resolves a JWT decryption key. No token components have been authenticated when this function is
+ * called.
+ */
+export interface JWTDecryptGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.CompactJWEHeaderParameters, t.FlattenedJWE, KeyType | t.KeyObject | t.JWK> {
+}
+/**
+ * Decrypts a Compact JWE-formatted JWT and validates its Claims Set.
+ *
+ * @param key Private key or shared secret to decrypt and verify the JWT with. See
+ *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ */
+export declare function jwtDecrypt<PayloadType = t.JWTPayload>(jwt: string | Uint8Array, key: t.KeyInput, options?: JWTDecryptOptions): Promise<t.JWTDecryptResult<PayloadType>>;
+/**
+ * Decrypts a JWT and validates its claims, returning the dynamically
+ * {@link t.ResolvedKey.key resolved key}.
+ *
+ * @param getKey Function resolving a private key or shared secret to decrypt and verify the JWT
+ *   with. See {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ */
+export declare function jwtDecrypt<PayloadType = t.JWTPayload, KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwt: string | Uint8Array, getKey: JWTDecryptGetKey<KeyType>, options?: JWTDecryptOptions): Promise<t.JWTDecryptResult<PayloadType> & t.ResolvedKey<KeyType>>;
+/**
+ * Accepts a key or key resolver. Use this overload when forwarding either form; the result includes
+ * `key` only when a resolver was used.
+ *
+ * @param key Private key or shared secret, or a function resolving one, to decrypt and verify the
+ *   JWT with. See
+ *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ */
+export declare function jwtDecrypt<PayloadType = t.JWTPayload>(jwt: string | Uint8Array, key: t.KeyInput | JWTDecryptGetKey, options?: JWTDecryptOptions): Promise<t.JWTDecryptResult<PayloadType> & Partial<t.ResolvedKey>>;
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwt/encrypt.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwt/encrypt.d.ts
new file mode 100644
index 000000000..c39e4c994
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwt/encrypt.d.ts
@@ -0,0 +1,57 @@
+import type * as t from '../types.d.ts';
+/** @param payload Initial JWT Claims Set. Defaults to an empty object. */
+declare const EncryptJWT_base: new (payload?: t.JWTPayload) => t.ProduceJWT;
+/** Builds and encrypts Compact JWE-formatted JSON Web Tokens. */
+export declare class EncryptJWT extends EncryptJWT_base {
+    #private;
+    /**
+     * Sets the JWE Protected Header. May only be called once.
+     *
+     * @param protectedHeader JWE Protected Header. Must contain an "alg" (JWE Algorithm) and "enc"
+     *   (JWE Encryption Algorithm) properties.
+     */
+    setProtectedHeader(protectedHeader: t.CompactJWEHeaderParameters): this;
+    /**
+     * Sets JWE Key Management parameters, such as ECDH-ES "apu" and "apv" or PBES2 "p2c", and adds
+     * them to the appropriate JOSE Header. Use this instead of the header setters for algorithm
+     * inputs. May only be called once.
+     */
+    setKeyManagementParameters(parameters: t.JWEKeyManagementHeaderParameters): this;
+    /**
+     * Sets the content encryption key. By default, a suitable random key is generated for the JWE
+     * "enc" (Encryption Algorithm). May only be called once.
+     *
+     * @deprecated For testing and vector validation only; allow random generation in production.
+     */
+    setContentEncryptionKey(cek: Uint8Array): this;
+    /**
+     * Sets the Initialization Vector for content encryption. By default, a suitable random IV is
+     * generated for the JWE "enc" (Encryption Algorithm). May only be called once.
+     *
+     * @deprecated For testing and vector validation only; allow random generation in production.
+     */
+    setInitializationVector(iv: Uint8Array): this;
+    /**
+     * Replicates the "iss" (Issuer) Claim in the JWE Protected Header, exposing it without
+     * decryption.
+     */
+    replicateIssuerAsHeader(): this;
+    /**
+     * Replicates the "sub" (Subject) Claim in the JWE Protected Header, exposing it without
+     * decryption.
+     */
+    replicateSubjectAsHeader(): this;
+    /**
+     * Replicates the "aud" (Audience) Claim in the JWE Protected Header, exposing it without
+     * decryption.
+     */
+    replicateAudienceAsHeader(): this;
+    /**
+     * Encrypts and returns the JWT.
+     *
+     * @param key Public key or shared secret to encrypt the JWT with. See
+     *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+     */
+    encrypt(key: t.KeyInput, options?: t.EncryptOptions): Promise<string>;
+}
+export {};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwt/sign.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwt/sign.d.ts
new file mode 100644
index 000000000..67ce10434
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwt/sign.d.ts
@@ -0,0 +1,21 @@
+import type * as t from '../types.d.ts';
+/** @param payload Initial JWT Claims Set. Defaults to an empty object. */
+declare const SignJWT_base: new (payload?: t.JWTPayload) => t.ProduceJWT;
+/** Builds and signs Compact JWS-formatted JSON Web Tokens. */
+export declare class SignJWT extends SignJWT_base {
+    #private;
+    /**
+     * Sets the JWS Protected Header. May only be called once.
+     *
+     * @param protectedHeader JWS Protected Header. Must contain an "alg" (JWS Algorithm) property.
+     */
+    setProtectedHeader(protectedHeader: t.JWTHeaderParameters): this;
+    /**
+     * Signs and returns the JWT.
+     *
+     * @param key Private key or shared secret to sign the JWT with. See
+     *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+     */
+    sign(key: t.KeyInput, options?: t.SignOptions): Promise<string>;
+}
+export {};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwt/unsecured.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwt/unsecured.d.ts
new file mode 100644
index 000000000..6c3454eef
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwt/unsecured.d.ts
@@ -0,0 +1,19 @@
+import type * as t from '../types.d.ts';
+/** Decoded Unsecured JWT. */
+export interface UnsecuredResult<PayloadType = t.JWTPayload> {
+    /** JWT Claims Set. */
+    payload: PayloadType & t.JWTPayload & ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never);
+    /** The decoded JOSE Header; always `{ "alg": "none" }` for an Unsecured JWT. */
+    header: t.JWSHeaderParameters;
+}
+/** @param payload Initial JWT Claims Set. Defaults to an empty object. */
+declare const UnsecuredJWT_base: new (payload?: t.JWTPayload) => t.ProduceJWT;
+/** Encodes and decodes `{ "alg": "none" }` Unsecured JWTs. */
+export declare class UnsecuredJWT extends UnsecuredJWT_base {
+    private jwt;
+    /** Encodes the Unsecured JWT. */
+    encode(): string;
+    /** Decodes an unsecured JWT and validates its claims without authenticating the token. */
+    static decode<PayloadType = t.JWTPayload>(jwt: string, options?: t.JWTClaimVerificationOptions): UnsecuredResult<PayloadType>;
+}
+export {};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwt/verify.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwt/verify.d.ts
new file mode 100644
index 000000000..6c8b2f32b
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/jwt/verify.d.ts
@@ -0,0 +1,35 @@
+import type * as t from '../types.d.ts';
+/** JWS verification and JWT Claims Set validation options. */
+export interface JWTVerifyOptions extends t.VerifyOptions, t.JWTClaimVerificationOptions {
+}
+/**
+ * Resolves a JWT verification key. No token components have been authenticated when this function
+ * is called.
+ */
+export interface JWTVerifyGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.CompactJWSHeaderParameters, t.FlattenedJWSInput, KeyType | t.KeyObject | t.JWK> {
+}
+/**
+ * Verifies a Compact JWS-formatted JWT and validates its Claims Set.
+ *
+ * @param key Public key or shared secret to verify the JWT with. See
+ *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param options JWT Verification and JWT Claims Set validation options.
+ */
+export declare function jwtVerify<PayloadType = t.JWTPayload>(jwt: string | Uint8Array, key: t.KeyInput, options?: JWTVerifyOptions): Promise<t.JWTVerifyResult<PayloadType>>;
+/**
+ * Verifies the JWT signature and claims, returning the resolved key.
+ *
+ * @param getKey Function resolving a public key or shared secret to verify the JWT with. See
+ *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param options JWT Verification and JWT Claims Set validation options.
+ */
+export declare function jwtVerify<PayloadType = t.JWTPayload, KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwt: string | Uint8Array, getKey: JWTVerifyGetKey<KeyType>, options?: JWTVerifyOptions): Promise<t.JWTVerifyResult<PayloadType> & t.ResolvedKey<KeyType>>;
+/**
+ * Accepts a key or key resolver. Use this overload when forwarding either form; the result includes
+ * `key` only when a resolver was used.
+ *
+ * @param key Key, or function resolving a key, to verify the JWT with. See
+ *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param options JWT Verification and JWT Claims Set validation options.
+ */
+export declare function jwtVerify<PayloadType = t.JWTPayload>(jwt: string | Uint8Array, key: t.KeyInput | JWTVerifyGetKey, options?: JWTVerifyOptions): Promise<t.JWTVerifyResult<PayloadType> & Partial<t.ResolvedKey>>;
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/key/export.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/key/export.d.ts
new file mode 100644
index 000000000..bbc7ef7d4
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/key/export.d.ts
@@ -0,0 +1,19 @@
+import type * as t from '../types.d.ts';
+/**
+ * Exports a public key to PEM-encoded SPKI. CryptoKey inputs must be extractable.
+ *
+ * @param key Key to export.
+ */
+export declare function exportSPKI(key: t.CryptoKey | t.KeyObject): Promise<string>;
+/**
+ * Exports a private key to PEM-encoded PKCS#8. CryptoKey inputs must be extractable.
+ *
+ * @param key Key to export.
+ */
+export declare function exportPKCS8(key: t.CryptoKey | t.KeyObject): Promise<string>;
+/**
+ * Exports a key to JWK. CryptoKey inputs must be extractable.
+ *
+ * @param key Key to export.
+ */
+export declare function exportJWK(key: t.CryptoKey | t.KeyObject | Uint8Array): Promise<t.JWK>;
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/key/generate_key_pair.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/key/generate_key_pair.d.ts
new file mode 100644
index 000000000..ecc53339c
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/key/generate_key_pair.d.ts
@@ -0,0 +1,33 @@
+import type * as t from '../types.d.ts';
+/** Algorithms supported by {@link generateKeyPair}, subject to runtime support. */
+export type GenerateKeyPairAlgorithm = 'PS256' | 'PS384' | 'PS512' | 'RS256' | 'RS384' | 'RS512' | 'RSA-OAEP' | 'RSA-OAEP-256' | 'RSA-OAEP-384' | 'RSA-OAEP-512' | 'ES256' | 'ES384' | 'ES512' | 'Ed25519' | 'EdDSA' | 'ML-DSA-44' | 'ML-DSA-65' | 'ML-DSA-87' | 'ECDH-ES' | 'ECDH-ES+A128KW' | 'ECDH-ES+A192KW' | 'ECDH-ES+A256KW' | (string & {});
+/** Generated asymmetric key pair. */
+export interface GenerateKeyPairResult {
+    privateKey: t.CryptoKey;
+    publicKey: t.CryptoKey;
+}
+/** Asymmetric key pair generation options. */
+export interface GenerateKeyPairOptions {
+    /**
+     * EC curve or OKP key subtype. Must be supported by the algorithm and runtime. ECDH-ES defaults
+     * to P-256.
+     */
+    crv?: string;
+    /** RSA modulus length in bits. Must be an integer of at least 2048; defaults to 2048. */
+    modulusLength?: number;
+    /**
+     * Whether the private key is extractable. Defaults to false; the public key is always
+     * extractable.
+     */
+    extractable?: boolean;
+}
+/**
+ * Generates an asymmetric key pair for a JWA algorithm identifier.
+ *
+ * > Note: Private keys are not extractable by default. Set {@link GenerateKeyPairOptions.extractable} to
+ * > export them; public keys are always extractable.
+ *
+ * @param alg JWA Algorithm Identifier to be used with the generated key pair. See
+ *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
+ */
+export declare function generateKeyPair(alg: GenerateKeyPairAlgorithm, options?: GenerateKeyPairOptions): Promise<GenerateKeyPairResult>;
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/key/generate_secret.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/key/generate_secret.d.ts
new file mode 100644
index 000000000..da1db236e
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/key/generate_secret.d.ts
@@ -0,0 +1,30 @@
+import type * as t from '../types.d.ts';
+/** Algorithms supported by {@link generateSecret}, subject to runtime support. */
+export type GenerateSecretAlgorithm = 'HS256' | 'HS384' | 'HS512' | 'A128CBC-HS256' | 'A192CBC-HS384' | 'A256CBC-HS512' | 'A128KW' | 'A192KW' | 'A256KW' | 'A128GCMKW' | 'A192GCMKW' | 'A256GCMKW' | 'A128GCM' | 'A192GCM' | 'A256GCM' | (string & {});
+/**
+ * Maps a JWA algorithm identifier to the value returned by {@link generateSecret}. AES-CBC-HMAC
+ * algorithms return {@link !Uint8Array}; other supported algorithms return
+ * {@link t.CryptoKey CryptoKey}. When the algorithm is not statically known, the result is their
+ * union.
+ */
+export type GeneratedSecret<Alg extends string> = Alg extends 'A128CBC-HS256' | 'A192CBC-HS384' | 'A256CBC-HS512' ? Uint8Array : string extends Alg ? t.CryptoKey | Uint8Array : t.CryptoKey;
+/** Secret generation options. */
+export interface GenerateSecretOptions {
+    /**
+     * Whether the generated CryptoKey is extractable. Defaults to false; has no effect for
+     * A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512, which return raw bytes.
+     */
+    extractable?: boolean;
+}
+/**
+ * Generates a symmetric secret key for a given JWA algorithm identifier.
+ *
+ * > Note: The secret key is generated with `extractable` set to `false` by default.
+ *
+ * > Note: A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 return {@link !Uint8Array} because these secrets
+ * > have no CryptoKey representation.
+ *
+ * @param alg JWA Algorithm Identifier to be used with the generated secret. See
+ *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
+ */
+export declare function generateSecret<Alg extends GenerateSecretAlgorithm>(alg: Alg, options?: GenerateSecretOptions): Promise<GeneratedSecret<Alg>>;
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/key/import.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/key/import.d.ts
new file mode 100644
index 000000000..88ba06a28
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/key/import.d.ts
@@ -0,0 +1,67 @@
+import type * as t from '../types.d.ts';
+/**
+ * Maps a JWK key type to the value returned by {@link importJWK}. An "oct" JWK returns
+ * {@link !Uint8Array}; other supported key types return {@link t.CryptoKey CryptoKey}. A JWK
+ * whose "kty" is not statically known resolves to their union.
+ */
+export type ImportedJWK<JWKType extends t.JWK> = JWKType extends {
+    kty: 'oct';
+} ? Uint8Array : JWKType extends {
+    kty: 'AKP' | 'EC' | 'OKP' | 'RSA';
+} ? t.CryptoKey : t.CryptoKey | Uint8Array;
+/** Key import options. */
+export interface KeyImportOptions {
+    /**
+     * Whether the imported CryptoKey is extractable. Overrides JWK "ext" when set. Without either,
+     * defaults to false for private keys, true otherwise.
+     */
+    extractable?: boolean;
+}
+/**
+ * Imports a PEM-encoded SPKI string as a {@link !CryptoKey}.
+ *
+ * > Note: For RSA keys, use the rsaEncryption OID (1.2.840.113549.1.1.1). The id-RSASSA-PSS OID
+ * > (1.2.840.113549.1.1.10) is not supported by the Web Cryptography API.
+ *
+ * @param spki PEM-encoded SPKI string
+ * @param alg JSON Web Algorithm identifier to be used with the imported key. See
+ *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
+ */
+export declare function importSPKI(spki: string, alg: string, options?: KeyImportOptions): Promise<t.CryptoKey>;
+/**
+ * Imports a PEM-encoded X.509 certificate's public key as a {@link !CryptoKey}.
+ *
+ * > Note: For RSA keys, use the rsaEncryption OID (1.2.840.113549.1.1.1). The id-RSASSA-PSS OID
+ * > (1.2.840.113549.1.1.10) is not supported by the Web Cryptography API.
+ *
+ * @param x509 X.509 certificate string
+ * @param alg JSON Web Algorithm identifier to be used with the imported key. See
+ *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
+ */
+export declare function importX509(x509: string, alg: string, options?: KeyImportOptions): Promise<t.CryptoKey>;
+/**
+ * Imports a PEM-encoded PKCS#8 string as a {@link !CryptoKey}.
+ *
+ * > Note: For RSA keys, use the rsaEncryption OID (1.2.840.113549.1.1.1). The id-RSASSA-PSS OID
+ * > (1.2.840.113549.1.1.10) is not supported by the Web Cryptography API.
+ *
+ * @param pkcs8 PEM-encoded PKCS#8 string
+ * @param alg JSON Web Algorithm identifier to be used with the imported key. See
+ *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
+ */
+export declare function importPKCS8(pkcs8: string, alg: string, options?: KeyImportOptions): Promise<t.CryptoKey>;
+/**
+ * Imports a JWK as a {@link !CryptoKey} or {@link !Uint8Array}. Asymmetric imports require either the
+ * "alg" argument or JWK "alg" parameter. For AKP keys, the JWK "alg" parameter is required and must
+ * match the argument when provided.
+ *
+ * > Note: CryptoKey imports honor the JWK "key_ops" and "ext" parameters.
+ *
+ * > Note: Symmetric JWKs (`kty: "oct"`) return {@link !Uint8Array} instead of CryptoKey.
+ *
+ * @param jwk JSON Web Key.
+ * @param alg JSON Web Algorithm identifier to be used with the imported key. Default is the "alg"
+ *   property on the JWK. See
+ *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
+ */
+export declare function importJWK<JWKType extends t.JWK>(jwk: JWKType, alg?: string, options?: KeyImportOptions): Promise<ImportedJWK<JWKType>>;
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/types.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/types.d.ts
new file mode 100644
index 000000000..9815c018d
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/types.d.ts
@@ -0,0 +1,736 @@
+/** Supported JWS "alg" (Algorithm) Header Parameter values. Availability depends on the runtime. */
+export type JWSAlgorithm =
+  | 'HS256'
+  | 'HS384'
+  | 'HS512'
+  | 'RS256'
+  | 'RS384'
+  | 'RS512'
+  | 'PS256'
+  | 'PS384'
+  | 'PS512'
+  | 'ES256'
+  | 'ES384'
+  | 'ES512'
+  | 'EdDSA'
+  | 'Ed25519'
+  | 'ML-DSA-44'
+  | 'ML-DSA-65'
+  | 'ML-DSA-87'
+  | (string & {})
+
+/** Supported JWE "alg" (Algorithm) Header Parameter values. Availability depends on the runtime. */
+export type JWEKeyManagementAlgorithm =
+  | 'dir'
+  | 'A128KW'
+  | 'A192KW'
+  | 'A256KW'
+  | 'A128GCMKW'
+  | 'A192GCMKW'
+  | 'A256GCMKW'
+  | 'ECDH-ES'
+  | 'ECDH-ES+A128KW'
+  | 'ECDH-ES+A192KW'
+  | 'ECDH-ES+A256KW'
+  | 'RSA-OAEP'
+  | 'RSA-OAEP-256'
+  | 'RSA-OAEP-384'
+  | 'RSA-OAEP-512'
+  | 'PBES2-HS256+A128KW'
+  | 'PBES2-HS384+A192KW'
+  | 'PBES2-HS512+A256KW'
+  | (string & {})
+
+/**
+ * Supported JWE "enc" (Encryption Algorithm) Header Parameter values. Availability depends on the
+ * runtime.
+ */
+export type JWEContentEncryptionAlgorithm =
+  | 'A128CBC-HS256'
+  | 'A192CBC-HS384'
+  | 'A256CBC-HS512'
+  | 'A128GCM'
+  | 'A192GCM'
+  | 'A256GCM'
+  | (string & {})
+
+/** JWK "kty" (Key Type) Parameter values supported by this module. */
+export type JWKKeyType = 'EC' | 'RSA' | 'OKP' | 'AKP' | 'oct' | (string & {})
+
+/**
+ * Generic JSON Web Key Parameters.
+ *
+ * > Note: This is declared as a type alias rather than an interface so that it satisfies the implicit index
+ * > signature of the `JsonWebKey` types shipped by `@types/node` and `lib.dom`.
+ */
+export type JWKParameters = {
+  /** JWK "kty" (Key Type) Parameter */
+  kty?: JWKKeyType
+  /** JWK "alg" (Algorithm) Parameter */
+  alg?: JWSAlgorithm | JWEKeyManagementAlgorithm | JWEContentEncryptionAlgorithm
+  /** Permitted key operations. */
+  key_ops?: string[]
+  /** Whether the key may be exported. */
+  ext?: boolean
+
+  /** JWK "use" (Public Key Use) Parameter */
+  use?: 'sig' | 'enc' | (string & {})
+  /** X.509 certificate chain. */
+  x5c?: string[]
+  /** X.509 certificate SHA-1 thumbprint. */
+  x5t?: string
+  /** X.509 certificate SHA-256 thumbprint. */
+  'x5t#S256'?: string
+  /** X.509 certificate URL. */
+  x5u?: string
+
+  /** JWK "kid" (Key ID) Parameter */
+  kid?: string
+}
+
+/** Convenience interface for public OKP JSON Web Keys. */
+export interface JWK_OKP_Public extends JWKParameters {
+  /** Key pair subtype. */
+  crv: string
+  /** Public key. */
+  x: string
+}
+
+/** Convenience interface for private OKP JSON Web Keys. */
+export interface JWK_OKP_Private extends JWK_OKP_Public {
+  /** Private key. */
+  d: string
+}
+
+/** Convenience interface for public AKP JSON Web Keys. */
+export interface JWK_AKP_Public extends JWKParameters {
+  /** JWK "alg" (Algorithm) Parameter */
+  alg: string
+
+  /** AKP JWK "pub" (The Public key) Parameter */
+  pub: string
+}
+
+/** Convenience interface for private AKP JSON Web Keys. */
+export interface JWK_AKP_Private extends JWK_AKP_Public {
+  /** AKP JWK "priv" (The Private Key) Parameter */
+  priv: string
+}
+
+/** Convenience interface for public EC JSON Web Keys. */
+export interface JWK_EC_Public extends JWKParameters {
+  /** Curve. */
+  crv: string
+  /** Public key X coordinate. */
+  x: string
+  /** Public key Y coordinate. */
+  y: string
+}
+
+/** Convenience interface for private EC JSON Web Keys. */
+export interface JWK_EC_Private extends JWK_EC_Public {
+  /** Private key. */
+  d: string
+}
+
+/** Convenience interface for public RSA JSON Web Keys. */
+export interface JWK_RSA_Public extends JWKParameters {
+  /** Public exponent. */
+  e: string
+  /** Modulus. */
+  n: string
+}
+
+/** Convenience interface for private RSA JSON Web Keys. */
+export interface JWK_RSA_Private extends JWK_RSA_Public {
+  /** Private exponent. */
+  d: string
+  /** First factor CRT exponent. */
+  dp: string
+  /** Second factor CRT exponent. */
+  dq: string
+  /** First prime factor. */
+  p: string
+  /** Second prime factor. */
+  q: string
+  /** First CRT coefficient. */
+  qi: string
+}
+
+/** Convenience interface for "oct" JSON Web Keys. */
+export interface JWK_oct extends JWKParameters {
+  /** Symmetric key value. */
+  k: string
+}
+
+/**
+ * JSON Web Key ({@link https://www.rfc-editor.org/info/rfc7517/ JWK}). "RSA", "EC", "OKP", "AKP",
+ * and "oct" key types are supported.
+ *
+ * > Note: This is declared as a type alias rather than an interface so that it satisfies the implicit index
+ * > signature of the `JsonWebKey` types shipped by `@types/node` and `lib.dom`. It spells out the
+ * > {@link JWKParameters} members rather than intersecting them so that every JWK member is documented
+ * > in one place.
+ */
+export type JWK = {
+  /** JWK "kty" (Key Type) Parameter */
+  kty?: JWKKeyType
+  /** JWK "alg" (Algorithm) Parameter */
+  alg?: JWSAlgorithm | JWEKeyManagementAlgorithm | JWEContentEncryptionAlgorithm
+  /** Permitted key operations. */
+  key_ops?: string[]
+  /** Whether the key may be exported. */
+  ext?: boolean
+
+  /** JWK "use" (Public Key Use) Parameter */
+  use?: 'sig' | 'enc' | (string & {})
+  /** X.509 certificate chain. */
+  x5c?: string[]
+  /** X.509 certificate SHA-1 thumbprint. */
+  x5t?: string
+  /** X.509 certificate SHA-256 thumbprint. */
+  'x5t#S256'?: string
+  /** X.509 certificate URL. */
+  x5u?: string
+
+  /** JWK "kid" (Key ID) Parameter */
+  kid?: string
+  /** EC curve or OKP key pair subtype. */
+  crv?: string
+  /** Private RSA exponent, EC key, or OKP key. */
+  d?: string
+  /** RSA first factor CRT exponent. */
+  dp?: string
+  /** RSA second factor CRT exponent. */
+  dq?: string
+  /** RSA public exponent. */
+  e?: string
+  /** Symmetric key value. */
+  k?: string
+  /** RSA modulus. */
+  n?: string
+  /** RSA first prime factor. */
+  p?: string
+  /** RSA second prime factor. */
+  q?: string
+  /** RSA first CRT coefficient. */
+  qi?: string
+  /** EC public key X coordinate or OKP public key. */
+  x?: string
+  /** EC public key Y coordinate. */
+  y?: string
+
+  /** AKP JWK "pub" (Public Key) Parameter */
+  pub?: string
+
+  /** AKP JWK "priv" (Private key) Parameter */
+  priv?: string
+  /** Additional RSA prime factors. */
+  oth?: Array<{
+    /** Factor CRT exponent. */
+    d?: string
+    /** Prime factor. */
+    r?: string
+    /** Factor CRT coefficient. */
+    t?: string
+  }>
+}
+
+/** Discriminated union of supported JSON Web Key shapes, narrowed by the "kty" (Key Type) Parameter. */
+// Intersect "kty" into each member separately: typedoc omits the parentheses in `X & (A | B)`.
+export type AnyJWK =
+  | (JWK_EC_Private & { kty: 'EC' })
+  | (JWK_EC_Public & { kty: 'EC' })
+  | (JWK_RSA_Private & { kty: 'RSA' })
+  | (JWK_RSA_Public & { kty: 'RSA' })
+  | (JWK_OKP_Private & { kty: 'OKP' })
+  | (JWK_OKP_Public & { kty: 'OKP' })
+  | (JWK_AKP_Private & { kty: 'AKP' })
+  | (JWK_AKP_Public & { kty: 'AKP' })
+  | (JWK_oct & { kty: 'oct' })
+
+/** Key or secret input accepted by all sign, verify, encrypt, and decrypt operations. */
+export type KeyInput = CryptoKey | KeyObject | JWK | Uint8Array
+
+/** Dynamic key resolver for consuming operations. */
+export interface GetKeyFunction<IProtectedHeader, IToken, KeyTypes extends KeyInput = KeyInput> {
+  /**
+   * Resolves a key for an unverified token. Throw if no suitable key can be resolved.
+   *
+   * @param token The consumed JWE or JWS token; none of its components have been verified.
+   */
+  (protectedHeader: IProtectedHeader, token: IToken): Promise<KeyTypes> | KeyTypes
+}
+
+/** Flattened JWS verification input. */
+export interface FlattenedJWSInput {
+  /** JWS Unprotected Header as a JSON object. Not integrity protected; omit when empty. */
+  header?: JWSHeaderParameters
+
+  /** Base64url-encoded payload; with `b64: false`, supply an unencoded string or Uint8Array. */
+  payload: string | Uint8Array
+
+  /** Base64url-encoded UTF-8 JWS Protected Header. Integrity protected; omit when empty. */
+  protected?: string
+
+  /** Base64url-encoded signature or MAC. */
+  signature: string
+}
+
+/** General JWS verification input. */
+export interface GeneralJWSInput {
+  /** Base64url-encoded payload; with `b64: false`, supply an unencoded string or Uint8Array. */
+  payload: string | Uint8Array
+
+  /**
+   * The "signatures" member value MUST be an array of JSON objects. Each object represents a
+   * signature or MAC over the JWS Payload and the JWS Protected Header.
+   */
+  signatures: Omit<FlattenedJWSInput, 'payload'>[]
+}
+
+/**
+ * Flattened JWS JSON Serialization token. The payload is an empty string when the
+ * {@link https://www.rfc-editor.org/info/rfc7797/ unencoded payload option} is used.
+ */
+export interface FlattenedJWS extends Partial<FlattenedJWSInput> {
+  payload: string
+  signature: string
+}
+
+/**
+ * General JWS JSON Serialization token. The payload is an empty string when the
+ * {@link https://www.rfc-editor.org/info/rfc7797/ unencoded payload option} is used.
+ */
+export interface GeneralJWS {
+  payload: string
+  signatures: Omit<FlattenedJWSInput, 'payload'>[]
+}
+
+/** Header Parameters common to JWE and JWS. */
+export interface JoseHeaderParameters {
+  /** "kid" (Key ID) Header Parameter */
+  kid?: string
+
+  /** X.509 certificate SHA-1 thumbprint. */
+  x5t?: string
+
+  /** X.509 certificate chain. */
+  x5c?: string[]
+
+  /** X.509 certificate URL. */
+  x5u?: string
+
+  /** JWK Set URL. */
+  jku?: string
+
+  /** Public JWK only; private and symmetric key parameters are not permitted. */
+  jwk?: Omit<JWK, 'd' | 'dp' | 'dq' | 'k' | 'p' | 'q' | 'qi' | 'priv' | 'oth'>
+
+  /** "typ" (Type) Header Parameter */
+  typ?: string
+
+  /** Content type. */
+  cty?: string
+}
+
+/** Recognized JWS Header Parameters; additional members may also be present. */
+export interface JWSHeaderParameters extends JoseHeaderParameters {
+  /** JWS "alg" (Algorithm) Header Parameter */
+  alg?: JWSAlgorithm
+
+  /**
+   * Controls payload encoding and the JWS signing input as defined by
+   * {@link https://www.rfc-editor.org/info/rfc7797/ RFC7797}. Set to `false` and list `b64` in
+   * `crit` to use an unencoded payload.
+   */
+  b64?: boolean
+
+  /** Extension parameters that must be recognized. */
+  crit?: string[]
+
+  /** Any other JWS Header member. */
+  [propName: string]: unknown
+}
+
+/** Recognized JWE Key Management-related Header Parameters. */
+export interface JWEKeyManagementHeaderParameters {
+  /** ECDH-ES Agreement PartyUInfo bytes, used in ConcatKDF and added to the JOSE header. */
+  apu?: Uint8Array
+
+  /** ECDH-ES Agreement PartyVInfo bytes, used in ConcatKDF and added to the JOSE header. */
+  apv?: Uint8Array
+
+  /** PBES2 PBKDF2 iteration count, added to the JOSE header. */
+  p2c?: number
+
+  /** @deprecated For testing and vector validation only. */
+  p2s?: Uint8Array
+  /** @deprecated For testing and vector validation only. */
+  iv?: Uint8Array
+  /** @deprecated For testing and vector validation only. */
+  epk?: CryptoKey | KeyObject
+}
+
+/** Flattened JWE JSON Serialization token. */
+export interface FlattenedJWE {
+  /**
+   * Base64url-encoded additional authenticated data; integrity protected but not encrypted. Omit
+   * when empty.
+   */
+  aad?: string
+
+  /** Base64url-encoded ciphertext. */
+  ciphertext: string
+
+  /** Base64url-encoded encrypted key. Omit when empty. */
+  encrypted_key?: string
+
+  /**
+   * JWE Per-Recipient Unprotected Header as a JSON object. Not integrity protected; omit when
+   * empty.
+   */
+  header?: JWEHeaderParameters
+
+  /** Base64url-encoded initialization vector. Omit when empty. */
+  iv?: string
+
+  /** Base64url-encoded UTF-8 JWE Protected Header. Integrity protected; omit when empty. */
+  protected?: string
+
+  /** Base64url-encoded authentication tag. Omit when empty. */
+  tag?: string
+
+  /** JWE Shared Unprotected Header as a JSON object. Not integrity protected; omit when empty. */
+  unprotected?: JWEHeaderParameters
+}
+
+/** General JWE JSON Serialization token. */
+export interface GeneralJWE extends Omit<FlattenedJWE, 'encrypted_key' | 'header'> {
+  recipients: Pick<FlattenedJWE, 'encrypted_key' | 'header'>[]
+}
+
+/** Recognized JWE Header Parameters; additional members may also be present. */
+export interface JWEHeaderParameters extends JoseHeaderParameters {
+  /** JWE "alg" (Algorithm) Header Parameter */
+  alg?: JWEKeyManagementAlgorithm
+
+  /** JWE "enc" (Encryption Algorithm) Header Parameter */
+  enc?: JWEContentEncryptionAlgorithm
+
+  /** Extension parameters that must be recognized. */
+  crit?: string[]
+
+  /**
+   * JWE compression algorithm. Only `"DEF"` (DEFLATE) is supported, requiring the runtime's
+   * `CompressionStream` / `DecompressionStream` APIs.
+   */
+  zip?: 'DEF' | (string & {})
+
+  /** Any other JWE Header member. */
+  [propName: string]: unknown
+}
+
+/** Shared "crit" option for signing, verification, encryption, and decryption. */
+export interface CritOption {
+  /**
+   * Recognized "crit" (Critical) Header Parameter names. Set each value to `true` to require
+   * integrity protection, or `false` when protection is optional. The JWS `b64` extension is always
+   * recognized and processed.
+   *
+   * > Warning: Other extensions are only checked for syntax and optional integrity protection. Their presence
+   * > is not required by this option. You must check their presence and process them according to the
+   * > profile's validation steps after the operation succeeds.
+   */
+  crit?: {
+    [propName: string]: boolean
+  }
+}
+
+/** JWE Decryption options. */
+export interface DecryptOptions extends CritOption {
+  /**
+   * Accepted JWE "alg" (Algorithm) Header Parameter values. Defaults to all algorithms applicable
+   * to the key or secret except PBES2, which must be explicitly allowed.
+   */
+  keyManagementAlgorithms?: JWEKeyManagementAlgorithm[]
+
+  /**
+   * Accepted JWE "enc" (Encryption Algorithm) Header Parameter values. Defaults to all algorithms
+   * applicable to the key or secret.
+   */
+  contentEncryptionAlgorithms?: JWEContentEncryptionAlgorithm[]
+
+  /**
+   * Maximum "p2c" (PBES2 Count) Header Parameter value, limiting PBKDF2 iterations and their
+   * computational expense. Defaults to 10000; must be a positive safe integer or `Infinity` to
+   * disable the limit.
+   */
+  maxPBES2Count?: number
+
+  /**
+   * Maximum decompressed plaintext size in bytes. Defaults to 250000; `0` rejects compressed JWEs,
+   * and `Infinity` disables the limit. Other values must be positive safe integers.
+   */
+  maxDecompressedLength?: number
+}
+
+/** JWE Encryption options. */
+export interface EncryptOptions extends CritOption {}
+
+/** JWT Claims Set verification options. */
+export interface JWTClaimVerificationOptions {
+  /** Expected JWT "aud" (Audience) Claim value(s). Requires the claim to be present. */
+  audience?: string | string[]
+
+  /**
+   * Clock skew tolerance in seconds or a duration string (e.g. "5 seconds"). Applies to the "nbf"
+   * (Not Before) and "exp" (Expiration Time) claims, and to "iat" (Issued At) when
+   * {@link maxTokenAge} is set.
+   */
+  clockTolerance?: string | number
+
+  /** Expected JWT "iss" (Issuer) Claim value(s). Requires the claim to be present. */
+  issuer?: string | string[]
+
+  /**
+   * Maximum time since the JWT "iat" (Issued At) Claim, in seconds or a duration string (e.g. "2
+   * hours"). Requires the claim to be present.
+   */
+  maxTokenAge?: string | number
+
+  /** Expected JWT "sub" (Subject) Claim value. Requires the claim to be present. */
+  subject?: string
+
+  /** Expected JWT "typ" (Type) Header Parameter value. Requires the parameter to be present. */
+  typ?: string
+
+  /** Date for NumericDate comparisons. Defaults to `new Date()`. */
+  currentDate?: Date
+
+  /**
+   * Additional claim names required in the JWT Claims Set. The {@link issuer}, {@link audience},
+   * {@link subject}, and {@link maxTokenAge} options independently require "iss", "aud", "sub", and
+   * "iat", respectively.
+   */
+  requiredClaims?: string[]
+}
+
+/** JWS Verification options. */
+export interface VerifyOptions extends CritOption {
+  /**
+   * Accepted JWS "alg" (Algorithm) Header Parameter values. Defaults to all algorithms applicable
+   * to the key or secret. Unsecured JWTs (`alg: "none"`) are never accepted.
+   */
+  algorithms?: JWSAlgorithm[]
+}
+
+/** JWS Signing options. */
+export interface SignOptions extends CritOption {}
+
+/** Recognized JWT Claims Set members; additional members may also be present. */
+export interface JWTPayload {
+  /** JWT Issuer */
+  iss?: string
+
+  /** JWT Subject */
+  sub?: string
+
+  /** JWT Audience */
+  aud?: string | string[]
+
+  /** JWT ID */
+  jti?: string
+
+  /** Not valid before this Unix timestamp in seconds. */
+  nbf?: number
+
+  /** Expiration Unix timestamp in seconds. */
+  exp?: number
+
+  /** Issued-at Unix timestamp in seconds. */
+  iat?: number
+
+  /** Any other JWT Claim Set member. */
+  [propName: string]: unknown
+}
+
+/** Flattened JWE JSON Serialization decryption result. */
+export interface FlattenedDecryptResult {
+  /** JWE Additional Authenticated Data, integrity protected but not encrypted. */
+  additionalAuthenticatedData?: Uint8Array
+
+  /** Plaintext. */
+  plaintext: Uint8Array
+
+  /** JWE Protected Header. */
+  protectedHeader?: JWEHeaderParameters
+
+  /** JWE Shared Unprotected Header. Not integrity protected. */
+  sharedUnprotectedHeader?: JWEHeaderParameters
+
+  /** JWE Per-Recipient Unprotected Header. Not integrity protected. */
+  unprotectedHeader?: JWEHeaderParameters
+}
+
+/** General JWE JSON Serialization decryption result. */
+export interface GeneralDecryptResult extends FlattenedDecryptResult {}
+
+/** Compact JWE decryption result. */
+export interface CompactDecryptResult {
+  /** Plaintext. */
+  plaintext: Uint8Array
+
+  /** JWE Protected Header. */
+  protectedHeader: CompactJWEHeaderParameters
+}
+
+/** Flattened JWS JSON Serialization verification result. */
+export interface FlattenedVerifyResult {
+  /** JWS Payload. */
+  payload: Uint8Array
+
+  /** JWS Protected Header. */
+  protectedHeader?: JWSHeaderParameters
+
+  /** JWS Unprotected Header. Not integrity protected. */
+  unprotectedHeader?: JWSHeaderParameters
+}
+
+/** General JWS JSON Serialization verification result. */
+export interface GeneralVerifyResult extends FlattenedVerifyResult {}
+
+/** Compact JWS verification result. */
+export interface CompactVerifyResult {
+  /** JWS Payload. */
+  payload: Uint8Array
+
+  /** JWS Protected Header. */
+  protectedHeader: CompactJWSHeaderParameters
+}
+
+/** Signed JSON Web Token (JWT) verification result. */
+export interface JWTVerifyResult<PayloadType = JWTPayload> {
+  /** JWT Claims Set. */
+  payload: PayloadType &
+    JWTPayload &
+    ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never)
+
+  /** JWS Protected Header. */
+  protectedHeader: JWTHeaderParameters
+}
+
+/** Encrypted JSON Web Token (JWT) decryption result. */
+export interface JWTDecryptResult<PayloadType = JWTPayload> {
+  /** JWT Claims Set. */
+  payload: PayloadType &
+    JWTPayload &
+    ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never)
+
+  /** JWE Protected Header. */
+  protectedHeader: CompactJWEHeaderParameters
+}
+
+/** Key resolver result metadata. */
+export interface ResolvedKey<KeyType extends CryptoKey | Uint8Array = CryptoKey | Uint8Array> {
+  /** The resolved key, present only when a key resolver is used. */
+  key: KeyType
+}
+
+/** Recognized Compact JWS Header Parameters; additional members may also be present. */
+export interface CompactJWSHeaderParameters extends JWSHeaderParameters {
+  alg: JWSAlgorithm
+}
+
+/** Recognized signed JWT Header Parameters; additional members may also be present. */
+export interface JWTHeaderParameters extends CompactJWSHeaderParameters {
+  b64?: boolean
+}
+
+/** Recognized Compact JWE Header Parameters; additional members may also be present. */
+export interface CompactJWEHeaderParameters extends JWEHeaderParameters {
+  alg: JWEKeyManagementAlgorithm
+  enc: JWEContentEncryptionAlgorithm
+}
+
+/** JSON Web Key Set. */
+export interface JSONWebKeySet {
+  keys: JWK[]
+}
+
+/** Node.js {@link !KeyObject} representation accepted as key input. */
+export interface KeyObject {
+  type: string
+}
+
+/** The runtime's Web Crypto {@link !CryptoKey} representation accepted as key input. */
+export type CryptoKey = typeof globalThis extends {
+  crypto: { subtle: { generateKey(...args: any[]): Promise<infer R> } }
+}
+  ? Extract<R, { type: string }>
+  : CryptoKeyStructuralFallback
+
+/** Structural fallback used when the host {@link !CryptoKey} type cannot be inferred. */
+export interface CryptoKeyStructuralFallback {
+  readonly algorithm: { name: string }
+  readonly extractable: boolean
+  readonly type: string
+  readonly usages: string[]
+}
+
+/** Shared fluent API for JWT-producing classes. */
+export interface ProduceJWT {
+  /**
+   * Set the "iss" (Issuer) Claim.
+   *
+   * @param issuer "Issuer" Claim value to set on the JWT Claims Set.
+   */
+  setIssuer(issuer: string): this
+
+  /**
+   * Set the "sub" (Subject) Claim.
+   *
+   * @param subject "sub" (Subject) Claim value to set on the JWT Claims Set.
+   */
+  setSubject(subject: string): this
+
+  /**
+   * Set the "aud" (Audience) Claim.
+   *
+   * @param audience "aud" (Audience) Claim value to set on the JWT Claims Set.
+   */
+  setAudience(audience: string | string[]): this
+
+  /**
+   * Set the "jti" (JWT ID) Claim.
+   *
+   * @param jwtId "jti" (JWT ID) Claim value to set on the JWT Claims Set.
+   */
+  setJti(jwtId: string): this
+
+  /**
+   * Set the "nbf" (Not Before) Claim. Numbers are Unix timestamps in seconds; Dates are converted
+   * to seconds. Strings are relative to now, using seconds, minutes, hours, days, weeks, or years
+   * (365.25 days; no months). Prefix `-` or suffix `ago` subtracts the duration.
+   *
+   * @param input "nbf" (Not Before) Claim value as a timestamp, Date, or relative duration.
+   */
+  setNotBefore(input: number | string | Date): this
+
+  /**
+   * Set the "exp" (Expiration Time) Claim. Accepts a Unix timestamp in seconds, a Date, or a
+   * duration relative to now using the same formats as {@link setNotBefore}.
+   *
+   * @param input "exp" (Expiration Time) Claim value as a timestamp, Date, or relative duration.
+   */
+  setExpirationTime(input: number | string | Date): this
+
+  /**
+   * Set the "iat" (Issued At) Claim. Defaults to the current Unix timestamp in seconds. Accepts a
+   * Unix timestamp in seconds, a Date, or a duration relative to now using the same formats as
+   * {@link setNotBefore}.
+   *
+   * @param input "iat" (Issued At) Claim value as a timestamp, Date, or relative duration.
+   */
+  setIssuedAt(input?: number | string | Date): this
+}
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/util/base64url.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/util/base64url.d.ts
new file mode 100644
index 000000000..6d8a665fa
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/util/base64url.d.ts
@@ -0,0 +1,16 @@
+/**
+ * Decodes base64url text or its UTF-8 bytes.
+ *
+ * @param input Base64url-encoded string or its UTF-8 bytes.
+ * @returns The decoded bytes.
+ * @throws {TypeError} If the input is not valid base64url. Standard Base64 `+` and `/` are
+ *   rejected.
+ */
+export declare function decode(input: Uint8Array | string): Uint8Array;
+/**
+ * Encodes unpadded base64url; strings are first encoded as UTF-8.
+ *
+ * @param input Bytes or a string to encode. Strings are first encoded as UTF-8.
+ * @returns The unpadded base64url representation of the input.
+ */
+export declare function encode(input: Uint8Array | string): string;
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/util/decode_jwt.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/util/decode_jwt.d.ts
new file mode 100644
index 000000000..63ce31f0e
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/util/decode_jwt.d.ts
@@ -0,0 +1,8 @@
+import type * as t from '../types.d.ts';
+/**
+ * Decodes the Claims Set of a JWT in Compact JWS serialization without checking its signature or
+ * validating claim types and values.
+ *
+ * @returns The parsed JWT Claims Set.
+ */
+export declare function decodeJwt<PayloadType = t.JWTPayload>(jwt: string): PayloadType & t.JWTPayload & ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never);
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/util/decode_protected_header.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/util/decode_protected_header.d.ts
new file mode 100644
index 000000000..2d74643d3
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/util/decode_protected_header.d.ts
@@ -0,0 +1,10 @@
+import type * as t from '../types.d.ts';
+/** JWE and JWS Header Parameters returned by {@link decodeProtectedHeader}. */
+export type ProtectedHeaderParameters = t.JWSHeaderParameters & t.JWEHeaderParameters;
+/**
+ * Decodes the Protected Header of a JWE, JWS, or JWT without authenticating the token.
+ *
+ * @param token Compact token or JSON serialization object with a `protected` member.
+ * @returns The parsed Protected Header.
+ */
+export declare function decodeProtectedHeader(token: string | object): ProtectedHeaderParameters;
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/util/errors.d.ts b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/util/errors.d.ts
new file mode 100644
index 000000000..930a29b9f
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/types/util/errors.d.ts
@@ -0,0 +1,182 @@
+import type * as t from '../types.d.ts';
+/** Stable error codes used by this module. */
+export type JOSEErrorCode = 'ERR_JOSE_ALG_NOT_ALLOWED' | 'ERR_JOSE_GENERIC' | 'ERR_JOSE_NOT_SUPPORTED' | 'ERR_JWE_DECRYPTION_FAILED' | 'ERR_JWE_INVALID' | 'ERR_JWK_INVALID' | 'ERR_JWKS_INVALID' | 'ERR_JWKS_MULTIPLE_MATCHING_KEYS' | 'ERR_JWKS_NO_MATCHING_KEY' | 'ERR_JWKS_TIMEOUT' | 'ERR_JWS_INVALID' | 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED' | 'ERR_JWT_CLAIM_VALIDATION_FAILED' | 'ERR_JWT_EXPIRED' | 'ERR_JWT_INVALID';
+/** Shared details of JWT claim or header validation failures. */
+export interface JWTClaimValidationFailure {
+    /** Claim or header that failed validation. */
+    claim: string;
+    /** Reason code for the validation failure. */
+    reason: JWTClaimValidationReason;
+    /** The parsed JWT Claims Set; validation of other claims may be incomplete. */
+    payload: t.JWTPayload;
+}
+/** Reason codes produced by JWT Claims Set validation. */
+export type JWTClaimValidationReason = 'check_failed' | 'invalid' | 'mismatch' | 'missing' | 'unspecified' | (string & {});
+/** Base class for JOSE errors. */
+export declare class JOSEError extends Error {
+    /** Stable code identifying the error class. */
+    static code: JOSEErrorCode | (string & {});
+    /** Stable code identifying the error class. Use {@link AnyJOSEError} to narrow subclasses by code. */
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * Thrown when JWT claim or header validation fails. Expiration is reported separately as
+ * {@link JWTExpired}.
+ */
+export declare class JWTClaimValidationFailed extends JOSEError implements JWTClaimValidationFailure {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    /** The {@link JWTClaimValidationFailure} details carried by this error. */
+    cause: JWTClaimValidationFailure;
+    /** Claim or header that failed validation. */
+    claim: string;
+    /** Reason code for the validation failure. */
+    reason: JWTClaimValidationReason;
+    /**
+     * The parsed JWT Claims Set; validation of other claims may be incomplete. With
+     * {@link jwt/verify.jwtVerify jwtVerify} and {@link jwt/decrypt.jwtDecrypt jwtDecrypt}, token
+     * authentication precedes claim validation. {@link jwt/unsecured.UnsecuredJWT.decode} does not
+     * authenticate tokens.
+     */
+    payload: t.JWTPayload;
+    constructor(message: string, payload: t.JWTPayload, claim?: string, reason?: JWTClaimValidationReason);
+}
+/** Thrown when a JWT has expired or exceeds the configured maximum token age. */
+export declare class JWTExpired extends JOSEError implements JWTClaimValidationFailure {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    /** The {@link JWTClaimValidationFailure} details carried by this error. */
+    cause: JWTClaimValidationFailure;
+    /** Claim or header that failed validation. */
+    claim: string;
+    /** Reason code for the validation failure. */
+    reason: JWTClaimValidationReason;
+    /**
+     * The parsed JWT Claims Set; validation of other claims may be incomplete. With
+     * {@link jwt/verify.jwtVerify jwtVerify} and {@link jwt/decrypt.jwtDecrypt jwtDecrypt}, token
+     * authentication precedes claim validation. {@link jwt/unsecured.UnsecuredJWT.decode} does not
+     * authenticate tokens.
+     */
+    payload: t.JWTPayload;
+    constructor(message: string, payload: t.JWTPayload, claim?: string, reason?: JWTClaimValidationReason);
+}
+/** Thrown when an algorithm is disallowed by configuration. */
+export declare class JOSEAlgNotAllowed extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when a feature or algorithm is unsupported. */
+export declare class JOSENotSupported extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when JWE ciphertext decryption or authentication fails. */
+export declare class JWEDecryptionFailed extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Thrown when a JWE is invalid. */
+export declare class JWEInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when a JWS is invalid. */
+export declare class JWSInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when a JWT is invalid. */
+export declare class JWTInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when a JWK is invalid. */
+export declare class JWKInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when a JWKS is invalid. */
+export declare class JWKSInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+}
+/** Thrown when no keys match in a JWKS. */
+export declare class JWKSNoMatchingKey extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Thrown when multiple keys match in a JWKS. */
+export declare class JWKSMultipleMatchingKeys extends JOSEError {
+    /**
+     * Yields public keys matching the JWS Header so verification can be attempted with each. See the
+     * {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} and
+     * {@link jwks/local.createLocalJWKSet createLocalJWKSet} examples. Empty on manually constructed
+     * errors.
+     */
+    [Symbol.asyncIterator]: () => AsyncIterableIterator<t.CryptoKey>;
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Thrown when fetching a remote JWKS times out. */
+export declare class JWKSTimeout extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Thrown when JWS signature verification fails. */
+export declare class JWSSignatureVerificationFailed extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Errors thrown during JWT Claims Set validation. */
+export type JWTClaimValidationError = JWTClaimValidationFailed | JWTExpired;
+/**
+ * Discriminated union of specific {@link JOSEError} subclasses, narrowed by `code`. Excludes base
+ * {@link JOSEError} instances; use `instanceof JOSEError` to catch all module errors.
+ */
+export type AnyJOSEError = (JOSEAlgNotAllowed & {
+    code: 'ERR_JOSE_ALG_NOT_ALLOWED';
+}) | (JOSENotSupported & {
+    code: 'ERR_JOSE_NOT_SUPPORTED';
+}) | (JWEDecryptionFailed & {
+    code: 'ERR_JWE_DECRYPTION_FAILED';
+}) | (JWEInvalid & {
+    code: 'ERR_JWE_INVALID';
+}) | (JWKInvalid & {
+    code: 'ERR_JWK_INVALID';
+}) | (JWKSInvalid & {
+    code: 'ERR_JWKS_INVALID';
+}) | (JWKSMultipleMatchingKeys & {
+    code: 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
+}) | (JWKSNoMatchingKey & {
+    code: 'ERR_JWKS_NO_MATCHING_KEY';
+}) | (JWKSTimeout & {
+    code: 'ERR_JWKS_TIMEOUT';
+}) | (JWSInvalid & {
+    code: 'ERR_JWS_INVALID';
+}) | (JWSSignatureVerificationFailed & {
+    code: 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
+}) | (JWTClaimValidationFailed & {
+    code: 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+}) | (JWTExpired & {
+    code: 'ERR_JWT_EXPIRED';
+}) | (JWTInvalid & {
+    code: 'ERR_JWT_INVALID';
+});
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/index.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/index.js
new file mode 100644
index 000000000..a41eeb626
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/index.js
@@ -0,0 +1,70 @@
+import { compactDecrypt } from "./jwe/compact/decrypt.js";
+import { flattenedDecrypt } from "./jwe/flattened/decrypt.js";
+import { generalDecrypt } from "./jwe/general/decrypt.js";
+import { GeneralEncrypt } from "./jwe/general/encrypt.js";
+import { compactVerify } from "./jws/compact/verify.js";
+import { flattenedVerify } from "./jws/flattened/verify.js";
+import { generalVerify } from "./jws/general/verify.js";
+import { jwtVerify } from "./jwt/verify.js";
+import { jwtDecrypt } from "./jwt/decrypt.js";
+import { CompactEncrypt } from "./jwe/compact/encrypt.js";
+import { FlattenedEncrypt } from "./jwe/flattened/encrypt.js";
+import { CompactSign } from "./jws/compact/sign.js";
+import { FlattenedSign } from "./jws/flattened/sign.js";
+import { GeneralSign } from "./jws/general/sign.js";
+import { SignJWT } from "./jwt/sign.js";
+import { EncryptJWT } from "./jwt/encrypt.js";
+import { calculateJwkThumbprint, calculateJwkThumbprintUri } from "./jwk/thumbprint.js";
+import { EmbeddedJWK } from "./jwk/embedded.js";
+import { createLocalJWKSet } from "./jwks/local.js";
+import { createRemoteJWKSet, jwksCache, customFetch } from "./jwks/remote.js";
+import { UnsecuredJWT } from "./jwt/unsecured.js";
+import { exportPKCS8, exportSPKI, exportJWK } from "./key/export.js";
+import { importSPKI, importPKCS8, importX509, importJWK } from "./key/import.js";
+import { decodeProtectedHeader } from "./util/decode_protected_header.js";
+import { decodeJwt } from "./util/decode_jwt.js";
+import * as errors from "./util/errors.js";
+import { generateKeyPair } from "./key/generate_key_pair.js";
+import { generateSecret } from "./key/generate_secret.js";
+import * as base64url from "./util/base64url.js";
+const cryptoRuntime = "WebCryptoAPI";
+export {
+  CompactEncrypt,
+  CompactSign,
+  EmbeddedJWK,
+  EncryptJWT,
+  FlattenedEncrypt,
+  FlattenedSign,
+  GeneralEncrypt,
+  GeneralSign,
+  SignJWT,
+  UnsecuredJWT,
+  base64url,
+  calculateJwkThumbprint,
+  calculateJwkThumbprintUri,
+  compactDecrypt,
+  compactVerify,
+  createLocalJWKSet,
+  createRemoteJWKSet,
+  cryptoRuntime,
+  customFetch,
+  decodeJwt,
+  decodeProtectedHeader,
+  errors,
+  exportJWK,
+  exportPKCS8,
+  exportSPKI,
+  flattenedDecrypt,
+  flattenedVerify,
+  generalDecrypt,
+  generalVerify,
+  generateKeyPair,
+  generateSecret,
+  importJWK,
+  importPKCS8,
+  importSPKI,
+  importX509,
+  jwksCache,
+  jwtDecrypt,
+  jwtVerify
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwe/compact/decrypt.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwe/compact/decrypt.js
new file mode 100644
index 000000000..3c20fe5df
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwe/compact/decrypt.js
@@ -0,0 +1,7 @@
+import { prepareDecrypt, decryptCompact } from "../../lib/jwe_decrypt.js";
+async function compactDecrypt(jwe, key, options) {
+  return decryptCompact(jwe, prepareDecrypt(options), key);
+}
+export {
+  compactDecrypt
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwe/compact/encrypt.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwe/compact/encrypt.js
new file mode 100644
index 000000000..a500eccd6
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwe/compact/encrypt.js
@@ -0,0 +1,26 @@
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
+import { compactJWE, createJWE } from "../../lib/jwe_encrypt.js";
+class CompactEncrypt {
+  #input;
+  constructor(plaintext) {
+    assertUint8Array(plaintext, "plaintext"), this.#input = [plaintext];
+  }
+  setContentEncryptionKey(cek) {
+    return assertNotSet(this.#input[5], "setContentEncryptionKey"), this.#input[5] = cek, this;
+  }
+  setInitializationVector(iv) {
+    return assertNotSet(this.#input[6], "setInitializationVector"), this.#input[6] = iv, this;
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#input[1], "setProtectedHeader"), this.#input[1] = protectedHeader, this;
+  }
+  setKeyManagementParameters(parameters) {
+    return assertNotSet(this.#input[7], "setKeyManagementParameters"), this.#input[7] = parameters, this;
+  }
+  async encrypt(key, options) {
+    return compactJWE(await createJWE([...this.#input], key, options));
+  }
+}
+export {
+  CompactEncrypt
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js
new file mode 100644
index 000000000..cba368907
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js
@@ -0,0 +1,15 @@
+import { JWEInvalid } from "../../util/errors.js";
+import { isObject } from "../../lib/validate.js";
+import { prepareDecrypt, decryptJWE, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE } from "../../lib/jwe_decrypt.js";
+async function flattenedDecrypt(jwe, key, options) {
+  if (!isObject(jwe))
+    throw new JWEInvalid("Flattened JWE must be an object");
+  const shared = snapshotSharedJWE(jwe), [recipient, , error] = snapshotRecipientJWE(jwe);
+  if (!recipient)
+    throw error;
+  const snapshot = { ...shared, ...recipient };
+  return checkRecipient(snapshot), decryptJWE(snapshot, prepareDecrypt(options), key);
+}
+export {
+  flattenedDecrypt
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwe/flattened/encrypt.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwe/flattened/encrypt.js
new file mode 100644
index 000000000..7ee1b91ed
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwe/flattened/encrypt.js
@@ -0,0 +1,35 @@
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
+import { createJWE } from "../../lib/jwe_encrypt.js";
+class FlattenedEncrypt {
+  #input;
+  constructor(plaintext) {
+    assertUint8Array(plaintext, "plaintext"), this.#input = [plaintext];
+  }
+  setKeyManagementParameters(parameters) {
+    return assertNotSet(this.#input[7], "setKeyManagementParameters"), this.#input[7] = parameters, this;
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#input[1], "setProtectedHeader"), this.#input[1] = protectedHeader, this;
+  }
+  setSharedUnprotectedHeader(sharedUnprotectedHeader) {
+    return assertNotSet(this.#input[3], "setSharedUnprotectedHeader"), this.#input[3] = sharedUnprotectedHeader, this;
+  }
+  setUnprotectedHeader(unprotectedHeader) {
+    return assertNotSet(this.#input[2], "setUnprotectedHeader"), this.#input[2] = unprotectedHeader, this;
+  }
+  setAdditionalAuthenticatedData(aad) {
+    return this.#input[4] = aad, this;
+  }
+  setContentEncryptionKey(cek) {
+    return assertNotSet(this.#input[5], "setContentEncryptionKey"), this.#input[5] = cek, this;
+  }
+  setInitializationVector(iv) {
+    return assertNotSet(this.#input[6], "setInitializationVector"), this.#input[6] = iv, this;
+  }
+  async encrypt(key, options) {
+    return createJWE([...this.#input], key, options);
+  }
+}
+export {
+  FlattenedEncrypt
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwe/general/decrypt.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwe/general/decrypt.js
new file mode 100644
index 000000000..dfdb66003
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwe/general/decrypt.js
@@ -0,0 +1,40 @@
+import { prepareDecrypt, shareJWE, decryptJWE, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE } from "../../lib/jwe_decrypt.js";
+import { JWEDecryptionFailed, JWEInvalid } from "../../util/errors.js";
+import { isObject } from "../../lib/validate.js";
+import { JWE, isJWECEKTransport } from "../../lib/jwe_algorithms.js";
+async function generalDecrypt(jwe, key, options) {
+  if (!isObject(jwe))
+    throw new JWEInvalid("General JWE must be an object");
+  const inputRecipients = jwe.recipients;
+  if (!Array.isArray(inputRecipients))
+    throw new JWEInvalid("JWE Recipients missing or incorrect type");
+  const recipients = Array.from(inputRecipients);
+  if (!recipients.every(isObject))
+    throw new JWEInvalid("JWE Recipients missing or incorrect type");
+  if (!recipients.length)
+    throw new JWEInvalid("JWE Recipients has no members");
+  let shared, sharedJwe, token;
+  try {
+    shared = prepareDecrypt(options), sharedJwe = snapshotSharedJWE(jwe), token = shareJWE(sharedJwe);
+  } catch {
+    throw new JWEDecryptionFailed();
+  }
+  const recipientSnapshots = recipients.map((recipient) => snapshotRecipientJWE(recipient));
+  if (recipients.length > 1)
+    for (const [, headerAlg] of recipientSnapshots) {
+      const alg = token[0]?.alg ?? headerAlg ?? sharedJwe.unprotected?.alg, algEntry = typeof alg == "string" ? JWE[alg] : void 0;
+      if (algEntry && !isJWECEKTransport(algEntry))
+        throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
+    }
+  for (const [recipient] of recipientSnapshots)
+    if (recipient)
+      try {
+        const flattened = { ...sharedJwe, ...recipient };
+        return checkRecipient(flattened), await decryptJWE(flattened, shared, key, token);
+      } catch {
+      }
+  throw new JWEDecryptionFailed();
+}
+export {
+  generalDecrypt
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwe/general/encrypt.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwe/general/encrypt.js
new file mode 100644
index 000000000..9fe068a8a
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwe/general/encrypt.js
@@ -0,0 +1,105 @@
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
+import { JWEInvalid } from "../../util/errors.js";
+import { generateCek } from "../../lib/content_encryption.js";
+import { encode as b64u } from "../../util/base64url.js";
+import { checkDisjoint, checkEncryptHeaders, encryptJWE } from "../../lib/jwe_encrypt.js";
+import { encryptKeyManagement } from "../../lib/key_management.js";
+import { isJWECEKTransport, jweAlgorithm } from "../../lib/jwe_algorithms.js";
+class IndividualRecipient {
+  #parent;
+  state;
+  constructor(enc, key, crit) {
+    this.#parent = enc, this.state = [void 0, void 0, key, crit];
+  }
+  setUnprotectedHeader(unprotectedHeader) {
+    return assertNotSet(this.state[0], "setUnprotectedHeader"), this.state[0] = unprotectedHeader, this;
+  }
+  setKeyManagementParameters(parameters) {
+    return assertNotSet(this.state[1], "setKeyManagementParameters"), this.state[1] = parameters, this;
+  }
+  addRecipient(...args) {
+    return this.#parent.addRecipient(...args);
+  }
+  encrypt(...args) {
+    return this.#parent.encrypt(...args);
+  }
+  done() {
+    return this.#parent;
+  }
+}
+class GeneralEncrypt {
+  #plaintext;
+  #recipients = [];
+  #protectedHeader;
+  #unprotectedHeader;
+  #aad;
+  constructor(plaintext) {
+    this.#plaintext = plaintext;
+  }
+  addRecipient(key, options) {
+    const recipient = new IndividualRecipient(this, key, options?.crit);
+    return this.#recipients.push(recipient), recipient;
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+  }
+  setSharedUnprotectedHeader(sharedUnprotectedHeader) {
+    return assertNotSet(this.#unprotectedHeader, "setSharedUnprotectedHeader"), this.#unprotectedHeader = sharedUnprotectedHeader, this;
+  }
+  setAdditionalAuthenticatedData(aad) {
+    return this.#aad = aad, this;
+  }
+  async encrypt() {
+    if (!this.#recipients.length)
+      throw new JWEInvalid("at least one recipient must be added");
+    assertUint8Array(this.#plaintext, "plaintext");
+    const multiple = this.#recipients.length > 1;
+    let enc, protectedHeader = this.#protectedHeader, sharedUnprotectedHeader = this.#unprotectedHeader;
+    const recipients = [];
+    for (const recipient of this.#recipients) {
+      const [unprotectedHeader, keyManagementParameters, key, crit] = recipient.state, input = [
+        this.#plaintext,
+        protectedHeader,
+        unprotectedHeader,
+        sharedUnprotectedHeader,
+        this.#aad,
+        void 0,
+        void 0,
+        keyManagementParameters,
+        crit,
+        multiple
+      ], headers = checkEncryptHeaders(input, void 0, recipients.length > 0);
+      recipients.length || (protectedHeader = input[1], sharedUnprotectedHeader = input[3]), recipients.push([input, headers, key]);
+      const [{ alg, enc: recipientEnc }, , algEntry] = headers;
+      if (multiple && algEntry && !isJWECEKTransport(algEntry))
+        throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
+      if (!enc)
+        enc = recipientEnc;
+      else if (enc !== recipientEnc)
+        throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
+    }
+    for (const [, headers] of recipients)
+      headers[2] ??= jweAlgorithm(headers[0].alg);
+    const [firstInput, firstHeaders, firstKey] = recipients[0], cek = multiple ? generateCek(firstHeaders[1]) : void 0;
+    firstInput[5] = cek;
+    const { encrypted_key, header, ...shared } = await encryptJWE(firstInput, firstHeaders, firstKey), jwe = {
+      ...shared,
+      recipients: [{}]
+    };
+    encrypted_key && (jwe.recipients[0].encrypted_key = encrypted_key), header && (jwe.recipients[0].header = header);
+    for (let i = 1; i < recipients.length; i++) {
+      const [input, [joseHeader, encEntry, algEntry], key] = recipients[i], unprotectedHeader = input[2], [, encryptedKey, parameters] = await encryptKeyManagement(algEntry, encEntry, key, joseHeader, cek, input[7]), target = {
+        encrypted_key: b64u(encryptedKey)
+      };
+      if (unprotectedHeader || parameters) {
+        const header2 = { ...unprotectedHeader, ...parameters };
+        parameters && checkDisjoint(input[1], header2, input[3]), target.header = header2;
+      }
+      jwe.recipients.push(target);
+    }
+    return jwe;
+  }
+}
+export {
+  GeneralEncrypt
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwk/embedded.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwk/embedded.js
new file mode 100644
index 000000000..1e1dd89c4
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwk/embedded.js
@@ -0,0 +1,30 @@
+import { jwkToKey, normalizeJwk } from "../lib/key.js";
+import { jwsAlgorithm } from "../lib/jws_algorithms.js";
+import { isObject } from "../lib/validate.js";
+import { JWSInvalid } from "../util/errors.js";
+async function EmbeddedJWK(protectedHeader, token) {
+  const joseHeader = {
+    ...protectedHeader,
+    ...token?.header
+  };
+  if (!isObject(joseHeader.jwk))
+    throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
+  let jwk;
+  try {
+    jwk = normalizeJwk(joseHeader.jwk);
+  } catch (cause) {
+    throw new JWSInvalid("Invalid Embedded JWK", { cause });
+  }
+  const entry = jwsAlgorithm(joseHeader.alg);
+  if (jwk.use !== void 0 && jwk.use !== "sig")
+    throw new JWSInvalid('Invalid Embedded JWK, its "use" must be "sig" when present');
+  if (jwk.alg !== void 0 && jwk.alg !== entry.alg)
+    throw new JWSInvalid(`Invalid Embedded JWK, its "alg" must be "${entry.alg}" when present`);
+  const key = await jwkToKey(entry, jwk, !0);
+  if (key.type !== "public")
+    throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
+  return key;
+}
+export {
+  EmbeddedJWK
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwk/thumbprint.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwk/thumbprint.js
new file mode 100644
index 000000000..ec93e222e
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwk/thumbprint.js
@@ -0,0 +1,55 @@
+import { digest, encode } from "../lib/buffer_utils.js";
+import { encode as b64u } from "../util/base64url.js";
+import { JOSENotSupported, JWKInvalid } from "../util/errors.js";
+import { isKeyLike, invalidKeyInput, snapshotJwk } from "../lib/key.js";
+import { isObject } from "../lib/validate.js";
+import { exportJWK } from "../key/export.js";
+const check = (value, description) => {
+  if (typeof value != "string" || !value)
+    throw new JWKInvalid(`${description} missing or invalid`);
+};
+async function calculateJwkThumbprint(key, digestAlgorithm) {
+  let jwk;
+  if (isObject(key)) {
+    if (jwk = snapshotJwk(key), typeof jwk.kty != "string")
+      throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+  } else if (isKeyLike(key))
+    jwk = snapshotJwk(await exportJWK(key));
+  else
+    throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+  if (digestAlgorithm ??= "sha256", digestAlgorithm !== "sha256" && digestAlgorithm !== "sha384" && digestAlgorithm !== "sha512")
+    throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
+  let components;
+  switch (jwk.kty) {
+    case "AKP":
+      check(jwk.alg, '"alg" (Algorithm) Parameter'), check(jwk.pub, '"pub" (Public key) Parameter'), components = { alg: jwk.alg, kty: jwk.kty, pub: jwk.pub };
+      break;
+    case "EC":
+      check(jwk.crv, '"crv" (Curve) Parameter'), check(jwk.x, '"x" (X Coordinate) Parameter'), check(jwk.y, '"y" (Y Coordinate) Parameter'), components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
+      break;
+    case "OKP":
+      check(jwk.crv, '"crv" (Subtype of Key Pair) Parameter'), check(jwk.x, '"x" (Public Key) Parameter'), components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x };
+      break;
+    case "RSA":
+      check(jwk.e, '"e" (Exponent) Parameter'), check(jwk.n, '"n" (Modulus) Parameter'), components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
+      break;
+    case "oct":
+      if (typeof jwk.k != "string")
+        throw new JWKInvalid('"k" (Key Value) Parameter missing or invalid');
+      components = { k: jwk.k, kty: jwk.kty };
+      break;
+    default:
+      throw new JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported');
+  }
+  const data = encode(JSON.stringify(components));
+  return b64u(await digest(digestAlgorithm, data));
+}
+async function calculateJwkThumbprintUri(key, digestAlgorithm) {
+  digestAlgorithm ??= "sha256";
+  const thumbprint = await calculateJwkThumbprint(key, digestAlgorithm);
+  return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
+}
+export {
+  calculateJwkThumbprint,
+  calculateJwkThumbprintUri
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwks/local.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwks/local.js
new file mode 100644
index 000000000..448757265
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwks/local.js
@@ -0,0 +1,59 @@
+import { jwkToKey, snapshotJwk } from "../lib/key.js";
+import { JWS } from "../lib/jws_algorithms.js";
+import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys } from "../util/errors.js";
+import { isJwkSet } from "../lib/validate.js";
+function isUsableJWK(jwk, entry, alg, kid) {
+  const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;
+  return (ext === void 0 || typeof ext == "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
+}
+async function importWithAlgCache(cache, jwk, entry) {
+  const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk), { alg } = entry;
+  if (cached[alg] === void 0) {
+    const pending = jwkToKey(entry, jwk, !0).then((key) => {
+      if (key.type !== "public")
+        throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+      return cached[alg] = key, key;
+    }).catch((error) => {
+      throw cached[alg] === pending && delete cached[alg], error;
+    });
+    cached[alg] = pending;
+  }
+  return cached[alg];
+}
+function createLocalJWKSet(jwks) {
+  let snapshot;
+  try {
+    snapshot = structuredClone(jwks);
+  } catch {
+  }
+  if (!isJwkSet(snapshot))
+    throw new JWKSInvalid("JSON Web Key Set malformed");
+  const metadata = snapshot.keys.map((jwk) => {
+    const normalized = snapshotJwk(jwk);
+    return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;
+  }), cached = /* @__PURE__ */ new WeakMap();
+  return Object.defineProperty(async (protectedHeader, token) => {
+    const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == "string" ? JWS[alg] : void 0;
+    if (!entry || entry.secret)
+      throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;
+    if (!length)
+      throw new JWKSNoMatchingKey();
+    if (length !== 1) {
+      const error = new JWKSMultipleMatchingKeys();
+      throw error[Symbol.asyncIterator] = async function* () {
+        for (const jwk2 of candidates)
+          try {
+            yield await importWithAlgCache(cached, jwk2, entry);
+          } catch {
+          }
+      }, error;
+    }
+    return importWithAlgCache(cached, jwk, entry);
+  }, "jwks", {
+    value: () => structuredClone(snapshot)
+  });
+}
+export {
+  createLocalJWKSet
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwks/remote.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwks/remote.js
new file mode 100644
index 000000000..39519f27b
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwks/remote.js
@@ -0,0 +1,101 @@
+import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from "../util/errors.js";
+import { createLocalJWKSet } from "./local.js";
+import { isJwkSet } from "../lib/validate.js";
+function isCloudflareWorkers() {
+  return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
+}
+let USER_AGENT;
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.12");
+const customFetch = /* @__PURE__ */ Symbol();
+async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
+  const response = await fetchImpl(url, {
+    method: "GET",
+    signal,
+    redirect: "manual",
+    headers
+  }).catch((err) => {
+    throw err.name === "TimeoutError" ? new JWKSTimeout() : err;
+  });
+  if (response.status !== 200)
+    throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
+  try {
+    return await response.json();
+  } catch {
+    throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
+  }
+}
+const jwksCache = /* @__PURE__ */ Symbol();
+function isFreshFor(timestamp, duration) {
+  return Number.isFinite(timestamp) && Date.now() < timestamp + duration;
+}
+function validateDuration(value, fallback, option) {
+  if (Number.isNaN(value))
+    throw new TypeError(`"${option}" option must not be NaN`);
+  return typeof value == "number" ? value : fallback;
+}
+function createRemoteJWKSet(url, options) {
+  if (!(url instanceof URL))
+    throw new TypeError("url must be an instance of URL");
+  const href = new URL(url.href).href, opts = options ?? {}, timeoutOption = opts.timeoutDuration;
+  if (typeof timeoutOption == "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0))
+    throw new TypeError('"timeoutDuration" option must be a non-negative integer');
+  const timeoutDuration = typeof timeoutOption == "number" ? timeoutOption : 5e3, cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, "cooldownDuration"), cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, "cacheMaxAge"), headers = new Headers(opts.headers);
+  USER_AGENT && !headers.has("User-Agent") && headers.set("User-Agent", USER_AGENT), headers.has("accept") || headers.set("accept", "application/json, application/jwk-set+json");
+  const fetchImpl = opts[customFetch], cache = opts[jwksCache];
+  let jwksTimestamp, pendingFetch, reloadSequence = 0, appliedSequence = 0, local;
+  if (cache && typeof cache == "object") {
+    const { uat, jwks } = cache;
+    isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks) && (jwksTimestamp = uat, local = createLocalJWKSet(jwks));
+  }
+  const reload = async () => {
+    if (pendingFetch && isCloudflareWorkers() && (pendingFetch = void 0), !pendingFetch) {
+      const sequence = ++reloadSequence, current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {
+        const next = createLocalJWKSet(json);
+        if (sequence <= appliedSequence)
+          return;
+        local = next;
+        const updatedAt = Date.now();
+        cache && (cache.uat = updatedAt, cache.jwks = json), jwksTimestamp = updatedAt, appliedSequence = sequence;
+      }).finally(() => {
+        pendingFetch === current && (pendingFetch = void 0);
+      });
+    }
+    await pendingFetch;
+  };
+  return Object.defineProperties(async (protectedHeader, token) => {
+    (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) && await reload();
+    try {
+      return await local(protectedHeader, token);
+    } catch (err) {
+      if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration))
+        return await reload(), local(protectedHeader, token);
+      throw err;
+    }
+  }, {
+    coolingDown: {
+      get: () => isFreshFor(jwksTimestamp, cooldownDuration),
+      enumerable: !0
+    },
+    fresh: {
+      get: () => isFreshFor(jwksTimestamp, cacheMaxAge),
+      enumerable: !0
+    },
+    reload: {
+      value: reload,
+      enumerable: !0
+    },
+    reloading: {
+      get: () => !!pendingFetch,
+      enumerable: !0
+    },
+    jwks: {
+      value: () => local?.jwks(),
+      enumerable: !0
+    }
+  });
+}
+export {
+  createRemoteJWKSet,
+  customFetch,
+  jwksCache
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jws/compact/sign.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jws/compact/sign.js
new file mode 100644
index 000000000..f3288d2f0
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jws/compact/sign.js
@@ -0,0 +1,20 @@
+import { createCompactSignature } from "../../lib/jws_sign.js";
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
+class CompactSign {
+  #payload;
+  #protectedHeader;
+  constructor(payload) {
+    assertUint8Array(payload, "payload"), this.#payload = payload;
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+  }
+  async sign(key, options) {
+    return createCompactSignature(this.#payload, this.#protectedHeader, options?.crit, key, () => {
+      throw new TypeError("use the flattened module for creating JWS with b64: false");
+    });
+  }
+}
+export {
+  CompactSign
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jws/compact/verify.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jws/compact/verify.js
new file mode 100644
index 000000000..49625ee85
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jws/compact/verify.js
@@ -0,0 +1,8 @@
+import { prepareVerify, verifyCompact } from "../../lib/jws_verify.js";
+async function compactVerify(jws, key, options) {
+  const [result] = await verifyCompact(jws, prepareVerify(options), key);
+  return result;
+}
+export {
+  compactVerify
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jws/flattened/sign.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jws/flattened/sign.js
new file mode 100644
index 000000000..7e321402f
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jws/flattened/sign.js
@@ -0,0 +1,23 @@
+import { createSignature } from "../../lib/jws_sign.js";
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
+class FlattenedSign {
+  #input;
+  constructor(payload) {
+    assertUint8Array(payload, "payload"), this.#input = [payload];
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#input[1], "setProtectedHeader"), this.#input[1] = protectedHeader, this;
+  }
+  setUnprotectedHeader(unprotectedHeader) {
+    return assertNotSet(this.#input[2], "setUnprotectedHeader"), this.#input[2] = unprotectedHeader, this;
+  }
+  async sign(key, options) {
+    const input = [...this.#input];
+    input[3] = options?.crit;
+    const [jws] = await createSignature(input, key);
+    return jws;
+  }
+}
+export {
+  FlattenedSign
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jws/flattened/verify.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jws/flattened/verify.js
new file mode 100644
index 000000000..f4a7c9541
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jws/flattened/verify.js
@@ -0,0 +1,12 @@
+import { JWSInvalid } from "../../util/errors.js";
+import { isObject } from "../../lib/validate.js";
+import { encodeJsonUnencodedPayload, prepareVerify, snapshotJws, verifySignature } from "../../lib/jws_verify.js";
+async function flattenedVerify(jws, key, options) {
+  if (!isObject(jws))
+    throw new JWSInvalid("Flattened JWS must be an object");
+  const snapshot = snapshotJws(jws), [result] = await verifySignature(snapshot, prepareVerify(options), key, encodeJsonUnencodedPayload);
+  return result;
+}
+export {
+  flattenedVerify
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jws/general/sign.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jws/general/sign.js
new file mode 100644
index 000000000..8f76dd00b
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jws/general/sign.js
@@ -0,0 +1,58 @@
+import { createSignature } from "../../lib/jws_sign.js";
+import { JWSInvalid } from "../../util/errors.js";
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
+class IndividualSignature {
+  #parent;
+  state;
+  constructor(sig, key, options) {
+    this.#parent = sig, this.state = [void 0, void 0, key, options?.crit];
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.state[0], "setProtectedHeader"), this.state[0] = protectedHeader, this;
+  }
+  setUnprotectedHeader(unprotectedHeader) {
+    return assertNotSet(this.state[1], "setUnprotectedHeader"), this.state[1] = unprotectedHeader, this;
+  }
+  addSignature(...args) {
+    return this.#parent.addSignature(...args);
+  }
+  sign(...args) {
+    return this.#parent.sign(...args);
+  }
+  done() {
+    return this.#parent;
+  }
+}
+class GeneralSign {
+  #payload;
+  #signatures = [];
+  constructor(payload) {
+    this.#payload = payload;
+  }
+  addSignature(key, options) {
+    const signature = new IndividualSignature(this, key, options);
+    return this.#signatures.push(signature), signature;
+  }
+  async sign() {
+    if (!this.#signatures.length)
+      throw new JWSInvalid("at least one signature must be added");
+    assertUint8Array(this.#payload, "payload");
+    const jws = {
+      signatures: [],
+      payload: ""
+    }, encoded = [];
+    let b64;
+    for (const signature of this.#signatures) {
+      const [protectedHeader, unprotectedHeader, key, crit] = signature.state, [{ payload, ...rest }, signatureB64] = await createSignature([this.#payload, protectedHeader, unprotectedHeader, crit, encoded], key);
+      if (b64 === void 0)
+        b64 = signatureB64, jws.payload = payload;
+      else if (b64 !== signatureB64)
+        throw new JWSInvalid("inconsistent use of JWS Unencoded Payload (RFC7797)");
+      jws.signatures.push(rest);
+    }
+    return jws;
+  }
+}
+export {
+  GeneralSign
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jws/general/verify.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jws/general/verify.js
new file mode 100644
index 000000000..3243408b8
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jws/general/verify.js
@@ -0,0 +1,48 @@
+import { encodeJsonUnencodedPayload, parseProtectedHeader, prepareVerify, snapshotJws, verifySignature } from "../../lib/jws_verify.js";
+import { JWSInvalid, JWSSignatureVerificationFailed } from "../../util/errors.js";
+import { isObject } from "../../lib/validate.js";
+function snapshotSignature(signature, payload) {
+  try {
+    const jws = snapshotJws(signature, [payload]), protectedHeader = parseProtectedHeader(jws.protected), { b64, crit } = protectedHeader;
+    return [
+      jws,
+      protectedHeader,
+      Array.isArray(crit) && crit.includes("b64") ? typeof b64 == "boolean" ? b64 ? 1 : 2 : 0 : 1
+    ];
+  } catch {
+    return;
+  }
+}
+async function generalVerify(jws, key, options) {
+  if (!isObject(jws))
+    throw new JWSInvalid("General JWS must be an object");
+  const { signatures, payload: inputPayload } = jws;
+  if (!Array.isArray(signatures))
+    throw new JWSInvalid("JWS Signatures missing or incorrect type");
+  const signatureEntries = Array.from(signatures);
+  if (!signatureEntries.every(isObject))
+    throw new JWSInvalid("JWS Signatures missing or incorrect type");
+  let shared;
+  try {
+    if (inputPayload === void 0)
+      throw new Error();
+    shared = prepareVerify(options);
+  } catch {
+    throw new JWSSignatureVerificationFailed();
+  }
+  const payload = inputPayload instanceof Uint8Array ? new Uint8Array(inputPayload) : inputPayload, candidates = signatureEntries.map((signature) => snapshotSignature(signature, payload)).filter((candidate) => candidate !== void 0);
+  let modes = 0;
+  for (const [, , mode] of candidates)
+    if (modes |= mode, modes === 3)
+      throw new JWSInvalid("inconsistent use of JWS Unencoded Payload (RFC7797)");
+  for (const candidate of candidates)
+    try {
+      const [result] = await verifySignature(candidate[0], shared, key, encodeJsonUnencodedPayload, candidate[1]);
+      return result;
+    } catch {
+    }
+  throw new JWSSignatureVerificationFailed();
+}
+export {
+  generalVerify
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwt/decrypt.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwt/decrypt.js
new file mode 100644
index 000000000..cfbe4730c
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwt/decrypt.js
@@ -0,0 +1,13 @@
+import { prepareDecrypt, decryptCompact } from "../lib/jwe_decrypt.js";
+import { validateClaimsSet } from "../lib/jwt_claims_set.js";
+import { JWTClaimValidationFailed } from "../util/errors.js";
+async function jwtDecrypt(jwt, key, options) {
+  const { plaintext, ...result } = await decryptCompact(jwt, prepareDecrypt(options), key), { protectedHeader } = result, payload = validateClaimsSet(protectedHeader, plaintext, options);
+  for (const claim of ["iss", "sub", "aud"])
+    if (protectedHeader[claim] !== void 0 && (claim === "aud" ? JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud) : protectedHeader[claim] !== payload[claim]))
+      throw new JWTClaimValidationFailed(`replicated "${claim}" claim header parameter mismatch`, payload, claim, "mismatch");
+  return { payload, ...result };
+}
+export {
+  jwtDecrypt
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwt/encrypt.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwt/encrypt.js
new file mode 100644
index 000000000..c26908857
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwt/encrypt.js
@@ -0,0 +1,45 @@
+import { compactJWE, createJWE } from "../lib/jwe_encrypt.js";
+import { JWTClaimsBuilder, jwtClaim, jwtData } from "../lib/jwt_claims_set.js";
+import { assertNotSet } from "../lib/validate.js";
+const EncryptJWT_base = JWTClaimsBuilder;
+class EncryptJWT extends EncryptJWT_base {
+  #input = [void 0];
+  #replicateIssuerAsHeader;
+  #replicateSubjectAsHeader;
+  #replicateAudienceAsHeader;
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#input[1], "setProtectedHeader"), this.#input[1] = protectedHeader, this;
+  }
+  setKeyManagementParameters(parameters) {
+    return assertNotSet(this.#input[7], "setKeyManagementParameters"), this.#input[7] = parameters, this;
+  }
+  setContentEncryptionKey(cek) {
+    return assertNotSet(this.#input[5], "setContentEncryptionKey"), this.#input[5] = cek, this;
+  }
+  setInitializationVector(iv) {
+    return assertNotSet(this.#input[6], "setInitializationVector"), this.#input[6] = iv, this;
+  }
+  replicateIssuerAsHeader() {
+    return this.#replicateIssuerAsHeader = !0, this;
+  }
+  replicateSubjectAsHeader() {
+    return this.#replicateSubjectAsHeader = !0, this;
+  }
+  replicateAudienceAsHeader() {
+    return this.#replicateAudienceAsHeader = !0, this;
+  }
+  async encrypt(key, options) {
+    const plaintext = jwtData(this);
+    this.#input[1] && (this.#replicateIssuerAsHeader || this.#replicateSubjectAsHeader || this.#replicateAudienceAsHeader) && (this.#input[1] = {
+      ...this.#input[1],
+      iss: this.#replicateIssuerAsHeader ? jwtClaim(this, "iss") : void 0,
+      sub: this.#replicateSubjectAsHeader ? jwtClaim(this, "sub") : void 0,
+      aud: this.#replicateAudienceAsHeader ? jwtClaim(this, "aud") : void 0
+    });
+    const input = [...this.#input];
+    return input[0] = plaintext, compactJWE(await createJWE(input, key, options));
+  }
+}
+export {
+  EncryptJWT
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwt/sign.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwt/sign.js
new file mode 100644
index 000000000..4d5e51c99
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwt/sign.js
@@ -0,0 +1,19 @@
+import { createCompactSignature } from "../lib/jws_sign.js";
+import { JWTInvalid } from "../util/errors.js";
+import { JWTClaimsBuilder, jwtData } from "../lib/jwt_claims_set.js";
+import { assertNotSet } from "../lib/validate.js";
+const SignJWT_base = JWTClaimsBuilder;
+class SignJWT extends SignJWT_base {
+  #protectedHeader;
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+  }
+  async sign(key, options) {
+    return createCompactSignature(jwtData(this), this.#protectedHeader, options?.crit, key, () => {
+      throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+    });
+  }
+}
+export {
+  SignJWT
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwt/unsecured.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwt/unsecured.js
new file mode 100644
index 000000000..0f01cc7a6
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwt/unsecured.js
@@ -0,0 +1,34 @@
+import * as b64u from "../util/base64url.js";
+import { decodeBase64url, parseJoseHeader, JWS_RECOGNIZED, validateB64, validateCrit } from "../lib/validate.js";
+import { JWSInvalid, JWTInvalid } from "../util/errors.js";
+import { validateClaimsSet, JWTClaimsBuilder, jwtData } from "../lib/jwt_claims_set.js";
+const UnsecuredJWT_base = JWTClaimsBuilder;
+class UnsecuredJWT extends UnsecuredJWT_base {
+  encode() {
+    const header = b64u.encode(JSON.stringify({ alg: "none" })), payload = b64u.encode(jwtData(this));
+    return `${header}.${payload}.`;
+  }
+  static decode(jwt, options) {
+    if (typeof jwt != "string")
+      throw new JWTInvalid("Unsecured JWT must be a string");
+    const { 0: encodedHeader, 1: encodedPayload, 2: signature, length } = jwt.split(".");
+    if (length !== 3 || signature !== "")
+      throw new JWTInvalid("Invalid Unsecured JWT");
+    let header, b64;
+    try {
+      header = parseJoseHeader(encodedHeader, JWSInvalid, "JWS Protected Header is invalid");
+      const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, void 0, header, header);
+      b64 = validateB64(header, extensions);
+    } catch (cause) {
+      throw cause instanceof JWSInvalid ? new JWTInvalid("Invalid Unsecured JWT", { cause }) : cause;
+    }
+    if (header.alg !== "none")
+      throw new JWTInvalid("Invalid Unsecured JWT");
+    if (!b64)
+      throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+    return { payload: validateClaimsSet(header, decodeBase64url(encodedPayload, "payload", JWTInvalid), options), header };
+  }
+}
+export {
+  UnsecuredJWT
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwt/verify.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwt/verify.js
new file mode 100644
index 000000000..8e02f3a8d
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/jwt/verify.js
@@ -0,0 +1,13 @@
+import { prepareVerify, verifyCompact } from "../lib/jws_verify.js";
+import { validateClaimsSet } from "../lib/jwt_claims_set.js";
+import { JWTInvalid } from "../util/errors.js";
+async function jwtVerify(jwt, key, options) {
+  const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
+  if (!b64)
+    throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+  const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
+  return { ...verified, payload };
+}
+export {
+  jwtVerify
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/key/export.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/key/export.js
new file mode 100644
index 000000000..49016c5a6
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/key/export.js
@@ -0,0 +1,35 @@
+import { toSPKI as exportPublic, toPKCS8 as exportPrivate } from "../lib/asn1.js";
+import { invalidKeyInput, isCryptoKey, isKeyObject } from "../lib/key.js";
+import { encode as b64u } from "../util/base64url.js";
+function exportSPKI(key) {
+  return exportPublic(key);
+}
+function exportPKCS8(key) {
+  return exportPrivate(key);
+}
+async function exportJWK(key) {
+  if (isKeyObject(key))
+    if (key.type === "secret")
+      key = key.export();
+    else
+      return key.export({ format: "jwk" });
+  if (key instanceof Uint8Array)
+    return {
+      kty: "oct",
+      k: b64u(key)
+    };
+  if (!isCryptoKey(key))
+    throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "Uint8Array"));
+  if (!key.extractable)
+    throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
+  const jwk = await crypto.subtle.exportKey("jwk", key);
+  delete jwk.ext, delete jwk.key_ops, delete jwk.use, jwk.kty !== "AKP" && delete jwk.alg;
+  for (const parameter of Object.keys(jwk))
+    jwk[parameter] === void 0 && delete jwk[parameter];
+  return jwk;
+}
+export {
+  exportJWK,
+  exportPKCS8,
+  exportSPKI
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/key/generate_key_pair.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/key/generate_key_pair.js
new file mode 100644
index 000000000..c687f420d
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/key/generate_key_pair.js
@@ -0,0 +1,35 @@
+import { JOSENotSupported } from "../util/errors.js";
+import { validateExtractableOption } from "../lib/key.js";
+import { keyAlgorithm, unsupportedAlg, algArgument } from "../lib/key_algorithm.js";
+function getModulusLengthOption(options) {
+  const modulusLength = options?.modulusLength ?? 2048;
+  if (typeof modulusLength != "number" || !Number.isInteger(modulusLength) || modulusLength < 2048)
+    throw new JOSENotSupported("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");
+  return modulusLength;
+}
+async function generateKeyPair(alg, options) {
+  const extractable = validateExtractableOption(options?.extractable), entry = keyAlgorithm(alg, algArgument);
+  entry.secret && unsupportedAlg(algArgument);
+  let algorithm;
+  if (entry.resolve) {
+    const crv = options?.crv ?? "P-256";
+    if (!["P-256", "P-384", "P-521", "X25519"].includes(crv))
+      throw new JOSENotSupported("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519");
+    algorithm = entry.resolve({ crv });
+  } else {
+    if (entry.crv !== void 0 && options?.crv !== void 0 && options.crv !== entry.crv)
+      throw new JOSENotSupported(`Invalid or unsupported crv option provided, the only supported value for ${alg} is ${entry.crv}`);
+    algorithm = entry.kty[0] === "RSA" ? {
+      ...entry.subtle,
+      publicExponent: Uint8Array.of(1, 0, 1),
+      modulusLength: getModulusLengthOption(options)
+    } : entry.subtle;
+  }
+  return crypto.subtle.generateKey(algorithm, extractable ?? !1, [
+    ...entry.usages[1],
+    ...entry.usages[0]
+  ]);
+}
+export {
+  generateKeyPair
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/key/generate_secret.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/key/generate_secret.js
new file mode 100644
index 000000000..b085b4919
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/key/generate_secret.js
@@ -0,0 +1,36 @@
+import { unsupportedAlg, algArgument } from "../lib/key_algorithm.js";
+import { validateExtractableOption } from "../lib/key.js";
+async function generateSecret(alg, options) {
+  const extractable = validateExtractableOption(options?.extractable);
+  let length, algorithm, keyUsages;
+  switch (alg) {
+    case "HS256":
+    case "HS384":
+    case "HS512":
+      length = +alg.slice(-3), algorithm = { name: "HMAC", hash: `SHA-${length}`, length }, keyUsages = ["sign", "verify"];
+      break;
+    case "A128CBC-HS256":
+    case "A192CBC-HS384":
+    case "A256CBC-HS512":
+      return crypto.getRandomValues(new Uint8Array(+alg.slice(-3) >> 3));
+    case "A128KW":
+    case "A192KW":
+    case "A256KW":
+      length = +alg.slice(1, 4), algorithm = { name: "AES-KW", length }, keyUsages = ["wrapKey", "unwrapKey"];
+      break;
+    case "A128GCMKW":
+    case "A192GCMKW":
+    case "A256GCMKW":
+    case "A128GCM":
+    case "A192GCM":
+    case "A256GCM":
+      length = +alg.slice(1, 4), algorithm = { name: "AES-GCM", length }, keyUsages = ["encrypt", "decrypt"];
+      break;
+    default:
+      unsupportedAlg(algArgument);
+  }
+  return crypto.subtle.generateKey(algorithm, extractable ?? !1, keyUsages);
+}
+export {
+  generateSecret
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/key/import.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/key/import.js
new file mode 100644
index 000000000..b171ae5de
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/key/import.js
@@ -0,0 +1,53 @@
+import { decode as decodeBase64URL } from "../util/base64url.js";
+import { fromSPKI, fromPKCS8, fromX509 } from "../lib/asn1.js";
+import { jwkToKey, validateExtractableOption, normalizeJwk } from "../lib/key.js";
+import { keyAlgorithm } from "../lib/key_algorithm.js";
+import { JOSENotSupported } from "../util/errors.js";
+import { isObject } from "../lib/validate.js";
+async function importSPKI(spki, alg, options) {
+  if (typeof spki != "string" || spki.indexOf("-----BEGIN PUBLIC KEY-----") !== 0)
+    throw new TypeError('"spki" must be SPKI formatted string');
+  return fromSPKI(spki, alg, options);
+}
+async function importX509(x509, alg, options) {
+  if (typeof x509 != "string" || x509.indexOf("-----BEGIN CERTIFICATE-----") !== 0)
+    throw new TypeError('"x509" must be X.509 formatted string');
+  return fromX509(x509, alg, options);
+}
+async function importPKCS8(pkcs8, alg, options) {
+  if (typeof pkcs8 != "string" || pkcs8.indexOf("-----BEGIN PRIVATE KEY-----") !== 0)
+    throw new TypeError('"pkcs8" must be PKCS#8 formatted string');
+  return fromPKCS8(pkcs8, alg, options);
+}
+async function importJWK(jwk, alg, options) {
+  if (!isObject(jwk))
+    throw new TypeError("JWK must be an object");
+  const normalized = normalizeJwk(jwk), extractable = validateExtractableOption(options?.extractable), { alg: jwkAlg } = normalized;
+  if (alg ??= jwkAlg, normalized.kty !== "oct" && !alg)
+    throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+  switch (normalized.kty) {
+    case "oct":
+      if (typeof normalized.k != "string")
+        throw new TypeError('missing "k" (Key Value) Parameter value');
+      return decodeBase64URL(normalized.k);
+    case "AKP": {
+      if (typeof jwkAlg != "string" || !jwkAlg)
+        throw new TypeError('missing "alg" (Algorithm) Parameter value');
+      if (alg !== jwkAlg)
+        throw new TypeError("JWK alg and alg option value mismatch");
+      return jwkToKey(keyAlgorithm(alg), normalized, extractable);
+    }
+    case "RSA":
+    case "EC":
+    case "OKP":
+      return jwkToKey(keyAlgorithm(alg), normalized, extractable);
+    default:
+      throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+  }
+}
+export {
+  importJWK,
+  importPKCS8,
+  importSPKI,
+  importX509
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/asn1.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/asn1.js
new file mode 100644
index 000000000..51f781b9f
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/asn1.js
@@ -0,0 +1,138 @@
+import { invalidKeyInput, isCryptoKey, isKeyObject, validateExtractableOption } from "./key.js";
+import { encodeBase64, decodeBase64 } from "./buffer_utils.js";
+import { JOSENotSupported } from "../util/errors.js";
+import { keyAlgorithm, unsupportedAlg, algArgument } from "./key_algorithm.js";
+const formatPEM = (b64, descriptor) => {
+  const newlined = (b64.match(/.{1,64}/g) || []).join(`
+`);
+  return `-----BEGIN ${descriptor}-----
+${newlined}
+-----END ${descriptor}-----`;
+}, genericExport = async (keyType, keyFormat, key) => {
+  if (isKeyObject(key)) {
+    if (key.type !== keyType)
+      throw new TypeError(`key is not a ${keyType} key`);
+    return key.export({ format: "pem", type: keyFormat });
+  }
+  if (!isCryptoKey(key))
+    throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject"));
+  if (!key.extractable)
+    throw new TypeError("CryptoKey is not extractable");
+  if (key.type !== keyType)
+    throw new TypeError(`key is not a ${keyType} key`);
+  return formatPEM(encodeBase64(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);
+}, toSPKI = (key) => genericExport("public", "spki", key), toPKCS8 = (key) => genericExport("private", "pkcs8", key), bytesEqual = (a, b) => {
+  if (a.byteLength !== b.length)
+    return !1;
+  for (let i = 0; i < a.byteLength; i++)
+    if (a[i] !== b[i])
+      return !1;
+  return !0;
+}, createASN1State = (data) => ({ data, pos: 0 }), readByte = (state) => {
+  const byte = state.data[state.pos++];
+  if (byte === void 0)
+    throw new Error("Unexpected end of ASN.1 input");
+  return byte;
+}, parseLength = (state) => {
+  const first = readByte(state);
+  if (first & 128) {
+    const lengthOfLen = first & 127;
+    let length = 0;
+    for (let i = 0; i < lengthOfLen; i++)
+      length = length << 8 | readByte(state);
+    return length;
+  }
+  return first;
+}, skipElement = (state, count = 1) => {
+  for (; count-- > 0; ) {
+    state.pos++;
+    const length = parseLength(state);
+    state.pos += length;
+  }
+}, expectTag = (state, expectedTag, errorMessage) => {
+  if (readByte(state) !== expectedTag)
+    throw new Error(errorMessage);
+}, getSubarray = (state, length) => {
+  if (length < 0 || state.pos + length > state.data.length)
+    throw new Error("Unexpected end of ASN.1 input");
+  const result = state.data.subarray(state.pos, state.pos + length);
+  return state.pos += length, result;
+}, parseAlgorithmOID = (state) => {
+  expectTag(state, 6, "Expected algorithm OID");
+  const oidLen = parseLength(state);
+  return getSubarray(state, oidLen);
+};
+function parseKeyHeader(state, keyFormat) {
+  if (expectTag(state, 48, `Invalid ${keyFormat === "spki" ? "SPKI" : "PKCS#8"} structure`), parseLength(state), keyFormat === "pkcs8") {
+    expectTag(state, 2, "Expected version field");
+    const length = parseLength(state);
+    state.pos += length;
+  }
+  expectTag(state, 48, "Expected algorithm identifier"), parseLength(state);
+}
+const parseECAlgorithmIdentifier = (state) => {
+  const algOid = parseAlgorithmOID(state);
+  if (bytesEqual(algOid, [43, 101, 110]))
+    return "X25519";
+  if (!bytesEqual(algOid, [42, 134, 72, 206, 61, 2, 1]))
+    throw new Error("Unsupported key algorithm");
+  expectTag(state, 6, "Expected curve OID");
+  const curveOidLen = parseLength(state), curveOid = getSubarray(state, curveOidLen);
+  if (bytesEqual(curveOid, [42, 134, 72, 206, 61, 3, 1, 7]))
+    return "P-256";
+  if (bytesEqual(curveOid, [43, 129, 4, 0, 34]))
+    return "P-384";
+  if (bytesEqual(curveOid, [43, 129, 4, 0, 35]))
+    return "P-521";
+  throw new Error("Unsupported named curve");
+}, genericImport = async (keyFormat, keyData, alg, options) => {
+  const extractable = validateExtractableOption(options?.extractable), entry = keyAlgorithm(alg, algArgument);
+  entry.secret && unsupportedAlg(algArgument);
+  const isPublic = keyFormat === "spki";
+  let algorithm;
+  if (entry.resolve)
+    try {
+      const state = createASN1State(keyData);
+      parseKeyHeader(state, keyFormat), algorithm = entry.resolve({ crv: parseECAlgorithmIdentifier(state) });
+    } catch {
+      throw new JOSENotSupported("Invalid or unsupported key format");
+    }
+  else
+    algorithm = entry.subtle;
+  return crypto.subtle.importKey(keyFormat, keyData, algorithm, extractable ?? isPublic, entry.usages[isPublic ? 0 : 1]);
+}, processPEMData = (pem, pattern) => decodeBase64(pem.replace(pattern, "")), fromPKCS8 = (pem, alg, options) => {
+  const keyData = processPEMData(pem, /(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);
+  return genericImport("pkcs8", keyData, alg, options);
+}, fromSPKI = (pem, alg, options) => {
+  const keyData = processPEMData(pem, /(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g);
+  return genericImport("spki", keyData, alg, options);
+};
+function spkiFromX509(buf) {
+  const state = createASN1State(buf);
+  expectTag(state, 48, "Invalid certificate structure");
+  const certificateLength = parseLength(state);
+  if (certificateLength < 0 || state.pos + certificateLength > state.data.length)
+    throw new Error("Unexpected end of ASN.1 input");
+  expectTag(state, 48, "Invalid tbsCertificate structure"), parseLength(state), buf[state.pos] === 160 ? skipElement(state, 6) : skipElement(state, 5);
+  const spkiStart = state.pos;
+  expectTag(state, 48, "Invalid SPKI structure");
+  const spkiContentLen = parseLength(state);
+  return buf.subarray(spkiStart, spkiStart + spkiContentLen + (state.pos - spkiStart));
+}
+const fromX509 = (pem, alg, options) => {
+  let spki;
+  try {
+    const certificate = processPEMData(pem, /(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);
+    spki = spkiFromX509(certificate);
+  } catch (cause) {
+    throw new TypeError("Failed to parse the X.509 certificate", { cause });
+  }
+  return genericImport("spki", spki, alg, options);
+};
+export {
+  fromPKCS8,
+  fromSPKI,
+  fromX509,
+  toPKCS8,
+  toSPKI
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/buffer_utils.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/buffer_utils.js
new file mode 100644
index 000000000..b3cad85a9
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -0,0 +1,75 @@
+const encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder("utf-8", { fatal: !0 }), MAX_INT32 = 2 ** 32;
+function concat(...buffers) {
+  const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
+  let i = 0;
+  for (const buffer of buffers)
+    buf.set(buffer, i), i += buffer.length;
+  return buf;
+}
+function writeUInt32BE(buf, value, offset) {
+  if (value < 0 || value >= MAX_INT32)
+    throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);
+  buf.set([value >>> 24, value >>> 16, value >>> 8, value & 255], offset);
+}
+function uint64be(value) {
+  const high = Math.floor(value / MAX_INT32), low = value % MAX_INT32, buf = new Uint8Array(8);
+  return writeUInt32BE(buf, high, 0), writeUInt32BE(buf, low, 4), buf;
+}
+function uint32be(value) {
+  const buf = new Uint8Array(4);
+  return writeUInt32BE(buf, value), buf;
+}
+const NON_ASCII = /[^\x00-\x7f]/;
+function encode(string) {
+  if (typeof string == "string" && string.length >= 128) {
+    if (NON_ASCII.test(string))
+      throw new TypeError("non-ASCII string encountered in encode()");
+    return encoder.encode(string);
+  }
+  const bytes = new Uint8Array(string.length);
+  for (let i = 0; i < string.length; i++) {
+    const code = string.charCodeAt(i);
+    if (code > 127)
+      throw new TypeError("non-ASCII string encountered in encode()");
+    bytes[i] = code;
+  }
+  return bytes;
+}
+function encodeBase64(input, url = !1) {
+  if (Uint8Array.prototype.toBase64)
+    return input.toBase64({ alphabet: url ? "base64url" : "base64", omitPadding: url });
+  const CHUNK_SIZE = 32768, arr = [];
+  for (let i = 0; i < input.length; i += CHUNK_SIZE)
+    arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+  const encoded = btoa(arr.join(""));
+  return url ? encoded.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : encoded;
+}
+function decodeBase64(encoded, url = !1) {
+  if (Uint8Array.fromBase64)
+    return Uint8Array.fromBase64(encoded, { alphabet: url ? "base64url" : "base64" });
+  if (url) {
+    if (encoded.includes("+") || encoded.includes("/"))
+      throw new TypeError("Invalid base64url");
+    encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+  }
+  const binary = atob(encoded), bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++)
+    bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+async function digest(algorithm, data) {
+  const subtleDigest = `SHA-${algorithm.slice(-3)}`;
+  return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
+}
+export {
+  concat,
+  decodeBase64,
+  decoder,
+  digest,
+  encode,
+  encodeBase64,
+  encoder,
+  strictDecoder,
+  uint32be,
+  uint64be
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/content_encryption.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/content_encryption.js
new file mode 100644
index 000000000..1ea355e91
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/content_encryption.js
@@ -0,0 +1,90 @@
+import { concat, uint64be } from "./buffer_utils.js";
+import { rawKey, invalidKeyInput, isCryptoKey } from "./key.js";
+import { JWEDecryptionFailed, JWEInvalid } from "../util/errors.js";
+const generateCek = (enc) => crypto.getRandomValues(new Uint8Array(enc.cekBits >> 3));
+function checkCekLength(cek, expected) {
+  const actual = cek.byteLength << 3;
+  if (actual !== expected)
+    throw new JWEInvalid(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`);
+}
+const generateIv = (enc) => crypto.getRandomValues(new Uint8Array(enc.ivBits >> 3));
+function checkIvLength(enc, iv) {
+  if (iv.length << 3 !== enc.ivBits)
+    throw new JWEInvalid("Invalid Initialization Vector length");
+}
+async function cbcKeySetup(enc, cek, usage) {
+  if (!(cek instanceof Uint8Array))
+    throw new TypeError(invalidKeyInput(cek, "Uint8Array"));
+  const keySize = enc.cekBits >> 1, encKey = await crypto.subtle.importKey("raw", cek.subarray(keySize >> 3), "AES-CBC", !1, [usage]), macKey = await crypto.subtle.importKey("raw", cek.subarray(0, keySize >> 3), {
+    hash: `SHA-${keySize << 1}`,
+    name: "HMAC"
+  }, !1, ["sign"]);
+  return [encKey, macKey, keySize];
+}
+async function cbcHmacTag(macKey, macData, keySize) {
+  return new Uint8Array((await crypto.subtle.sign("HMAC", macKey, macData)).slice(0, keySize >> 3));
+}
+async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
+  const [encKey, macKey, keySize] = await cbcKeySetup(enc, cek, "encrypt"), ciphertext = new Uint8Array(await crypto.subtle.encrypt({
+    iv,
+    name: "AES-CBC"
+  }, encKey, plaintext)), macData = concat(aad, iv, ciphertext, uint64be(aad.length * 8)), tag = await cbcHmacTag(macKey, macData, keySize);
+  return { ciphertext, tag, iv };
+}
+async function timingSafeEqual(a, b) {
+  const algorithm = { name: "HMAC", hash: "SHA-256" }, key = await crypto.subtle.generateKey(algorithm, !1, ["sign", "verify"]), aHmac = await crypto.subtle.sign(algorithm, key, a);
+  return crypto.subtle.verify(algorithm, key, aHmac, b);
+}
+async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
+  const [encKey, macKey, keySize] = await cbcKeySetup(enc, cek, "decrypt"), macData = concat(aad, iv, ciphertext, uint64be(aad.length * 8)), expectedTag = await cbcHmacTag(macKey, macData, keySize);
+  try {
+    if (await timingSafeEqual(tag, expectedTag))
+      return new Uint8Array(await crypto.subtle.decrypt({ iv, name: "AES-CBC" }, encKey, ciphertext));
+  } catch {
+  }
+  throw new JWEDecryptionFailed();
+}
+async function encrypt(enc, plaintext, cek, iv, aad) {
+  if (!isCryptoKey(cek) && !(cek instanceof Uint8Array))
+    throw new TypeError(invalidKeyInput(cek, "CryptoKey", "KeyObject", "Uint8Array", "JSON Web Key"));
+  if (iv ? checkIvLength(enc, iv) : iv = generateIv(enc), cek instanceof Uint8Array && checkCekLength(cek, enc.cekBits), enc.cbc)
+    return cbcEncrypt(enc, plaintext, cek, iv, aad);
+  const encKey = await rawKey(cek, enc.subtle, "encrypt"), encrypted = new Uint8Array(await crypto.subtle.encrypt({
+    additionalData: aad,
+    iv,
+    name: "AES-GCM",
+    tagLength: 128
+  }, encKey, plaintext));
+  return { ciphertext: encrypted.subarray(0, -16), tag: encrypted.subarray(-16), iv };
+}
+async function decrypt(enc, cek, ciphertext, iv, tag, aad) {
+  if (!isCryptoKey(cek) && !(cek instanceof Uint8Array))
+    throw new TypeError(invalidKeyInput(cek, "CryptoKey", "KeyObject", "Uint8Array", "JSON Web Key"));
+  if (!iv)
+    throw new JWEInvalid("JWE Initialization Vector missing");
+  if (!tag)
+    throw new JWEInvalid("JWE Authentication Tag missing");
+  if (!enc.cbc && tag.length !== 16)
+    throw new JWEInvalid("Invalid Authentication Tag length");
+  if (checkIvLength(enc, iv), cek instanceof Uint8Array && checkCekLength(cek, enc.cekBits), enc.cbc)
+    return cbcDecrypt(enc, cek, ciphertext, iv, tag, aad);
+  const encKey = await rawKey(cek, enc.subtle, "decrypt");
+  try {
+    return new Uint8Array(await crypto.subtle.decrypt({
+      additionalData: aad,
+      iv,
+      name: "AES-GCM",
+      tagLength: 128
+    }, encKey, concat(ciphertext, tag)));
+  } catch {
+    throw new JWEDecryptionFailed();
+  }
+}
+export {
+  checkCekLength,
+  checkIvLength,
+  decrypt,
+  encrypt,
+  generateCek,
+  generateIv
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/deflate.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/deflate.js
new file mode 100644
index 000000000..27ffba278
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/deflate.js
@@ -0,0 +1,40 @@
+import { JOSENotSupported, JWEInvalid } from "../util/errors.js";
+import { concat } from "./buffer_utils.js";
+function validateZip(joseHeader, protectedHeader) {
+  if (joseHeader.zip !== void 0 && joseHeader.zip !== "DEF")
+    throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');
+  if (joseHeader.zip !== void 0 && !protectedHeader?.zip)
+    throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');
+}
+function supported(name) {
+  if (typeof globalThis[name] > "u")
+    throw new JOSENotSupported(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${name} API.`);
+}
+async function transform(stream, input, maxLength = 1 / 0) {
+  const writer = stream.writable.getWriter();
+  writer.write(input).catch(() => {
+  }), writer.close().catch(() => {
+  });
+  const chunks = [];
+  let length = 0;
+  const reader = stream.readable.getReader();
+  for (; ; ) {
+    const { value, done } = await reader.read();
+    if (done)
+      break;
+    if (chunks.push(value), length += value.byteLength, maxLength !== 1 / 0 && length > maxLength)
+      throw new JWEInvalid("Decompressed plaintext exceeded the configured limit");
+  }
+  return concat(...chunks);
+}
+async function compress(input) {
+  return supported("CompressionStream"), transform(new CompressionStream("deflate-raw"), input);
+}
+async function decompress(input, maxLength) {
+  return supported("DecompressionStream"), transform(new DecompressionStream("deflate-raw"), input, maxLength);
+}
+export {
+  compress,
+  decompress,
+  validateZip
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jwe_algorithms.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jwe_algorithms.js
new file mode 100644
index 000000000..a87af4eb5
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jwe_algorithms.js
@@ -0,0 +1,116 @@
+import { JOSENotSupported } from "../util/errors.js";
+import { table } from "./key_descriptor.js";
+const wrap = [
+  ["encrypt", "wrapKey"],
+  ["decrypt", "unwrapKey"]
+], derive = [[], ["deriveBits"]], none = [[], []];
+function rsaes(bits) {
+  return {
+    kty: ["RSA"],
+    mode: "key-encryption",
+    subtle: { name: "RSA-OAEP", hash: `SHA-${bits}` },
+    usages: wrap,
+    ops: ["wrapKey", "unwrapKey"]
+  };
+}
+function ecdh(mode) {
+  return {
+    kty: ["EC", "OKP"],
+    mode,
+    subtle: { name: "ECDH" },
+    resolve: ({ kty, crv, asymmetricKeyType }) => {
+      if (crv === "X25519" || asymmetricKeyType === "x25519")
+        return { name: "X25519" };
+      if (kty === "OKP")
+        throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+      return { name: "ECDH", namedCurve: crv };
+    },
+    usages: derive,
+    ops: [void 0, "deriveBits"]
+  };
+}
+function aeskw(bits, gcm = !1) {
+  return {
+    kty: ["oct"],
+    mode: "key-wrapping",
+    secret: !0,
+    subtle: { name: gcm ? "AES-GCM" : "AES-KW", length: bits },
+    usages: none,
+    ops: gcm ? ["encrypt", "decrypt"] : ["wrapKey", "unwrapKey"]
+  };
+}
+function pbes2() {
+  return {
+    kty: ["oct"],
+    mode: "key-wrapping",
+    secret: !0,
+    subtle: { name: "PBKDF2" },
+    usages: none,
+    ops: ["deriveBits", "deriveBits"]
+  };
+}
+const JWE = table({
+  dir: {
+    kty: ["oct"],
+    mode: "direct-encryption",
+    secret: !0,
+    subtle: { name: "AES-GCM" },
+    usages: none,
+    ops: ["encrypt", "decrypt"]
+  },
+  "RSA-OAEP": rsaes(1),
+  "RSA-OAEP-256": rsaes(256),
+  "RSA-OAEP-384": rsaes(384),
+  "RSA-OAEP-512": rsaes(512),
+  "ECDH-ES": ecdh("direct-key-agreement"),
+  "ECDH-ES+A128KW": ecdh("key-agreement-with-key-wrapping"),
+  "ECDH-ES+A192KW": ecdh("key-agreement-with-key-wrapping"),
+  "ECDH-ES+A256KW": ecdh("key-agreement-with-key-wrapping"),
+  A128KW: aeskw(128),
+  A192KW: aeskw(192),
+  A256KW: aeskw(256),
+  A128GCMKW: aeskw(128, !0),
+  A192GCMKW: aeskw(192, !0),
+  A256GCMKW: aeskw(256, !0),
+  "PBES2-HS256+A128KW": pbes2(),
+  "PBES2-HS384+A192KW": pbes2(),
+  "PBES2-HS512+A256KW": pbes2()
+}), contentOps = ["encrypt", "decrypt"];
+function contentEncryption(bits, cbc = !1) {
+  return {
+    kty: ["oct"],
+    secret: !0,
+    subtle: { name: cbc ? "AES-CBC" : "AES-GCM", length: bits },
+    usages: none,
+    ops: contentOps,
+    cekBits: bits,
+    ivBits: cbc ? 128 : 96,
+    cbc
+  };
+}
+const ENC = table({
+  A128GCM: contentEncryption(128),
+  A192GCM: contentEncryption(192),
+  A256GCM: contentEncryption(256),
+  "A128CBC-HS256": contentEncryption(256, !0),
+  "A192CBC-HS384": contentEncryption(384, !0),
+  "A256CBC-HS512": contentEncryption(512, !0)
+});
+function unsupported(parameter, name) {
+  throw new JOSENotSupported(`Invalid or unsupported "${parameter}" (JWE ${name}) header value`);
+}
+function jweAlgorithm(alg) {
+  return (typeof alg == "string" ? JWE[alg] : void 0) ?? unsupported("alg", "Algorithm");
+}
+function isJWECEKTransport(algorithm) {
+  return algorithm.mode === "key-wrapping" || algorithm.mode === "key-encryption" || algorithm.mode === "key-agreement-with-key-wrapping";
+}
+function jweEncryption(enc) {
+  return (typeof enc == "string" ? ENC[enc] : void 0) ?? unsupported("enc", "Encryption Algorithm");
+}
+export {
+  JWE,
+  isJWECEKTransport,
+  jweAlgorithm,
+  jweEncryption
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jwe_decrypt.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jwe_decrypt.js
new file mode 100644
index 000000000..e5453b9ba
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jwe_decrypt.js
@@ -0,0 +1,187 @@
+import { decrypt, generateCek } from "./content_encryption.js";
+import { decodeBase64url, encodeBase64url, parseJoseHeader, isDisjoint, isObject, validateCrit, validateAlgorithms, JWE_RECOGNIZED } from "./validate.js";
+import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from "../util/errors.js";
+import { decryptKeyManagement } from "./key_management.js";
+import { decoder } from "./buffer_utils.js";
+import { prepareKey } from "./key.js";
+import { JWE, isJWECEKTransport, jweAlgorithm, jweEncryption } from "./jwe_algorithms.js";
+import { decompress, validateZip } from "./deflate.js";
+function snapshotSharedJWE(jwe) {
+  const { aad, ciphertext, iv, protected: encodedProtected, tag, unprotected } = jwe;
+  if (iv !== void 0 && (typeof iv != "string" || !iv))
+    throw new JWEInvalid("JWE Initialization Vector incorrect type");
+  if (typeof ciphertext != "string")
+    throw new JWEInvalid("JWE Ciphertext missing or incorrect type");
+  if (tag !== void 0 && (typeof tag != "string" || !tag))
+    throw new JWEInvalid("JWE Authentication Tag incorrect type");
+  if (encodedProtected !== void 0 && typeof encodedProtected != "string")
+    throw new JWEInvalid("JWE Protected Header incorrect type");
+  if (aad !== void 0 && (typeof aad != "string" || !aad))
+    throw new JWEInvalid("JWE AAD incorrect type");
+  if (unprotected !== void 0 && !isObject(unprotected))
+    throw new JWEInvalid("JWE Shared Unprotected Header incorrect type");
+  return {
+    aad,
+    ciphertext,
+    iv,
+    protected: encodedProtected,
+    tag,
+    unprotected: unprotected === void 0 ? void 0 : { ...unprotected }
+  };
+}
+function snapshotRecipientJWE(recipient) {
+  let header, headerAlg;
+  try {
+    const { header: inputHeader } = recipient;
+    if (isObject(inputHeader)) {
+      headerAlg = inputHeader.alg;
+      const parameters = Object.keys(inputHeader);
+      parameters.includes("alg") || (headerAlg = void 0), header = Object.fromEntries(parameters.map((parameter) => [
+        parameter,
+        parameter === "alg" ? headerAlg : inputHeader[parameter]
+      ]));
+    } else
+      header = inputHeader;
+    const { encrypted_key: encryptedKey } = recipient;
+    return [{ encrypted_key: encryptedKey, header }, headerAlg];
+  } catch (error) {
+    return [void 0, headerAlg, error];
+  }
+}
+function checkRecipient(jwe) {
+  const { encrypted_key: encryptedKey, header } = jwe;
+  if (encryptedKey !== void 0 && typeof encryptedKey != "string")
+    throw new JWEInvalid("JWE Encrypted Key incorrect type");
+  if (header !== void 0 && !isObject(header))
+    throw new JWEInvalid("JWE Per-Recipient Unprotected Header incorrect type");
+  if (jwe.protected === void 0 && header === void 0 && jwe.unprotected === void 0)
+    throw new JWEInvalid("JOSE Header missing");
+}
+function shareJWE(jwe) {
+  const { protected: encodedProtected, ciphertext, iv, tag, aad } = jwe;
+  let parsedProt;
+  return encodedProtected !== void 0 && (parsedProt = parseJoseHeader(encodedProtected, JWEInvalid, "JWE Protected Header is invalid")), [
+    parsedProt,
+    decodeBase64url(ciphertext, "ciphertext", JWEInvalid),
+    iv !== void 0 ? decodeBase64url(iv, "iv", JWEInvalid) : void 0,
+    tag !== void 0 ? decodeBase64url(tag, "tag", JWEInvalid) : void 0,
+    encodeBase64url((encodedProtected ?? "") + (aad !== void 0 ? `.${aad}` : ""), "aad", JWEInvalid)
+  ];
+}
+function prepareDecrypt(options) {
+  return [
+    options && validateAlgorithms("keyManagementAlgorithms", options.keyManagementAlgorithms),
+    options && validateAlgorithms("contentEncryptionAlgorithms", options.contentEncryptionAlgorithms),
+    options?.crit,
+    options?.maxPBES2Count,
+    options?.maxDecompressedLength
+  ];
+}
+async function decryptJWE(jwe, shared, key, token = shareJWE(jwe)) {
+  const [parsedProt, ciphertext, iv, tag, additionalData] = token, { header, unprotected, aad } = jwe;
+  let joseHeader;
+  if (header !== void 0 || unprotected !== void 0) {
+    if (!isDisjoint(parsedProt, header, unprotected))
+      throw new JWEInvalid("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");
+    joseHeader = { ...parsedProt, ...header, ...unprotected };
+  } else
+    joseHeader = parsedProt ?? {};
+  const [keyManagementAlgorithms, contentEncryptionAlgorithms, crit, maxPBES2Count, maxDecompressedLength] = shared, { encrypted_key: encodedKey } = jwe;
+  validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, parsedProt, joseHeader), validateZip(joseHeader, parsedProt);
+  const { alg, enc } = joseHeader;
+  if (typeof alg != "string" || !alg)
+    throw new JWEInvalid("missing JWE Algorithm (alg) in JWE Header");
+  const selected = JWE[alg];
+  if (encodedKey === "" && (!selected || !isJWECEKTransport(selected)))
+    throw new JWEInvalid("JWE Encrypted Key incorrect type");
+  const integrated = selected?.mode === "integrated-encryption";
+  if (!integrated && (typeof enc != "string" || !enc))
+    throw new JWEInvalid("missing JWE Encryption Algorithm (enc) in JWE Header");
+  if (keyManagementAlgorithms && !keyManagementAlgorithms.has(alg) || !keyManagementAlgorithms && alg.startsWith("PBES2"))
+    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+  let encEntry;
+  if (integrated) {
+    if (enc !== void 0)
+      throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption');
+    if (iv?.byteLength)
+      throw new JWEInvalid("JWE Initialization Vector must be empty for integrated encryption");
+    if (tag?.byteLength)
+      throw new JWEInvalid("JWE Authentication Tag must be empty for integrated encryption");
+  } else {
+    if (contentEncryptionAlgorithms && !contentEncryptionAlgorithms.has(enc))
+      throw new JOSEAlgNotAllowed('"enc" (Encryption Algorithm) Header Parameter value not allowed');
+    encEntry = jweEncryption(enc);
+  }
+  let encryptedKey;
+  if (encodedKey !== void 0)
+    try {
+      encryptedKey = decodeBase64url(encodedKey, "encrypted_key", JWEInvalid);
+    } catch (error) {
+      if (!selected || !isJWECEKTransport(selected))
+        throw error;
+      encryptedKey = new Uint8Array();
+    }
+  let resolvedKey = !1;
+  typeof key == "function" && (key = await key(parsedProt, jwe), resolvedKey = !0);
+  const algEntry = selected ?? jweAlgorithm(alg);
+  isJWECEKTransport(algEntry) && encryptedKey === void 0 && (encryptedKey = new Uint8Array());
+  const k = await prepareKey(algEntry.mode === "direct-encryption" ? encEntry : algEntry, key, "decrypt");
+  let plaintext;
+  if (algEntry.mode === "integrated-encryption")
+    plaintext = await algEntry.decrypt(k, encryptedKey, ciphertext, additionalData, parsedProt, joseHeader);
+  else {
+    const encryption = encEntry;
+    let cek;
+    try {
+      cek = await decryptKeyManagement(algEntry, encryption, k, encryptedKey, joseHeader, maxPBES2Count), isJWECEKTransport(algEntry) && cek instanceof Uint8Array && cek.byteLength << 3 !== encryption.cekBits && (cek = generateCek(encryption));
+    } catch (err) {
+      if (err instanceof TypeError || err instanceof JWEInvalid || err instanceof JOSENotSupported)
+        throw err;
+      cek = generateCek(encryption);
+    }
+    plaintext = await decrypt(encryption, cek, ciphertext, iv, tag, additionalData);
+  }
+  if (joseHeader.zip === "DEF") {
+    const decompressionLimit = maxDecompressedLength ?? 25e4;
+    if (decompressionLimit === 0)
+      throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
+    if (decompressionLimit !== 1 / 0 && (!Number.isSafeInteger(decompressionLimit) || decompressionLimit < 1))
+      throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");
+    plaintext = await decompress(plaintext, decompressionLimit).catch((cause) => {
+      throw cause instanceof JWEInvalid ? cause : new JWEInvalid("Failed to decompress plaintext", { cause });
+    });
+  }
+  return {
+    plaintext,
+    ...parsedProt && { protectedHeader: parsedProt },
+    ...aad !== void 0 && {
+      additionalAuthenticatedData: decodeBase64url(aad, "aad", JWEInvalid)
+    },
+    ...unprotected && { sharedUnprotectedHeader: unprotected },
+    ...header && { unprotectedHeader: header },
+    ...resolvedKey && { key: k }
+  };
+}
+async function decryptCompact(jwe, shared, key) {
+  if (jwe instanceof Uint8Array && (jwe = decoder.decode(jwe)), typeof jwe != "string")
+    throw new JWEInvalid("Compact JWE must be a string or Uint8Array");
+  const { 0: protectedHeader, 1: encryptedKey, 2: iv, 3: ciphertext, 4: tag, length } = jwe.split(".");
+  if (length !== 5)
+    throw new JWEInvalid("Invalid Compact JWE");
+  return decryptJWE({
+    ciphertext,
+    iv: iv || void 0,
+    protected: protectedHeader,
+    tag: tag || void 0,
+    encrypted_key: encryptedKey || void 0
+  }, shared, key);
+}
+export {
+  checkRecipient,
+  decryptCompact,
+  decryptJWE,
+  prepareDecrypt,
+  shareJWE,
+  snapshotRecipientJWE,
+  snapshotSharedJWE
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jwe_encrypt.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jwe_encrypt.js
new file mode 100644
index 000000000..5ab33766b
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jwe_encrypt.js
@@ -0,0 +1,75 @@
+import { encode as b64u } from "../util/base64url.js";
+import { encrypt } from "./content_encryption.js";
+import { encryptKeyManagement } from "./key_management.js";
+import { JWEInvalid } from "../util/errors.js";
+import { assertUint8Array, isDisjoint, isObject, serializeJoseHeader, validateCrit, validateCritDuplicates, JWE_RECOGNIZED } from "./validate.js";
+import { encode } from "./buffer_utils.js";
+import { prepareKey } from "./key.js";
+import { JWE, jweAlgorithm, jweEncryption } from "./jwe_algorithms.js";
+import { compress, validateZip } from "./deflate.js";
+function checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader) {
+  if (!isDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader))
+    throw new JWEInvalid("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");
+}
+function checkEncryptHeaders(input, options, sharedHeadersNormalized = !1) {
+  if (!input[1] && !input[2] && !input[3])
+    throw new JWEInvalid("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");
+  options !== void 0 && (input[8] = options?.crit);
+  let [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, aad, cek, iv, keyManagementParameters, crit] = input;
+  if (aad !== void 0 && assertUint8Array(aad, "JWE Additional Authenticated Data"), cek !== void 0 && assertUint8Array(cek, "JWE Content Encryption Key"), iv !== void 0 && assertUint8Array(iv, "JWE Initialization Vector"), !sharedHeadersNormalized && protectedHeader !== void 0 && (protectedHeader = serializeJoseHeader(JWEInvalid, protectedHeader)[0], input[1] = protectedHeader), unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWEInvalid, unprotectedHeader)[0], input[2] = unprotectedHeader), !sharedHeadersNormalized && sharedUnprotectedHeader !== void 0 && (sharedUnprotectedHeader = serializeJoseHeader(JWEInvalid, sharedUnprotectedHeader)[0], input[3] = sharedUnprotectedHeader), keyManagementParameters !== void 0 && !isObject(keyManagementParameters))
+    throw new TypeError("JWE Key Management Parameters must be an object");
+  checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);
+  const joseHeader = {
+    ...protectedHeader,
+    ...unprotectedHeader,
+    ...sharedUnprotectedHeader
+  };
+  validateCritDuplicates(JWEInvalid, protectedHeader), validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, protectedHeader, joseHeader), validateZip(joseHeader, protectedHeader);
+  const { alg, enc } = joseHeader;
+  if (typeof alg != "string" || !alg)
+    throw new JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid');
+  const algEntry = JWE[alg];
+  if (algEntry?.mode === "integrated-encryption") {
+    if (enc !== void 0)
+      throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption');
+    if (cek !== void 0)
+      throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${alg}`);
+    if (iv !== void 0)
+      throw new TypeError(`setInitializationVector cannot be called with JWE "alg" (Algorithm) Header ${alg}`);
+    return [joseHeader, void 0, algEntry];
+  }
+  if (typeof enc != "string" || !enc)
+    throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');
+  return [joseHeader, jweEncryption(enc), algEntry];
+}
+async function encryptJWE(input, checked, key) {
+  const [joseHeader, encEntry, selected] = checked, [inputPlaintext, inputProtectedHeader, inputUnprotectedHeader, sharedUnprotectedHeader, aad, providedCek, inputIv, keyManagementParameters, , unprotectedParameters] = input;
+  let protectedHeader = inputProtectedHeader, unprotectedHeader = inputUnprotectedHeader;
+  const algEntry = selected ?? jweAlgorithm(joseHeader.alg);
+  let encryptedKey, parameters, cek;
+  algEntry.mode === "integrated-encryption" ? cek = await prepareKey(algEntry, key, "encrypt") : [cek, encryptedKey, parameters] = await encryptKeyManagement(algEntry, encEntry, key, joseHeader, providedCek, keyManagementParameters), parameters && (unprotectedParameters ? unprotectedHeader = unprotectedHeader ? { ...unprotectedHeader, ...parameters } : parameters : protectedHeader = protectedHeader ? { ...protectedHeader, ...parameters } : parameters, checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader));
+  const protectedHeaderS = protectedHeader ? b64u(JSON.stringify(protectedHeader)) : "", aadMember = aad?.byteLength ? b64u(aad) : void 0, additionalData = encode(aadMember ? `${protectedHeaderS}.${aadMember}` : protectedHeaderS);
+  let plaintext = inputPlaintext;
+  joseHeader.zip === "DEF" && (plaintext = await compress(plaintext).catch((cause) => {
+    throw new JWEInvalid("Failed to compress plaintext", { cause });
+  }));
+  let ciphertext, tag, iv;
+  algEntry.mode === "integrated-encryption" ? [encryptedKey, ciphertext] = await algEntry.encrypt(cek, plaintext, additionalData, protectedHeader, joseHeader, keyManagementParameters) : { ciphertext, tag, iv } = await encrypt(encEntry, plaintext, cek, inputIv, additionalData);
+  const jwe = {
+    ciphertext: b64u(ciphertext)
+  };
+  return iv && (jwe.iv = b64u(iv)), tag && (jwe.tag = b64u(tag)), encryptedKey?.byteLength && (jwe.encrypted_key = b64u(encryptedKey)), aadMember && (jwe.aad = aadMember), protectedHeader && (jwe.protected = protectedHeaderS), sharedUnprotectedHeader && (jwe.unprotected = sharedUnprotectedHeader), unprotectedHeader && (jwe.header = unprotectedHeader), jwe;
+}
+async function createJWE(input, key, options) {
+  return encryptJWE(input, checkEncryptHeaders(input, options), key);
+}
+function compactJWE(jwe) {
+  return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join(".");
+}
+export {
+  checkDisjoint,
+  checkEncryptHeaders,
+  compactJWE,
+  createJWE,
+  encryptJWE
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jws_algorithms.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jws_algorithms.js
new file mode 100644
index 000000000..08e2e22ac
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jws_algorithms.js
@@ -0,0 +1,74 @@
+import { JOSENotSupported } from "../util/errors.js";
+import { table } from "./key_descriptor.js";
+const sig = [["verify"], ["sign"]];
+function hmac(bits) {
+  const subtle = { name: "HMAC", hash: `SHA-${bits}` };
+  return { kty: ["oct"], secret: !0, subtle, signing: subtle, usages: sig };
+}
+function rsa(bits, saltLength) {
+  const subtle = { name: saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5", hash: `SHA-${bits}` };
+  return {
+    kty: ["RSA"],
+    subtle,
+    signing: saltLength ? { ...subtle, saltLength } : subtle,
+    usages: sig,
+    minRsaBits: 2048
+  };
+}
+function ecdsa(crv, bits) {
+  return {
+    kty: ["EC"],
+    crv,
+    subtle: { name: "ECDSA", namedCurve: crv },
+    signing: { name: "ECDSA", hash: `SHA-${bits}` },
+    usages: sig
+  };
+}
+function eddsa() {
+  const subtle = { name: "Ed25519" };
+  return {
+    kty: ["OKP"],
+    crv: "Ed25519",
+    subtle,
+    signing: subtle,
+    usages: sig
+  };
+}
+function mldsa(bits) {
+  const subtle = { name: `ML-DSA-${bits}` };
+  return {
+    kty: ["AKP"],
+    subtle,
+    signing: subtle,
+    usages: sig
+  };
+}
+const JWS = table({
+  HS256: hmac(256),
+  HS384: hmac(384),
+  HS512: hmac(512),
+  RS256: rsa(256),
+  RS384: rsa(384),
+  RS512: rsa(512),
+  PS256: rsa(256, 32),
+  PS384: rsa(384, 48),
+  PS512: rsa(512, 64),
+  ES256: ecdsa("P-256", 256),
+  ES384: ecdsa("P-384", 384),
+  ES512: ecdsa("P-521", 512),
+  EdDSA: eddsa(),
+  Ed25519: eddsa(),
+  "ML-DSA-44": mldsa(44),
+  "ML-DSA-65": mldsa(65),
+  "ML-DSA-87": mldsa(87)
+});
+function jwsAlgorithm(alg) {
+  const entry = typeof alg == "string" ? JWS[alg] : void 0;
+  if (!entry)
+    throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+  return entry;
+}
+export {
+  JWS,
+  jwsAlgorithm
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jws_sign.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jws_sign.js
new file mode 100644
index 000000000..76e6e02dd
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jws_sign.js
@@ -0,0 +1,46 @@
+import { encode as b64u } from "../util/base64url.js";
+import { jwsAlgorithm } from "./jws_algorithms.js";
+import { isDisjoint, serializeJoseHeader, validateB64, validateCrit, validateCritDuplicates, JWS_RECOGNIZED } from "./validate.js";
+import { JWSInvalid } from "../util/errors.js";
+import { concat, encode, encoder } from "./buffer_utils.js";
+import { prepareKey, rawKey, checkModulusLength } from "./key.js";
+async function createSignature(input, key, rejectUnencoded) {
+  let [payload, protectedHeader, unprotectedHeader, crit] = input, protectedHeaderString = "";
+  if (protectedHeader !== void 0) {
+    const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
+    protectedHeader = normalized[0], protectedHeaderString = b64u(normalized[1]);
+  }
+  if (unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0]), !protectedHeader && !unprotectedHeader)
+    throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
+  if (!isDisjoint(protectedHeader, unprotectedHeader))
+    throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+  const joseHeader = { ...protectedHeader, ...unprotectedHeader };
+  validateCritDuplicates(JWSInvalid, protectedHeader);
+  const b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
+  b64 || rejectUnencoded?.();
+  const { alg } = joseHeader;
+  if (typeof alg != "string" || !alg)
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  const entry = jwsAlgorithm(alg);
+  let payloadS = "", payloadB = payload, data;
+  if (b64) {
+    const encoded = input[4];
+    encoded ? (payloadS = encoded[0] ??= b64u(payload), payloadB = encoded[1] ??= encode(payloadS)) : (payloadS = b64u(payload), data = encoder.encode(`${protectedHeaderString}.${payloadS}`));
+  }
+  data ??= concat(encode(protectedHeaderString), encode("."), payloadB);
+  const k = await rawKey(await prepareKey(entry, key, "sign"), entry.subtle, "sign");
+  entry.minRsaBits && checkModulusLength(entry.alg, k);
+  const jws = {
+    signature: b64u(new Uint8Array(await crypto.subtle.sign(entry.signing, k, data))),
+    payload: payloadS
+  };
+  return protectedHeader && (jws.protected = protectedHeaderString), unprotectedHeader && (jws.header = unprotectedHeader), [jws, b64];
+}
+async function createCompactSignature(payload, protectedHeader, crit, key, rejectUnencoded) {
+  const [jws] = await createSignature([payload, protectedHeader, void 0, crit], key, rejectUnencoded);
+  return `${jws.protected}.${jws.payload}.${jws.signature}`;
+}
+export {
+  createCompactSignature,
+  createSignature
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jws_verify.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jws_verify.js
new file mode 100644
index 000000000..7337b9c8e
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jws_verify.js
@@ -0,0 +1,86 @@
+import { jwsAlgorithm } from "./jws_algorithms.js";
+import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from "../util/errors.js";
+import { concat, decoder, encoder, encode } from "./buffer_utils.js";
+import { decodeBase64url, encodeBase64url, parseJoseHeader, isDisjoint, isObject, validateB64, validateCrit, validateAlgorithms, JWS_RECOGNIZED } from "./validate.js";
+import { prepareKey, rawKey, checkModulusLength } from "./key.js";
+function snapshotJws(jws, sharedPayload) {
+  const encodedProtected = jws.protected, inputHeader = jws.header, header = isObject(inputHeader) ? { ...inputHeader } : inputHeader;
+  let payload = sharedPayload ? sharedPayload[0] : jws.payload;
+  !sharedPayload && payload instanceof Uint8Array && (payload = new Uint8Array(payload));
+  const signature = jws.signature, snapshot = { payload, signature };
+  if (encodedProtected !== void 0 && (snapshot.protected = encodedProtected), inputHeader !== void 0 && (snapshot.header = header), encodedProtected === void 0 && header === void 0)
+    throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
+  if (encodedProtected !== void 0 && typeof encodedProtected != "string")
+    throw new JWSInvalid("JWS Protected Header incorrect type");
+  if (payload === void 0)
+    throw new JWSInvalid("JWS Payload missing");
+  if (typeof signature != "string")
+    throw new JWSInvalid("JWS Signature missing or incorrect type");
+  if (header !== void 0 && !isObject(header))
+    throw new JWSInvalid("JWS Unprotected Header incorrect type");
+  return snapshot;
+}
+function prepareVerify(options) {
+  return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
+}
+function parseProtectedHeader(encodedProtected) {
+  return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
+}
+function encodeJsonUnencodedPayload(payload) {
+  const invalid = /[\p{Cs}\p{Cn}]/u.exec(payload)?.[0];
+  if (invalid !== void 0)
+    throw new JWSInvalid(/\p{Cs}/u.test(invalid) ? "JWS Payload must be a well-formed Unicode string" : "JWS Payload must not contain unassigned Unicode code points");
+  return encoder.encode(payload);
+}
+function encodeCompactUnencodedPayload(payload) {
+  try {
+    return encode(payload);
+  } catch {
+    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
+  }
+}
+async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
+  const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
+  if (!isDisjoint(parsedProt, header))
+    throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+  const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
+  if (typeof alg != "string" || !alg)
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  if (shared[0] && !shared[0].has(alg))
+    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+  if (b64) {
+    if (typeof inputPayload != "string")
+      throw new JWSInvalid("JWS Payload must be a string");
+  } else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array))
+    throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+  const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
+  let resolvedKey = !1;
+  typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = !0);
+  const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
+  entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
+  let verified = !1;
+  try {
+    verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
+  } catch {
+  }
+  if (!verified)
+    throw new JWSSignatureVerificationFailed();
+  const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
+  return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];
+}
+async function verifyCompact(jws, shared, key) {
+  if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != "string")
+    throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
+  const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
+  if (length !== 3)
+    throw new JWSInvalid("Invalid Compact JWS");
+  return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);
+}
+export {
+  encodeJsonUnencodedPayload,
+  parseProtectedHeader,
+  prepareVerify,
+  snapshotJws,
+  verifyCompact,
+  verifySignature
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jwt_claims_set.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jwt_claims_set.js
new file mode 100644
index 000000000..b99943f9c
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/jwt_claims_set.js
@@ -0,0 +1,146 @@
+import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from "../util/errors.js";
+import { encoder, strictDecoder } from "./buffer_utils.js";
+import { isObject } from "./validate.js";
+const epoch = (date) => Math.floor(date.getTime() / 1e3), multipliers = {
+  s: 1,
+  m: 60,
+  h: 3600,
+  d: 86400,
+  w: 604800,
+  y: 31557600
+}, REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i, checkFailed = "check_failed";
+function invalidDuration() {
+  throw new TypeError("Invalid time period format");
+}
+function secs(str) {
+  typeof str != "string" && invalidDuration();
+  const matched = REGEX.exec(str);
+  (!matched || matched[4] && matched[1]) && invalidDuration();
+  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
+}
+function validateInput(label, input) {
+  if (!Number.isFinite(input))
+    throw new TypeError(`Invalid ${label} input`);
+  return input;
+}
+function validateStringClaim(claim, value) {
+  if (typeof value != "string")
+    throw new TypeError(`"${claim}" claim must be a string`);
+}
+function validateAudienceClaim(value) {
+  if (typeof value != "string" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member != "string")))
+    throw new TypeError('"aud" claim must be a string or an array of strings');
+}
+function numericDate(value, label) {
+  return typeof value == "number" ? validateInput(label, value) : value instanceof Date ? validateInput(label, epoch(value)) : epoch(/* @__PURE__ */ new Date()) + secs(value);
+}
+const normalizeTyp = (value) => {
+  const normalized = value.toLowerCase();
+  return value.includes("/") ? normalized : `application/${normalized}`;
+}, checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : !1;
+function validateNumericDate(payload, claim, required = !1) {
+  const value = payload[claim];
+  if (!(value === void 0 && !required)) {
+    if (typeof value != "number")
+      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
+    return value;
+  }
+}
+function unexpectedClaim(payload, claim) {
+  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+}
+function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
+  let payload;
+  try {
+    payload = JSON.parse(strictDecoder.decode(encodedPayload));
+  } catch {
+  }
+  if (!isObject(payload))
+    throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
+  const { typ } = options;
+  if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))
+    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
+  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
+  maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
+  for (const claim of new Set(presenceCheck.reverse()))
+    if (!Object.hasOwn(payload, claim))
+      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
+  issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
+  const { clockTolerance } = options;
+  let tolerance = 0;
+  if (typeof clockTolerance == "string")
+    tolerance = secs(clockTolerance);
+  else if (clockTolerance !== void 0) {
+    if (typeof clockTolerance != "number")
+      throw new TypeError("Invalid clockTolerance option type");
+    tolerance = clockTolerance;
+  }
+  validateInput("clockTolerance option", tolerance);
+  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload, "nbf");
+  if (nbf !== void 0 && nbf > now + tolerance)
+    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
+  const exp = validateNumericDate(payload, "exp");
+  if (exp !== void 0 && exp <= now - tolerance)
+    throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
+  if (maxTokenAge !== void 0) {
+    const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
+    if (age - tolerance > max)
+      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
+    if (age < -tolerance)
+      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
+  }
+  return payload;
+}
+let producerPayloads;
+function producerPayload(producer) {
+  return producerPayloads.get(producer);
+}
+function jwtData(producer) {
+  const payload = producerPayload(producer);
+  for (const claim of ["iat", "nbf", "exp"]) {
+    const value = payload[claim];
+    if (typeof value == "number" && !Number.isFinite(value))
+      throw new TypeError(`"${claim}" claim must be a finite number`);
+  }
+  return encoder.encode(JSON.stringify(payload));
+}
+function jwtClaim(producer, claim) {
+  return producerPayload(producer)[claim];
+}
+class JWTClaimsBuilder {
+  constructor(payload = {}) {
+    if (!isObject(payload))
+      throw new TypeError("JWT Claims Set MUST be an object");
+    (producerPayloads ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(payload));
+  }
+  setIssuer(value) {
+    return validateStringClaim("iss", value), producerPayload(this).iss = value, this;
+  }
+  setSubject(value) {
+    return validateStringClaim("sub", value), producerPayload(this).sub = value, this;
+  }
+  setAudience(value) {
+    return validateAudienceClaim(value), producerPayload(this).aud = value, this;
+  }
+  setJti(value) {
+    return validateStringClaim("jti", value), producerPayload(this).jti = value, this;
+  }
+  setNotBefore(value) {
+    return producerPayload(this).nbf = numericDate(value, "setNotBefore"), this;
+  }
+  setExpirationTime(value) {
+    return producerPayload(this).exp = numericDate(value, "setExpirationTime"), this;
+  }
+  setIssuedAt(value) {
+    const payload = producerPayload(this);
+    return value === void 0 ? payload.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == "string" ? payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value)) : payload.iat = numericDate(value, "setIssuedAt"), this;
+  }
+}
+export {
+  JWTClaimsBuilder,
+  jwtClaim,
+  jwtData,
+  secs,
+  validateClaimsSet
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/key.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/key.js
new file mode 100644
index 000000000..7dc5602f1
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/key.js
@@ -0,0 +1,155 @@
+import { isObject } from "./validate.js";
+import { decode } from "../util/base64url.js";
+import { JOSENotSupported } from "../util/errors.js";
+const tag = (key) => key[Symbol.toStringTag], jwkMatchesOp = (entry, key, usage) => {
+  const { alg } = entry;
+  if (key.use !== void 0) {
+    const expected = usage === "sign" || usage === "verify" ? "sig" : "enc";
+    if (key.use !== expected)
+      throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
+  }
+  if (key.alg !== void 0 && key.alg !== alg)
+    throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+  if (Array.isArray(key.key_ops)) {
+    const expectedKeyOp = usage === "encrypt" || usage === "decrypt" ? entry.ops?.[usage === "encrypt" ? 0 : 1] : usage;
+    if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))
+      throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
+  }
+};
+async function prepareKey(entry, key, usage) {
+  const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
+  if (secret && key instanceof Uint8Array)
+    return key;
+  let normalized, keyObject;
+  if (isObject(key)) {
+    if (normalized = normalizeJwk(key), typeof normalized.kty != "string")
+      throw invalidKeyType(alg, key, secret);
+    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0)))
+      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+    if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct")
+      return decode(normalized.k);
+    if (!Object.isFrozen(key)) {
+      const { key_ops } = key;
+      Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);
+    }
+  } else {
+    if (!isKeyLike(key))
+      throw invalidKeyType(alg, key, secret);
+    const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+    if (key.type !== expectedType && (secret || ["secret", "public", "private"].includes(key.type)))
+      throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
+    if (isCryptoKey(key))
+      return key;
+    if (keyObject = key, keyObject.type === "secret")
+      return keyObject.export();
+  }
+  cache ||= /* @__PURE__ */ new WeakMap();
+  const cacheKey = key;
+  let cached = cache.get(cacheKey);
+  if (cached?.[alg])
+    return cached[alg];
+  if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == "function") {
+    const isPublic = keyObject.type === "public", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;
+    return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);
+  }
+  return normalized ??= keyObject.export({ format: "jwk" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);
+}
+let cache;
+const nist = {
+  __proto__: null,
+  prime256v1: "P-256",
+  secp384r1: "P-384",
+  secp521r1: "P-521"
+};
+function assertCryptoKey(key) {
+  if (!isCryptoKey(key))
+    throw new Error("CryptoKey instance expected");
+}
+const isCryptoKey = (key) => {
+  if (key?.[Symbol.toStringTag] === "CryptoKey")
+    return !0;
+  try {
+    return key instanceof CryptoKey;
+  } catch {
+    return !1;
+  }
+}, isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject", isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+function message(msg, actual, ...types) {
+  if (types.length > 2) {
+    const last = types.pop();
+    msg += `one of type ${types.join(", ")}, or ${last}.`;
+  } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
+  return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
+}
+const invalidKeyInput = (actual, ...types) => message("Key must be ", actual, ...types);
+function invalidKeyType(alg, actual, secret) {
+  const types = ["CryptoKey", "KeyObject", "JSON Web Key"];
+  return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
+}
+const unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+function checkUsage(key, usage) {
+  if (usage && !key.usages.includes(usage))
+    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+function checkModulusLength(alg, key) {
+  const { modulusLength } = key.algorithm;
+  if (typeof modulusLength != "number" || modulusLength < 2048)
+    throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+}
+function checkCryptoKey(key, expected, usage) {
+  const algorithm = key.algorithm;
+  if (algorithm.name !== expected.name)
+    throw unusable(expected.name);
+  if (expected.hash && algorithm.hash?.name !== expected.hash)
+    throw unusable(expected.hash, "algorithm.hash");
+  if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)
+    throw unusable(expected.namedCurve, "algorithm.namedCurve");
+  if (expected.length !== void 0 && algorithm.length !== expected.length)
+    throw unusable(expected.length, "algorithm.length");
+  checkUsage(key, usage);
+}
+function snapshotJwk(jwk) {
+  return { __proto__: null, ...jwk };
+}
+function normalizeJwk(jwk) {
+  const normalized = snapshotJwk(jwk);
+  if (normalized.ext !== void 0 && typeof normalized.ext != "boolean")
+    throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
+  if (normalized.key_ops !== void 0) {
+    const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;
+    if (!keyOps || keyOps.some((operation) => typeof operation != "string") || new Set(keyOps).size !== keyOps.length)
+      throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
+    normalized.key_ops = keyOps;
+  }
+  return normalized;
+}
+function validateExtractableOption(extractable) {
+  if (extractable !== void 0 && typeof extractable != "boolean")
+    throw new TypeError('"extractable" option must be a boolean');
+  return extractable;
+}
+async function jwkToKey(entry, jwk, extractable) {
+  if (!entry.kty.includes(jwk.kty))
+    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+  const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };
+  return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
+}
+async function rawKey(key, expected, usage, extractable = !1) {
+  return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
+}
+export {
+  assertCryptoKey,
+  checkCryptoKey,
+  checkModulusLength,
+  checkUsage,
+  invalidKeyInput,
+  isCryptoKey,
+  isKeyLike,
+  isKeyObject,
+  jwkToKey,
+  normalizeJwk,
+  prepareKey,
+  rawKey,
+  snapshotJwk,
+  validateExtractableOption
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/key_algorithm.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/key_algorithm.js
new file mode 100644
index 000000000..8a4d3fc93
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/key_algorithm.js
@@ -0,0 +1,15 @@
+import { JOSENotSupported } from "../util/errors.js";
+import { JWS } from "./jws_algorithms.js";
+import { JWE } from "./jwe_algorithms.js";
+const algArgument = '"alg" (Algorithm)';
+function unsupportedAlg(source = 'JWK "alg" (Algorithm) Parameter') {
+  throw new JOSENotSupported(`Invalid or unsupported ${source} value`);
+}
+function keyAlgorithm(alg, source) {
+  return (typeof alg == "string" ? JWS[alg] ?? JWE[alg] : void 0) ?? unsupportedAlg(source);
+}
+export {
+  algArgument,
+  keyAlgorithm,
+  unsupportedAlg
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/key_descriptor.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/key_descriptor.js
new file mode 100644
index 000000000..cf0afbd90
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/key_descriptor.js
@@ -0,0 +1,9 @@
+function table(entries) {
+  const out = { __proto__: null };
+  for (const alg in entries)
+    out[alg] = { ...entries[alg], alg };
+  return out;
+}
+export {
+  table
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/key_management.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/key_management.js
new file mode 100644
index 000000000..7b7533b70
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/key_management.js
@@ -0,0 +1,196 @@
+import { encode as b64u } from "../util/base64url.js";
+import { prepareKey, rawKey, jwkToKey, checkCryptoKey, checkModulusLength, checkUsage, assertCryptoKey } from "./key.js";
+import { jweAlgorithm, jweEncryption, isJWECEKTransport } from "./jwe_algorithms.js";
+import { JOSENotSupported, JWEInvalid } from "../util/errors.js";
+import { decodeBase64url, assertUint8Array, isObject } from "./validate.js";
+import { digest, concat, encode, uint32be } from "./buffer_utils.js";
+import { checkCekLength, generateCek, encrypt, decrypt } from "./content_encryption.js";
+function checkEcdhCryptoKey(key, usage) {
+  if (key.algorithm.name !== "ECDH" && key.algorithm.name !== "X25519")
+    throw new TypeError("CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519");
+  checkUsage(key, usage);
+}
+async function aeskwWrap(alg, key, cek) {
+  const cryptoKey = await rawKey(key, jweAlgorithm(alg).subtle, "wrapKey", !0), cryptoKeyCek = await crypto.subtle.importKey("raw", cek, { hash: "SHA-256", name: "HMAC" }, !0, ["sign"]);
+  return new Uint8Array(await crypto.subtle.wrapKey("raw", cryptoKeyCek, cryptoKey, "AES-KW"));
+}
+async function aeskwUnwrap(alg, key, encryptedKey) {
+  const cryptoKey = await rawKey(key, jweAlgorithm(alg).subtle, "unwrapKey", !0), cryptoKeyCek = await crypto.subtle.unwrapKey("raw", encryptedKey, cryptoKey, "AES-KW", { hash: "SHA-256", name: "HMAC" }, !0, ["sign"]);
+  return new Uint8Array(await crypto.subtle.exportKey("raw", cryptoKeyCek));
+}
+function checkRsaKey(alg, key, usage) {
+  checkCryptoKey(key, jweAlgorithm(alg).subtle, usage), checkModulusLength(alg, key);
+}
+async function deriveKey(p2s, alg, p2c, key) {
+  if (!(p2s instanceof Uint8Array) || p2s.length < 8)
+    throw new JWEInvalid("PBES2 Salt Input must be 8 or more octets");
+  if (!Number.isSafeInteger(p2c) || Math.sign(p2c) !== 1)
+    throw new JWEInvalid("PBES2 Count Input must be a positive integer");
+  const salt = concat(encode(alg), Uint8Array.of(0), p2s), keylen = parseInt(alg.slice(13, 16), 10), subtleAlg = {
+    hash: `SHA-${alg.slice(8, 11)}`,
+    iterations: p2c,
+    name: "PBKDF2",
+    salt
+  }, cryptoKey = await rawKey(key, jweAlgorithm(alg).subtle, "deriveBits");
+  return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
+}
+function lengthAndInput(input) {
+  return concat(uint32be(input.length), input);
+}
+async function concatKdf(Z, L, OtherInfo) {
+  const dkLen = L >> 3, hashLen = 32, reps = Math.ceil(dkLen / hashLen), dk = new Uint8Array(reps * hashLen);
+  for (let i = 1; i <= reps; i++) {
+    const hashResult = await digest("sha256", concat(uint32be(i), Z, OtherInfo));
+    dk.set(hashResult, (i - 1) * hashLen);
+  }
+  return dk.slice(0, dkLen);
+}
+async function ecdhesDeriveKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(), apv = new Uint8Array()) {
+  checkEcdhCryptoKey(publicKey), checkEcdhCryptoKey(privateKey, "deriveBits");
+  const otherInfo = concat(lengthAndInput(encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength)), Z = new Uint8Array(await crypto.subtle.deriveBits({
+    name: publicKey.algorithm.name,
+    public: publicKey
+  }, privateKey, publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(parseInt(publicKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3));
+  return concatKdf(Z, keyLength, otherInfo);
+}
+function assertEcdhKey(key) {
+  assertCryptoKey(key);
+  const curve = key.algorithm.namedCurve;
+  if (curve !== "P-256" && curve !== "P-384" && curve !== "P-521" && key.algorithm.name !== "X25519")
+    throw new JOSENotSupported("ECDH with the provided key is not allowed or not supported by your javascript runtime");
+}
+function partyInfo(joseHeader, name) {
+  const value = joseHeader[name];
+  if (value !== void 0) {
+    if (typeof value != "string")
+      throw new JWEInvalid(`JOSE Header "${name}" (Agreement Party${name === "apu" ? "U" : "V"}Info) invalid`);
+    return decodeBase64url(value, name, JWEInvalid);
+  }
+}
+function checkPartyInfo(apu, apv) {
+  if (!(apu === void 0 || apv === void 0 || apu.byteLength !== apv.byteLength)) {
+    for (let i = 0; i < apu.byteLength; i++)
+      if (apu[i] !== apv[i])
+        return;
+    throw new JWEInvalid('JOSE Header "apu" and "apv" values must be distinct');
+  }
+}
+function assertEncryptedKey(encryptedKey) {
+  if (encryptedKey === void 0)
+    throw new JWEInvalid("JWE Encrypted Key missing");
+}
+function assertNoEncryptedKey(encryptedKey) {
+  if (encryptedKey !== void 0)
+    throw new JWEInvalid("Encountered unexpected JWE Encrypted Key");
+}
+function validateMaxPBES2Count(value) {
+  if (value !== void 0 && value !== 1 / 0 && (!Number.isSafeInteger(value) || value < 1))
+    throw new TypeError("maxPBES2Count must be a positive safe integer or Infinity");
+}
+async function decryptKeyManagement(entry, enc, key, encryptedKey, joseHeader, maxPBES2Count) {
+  const { alg } = entry, mode = entry.mode;
+  if (mode === "direct-encryption")
+    return assertNoEncryptedKey(encryptedKey), key;
+  const direct = mode === "direct-key-agreement";
+  switch (direct ? assertNoEncryptedKey(encryptedKey) : assertEncryptedKey(encryptedKey), entry.subtle.name) {
+    case "ECDH": {
+      const { epk } = joseHeader;
+      if (!isObject(epk) || ["d", "k", "p", "q", "dp", "dq", "qi", "oth", "priv"].some((parameter) => Object.hasOwn(epk, parameter)))
+        throw new JWEInvalid('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');
+      assertEcdhKey(key);
+      const ephemeralPublicKey = await jwkToKey(entry, epk), partyUInfo = partyInfo(joseHeader, "apu"), partyVInfo = partyInfo(joseHeader, "apv");
+      checkPartyInfo(partyUInfo, partyVInfo);
+      const sharedSecret = await ecdhesDeriveKey(ephemeralPublicKey, key, direct ? enc.alg : alg, direct ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
+      if (direct)
+        return sharedSecret;
+      key = sharedSecret;
+      break;
+    }
+    case "RSA-OAEP":
+      return assertCryptoKey(key), checkRsaKey(alg, key, "decrypt"), new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP", key, encryptedKey));
+    case "PBKDF2": {
+      if (typeof joseHeader.p2c != "number")
+        throw new JWEInvalid('JOSE Header "p2c" (PBES2 Count) missing or invalid');
+      validateMaxPBES2Count(maxPBES2Count);
+      const p2cLimit = maxPBES2Count ?? 1e4;
+      if (joseHeader.p2c > p2cLimit)
+        throw new JWEInvalid('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');
+      if (typeof joseHeader.p2s != "string")
+        throw new JWEInvalid('JOSE Header "p2s" (PBES2 Salt) missing or invalid');
+      const p2s = decodeBase64url(joseHeader.p2s, "p2s", JWEInvalid);
+      key = await deriveKey(p2s, alg, joseHeader.p2c, key);
+      break;
+    }
+    case "AES-GCM": {
+      if (typeof joseHeader.iv != "string")
+        throw new JWEInvalid('JOSE Header "iv" (Initialization Vector) missing or invalid');
+      if (typeof joseHeader.tag != "string")
+        throw new JWEInvalid('JOSE Header "tag" (Authentication Tag) missing or invalid');
+      const iv = decodeBase64url(joseHeader.iv, "iv", JWEInvalid), tag = decodeBase64url(joseHeader.tag, "tag", JWEInvalid);
+      if (iv.byteLength !== 12)
+        throw new JWEInvalid("Invalid Initialization Vector length");
+      if (tag.byteLength !== 16)
+        throw new JWEInvalid("Invalid Authentication Tag length");
+      return decrypt(jweEncryption(alg.slice(0, -2)), key, encryptedKey, iv, tag, new Uint8Array());
+    }
+  }
+  return aeskwUnwrap(alg.slice(-6), key, encryptedKey);
+}
+async function encryptKeyManagement(entry, enc, inputKey, joseHeader, providedCek, providedParameters = {}) {
+  const { alg, mode } = entry, transport = isJWECEKTransport(entry);
+  if (providedCek !== void 0 && !transport)
+    throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${alg}`);
+  let key = await prepareKey(mode === "direct-encryption" ? enc : entry, inputKey, "encrypt");
+  if (mode === "direct-encryption")
+    return [key, void 0, void 0];
+  const cek = transport ? providedCek ?? generateCek(enc) : void 0;
+  cek && checkCekLength(cek, enc.cekBits);
+  let encryptedKey, parameters;
+  switch (entry.subtle.name) {
+    case "ECDH": {
+      assertEcdhKey(key);
+      const { apu: providedApu, apv: providedApv } = providedParameters;
+      providedApu !== void 0 && assertUint8Array(providedApu, '"apu"'), providedApv !== void 0 && assertUint8Array(providedApv, '"apv"');
+      const apu = providedApu ?? partyInfo(joseHeader, "apu"), apv = providedApv ?? partyInfo(joseHeader, "apv");
+      checkPartyInfo(apu, apv);
+      let ephemeralKey;
+      providedParameters.epk !== void 0 ? ephemeralKey = await prepareKey(entry, providedParameters.epk, "decrypt") : ephemeralKey = (await crypto.subtle.generateKey(key.algorithm, !0, ["deriveBits"])).privateKey;
+      const subtle = crypto.subtle;
+      let exportableEpk = ephemeralKey;
+      if (!exportableEpk.extractable) {
+        if (typeof subtle.getPublicKey != "function")
+          throw new TypeError('CryptoKey for "epk" must be extractable');
+        exportableEpk = await subtle.getPublicKey(ephemeralKey, []);
+      }
+      const { x, y, crv, kty } = await subtle.exportKey("jwk", exportableEpk), direct = mode === "direct-key-agreement", sharedSecret = await ecdhesDeriveKey(key, ephemeralKey, direct ? enc.alg : alg, direct ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), apu, apv), epk = { x, crv, kty };
+      if (kty === "EC" && (epk.y = y), parameters = { epk }, providedApu !== void 0 && (parameters.apu = b64u(providedApu)), providedApv !== void 0 && (parameters.apv = b64u(providedApv)), direct)
+        return [sharedSecret, void 0, parameters];
+      key = sharedSecret;
+      break;
+    }
+    case "RSA-OAEP": {
+      assertCryptoKey(key), checkRsaKey(alg, key, "encrypt"), encryptedKey = new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP", key, cek));
+      break;
+    }
+    case "PBKDF2": {
+      const { p2c = 2048, p2s = crypto.getRandomValues(new Uint8Array(16)) } = providedParameters;
+      key = await deriveKey(p2s, alg, p2c, key), parameters = { p2c, p2s: b64u(p2s) };
+      break;
+    }
+    case "AES-GCM": {
+      const iv = providedParameters.iv === void 0 ? crypto.getRandomValues(new Uint8Array(12)) : providedParameters.iv;
+      if (!(iv instanceof Uint8Array))
+        throw new TypeError('"iv" must be an instance of Uint8Array');
+      const wrapped = await encrypt(jweEncryption(alg.slice(0, -2)), cek, key, iv, new Uint8Array());
+      encryptedKey = wrapped.ciphertext, parameters = { iv: b64u(wrapped.iv), tag: b64u(wrapped.tag) };
+    }
+  }
+  if (encryptedKey ??= await aeskwWrap(alg.slice(-6), key, cek), !(encryptedKey instanceof Uint8Array) || !encryptedKey.byteLength)
+    throw new TypeError("JWE key management algorithm did not produce an Encrypted Key");
+  return [cek, encryptedKey, parameters];
+}
+export {
+  decryptKeyManagement,
+  encryptKeyManagement,
+  validateMaxPBES2Count
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/validate.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/validate.js
new file mode 100644
index 000000000..51b7dfe89
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/lib/validate.js
@@ -0,0 +1,122 @@
+import { JOSENotSupported, JWSInvalid } from "../util/errors.js";
+import { decode } from "../util/base64url.js";
+import { encode, strictDecoder } from "./buffer_utils.js";
+function assertUint8Array(input, label) {
+  if (!(input instanceof Uint8Array))
+    throw new TypeError(`${label} must be an instance of Uint8Array`);
+}
+function isObject(input) {
+  if (typeof input != "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]")
+    return !1;
+  const prototype = Object.getPrototypeOf(input);
+  return prototype === null || Object.getPrototypeOf(prototype) === null;
+}
+function isJwkSet(input) {
+  return isObject(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject);
+}
+function isDisjoint(...headers) {
+  const parameters = /* @__PURE__ */ new Set();
+  for (const header of headers)
+    if (header)
+      for (const parameter of Object.keys(header)) {
+        if (parameters.has(parameter))
+          return !1;
+        parameters.add(parameter);
+      }
+  return !0;
+}
+function assertNotSet(value, name) {
+  if (value !== void 0)
+    throw new TypeError(`${name} can only be called once`);
+}
+function decodeBase64url(value, label, ErrorClass) {
+  try {
+    return decode(value);
+  } catch {
+    throw new ErrorClass(`Failed to base64url decode the ${label}`);
+  }
+}
+function encodeBase64url(value, label, ErrorClass) {
+  try {
+    return encode(value);
+  } catch {
+    throw new ErrorClass(`The ${label} is not a valid base64url string`);
+  }
+}
+function parseJoseHeader(b64, ErrorClass, message) {
+  let parsed;
+  try {
+    parsed = JSON.parse(strictDecoder.decode(decode(b64)));
+  } catch {
+    throw new ErrorClass(message);
+  }
+  if (!isObject(parsed))
+    throw new ErrorClass(message);
+  return parsed;
+}
+const JWS_RECOGNIZED = { __proto__: null, b64: !0 }, JWE_RECOGNIZED = { __proto__: null };
+function validateAlgorithms(option, algorithms) {
+  if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != "string")))
+    throw new TypeError(`"${option}" option must be an array of strings`);
+  return algorithms === void 0 ? void 0 : new Set(algorithms);
+}
+function validateCritDuplicates(Err, protectedHeader) {
+  const { crit } = protectedHeader ?? {};
+  if (Array.isArray(crit) && new Set(crit).size !== crit.length)
+    throw new Err('"crit" (Critical) Header Parameter MUST NOT contain duplicate values');
+}
+function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+  if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0)
+    throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
+  if (!protectedHeader || protectedHeader.crit === void 0)
+    return [];
+  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != "string" || input.length === 0))
+    throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
+  const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };
+  for (const parameter of protectedHeader.crit) {
+    if (!(parameter in recognized))
+      throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+    if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0)
+      throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+    if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0))
+      throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
+  }
+  return protectedHeader.crit;
+}
+function validateB64(protectedHeader, extensions) {
+  if (extensions.includes("b64")) {
+    const b64 = protectedHeader.b64;
+    if (typeof b64 != "boolean")
+      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+    return b64;
+  }
+  return !0;
+}
+function serializeJoseHeader(Err, header) {
+  let serialized, parsed;
+  try {
+    serialized = JSON.stringify(header), parsed = JSON.parse(serialized);
+  } catch (cause) {
+    throw new Err("JOSE Header is not valid JSON", { cause });
+  }
+  if (!isObject(parsed))
+    throw new Err("JOSE Header is not a JSON object");
+  return [parsed, serialized];
+}
+export {
+  JWE_RECOGNIZED,
+  JWS_RECOGNIZED,
+  assertNotSet,
+  assertUint8Array,
+  decodeBase64url,
+  encodeBase64url,
+  isDisjoint,
+  isJwkSet,
+  isObject,
+  parseJoseHeader,
+  serializeJoseHeader,
+  validateAlgorithms,
+  validateB64,
+  validateCrit,
+  validateCritDuplicates
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/util/base64url.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/util/base64url.js
new file mode 100644
index 000000000..4447baa6d
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/util/base64url.js
@@ -0,0 +1,16 @@
+import { encoder, decoder, encodeBase64, decodeBase64 } from "../lib/buffer_utils.js";
+const invalid = "The input to be decoded is not correctly encoded.";
+function decode(input) {
+  try {
+    return decodeBase64(typeof input == "string" ? input : decoder.decode(input), !0);
+  } catch (cause) {
+    throw new TypeError(invalid, { cause });
+  }
+}
+function encode(input) {
+  return encodeBase64(typeof input == "string" ? encoder.encode(input) : input, !0);
+}
+export {
+  decode,
+  encode
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/util/decode_jwt.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/util/decode_jwt.js
new file mode 100644
index 000000000..a4b277f18
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/util/decode_jwt.js
@@ -0,0 +1,33 @@
+import { decode as b64u } from "./base64url.js";
+import { strictDecoder } from "../lib/buffer_utils.js";
+import { isObject } from "../lib/validate.js";
+import { JWTInvalid } from "./errors.js";
+function decodeJwt(jwt) {
+  if (typeof jwt != "string")
+    throw new JWTInvalid("JWTs must use Compact JWS serialization, JWT must be a string");
+  const { 1: payload, length } = jwt.split(".");
+  if (length === 5)
+    throw new JWTInvalid("Only JWTs using Compact JWS serialization can be decoded");
+  if (length !== 3)
+    throw new JWTInvalid("Invalid JWT");
+  if (!payload)
+    throw new JWTInvalid("JWTs must contain a payload");
+  let decoded;
+  try {
+    decoded = b64u(payload);
+  } catch {
+    throw new JWTInvalid("Failed to base64url decode the payload");
+  }
+  let result;
+  try {
+    result = JSON.parse(strictDecoder.decode(decoded));
+  } catch {
+    throw new JWTInvalid("Failed to parse the decoded payload as JSON");
+  }
+  if (!isObject(result))
+    throw new JWTInvalid("Invalid JWT Claims Set");
+  return result;
+}
+export {
+  decodeJwt
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/util/decode_protected_header.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/util/decode_protected_header.js
new file mode 100644
index 000000000..274e03617
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/util/decode_protected_header.js
@@ -0,0 +1,19 @@
+import { parseJoseHeader } from "../lib/validate.js";
+function decodeProtectedHeader(token) {
+  let protectedB64u;
+  if (typeof token == "string") {
+    const parts = token.split(".");
+    (parts.length === 3 || parts.length === 5) && ([protectedB64u] = parts);
+  } else if (typeof token == "object" && token)
+    if ("protected" in token)
+      protectedB64u = token.protected;
+    else
+      throw new TypeError("Token does not contain a Protected Header");
+  const invalid = "Invalid Token or Protected Header formatting";
+  if (typeof protectedB64u != "string" || !protectedB64u)
+    throw new TypeError(invalid);
+  return parseJoseHeader(protectedB64u, TypeError, invalid);
+}
+export {
+  decodeProtectedHeader
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/util/errors.js b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/util/errors.js
new file mode 100644
index 000000000..b7d579f51
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/dist/webapi/util/errors.js
@@ -0,0 +1,109 @@
+class JOSEError extends Error {
+  static code = "ERR_JOSE_GENERIC";
+  code = "ERR_JOSE_GENERIC";
+  constructor(message, options) {
+    super(message, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
+  }
+}
+class JWTClaimValidationFailed extends JOSEError {
+  static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  claim;
+  reason;
+  payload;
+  constructor(message, payload, claim = "unspecified", reason = "unspecified") {
+    super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;
+  }
+}
+class JWTExpired extends JOSEError {
+  static code = "ERR_JWT_EXPIRED";
+  code = "ERR_JWT_EXPIRED";
+  claim;
+  reason;
+  payload;
+  constructor(message, payload, claim = "unspecified", reason = "unspecified") {
+    super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;
+  }
+}
+class JOSEAlgNotAllowed extends JOSEError {
+  static code = "ERR_JOSE_ALG_NOT_ALLOWED";
+  code = "ERR_JOSE_ALG_NOT_ALLOWED";
+}
+class JOSENotSupported extends JOSEError {
+  static code = "ERR_JOSE_NOT_SUPPORTED";
+  code = "ERR_JOSE_NOT_SUPPORTED";
+}
+class JWEDecryptionFailed extends JOSEError {
+  static code = "ERR_JWE_DECRYPTION_FAILED";
+  code = "ERR_JWE_DECRYPTION_FAILED";
+  constructor(message = "decryption operation failed", options) {
+    super(message, options);
+  }
+}
+class JWEInvalid extends JOSEError {
+  static code = "ERR_JWE_INVALID";
+  code = "ERR_JWE_INVALID";
+}
+class JWSInvalid extends JOSEError {
+  static code = "ERR_JWS_INVALID";
+  code = "ERR_JWS_INVALID";
+}
+class JWTInvalid extends JOSEError {
+  static code = "ERR_JWT_INVALID";
+  code = "ERR_JWT_INVALID";
+}
+class JWKInvalid extends JOSEError {
+  static code = "ERR_JWK_INVALID";
+  code = "ERR_JWK_INVALID";
+}
+class JWKSInvalid extends JOSEError {
+  static code = "ERR_JWKS_INVALID";
+  code = "ERR_JWKS_INVALID";
+}
+class JWKSNoMatchingKey extends JOSEError {
+  static code = "ERR_JWKS_NO_MATCHING_KEY";
+  code = "ERR_JWKS_NO_MATCHING_KEY";
+  constructor(message = "no applicable key found in the JSON Web Key Set", options) {
+    super(message, options);
+  }
+}
+class JWKSMultipleMatchingKeys extends JOSEError {
+  [Symbol.asyncIterator] = async function* () {
+  };
+  static code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+  code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+  constructor(message = "multiple matching keys found in the JSON Web Key Set", options) {
+    super(message, options);
+  }
+}
+class JWKSTimeout extends JOSEError {
+  static code = "ERR_JWKS_TIMEOUT";
+  code = "ERR_JWKS_TIMEOUT";
+  constructor(message = "request timed out", options) {
+    super(message, options);
+  }
+}
+class JWSSignatureVerificationFailed extends JOSEError {
+  static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  constructor(message = "signature verification failed", options) {
+    super(message, options);
+  }
+}
+export {
+  JOSEAlgNotAllowed,
+  JOSEError,
+  JOSENotSupported,
+  JWEDecryptionFailed,
+  JWEInvalid,
+  JWKInvalid,
+  JWKSInvalid,
+  JWKSMultipleMatchingKeys,
+  JWKSNoMatchingKey,
+  JWKSTimeout,
+  JWSInvalid,
+  JWSSignatureVerificationFailed,
+  JWTClaimValidationFailed,
+  JWTExpired,
+  JWTInvalid
+};
diff --git a/tests/corpus/6331-jose-root-entry/node_modules/jose/package.json b/tests/corpus/6331-jose-root-entry/node_modules/jose/package.json
new file mode 100644
index 000000000..2d7d92f72
--- /dev/null
+++ b/tests/corpus/6331-jose-root-entry/node_modules/jose/package.json
@@ -0,0 +1,134 @@
+{
+  "name": "jose",
+  "version": "6.2.12",
+  "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
+  "keywords": [
+    "akp",
+    "browser",
+    "bun",
+    "cloudflare",
+    "compact",
+    "decode",
+    "decrypt",
+    "deno",
+    "detached",
+    "ec",
+    "ecdsa",
+    "ed25519",
+    "eddsa",
+    "edge",
+    "electron",
+    "embedded",
+    "encrypt",
+    "flattened",
+    "general",
+    "jose",
+    "json web token",
+    "jsonwebtoken",
+    "jwa",
+    "jwe",
+    "jwk",
+    "jwks",
+    "jws",
+    "jwt-decode",
+    "jwt",
+    "ml-dsa",
+    "netlify",
+    "next",
+    "nextjs",
+    "oct",
+    "okp",
+    "payload",
+    "pem",
+    "pkcs8",
+    "rsa",
+    "sign",
+    "signature",
+    "spki",
+    "validate",
+    "vercel",
+    "verify",
+    "webcrypto",
+    "workerd",
+    "workers",
+    "x509"
+  ],
+  "homepage": "https://github.com/panva/jose",
+  "repository": "panva/jose",
+  "funding": {
+    "url": "https://github.com/sponsors/panva"
+  },
+  "license": "MIT",
+  "author": "Filip Skokan <panva.ip@gmail.com>",
+  "sideEffects": false,
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/types/index.d.ts",
+      "default": "./dist/webapi/index.js"
+    },
+    "./jwk/*": {
+      "types": "./dist/types/jwk/*.d.ts",
+      "default": "./dist/webapi/jwk/*.js"
+    },
+    "./key/import": {
+      "types": "./dist/types/key/import.d.ts",
+      "default": "./dist/webapi/key/import.js"
+    },
+    "./key/export": {
+      "types": "./dist/types/key/export.d.ts",
+      "default": "./dist/webapi/key/export.js"
+    },
+    "./key/generate/keypair": {
+      "types": "./dist/types/key/generate_key_pair.d.ts",
+      "default": "./dist/webapi/key/generate_key_pair.js"
+    },
+    "./key/generate/secret": {
+      "types": "./dist/types/key/generate_secret.d.ts",
+      "default": "./dist/webapi/key/generate_secret.js"
+    },
+    "./jwks/*": {
+      "types": "./dist/types/jwks/*.d.ts",
+      "default": "./dist/webapi/jwks/*.js"
+    },
+    "./jwt/decode": {
+      "types": "./dist/types/util/decode_jwt.d.ts",
+      "default": "./dist/webapi/util/decode_jwt.js"
+    },
+    "./jwt/*": {
+      "types": "./dist/types/jwt/*.d.ts",
+      "default": "./dist/webapi/jwt/*.js"
+    },
+    "./decode/protected_header": {
+      "types": "./dist/types/util/decode_protected_header.d.ts",
+      "default": "./dist/webapi/util/decode_protected_header.js"
+    },
+    "./jws/*": {
+      "types": "./dist/types/jws/*.d.ts",
+      "default": "./dist/webapi/jws/*.js"
+    },
+    "./jwe/*": {
+      "types": "./dist/types/jwe/*.d.ts",
+      "default": "./dist/webapi/jwe/*.js"
+    },
+    "./errors": {
+      "types": "./dist/types/util/errors.d.ts",
+      "default": "./dist/webapi/util/errors.js"
+    },
+    "./base64url": {
+      "types": "./dist/types/util/base64url.d.ts",
+      "default": "./dist/webapi/util/base64url.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/webapi/index.js",
+  "types": "./dist/types/index.d.ts",
+  "files": [
+    "dist/webapi/**/*.js",
+    "dist/types/**/*.d.ts",
+    "!dist/**/*.bundle.js",
+    "!dist/**/*.umd.js",
+    "!dist/**/*.min.js",
+    "!dist/types/lib/**"
+  ]
+}
diff --git a/tests/corpus/6332-fluent-this-declaration/main.ts b/tests/corpus/6332-fluent-this-declaration/main.ts
new file mode 100644
index 000000000..10804083f
--- /dev/null
+++ b/tests/corpus/6332-fluent-this-declaration/main.ts
@@ -0,0 +1,17 @@
+// A declaration file types a JavaScript class's inherited setters as
+// returning `this` (jose's SignJWT over JWTClaimsBuilder): chained calls
+// on the subclass keep the subclass, so its own methods stay callable.
+import { Counter, Signer } from "fluent";
+
+console.log(new Signer({ role: "admin" }).setHeader("HS256").setSubject("alice").setIssuer("me").sign());
+console.log(new Signer().setSubject("bob").setHeader("HS384").sign());
+const signer = new Signer({ n: 1 }).setIssuer("you").setSubject("carol");
+console.log(signer.setHeader("HS512").sign());
+const counter = new Counter({ a: 1 }).setSubject("dave").setIssuer("eve");
+console.log(counter.count(), counter.setHeader("x").sign(), counter instanceof Counter);
+function described(s: Signer): string {
+  return s.setSubject("frank").sign();
+}
+console.log(described(new Counter().setHeader("y")));
+const reset = new Counter({ b: 2 }).reset();
+console.log(reset.count(), reset.setSubject("gina").count());
diff --git a/tests/corpus/6332-fluent-this-declaration/node_modules/fluent/index.d.ts b/tests/corpus/6332-fluent-this-declaration/node_modules/fluent/index.d.ts
new file mode 100644
index 000000000..486f72652
--- /dev/null
+++ b/tests/corpus/6332-fluent-this-declaration/node_modules/fluent/index.d.ts
@@ -0,0 +1,14 @@
+export interface Claims {
+  setSubject(subject: string): this;
+  setIssuer(issuer: string): this;
+  reset(): this;
+}
+declare const Signer_base: new (payload?: Record<string, unknown>) => Claims;
+export declare class Signer extends Signer_base {
+  #private;
+  setHeader(header: string): this;
+  sign(): string;
+}
+export declare class Counter extends Signer {
+  count(): number;
+}
diff --git a/tests/corpus/6332-fluent-this-declaration/node_modules/fluent/index.js b/tests/corpus/6332-fluent-this-declaration/node_modules/fluent/index.js
new file mode 100644
index 000000000..9334722a9
--- /dev/null
+++ b/tests/corpus/6332-fluent-this-declaration/node_modules/fluent/index.js
@@ -0,0 +1,31 @@
+const claims = new WeakMap();
+class ClaimsBuilder {
+  constructor(payload = {}) {
+    claims.set(this, structuredClone(payload));
+  }
+  setSubject(subject) {
+    return claims.get(this).sub = subject, this;
+  }
+  setIssuer(issuer) {
+    return claims.get(this).iss = issuer, this;
+  }
+  reset() {
+    return claims.set(this, {}), this;
+  }
+}
+const Signer_base = ClaimsBuilder;
+class Signer extends Signer_base {
+  #header = "none";
+  setHeader(header) {
+    return this.#header = header, this;
+  }
+  sign() {
+    return `${this.#header}.${JSON.stringify(claims.get(this))}`;
+  }
+}
+class Counter extends Signer {
+  count() {
+    return Object.keys(claims.get(this)).length;
+  }
+}
+export { Signer, Counter };
diff --git a/tests/corpus/6332-fluent-this-declaration/node_modules/fluent/package.json b/tests/corpus/6332-fluent-this-declaration/node_modules/fluent/package.json
new file mode 100644
index 000000000..428e91d97
--- /dev/null
+++ b/tests/corpus/6332-fluent-this-declaration/node_modules/fluent/package.json
@@ -0,0 +1,11 @@
+{
+  "name": "fluent",
+  "version": "1.0.0",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "default": "./index.js"
+    }
+  }
+}
diff --git a/tests/corpus/6333-fluent-this-declaration-js/main.mjs b/tests/corpus/6333-fluent-this-declaration-js/main.mjs
new file mode 100644
index 000000000..44ac698cc
--- /dev/null
+++ b/tests/corpus/6333-fluent-this-declaration-js/main.mjs
@@ -0,0 +1,17 @@
+// A declaration file types a JavaScript class's inherited setters as
+// returning `this` (jose's SignJWT over JWTClaimsBuilder): chained calls
+// on the subclass keep the subclass, so its own methods stay callable.
+import { Counter, Signer } from "fluent";
+
+console.log(new Signer({ role: "admin" }).setHeader("HS256").setSubject("alice").setIssuer("me").sign());
+console.log(new Signer().setSubject("bob").setHeader("HS384").sign());
+const signer = new Signer({ n: 1 }).setIssuer("you").setSubject("carol");
+console.log(signer.setHeader("HS512").sign());
+const counter = new Counter({ a: 1 }).setSubject("dave").setIssuer("eve");
+console.log(counter.count(), counter.setHeader("x").sign(), counter instanceof Counter);
+function described(s) {
+  return s.setSubject("frank").sign();
+}
+console.log(described(new Counter().setHeader("y")));
+const reset = new Counter({ b: 2 }).reset();
+console.log(reset.count(), reset.setSubject("gina").count());
diff --git a/tests/corpus/6333-fluent-this-declaration-js/node_modules/fluent/index.d.ts b/tests/corpus/6333-fluent-this-declaration-js/node_modules/fluent/index.d.ts
new file mode 100644
index 000000000..486f72652
--- /dev/null
+++ b/tests/corpus/6333-fluent-this-declaration-js/node_modules/fluent/index.d.ts
@@ -0,0 +1,14 @@
+export interface Claims {
+  setSubject(subject: string): this;
+  setIssuer(issuer: string): this;
+  reset(): this;
+}
+declare const Signer_base: new (payload?: Record<string, unknown>) => Claims;
+export declare class Signer extends Signer_base {
+  #private;
+  setHeader(header: string): this;
+  sign(): string;
+}
+export declare class Counter extends Signer {
+  count(): number;
+}
diff --git a/tests/corpus/6333-fluent-this-declaration-js/node_modules/fluent/index.js b/tests/corpus/6333-fluent-this-declaration-js/node_modules/fluent/index.js
new file mode 100644
index 000000000..9334722a9
--- /dev/null
+++ b/tests/corpus/6333-fluent-this-declaration-js/node_modules/fluent/index.js
@@ -0,0 +1,31 @@
+const claims = new WeakMap();
+class ClaimsBuilder {
+  constructor(payload = {}) {
+    claims.set(this, structuredClone(payload));
+  }
+  setSubject(subject) {
+    return claims.get(this).sub = subject, this;
+  }
+  setIssuer(issuer) {
+    return claims.get(this).iss = issuer, this;
+  }
+  reset() {
+    return claims.set(this, {}), this;
+  }
+}
+const Signer_base = ClaimsBuilder;
+class Signer extends Signer_base {
+  #header = "none";
+  setHeader(header) {
+    return this.#header = header, this;
+  }
+  sign() {
+    return `${this.#header}.${JSON.stringify(claims.get(this))}`;
+  }
+}
+class Counter extends Signer {
+  count() {
+    return Object.keys(claims.get(this)).length;
+  }
+}
+export { Signer, Counter };
diff --git a/tests/corpus/6333-fluent-this-declaration-js/node_modules/fluent/package.json b/tests/corpus/6333-fluent-this-declaration-js/node_modules/fluent/package.json
new file mode 100644
index 000000000..428e91d97
--- /dev/null
+++ b/tests/corpus/6333-fluent-this-declaration-js/node_modules/fluent/package.json
@@ -0,0 +1,11 @@
+{
+  "name": "fluent",
+  "version": "1.0.0",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "default": "./index.js"
+    }
+  }
+}
diff --git a/tests/corpus/6334-discarded-logical-statements.mjs b/tests/corpus/6334-discarded-logical-statements.mjs
new file mode 100644
index 000000000..2e1df91a8
--- /dev/null
+++ b/tests/corpus/6334-discarded-logical-statements.mjs
@@ -0,0 +1,42 @@
+// Minified `a && b;` / `a || b;` statements whose operands share no value
+// representation lower as the control flow they are (jose's secs()), and
+// element reads on a RegExpExecArray | null the code ruled non-null
+// without narrowing answer undefined for groups that did not participate.
+const multipliers = { s: 1, m: 60, h: 3600, d: 86400 };
+const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|s|minutes?|m|hours?|h|days?|d)(?: (ago|from now))?$/i;
+function invalid() {
+  throw new TypeError("Invalid time period format");
+}
+function secs(str) {
+  typeof str != "string" && invalid();
+  const matched = REGEX.exec(str);
+  (!matched || matched[4] && matched[1]) && invalid();
+  const value = parseFloat(matched[2]);
+  const n = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  return Number.isFinite(n) || invalid(), matched[1] === "-" || matched[4] === "ago" ? -n : n;
+}
+for (const input of ["10 minutes", "2h", "-1d", "+3 s", "1.5 hours ago", "4 days from now", "-2h ago", "bogus", "", 7]) {
+  try {
+    console.log(JSON.stringify(input), secs(input));
+  } catch (e) {
+    console.log(JSON.stringify(input), e.name, e.message);
+  }
+}
+
+const log = [];
+function note(v) {
+  log.push(v);
+  return v;
+}
+const values = [0, 1, "", "x", undefined, null, true, false];
+for (const v of values) {
+  (note(v) || typeof v === "number") && note("and");
+  (v && typeof v === "string") || note("or");
+  !v || (v === true && note("bool")) || note("rest");
+}
+console.log(JSON.stringify(log));
+
+const m = /(a)?(b)(c)?/.exec("b");
+console.log(m[1], m[2], m[3], m[7], m[1] === undefined, m.length);
+const none = /(z)/.exec("b");
+console.log(none?.[1], none === null);
diff --git a/tests/corpus/6335-discarded-logical-statements.ts b/tests/corpus/6335-discarded-logical-statements.ts
new file mode 100644
index 000000000..84b89f7b1
--- /dev/null
+++ b/tests/corpus/6335-discarded-logical-statements.ts
@@ -0,0 +1,27 @@
+// `a && b;` / `a || b;` statements whose operands share no value
+// representation lower as control flow: only the deciding test runs.
+function invalid(): never {
+  throw new TypeError("invalid");
+}
+function check(input: string): string {
+  const matched = /^(\+|-)?(\d+)(s|m)( ago)?$/.exec(input);
+  (!matched || (matched[4] && matched[1])) && invalid();
+  return matched ? `${matched[2]}${matched[3]}` : "none";
+}
+for (const input of ["5s", "-5m", "5m ago", "-5m ago", "x"]) {
+  try {
+    console.log(input, check(input));
+  } catch (e) {
+    console.log(input, (e as Error).message);
+  }
+}
+const seen: string[] = [];
+function flag(s: string, v: boolean | string | undefined): boolean | string | undefined {
+  seen.push(s);
+  return v;
+}
+for (const v of [true, false, "", "y", undefined]) {
+  (flag("a", v) || flag("b", v === undefined ? "u" : false)) && seen.push("then");
+  (flag("c", v) && flag("d", typeof v === "string")) || seen.push("else");
+}
+console.log(seen.join(","));
diff --git a/tests/corpus/6340-prototype-reflection-optional-view-param.ts b/tests/corpus/6340-prototype-reflection-optional-view-param.ts
new file mode 100644
index 000000000..58e21164d
--- /dev/null
+++ b/tests/corpus/6340-prototype-reflection-optional-view-param.ts
@@ -0,0 +1,42 @@
+// A generic method whose optional parameter is an interface view (or an
+// erased type parameter) reflects through the prototype of an instance
+// that crossed into checked-dynamic code, and calls directly with the
+// argument omitted.
+interface Handle {
+  close(): string;
+}
+class Plain implements Handle {
+  close(): string {
+    return "closed";
+  }
+}
+class Registry {
+  private current: Handle | null = null;
+  use(handle: Handle | null): void {
+    this.current = handle;
+  }
+  wrap<F>(fn: F, handle?: Handle | null): F {
+    if (handle) this.current = handle;
+    return fn;
+  }
+  tag<T>(value: T, label?: T): string {
+    return `${String(value)}:${label === undefined ? "none" : String(label)}`;
+  }
+  size(): number {
+    return this.current === null ? 0 : 1;
+  }
+}
+
+const registry = new Registry();
+const inc = registry.wrap((x: number) => x + 1);
+console.log(inc(1), registry.size());
+const dec = registry.wrap((x: number) => x - 1, new Plain());
+console.log(dec(1), registry.size());
+console.log(registry.tag(1), registry.tag("a", "b"));
+
+const boxed: unknown = registry;
+const proto = Object.getPrototypeOf(boxed);
+console.log(Object.getOwnPropertyNames(proto).join(","));
+console.log(typeof proto.wrap, typeof proto.tag, proto.size.call(registry));
+const loose: any = registry;
+console.log(loose.size(), proto.tag.call(registry, 2), proto.tag.call(registry, 2, 3));
diff --git a/tests/corpus/6341-throw-array-identity.ts b/tests/corpus/6341-throw-array-identity.ts
new file mode 100644
index 000000000..1fc78afd7
--- /dev/null
+++ b/tests/corpus/6341-throw-array-identity.ts
@@ -0,0 +1,56 @@
+// A thrown array reaches the catch binding as the same array: inspection,
+// String(), Array.isArray, typed views and mutation see the thrown object,
+// including when the thrown value is a union of a record and an array, and
+// after a rethrow.
+const shared = [1, 2];
+try {
+  throw shared;
+} catch (e) {
+  console.log(e === shared, Array.isArray(e), String(e));
+  (e as number[]).push(3);
+}
+console.log(shared);
+
+function pick(k: number): number[] | { a: number } {
+  return k ? [k, k * 2] : { a: k };
+}
+for (const k of [0, 2]) {
+  try {
+    throw pick(k);
+  } catch (e) {
+    console.log(e, Array.isArray(e), typeof e);
+  }
+}
+
+try {
+  try {
+    throw [7, [8]];
+  } catch (e) {
+    throw e;
+  }
+} catch (e) {
+  console.log("rethrown", e);
+}
+
+const grid: string[][] = [["x"], ["y", "z"]];
+try {
+  throw grid;
+} catch (e) {
+  const rows = e as string[][];
+  console.log(JSON.stringify(e), rows.length, rows[1]![1]);
+}
+
+try {
+  throw [] as number[];
+} catch (e) {
+  console.log(e, String(e) === "", (e as number[]).length);
+}
+
+function fail(items: { id: number }[]): never {
+  throw items;
+}
+try {
+  fail([{ id: 1 }, { id: 2 }]);
+} catch (e) {
+  console.log((e as { id: number }[]).map((item) => item.id));
+}
diff --git a/tests/corpus/6342-throw-builtin-identity.ts b/tests/corpus/6342-throw-builtin-identity.ts
new file mode 100644
index 000000000..457b94138
--- /dev/null
+++ b/tests/corpus/6342-throw-builtin-identity.ts
@@ -0,0 +1,56 @@
+// Thrown Maps, Sets, typed arrays, Buffers and functions reach the catch
+// binding as the same objects: inspection, String(), typeof, instanceof
+// and typed views see the thrown value.
+function report(label: string, f: () => void): void {
+  try {
+    f();
+  } catch (e) {
+    console.log(label, e, typeof e, e instanceof Map, e instanceof Set, ArrayBuffer.isView(e));
+  }
+}
+
+const shared = new Map<string, number>([["a", 1]]);
+try {
+  throw shared;
+} catch (e) {
+  console.log(e === shared, String(e));
+  (e as Map<string, number>).set("b", 2);
+}
+console.log(shared);
+
+report("set", () => {
+  throw new Set<number>([1, 2]);
+});
+report("u8", () => {
+  throw new Uint8Array([1, 2, 3]);
+});
+report("f64", () => {
+  throw new Float64Array([1.5, -0]);
+});
+report("buffer", () => {
+  throw Buffer.from("hi");
+});
+report("function", () => {
+  throw function named(): number {
+    return 1;
+  };
+});
+const twice = (x: number): number => x * 2;
+try {
+  throw twice;
+} catch (e) {
+  console.log(e, typeof e, (e as (x: number) => number)(21));
+}
+
+function pick(k: number): Map<string, number> | number[] {
+  return k ? new Map([["k", k]]) : [k];
+}
+for (const k of [0, 3]) report(`union ${k}`, () => {
+  throw pick(k);
+});
+
+try {
+  throw new Set(["x"]);
+} catch (e) {
+  console.log([...(e as Set<string>)].join(","), (e as Set<string>).has("x"));
+}
diff --git a/tests/corpus/6345-inspect-dyn-holes.ts b/tests/corpus/6345-inspect-dyn-holes.ts
new file mode 100644
index 000000000..60ecbfa73
--- /dev/null
+++ b/tests/corpus/6345-inspect-dyn-holes.ts
@@ -0,0 +1,29 @@
+// Holey arrays reached through `unknown` print their holes as Node does:
+// runs of holes as `<n empty items>` entries, which count toward the
+// 100-entry limit, inside nested values too.
+function show(label: string, value: unknown): void {
+  console.log(label, value);
+}
+const a: number[] = [];
+a[2] = 1;
+show("lead", a);
+const t: string[] = ["x"];
+t[4] = "y";
+t.length = 7;
+show("runs", t);
+const one: number[] = [1];
+one[2] = 3;
+show("single", one);
+const wide: number[] = [];
+for (let i = 0; i < 150; i += 2) wide[i] = i;
+show("wide", wide);
+const dense: number[] = [];
+for (let i = 0; i < 120; i++) dense[i] = i;
+dense[130] = 1;
+show("dense", dense);
+show("nested", { rows: [a, one] });
+const made: unknown = new Array<number>(3);
+show("ctor", made);
+const holes: number[] = [];
+holes.length = 3;
+show("length", holes);
diff --git a/tests/corpus/6350-globalthis-assertion-state.ts b/tests/corpus/6350-globalthis-assertion-state.ts
new file mode 100644
index 000000000..4a7f5a990
--- /dev/null
+++ b/tests/corpus/6350-globalthis-assertion-state.ts
@@ -0,0 +1,50 @@
+// Process-global state on the global object through a type assertion:
+// every assertion of globalThis denotes the global object itself, so a
+// write through one view is visible through every other view and through
+// a view bound before the write.
+const KEY = Symbol.for("example.state");
+interface State {
+  n: number;
+  log: string[];
+}
+type Holder = { [KEY]?: State; label?: string };
+
+const early = globalThis as Holder;
+
+function get(): State | undefined {
+  return early[KEY];
+}
+
+early[KEY] = { n: 1, log: [] };
+console.log(get()?.n, (globalThis as Holder)[KEY]?.n);
+
+function touch(entry: string): void {
+  const view = globalThis as Holder;
+  const state = view[KEY] ?? (view[KEY] = { n: 0, log: [] });
+  state.n++;
+  state.log.push(entry);
+}
+touch("a");
+touch("b");
+console.log(early[KEY]?.n, early[KEY]?.log.join(","), get() === early[KEY]);
+
+// string-keyed members of the same object
+(globalThis as Holder).label = "ready";
+console.log(early.label, (globalThis as unknown as { label?: string }).label);
+
+// ??= initializes once; delete removes the member for every view
+const COUNTER = Symbol.for("example.counter");
+type Counters = { [COUNTER]?: { hits: number } };
+(globalThis as Counters)[COUNTER] ??= { hits: 0 };
+(globalThis as Counters)[COUNTER] ??= { hits: 100 };
+const counters = globalThis as Counters;
+counters[COUNTER]!.hits += 2;
+console.log((globalThis as Counters)[COUNTER]?.hits, COUNTER in globalThis);
+delete counters[COUNTER];
+console.log((globalThis as Counters)[COUNTER], COUNTER in globalThis);
+
+// an index-signature view
+const dict = globalThis as unknown as Record<string, number | undefined>;
+dict.exampleTotal = 1;
+dict["exampleTotal"] = (dict["exampleTotal"] ?? 0) + 1;
+console.log((globalThis as unknown as { exampleTotal?: number }).exampleTotal);
diff --git a/tests/corpus/6352-globalthis-state-modules/boot.ts b/tests/corpus/6352-globalthis-state-modules/boot.ts
new file mode 100644
index 000000000..856ff1baa
--- /dev/null
+++ b/tests/corpus/6352-globalthis-state-modules/boot.ts
@@ -0,0 +1,14 @@
+// The boot module writes the state through its own assertion of globalThis.
+const STATE = Symbol.for("example.boot-state");
+const PENDING = Symbol.for("example.boot-pending");
+
+interface Early {
+  startedAt: number;
+  steps: string[];
+}
+
+export function boot(): void {
+  const view = globalThis as { [STATE]?: Early; [PENDING]?: Promise<string> };
+  view[STATE] = { startedAt: 42, steps: ["boot"] };
+  view[PENDING] = Promise.resolve("container-1");
+}
diff --git a/tests/corpus/6352-globalthis-state-modules/main.ts b/tests/corpus/6352-globalthis-state-modules/main.ts
new file mode 100644
index 000000000..5b5aee7eb
--- /dev/null
+++ b/tests/corpus/6352-globalthis-state-modules/main.ts
@@ -0,0 +1,18 @@
+// Boot writes the state; main reads it through a binding exported by
+// another module, then takes the pending value out of the global object.
+import { boot } from "./boot.ts";
+import { PENDING_KEY, STATE_KEY, globalState, readState } from "./state.ts";
+
+console.log(readState() === undefined);
+boot();
+const state = readState();
+console.log(state?.startedAt, state?.steps.join(","));
+state?.steps.push("main");
+console.log(globalState[STATE_KEY]?.steps.join(","));
+
+async function main(): Promise<void> {
+  const pending = globalState[PENDING_KEY];
+  globalState[PENDING_KEY] = undefined;
+  console.log(await pending, globalState[PENDING_KEY]);
+}
+void main();
diff --git a/tests/corpus/6352-globalthis-state-modules/state.ts b/tests/corpus/6352-globalthis-state-modules/state.ts
new file mode 100644
index 000000000..cef92c25f
--- /dev/null
+++ b/tests/corpus/6352-globalthis-state-modules/state.ts
@@ -0,0 +1,18 @@
+// Shared by the boot and main modules: the state lives on the global
+// object, keyed by registered symbols.
+export const STATE_KEY = Symbol.for("example.boot-state");
+export const PENDING_KEY = Symbol.for("example.boot-pending");
+
+export interface BootState {
+  startedAt: number;
+  steps: string[];
+}
+
+export const globalState = globalThis as {
+  [STATE_KEY]?: BootState;
+  [PENDING_KEY]?: Promise<string>;
+};
+
+export function readState(): BootState | undefined {
+  return globalState[STATE_KEY];
+}
diff --git a/tests/corpus/6416-tls-session-reused.ts b/tests/corpus/6416-tls-session-reused.ts
new file mode 100644
index 000000000..a30f4f1b0
--- /dev/null
+++ b/tests/corpus/6416-tls-session-reused.ts
@@ -0,0 +1,33 @@
+// TLSSocket.isSessionReused() on both ends of a fresh TLS connection,
+// before and after the handshake: a first handshake never resumes a
+// session, so every answer is false.
+import * as tls from "node:tls";
+import { readFileSync } from "node:fs";
+
+const cert = readFileSync("tests/fixtures/server/certs/localhost.pem");
+const key = readFileSync("tests/fixtures/server/certs/localhost-key.pem");
+const ca = readFileSync("tests/fixtures/server/certs/ca.pem");
+
+let serverLine: string | null = null;
+let clientLine: string | null = null;
+function both(): void {
+  if (serverLine === null || clientLine === null) return;
+  console.log(serverLine);
+  console.log(clientLine);
+}
+
+const server = tls.createServer({ key, cert }, (socket) => {
+  serverLine = `server reused ${socket.isSessionReused()}`;
+  both();
+  socket.end("hi");
+});
+server.listen(0, "127.0.0.1", () => {
+  const port = (server.address() as { port: number }).port;
+  const client = tls.connect({ port, host: "127.0.0.1", servername: "localhost", ca }, () => {
+    clientLine = `client reused ${client.isSessionReused()}`;
+    both();
+  });
+  console.log("before handshake", client.isSessionReused());
+  client.on("data", (d: Buffer) => console.log("data", d.toString()));
+  client.on("close", () => server.close());
+});
diff --git a/tests/corpus/6417-object-assign-class-target.ts b/tests/corpus/6417-object-assign-class-target.ts
new file mode 100644
index 000000000..4c2746693
--- /dev/null
+++ b/tests/corpus/6417-object-assign-class-target.ts
@@ -0,0 +1,36 @@
+// Object.assign with a class instance as the target and a plain record as
+// the source: the record's fields land on the instance's own fields (also
+// readonly ones, which only the checker guards), optional source fields
+// only when present, and the call answers the instance itself.
+class Settings {
+  retries = 1;
+  readonly name: string = "default";
+  verbose = false;
+  label?: string;
+  describe(): string {
+    return `${this.name}:${this.retries}:${this.verbose}:${this.label ?? "-"}`;
+  }
+}
+
+const s = new Settings();
+const same = Object.assign(s, { retries: 3, verbose: true });
+console.log(same === s, s.describe());
+
+function patch(target: Settings, update: { label?: string }): Settings {
+  return Object.assign(target, update);
+}
+console.log(patch(s, { label: "x" }).describe());
+console.log(patch(s, {}).describe());
+console.log(patch(s, { label: undefined }).describe(), Object.assign(s, { retries: 0 }).describe());
+
+class Point {
+  x: number;
+  y: number;
+  constructor(x: number, y: number) {
+    this.x = x;
+    this.y = y;
+  }
+}
+const p = new Point(1, 2);
+Object.assign(p, { y: 5 });
+console.log(p.x, p.y, JSON.stringify(p), p instanceof Point);
diff --git a/tests/corpus/6418-nullish-assign-index-record.ts b/tests/corpus/6418-nullish-assign-index-record.ts
new file mode 100644
index 000000000..97918cd98
--- /dev/null
+++ b/tests/corpus/6418-nullish-assign-index-record.ts
@@ -0,0 +1,29 @@
+// Short-circuit assignment through a string-keyed index-signature record
+// (`timings[phase] ??= value`): a missing key takes the right side, a
+// present one keeps its value, and `||=` and `&&=` test truthiness.
+class Telemetry {
+  private readonly timings: Record<string, number> = {};
+  private readonly labels: { [key: string]: string } = {};
+  mark(phase: string, at: number): number {
+    return (this.timings[phase] ??= at);
+  }
+  label(key: string, value: string): string {
+    this.labels[key] ||= value;
+    this.labels[key] &&= this.labels[key].toUpperCase();
+    return this.labels[key];
+  }
+  dump(): string {
+    return JSON.stringify(this.timings) + " " + JSON.stringify(this.labels);
+  }
+}
+
+const t = new Telemetry();
+console.log(t.mark("dns", 5), t.mark("tcp", 7), t.mark("dns", 9));
+console.log(t.label("a", "first"), t.label("a", "second"), t.label("", "empty"));
+console.log(t.dump());
+
+const counts: Record<string, number> = { zero: 0 };
+const keys = ["zero", "one", "zero"];
+for (const k of keys) counts[k] ??= 10;
+for (const k of keys) counts[k] ||= 20;
+console.log(JSON.stringify(counts));
diff --git a/tests/corpus/bound-constructor-inspect-names.cjs b/tests/corpus/bound-constructor-inspect-names.cjs
new file mode 100644
index 000000000..52faa689c
--- /dev/null
+++ b/tests/corpus/bound-constructor-inspect-names.cjs
@@ -0,0 +1,36 @@
+'use strict';
+// util.inspect names an object after the function in the first own
+// `constructor` property on its prototype chain. Here that function is a
+// bound function, whose name ("bound " and the target's name) is built at
+// bind time, and the property is replaced after construction, which
+// releases the first bound function. The instance keeps the name. The
+// targets are anonymous, so the bound names are "bound " and "bound bound ".
+const util = require('util');
+
+// Array elements give the functions no name.
+const [Point, Pair] = [
+  function (x) {
+    this.x = x;
+  },
+  function (a, b) {
+    this.a = a;
+    this.b = b;
+  },
+];
+Point.prototype.constructor = Point.bind(null);
+const p = new Point(1);
+console.log(util.inspect(p));
+
+Point.prototype.constructor = Point.bind(null);
+const filler = [];
+for (let i = 0; i < 200; i++) filler.push('bound '.repeat(i % 5) + i);
+console.log(util.inspect(p));
+console.log(p);
+console.log(filler.length);
+
+// A bound function of a bound function, replaced the same way.
+Pair.prototype.constructor = Pair.bind(null).bind(null);
+const q = new Pair(1, 2);
+Pair.prototype.constructor = Pair.bind(null).bind(null);
+console.log(util.inspect(q));
+console.log(q);
diff --git a/tests/corpus/builtin-function-record-values/main.ts b/tests/corpus/builtin-function-record-values/main.ts
new file mode 100644
index 000000000..c742acc16
--- /dev/null
+++ b/tests/corpus/builtin-function-record-values/main.ts
@@ -0,0 +1,10 @@
+// A builtin function stored in a JavaScript record is a real function:
+// TypeScript consumers call it through the record.
+import native from "./native.js";
+const shape = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const id = native.randomUUID();
+console.log(typeof id, id.length, shape.test(id));
+const ids = new Set<string>();
+for (let i = 0; i < 50; i++) ids.add(native.randomUUID());
+console.log(ids.size);
+console.log(shape.test(native.randomUUID({ disableEntropyCache: true })));
diff --git a/tests/corpus/builtin-function-record-values/native.js b/tests/corpus/builtin-function-record-values/native.js
new file mode 100644
index 000000000..7009a2cd9
--- /dev/null
+++ b/tests/corpus/builtin-function-record-values/native.js
@@ -0,0 +1,3 @@
+// uuid's native.js layout: a record exporting a builtin function value.
+import { randomUUID } from "crypto";
+export default { randomUUID };
diff --git a/tests/corpus/builtin-function-values.mjs b/tests/corpus/builtin-function-values.mjs
new file mode 100644
index 000000000..ad0331291
--- /dev/null
+++ b/tests/corpus/builtin-function-values.mjs
@@ -0,0 +1,17 @@
+// Builtin functions used as JavaScript values are functions: typeof,
+// identity, their name, and calls through the value.
+import { randomUUID, scryptSync } from "crypto";
+const table = { randomUUID, scryptSync };
+console.log(typeof table.randomUUID, table.randomUUID === randomUUID);
+console.log(/^[0-9a-f-]{36}$/.test(table.randomUUID()));
+console.log(/^[0-9a-f-]{36}$/.test(table.randomUUID(undefined)));
+try {
+  table.randomUUID(5);
+} catch (e) {
+  console.log(e.code, e.name);
+}
+console.log(table.randomUUID);
+console.log(typeof table.scryptSync, table.scryptSync === scryptSync);
+console.log(new Set([scryptSync]).has(table.scryptSync), table.scryptSync.name);
+const pick = (useNative) => (useNative && table.randomUUID ? table.randomUUID() : "fallback");
+console.log(pick(true).length, pick(false));
diff --git a/tests/corpus/cjs-class-hierarchy-npm/main.ts b/tests/corpus/cjs-class-hierarchy-npm/main.ts
new file mode 100644
index 000000000..b709aa556
--- /dev/null
+++ b/tests/corpus/cjs-class-hierarchy-npm/main.ts
@@ -0,0 +1,58 @@
+// Class hierarchies across the CommonJS modules of an npm package (the
+// undici dispatcher shape): an EventEmitter-rooted base in one module,
+// symbol-keyed fields whose keys come from a shared export table, a
+// computed accessor, subclasses in further modules re-exported through
+// require bindings and inline requires, and TypeScript subclasses that
+// override a JavaScript method with typed parameters and call super.
+import { Agent, Dispatcher, DispatcherBase, Pool, describe, type Handler } from "dispatchkit";
+
+class TracingAgent extends Agent {
+  readonly trace: string[] = [];
+
+  constructor() {
+    super({ label: "tracing", prefix: "+" });
+  }
+
+  dispatch(path: string, handler: Handler): boolean {
+    this.trace.push(path);
+    return super.dispatch(path.toUpperCase(), handler);
+  }
+}
+
+class LimitedPool extends Pool {
+  rejected = 0;
+
+  dispatch(path: string, handler: Handler): boolean {
+    const ok = super.dispatch(path, handler);
+    if (!ok) this.rejected++;
+    return ok;
+  }
+}
+
+const print: Handler = (line) => console.log("handled", line);
+
+function run(d: Dispatcher, paths: string[]): void {
+  for (const path of paths) console.log(path, "->", d.dispatch(path, print));
+}
+
+const plain = new Agent();
+run(plain, ["/a", "/b"]);
+console.log(describe(plain), plain.kind, plain.prefix);
+
+const tracing = new TracingAgent();
+tracing.on("closed", (label: unknown, count: unknown) => console.log("closed event", label, count));
+run(tracing, ["/x", "/y/z"]);
+console.log(tracing.trace.join(","), tracing.dispatched, tracing.closed);
+tracing.close();
+tracing.close();
+console.log(describe(tracing), tracing.kind);
+try {
+  tracing.dispatch("/late", print);
+} catch (err) {
+  console.log("error", (err as Error).message);
+}
+
+const pool = new LimitedPool(3);
+run(pool, ["/1", "/long", "/2"]);
+console.log(pool.rejected, pool.size, pool.dispatched, pool instanceof DispatcherBase);
+console.log(describe(pool), pool.kind);
diff --git a/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/index.d.ts b/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/index.d.ts
new file mode 100644
index 000000000..bde4d4117
--- /dev/null
+++ b/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/index.d.ts
@@ -0,0 +1,27 @@
+import { EventEmitter } from "node:events";
+
+export type Handler = (line: string) => void;
+
+export declare class Dispatcher extends EventEmitter {
+  dispatch(path: string, handler: Handler): boolean;
+  close(): void;
+}
+
+export declare class DispatcherBase extends Dispatcher {
+  constructor(opts?: { label?: string });
+  get closed(): boolean;
+  get dispatched(): number;
+  get kind(): string;
+}
+
+export declare class Agent extends DispatcherBase {
+  constructor(opts?: { label?: string; prefix?: string });
+  prefix: string;
+}
+
+export declare class Pool extends Agent {
+  constructor(size: number);
+  size: number;
+}
+
+export declare function describe(d: Dispatcher): string;
diff --git a/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/index.js b/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/index.js
new file mode 100644
index 000000000..1f6cd7f85
--- /dev/null
+++ b/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/index.js
@@ -0,0 +1,12 @@
+'use strict';
+
+// The undici index shape: classes re-exported through require bindings and
+// inline requires of modules whose whole export is the class.
+const Dispatcher = require('./lib/dispatcher');
+const { describe } = require('./lib/describe');
+
+module.exports.Dispatcher = Dispatcher;
+module.exports.DispatcherBase = require('./lib/dispatcher-base');
+module.exports.Agent = require('./lib/agent');
+module.exports.Pool = require('./lib/pool');
+module.exports.describe = describe;
diff --git a/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/lib/agent.js b/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/lib/agent.js
new file mode 100644
index 000000000..95b2e02f2
--- /dev/null
+++ b/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/lib/agent.js
@@ -0,0 +1,18 @@
+'use strict';
+
+const DispatcherBase = require('./dispatcher-base');
+const { kCount, kDispatch, kLabel } = require('./symbols');
+
+class Agent extends DispatcherBase {
+  constructor({ label = 'agent', prefix = '>' } = {}) {
+    super({ label });
+    this.prefix = prefix;
+  }
+
+  [kDispatch](path, handler) {
+    handler(this.prefix + ' ' + this[kLabel] + ' ' + path + ' #' + this[kCount]);
+    return true;
+  }
+}
+
+module.exports = Agent;
diff --git a/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/lib/describe.js b/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/lib/describe.js
new file mode 100644
index 000000000..7c0c3aef7
--- /dev/null
+++ b/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/lib/describe.js
@@ -0,0 +1,9 @@
+'use strict';
+
+const { kCount, kLabel } = require('./symbols');
+
+function describe(d) {
+  return d[kLabel] + ': ' + d[kCount] + ' dispatched, ' + (d.closed ? 'closed' : 'open');
+}
+
+module.exports = { describe };
diff --git a/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/lib/dispatcher-base.js b/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/lib/dispatcher-base.js
new file mode 100644
index 000000000..091455592
--- /dev/null
+++ b/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/lib/dispatcher-base.js
@@ -0,0 +1,48 @@
+'use strict';
+
+const Dispatcher = require('./dispatcher');
+const { kClosed, kDispatch, kCount, kLabel, kOnClose } = require('./symbols');
+
+const KIND = 'kind';
+
+class DispatcherBase extends Dispatcher {
+  // Symbol-keyed fields whose keys come from another module.
+  [kClosed] = false;
+
+  [kCount] = 0;
+
+  [kOnClose] = null;
+
+  constructor(opts) {
+    super();
+    this[kLabel] = (opts && opts.label) || 'base';
+  }
+
+  get closed() {
+    return this[kClosed];
+  }
+
+  get dispatched() {
+    return this[kCount];
+  }
+
+  // A computed accessor name.
+  get [KIND]() {
+    return 'dispatcher:' + this[kLabel];
+  }
+
+  close() {
+    if (this[kClosed]) return;
+    this[kClosed] = true;
+    this.emit('closed', this[kLabel], this[kCount]);
+  }
+
+  dispatch(path, handler) {
+    if (this[kClosed]) throw new Error(this[kLabel] + ' is closed');
+    this[kCount]++;
+    // Subclasses declare the symbol-keyed method this calls.
+    return this[kDispatch](path, handler);
+  }
+}
+
+module.exports = DispatcherBase;
diff --git a/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/lib/dispatcher.js b/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/lib/dispatcher.js
new file mode 100644
index 000000000..510208c49
--- /dev/null
+++ b/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/lib/dispatcher.js
@@ -0,0 +1,15 @@
+'use strict';
+
+const EventEmitter = require('node:events');
+
+class Dispatcher extends EventEmitter {
+  dispatch() {
+    throw new Error('not implemented');
+  }
+
+  close() {
+    throw new Error('not implemented');
+  }
+}
+
+module.exports = Dispatcher;
diff --git a/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/lib/pool.js b/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/lib/pool.js
new file mode 100644
index 000000000..837239fbd
--- /dev/null
+++ b/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/lib/pool.js
@@ -0,0 +1,20 @@
+'use strict';
+
+const Agent = require('./agent');
+const { kCount, kDispatch, kLabel } = require('./symbols');
+
+class Pool extends Agent {
+  constructor(size) {
+    super({ label: 'pool', prefix: '*' });
+    this.size = size;
+  }
+
+  // Overrides the symbol-keyed method Agent declares.
+  [kDispatch](path, handler) {
+    if (path.length > this.size) return false;
+    handler(this.prefix + ' ' + this[kLabel] + ' ' + path + ' #' + this[kCount]);
+    return true;
+  }
+}
+
+module.exports = Pool;
diff --git a/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/lib/symbols.js b/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/lib/symbols.js
new file mode 100644
index 000000000..a795c4178
--- /dev/null
+++ b/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/lib/symbols.js
@@ -0,0 +1,11 @@
+'use strict';
+
+// Keys shared across modules through one export table (undici's
+// core/symbols.js). Two keys deliberately share no description.
+module.exports = {
+  kClosed: Symbol('closed'),
+  kDispatch: Symbol('dispatch'),
+  kCount: Symbol('count'),
+  kLabel: Symbol('label'),
+  kOnClose: Symbol('on close'),
+};
diff --git a/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/package.json b/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/package.json
new file mode 100644
index 000000000..e187b1539
--- /dev/null
+++ b/tests/corpus/cjs-class-hierarchy-npm/node_modules/dispatchkit/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "dispatchkit",
+  "version": "1.0.0",
+  "main": "index.js",
+  "types": "index.d.ts"
+}
diff --git a/tests/corpus/cjs-open-options-npm/main.ts b/tests/corpus/cjs-open-options-npm/main.ts
new file mode 100644
index 000000000..9fd133155
--- /dev/null
+++ b/tests/corpus/cjs-open-options-npm/main.ts
@@ -0,0 +1,12 @@
+// TypeScript object literals passed to a JavaScript constructor whose
+// options parameter is a destructuring pattern with a rest element: the
+// literal's extra properties reach the rest object.
+import { Agent } from "optkit";
+
+console.log(new Agent().describe("a"));
+console.log(new Agent({ keepAliveTimeout: 10 }).describe("b"));
+console.log(new Agent({ maxOrigins: 2, keepAliveTimeout: 5, pipelining: 1 }).describe("c"));
+console.log(new Agent({ factory: (origin) => "client(" + origin + ")" }).describe("d"));
+
+class TracingAgent extends Agent {}
+console.log(new TracingAgent({ pipelining: 3 }).describe("e"));
diff --git a/tests/corpus/cjs-open-options-npm/node_modules/optkit/index.d.ts b/tests/corpus/cjs-open-options-npm/node_modules/optkit/index.d.ts
new file mode 100644
index 000000000..643b92d84
--- /dev/null
+++ b/tests/corpus/cjs-open-options-npm/node_modules/optkit/index.d.ts
@@ -0,0 +1,11 @@
+export interface Options {
+  factory?: (origin: string) => string;
+  maxOrigins?: number;
+  keepAliveTimeout?: number;
+  pipelining?: number;
+}
+
+export declare class Agent {
+  constructor(opts?: Options);
+  describe(origin: string): string;
+}
diff --git a/tests/corpus/cjs-open-options-npm/node_modules/optkit/index.js b/tests/corpus/cjs-open-options-npm/node_modules/optkit/index.js
new file mode 100644
index 000000000..0034fc442
--- /dev/null
+++ b/tests/corpus/cjs-open-options-npm/node_modules/optkit/index.js
@@ -0,0 +1,21 @@
+'use strict';
+
+function defaultFactory(origin) {
+  return 'pool(' + origin + ')';
+}
+
+// undici's Agent constructor shape: named options with defaults, and a rest
+// element collecting every other option for the per-origin dispatchers.
+class Agent {
+  constructor({ factory = defaultFactory, maxOrigins = Infinity, ...options } = {}) {
+    this.factory = factory;
+    this.maxOrigins = maxOrigins;
+    this.options = options;
+  }
+
+  describe(origin) {
+    return this.factory(origin) + ' max=' + this.maxOrigins + ' ' + JSON.stringify(this.options);
+  }
+}
+
+module.exports = { Agent };
diff --git a/tests/corpus/cjs-open-options-npm/node_modules/optkit/package.json b/tests/corpus/cjs-open-options-npm/node_modules/optkit/package.json
new file mode 100644
index 000000000..9552d73ee
--- /dev/null
+++ b/tests/corpus/cjs-open-options-npm/node_modules/optkit/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "optkit",
+  "version": "1.0.0",
+  "main": "index.js",
+  "types": "index.d.ts"
+}
diff --git a/tests/corpus/cjs-strict-arguments.cjs b/tests/corpus/cjs-strict-arguments.cjs
new file mode 100644
index 000000000..78af27f0d
--- /dev/null
+++ b/tests/corpus/cjs-strict-arguments.cjs
@@ -0,0 +1,43 @@
+// `arguments` as a value in CommonJS functions with parameters where Node
+// gives the unmapped object: a 'use strict' file prologue (undici's
+// webidl.argumentLengthCheck(arguments, 1, name) idiom) and non-simple
+// parameter lists. The object's elements never alias the parameters.
+'use strict';
+
+function argumentLengthCheck(args, min, ctx) {
+  if (args.length < min) {
+    throw new TypeError(`${ctx}: ${min} argument${min === 1 ? '' : 's'} required, but only ${args.length} present.`);
+  }
+}
+
+function getCookies(headers) {
+  argumentLengthCheck(arguments, 1, 'getCookies');
+  return 'cookies of ' + headers;
+}
+
+function setCookie(headers, cookie) {
+  argumentLengthCheck(arguments, 2, 'setCookie');
+  headers = headers + '!';
+  return headers + ' ' + cookie + ' ' + arguments[0];
+}
+
+function count(first, second) {
+  const args = arguments;
+  let total = 0;
+  for (let i = 0; i < args.length; i++) total += args[i];
+  return first + ':' + second + ':' + total;
+}
+
+console.log(getCookies('h1'));
+console.log(setCookie('h2', 'c=1'));
+try {
+  getCookies();
+} catch (err) {
+  console.log(err.name, err.message);
+}
+try {
+  setCookie('only');
+} catch (err) {
+  console.log(err.message);
+}
+console.log(count(1, 2), count(1, 2, 3, 4), count(5));
diff --git a/tests/corpus/cjs-symbol-key-collisions/client.js b/tests/corpus/cjs-symbol-key-collisions/client.js
new file mode 100644
index 000000000..aaa9dbb5d
--- /dev/null
+++ b/tests/corpus/cjs-symbol-key-collisions/client.js
@@ -0,0 +1,16 @@
+'use strict';
+
+const { kClose, kUrl } = require('./core-symbols');
+
+class Client {
+  constructor(url) {
+    this[kUrl] = url;
+    this[kClose] = 'core close slot';
+  }
+
+  close() {
+    return 'closing ' + this[kUrl] + ' (' + this[kClose] + ')';
+  }
+}
+
+module.exports = Client;
diff --git a/tests/corpus/cjs-symbol-key-collisions/core-symbols.js b/tests/corpus/cjs-symbol-key-collisions/core-symbols.js
new file mode 100644
index 000000000..e42309aa3
--- /dev/null
+++ b/tests/corpus/cjs-symbol-key-collisions/core-symbols.js
@@ -0,0 +1,6 @@
+'use strict';
+
+module.exports = {
+  kClose: Symbol('close'),
+  kUrl: Symbol('url'),
+};
diff --git a/tests/corpus/cjs-symbol-key-collisions/main.js b/tests/corpus/cjs-symbol-key-collisions/main.js
new file mode 100644
index 000000000..9f66616b4
--- /dev/null
+++ b/tests/corpus/cjs-symbol-key-collisions/main.js
@@ -0,0 +1,11 @@
+// Distinct symbols from two CommonJS key tables that share one description:
+// each keeps its own slot, and inspect prints both under Node's spelling.
+'use strict';
+
+const { inspect } = require('node:util');
+const MockClient = require('./mock-client');
+
+const m = new MockClient('http://a');
+console.log(m.shutdown());
+console.log(m.shutdown());
+console.log(inspect(m));
diff --git a/tests/corpus/cjs-symbol-key-collisions/mock-client.js b/tests/corpus/cjs-symbol-key-collisions/mock-client.js
new file mode 100644
index 000000000..17113c4bb
--- /dev/null
+++ b/tests/corpus/cjs-symbol-key-collisions/mock-client.js
@@ -0,0 +1,24 @@
+'use strict';
+
+const Client = require('./client');
+const { kClose, kCalls } = require('./mock-symbols');
+
+// Inherits the core `Symbol('close')` slot and declares a method under the
+// mock table's distinct `Symbol('close')` (undici's MockClient shape).
+class MockClient extends Client {
+  constructor(url) {
+    super(url);
+    this[kCalls] = '';
+  }
+
+  [kClose]() {
+    this[kCalls] = this[kCalls] + '*';
+    return 'mock close ' + this[kCalls];
+  }
+
+  shutdown() {
+    return this[kClose]() + ' then ' + this.close();
+  }
+}
+
+module.exports = MockClient;
diff --git a/tests/corpus/cjs-symbol-key-collisions/mock-symbols.js b/tests/corpus/cjs-symbol-key-collisions/mock-symbols.js
new file mode 100644
index 000000000..9726a8444
--- /dev/null
+++ b/tests/corpus/cjs-symbol-key-collisions/mock-symbols.js
@@ -0,0 +1,7 @@
+'use strict';
+
+// A second table reuses a description the first already holds.
+module.exports = {
+  kClose: Symbol('close'),
+  kCalls: Symbol('calls'),
+};
diff --git a/tests/corpus/cjs-symbol-key-collisions/package.json b/tests/corpus/cjs-symbol-key-collisions/package.json
new file mode 100644
index 000000000..5bbefffba
--- /dev/null
+++ b/tests/corpus/cjs-symbol-key-collisions/package.json
@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}
diff --git a/tests/corpus/cjs-symbol-key-table/main.js b/tests/corpus/cjs-symbol-key-table/main.js
new file mode 100644
index 000000000..2c639bf6e
--- /dev/null
+++ b/tests/corpus/cjs-symbol-key-table/main.js
@@ -0,0 +1,19 @@
+// Symbol-keyed class fields and methods whose keys come from a CommonJS
+// key table in another module: field declarations, constructor and method
+// assignments, a base method calling a subclass's symbol-keyed method,
+// reads through the table from a third module, and inspect output.
+'use strict';
+
+const { inspect } = require('node:util');
+const UpperQueue = require('./upper-queue');
+const { kState, kSize, kName } = require('./symbols');
+
+const q = new UpperQueue('jobs');
+console.log(q.push('a'), q.push('b'), q.push(3));
+console.log(q.state, q[kSize], q[kName]);
+console.log(q.drain());
+console.log(q.state, q[kSize], q[kState]);
+q[kName] = 'renamed';
+console.log(q.state);
+console.log(inspect(q));
+console.log(Object.keys(q));
diff --git a/tests/corpus/cjs-symbol-key-table/package.json b/tests/corpus/cjs-symbol-key-table/package.json
new file mode 100644
index 000000000..5bbefffba
--- /dev/null
+++ b/tests/corpus/cjs-symbol-key-table/package.json
@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}
diff --git a/tests/corpus/cjs-symbol-key-table/queue.js b/tests/corpus/cjs-symbol-key-table/queue.js
new file mode 100644
index 000000000..c5b7fdaf5
--- /dev/null
+++ b/tests/corpus/cjs-symbol-key-table/queue.js
@@ -0,0 +1,37 @@
+'use strict';
+
+const { kState, kSize, kName, kRun } = require('./symbols');
+
+class Queue {
+  // Field declarations keyed by table symbols.
+  [kState] = 'idle';
+
+  [kSize] = 0;
+
+  constructor(name) {
+    this[kName] = name;
+    this.items = [];
+  }
+
+  push(item) {
+    this.items.push(item);
+    this[kSize] = this.items.length;
+    return this[kSize];
+  }
+
+  drain() {
+    this[kState] = 'draining';
+    // The subclass declares the symbol-keyed method this calls.
+    const out = this[kRun](this.items);
+    this.items = [];
+    this[kSize] = 0;
+    this[kState] = 'idle';
+    return out;
+  }
+
+  get state() {
+    return this[kName] + ' is ' + this[kState];
+  }
+}
+
+module.exports = Queue;
diff --git a/tests/corpus/cjs-symbol-key-table/symbols.js b/tests/corpus/cjs-symbol-key-table/symbols.js
new file mode 100644
index 000000000..1eca50273
--- /dev/null
+++ b/tests/corpus/cjs-symbol-key-table/symbols.js
@@ -0,0 +1,11 @@
+// The key table: one module exports every symbol its siblings use as
+// class keys (undici's core/symbols.js). Each property names one symbol
+// identity for all requirers.
+'use strict';
+
+module.exports = {
+  kState: Symbol('state'),
+  kSize: Symbol('size'),
+  kName: Symbol('name'),
+  kRun: Symbol('run'),
+};
diff --git a/tests/corpus/cjs-symbol-key-table/upper-queue.js b/tests/corpus/cjs-symbol-key-table/upper-queue.js
new file mode 100644
index 000000000..cebdb5b58
--- /dev/null
+++ b/tests/corpus/cjs-symbol-key-table/upper-queue.js
@@ -0,0 +1,12 @@
+'use strict';
+
+const Queue = require('./queue');
+const symbols = require('./symbols');
+
+class UpperQueue extends Queue {
+  [symbols.kRun](items) {
+    return items.map((item) => String(item).toUpperCase()).join(' ');
+  }
+}
+
+module.exports = UpperQueue;
diff --git a/tests/corpus/cjs-unmapped-arguments.cjs b/tests/corpus/cjs-unmapped-arguments.cjs
new file mode 100644
index 000000000..ab4a8f3cb
--- /dev/null
+++ b/tests/corpus/cjs-unmapped-arguments.cjs
@@ -0,0 +1,28 @@
+// Sloppy-mode CommonJS functions whose parameter lists are not simple
+// (defaults, destructuring) get the unmapped `arguments` object:
+// writing a parameter never shows through it.
+function withDefault(a, b = 2) {
+  a = 'changed';
+  return [a, b, arguments.length, arguments[0]].join(' ');
+}
+
+function withPattern({ x }, y) {
+  y = 'changed';
+  return [x, y, arguments.length, arguments[1]].join(' ');
+}
+
+function passAlong(first, { y } = {}) {
+  first = 'changed';
+  return collect(arguments) + ' / ' + y + ' ' + first;
+}
+
+function collect(args) {
+  const out = [];
+  for (let i = 0; i < args.length; i++) out.push(String(args[i]));
+  return out.join(',');
+}
+
+console.log(withDefault('orig'));
+console.log(withDefault('orig', 5, 6));
+console.log(withPattern({ x: 1 }, 'orig'));
+console.log(passAlong('a', { y: 'b' }, 'c'));
diff --git a/tests/corpus/constructor-returns-chained-this.js b/tests/corpus/constructor-returns-chained-this.js
new file mode 100644
index 000000000..c3a2a0469
--- /dev/null
+++ b/tests/corpus/constructor-returns-chained-this.js
@@ -0,0 +1,40 @@
+// The JavaScript shape three.js ships: the constructor returns a chainable
+// setter's result and other classes extend it.
+class Color {
+  constructor(r, g, b) {
+    this.isColor = true;
+    this.r = 1;
+    this.g = 1;
+    this.b = 1;
+    return this.set(r, g, b);
+  }
+  set(r, g, b) {
+    if (g === undefined && b === undefined) {
+      if (r !== undefined) this.setScalar(r);
+    } else {
+      this.r = r;
+      this.g = g;
+      this.b = b;
+    }
+    return this;
+  }
+  setScalar(s) {
+    this.r = this.g = this.b = s;
+    return this;
+  }
+}
+class Tinted extends Color {
+  constructor(r, g, b, tint) {
+    super(r, g, b);
+    this.tint = tint;
+  }
+  set(r, g, b, a = 1) {
+    this.a = a;
+    return super.set(r, g, b);
+  }
+}
+const c = new Color(0.5);
+console.log(c.r, c.g, c.b, c instanceof Color);
+const t = new Tinted(0.1, 0.2, 0.3, 'warm');
+console.log(t.r, t.g, t.b, t.a, t.tint, t instanceof Tinted, t instanceof Color);
+console.log(new Color().r);
diff --git a/tests/corpus/constructor-returns-chained-this.ts b/tests/corpus/constructor-returns-chained-this.ts
new file mode 100644
index 000000000..d2a9f3955
--- /dev/null
+++ b/tests/corpus/constructor-returns-chained-this.ts
@@ -0,0 +1,38 @@
+// A constructor that ends with `return this.set(...)`, where every
+// reachable `set` returns `this`, answers the constructed instance, so
+// subclasses still construct through super() (three.js's Color).
+class Color {
+  r = 0;
+  g = 0;
+  b = 0;
+  constructor(r?: number, g?: number, b?: number) {
+    return this.set(r ?? 0, g ?? 0, b ?? 0);
+  }
+  set(r: number, g: number, b: number): this {
+    if (r < 0) return this.clear();
+    this.r = r;
+    this.g = g;
+    this.b = b;
+    return this;
+  }
+  clear(): this {
+    this.r = this.g = this.b = 0;
+    return this;
+  }
+}
+class NamedColor extends Color {
+  name: string;
+  constructor(name: string, r: number, g: number, b: number) {
+    super(r, g, b);
+    this.name = name;
+  }
+  override set(r: number, g: number, b: number): this {
+    super.set(r * 2, g * 2, b * 2);
+    return this;
+  }
+}
+const plain = new Color(1, 2, 3);
+console.log(plain instanceof Color, plain.r, plain.g, plain.b);
+console.log(new Color(-1, 5, 5).r, new Color().b);
+const named = new NamedColor("teal", 0, 1, 2);
+console.log(named instanceof NamedColor, named instanceof Color, named.name, named.r, named.g, named.b);
diff --git a/tests/corpus/constructor-returns-instance.js b/tests/corpus/constructor-returns-instance.js
new file mode 100644
index 000000000..ab7af8b2c
--- /dev/null
+++ b/tests/corpus/constructor-returns-instance.js
@@ -0,0 +1,45 @@
+// JavaScript constructors whose returned value is typed only at run time:
+// an instance of the class replaces `this`, a primitive keeps it.
+class Connection {
+  constructor(url) {
+    if (Connection.open && Connection.open.url === url) return Connection.open;
+    this.url = url;
+    this.uses = 0;
+    Connection.open = this;
+  }
+  use() {
+    this.uses++;
+    return this;
+  }
+}
+const c1 = new Connection("db://a").use();
+const c2 = new Connection("db://a").use();
+const c3 = new Connection("db://b").use();
+console.log(c1 === c2, c2.uses, c3 === c1, c3.uses, c3.url);
+
+class Counter {
+  constructor(start, answer) {
+    this.count = start;
+    return answer;
+  }
+}
+console.log(new Counter(1, 5).count, new Counter(2, "x").count, new Counter(3, null).count);
+console.log(new Counter(4, undefined).count, new Counter(5, true).count);
+const kept = new Counter(6, 0);
+console.log(new Counter(7, kept) === kept, kept.count);
+
+const memoCache = new Map();
+let memoCreated = 0;
+class Memo {
+  constructor(key) {
+    const hit = memoCache.get(key);
+    if (hit !== undefined) return hit;
+    this.key = key;
+    this.created = ++memoCreated;
+    memoCache.set(key, this);
+  }
+}
+const m1 = new Memo("k");
+const m2 = new Memo("k");
+const m3 = new Memo("j");
+console.log(m1 === m2, m3 === m1, m2.created, m3.created, memoCreated);
diff --git a/tests/corpus/constructor-returns-instance.ts b/tests/corpus/constructor-returns-instance.ts
new file mode 100644
index 000000000..81e25a12d
--- /dev/null
+++ b/tests/corpus/constructor-returns-instance.ts
@@ -0,0 +1,112 @@
+// A constructor's returned object replaces the constructed instance when it
+// is an object; primitive, bare and `this` returns answer the instance.
+class Registry {
+  static current: Registry | undefined = undefined;
+  readonly id: number = 0;
+  entries: string[] = [];
+  constructor(id: number) {
+    if (Registry.current) return Registry.current;
+    this.id = id;
+    Registry.current = this;
+  }
+  add(entry: string): this {
+    this.entries.push(entry);
+    return this;
+  }
+}
+const first = new Registry(1).add("a");
+const second = new Registry(2).add("b");
+console.log(first === second, second.id, second.entries.join(","));
+
+// An instance returned only on some paths.
+class Slot {
+  static previous: Slot | undefined = undefined;
+  label: string;
+  constructor(label: string, reuse: boolean) {
+    this.label = label;
+    const previous = Slot.previous;
+    Slot.previous = this;
+    if (reuse && previous) return previous;
+  }
+}
+const s1 = new Slot("one", true);
+const s2 = new Slot("two", true);
+const s3 = new Slot("three", false);
+console.log(s1.label, s2.label, s3.label, s2 === s1, s3 === s2);
+
+// Constructing the class again inside its own constructor.
+class Node2 {
+  static made = 0;
+  value: number;
+  child: Node2 | null = null;
+  constructor(depth: number, share: Node2 | null) {
+    Node2.made++;
+    this.value = depth;
+    if (share !== null) return share;
+    if (depth > 0) this.child = new Node2(depth - 1, null);
+  }
+}
+const root = new Node2(2, null);
+const alias = new Node2(9, root);
+console.log(alias === root, alias.value, root.child?.value, root.child?.child?.value, Node2.made);
+
+// A constructor that throws leaves later constructions unaffected.
+class Guarded {
+  static kept: Guarded | undefined = undefined;
+  n: number;
+  constructor(n: number) {
+    if (n < 0) throw new RangeError(`negative: ${n}`);
+    this.n = n;
+    if (n === 0 && Guarded.kept) return Guarded.kept;
+    Guarded.kept = this;
+  }
+}
+try {
+  new Guarded(-1);
+} catch (e) {
+  console.log((e as Error).message);
+}
+const g1 = new Guarded(5);
+const g2 = new Guarded(0);
+const g3 = new Guarded(7);
+console.log(g1.n, g2.n, g3.n, g1 === g2, g3 === g1);
+
+// Primitive, bare and `this` returns keep the constructed instance.
+class Plain {
+  v = 3;
+  constructor(mode: number) {
+    if (mode === 1) return;
+    if (mode === 2) return this;
+  }
+}
+const plain = new Plain(2);
+console.log(new Plain(0).v, new Plain(1).v, plain.v, plain instanceof Plain);
+
+// The derived class's own constructor may return an instance of itself.
+class Animal {
+  sound = "...";
+}
+class Dog extends Animal {
+  static pack: Dog[] = [];
+  name: string;
+  constructor(name: string) {
+    super();
+    this.name = name;
+    this.sound = "woof";
+    const known = Dog.pack.find((d) => d.name === name);
+    if (known) return known;
+    Dog.pack.push(this);
+  }
+}
+const rex = new Dog("rex");
+const again = new Dog("rex");
+const fido = new Dog("fido");
+console.log(rex === again, fido === rex, Dog.pack.length, again.sound, again instanceof Animal);
+
+// Constructions through class values take the returned instance too.
+const Ctor: typeof Registry = Registry;
+console.log(new Ctor(3) === first);
+function build<T>(make: new (id: number) => T, id: number): T {
+  return new make(id);
+}
+console.log(build(Registry, 4) === first, build(Registry, 5).entries.length);
diff --git a/tests/corpus/constructor-returns-this-super.js b/tests/corpus/constructor-returns-this-super.js
new file mode 100644
index 000000000..3901c5553
--- /dev/null
+++ b/tests/corpus/constructor-returns-this-super.js
@@ -0,0 +1,33 @@
+// A JavaScript base constructor that returns `this` through a method, as
+// three.js's Color does: `super()` from a subclass keeps the subclass's own
+// instance.
+class Color {
+  constructor(r, g, b) {
+    this.r = 1;
+    this.g = 1;
+    this.b = 1;
+    return this.set(r, g, b);
+  }
+  set(r, g, b) {
+    if (g === undefined) {
+      this.r = this.g = this.b = r;
+    } else {
+      this.r = r;
+      this.g = g;
+      this.b = b;
+    }
+    return this;
+  }
+}
+class Color4 extends Color {
+  constructor(r, g, b, a = 1) {
+    super(r, g, b);
+    this.a = a;
+  }
+}
+const c = new Color(0.5);
+const c4 = new Color4(0.1, 0.2, 0.3);
+const c4b = new Color4(1, 0, 0, 0.5);
+console.log(c.r, c.g, c.b, c instanceof Color);
+console.log(c4.r, c4.g, c4.b, c4.a, c4 instanceof Color4, c4 instanceof Color);
+console.log(c4b.a, c4b !== c4, Object.keys(c4b).join(","));
diff --git a/tests/corpus/es5-constructor-inspect-names.cjs b/tests/corpus/es5-constructor-inspect-names.cjs
new file mode 100644
index 000000000..b7cc84349
--- /dev/null
+++ b/tests/corpus/es5-constructor-inspect-names.cjs
@@ -0,0 +1,41 @@
+// util.inspect names objects built by plain constructor functions after
+// the constructor their prototype chain records, as Node does.
+'use strict';
+const util = require('util');
+function Point(x, y) {
+  this.x = x;
+  this.y = y;
+}
+Point.prototype.norm = function () {
+  return Math.hypot(this.x, this.y);
+};
+const p = new Point(3, 4);
+console.log(p, p.norm());
+p.z = 0;
+console.log(p);
+function Empty() {}
+console.log(new Empty(), [new Empty()], { inner: new Empty() });
+console.log(util.inspect(new Point(1, 2)));
+console.log(`${util.inspect({ list: [new Point(0, 1)] })}`);
+// A subclass whose prototype was replaced without a constructor reports
+// the nearest constructor on the chain.
+function Base(n) {
+  this.n = n;
+}
+function Derived(n) {
+  Base.call(this, n);
+  this.extra = true;
+}
+Derived.prototype = Object.create(Base.prototype);
+console.log(new Derived(1));
+Derived.prototype.constructor = Derived;
+console.log(new Derived(2));
+// A replaced prototype object without a constructor prints plainly.
+function Plain() {
+  this.v = 1;
+}
+Plain.prototype = { get() { return this.v; } };
+console.log(new Plain());
+const made = Object.create(Point.prototype);
+made.x = 9;
+console.log(made);
diff --git a/tests/corpus/exponent-unit-base.ts b/tests/corpus/exponent-unit-base.ts
new file mode 100644
index 000000000..d8d4cd1ac
--- /dev/null
+++ b/tests/corpus/exponent-unit-base.ts
@@ -0,0 +1,16 @@
+// `**` answers NaN for a base of ±1 with a NaN or infinite exponent, where
+// libm's pow (and LLVM's folding of pow(1, x)) answers 1.
+const values = [Infinity, -Infinity, NaN, 0, -0, 2, 0.5];
+const read = (i: number): number => values[i % values.length]!;
+for (let i = 0; i < values.length; i++) {
+  const x = read(i);
+  console.log(x, 1 ** x, (-1) ** x, x ** 0, x ** 1, 2 ** x, x ** -1);
+}
+let base = 1;
+let exponent = Infinity;
+console.log(base ** exponent, (-base) ** exponent, base ** NaN);
+exponent = 3;
+console.log(base ** exponent, (-1) ** exponent);
+let acc = 1;
+acc **= Infinity;
+console.log(acc, Math.pow(1, Infinity), NaN ** 0, (-0) ** -1, 0 ** -1);
diff --git a/tests/corpus/function-local-detached-methods.js b/tests/corpus/function-local-detached-methods.js
new file mode 100644
index 000000000..9bde77a19
--- /dev/null
+++ b/tests/corpus/function-local-detached-methods.js
@@ -0,0 +1,22 @@
+// A method of a function-local class that never reads `this` keeps working
+// when it is taken off an instance and called detached or with another
+// receiver.
+'use strict';
+
+function make(label) {
+  class Box {
+    one() {
+      return 1;
+    }
+
+    named() {
+      return `box ${label}`;
+    }
+  }
+  return new Box();
+}
+
+const box = make('a');
+const one = box.one;
+console.log(one(), box.one.call(null), box.one.call({}), box.named());
+console.log([box, make('b')].map((b) => b.one()).join(','));
diff --git a/tests/corpus/function-local-detached-methods.ts b/tests/corpus/function-local-detached-methods.ts
new file mode 100644
index 000000000..ba4d3ba3c
--- /dev/null
+++ b/tests/corpus/function-local-detached-methods.ts
@@ -0,0 +1,19 @@
+// A method of a function-local class that never reads `this` keeps working
+// when it is taken off an instance and called detached or with another
+// receiver.
+function make(label: string) {
+  class Box {
+    one(): number {
+      return 1;
+    }
+
+    named(): string {
+      return `box ${label}`;
+    }
+  }
+  return new Box();
+}
+
+const box = make("a");
+const one = box.one;
+console.log(one(), box.one.call(null), box.one.call({}), box.named());
diff --git a/tests/corpus/function-local-private-evaluations.js b/tests/corpus/function-local-private-evaluations.js
new file mode 100644
index 000000000..6e18a4766
--- /dev/null
+++ b/tests/corpus/function-local-private-evaluations.js
@@ -0,0 +1,172 @@
+// Each evaluation of a function-local class creates its own private names.
+// A method taken from one evaluation and called with an instance of another
+// (through call, a prototype read, or a checked receiver) finds no brand:
+// field reads and writes throw Node's TypeErrors and `#x in this` answers
+// false. Calls within one evaluation share the instance's fields.
+'use strict';
+
+function make(label) {
+  class Counter {
+    #count = 0;
+    #label = label;
+    #format = (n) => `${label}#${n}`;
+
+    bump() {
+      this.#count = this.#count + 1;
+      return `${this.#label}:${this.#count}`;
+    }
+
+    add(n) {
+      this.#count += n;
+      return this.#count;
+    }
+
+    increment() {
+      this.#count++;
+      return this.#count;
+    }
+
+    reset() {
+      [this.#count] = [0];
+      return this.#count;
+    }
+
+    assign() {
+      return (this.#count = 7);
+    }
+
+    order(note) {
+      this.#count = note();
+      return this.#count;
+    }
+
+    has() {
+      return #count in this;
+    }
+
+    later() {
+      return () => this.#label;
+    }
+
+    describe() {
+      return this.#format(this.#count);
+    }
+
+    get count() {
+      return this.#count;
+    }
+
+    set count(value) {
+      this.#count = value;
+    }
+  }
+
+  class Tagged extends Counter {
+    tag() {
+      return `tagged ${this.bump()}`;
+    }
+  }
+
+  return { counter: () => new Counter(), tagged: () => new Tagged() };
+}
+
+function attempt(label, fn) {
+  try {
+    console.log(label, fn());
+  } catch (e) {
+    console.log(label, e instanceof TypeError, e.message);
+  }
+}
+
+const one = make('one');
+const two = make('two');
+const a = one.counter();
+const b = two.counter();
+const a2 = one.counter();
+
+console.log(a.bump(), a.bump(), b.bump(), a2.bump());
+console.log(a.add(5), a.increment(), a.has(), a.later()());
+
+// Borrowed within one evaluation: the fields are the instance's own.
+const bump = a.bump;
+console.log(bump.call(a2), a2.bump(), bump.call(a));
+console.log(Object.getPrototypeOf(a).bump.call(a2));
+
+// Borrowed across evaluations.
+attempt('call read', () => a.bump.call(b));
+attempt('compound', () => a.add.call(b, 1));
+attempt('update', () => a.increment.call(b));
+attempt('destructure', () => a.reset.call(b));
+attempt('assign value', () => a.assign.call(b));
+attempt('value first', () =>
+  a.order.call(b, () => {
+    console.log('value evaluated');
+    return 1;
+  }),
+);
+attempt('proto read', () => Object.getPrototypeOf(a).bump.call(b));
+attempt('has other', () => a.has.call(b));
+attempt('has own', () => a.has.call(a2));
+attempt('arrow', () => a.later.call(b)());
+attempt('field call', () => a.describe.call(b));
+attempt('field call own', () => a.describe.call(a2));
+attempt('apply', () => a.bump.apply(b));
+attempt('bind', () => a.bump.bind(b)());
+attempt('Reflect.apply', () => Reflect.apply(a.bump, b, []));
+const proto = Object.getPrototypeOf(a);
+const bumpDescriptor = /** @type {any} */ (Object.getOwnPropertyDescriptor(proto, 'bump'));
+const countDescriptor = /** @type {any} */ (Object.getOwnPropertyDescriptor(proto, 'count'));
+attempt('descriptor value', () => bumpDescriptor.value.call(b));
+attempt('getter', () => countDescriptor.get.call(b));
+attempt('setter', () => countDescriptor.set.call(b, 5));
+attempt('Reflect.get', () => Reflect.get(a, 'count', b));
+attempt('Reflect.set', () => Reflect.set(a, 'count', 3, b));
+attempt('own getter', () => [countDescriptor.get.call(a2), Reflect.get(a, 'count', a2)].join(' '));
+console.log(b.bump(), b.count, (b.count = 10), b.bump());
+
+// Receivers that are not instances.
+for (const recv of [{}, [], undefined, null, 1, 'x']) {
+  attempt(`read ${String(recv)}`, () => a.bump.call(recv));
+  attempt(`write ${String(recv)}`, () => a.reset.call(recv));
+  attempt(`has ${String(recv)}`, () => a.has.call(recv));
+}
+
+// A subclass declared after the class in the same function carries the
+// brand of its own evaluation.
+const t1 = one.tagged();
+const t2 = two.tagged();
+console.log(t1.tag(), t2.tag(), t1.has(), a.has.call(t1), a.has.call(t2));
+attempt('subclass across', () => a.bump.call(t2));
+attempt('subclass own', () => b.bump.call(t2));
+
+// undici's iterator guard: the error comes from the method itself.
+function createIterator(name) {
+  class FastIterableIterator {
+    #target;
+    #index = 0;
+
+    constructor(target) {
+      this.#target = target;
+    }
+
+    next() {
+      if (typeof this !== 'object' || this === null || !(#target in this)) {
+        throw new TypeError(`'next' called on an object that does not implement interface ${name} Iterator.`);
+      }
+      const index = this.#index;
+      if (index >= this.#target.length) return { value: undefined, done: true };
+      this.#index = index + 1;
+      return { value: this.#target[index], done: false };
+    }
+  }
+  return (target) => new FastIterableIterator(target);
+}
+
+const headers = createIterator('Headers');
+const params = createIterator('Params');
+const it = headers(['a', 'b']);
+const next = it.next;
+console.log(JSON.stringify(next.call(it)), JSON.stringify(it.next()), JSON.stringify(next.call(it)));
+for (const recv of [headers(['c']), params(['d']), {}, null]) {
+  attempt('next', () => JSON.stringify(next.call(recv)));
+}
diff --git a/tests/corpus/function-local-private-fields.js b/tests/corpus/function-local-private-fields.js
new file mode 100644
index 000000000..c8c999659
--- /dev/null
+++ b/tests/corpus/function-local-private-fields.js
@@ -0,0 +1,48 @@
+// A class declared inside a function with private fields used only on
+// `this` (undici's webidl createIterator): each evaluation's instances meet
+// only their own methods, so one compiled layout serves every evaluation.
+'use strict';
+
+function createIterator(name, entries) {
+  class FastIterableIterator {
+    #target;
+    #kind;
+    #index;
+
+    constructor(target, kind) {
+      this.#target = target;
+      this.#kind = kind;
+      this.#index = 0;
+    }
+
+    next() {
+      if (typeof this !== 'object' || this === null || !(#target in this)) {
+        throw new TypeError(`'next' called on an object that does not implement interface ${name} Iterator.`);
+      }
+      const values = entries(this.#target);
+      if (this.#index >= values.length) return { value: undefined, done: true };
+      const pair = values[this.#index];
+      this.#index = this.#index + 1;
+      if (this.#kind === 'key') return { value: pair[0], done: false };
+      if (this.#kind === 'value') return { value: pair[1], done: false };
+      return { value: pair[0] + '=' + pair[1], done: false };
+    }
+  }
+  return function (target, kind) {
+    return new FastIterableIterator(target, kind);
+  };
+}
+
+const headers = createIterator('Headers', (t) => t.pairs);
+const params = createIterator('Params', (t) => t.list);
+
+function drain(it) {
+  const out = [];
+  for (let step = it.next(); !step.done; step = it.next()) out.push(step.value);
+  return out.join(',');
+}
+
+const target = { pairs: [['a', '1'], ['b', '2']] };
+console.log(drain(headers(target, 'key')));
+console.log(drain(headers(target, 'value')));
+console.log(drain(params({ list: [['x', 'y']] }, 'key+value')));
diff --git a/tests/corpus/key-order-late-optional.ts b/tests/corpus/key-order-late-optional.ts
new file mode 100644
index 000000000..f4742acb0
--- /dev/null
+++ b/tests/corpus/key-order-late-optional.ts
@@ -0,0 +1,84 @@
+// An optional key that no literal creates is appended when it is first
+// assigned, after every key the value was built with, and straight-line
+// assignments of several such keys keep their program order, including
+// assignments behind conditions. Assigning a key that already exists never
+// moves it.
+interface Item {
+  label?: string;
+  id: number;
+  done: boolean;
+}
+function makeItem(id: number): Item {
+  return { id, done: false };
+}
+const item = makeItem(1);
+item.label = "first";
+console.log(Object.keys(item).join(","), JSON.stringify(item));
+console.log(item);
+const direct: Item = { id: 2, done: true };
+direct.label = "second";
+console.log(Object.keys(direct).join(","), JSON.stringify(direct));
+const untouched = makeItem(3);
+console.log(JSON.stringify(untouched), Object.keys(untouched).join(","));
+
+// Two late keys assigned in reverse declaration order.
+interface Pos {
+  id: number;
+  x?: number;
+  y?: number;
+}
+function makePos(): Pos {
+  return { id: 0 };
+}
+const pos = makePos();
+pos.y = 1;
+pos.x = 2;
+console.log(Object.keys(pos).join(","), JSON.stringify(pos));
+console.log(pos);
+pos.id = 3;
+console.log(JSON.stringify(pos));
+
+// An options object filled key by key, some keys conditionally.
+interface Opts {
+  verbose?: boolean;
+  depth?: number;
+  name?: string;
+}
+function build(deep: boolean, loud: boolean): Opts {
+  const o: Opts = {};
+  o.name = "n";
+  if (deep) o.depth = 2;
+  if (loud) o.verbose = true;
+  return o;
+}
+for (const deep of [true, false])
+  for (const loud of [true, false]) console.log(JSON.stringify(build(deep, loud)));
+console.log(build(true, true));
+const forIn: string[] = [];
+for (const k in build(true, true)) forIn.push(k);
+console.log(forIn.join(","));
+
+// Late keys on records stored in arrays and Maps.
+interface Task {
+  owner?: string;
+  title: string;
+  priority: number;
+}
+const tasks: Task[] = [];
+for (let i = 0; i < 3; i++) tasks.push({ title: "t" + i, priority: i });
+for (const t of tasks) if (t.priority > 0) t.owner = "o" + t.priority;
+console.log(JSON.stringify(tasks));
+const byTitle = new Map<string, Task>();
+for (const t of tasks) byTitle.set(t.title, t);
+console.log(byTitle);
+
+// An explicit undefined is a present key at its literal position.
+interface Maybe {
+  a?: number;
+  b: number;
+}
+function makeMaybe(): Maybe {
+  return { b: 1, a: undefined };
+}
+console.log(Object.keys(makeMaybe()).join(","), JSON.stringify(makeMaybe()));
+console.log(makeMaybe());
diff --git a/tests/corpus/key-order-literal-flows.ts b/tests/corpus/key-order-literal-flows.ts
new file mode 100644
index 000000000..350e78ffa
--- /dev/null
+++ b/tests/corpus/key-order-literal-flows.ts
@@ -0,0 +1,150 @@
+// Records enumerate their keys in the order their object literals create
+// them, even when every literal writes the keys in another order than the
+// type declares them and the value is observed far from the literal:
+// factory returns, arrays, Maps, nested records, generic factories, union
+// arms, records widened to unknown/any, structuredClone, and every
+// order-observing surface (keys, values, entries, for...in, JSON.stringify
+// with replacers and indentation, inspect, console.log, util.format).
+import { format, inspect } from "node:util";
+
+interface Point {
+  x: number;
+  y: number;
+  label: string;
+}
+function makePoint(i: number): Point {
+  return { label: "p" + i, y: i * 2, x: i };
+}
+
+const p = makePoint(1);
+console.log(Object.keys(p).join(","));
+console.log(Object.values(p).join(","));
+console.log(JSON.stringify(Object.entries(p)));
+const forIn: string[] = [];
+for (const k in p) forIn.push(k);
+console.log(forIn.join(","));
+console.log(JSON.stringify(p));
+console.log(JSON.stringify(p, null, 2));
+console.log(JSON.stringify(p, ["y", "x"]));
+const visited: string[] = [];
+JSON.stringify(p, (key: string, value: unknown) => {
+  visited.push(key);
+  return value;
+});
+console.log(visited.join(","));
+console.log(p);
+console.log(inspect(p));
+console.log(format("%o|%j|%O", p, p, p));
+
+// Arrays of records: literals pushed in a loop and produced by map.
+interface Row {
+  id: number;
+  name: string;
+  score: number;
+}
+const rows: Row[] = [];
+for (let i = 0; i < 3; i++) rows.push({ name: "n" + i, score: i * 10, id: i });
+for (const r of rows) console.log(Object.values(r).join("|"));
+console.log(JSON.stringify(rows));
+const mapped: Row[] = [4, 5].map((i) => ({ name: "m" + i, score: i, id: i * 100 }));
+console.log(JSON.stringify(mapped));
+console.log(mapped);
+
+// Records stored in a Map, read back, serialized and inspected.
+const byName = new Map<string, Row>();
+for (const r of rows) byName.set(r.name, r);
+byName.set("extra", { name: "extra", score: 9, id: 99 });
+console.log(byName);
+console.log(JSON.stringify([...byName.values()]));
+console.log(Object.keys(byName.get("extra")!).join(","));
+
+// Nested records: every level keeps its own literal's order.
+interface Inner {
+  b: number;
+  a: number;
+}
+interface Outer {
+  inner: Inner;
+  id: number;
+  tags: string[];
+}
+function makeOuter(id: number): Outer {
+  return { id, tags: ["t" + id], inner: { a: id, b: id + 1 } };
+}
+console.log(JSON.stringify(makeOuter(1)));
+console.log(makeOuter(2));
+console.log(JSON.stringify([makeOuter(3), makeOuter(4)], null, 1));
+
+// Generic factories instantiate per type argument.
+function boxed<T>(value: T): { value: T; tag: string; count: number } {
+  return { tag: "box", count: 1, value };
+}
+console.log(JSON.stringify(boxed(7)));
+console.log(JSON.stringify(boxed("s")));
+console.log(Object.keys(boxed(true)).join(","));
+
+// Union arms keep their own literal orders.
+type Shape = { kind: "circle"; r: number } | { kind: "rect"; w: number; h: number };
+function shapeAt(i: number): Shape {
+  return i % 2 === 0 ? { r: i, kind: "circle" } : { h: i, kind: "rect", w: i + 1 };
+}
+const shapes: Shape[] = [shapeAt(0), shapeAt(1), shapeAt(2)];
+for (const s of shapes) console.log(JSON.stringify(s));
+console.log(shapes);
+
+// Widened to unknown and any, and cloned.
+const u: unknown = makePoint(3);
+console.log(JSON.stringify(u));
+const loose: any = makePoint(4);
+console.log(Object.keys(loose).join(","));
+const cloned = structuredClone(makePoint(5));
+console.log(JSON.stringify(cloned), Object.keys(cloned).join(","));
+
+// Integer-like keys still come first, ascending, ahead of the literal order.
+interface Indexed {
+  name: string;
+  "10": number;
+  "2": number;
+  "01": number;
+}
+function makeIndexed(): Indexed {
+  return { "01": 1, name: "n", "10": 10, "2": 2 };
+}
+console.log(JSON.stringify(makeIndexed()));
+console.log(Object.keys(makeIndexed()).join(","));
+
+// A literal whose fields are flipped by later assignments: assigning an
+// existing key never moves it (the pattern of scriptc's own
+// RuntimeFeatures scan).
+interface Features {
+  regex: boolean;
+  eventTarget: boolean;
+  warningReplace: boolean;
+  stdioExtended: boolean;
+  processEvents: boolean;
+  emitter: boolean;
+}
+function scanFeatures(classes: string[], workers: boolean): Features {
+  const features: Features = {
+    regex: false,
+    eventTarget: classes.some((c) => c === "EventTarget"),
+    processEvents: false,
+    warningReplace: false,
+    stdioExtended: false,
+    emitter: workers,
+  };
+  if (classes.length > 1) features.regex = true;
+  features.stdioExtended = workers;
+  return features;
+}
+console.log(JSON.stringify(scanFeatures(["EventTarget", "X"], true)));
+console.log(JSON.stringify(scanFeatures([], false)));
+
+// Literals written in declaration order keep it.
+interface Ordered {
+  first: string;
+  second: number;
+  third: boolean;
+}
+const ordered: Ordered = { first: "f", second: 2, third: true };
+console.log(JSON.stringify(ordered), Object.keys(ordered).join(","));
diff --git a/tests/corpus/key-order-spread-copies.ts b/tests/corpus/key-order-spread-copies.ts
new file mode 100644
index 000000000..b677eb0a4
--- /dev/null
+++ b/tests/corpus/key-order-spread-copies.ts
@@ -0,0 +1,107 @@
+// Copies keep the key order of the values they copy: a spread places the
+// source's keys at the spread's position in the source's own order, an
+// override keeps the position the spread gave it, and new keys follow.
+// Rest bindings, width copies, Object.assign and structuredClone keep the
+// source order too, including when the source literal was written in
+// another order than its type declares.
+interface Source {
+  a: number;
+  b: number;
+  c: number;
+}
+function makeSource(i: number): Source {
+  return { c: i, b: i + 1, a: i + 2 };
+}
+
+// Spread followed by a new key, and by an override.
+interface Extended {
+  a: number;
+  b: number;
+  c: number;
+  d: number;
+}
+const extended: Extended = { ...makeSource(1), d: 4 };
+console.log(JSON.stringify(extended), Object.keys(extended).join(","));
+const overridden: Source = { ...makeSource(2), b: 0 };
+console.log(JSON.stringify(overridden));
+interface Led {
+  a: number;
+  b: number;
+  c: number;
+  lead: number;
+}
+const leading: Led = { lead: 0, ...makeSource(3) };
+console.log(JSON.stringify(leading));
+
+// A spread whose overrides change field types builds a new shape through
+// the field-by-field desugar (scriptc's own frontend-cache writer).
+interface Entry {
+  ok: true;
+  llvm: string;
+  ir: string[] | null;
+  sidecarJson: string | null;
+  features: number;
+  sources: [string, string][];
+  warnings?: string[];
+}
+function makeEntry(): Entry {
+  return { ok: true, llvm: "L", ir: ["x"], sidecarJson: null, features: 1, sources: [] };
+}
+const entry = makeEntry();
+console.log(JSON.stringify({ schema: "v3", input: { ...entry, llvm: "", ir: null } }));
+
+// Same-shape updates keep every key in place.
+interface State {
+  name: string;
+  count: number;
+  last: string | undefined;
+}
+let state: State = { count: 0, last: undefined, name: "s" };
+for (let i = 0; i < 3; i++) state = { ...state, count: state.count + 1, last: "i" + i };
+console.log(JSON.stringify(state), Object.keys(state).join(","));
+console.log({ ...state, name: "shown" });
+
+// Rest bindings copy the remaining keys in the source's order.
+const { b, ...rest } = makeSource(5);
+console.log(b, JSON.stringify(rest), Object.keys(rest).join(","));
+let picked: number;
+let restAgain: { a: number; c: number };
+({ b: picked, ...restAgain } = makeSource(6));
+console.log(picked, JSON.stringify(restAgain), Object.keys(restAgain).join(","));
+
+// Width copies into an optional-widened type and assignment into a fresh
+// target.
+interface Wider {
+  a: number;
+  b: number;
+  c: number;
+  note?: string;
+}
+function widen(s: Source): Wider {
+  return s;
+}
+console.log(JSON.stringify(widen(makeSource(7))));
+const assigned = Object.assign({ z: 0 }, makeSource(8));
+console.log(JSON.stringify(assigned));
+console.log(JSON.stringify(structuredClone(makeSource(9))));
+
+// Nested spreads of nested records.
+interface Holder {
+  inner: Source;
+  id: number;
+}
+const holder: Holder = { id: 1, inner: makeSource(10) };
+const copied: Holder = { ...holder, id: 2 };
+console.log(JSON.stringify(copied));
+console.log(copied);
+
+// Conditional spreads place their key at the spread's position.
+interface Options {
+  mode: string;
+  depth?: number;
+  verbose: boolean;
+}
+function options(deep: boolean): Options {
+  return { mode: "m", ...(deep ? { depth: 3 } : {}), verbose: deep };
+}
+console.log(JSON.stringify(options(true)), JSON.stringify(options(false)));
diff --git a/tests/corpus/let-uninitialized-function-binding.ts b/tests/corpus/let-uninitialized-function-binding.ts
new file mode 100644
index 000000000..ade6748d3
--- /dev/null
+++ b/tests/corpus/let-uninitialized-function-binding.ts
@@ -0,0 +1,46 @@
+// A module-scope `let` declared without an initializer is initialized (to
+// undefined) where the declaration runs, so a later assignment of a closure
+// that calls the binding itself is an ordinary write.
+type Step = (n: number) => number;
+
+// A write that runs before the declaration is still in the dead zone.
+function early(): void {
+  late = () => 1;
+}
+try {
+  early();
+} catch (e) {
+  console.log((e as Error).name, (e as Error).message);
+}
+let late: () => number;
+late = () => 2;
+early();
+console.log(late());
+
+let countdown: Step;
+countdown = (n) => (n <= 0 ? 0 : 1 + countdown(n - 1));
+console.log(countdown(5));
+
+let log: (s: string) => void;
+log = (s) => {
+  if (s.length < 3) log(s + "!");
+  else console.log(s);
+};
+log("a");
+
+// Reassignment and assignment from a function body after the declaration.
+let pick: (xs: number[]) => number;
+function install(largest: boolean): void {
+  pick = largest ? (xs) => Math.max(...xs) : (xs) => Math.min(...xs);
+}
+install(true);
+console.log(pick!([3, 9, 4]));
+install(false);
+console.log(pick!([3, 9, 4]));
+
+// Mutual recursion through two such bindings.
+let isEven: (n: number) => boolean;
+let isOdd: (n: number) => boolean;
+isEven = (n) => (n === 0 ? true : isOdd(n - 1));
+isOdd = (n) => (n === 0 ? false : isEven(n - 1));
+console.log(isEven(10), isOdd(7), isEven(3));
diff --git a/tests/corpus/logical-and-truthy-index.ts b/tests/corpus/logical-and-truthy-index.ts
new file mode 100644
index 000000000..b89e4d78d
--- /dev/null
+++ b/tests/corpus/logical-and-truthy-index.ts
@@ -0,0 +1,44 @@
+// `&&` whose left operand is an array, object or function value: every
+// object is truthy, so the result is the right operand, here an element
+// read that may be undefined at run time.
+const list = [3, 1, 2];
+const head = list && list[0];
+console.log(head);
+const words: string[] = ["x"];
+console.log(words && words[0], words && words[5]);
+const empty: number[] = [];
+console.log(empty && empty[0]);
+function first(xs: (string | number)[]): string | number {
+  return xs && xs[0];
+}
+console.log(first([1]), first(["s"]));
+type Item = { n: number } | string;
+const items: Item[] = [{ n: 1 }, "z"];
+console.log(items && items[0], items && items[1]);
+const nested: number[][] = [[1]];
+console.log(nested && nested[0]);
+const flags: boolean[] = [false];
+console.log(flags && flags[0]);
+const maybe: (number | null)[] = [null];
+console.log(maybe && maybe[0]);
+const holes: (number | undefined)[] = [undefined, 4];
+console.log(holes && holes[0], holes && holes[1]);
+const box = { k: [1, 2] };
+console.log(box.k && box.k[1]);
+// The left operand still evaluates exactly once.
+let reads = 0;
+const source = (): number[] => {
+  reads++;
+  return [7, 8];
+};
+console.log(source() && source()[1], reads);
+const table: Record<string, number[]> = { a: [5] };
+const pick = (key: string): number | undefined => table[key] && table[key][0];
+console.log(pick("a"), reads);
+class Holder {
+  xs = [1, 2];
+  second(): number | undefined {
+    return this.xs && this.xs[1];
+  }
+}
+console.log(new Holder().second());
diff --git a/tests/corpus/private-in-checked-primitives.js b/tests/corpus/private-in-checked-primitives.js
new file mode 100644
index 000000000..f73902b74
--- /dev/null
+++ b/tests/corpus/private-in-checked-primitives.js
@@ -0,0 +1,28 @@
+// `#x in v` where v is a checked value: objects answer by brand, and a
+// primitive operand throws Node's TypeError, which names the value as
+// String(v) spells it.
+'use strict';
+
+class Base {}
+
+class Box extends Base {
+  #value = 1;
+
+  static is(v) {
+    return #value in v;
+  }
+}
+
+class Sub extends Box {}
+
+console.log(Box.is(new Box()), Box.is(new Sub()), Box.is(new Base()));
+console.log(Box.is({}), Box.is([]), Box.is(function () {}), Box.is(Box));
+
+const primitives = [1, -0, NaN, 1.5, 'str', '', true, false, undefined, null, 10n, -5n, Symbol('s'), Symbol()];
+for (const v of primitives) {
+  try {
+    console.log('no throw', Box.is(v));
+  } catch (e) {
+    console.log(e instanceof TypeError, e.message);
+  }
+}
diff --git a/tests/coverage-fixtures/divergences.ts b/tests/coverage-fixtures/divergences.ts
index e13701a93..10b0a12e7 100644
--- a/tests/coverage-fixtures/divergences.ts
+++ b/tests/coverage-fixtures/divergences.ts
@@ -20,14 +20,14 @@ console.log(tagged.label);
 const view: Labeled = tagged;
 console.log(view === tagged);
 
-// Key order: the literal's order differs from the declaration and the
-// program observes it.
+// Key order: values of one type are built in two orders and the program
+// observes them, so the type keeps its declaration order.
 interface Point {
   x: number;
   y: number;
 }
 const point: Point = { y: 1, x: 2 };
-console.log(JSON.stringify(point));
+console.log(JSON.stringify(point), JSON.stringify({ x: 3, y: 4 }));
 
 // Text outside the built-in collation compares by code point natively.
 console.log(["б", "а"].sort((p, q) => p.localeCompare(q)).join(","), "яблоко".localeCompare("груша"));
diff --git a/tests/coverage-fixtures/dynamic-mix.ts b/tests/coverage-fixtures/dynamic-mix.ts
index 0c9779a64..d70141b91 100644
--- a/tests/coverage-fixtures/dynamic-mix.ts
+++ b/tests/coverage-fixtures/dynamic-mix.ts
@@ -1,9 +1,9 @@
 // Native checked values and loose equality share this program with
-// island-backed APIs (SC2012) with native compilation refusals.
+// native compilation refusals (a default-locale toLocaleString, SC2020).
 const v: any = 21;
 const doubled = v * 2;
 const root = Math.cbrt(81);
-const up = (19.99).toPrecision(3);
+const up = (19.99).toLocaleString();
 const parsed = Number.parseFloat("1.5"); // a string argument compiles statically, like the global
 const unknownScore: unknown = 81;
 const flags = unknownScore == 81;
diff --git a/tests/coverage-fixtures/mixed.ts b/tests/coverage-fixtures/mixed.ts
index 73a36ce47..1ae9db26d 100644
--- a/tests/coverage-fixtures/mixed.ts
+++ b/tests/coverage-fixtures/mixed.ts
@@ -10,7 +10,7 @@ const handler = (x: number) => x * 2;
 
 const anyone: unknown = score(1);
 const flags = anyone == score(2); // unknown/object coercion keeps the fence; static primitive pairs lower
-const { length: firstItem } = items; // object patterns over arrays keep the fence (patterns and defaults compile)
+const { length: firstItem } = score(3) > 99 ? items : "abc"; // a union source keeps the object-pattern fence (narrow first)
 let label = "score: ";
 label += score(10);
 console.log(label);
diff --git a/tests/coverage-fixtures/no-divergences.ts b/tests/coverage-fixtures/no-divergences.ts
index 9571add6e..3739336e3 100644
--- a/tests/coverage-fixtures/no-divergences.ts
+++ b/tests/coverage-fixtures/no-divergences.ts
@@ -1,6 +1,6 @@
 // Ordinary code: identity-preserving calls, declaration-ordered literals,
-// Latin-script comparisons, related-class casts and ISO dates report no
-// divergence.
+// Latin-script comparisons, related-class casts, ISO dates and views of the
+// global object report no divergence.
 interface Item {
   name: string;
   qty: number;
@@ -32,3 +32,9 @@ function wingsOf(a: Animal): number {
 console.log(wingsOf(new Bird()), wingsOf(new Animal()));
 console.log(["b", "A", "a"].sort((p, q) => p.localeCompare(q)).join(","));
 console.log(Date.parse("2024-01-02"), new Date("2024-01-02T03:04:05+01:00").getTime());
+
+// A type assertion of the global object denotes the global object itself.
+const COUNT = Symbol.for("no-divergences.count");
+const globalState = globalThis as { [COUNT]?: { n: number } };
+globalState[COUNT] = { n: 1 };
+console.log(globalState[COUNT]?.n);
diff --git a/tests/coverage-fixtures/tier-demotions.ts b/tests/coverage-fixtures/tier-demotions.ts
index 52f2058f1..3dbd0c3fe 100644
--- a/tests/coverage-fixtures/tier-demotions.ts
+++ b/tests/coverage-fixtures/tier-demotions.ts
@@ -17,9 +17,9 @@ function readName(text: string): string {
   return String(data.name);
 }
 
-// An operation without a static lowering, on a parameter.
+// An operation without a static lowering (the host's default locale), on a parameter.
 function precise(n: number): string {
-  return n.toPrecision(3);
+  return n.toLocaleString();
 }
 
 console.log(readName('{"name":"a"}'), precise(1.5), new Point(1, 2).x);
diff --git a/tests/diagnostics/constructor-returns-instance-super.ts b/tests/diagnostics/constructor-returns-instance-super.ts
new file mode 100644
index 000000000..c5e34c7a1
--- /dev/null
+++ b/tests/diagnostics/constructor-returns-instance-super.ts
@@ -0,0 +1,15 @@
+// `super()` into a constructor that can return an existing instance would
+// rebind the subclass's `this` to that instance.
+class Shared {
+  static one: Shared | undefined = undefined;
+  constructor() {
+    if (Shared.one) return Shared.one;
+    Shared.one = this;
+  }
+}
+class Derived extends Shared {
+  constructor() {
+    super();
+  }
+}
+console.log(new Derived() instanceof Derived);
diff --git a/tests/diagnostics/constructor-returns-object.ts b/tests/diagnostics/constructor-returns-object.ts
new file mode 100644
index 000000000..63abf4c4d
--- /dev/null
+++ b/tests/diagnostics/constructor-returns-object.ts
@@ -0,0 +1,10 @@
+// Node's `new Point()` answers the object a constructor returns. A plain
+// object has no representation as a Point instance, so the return refuses
+// instead of answering the constructed instance.
+class Point {
+  x = 1;
+  constructor() {
+    return { x: 2 };
+  }
+}
+console.log(new Point().x);
diff --git a/tests/diagnostics/deferred-class-receiver/shelf.ts b/tests/diagnostics/deferred-class-receiver/shelf.ts
index 1308ce5dc..d0fba73b3 100644
--- a/tests/diagnostics/deferred-class-receiver/shelf.ts
+++ b/tests/diagnostics/deferred-class-receiver/shelf.ts
@@ -1,6 +1,6 @@
 export class Shelf {
   readonly name: string;
-  private readonly notes = new WeakMap<object, string>();
+  private readonly cursor = new Map<string, number>().keys();
   constructor(name: string) {
     this.name = name;
   }
diff --git a/tests/diagnostics/destructuring-fences.ts b/tests/diagnostics/destructuring-fences.ts
index b79836920..e42f8a07a 100644
--- a/tests/diagnostics/destructuring-fences.ts
+++ b/tests/diagnostics/destructuring-fences.ts
@@ -48,8 +48,8 @@ function fromUnion(u: E1 | E2): string {
 console.log(fromUnion({ kind: "one", b: "s", count: 1 }));
 
 const xs = [1, 2, 3];
-const { length: len } = xs; // object patterns over arrays keep the fence
-console.log(len);
+const { push: append } = xs; // object patterns over arrays read positions and length only
+console.log(typeof append);
 
 const indexed: Record<string, number> = { a: 1 };
 const { ...allOfIt } = indexed; // index-signature rest needs overflow packing
diff --git a/tests/diagnostics/dynamic-surface.ts b/tests/diagnostics/dynamic-surface.ts
index 537a992eb..3af6671f4 100644
--- a/tests/diagnostics/dynamic-surface.ts
+++ b/tests/diagnostics/dynamic-surface.ts
@@ -4,11 +4,12 @@
 // flag — never an ICE, never a link error. Static Math methods include
 // the scalar functions and variadic Math.hypot. The .split(string),
 // trim/pad variants, parseInt, isNaN, the global parseFloat/isFinite and
-// Number.parseFloat/Number.parseInt over exactly-typed arguments, and
-// string-pattern replacement compile statically now and no longer appear
-// here.)
+// Number.parseFloat/Number.parseInt over exactly-typed arguments,
+// string-pattern replacement and toPrecision compile statically now and no
+// longer appear here; toLocaleString without a locale still has no
+// lowering.)
 const up = Math.cbrt(2);
 const tau = Math.PI * 2;
-const price = (19.99).toPrecision(4);
+const price = (19.99).toLocaleString();
 const n = Number.parseFloat("3.14");
 void n;
diff --git a/tests/diagnostics/local-class-boundaries.ts b/tests/diagnostics/local-class-boundaries.ts
index a82dfb869..2c43e9900 100644
--- a/tests/diagnostics/local-class-boundaries.ts
+++ b/tests/diagnostics/local-class-boundaries.ts
@@ -1,4 +1,4 @@
-function privateBrand() { return class { #value = 1; read(): number { return this.#value; } }; }
+function privateBrand() { return class { #value = 1; has(other: object): boolean { return #value in other; } }; }
 function selfName() { return class Local { copy() { return new Local(); } }; }
 class Base {}
 function derived() { return class extends Base {}; }
diff --git a/tests/diagnostics/local-class-type-query-brand.ts b/tests/diagnostics/local-class-type-query-brand.ts
index 566304627..aeb905cad 100644
--- a/tests/diagnostics/local-class-type-query-brand.ts
+++ b/tests/diagnostics/local-class-type-query-brand.ts
@@ -1,11 +1,15 @@
 // The same speculative element-type query, reaching a function-local class
-// with a private brand through the function's returned array.
+// with a private brand through the function's returned array. The brand is
+// tested on another object, so the evaluations' private names must differ.
 function make() {
   class Box {
     #v = 1;
     read(): number {
       return this.#v;
     }
+    same(other: object): boolean {
+      return #v in other;
+    }
   }
   return [new Box()];
 }
diff --git a/tests/diagnostics/object-assign-class-copy.ts b/tests/diagnostics/object-assign-class-copy.ts
new file mode 100644
index 000000000..4899306a9
--- /dev/null
+++ b/tests/diagnostics/object-assign-class-copy.ts
@@ -0,0 +1,11 @@
+// Object.assign copying a class instance into a fresh object: the result
+// is a plain object holding the instance's own fields, never an instance,
+// so a result the checker types as the class is refused rather than
+// failing its checked cast at run time.
+class Config {
+  b = 1;
+  a = 2;
+}
+const config = new Config();
+const copy = Object.assign({}, config);
+console.log(JSON.stringify(copy), Object.keys(copy).join(","));
diff --git a/tests/diagnostics/thread-slots-fences.ts b/tests/diagnostics/thread-slots-fences.ts
index 7ec71db34..ed985c803 100644
--- a/tests/diagnostics/thread-slots-fences.ts
+++ b/tests/diagnostics/thread-slots-fences.ts
@@ -27,3 +27,8 @@ function local(slots: ThreadSlots<Key, State>, key: Key): State | undefined {
 const ctor = ThreadSlots;
 const getter = first.get;
 console.log(named, second, shaped, callbacks, local(first, new Key()), ctor, getter);
+
+// A read through an annotated value type the stored values can't be converted
+// to: they are stored as records, which a read as the class can't convert.
+const records: ThreadSlots<Key, State> = new ThreadSlots<Key, { count: number }>("fences.records");
+console.log(records.get(new Key()));
diff --git a/tests/diagnostics/webcrypto-refusals.ts b/tests/diagnostics/webcrypto-refusals.ts
new file mode 100644
index 000000000..d162872fb
--- /dev/null
+++ b/tests/diagnostics/webcrypto-refusals.ts
@@ -0,0 +1,18 @@
+// The native WebCrypto surface is HMAC importKey('raw'), sign and verify,
+// and the SHA-1/SHA-2 digests, called directly on crypto.subtle. The 'jwk'
+// key format and crypto.subtle or its methods taken as values are refused
+// by name; the bundled declarations omit the other SubtleCrypto methods
+// (node-types/fenced.ts pins their fence under @types/node).
+const fromJwk = await crypto.subtle.importKey(
+  "jwk",
+  { kty: "oct", k: "c2VjcmV0" },
+  { name: "HMAC", hash: "SHA-256" },
+  false,
+  ["sign"],
+);
+console.log(fromJwk.type);
+
+const subtle = crypto.subtle;
+console.log(typeof subtle);
+
+console.log(typeof crypto.subtle.sign);
diff --git a/tests/fixtures/node-test/cases/thrown-values.ts b/tests/fixtures/node-test/cases/thrown-values.ts
index 2793b62b5..52788c19f 100644
--- a/tests/fixtures/node-test/cases/thrown-values.ts
+++ b/tests/fixtures/node-test/cases/thrown-values.ts
@@ -1,6 +1,7 @@
 // @exit: 1
 // Failures from thrown non-Error values print as Node inspects them: a
-// string quoted, a number and a boolean as written.
+// string quoted, a number and a boolean as written, negative zero as -0,
+// and records, arrays, null and undefined as util.inspect renders them.
 import { test } from "node:test";
 
 test("throws a string", () => {
@@ -12,6 +13,21 @@ test("throws a string with a quote", () => {
 test("throws a number", () => {
   throw 42;
 });
+test("throws negative zero", () => {
+  throw -0;
+});
 test("throws a boolean", () => {
   throw false;
 });
+test("throws a record", () => {
+  throw { code: 42, nested: { list: [1, 2] } };
+});
+test("throws an array", () => {
+  throw [1, "two", { three: 3 }];
+});
+test("throws null", () => {
+  throw null;
+});
+test("throws undefined", () => {
+  throw undefined;
+});
diff --git a/tests/fixtures/node-types/fenced.ts b/tests/fixtures/node-types/fenced.ts
index b884de3ce..78fbf2af7 100644
--- a/tests/fixtures/node-types/fenced.ts
+++ b/tests/fixtures/node-types/fenced.ts
@@ -97,4 +97,15 @@ void callbackified;
  * getAuthTag(), and setAuthTag(); the stream.Transform members are fenced. */
 const cipherStream = createCipheriv("aes-128-cbc", Buffer.alloc(16), Buffer.alloc(16));
 cipherStream.on("data", () => {});
+/* WebCrypto beyond the HMAC slice: @types/node declares the whole
+ * SubtleCrypto surface, and the methods outside importKey, sign, verify
+ * and digest fence by name. */
+async function encryptWithWebCrypto(key: import("node:crypto").webcrypto.CryptoKey): Promise<void> {
+  await crypto.subtle.encrypt({ name: "AES-GCM", iv: new Uint8Array(12) }, key, new Uint8Array(1));
+}
+void encryptWithWebCrypto;
+/* Node's navigator global: typeof navigator and navigator.userAgent
+ * compile; the other members fence by name. */
+const cores = navigator.hardwareConcurrency;
+void cores;
 // End of the declared-but-not-lowered surface.
diff --git a/tests/fixtures/node-types/navigator.ts b/tests/fixtures/node-types/navigator.ts
new file mode 100644
index 000000000..2f1ee2d9f
--- /dev/null
+++ b/tests/fixtures/node-types/navigator.ts
@@ -0,0 +1,6 @@
+/* Node 24's navigator global under @types/node: the runtime probe
+ * libraries use (jose's user-agent check) folds to Node's values. */
+const browser = !navigator.userAgent.startsWith("Mozilla/5.0 ");
+console.log(typeof navigator, navigator.userAgent, browser);
+console.log(typeof navigator !== "undefined" && navigator.userAgent === "Cloudflare-Workers");
+console.log(navigator.userAgent.split("/")[0], navigator.userAgent.length);
diff --git a/tests/fixtures/node-types/tls-session-timings.ts b/tests/fixtures/node-types/tls-session-timings.ts
new file mode 100644
index 000000000..7ebb53ce9
--- /dev/null
+++ b/tests/fixtures/node-types/tls-session-timings.ts
@@ -0,0 +1,31 @@
+// Under @types/node: a connector-style TLS client reads
+// isSessionReused() through a TLSSocket assertion and keeps per-phase
+// timings in a string-keyed record with `??=`.
+import * as net from "node:net";
+import * as tls from "node:tls";
+import { readFileSync } from "node:fs";
+
+const cert = readFileSync("tests/fixtures/server/certs/localhost.pem");
+const key = readFileSync("tests/fixtures/server/certs/localhost-key.pem");
+const ca = readFileSync("tests/fixtures/server/certs/ca.pem");
+
+const timings: Record<string, number> = {};
+function mark(phase: string, value: number): void {
+  timings[phase] ??= value;
+}
+
+const server = tls.createServer({ key, cert }, (socket) => socket.end("ok"));
+server.listen(0, "127.0.0.1", () => {
+  const port = (server.address() as net.AddressInfo).port;
+  const socket: net.Socket = tls.connect({ port, host: "127.0.0.1", servername: "localhost", ca }, () => {
+    mark("secure", 1);
+    mark("secure", 2);
+    console.log("reused", (socket as tls.TLSSocket).isSessionReused());
+  });
+  socket.on("data", (d: Buffer) => console.log("data", d.toString()));
+  socket.on("close", () => {
+    mark("close", 3);
+    console.log(JSON.stringify(timings));
+    server.close();
+  });
+});
diff --git a/tests/fixtures/node-types/webcrypto-hmac.ts b/tests/fixtures/node-types/webcrypto-hmac.ts
new file mode 100644
index 000000000..4b37d7de4
--- /dev/null
+++ b/tests/fixtures/node-types/webcrypto-hmac.ts
@@ -0,0 +1,25 @@
+/* WebCrypto's HMAC slice under @types/node: the crypto global's subtle
+ * methods and CryptoKey members lower to the same native values as under
+ * the bundled declarations. @types/node names the dictionary and key
+ * types in node:crypto's webcrypto namespace. */
+import type { webcrypto } from "node:crypto";
+
+async function main(): Promise<void> {
+  const encoder = new TextEncoder();
+  const params: webcrypto.HmacImportParams = { name: "HMAC", hash: "SHA-512" };
+  const key: webcrypto.CryptoKey = await crypto.subtle.importKey("raw", encoder.encode("node-types"), params, true, [
+    "verify",
+    "sign",
+  ]);
+  const algorithm = key.algorithm as webcrypto.HmacKeyAlgorithm;
+  console.log(key.type, key.extractable, key.usages.join(","), algorithm.name, algorithm.length, algorithm.hash.name);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode("message"));
+  console.log(signature.byteLength, Buffer.from(signature).toString("base64"));
+  console.log(await crypto.subtle.verify("HMAC", key, signature, encoder.encode("message")));
+  console.log(await crypto.subtle.verify("HMAC", key, signature, encoder.encode("massage")));
+  const digest = await crypto.subtle.digest("SHA-384", encoder.encode("message"));
+  console.log(Buffer.from(digest).toString("hex"));
+  console.log(key instanceof CryptoKey);
+}
+
+void main();
diff --git a/tests/fixtures/npm/cases/chalk5/main.ts b/tests/fixtures/npm/cases/chalk5/main.ts
index 6a33a1466..0bfa806c1 100644
--- a/tests/fixtures/npm/cases/chalk5/main.ts
+++ b/tests/fixtures/npm/cases/chalk5/main.ts
@@ -15,6 +15,13 @@ console.log(modifierNames.join(","));
 console.log(foregroundColorNames.length + " " + backgroundColorNames.length + " " + colorNames.length);
 
 show("red", chalk.red("red"));
+// Root members named like String.prototype's HTML methods, called from
+// TypeScript (pi's `chalk.bold(APP_NAME)`): the checker types chalk's
+// JavaScript default export as a plain function, so the member is `any`.
+show("bold", chalk.bold("bold"));
+show("bold template", `${chalk.bold("Usage:")} pi`);
+const alias = chalk;
+show("bold alias", alias.bold("alias") + alias.italic("i"));
 show("red.bold", chalk.red.bold("bold red"));
 show("nested", chalk.blue("a " + chalk.red("b") + " c"));
 show("multi-arg", chalk.green("one", "two", 3));
@@ -36,6 +43,7 @@ show("gray-grey", chalk.gray("x") + chalk.grey("y"));
 for (const level of [0, 1, 2, 3] as const) {
   const c = new Chalk({ level });
   show(`L${level} red.bold`, c.red.bold("x"));
+  show(`L${level} bold`, c.bold("x"));
   show(`L${level} hex`, c.hex("#123456")("x"));
   show(`L${level} rgb`, c.rgb(255, 255, 255).bgRgb(0, 0, 0)("x"));
   show(`L${level} ansi256`, c.ansi256(100).bgAnsi256(200)("x"));
diff --git a/tests/fixtures/self-hosting/class-types.ts b/tests/fixtures/self-hosting/class-types.ts
index 2a66e7444..c43b43f56 100644
--- a/tests/fixtures/self-hosting/class-types.ts
+++ b/tests/fixtures/self-hosting/class-types.ts
@@ -8,7 +8,7 @@ const kept: IrType = { kind: "object", className: "Registered" };
 const expr: IrExpr = { kind: "varRef", localId: "x", type: missing, loc };
 const nested: IrType = { kind: "func", params: [{ kind: "array", elem: missing }],
   ret: { kind: "generator", yieldT: missing, retT: kept, nextT: missing } };
-const module: IrModule = { irVersion: 16, sourceFile: loc.file, entry: "main",
+const module: IrModule = { irVersion: 17, sourceFile: loc.file, entry: "main",
   functions: [{ name: "main", params: [{ localId: "x", name: "x", type: missing }],
     returnType: nested, locals: [], loc, body: [{ kind: "exprStmt", expr, loc }] }],
   records: [{ id: "r", fields: [{ name: "callback", type: nested }], indexValue: missing }],
diff --git a/tests/fixtures/self-hosting/ts7-checker-cases.ts b/tests/fixtures/self-hosting/ts7-checker-cases.ts
index 52cb6981e..da0a3dc52 100644
--- a/tests/fixtures/self-hosting/ts7-checker-cases.ts
+++ b/tests/fixtures/self-hosting/ts7-checker-cases.ts
@@ -50,8 +50,8 @@ export function checkCheckerFacade(raw: SemanticChecker, root: SourceFile, reque
   check(facade.getBaseTypeOfLiteralType(answerType) === number, "number literal base");
   check(facade.getTypeOfSymbol(answerSymbol) === answerType, "symbol type");
   check(facade.getTypeOfSymbolAtLocation(answerSymbol, answerName) === answerType, "location type");
-  check(facade.declarationsOf(answerSymbol)[0] === answer, "declaration identity");
-  check(facade.valueDeclarationOf(answerSymbol) === answer, "value declaration");
+  check(answerSymbol.declarations[0] === answer, "declaration identity");
+  check(answerSymbol.valueDeclaration === answer, "value declaration");
   check(facade.getContextualType(answerName) === undefined, "absent contextual type");
   check(facade.getSymbolAtLocation(root.endOfFileToken) === undefined, "absent symbol");
   check(facade.getUnknownType().flags === TypeFlags.Unknown, "unknown intrinsic");
@@ -77,14 +77,14 @@ export function checkCheckerFacade(raw: SemanticChecker, root: SourceFile, reque
   const identityType = facade.getTypeAtLocation(identity.name!);
   const signature = facade.getSignatureFromDeclaration(identity)!;
   check(facade.getCallSignatures(identityType)[0] === signature, "call signature identity");
-  check(facade.signatureDeclaration(signature) === identity, "signature declaration identity");
+  check(signature.declaration === identity, "signature declaration identity");
   check(facade.typeToString(facade.getReturnTypeOfSignature(signature)) === "T", "generic return type");
   check(facade.getTypePredicateOfSignature(signature) === undefined, "absent predicate");
   const isBox = facade.getSignatureFromDeclaration(declaration(root, "isBox"))!;
   check(facade.getTypePredicateOfSignature(isBox)!.type === boxType, "predicate type identity");
   const call = declaration(root, "called").initializer!;
   const resolved = facade.getResolvedSignature(call)!;
-  check(facade.signatureDeclaration(resolved) === identity, "instantiated signature declaration");
+  check(resolved.declaration === identity, "instantiated signature declaration");
   check(facade.typeToString(facade.getReturnTypeOfSignature(resolved)).includes("n: number"), "instantiated return type");
 
   const ref = declaration(root, "ref").initializer!.properties?.nodes[0]!;
@@ -140,11 +140,11 @@ export function checkCheckerFacade(raw: SemanticChecker, root: SourceFile, reque
     check(facade.getTypeOfSymbol(answerSymbol) === answerType, "warm symbol type");
     check(facade.getDeclaredTypeOfSymbol(boxSymbol) === boxType, "warm declared type");
     check(facade.getAliasedSymbol(alias) === answerSymbol, "warm alias");
-    check(facade.declarationsOf(answerSymbol)[0] === answer, "warm declarations");
-    check(facade.valueDeclarationOf(answerSymbol) === answer, "warm value declaration");
+    check(answerSymbol.declarations[0] === answer, "warm declarations");
+    check(answerSymbol.valueDeclaration === answer, "warm value declaration");
     check(facade.getResolvedSignature(call) === resolved, "warm resolved signature");
     check(facade.getSignatureFromDeclaration(identity) === signature, "warm signature");
-    check(facade.signatureDeclaration(signature) === identity, "warm signature declaration");
+    check(signature.declaration === identity, "warm signature declaration");
     check(facade.getTypePredicateOfSignature(signature) === undefined, "warm absent predicate");
     check(facade.getTypePredicateOfSignature(isBox)!.type === boxType, "warm predicate");
     check(facade.getCallSignatures(identityType)[0] === signature, "warm call signatures");
diff --git a/tests/fixtures/self-hosting/ts7-checker-snapshots.ts b/tests/fixtures/self-hosting/ts7-checker-snapshots.ts
index 949eff4b7..710255433 100644
--- a/tests/fixtures/self-hosting/ts7-checker-snapshots.ts
+++ b/tests/fixtures/self-hosting/ts7-checker-snapshots.ts
@@ -60,7 +60,7 @@ export function checkCheckerSnapshots(session: Ts7Session, client: Ts7RpcClient,
   check(oldArms.length === 2 && siblingArms.length === 2, "original constituents");
   check(oldArms !== siblingArms && oldArms[0] !== siblingArms[0], "project-local constituents");
   const oldSymbol = old.getSymbolAtLocation(name)!;
-  const oldDeclaration = old.valueDeclarationOf(oldSymbol)!;
+  const oldDeclaration = oldSymbol.valueDeclaration!;
   check(oldDeclaration.name === name, "resolved declaration identity");
 
   value = 'export const value: string | null = "new";';
@@ -73,7 +73,7 @@ export function checkCheckerSnapshots(session: Ts7Session, client: Ts7RpcClient,
   const newSymbol = next.getSymbolAtLocation(name)!;
   check(next.typeToString(newType) === "string | null", "new snapshot result");
   check(newType !== oldType && newSymbol !== oldSymbol, "independent semantic identities");
-  check(next.valueDeclarationOf(newSymbol) === oldDeclaration, "declarations retain shared syntax identity");
+  check(newSymbol.valueDeclaration === oldDeclaration, "declarations retain shared syntax identity");
   check(next.getTypeOfSymbol(newSymbol) === newType, "new symbol answer");
   check(old.getTypeOfSymbol(oldSymbol) === oldType, "old symbol answer");
   check(old.getTypeAtLocation(name) === oldType && old.typeToString(oldType) === "number | null", "old snapshot stays immutable");
diff --git a/tests/fixtures/self-hosting/ts7-client-cases.ts b/tests/fixtures/self-hosting/ts7-client-cases.ts
index c98869785..d97f90892 100644
--- a/tests/fixtures/self-hosting/ts7-client-cases.ts
+++ b/tests/fixtures/self-hosting/ts7-client-cases.ts
@@ -267,7 +267,7 @@ export function runTs7Client(client: Ts7RpcClient, directory: string, report: st
     const typeText = checker.typeToString(ownedType);
     check(checker.getTypeAtPosition(file, content.indexOf("answer")) === ownedType, "semantic type identity");
     check(checker.getSymbolAtPosition(file, content.indexOf("answer")) === ownedSymbol, "semantic symbol identity");
-    check(ownedSymbol.declarations[0]!.resolve() === declaration, "semantic declaration identity");
+    check(ownedSymbol.declarationHandles[0]!.resolve() === declaration, "semantic declaration identity");
     check(typeText === "42" && ownedType.isNumberLiteralType() && ownedType.value === 42, "semantic literal metadata");
     // The semantic exercise disposes its graph; the session still owns the
     // server snapshot and its program until explicit snapshot disposal.
diff --git a/tests/fixtures/self-hosting/ts7-semantic-cases.ts b/tests/fixtures/self-hosting/ts7-semantic-cases.ts
index 3fd34cefd..41b61b824 100644
--- a/tests/fixtures/self-hosting/ts7-semantic-cases.ts
+++ b/tests/fixtures/self-hosting/ts7-semantic-cases.ts
@@ -81,8 +81,8 @@ export function checkSemanticModel(snapshot: SemanticSnapshot, checker: Semantic
   check(checker.getTypeOfSymbol(answerSymbol) === answerType, "symbol type identity");
   check(checker.getTypeOfSymbol([answerSymbol, answerSymbol])[1] === answerType, "batch symbol types");
   check(checker.getTypeOfSymbolAtLocation(answerSymbol, answerName) === answerType, "location-dependent symbol type");
-  check(answerSymbol.valueDeclaration?.resolve() === answer && answerSymbol.declarations[0]!.resolve() === answer, "default declaration resolution");
-  check(answerSymbol.declarations[0]!.resolve(checker.project) === answer, "explicit declaration project");
+  check(answerSymbol.valueDeclarationHandle?.resolve() === answer && answerSymbol.declarationHandles[0]!.resolve() === answer, "default declaration resolution");
+  check(answerSymbol.declarationHandles[0]!.resolve(checker.project) === answer, "explicit declaration project");
   check(checker.getTypeAtPosition(root.fileName, [answerName.getStart(), answerName.getStart()])[1] === answerType, "position type batch");
   check(checker.getSymbolAtPosition(root.fileName, [answerName.getStart(), answerName.getStart()])[1] === answerSymbol, "position symbol batch");
   check(checker.getResolvedSymbol(answerName)!.getExportSymbol() === answerSymbol, "resolved local/export symbol identity");
@@ -123,7 +123,7 @@ export function checkSemanticModel(snapshot: SemanticSnapshot, checker: Semantic
   // the binder's member symbol is distinct but refers to the same AST node.
   const boundMember = boxSymbol.getMembers().get("value")!;
   const checkedMember = checker.getPropertyOfType(boxType, "value")!;
-  check(boundMember !== checkedMember && boundMember.declarations[0]!.resolve() === checkedMember.declarations[0]!.resolve(), "bound and instantiated member declarations");
+  check(boundMember !== checkedMember && boundMember.declarationHandles[0]!.resolve() === checkedMember.declarationHandles[0]!.resolve(), "bound and instantiated member declarations");
   check(boxSymbol.getMembers() === boxSymbol.getMembers() && boxSymbol.getExports() === boxSymbol.getExports(), "symbol table cache");
   check(boxType.getBaseTypes()!.length === 0 && checker.getBaseTypes(boxType).length === 0, "empty base types");
   const child = checker.getDeclaredTypeOfSymbol(symbolAt(checker, declaration(root, "Child").name!));
@@ -147,8 +147,8 @@ export function checkSemanticModel(snapshot: SemanticSnapshot, checker: Semantic
   const signature = signatureAt(checker, identity);
   const signatureTypes = signature.getTypeParameters();
   check(signatureTypes.length === 1 && signatureTypes[0]!.isTypeParameter(), "signature type parameters");
-  check(signature.getParameters()[0]!.name === "value" && signature.getParameters()[0]!.declarations[0]!.resolve() === identity.parameters?.nodes[0], "signature parameters");
-  check(signature.declaration!.resolve() === identity, "signature declaration");
+  check(signature.getParameters()[0]!.name === "value" && signature.getParameters()[0]!.declarationHandles[0]!.resolve() === identity.parameters?.nodes[0], "signature parameters");
+  check(signature.declarationHandle!.resolve() === identity, "signature declaration");
   check(checker.getReturnTypeOfSignature(signature) === signatureTypes[0], "generic return identity");
   check(checker.getParameterType(signature, 0) === signatureTypes[0], "parameter type query");
   const constraint = checker.getConstraintOfTypeParameter(signatureTypes[0]!)!;
@@ -179,7 +179,7 @@ export function checkSemanticModel(snapshot: SemanticSnapshot, checker: Semantic
   check(checker.isUndefinedSymbol(undefinedSymbol), "well-known undefined symbol");
   const shorthand = declaration(root, "ref").initializer!.properties?.nodes[0]!;
   check(checker.getShorthandAssignmentValueSymbol(shorthand) === answerSymbol, "shorthand symbol");
-  const exportSpecifier = renamed.declarations[0]!.resolve()!;
+  const exportSpecifier = renamed.declarationHandles[0]!.resolve()!;
   check(checker.getExportSpecifierLocalTargetSymbol(exportSpecifier) === answerSymbol, "export specifier symbol");
   check(checker.getConstantValue(declaration(root, "Mode").members?.nodes[0]!) === 3, "enum constant");
   check(checker.getConstantValue(answerName) === undefined, "missing constant");
@@ -235,7 +235,7 @@ export function checkSemanticModel(snapshot: SemanticSnapshot, checker: Semantic
   try { answerType.getRegularType(); } catch { refused = true; }
   check(refused, "type access after disposal");
   refused = false;
-  try { answerSymbol.declarations[0]!.resolve(); } catch { refused = true; }
+  try { answerSymbol.declarationHandles[0]!.resolve(); } catch { refused = true; }
   check(refused, "declaration access after disposal");
 }
 
diff --git a/tests/fixtures/self-hosting/union-conversions.ts b/tests/fixtures/self-hosting/union-conversions.ts
index 58d49f863..fc6ce2dca 100644
--- a/tests/fixtures/self-hosting/union-conversions.ts
+++ b/tests/fixtures/self-hosting/union-conversions.ts
@@ -2,6 +2,7 @@ import { writeFileSync } from "node:fs";
 import { BOOL, F64, STRING, UNDEFINED_T, VOID, typeEquals } from "../../../packages/compiler/src/ir/ir.js";
 import type { IrClassDef, IrExpr, IrFunction, IrModule, IrRecordShape, IrStmt, IrType, IrUnionDef, SrcLoc } from "../../../packages/compiler/src/ir/ir.js";
 import { IR_VERSION, serializeModule } from "../../../packages/compiler/src/ir/serialize.js";
+import { assignLegacyTiers } from "../../../packages/compiler/src/ir/tiers.js";
 import { buildUnionNarrow } from "../../../packages/compiler/src/frontend/lowering/union-narrow.js";
 import { buildUnionRetag, planUnionRetag } from "../../../packages/compiler/src/frontend/lowering/union-retag.js";
 import type { WidthLift } from "../../../packages/compiler/src/frontend/lowering/width-lift.js";
@@ -227,4 +228,6 @@ const classes: IrClassDef[] = [
   { name: "%TypeError", runtime: true, base: "%Error", fields: errorFields, loc },
 ];
 const module: IrModule = { classes, irVersion: IR_VERSION, sourceFile: loc.file, entry: "main", records, unions, functions };
+// Serialized IR carries each function's tier, as lowering assigns it.
+assignLegacyTiers(module.functions);
 writeFileSync(process.argv[2]!, serializeModule(module));
diff --git a/tests/harness/__snapshots__/constructor-returns-instance-super.ts.txt b/tests/harness/__snapshots__/constructor-returns-instance-super.ts.txt
new file mode 100644
index 000000000..53a01d431
--- /dev/null
+++ b/tests/harness/__snapshots__/constructor-returns-instance-super.ts.txt
@@ -0,0 +1,6 @@
+constructor-returns-instance-super.ts:11:3 - error SC1090: extending a class whose constructor can return an existing instance ('super()' would rebind 'this' to the instance 'Shared' returns) is not supported yet
+
+  10 | class Derived extends Shared {
+  11 |   constructor() {
+     |   ^~~~~~~~~~~~~~~
+  12 |     super();
\ No newline at end of file
diff --git a/tests/harness/__snapshots__/constructor-returns-object.ts.txt b/tests/harness/__snapshots__/constructor-returns-object.ts.txt
new file mode 100644
index 000000000..fe2220d56
--- /dev/null
+++ b/tests/harness/__snapshots__/constructor-returns-object.ts.txt
@@ -0,0 +1,6 @@
+constructor-returns-object.ts:7:5 - error SC1090: returning an object other than an instance of the class from a constructor (Node's 'new Point()' answers the returned object, which has no representation as a 'Point' instance) is not supported yet
+
+  6 |   constructor() {
+  7 |     return { x: 2 };
+    |     ^~~~~~~~~~~~~~~~
+  8 |   }
\ No newline at end of file
diff --git a/tests/harness/__snapshots__/coverage-dynamic-mix.txt b/tests/harness/__snapshots__/coverage-dynamic-mix.txt
index 2ad84f0af..0bff0f03c 100644
--- a/tests/harness/__snapshots__/coverage-dynamic-mix.txt
+++ b/tests/harness/__snapshots__/coverage-dynamic-mix.txt
@@ -5,6 +5,6 @@ scriptc coverage tests/coverage-fixtures/dynamic-mix.ts
     in dynamic tier     2  (operate on values typed only at runtime; --explain-dynamic lists them)
 
   blockers:
-      ×1  SC2012  '.toPrecision()' on numbers cannot compile statically
+      ×1  SC2020  'Number.prototype.toLocaleString without a locale' is part of the standard library types but has no scriptc lowering yet
           at tests/coverage-fixtures/dynamic-mix.ts:6:12
-          hint: use a supported API or rewrite this operation for native compilation
\ No newline at end of file
+          hint: the default locale is the host environment's, which a compiled binary cannot carry — pass it explicitly: x.toLocaleString("en-US")
\ No newline at end of file
diff --git a/tests/harness/__snapshots__/coverage-explain-dynamic.txt b/tests/harness/__snapshots__/coverage-explain-dynamic.txt
index 1c86a808c..f168988e6 100644
--- a/tests/harness/__snapshots__/coverage-explain-dynamic.txt
+++ b/tests/harness/__snapshots__/coverage-explain-dynamic.txt
@@ -12,5 +12,5 @@
     function <top level>  tests/coverage-fixtures/tier-demotions.ts:1:1 (1 site inside)
     function precise  tests/coverage-fixtures/tier-demotions.ts:21:1 (1 site inside)
     binding n in precise  tests/coverage-fixtures/tier-demotions.ts:21:18 (1 request)
-      <- SC2012 operation at tests/coverage-fixtures/tier-demotions.ts:22:10: '.toPrecision()' on numbers cannot compile statically
+      <- SC2020 operation at tests/coverage-fixtures/tier-demotions.ts:22:10: 'Number.prototype.toLocaleString without a locale' is part of the standard library types but has no scriptc lowering yet
       -> function precise turns dynamic
\ No newline at end of file
diff --git a/tests/harness/__snapshots__/coverage-mixed.txt b/tests/harness/__snapshots__/coverage-mixed.txt
index c3b348f9c..cf78aa9e0 100644
--- a/tests/harness/__snapshots__/coverage-mixed.txt
+++ b/tests/harness/__snapshots__/coverage-mixed.txt
@@ -5,6 +5,6 @@ scriptc coverage tests/coverage-fixtures/mixed.ts
     in dynamic tier     1  (operate on values typed only at runtime; --explain-dynamic lists them)
 
   blockers:
-      ×1  SC1031  object destructuring of non-record values (the source is array-typed)
+      ×1  SC1031  object destructuring of non-record values (the source is union-typed)
           at tests/coverage-fixtures/mixed.ts:13:7
           hint: this construct is valid TypeScript outside the compiled subset — rewrite it with a supported equivalent (https://scriptc.dev/limitations)
\ No newline at end of file
diff --git a/tests/harness/__snapshots__/coverage-tier-demotions.txt b/tests/harness/__snapshots__/coverage-tier-demotions.txt
index 7b52f9d63..aaf1f4e3b 100644
--- a/tests/harness/__snapshots__/coverage-tier-demotions.txt
+++ b/tests/harness/__snapshots__/coverage-tier-demotions.txt
@@ -8,6 +8,6 @@ scriptc coverage tests/coverage-fixtures/tier-demotions.ts
       ×1  SC1090  assignment to non-variables
           at tests/coverage-fixtures/tier-demotions.ts:10:1
           hint: this form is valid TypeScript but does not compile yet — rewrite it with a supported equivalent of the construct the message names (https://scriptc.dev/limitations lists the boundary)
-      ×1  SC2012  '.toPrecision()' on numbers cannot compile statically
+      ×1  SC2020  'Number.prototype.toLocaleString without a locale' is part of the standard library types but has no scriptc lowering yet
           at tests/coverage-fixtures/tier-demotions.ts:22:10
-          hint: use a supported API or rewrite this operation for native compilation
\ No newline at end of file
+          hint: the default locale is the host environment's, which a compiled binary cannot carry — pass it explicitly: x.toLocaleString("en-US")
\ No newline at end of file
diff --git a/tests/harness/__snapshots__/deferred-class-receiver/main.ts.txt b/tests/harness/__snapshots__/deferred-class-receiver/main.ts.txt
index 0e9cab090..909795174 100644
--- a/tests/harness/__snapshots__/deferred-class-receiver/main.ts.txt
+++ b/tests/harness/__snapshots__/deferred-class-receiver/main.ts.txt
@@ -5,9 +5,9 @@ deferred-class-receiver/main.ts:4:10 - error SC1090: constructing through a clas
     |          ^~~~~~~~~~~~~~~
   5 | }
 
-deferred-class-receiver/shelf.ts:3:20 - error SC1090: 'WeakMap<object, string>'-typed class fields are not supported yet
+deferred-class-receiver/shelf.ts:3:20 - error SC1090: 'MapIterator<string>'-typed class fields are not supported yet
 
   2 |   readonly name: string;
-  3 |   private readonly notes = new WeakMap<object, string>();
-    |                    ^~~~~
+  3 |   private readonly cursor = new Map<string, number>().keys();
+    |                    ^~~~~~
   4 |   constructor(name: string) {
\ No newline at end of file
diff --git a/tests/harness/__snapshots__/destructuring-fences.ts.txt b/tests/harness/__snapshots__/destructuring-fences.ts.txt
index 65d9c293b..743bb5657 100644
--- a/tests/harness/__snapshots__/destructuring-fences.ts.txt
+++ b/tests/harness/__snapshots__/destructuring-fences.ts.txt
@@ -38,9 +38,9 @@ destructuring-fences.ts:46:10 - error SC2004: uses of 'b' inherit the blocker on
 destructuring-fences.ts:51:7 - error SC1031: object destructuring of non-record values (the source is array-typed) are not supported yet
 
   50 | const xs = [1, 2, 3];
-  51 | const { length: len } = xs; // object patterns over arrays keep the fence
-     |       ^~~~~~~~~~~~~~~
-  52 | console.log(len);
+  51 | const { push: append } = xs; // object patterns over arrays read positions and length only
+     |       ^~~~~~~~~~~~~~~~
+  52 | console.log(typeof append);
 
 destructuring-fences.ts:55:9 - error SC1031: rest bindings over index-signature shapes (the undeclared entries would need overflow packing) are not supported yet
 
diff --git a/tests/harness/__snapshots__/dynamic-surface.ts.txt b/tests/harness/__snapshots__/dynamic-surface.ts.txt
index 2744d29e5..d4fe2ac7e 100644
--- a/tests/harness/__snapshots__/dynamic-surface.ts.txt
+++ b/tests/harness/__snapshots__/dynamic-surface.ts.txt
@@ -1,8 +1,8 @@
-dynamic-surface.ts:12:15 - error SC2012: '.toPrecision()' on numbers cannot compile statically
+dynamic-surface.ts:13:15 - error SC2020: 'Number.prototype.toLocaleString without a locale' is part of the standard library types but has no scriptc lowering yet
 
-  11 | const tau = Math.PI * 2;
-  12 | const price = (19.99).toPrecision(4);
-     |               ^~~~~~~~~~~~~~~~~~~~~~
-  13 | const n = Number.parseFloat("3.14");
+  12 | const tau = Math.PI * 2;
+  13 | const price = (19.99).toLocaleString();
+     |               ^~~~~~~~~~~~~~~~~~~~~~~~
+  14 | const n = Number.parseFloat("3.14");
 
-  hint: use a supported API or rewrite this operation for native compilation
\ No newline at end of file
+  hint: the default locale is the host environment's, which a compiled binary cannot carry — pass it explicitly: x.toLocaleString("en-US")
\ No newline at end of file
diff --git a/tests/harness/__snapshots__/local-class-boundaries.ts.txt b/tests/harness/__snapshots__/local-class-boundaries.ts.txt
index 04dbc336c..6706a1278 100644
--- a/tests/harness/__snapshots__/local-class-boundaries.ts.txt
+++ b/tests/harness/__snapshots__/local-class-boundaries.ts.txt
@@ -1,12 +1,12 @@
 local-class-boundaries.ts:1:34 - error SC1090: function-local classes with private brands are not supported yet
 
-  1 | function privateBrand() { return class { #value = 1; read(): number { return this.#value; } }; }
-    |                                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  1 | function privateBrand() { return class { #value = 1; has(other: object): boolean { return #value in other; } }; }
+    |                                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   2 | function selfName() { return class Local { copy() { return new Local(); } }; }
 
 local-class-boundaries.ts:2:64 - error SC1090: named self references inside function-local classes are not supported yet
 
-  1 | function privateBrand() { return class { #value = 1; read(): number { return this.#value; } }; }
+  1 | function privateBrand() { return class { #value = 1; has(other: object): boolean { return #value in other; } }; }
   2 | function selfName() { return class Local { copy() { return new Local(); } }; }
     |                                                                ^~~~~
   3 | class Base {}
diff --git a/tests/harness/__snapshots__/local-class-type-query-brand.ts.txt b/tests/harness/__snapshots__/local-class-type-query-brand.ts.txt
index 6db3418a8..ea877dec3 100644
--- a/tests/harness/__snapshots__/local-class-type-query-brand.ts.txt
+++ b/tests/harness/__snapshots__/local-class-type-query-brand.ts.txt
@@ -1,6 +1,6 @@
-local-class-type-query-brand.ts:4:3 - error SC1090: function-local classes with private brands are not supported yet
+local-class-type-query-brand.ts:5:3 - error SC1090: function-local classes with private brands are not supported yet
 
-  3 | function make() {
-  4 |   class Box {
+  4 | function make() {
+  5 |   class Box {
     |   ^~~~~~~~~~~
-  5 |     #v = 1;
\ No newline at end of file
+  6 |     #v = 1;
\ No newline at end of file
diff --git a/tests/harness/__snapshots__/node-types-fenced.txt b/tests/harness/__snapshots__/node-types-fenced.txt
index 29e4a2ee9..81db57e65 100644
--- a/tests/harness/__snapshots__/node-types-fenced.txt
+++ b/tests/harness/__snapshots__/node-types-fenced.txt
@@ -210,6 +210,24 @@ fenced.ts:99:1 - error SC2020: 'Cipheriv/Decipheriv.on' is part of the standard
    98 | const cipherStream = createCipheriv("aes-128-cbc", Buffer.alloc(16), Buffer.alloc(16));
    99 | cipherStream.on("data", () => {});
       | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-  100 | // End of the declared-but-not-lowered surface.
+  100 | /* WebCrypto beyond the HMAC slice: @types/node declares the whole
 
-  hint: update(), final(), setAAD(), setAutoPadding(), getAuthTag(), and setAuthTag() are supported; cipher streams are not
\ No newline at end of file
+  hint: update(), final(), setAAD(), setAutoPadding(), getAuthTag(), and setAuthTag() are supported; cipher streams are not
+
+fenced.ts:104:9 - error SC2020: 'crypto.subtle.encrypt' is part of the standard library types but has no scriptc lowering yet
+
+  103 | async function encryptWithWebCrypto(key: import("node:crypto").webcrypto.CryptoKey): Promise<void> {
+  104 |   await crypto.subtle.encrypt({ name: "AES-GCM", iv: new Uint8Array(12) }, key, new Uint8Array(1));
+      |         ^~~~~~~~~~~~~~~~~~~~~
+  105 | }
+
+  hint: the native WebCrypto surface is crypto.subtle.importKey('raw', ...) for HMAC keys, sign and verify with HMAC, and digest with SHA-1, SHA-256, SHA-384 or SHA-512, each called directly on crypto.subtle
+
+fenced.ts:109:15 - error SC2020: 'navigator.hardwareConcurrency' is typed by @types/node but has no scriptc lowering yet
+
+  108 |  * compile; the other members fence by name. */
+  109 | const cores = navigator.hardwareConcurrency;
+      |               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  110 | void cores;
+
+  hint: of Node's navigator global only typeof navigator and navigator.userAgent compile
\ No newline at end of file
diff --git a/tests/harness/__snapshots__/object-assign-class-copy.ts.txt b/tests/harness/__snapshots__/object-assign-class-copy.ts.txt
new file mode 100644
index 000000000..ce25cc38f
--- /dev/null
+++ b/tests/harness/__snapshots__/object-assign-class-copy.ts.txt
@@ -0,0 +1,6 @@
+object-assign-class-copy.ts:10:32 - error SC1090: Object.assign copying a 'Config' instance into a fresh object typed as the class (the copy is a plain object holding the instance's own fields, not an instance — build the object literal from the fields you need) is not supported yet
+
+   9 | const config = new Config();
+  10 | const copy = Object.assign({}, config);
+     |                                ^~~~~~
+  11 | console.log(JSON.stringify(copy), Object.keys(copy).join(","));
\ No newline at end of file
diff --git a/tests/harness/__snapshots__/retired-engine-1112-number-methods.ts.txt b/tests/harness/__snapshots__/retired-engine-1112-number-methods.ts.txt
deleted file mode 100644
index dfd5f0eaa..000000000
--- a/tests/harness/__snapshots__/retired-engine-1112-number-methods.ts.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-retired-engine-1112-number-methods.ts:9:13 - error SC2012: '.toPrecision()' on numbers cannot compile statically
-
-   8 | console.log((1e21).toFixed(2), (0 / 0).toFixed(2));
-   9 | console.log(n.toPrecision(2), n.toPrecision(8), (0.000123).toPrecision(2));
-     |             ^~~~~~~~~~~~~~~~
-  10 | console.log((255).toString(16), (255).toString(2), (511).toString(8), (12345).toString(36));
-
-  hint: use a supported API or rewrite this operation for native compilation
\ No newline at end of file
diff --git a/tests/harness/__snapshots__/thread-slots-fences.ts.txt b/tests/harness/__snapshots__/thread-slots-fences.ts.txt
index 566ddfba6..9d4648c27 100644
--- a/tests/harness/__snapshots__/thread-slots-fences.ts.txt
+++ b/tests/harness/__snapshots__/thread-slots-fences.ts.txt
@@ -59,4 +59,13 @@ thread-slots-fences.ts:28:16 - error SC2020: 'ThreadSlots.get (@scriptc/experime
      |                ^~~~~~~~~
   29 | console.log(named, second, shaped, callbacks, local(first, new Key()), ctor, getter);
 
-  hint: call slots.get(...) directly
\ No newline at end of file
+  hint: call slots.get(...) directly
+
+thread-slots-fences.ts:34:13 - error SC2003: union conversion has no unambiguous layout mapping: expected 'State | undefined', got '{ count: number } | undefined' (each source arm needs an identical destination arm, a unique compatible record/array layout, or a shared literal discriminant selecting compatible layouts)
+
+  33 | const records: ThreadSlots<Key, State> = new ThreadSlots<Key, { count: number }>("fences.records");
+  34 | console.log(records.get(new Key()));
+     |             ^~~~~~~~~~~~~~~~~~~~~~
+  35 | 
+
+  hint: narrow the value to a SINGLE arm first (a discriminant check, or '!== undefined'/'!== null' for unit arms); a plain arm value widens into any union that contains it, and a whole union widens into any union whose arms include the source's
\ No newline at end of file
diff --git a/tests/harness/__snapshots__/webcrypto-refusals.ts.txt b/tests/harness/__snapshots__/webcrypto-refusals.ts.txt
new file mode 100644
index 000000000..521edff3c
--- /dev/null
+++ b/tests/harness/__snapshots__/webcrypto-refusals.ts.txt
@@ -0,0 +1,26 @@
+webcrypto-refusals.ts:7:3 - error SC2020: 'crypto.subtle.importKey with the 'jwk' key format' is part of the standard library types but has no scriptc lowering yet
+
+  6 | const fromJwk = await crypto.subtle.importKey(
+  7 |   "jwk",
+    |   ^~~~~
+  8 |   { kty: "oct", k: "c2VjcmV0" },
+
+  hint: the native WebCrypto surface is crypto.subtle.importKey('raw', ...) for HMAC keys, sign and verify with HMAC, and digest with SHA-1, SHA-256, SHA-384 or SHA-512, each called directly on crypto.subtle
+
+webcrypto-refusals.ts:15:16 - error SC2020: 'crypto.subtle as a value' is part of the standard library types but has no scriptc lowering yet
+
+  14 | 
+  15 | const subtle = crypto.subtle;
+     |                ^~~~~~~~~~~~~
+  16 | console.log(typeof subtle);
+
+  hint: the native WebCrypto surface is crypto.subtle.importKey('raw', ...) for HMAC keys, sign and verify with HMAC, and digest with SHA-1, SHA-256, SHA-384 or SHA-512, each called directly on crypto.subtle
+
+webcrypto-refusals.ts:18:20 - error SC2020: 'crypto.subtle.sign as a value' is part of the standard library types but has no scriptc lowering yet
+
+  17 | 
+  18 | console.log(typeof crypto.subtle.sign);
+     |                    ^~~~~~~~~~~~~~~~~~
+  19 | 
+
+  hint: the native WebCrypto surface is crypto.subtle.importKey('raw', ...) for HMAC keys, sign and verify with HMAC, and digest with SHA-1, SHA-256, SHA-384 or SHA-512, each called directly on crypto.subtle
\ No newline at end of file
diff --git a/tests/harness/bench-dynamic-tier.test.ts b/tests/harness/bench-dynamic-tier.test.ts
new file mode 100644
index 000000000..de19f2b21
--- /dev/null
+++ b/tests/harness/bench-dynamic-tier.test.ts
@@ -0,0 +1,65 @@
+/* Two-tier invariant I3 for the runtime benchmark workloads, in CI: the
+ * release executable of a fully typed workload defines no dynamic-tier
+ * runtime symbol (DYNAMIC_TIER_PREFIXES), and every workload the zero-cost
+ * gate lists as dynamic (DYNAMIC_WORKLOADS) still defines one, so the list
+ * shrinks as leaks close. The gate (scripts/zero-cost-gate.mjs) checks the
+ * same contract, but only when someone runs it. The contract is the Linux
+ * release binary the gate measures, so other hosts and the sanitized lane
+ * skip the builds. */
+import { execFile } from "node:child_process";
+import { mkdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { expect, test } from "vitest";
+import { compile } from "@scriptc/compiler";
+import {
+  DYNAMIC_WORKLOADS,
+  definedFunctionNames,
+  dynamicTierSymbols,
+} from "../../scripts/zero-cost-compare.mjs";
+
+const execFileAsync = promisify(execFile);
+const repoRoot = join(import.meta.dirname, "../..");
+const suite = join(repoRoot, "benchmarks/runtime");
+const cacheDir = join(repoRoot, "node_modules/.cache/scriptc-tests/bench-dynamic-tier");
+const skip = process.platform !== "linux" || process.env["SCRIPTC_SAN"] === "1";
+
+interface Workload {
+  name: string;
+  entry: string;
+}
+
+// One program per entry file, named after its first workload, as the gate
+// names them.
+const manifest = JSON.parse(readFileSync(join(suite, "workloads.json"), "utf8")) as {
+  workloads: Workload[];
+};
+const programs = new Map<string, string>();
+for (const w of manifest.workloads)
+  if (![...programs.values()].includes(w.entry)) programs.set(`bench/${w.name}`, w.entry);
+
+test("every workload the gate lists as dynamic is a bench program", () => {
+  for (const id of DYNAMIC_WORKLOADS) expect(programs.has(id), id).toBe(true);
+});
+
+test.skipIf(skip).each([...programs])(
+  "%s links the dynamic tier only if listed",
+  async (id, entry) => {
+    const outDir = join(cacheDir, id.slice("bench/".length));
+    mkdirSync(outDir, { recursive: true });
+    const result = await compile(join(suite, entry), { outPath: join(outDir, "program"), outDir });
+    if (!result.ok)
+      throw new Error(result.diagnostics.map((d) => `${d.code}: ${d.message}`).join("\n"));
+    const { stdout } = await execFileAsync("nm", [result.binaryPath], {
+      encoding: "utf8",
+      maxBuffer: 1 << 28,
+    });
+    const linked = dynamicTierSymbols(definedFunctionNames(stdout));
+    if (DYNAMIC_WORKLOADS.has(id))
+      expect(
+        linked.length,
+        `${id} links no dynamic-tier symbol: drop it from DYNAMIC_WORKLOADS`,
+      ).toBeGreaterThan(0);
+    else expect(linked, `fully typed ${id} links dynamic-tier symbols`).toEqual([]);
+  },
+);
diff --git a/tests/harness/corpus-costs.json b/tests/harness/corpus-costs.json
index b4d0ff3aa..b18e2ab28 100644
--- a/tests/harness/corpus-costs.json
+++ b/tests/harness/corpus-costs.json
@@ -2255,6 +2255,10 @@
     "6074-stored-collection-helpers-js.js": 4100,
     "6075-print-iterators.ts": 3800,
     "6076-print-iterators-js.js": 3500,
+    "6077-generator-helpers-untyped.js": 2550,
+    "6078-destructure-untyped-iterables.js": 2500,
+    "6079-generator-helpers-any.ts": 2550,
+    "6080-take-then-flatmap.ts": 2600,
     "6100-record-get-or-create.ts": 3771,
     "6101-record-get-or-create-unchecked/main.ts": 2107,
     "6103-typeof-builtin-bindings.cjs": 2202,
@@ -2521,6 +2525,7 @@
     "constant-module-globals/main.ts": 2455,
     "constant-number-remainders.ts": 2350,
     "constructed-class-dispatch.ts": 3014,
+    "constructor-returns-this-super.js": 2431,
     "contextual-array-union-write.ts": 5379,
     "contextual-return-layouts.ts": 2919,
     "counted-loop-numbers.ts": 2515,
@@ -5347,6 +5352,10 @@
     "6074-stored-collection-helpers-js.js": 3600,
     "6075-print-iterators.ts": 3450,
     "6076-print-iterators-js.js": 3300,
+    "6077-generator-helpers-untyped.js": 3050,
+    "6078-destructure-untyped-iterables.js": 2550,
+    "6079-generator-helpers-any.ts": 2700,
+    "6080-take-then-flatmap.ts": 2750,
     "6100-record-get-or-create.ts": 3173,
     "6101-record-get-or-create-unchecked/main.ts": 3228,
     "6103-typeof-builtin-bindings.cjs": 1796,
@@ -5613,6 +5622,7 @@
     "constant-module-globals/main.ts": 2911,
     "constant-number-remainders.ts": 2372,
     "constructed-class-dispatch.ts": 3382,
+    "constructor-returns-this-super.js": 4629,
     "contextual-array-union-write.ts": 6417,
     "contextual-return-layouts.ts": 3746,
     "counted-loop-numbers.ts": 2724,
diff --git a/tests/harness/corpus-costs/1112-number-methods.ts.json b/tests/harness/corpus-costs/1112-number-methods.ts.json
new file mode 100644
index 000000000..b99785c0f
--- /dev/null
+++ b/tests/harness/corpus-costs/1112-number-methods.ts.json
@@ -0,0 +1 @@
+{ "plain": 3859, "san": 43669 }
diff --git a/tests/harness/corpus-costs/5639-union-arm-by-discriminant.ts.json b/tests/harness/corpus-costs/5639-union-arm-by-discriminant.ts.json
new file mode 100644
index 000000000..4203ad979
--- /dev/null
+++ b/tests/harness/corpus-costs/5639-union-arm-by-discriminant.ts.json
@@ -0,0 +1 @@
+{ "plain": 1800, "san": 1900 }
diff --git a/tests/harness/corpus-costs/5640-generic-structural-class-narrowing.ts.json b/tests/harness/corpus-costs/5640-generic-structural-class-narrowing.ts.json
new file mode 100644
index 000000000..0b3994fcd
--- /dev/null
+++ b/tests/harness/corpus-costs/5640-generic-structural-class-narrowing.ts.json
@@ -0,0 +1 @@
+{ "plain": 2300, "san": 3300 }
diff --git a/tests/harness/corpus-costs/5730-thread-slots-widened-values.ts.json b/tests/harness/corpus-costs/5730-thread-slots-widened-values.ts.json
new file mode 100644
index 000000000..444a9b634
--- /dev/null
+++ b/tests/harness/corpus-costs/5730-thread-slots-widened-values.ts.json
@@ -0,0 +1 @@
+{ "plain": 2849, "san": 4164 }
diff --git a/tests/harness/corpus-costs/6023-string-compare-utf16.ts.json b/tests/harness/corpus-costs/6023-string-compare-utf16.ts.json
new file mode 100644
index 000000000..2d2f07e08
--- /dev/null
+++ b/tests/harness/corpus-costs/6023-string-compare-utf16.ts.json
@@ -0,0 +1 @@
+{ "plain": 2700, "san": 5400 }
diff --git a/tests/harness/corpus-costs/6061-type-only-class-fields/main.ts.json b/tests/harness/corpus-costs/6061-type-only-class-fields/main.ts.json
new file mode 100644
index 000000000..546e4a9e8
--- /dev/null
+++ b/tests/harness/corpus-costs/6061-type-only-class-fields/main.ts.json
@@ -0,0 +1 @@
+{ "plain": 6644, "san": 11367 }
diff --git a/tests/harness/corpus-costs/6063-union-class-field-checks.ts.json b/tests/harness/corpus-costs/6063-union-class-field-checks.ts.json
new file mode 100644
index 000000000..bba381595
--- /dev/null
+++ b/tests/harness/corpus-costs/6063-union-class-field-checks.ts.json
@@ -0,0 +1 @@
+{ "plain": 4152, "san": 6474 }
diff --git a/tests/harness/corpus-costs/6064-protocol-subinterface-assertions.ts.json b/tests/harness/corpus-costs/6064-protocol-subinterface-assertions.ts.json
new file mode 100644
index 000000000..c05586e43
--- /dev/null
+++ b/tests/harness/corpus-costs/6064-protocol-subinterface-assertions.ts.json
@@ -0,0 +1 @@
+{ "plain": 4411, "san": 5159 }
diff --git a/tests/harness/corpus-costs/6146-jsval-operators.js.json b/tests/harness/corpus-costs/6146-jsval-operators.js.json
new file mode 100644
index 000000000..b47e718e6
--- /dev/null
+++ b/tests/harness/corpus-costs/6146-jsval-operators.js.json
@@ -0,0 +1 @@
+{ "plain": 5693, "san": 34396 }
diff --git a/tests/harness/corpus-costs/6147-jsval-any-operators.ts.json b/tests/harness/corpus-costs/6147-jsval-any-operators.ts.json
new file mode 100644
index 000000000..0a0d95f23
--- /dev/null
+++ b/tests/harness/corpus-costs/6147-jsval-any-operators.ts.json
@@ -0,0 +1 @@
+{ "plain": 2623, "san": 3590 }
diff --git a/tests/harness/corpus-costs/6200-string-annexb-locale-methods.ts.json b/tests/harness/corpus-costs/6200-string-annexb-locale-methods.ts.json
new file mode 100644
index 000000000..645cfe9a7
--- /dev/null
+++ b/tests/harness/corpus-costs/6200-string-annexb-locale-methods.ts.json
@@ -0,0 +1 @@
+{ "plain": 2795, "san": 4147 }
diff --git a/tests/harness/corpus-costs/6201-number-precision-exponential.ts.json b/tests/harness/corpus-costs/6201-number-precision-exponential.ts.json
new file mode 100644
index 000000000..98160b1ea
--- /dev/null
+++ b/tests/harness/corpus-costs/6201-number-precision-exponential.ts.json
@@ -0,0 +1 @@
+{ "plain": 1595, "san": 2653 }
diff --git a/tests/harness/corpus-costs/6202-dyn-string-number-methods.js.json b/tests/harness/corpus-costs/6202-dyn-string-number-methods.js.json
new file mode 100644
index 000000000..d4cc558f1
--- /dev/null
+++ b/tests/harness/corpus-costs/6202-dyn-string-number-methods.js.json
@@ -0,0 +1 @@
+{ "plain": 4232, "san": 4434 }
diff --git a/tests/harness/corpus-costs/6203-any-string-number-methods.ts.json b/tests/harness/corpus-costs/6203-any-string-number-methods.ts.json
new file mode 100644
index 000000000..27c124839
--- /dev/null
+++ b/tests/harness/corpus-costs/6203-any-string-number-methods.ts.json
@@ -0,0 +1 @@
+{ "plain": 2843, "san": 5904 }
diff --git a/tests/harness/corpus-costs/6204-crypto-get-random-values.ts.json b/tests/harness/corpus-costs/6204-crypto-get-random-values.ts.json
new file mode 100644
index 000000000..ecb1d73b4
--- /dev/null
+++ b/tests/harness/corpus-costs/6204-crypto-get-random-values.ts.json
@@ -0,0 +1 @@
+{ "plain": 3066, "san": 3476 }
diff --git a/tests/harness/corpus-costs/6205-crypto-get-random-values.js.json b/tests/harness/corpus-costs/6205-crypto-get-random-values.js.json
new file mode 100644
index 000000000..dff4ea74a
--- /dev/null
+++ b/tests/harness/corpus-costs/6205-crypto-get-random-values.js.json
@@ -0,0 +1 @@
+{ "plain": 2527, "san": 3675 }
diff --git a/tests/harness/corpus-costs/6206-buffer-is-buffer-views.ts.json b/tests/harness/corpus-costs/6206-buffer-is-buffer-views.ts.json
new file mode 100644
index 000000000..80af3c965
--- /dev/null
+++ b/tests/harness/corpus-costs/6206-buffer-is-buffer-views.ts.json
@@ -0,0 +1 @@
+{ "plain": 3062, "san": 3821 }
diff --git a/tests/harness/corpus-costs/6207-fs-constants-object.ts.json b/tests/harness/corpus-costs/6207-fs-constants-object.ts.json
new file mode 100644
index 000000000..9a68cf16c
--- /dev/null
+++ b/tests/harness/corpus-costs/6207-fs-constants-object.ts.json
@@ -0,0 +1 @@
+{ "plain": 2367, "san": 1937 }
diff --git a/tests/harness/corpus-costs/6208-fs-constants-require.cjs.json b/tests/harness/corpus-costs/6208-fs-constants-require.cjs.json
new file mode 100644
index 000000000..377f8328c
--- /dev/null
+++ b/tests/harness/corpus-costs/6208-fs-constants-require.cjs.json
@@ -0,0 +1 @@
+{ "plain": 3082, "san": 3887 }
diff --git a/tests/harness/corpus-costs/6209-buffer-module-alias.cjs.json b/tests/harness/corpus-costs/6209-buffer-module-alias.cjs.json
new file mode 100644
index 000000000..db5f0ebc8
--- /dev/null
+++ b/tests/harness/corpus-costs/6209-buffer-module-alias.cjs.json
@@ -0,0 +1 @@
+{ "plain": 2310, "san": 4242 }
diff --git a/tests/harness/corpus-costs/6210-typeof-global-static-members.js.json b/tests/harness/corpus-costs/6210-typeof-global-static-members.js.json
new file mode 100644
index 000000000..ccf3a0f37
--- /dev/null
+++ b/tests/harness/corpus-costs/6210-typeof-global-static-members.js.json
@@ -0,0 +1 @@
+{ "plain": 3244, "san": 5476 }
diff --git a/tests/harness/corpus-costs/6331-jose-root-entry/main.ts.json b/tests/harness/corpus-costs/6331-jose-root-entry/main.ts.json
new file mode 100644
index 000000000..c6ea1665b
--- /dev/null
+++ b/tests/harness/corpus-costs/6331-jose-root-entry/main.ts.json
@@ -0,0 +1 @@
+{ "plain": 20300, "san": 40800 }
diff --git a/tests/harness/corpus-costs/6332-fluent-this-declaration/main.ts.json b/tests/harness/corpus-costs/6332-fluent-this-declaration/main.ts.json
new file mode 100644
index 000000000..8c0e66c3c
--- /dev/null
+++ b/tests/harness/corpus-costs/6332-fluent-this-declaration/main.ts.json
@@ -0,0 +1 @@
+{ "plain": 3000, "san": 3600 }
diff --git a/tests/harness/corpus-costs/6333-fluent-this-declaration-js/main.mjs.json b/tests/harness/corpus-costs/6333-fluent-this-declaration-js/main.mjs.json
new file mode 100644
index 000000000..8c0e66c3c
--- /dev/null
+++ b/tests/harness/corpus-costs/6333-fluent-this-declaration-js/main.mjs.json
@@ -0,0 +1 @@
+{ "plain": 3000, "san": 3600 }
diff --git a/tests/harness/corpus-costs/6334-discarded-logical-statements.mjs.json b/tests/harness/corpus-costs/6334-discarded-logical-statements.mjs.json
new file mode 100644
index 000000000..8c0e66c3c
--- /dev/null
+++ b/tests/harness/corpus-costs/6334-discarded-logical-statements.mjs.json
@@ -0,0 +1 @@
+{ "plain": 3000, "san": 3600 }
diff --git a/tests/harness/corpus-costs/6335-discarded-logical-statements.ts.json b/tests/harness/corpus-costs/6335-discarded-logical-statements.ts.json
new file mode 100644
index 000000000..8c0e66c3c
--- /dev/null
+++ b/tests/harness/corpus-costs/6335-discarded-logical-statements.ts.json
@@ -0,0 +1 @@
+{ "plain": 3000, "san": 3600 }
diff --git a/tests/harness/corpus-costs/6341-throw-array-identity.ts.json b/tests/harness/corpus-costs/6341-throw-array-identity.ts.json
new file mode 100644
index 000000000..2c49e2f02
--- /dev/null
+++ b/tests/harness/corpus-costs/6341-throw-array-identity.ts.json
@@ -0,0 +1 @@
+{ "plain": 3800, "san": 4900 }
diff --git a/tests/harness/corpus-costs/6342-throw-builtin-identity.ts.json b/tests/harness/corpus-costs/6342-throw-builtin-identity.ts.json
new file mode 100644
index 000000000..e2254bc18
--- /dev/null
+++ b/tests/harness/corpus-costs/6342-throw-builtin-identity.ts.json
@@ -0,0 +1 @@
+{ "plain": 3000, "san": 3900 }
diff --git a/tests/harness/corpus-costs/6345-inspect-dyn-holes.ts.json b/tests/harness/corpus-costs/6345-inspect-dyn-holes.ts.json
new file mode 100644
index 000000000..d80769f29
--- /dev/null
+++ b/tests/harness/corpus-costs/6345-inspect-dyn-holes.ts.json
@@ -0,0 +1 @@
+{ "plain": 2100, "san": 2300 }
diff --git a/tests/harness/corpus-costs/bound-constructor-inspect-names.cjs.json b/tests/harness/corpus-costs/bound-constructor-inspect-names.cjs.json
new file mode 100644
index 000000000..ab2bc177b
--- /dev/null
+++ b/tests/harness/corpus-costs/bound-constructor-inspect-names.cjs.json
@@ -0,0 +1 @@
+{ "plain": 2400, "san": 2700 }
diff --git a/tests/harness/corpus-costs/cjs-class-hierarchy-npm/main.ts.json b/tests/harness/corpus-costs/cjs-class-hierarchy-npm/main.ts.json
new file mode 100644
index 000000000..6f2c07c70
--- /dev/null
+++ b/tests/harness/corpus-costs/cjs-class-hierarchy-npm/main.ts.json
@@ -0,0 +1 @@
+{ "plain": 5788, "san": 8587 }
diff --git a/tests/harness/corpus-costs/cjs-open-options-npm/main.ts.json b/tests/harness/corpus-costs/cjs-open-options-npm/main.ts.json
new file mode 100644
index 000000000..bc8f1df37
--- /dev/null
+++ b/tests/harness/corpus-costs/cjs-open-options-npm/main.ts.json
@@ -0,0 +1 @@
+{ "plain": 3636, "san": 4211 }
diff --git a/tests/harness/corpus-costs/cjs-strict-arguments.cjs.json b/tests/harness/corpus-costs/cjs-strict-arguments.cjs.json
new file mode 100644
index 000000000..82b947fc7
--- /dev/null
+++ b/tests/harness/corpus-costs/cjs-strict-arguments.cjs.json
@@ -0,0 +1 @@
+{ "plain": 2381, "san": 3148 }
diff --git a/tests/harness/corpus-costs/cjs-symbol-key-collisions/main.js.json b/tests/harness/corpus-costs/cjs-symbol-key-collisions/main.js.json
new file mode 100644
index 000000000..682d630d5
--- /dev/null
+++ b/tests/harness/corpus-costs/cjs-symbol-key-collisions/main.js.json
@@ -0,0 +1 @@
+{ "plain": 2258, "san": 3272 }
diff --git a/tests/harness/corpus-costs/cjs-symbol-key-table/main.js.json b/tests/harness/corpus-costs/cjs-symbol-key-table/main.js.json
new file mode 100644
index 000000000..5bdd1fc52
--- /dev/null
+++ b/tests/harness/corpus-costs/cjs-symbol-key-table/main.js.json
@@ -0,0 +1 @@
+{ "plain": 3327, "san": 4728 }
diff --git a/tests/harness/corpus-costs/cjs-unmapped-arguments.cjs.json b/tests/harness/corpus-costs/cjs-unmapped-arguments.cjs.json
new file mode 100644
index 000000000..7a5c1ebd8
--- /dev/null
+++ b/tests/harness/corpus-costs/cjs-unmapped-arguments.cjs.json
@@ -0,0 +1 @@
+{ "plain": 2377, "san": 3264 }
diff --git a/tests/harness/corpus-costs/function-local-detached-methods.js.json b/tests/harness/corpus-costs/function-local-detached-methods.js.json
new file mode 100644
index 000000000..f839807c5
--- /dev/null
+++ b/tests/harness/corpus-costs/function-local-detached-methods.js.json
@@ -0,0 +1 @@
+{ "plain": 3316, "san": 4688 }
diff --git a/tests/harness/corpus-costs/function-local-detached-methods.ts.json b/tests/harness/corpus-costs/function-local-detached-methods.ts.json
new file mode 100644
index 000000000..19907d4e4
--- /dev/null
+++ b/tests/harness/corpus-costs/function-local-detached-methods.ts.json
@@ -0,0 +1 @@
+{ "plain": 2314, "san": 3117 }
diff --git a/tests/harness/corpus-costs/function-local-private-evaluations.js.json b/tests/harness/corpus-costs/function-local-private-evaluations.js.json
new file mode 100644
index 000000000..c75974ffd
--- /dev/null
+++ b/tests/harness/corpus-costs/function-local-private-evaluations.js.json
@@ -0,0 +1 @@
+{ "plain": 6264, "san": 10866 }
diff --git a/tests/harness/corpus-costs/function-local-private-fields.js.json b/tests/harness/corpus-costs/function-local-private-fields.js.json
new file mode 100644
index 000000000..e01fe4c5f
--- /dev/null
+++ b/tests/harness/corpus-costs/function-local-private-fields.js.json
@@ -0,0 +1 @@
+{ "plain": 2964, "san": 5827 }
diff --git a/tests/harness/corpus-costs/private-in-checked-primitives.js.json b/tests/harness/corpus-costs/private-in-checked-primitives.js.json
new file mode 100644
index 000000000..ce2fa848e
--- /dev/null
+++ b/tests/harness/corpus-costs/private-in-checked-primitives.js.json
@@ -0,0 +1 @@
+{ "plain": 2316, "san": 2225 }
diff --git a/tests/harness/coverage.test.ts b/tests/harness/coverage.test.ts
index f1347bf23..b1e25dead 100644
--- a/tests/harness/coverage.test.ts
+++ b/tests/harness/coverage.test.ts
@@ -295,7 +295,7 @@ test("--explain-dynamic attributes each refusal to the unit the dynamic tier wou
     requests.map((r) => [r.code, r.seed, r.scope, r.unit.kind, r.unit.name, r.enclosing.name]),
   ).toEqual([
     ["SC1090", "reflection", "reached", "class", "Point", "<top level>"],
-    ["SC2012", "operation", "reached", "binding", "n", "precise"],
+    ["SC2020", "operation", "reached", "binding", "n", "precise"],
   ]);
   expect(tiers.units.map((u) => [u.kind, u.name, u.requests, u.sites])).toEqual([
     ["class", "Point", 1, 0],
@@ -421,7 +421,7 @@ test("a rejected class reached only through a receiver probe reports its own dia
   const { coverage } = analyze(join(repoRoot, "tests/diagnostics/deferred-class-receiver/main.ts"));
   const messages = coverage.diagnostics.map((d) => d.message);
   expect(
-    messages.filter((m) => m.startsWith("'WeakMap<object, string>'-typed class fields")),
+    messages.filter((m) => m.startsWith("'MapIterator<string>'-typed class fields")),
   ).toHaveLength(1);
   expect(messages.some((m) => m.startsWith("constructing through a class value"))).toBe(true);
   expect(coverage.unreached?.diagnostics ?? []).toEqual([]);
diff --git a/tests/harness/errors.test.ts b/tests/harness/errors.test.ts
index 92ac8f5ab..26dfd3a5c 100644
--- a/tests/harness/errors.test.ts
+++ b/tests/harness/errors.test.ts
@@ -1051,6 +1051,107 @@ console.log(typeof Derived);
   });
 });
 
+describe("constructors returning objects (JS lane)", () => {
+  test("a returned plain object is a named deferred fence", async () => {
+    // Node's `new Box(2)` answers `{ size: 99 }`; a Box instance cannot
+    // hold that object, so the return refuses instead of answering `this`.
+    const r = await compileAndRun(
+      "constructor-returns-object",
+      `'use strict';
+class Box {
+  constructor(size) {
+    this.size = size;
+    if (size > 1) return { size: 99 };
+  }
+}
+console.log(new Box(1).size);
+console.log(new Box(2));
+`,
+      "cjs",
+    );
+    expect(r.exitCode).toBe(1);
+    expect(r.stdout).toBe("1\n");
+    expect(r.stderr).toMatch(
+      /^Uncaught Error: returning an object other than an instance of the class from a constructor \(Node's 'new Box\(\)' answers the returned object, .*\) is not supported yet \[SC1090 at .*constructor-returns-object\.cjs:5\]\n$/,
+    );
+  });
+
+  test("an untyped returned value fences only when it holds a foreign object", async () => {
+    // Primitive results answer the constructed instance, as in Node; an
+    // object that is not a Wrap instance refuses.
+    const r = await compileAndRun(
+      "constructor-returns-untyped",
+      `'use strict';
+class Wrap {
+  constructor(value) {
+    this.value = value;
+    return value;
+  }
+}
+console.log(new Wrap(1).value, new Wrap('s').value, new Wrap(null).value);
+const w = new Wrap(0);
+console.log(new Wrap(w) === w);
+console.log(new Wrap({ a: 1 }));
+`,
+      "cjs",
+    );
+    expect(r.exitCode).toBe(1);
+    expect(r.stdout).toBe("1 s null\ntrue\n");
+    expect(r.stderr).toMatch(
+      /^Uncaught Error: returning an object other than an instance of the class from a constructor .* is not supported yet \[SC1090 at .*constructor-returns-untyped\.cjs:5\]\n$/,
+    );
+  });
+});
+
+describe("module exports that read this, called through the module binding (JS lane)", () => {
+  test("a require binding's member call is a named deferred fence", async () => {
+    // Node passes the exports object as `this` to `m.hello()`; the direct
+    // call has none to pass, so it refuses instead of reading another one.
+    const r = await compileAndRun(
+      "require-member-this",
+      `'use strict';
+const m = require('./lib.cjs');
+console.log(m.plain(21));
+console.log(m.hello());
+`,
+      "cjs",
+      {
+        "lib.cjs": `'use strict';
+exports.name = 'lib';
+exports.hello = function () { return 'hi from ' + this.name; };
+exports.plain = function (x) { return x * 2; };
+`,
+      },
+    );
+    expect(r.exitCode).toBe(1);
+    expect(r.stdout).toBe("42\n");
+    expect(r.stderr).toMatch(
+      /^Uncaught Error: calling a module export that reads 'this' through its module binding \('hello': .*\) is not supported yet \[SC1090 at .*require-member-this\.cjs:4\]\n$/,
+    );
+  });
+
+  test("a namespace import's member call is a named deferred fence", async () => {
+    const r = await compileAndRun(
+      "namespace-member-this",
+      `import * as ns from './lib.mjs';
+console.log(ns.plain(1));
+console.log(ns.who());
+`,
+      "mjs",
+      {
+        "lib.mjs": `export function who() { return typeof this; }
+export function plain(x) { return x + 1; }
+`,
+      },
+    );
+    expect(r.exitCode).toBe(1);
+    expect(r.stdout).toBe("2\n");
+    expect(r.stderr).toMatch(
+      /^Uncaught Error: calling a module export that reads 'this' through its module binding \('who': .*\) is not supported yet \[SC1090 at .*namespace-member-this\.mjs:3\]\n$/,
+    );
+  });
+});
+
 // CommonJS forms around the module's exports that keep a refusal name the
 // construct itself (they used to report an unlowerable `require` value, a
 // "binding form with no lowering", or the ES-module `module` message).
@@ -1130,3 +1231,65 @@ console.log(count(require("./lib.cjs")));
     );
   });
 });
+
+// WebCrypto's native slice is HMAC importKey('raw'), sign and verify, and
+// the SHA-1/SHA-2 digests. Algorithms Node recognizes outside that slice
+// reject with a coded SC2020 Error instead of a Node-shaped success, and a
+// JavaScript call with the 'jwk' format meets its named fence when it runs.
+// Node's own rejections (unknown names, bad usages) are corpus-pinned
+// (6292, 6294); these refusals have no Node twin, so they live here.
+describe("WebCrypto refusals (JS lane)", () => {
+  test("recognized algorithms outside the HMAC slice reject with SC2020", async () => {
+    const r = await compileAndRun(
+      "webcrypto-unsupported-algorithms",
+      `const bytes = new TextEncoder().encode("secret");
+async function attempt(label, run) {
+  try {
+    await run();
+    console.log(label, "resolved");
+  } catch (e) {
+    console.log(label, e.name, e.code, e.message);
+  }
+}
+await attempt("rsa", () =>
+  crypto.subtle.importKey("raw", bytes, { name: "RSA-PSS", hash: "SHA-256" }, false, ["verify"]),
+);
+const key = await crypto.subtle.importKey("raw", bytes, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+await attempt("ecdsa", () => crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, key, bytes));
+await attempt("sha3", () => crypto.subtle.digest("SHA3-256", bytes));
+await attempt("sha3 hmac", () =>
+  crypto.subtle.importKey("raw", bytes, { name: "HMAC", hash: "SHA3-256" }, false, ["sign"]),
+);
+const format = JSON.parse('"jwk"');
+await attempt("computed jwk", () =>
+  crypto.subtle.importKey(format, { kty: "oct", k: "c2VjcmV0" }, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]),
+);
+`,
+      "mjs",
+    );
+    expect(r.exitCode).toBe(0);
+    expect(r.stderr).toBe("");
+    expect(r.stdout).toBe(
+      "rsa Error SC2020 crypto.subtle.importKey with the RSA-PSS algorithm is not supported yet\n" +
+        "ecdsa Error SC2020 crypto.subtle.sign with the ECDSA algorithm is not supported yet\n" +
+        "sha3 Error SC2020 crypto.subtle.digest with the SHA3-256 algorithm is not supported yet\n" +
+        "sha3 hmac Error SC2020 crypto.subtle.importKey with the SHA3-256 algorithm is not supported yet\n" +
+        "computed jwk Error SC2020 crypto.subtle.importKey with the 'jwk' key format is not supported yet\n",
+    );
+  });
+
+  test("a literal 'jwk' import is a named fence where it runs", async () => {
+    const r = await compileAndRun(
+      "webcrypto-jwk-literal",
+      `console.log("before");
+await crypto.subtle.importKey("jwk", { kty: "oct", k: "c2VjcmV0" }, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+`,
+      "mjs",
+    );
+    expect(r.exitCode).toBe(1);
+    expect(r.stdout).toBe("before\n");
+    expect(r.stderr).toMatch(
+      /^Uncaught Error: 'crypto\.subtle\.importKey with the 'jwk' key format' is part of the standard library types but has no scriptc lowering yet.*\n$/,
+    );
+  });
+});
diff --git a/tests/harness/library-mode.test.ts b/tests/harness/library-mode.test.ts
index 0eb0cf2c3..ffd42bd8e 100644
--- a/tests/harness/library-mode.test.ts
+++ b/tests/harness/library-mode.test.ts
@@ -1053,12 +1053,13 @@ describe.each(EMISSIONS)("K14: determinism fences, %s emission", (emission) => {
 
   test("a manifest-id-keyed teachings entry attaches to that surface's own refusal", async () => {
     const diags = await refusal(
-      `export function f(): number { return (1.234).toPrecision(2).length; }\n`,
+      `import { brotliCompressSync } from "node:zlib";\nexport function f(): number { return brotliCompressSync("data").length; }\n`,
       {
         exports: [{ export: "f", symbol: "kx_f", params: [], returns: "f64" }],
         determinism: {
           teachings: {
-            "stdlib.number.toPrecision": "formatting runs in the host; request it as an effect",
+            "node-builtin.zlib.brotliCompressSync":
+              "compression runs in the host; request it as an effect",
           },
         },
       },
@@ -1066,27 +1067,29 @@ describe.each(EMISSIONS)("K14: determinism fences, %s emission", (emission) => {
     );
     // The surface's own code, not a fence code: the id key attaches text
     // to the refusal that already fires.
-    expect(diags[0]!.code).toBe("SC2012");
-    expect(diags[0]!.message).toContain(".toPrecision()");
+    expect(diags[0]!.code).toBe("SC2020");
+    expect(diags[0]!.message).toContain("zlib.brotliCompressSync");
     expect(diags[0]!.note).toBe(
-      "from the 'refusal-fixture' profile: formatting runs in the host; request it as an effect",
+      "from the 'refusal-fixture' profile: compression runs in the host; request it as an effect",
     );
   });
 
   test("fencing a surface the static tier refuses anyway changes only the message", async () => {
     const diags = await refusal(
-      `export function f(): number { return (1.234).toPrecision(2).length; }\n`,
+      `import { brotliCompressSync } from "node:zlib";\nexport function f(): number { return brotliCompressSync("data").length; }\n`,
       {
         exports: [{ export: "f", symbol: "kx_f", params: [], returns: "f64" }],
         determinism: {
-          fences: [{ id: "stdlib.number.toPrecision", teaching: "formatting is host work" }],
+          fences: [
+            { id: "node-builtin.zlib.brotliCompressSync", teaching: "compression is host work" },
+          ],
         },
       },
       emission,
     );
     // The existing refusal's code survives — the fence never re-codes a
     // surface that already refuses; its teaching rides as the note.
-    expect(diags[0]!.code).toBe("SC2012");
-    expect(diags[0]!.note).toBe("from the 'refusal-fixture' profile: formatting is host work");
+    expect(diags[0]!.code).toBe("SC2020");
+    expect(diags[0]!.note).toBe("from the 'refusal-fixture' profile: compression is host work");
   });
 });
diff --git a/tests/harness/library-profile.test.ts b/tests/harness/library-profile.test.ts
index c7cb13751..eb1bcc4cd 100644
--- a/tests/harness/library-profile.test.ts
+++ b/tests/harness/library-profile.test.ts
@@ -481,7 +481,7 @@ describe("library profile fences", () => {
         determinism: {
           remediations: { SC2012: "the explicit map key wins" },
           fences: [
-            { id: "stdlib.number.toPrecision", remediation: "request it as an effect" },
+            { id: "diagnostic.sc2012", remediation: "request it as an effect" },
             { id: "node-builtin.crypto.createSign", remediation: "signatures come from the host" },
           ],
         },
diff --git a/tests/harness/link-features.ts b/tests/harness/link-features.ts
new file mode 100644
index 000000000..c62eeaa64
--- /dev/null
+++ b/tests/harness/link-features.ts
@@ -0,0 +1,7 @@
+/* The runtime units a lowered module links, selected exactly as compile()
+ * selects them (executableLinkFeatures). Harnesses that link IR through
+ * compileC spread this instead of hand-picking feature flags: a hand-picked
+ * list silently misses a unit added later (the dynamic tier's
+ * scr_js_value.c), which the sanitized lane, compiling only the listed
+ * runtime sources, reports as undefined references. */
+export { executableLinkFeatures as moduleLinkFeatures } from "../../packages/compiler/src/backend/executable-features.js";
diff --git a/tests/harness/native-frontend.ts b/tests/harness/native-frontend.ts
index 475db54aa..bcd1d6ae0 100644
--- a/tests/harness/native-frontend.ts
+++ b/tests/harness/native-frontend.ts
@@ -15,16 +15,7 @@ import type { compile } from "@scriptc/compiler";
 import type { IrModule } from "../../packages/compiler/src/ir/ir.js";
 import { ts7Executable } from "../../packages/compiler/src/frontend/ts7/rpc-api.js";
 
-import {
-  moduleUsesAssert,
-  moduleUsesBigInt,
-  moduleUsesCopying,
-  moduleUsesDynInvoke,
-  moduleUsesInspect,
-  moduleUsesRegex,
-  moduleUsesSymbol,
-  moduleUsesZlib,
-} from "../../packages/compiler/src/ir/runtime-features.js";
+import { moduleLinkFeatures } from "./link-features.js";
 
 const root = join(import.meta.dirname, "../..");
 const entry = join(root, "tests/fixtures/self-hosting/frontend-pipeline.ts");
@@ -66,6 +57,9 @@ export const programs = [
   "class-array-optional-return.ts",
   "contextual-array-union-write.ts",
   "6020-class-extends-function-constructor.js",
+  // Re-chosen key orders rebuild the inspect helpers after lowering.
+  "key-order-late-optional.ts",
+  "5888-inspect-sorted.ts",
 ];
 
 interface LowerRequest {
@@ -220,14 +214,7 @@ export async function checkProgram(frontend: NativeFrontend, file: string): Prom
     cPath,
     outPath: frontend.executable("program"),
     sanitize,
-    regex: moduleUsesRegex(module),
-    copying: moduleUsesCopying(module),
-    inspect: moduleUsesInspect(module),
-    dynInvoke: moduleUsesDynInvoke(module),
-    symbol: moduleUsesSymbol(module),
-    bigint: moduleUsesBigInt(module),
-    zlib: moduleUsesZlib(module),
-    assert: moduleUsesAssert(module),
+    ...moduleLinkFeatures(module),
   });
   const node = spawnSync(process.execPath, [source], runOptions);
   const native = spawnSync(frontend.executable("program"), [], runOptions);
@@ -390,6 +377,7 @@ export async function checkNativeBindings(frontend: NativeFrontend): Promise<voi
     cPath: ffiC,
     outPath: frontend.executable("ffi"),
     sanitize,
+    ...moduleLinkFeatures(ffiResult.module),
     inspect: true,
     linkInputs: [helperObject],
   });
diff --git a/tests/harness/npm.test.ts b/tests/harness/npm.test.ts
index b6af0dbb6..54207f246 100644
--- a/tests/harness/npm.test.ts
+++ b/tests/harness/npm.test.ts
@@ -52,7 +52,7 @@ const KNOWN: Record<string, Known> = {
   "esm-missing-default": { build: "SC1090" },
   "esm-missing-export": { build: "SC1090" },
   "fetch-destructure": { run: "SC1031" },
-  "fs-shims": { run: "SC2020" },
+  "fs-shims": { run: "SC1101" },
   "hoisted-workspace": { build: "SC2013" },
   "import-refusal": { build: "SC2020" },
   "island-registry": { build: "SC2011" },
diff --git a/tests/harness/project-config.test.ts b/tests/harness/project-config.test.ts
index bf57a830a..e979c772c 100644
--- a/tests/harness/project-config.test.ts
+++ b/tests/harness/project-config.test.ts
@@ -200,6 +200,27 @@ test("node-types: socket.address and resetAndDestroy under @types/node", async (
   expect(comparableStderr(native.stderr)).toBe(node.stderr);
 });
 
+test("node-types: TLSSocket.isSessionReused and keyed ??= timings under @types/node", async () => {
+  const outDir = outDirFor("tls-session-timings");
+  const entry = join(nodeTypesDir, "tls-session-timings.ts");
+  const result = await compile(entry, {
+    outPath: join(
+      outDir,
+      process.platform === "win32" ? "tls-session-timings.exe" : "tls-session-timings",
+    ),
+    outDir,
+    sanitize,
+  });
+  expect(result.ok, !result.ok ? JSON.stringify(result.diagnostics, null, 2) : "").toBe(true);
+  if (!result.ok) return;
+  const [native, node] = await Promise.all([
+    execFileAsync(result.binaryPath),
+    execFileAsync(process.execPath, ["--disable-warning=MODULE_TYPELESS_PACKAGE_JSON", entry]),
+  ]);
+  expect(native.stdout).toBe(node.stdout);
+  expect(comparableStderr(native.stderr)).toBe(node.stderr);
+});
+
 test("node-types: net.SocketAddress and net.BlockList under @types/node", async () => {
   const outDir = outDirFor("net-blocklist");
   const entry = join(nodeTypesDir, "net-blocklist.ts");
@@ -839,6 +860,42 @@ test("node-types: Cipheriv and Decipheriv match Node under @types/node", async (
   expect(comparableStderr(native.stderr)).toBe(node.stderr);
 });
 
+test("node-types: WebCrypto HMAC matches Node under @types/node", async () => {
+  const outDir = outDirFor("node-webcrypto-hmac");
+  const entry = join(nodeTypesDir, "webcrypto-hmac.ts");
+  const result = await compile(entry, {
+    outPath: join(outDir, "webcrypto-hmac"),
+    outDir,
+    sanitize,
+  });
+  expect(result.ok, !result.ok ? JSON.stringify(result.diagnostics, null, 2) : "").toBe(true);
+  if (!result.ok) return;
+  const [native, node] = await Promise.all([
+    execFileAsync(result.binaryPath),
+    execFileAsync(process.execPath, ["--disable-warning=MODULE_TYPELESS_PACKAGE_JSON", entry]),
+  ]);
+  expect(native.stdout).toBe(node.stdout);
+  expect(comparableStderr(native.stderr)).toBe(node.stderr);
+});
+
+test("node-types: the navigator global's runtime probe matches Node under @types/node", async () => {
+  const outDir = outDirFor("node-navigator");
+  const entry = join(nodeTypesDir, "navigator.ts");
+  const result = await compile(entry, {
+    outPath: join(outDir, "navigator"),
+    outDir,
+    sanitize,
+  });
+  expect(result.ok, !result.ok ? JSON.stringify(result.diagnostics, null, 2) : "").toBe(true);
+  if (!result.ok) return;
+  const [native, node] = await Promise.all([
+    execFileAsync(result.binaryPath),
+    execFileAsync(process.execPath, ["--disable-warning=MODULE_TYPELESS_PACKAGE_JSON", entry]),
+  ]);
+  expect(native.stdout).toBe(node.stdout);
+  expect(comparableStderr(native.stderr)).toBe(node.stderr);
+});
+
 test("node-types: declared-but-not-lowered surface fences, naming @types/node", async () => {
   const outDir = outDirFor("node-fenced");
   const result = await compile(join(nodeTypesDir, "fenced.ts"), {
diff --git a/tests/harness/self-hosting-backend-analysis.test.ts b/tests/harness/self-hosting-backend-analysis.test.ts
index 8ccfc097e..05bd2ce41 100644
--- a/tests/harness/self-hosting-backend-analysis.test.ts
+++ b/tests/harness/self-hosting-backend-analysis.test.ts
@@ -16,12 +16,7 @@ import {
 } from "@scriptc/compiler";
 import { everyStmtList } from "../../packages/compiler/src/ir/traverse.js";
 import { type IrModule } from "../../packages/compiler/src/ir/ir.js";
-import {
-  moduleUsesInspect,
-  moduleUsesDynInvoke,
-  moduleUsesRegex,
-  moduleUsesCopying,
-} from "../../packages/compiler/src/ir/runtime-features.js";
+import { moduleLinkFeatures } from "./link-features.js";
 import { backendAnalysisCases } from "./self-hosting-backend-cases.js";
 
 const root = fileURLToPath(new URL("../..", import.meta.url));
@@ -174,10 +169,7 @@ for (const backend of ["llvm"] as const) {
           cPath: path,
           outPath,
           sanitize,
-          inspect: moduleUsesInspect(optimized),
-          dynInvoke: moduleUsesDynInvoke(optimized),
-          regex: moduleUsesRegex(optimized),
-          copying: moduleUsesCopying(optimized),
+          ...moduleLinkFeatures(optimized),
         });
         const oracle = spawnSync(process.execPath, [sourcePath], options);
         const program = spawnSync(outPath, [], options);
diff --git a/tests/harness/self-hosting-emission.test.ts b/tests/harness/self-hosting-emission.test.ts
index b6c8d52cb..3977ede29 100644
--- a/tests/harness/self-hosting-emission.test.ts
+++ b/tests/harness/self-hosting-emission.test.ts
@@ -10,12 +10,7 @@ import { everyStmtList } from "../../packages/compiler/src/ir/traverse.js";
 import { type IrModule } from "../../packages/compiler/src/ir/ir.js";
 import { analyzeInChild, compileInChild } from "./self-hosting-compiler-process.js";
 import { spawnResult } from "./spawn-result.js";
-import {
-  moduleUsesCopying,
-  moduleUsesDynInvoke,
-  moduleUsesInspect,
-  moduleUsesRegex,
-} from "../../packages/compiler/src/ir/runtime-features.js";
+import { moduleLinkFeatures } from "./link-features.js";
 import {
   emissionCases,
   emissionModule,
@@ -258,10 +253,7 @@ for (const backend of ["llvm"] as const) {
           cPath: path,
           outPath,
           sanitize,
-          inspect: moduleUsesInspect(mod),
-          dynInvoke: moduleUsesDynInvoke(mod),
-          regex: moduleUsesRegex(mod),
-          copying: moduleUsesCopying(mod),
+          ...moduleLinkFeatures(mod),
         });
         const oracle = await spawnResult(process.execPath, [sourcePath], options);
         const program = await spawnResult(outPath, [], options);
diff --git a/tests/harness/self-hosting-llvm-emitter.test.ts b/tests/harness/self-hosting-llvm-emitter.test.ts
index c3187cb51..9c24d50cb 100644
--- a/tests/harness/self-hosting-llvm-emitter.test.ts
+++ b/tests/harness/self-hosting-llvm-emitter.test.ts
@@ -14,7 +14,7 @@ import {
 } from "@scriptc/compiler";
 import { emitLlvmModule } from "../../packages/compiler/src/backend/llvm/emitter.js";
 import { type IrModule } from "../../packages/compiler/src/ir/ir.js";
-import { executableLinkFeatures } from "../../packages/compiler/src/backend/executable-features.js";
+import { moduleLinkFeatures } from "./link-features.js";
 import {
   llvmEmitterCases,
   llvmEmitterOptions,
@@ -244,7 +244,7 @@ for (const backend of ["llvm"] as const) {
             cacheIdentity: generatedProgram,
             sanitize,
             optimization: "dev",
-            ...executableLinkFeatures(mod),
+            ...moduleLinkFeatures(mod),
           });
           const node = spawnSync(process.execPath, [sourcePath], runOptions);
           const native = spawnSync(outPath, [], runOptions);
@@ -272,7 +272,7 @@ for (const backend of ["llvm"] as const) {
           cacheIdentity: generatedProgram,
           sanitize,
           optimization: "dev",
-          ...executableLinkFeatures(ownIr),
+          ...moduleLinkFeatures(ownIr),
         });
         const again = join(dir, "again.ll");
         progress("second generation emits own IR");
diff --git a/tests/harness/self-hosting-native-toolchain.test.ts b/tests/harness/self-hosting-native-toolchain.test.ts
index c22e8a839..fa71b5a08 100644
--- a/tests/harness/self-hosting-native-toolchain.test.ts
+++ b/tests/harness/self-hosting-native-toolchain.test.ts
@@ -42,6 +42,7 @@ const features: NativeLinkFeatures = {
   tls: false,
   tlsCa: false,
   cipher: false,
+  webcrypto: false,
 };
 
 test("native toolchain configuration, staging and helper validation are static", async () => {
diff --git a/tests/harness/self-hosting-runtime-pack.test.ts b/tests/harness/self-hosting-runtime-pack.test.ts
index 08eb45754..c95d6d9a0 100644
--- a/tests/harness/self-hosting-runtime-pack.test.ts
+++ b/tests/harness/self-hosting-runtime-pack.test.ts
@@ -43,6 +43,7 @@ const base: NativeLinkFeatures = {
   tls: false,
   tlsCa: false,
   cipher: false,
+  webcrypto: false,
 };
 
 test("runtime manifest validation and selection are entirely static", async () => {
diff --git a/tests/harness/self-hosting-serialization.test.ts b/tests/harness/self-hosting-serialization.test.ts
index 77cb00c7a..73663a8fc 100644
--- a/tests/harness/self-hosting-serialization.test.ts
+++ b/tests/harness/self-hosting-serialization.test.ts
@@ -13,6 +13,7 @@ import {
   serializeModule,
   validateModule,
 } from "@scriptc/compiler";
+import { moduleLinkFeatures } from "./link-features.js";
 import { IR_VERSION } from "../../packages/compiler/src/ir/serialize.js";
 import { F64, VOID, type IrModule } from "../../packages/compiler/src/ir/ir.js";
 import { numLit } from "../../packages/compiler/src/ir/build.js";
@@ -206,7 +207,12 @@ for (const backend of ["llvm"] as const) {
       expect(Object.is(third.value, -0)).toBe(true);
       const cPath = join(dir, "numbers.ll");
       writeFileSync(cPath, emitLlvmModule(numeric));
-      await compileC({ cPath, outPath: executable("numbers"), sanitize });
+      await compileC({
+        cPath,
+        outPath: executable("numbers"),
+        sanitize,
+        ...moduleLinkFeatures(numeric),
+      });
       const program = spawnSync(executable("numbers"), [], runOptions);
       expect(program.error).toBeUndefined();
       expect(program.signal).toBeNull();
diff --git a/tests/harness/self-hosting-union-conversions.test.ts b/tests/harness/self-hosting-union-conversions.test.ts
index 15be29db4..0619ffa98 100644
--- a/tests/harness/self-hosting-union-conversions.test.ts
+++ b/tests/harness/self-hosting-union-conversions.test.ts
@@ -7,6 +7,7 @@ import { promisify } from "node:util";
 import { expect, test } from "vitest";
 import { compileC, deserializeModule, emitLlvmModule, validateModule } from "@scriptc/compiler";
 import type { AnalyzeResult, compile } from "@scriptc/compiler";
+import { moduleLinkFeatures } from "./link-features.js";
 
 const root = join(import.meta.dirname, "../..");
 const sanitize = process.env["SCRIPTC_SAN"] === "1";
@@ -92,7 +93,13 @@ for (const fixture of ["ir-refinements", "union-conversions"]) {
           expect(module.functions.filter((fn) => fn.name.endsWith("retag"))).toHaveLength(5);
           const cPath = join(dir, "generated.ll");
           writeFileSync(cPath, emitLlvmModule(module));
-          await compileC({ cPath, outPath: exe("generated"), sanitize, optimization: "dev" });
+          await compileC({
+            cPath,
+            outPath: exe("generated"),
+            sanitize,
+            optimization: "dev",
+            ...moduleLinkFeatures(module),
+          });
           const generated = spawnSync(exe("generated"), [], runOptions);
           expect(generated.error).toBeUndefined();
           expect(generated.signal, generated.stderr).toBeNull();
diff --git a/tests/harness/self-hosting-validator-cases.ts b/tests/harness/self-hosting-validator-cases.ts
index 4a02c9d58..cbebae409 100644
--- a/tests/harness/self-hosting-validator-cases.ts
+++ b/tests/harness/self-hosting-validator-cases.ts
@@ -16,7 +16,7 @@ import { boolLit, numLit, strLit, varRef } from "../../packages/compiler/src/ir/
 const loc = { file: "validator-input.ts", start: 12, end: 34 };
 const expression = (expr: IrExpr): IrStmt => ({ kind: "exprStmt", expr, loc });
 const base = (): IrModule => ({
-  irVersion: 16,
+  irVersion: 17,
   sourceFile: loc.file,
   entry: "main",
   functions: [{ name: "main", params: [], locals: [], returnType: VOID, body: [], loc }],
diff --git a/tests/harness/self-hosting.test.ts b/tests/harness/self-hosting.test.ts
index adf67807c..7198e7176 100644
--- a/tests/harness/self-hosting.test.ts
+++ b/tests/harness/self-hosting.test.ts
@@ -12,6 +12,7 @@ import {
   emitLlvmModule,
   validateModule,
 } from "@scriptc/compiler";
+import { moduleLinkFeatures } from "./link-features.js";
 
 const root = fileURLToPath(new URL("../..", import.meta.url));
 
@@ -137,6 +138,7 @@ for (const [fixture, backend] of ["ir-build", "contextual-ir", "coercion-builder
           outPath,
           sanitize,
           cacheIdentity: "scriptc-generated-v1",
+          ...moduleLinkFeatures(mod),
         });
         const program = spawnSync(outPath, [], options);
         expect(program.error).toBeUndefined();
diff --git a/tests/harness/stdlib-surface.test.ts b/tests/harness/stdlib-surface.test.ts
index 53c2704bf..d2ffab6cb 100644
--- a/tests/harness/stdlib-surface.test.ts
+++ b/tests/harness/stdlib-surface.test.ts
@@ -119,7 +119,7 @@ function calleeSymbol(decl: ts.VariableDeclaration): ts.Symbol | undefined {
 
 function isStdlibDeclared(symbol: ts.Symbol | undefined): boolean {
   if (!symbol) return false;
-  return checker.declarationsOf(symbol).some((d) => {
+  return symbol.declarations.some((d) => {
     const file = d.getSourceFile();
     return (
       file.fileName === ambient ||
diff --git a/tests/harness/zero-cost-gate.test.ts b/tests/harness/zero-cost-gate.test.ts
index 0b08da748..3da134010 100644
--- a/tests/harness/zero-cost-gate.test.ts
+++ b/tests/harness/zero-cost-gate.test.ts
@@ -5,6 +5,7 @@ import {
   compareArtifact,
   compareCounts,
   compareExecutables,
+  definedFunctionNames,
   dynamicTierSymbols,
   nmOutput,
   programVerdict,
@@ -141,6 +142,34 @@ test("the zero-cost gate recognizes dynamic-tier runtime symbols", () => {
   ).toEqual(["scr_dyn_obj_read", "scr_js_load_ic"]);
 });
 
+test("the zero-cost gate reads function names from ELF and Mach-O nm output", () => {
+  const elf = [
+    "0000000000001000 0000000000000010 T scr_dyn_call",
+    "0000000000001010 0000000000000008 t scr_dyn_obj_get",
+    "0000000000002000 0000000000000004 D scr_dyn_table",
+    "                 U memcpy",
+  ].join("\n");
+  expect(definedFunctionNames(elf, "linux")).toEqual(["scr_dyn_call", "scr_dyn_obj_get"]);
+  // Mach-O names carry a leading underscore, which would hide every
+  // dynamic-tier symbol from the prefix match.
+  const macho = [
+    "0000000100001000 T _scr_dyn_call",
+    "0000000100001010 t _scr_dyn_obj_get",
+    "0000000100002000 W __main",
+    "0000000100003000 s _scr_dyn_add.message",
+    "                 U _memcpy",
+  ].join("\n");
+  expect(definedFunctionNames(macho, "darwin")).toEqual([
+    "scr_dyn_call",
+    "scr_dyn_obj_get",
+    "_main",
+  ]);
+  expect(dynamicTierSymbols(definedFunctionNames(macho, "darwin"))).toEqual([
+    "scr_dyn_call",
+    "scr_dyn_obj_get",
+  ]);
+});
+
 test("the zero-cost gate fails differing programs unless they match the signature", () => {
   const ok = { ok: true };
   const same = { ir: { identical: true }, exe: { identical: true } };