Merge main

.github/workflows/release.yml

@@ -101,8 +101,8 @@ jobs:
           if (receiptRun) appendFileSync(process.env.GITHUB_OUTPUT, `receipt_run=${receiptRun}\n`);
           NODE
 
-  # Collects the native compiler's profile and function layout on this commit
-  # (scripts/refresh-cli-profile.mjs, scripts/refresh-cli-layout.mjs), so every
+  # Collects the native compiler's function layout and profile on this commit
+  # (scripts/refresh-cli-layout.mjs, scripts/refresh-cli-profile.mjs), so every
   # platform's CLI build optimizes and lays out the code it compiles. The
   # committed ones fall behind main within a day or two. If this job fails,
   # the CLI builds use the committed profile and layout.
@@ -111,7 +111,7 @@ jobs:
     needs: check-release
     if: needs.check-release.outputs.should_release == 'true' && needs.check-release.outputs.reuse_artifacts != 'true'
     runs-on: ubuntu-24.04
-    timeout-minutes: 45
+    timeout-minutes: 75
     continue-on-error: true
     permissions:
       contents: read
@@ -136,14 +136,20 @@ jobs:
           git clone --quiet --depth 1 https://github.com/vercel-labs/tsc-ts "$RUNNER_TEMP/tsc-ts"
           echo "tsc-ts $(git -C "$RUNNER_TEMP/tsc-ts" rev-parse HEAD)"
           npm ci --prefix "$RUNNER_TEMP/tsc-ts"
+      # The layout comes first: the profile matches the functions of builds
+      # with the layout its instrumented compiler was built with, so the
+      # profile is collected with a second instrumented compiler built with
+      # this layout.
+      - name: Collect the function layout
+        run: >-
+          node scripts/refresh-cli-layout.mjs --jobs 4
+          --output "$RUNNER_TEMP/cli-profile/cli.layout.gz" --work "$RUNNER_TEMP/cli-layout-work"
       - name: Collect the profile
+        env:
+          SCRIPTC_NATIVE_LAYOUT: ${{ runner.temp }}/cli-profile/cli.layout.gz
         run: >-
           node scripts/refresh-cli-profile.mjs --tsc-ts "$RUNNER_TEMP/tsc-ts" --jobs 4
           --output "$RUNNER_TEMP/cli-profile/cli.profdata.gz" --work "$RUNNER_TEMP/cli-profile-work"
-      - name: Collect the function layout
-        run: >-
-          node scripts/refresh-cli-layout.mjs --jobs 4 --instrumented "$RUNNER_TEMP/cli-profile-work/cli"
-          --output "$RUNNER_TEMP/cli-profile/cli.layout.gz"
       - uses: actions/upload-artifact@v4
         with:
           name: cli-profile

AGENTS.md

@@ -25,6 +25,8 @@ their supported native-clang contracts locally; other hosts retain those
 checks in the Sandboxes. Both lanes green is the bar before shipping any
 change.
 
+`SCRIPTC_SANDBOX_NATIVE_REFERENCE` names a built checkout inside a prepared `SCRIPTC_SANDBOX_SNAPSHOT` or image: each lane copies that checkout's LLVM helper and runtime pack instead of rebuilding them when their source inputs are identical. Sandbox creation is rate limited per team in vCPUs per minute, so the runner retries a rate-limited creation with backoff. Larger Sandboxes (`SCRIPTC_SANDBOX_VCPUS` up to 32, with `SCRIPTC_TEST_WORKERS` at half the vCPUs) shorten the lanes most.
+
 `VERCEL_OIDC_TOKEN` is the preferred credential. `VERCEL_TOKEN` remains
 supported with explicit `VERCEL_TEAM_ID` and `VERCEL_PROJECT_ID`. The custom
 `SCRIPTC_SANDBOX_IMAGE` is optional: without it, the gate starts from
@@ -58,6 +60,8 @@ A change that must not cost good code anything, such as a compatibility fix that
 node scripts/zero-cost-gate.mjs --baseline=/vercel/sandbox/prev --candidate=. --allow='\barguments\b'
 ```
 
+The whole gate takes 30 to 75 minutes on one 8-vCPU Sandbox, so shard it across Sandboxes. `--shard=i/n` splits the bench and corpus programs; the self-hosted compiler runs in shard 1, or alone with `--set=self`, and its candidate-source build overlaps its comparison build on hosts with 40 GB or more. Each shard writes `--json`, and `node scripts/zero-cost-merge.mjs <shard.json>...` merges them into one verdict, recomputing the compile-time intervals over every shard. `--record-baseline-cache=<file>` builds only the baseline and records each program's artifact hashes; `--baseline-cache=<file>` then skips the baseline build of every program whose candidate artifacts hash the same, which halves the work for a change that leaves most programs identical. A record applies only to the built baseline checkout, toolchain, and paths it was made with, and is ignored otherwise; a program whose entry, relative imports, or optimization level changed since the record builds its baseline.
+
 Test location follows scope:
 
 - Co-locate white-box unit tests with implementation files under

Dockerfile.sandbox

@@ -26,6 +26,7 @@ RUN apt-get update \
         libclang-rt-22-dev \
         libpolly-22-dev \
         libzstd-dev \
+        lld-22 \
         llvm-22-dev \
         ninja-build \
         xz-utils \
@@ -33,6 +34,7 @@ RUN apt-get update \
     && ln -sf clang-22 /usr/bin/clang \
     && ln -sf clang++-22 /usr/bin/clang++ \
     && test "$(llvm-config-22 --version)" = 22.1.8 \
+    && test -x "$(dirname "$(readlink -f /usr/bin/clang)")/ld.lld" \
     && rm -rf /var/lib/apt/lists/*
 
 RUN curl --fail --silent --show-error --location \

RELEASING.md

@@ -16,9 +16,9 @@ CI (`.github/workflows/release.yml`) compares the version in `packages/cli/packa
 
 The release job builds each pinned LLVM helper, precompiled runtime pack, and native CLI on its matching host. The native CLI package bundles its TypeScript checker, declarations, and comptime evaluator, and depends on its platform's LLVM helper and runtime pack packages at the same version; the compiler resolves them beside itself. The standalone archives bundle the helper and runtime pack too. npm postinstall installs the matching native executable; Node is needed for npm installation but not native compilation or execution. The user's toolchain performs the final platform link. Sanitized builds also use it to instrument program LLVM and compile the C runtime. Platform packages publish ahead of `@scriptc/compiler` and `scriptc`. The GitHub release attaches standalone compiler archives, their SHA-256 checksums, and the surface manifest after npm publication succeeds.
 
-Release builds of the native CLI optimize the compiler with a profile collected on the release commit. The `cli-profile` job runs `node scripts/refresh-cli-profile.mjs` on Linux x64, which builds an instrumented compiler, runs it on tsc-ts, a slice of the corpus, and the runtime benchmark workloads, and writes the merged sparse profile. Every platform's CLI build uses that profile (`SCRIPTC_NATIVE_PROFILE_USE`), and the GitHub release attaches it as `scriptc-<version>-cli.profdata.gz`. Code the profile does not describe, or describes from older compiler sources, is optimized as without a profile. When the profile job fails, the CLI builds use the committed profile `packages/compiler/native/cli.profdata.gz`, which local and CI builds of the native compiler also use. Refresh the committed profile when compiler code has changed substantially since the last refresh: run `node scripts/refresh-cli-profile.mjs --tsc-ts <tsc-ts checkout>` on a quiet Linux x64 host and commit the new profile on its own.
+Release builds of the native CLI optimize the compiler with a profile collected on the release commit. The `cli-profile` job runs `node scripts/refresh-cli-profile.mjs` on Linux x64, which builds an instrumented compiler, runs it on tsc-ts, a slice of the corpus, and the runtime benchmark workloads, and writes the merged profile. The profile keeps the functions that training never ran, with zero counts, so the CLI builds optimize them as cold code and place them after the code that ran. Every platform's CLI build uses that profile (`SCRIPTC_NATIVE_PROFILE_USE`), and the GitHub release attaches it as `scriptc-<version>-cli.profdata.gz`. Code the profile does not describe, or describes from older compiler sources, is optimized as without a profile. When the profile job fails, the CLI builds use the committed profile `packages/compiler/native/cli.profdata.gz`, which local and CI builds of the native compiler also use. Refresh the committed profile when compiler code has changed substantially since the last refresh: run `node scripts/refresh-cli-profile.mjs --tsc-ts <tsc-ts checkout>` on a quiet Linux x64 host and commit the new profile on its own.
 
-Builds of the native compiler also order its functions by the committed layout `packages/compiler/native/cli.layout.gz`: the functions that `--version` and rebuilds of unchanged programs run come first, then the ones other builds run, ordered by the share of the layout's training builds that run each, so a run maps fewer pages of the executable. Functions the layout does not list keep their usual order. Function names of closures and generated helpers change with nearby edits, so the `cli-profile` job also collects a layout on the release commit (`scripts/refresh-cli-layout.mjs`, reusing the job's instrumented compiler), and the CLI builds use it (`SCRIPTC_NATIVE_LAYOUT`). Refresh the committed layout the same way as the profile, with `node scripts/refresh-cli-layout.mjs`, and commit it on its own.
+Builds of the native compiler also order its functions by the committed layout `packages/compiler/native/cli.layout.gz`: the functions that `--version` and rebuilds of unchanged programs run come first, then the ones other builds run, ordered by the share of the layout's training builds that run each, so a run maps fewer pages of the executable. Functions the layout does not list keep their usual order. Function names of closures and generated helpers change with nearby edits, so the `cli-profile` job also collects a layout on the release commit (`scripts/refresh-cli-layout.mjs`), and the CLI builds use it (`SCRIPTC_NATIVE_LAYOUT`). Instrumented builds use the same layout as optimized builds, because a function laid out in a different partition than in the instrumented build no longer matches its profile record. The job therefore collects the layout first and then builds the instrumented compiler for the profile with that layout. Refresh the committed layout the same way, with `node scripts/refresh-cli-layout.mjs`, before the profile, and commit each on its own.
 
 Publishing uses npm trusted publishing (OIDC) — there is no npm token secret.
 Each published package must have a GitHub Actions trusted publisher for

benchmarks/runtime/README.md

@@ -28,6 +28,7 @@ Application-shaped workloads for measuring the speed of compiled executables. Ea
 | `numeric-kernels` | cpu | sieve, hashing, `number[][]` matmul, `Float64Array` |
 | `optional-fields` | cpu | records and class instances with `number \| undefined` and other scalar-union fields |
 | `published-graphs` | cpu | syntax trees with parent links and a symbol table, published with `@scriptc/threads` and then read |
+| `record-untyped-writes` | cpu | typed records written through untyped views: a counter helper taking `unknown` bumps fields of a stats record, and `Object.assign` merges patches into a settings record, with typed reads in between |
 | `record-boundaries` | cpu | records built from unchecked array reads passed to and returned from annotated functions |
 | `records-sort` | cpu | comparator sorts, group-by, `reduce`/`filter` |
 | `regex-logs` | cpu | regex `exec` with groups, `test`, global `replace` |

benchmarks/runtime/workloads/record-untyped-writes.json

@@ -0,0 +1,6 @@
+{
+  "entry": "workloads/record-untyped-writes.ts",
+  "args": [
+    "4"
+  ]
+}

benchmarks/runtime/workloads/record-untyped-writes.ts

@@ -0,0 +1,49 @@
+// Typed records updated through untyped views: a stats record written by a
+// generic counter helper that takes `unknown`, settings merged with
+// Object.assign, and typed reads in between. Each write stores into the
+// native record; typed code reads the same object.
+type Stats = { hits: number; misses: number; bytes: number; name: string; ok: boolean };
+type Settings = { host: string; port: number; debug: boolean; retries: number };
+
+const scale = Number(process.argv[2] ?? "1");
+
+function bump(target: unknown, key: string, by: number): void {
+  const record = target as Record<string, number>;
+  record[key] = record[key]! + by;
+}
+
+const stats: Stats[] = [];
+for (let i = 0; i < 16; i++) stats.push({ hits: 0, misses: 0, bytes: 0, name: "s" + i, ok: true });
+
+let seed = 12345;
+let checksum = 0;
+const rounds = Math.floor(1_000_000 * scale);
+for (let i = 0; i < rounds; i++) {
+  seed = (Math.imul(seed, 1103515245) + 12345) >>> 0;
+  const s = stats[seed & 15]!;
+  if ((seed >>> 8) % 5 === 0) bump(s, "misses", 1);
+  else bump(s, "hits", 1);
+  bump(s, "bytes", (seed >>> 12) & 1023);
+  checksum += s.hits - s.misses;
+}
+
+const settings: Settings = { host: "localhost", port: 80, debug: false, retries: 0 };
+const view: object = settings;
+const patches: object[] = [
+  { port: 8080 },
+  { debug: true, retries: 3 },
+  { host: "example.test" },
+  { port: 443, debug: false },
+];
+for (let i = 0; i < Math.floor(200_000 * scale); i++) {
+  Object.assign(view, patches[i & 3]!);
+  checksum += settings.port + settings.retries;
+}
+
+let hits = 0;
+let bytes = 0;
+for (const s of stats) {
+  hits += s.hits;
+  bytes += s.bytes;
+}
+console.log("hits", hits, "bytes", bytes, "settings", JSON.stringify(settings), "checksum", checksum);

docs/content/docs/how-it-works.mdx

@@ -134,8 +134,8 @@ Program objects define `main` and leave selected `scr_*` runtime functions undef
 
 ## Native runtime
 
-- **Memory:** Values use reference counting. Acyclic values are freed when their last reference is released, and a cycle collector runs at defined collection points. Some cycles involving opaque native values can remain allocated. When the main thread's script ends, the process exits without freeing what the program still holds, and the operating system reclaims it; worker threads free their heaps when they exit. Builds with `--sanitize`, and processes run with `SCRIPTC_EXIT_FREE=1` (for external leak checkers), free everything at exit.
-- **Concurrency:** An `async` function that suspends only at its own `await` expressions compiles to a stackless coroutine whose heap frame holds the values live across those awaits; other suspending `async` functions and async generators use stackful fibers. The native event loop schedules microtasks, timers, and I/O, using kqueue on macOS and epoll on Linux.
+- **Memory:** Values use reference counting. Acyclic values are freed when their last reference is released, and a cycle collector runs at defined collection points. When the compiler proves that a group of objects is released together, such as a tree that a recursive function builds and its caller only reads, the group is allocated in an arena and released at once, without freeing each object or collecting its cycles. Some cycles involving opaque native values can remain allocated. When the main thread's script ends, the process exits without freeing what the program still holds, and the operating system reclaims it; worker threads free their heaps when they exit. Builds with `--sanitize`, and processes run with `SCRIPTC_EXIT_FREE=1` (for external leak checkers), free everything at exit.
+- **Concurrency:** An `async` function or async generator that suspends only at its own `await` and `yield` expressions compiles to a stackless coroutine whose heap frame holds the values live across them; other suspending `async` functions and async generators use stackful fibers, as do debug builds, libraries, worker programs and Windows executables. The native event loop schedules microtasks, timers, and I/O, using kqueue on macOS and epoll on Linux.
 - **Networking:** Supported `net`, `http`, `https`, `tls`, `dgram`, and `dns` APIs use native implementations. TLS uses vendored mbedTLS.
 - **Numbers:** Values use JavaScript's double-precision representation. Number-to-string formatting uses shortest-roundtrip output and is tested against Node.js.
 - **Regular expressions and Unicode:** The runtime uses QuickJS's regular-expression and Unicode libraries, linked into programs that use them.

docs/content/limitations/array-bounds-and-runtime-errors.mdx

@@ -11,6 +11,6 @@ Runtime traps cannot be caught.
 User-thrown values and supported exceptions, including JSON parse, checked-cast, filesystem, regex, and `String.prototype.repeat` count errors, can be caught; hard traps such as out-of-range reads of statically typed ordinary arrays terminate the process.
 
 Deep recursion in Linux and macOS executables throws Node's catchable `RangeError: Maximum call stack size exceeded`, on the main thread, in worker threads, and inside async functions and generators.
-The depth at which it is thrown differs from Node: the main thread uses the process stack limit (usually 8 MiB), worker threads get an 8 MiB stack, and async functions and generators run on 512 KiB stacks, so native code usually recurses deeper than Node on threads and somewhat less deeply inside async bodies.
+The depth at which it is thrown differs from Node: the main thread uses the process stack limit (usually 8 MiB), worker threads get an 8 MiB stack, async functions and generators that keep a fiber run on 512 KiB stacks, and stackless ones run on the stack that resumes them, so native code usually recurses deeper than Node on threads and somewhat less deeply inside fiber bodies.
 Recursion inside runtime library operations, such as serializing deeply nested data, is not checked.
 Windows executables, WASI builds and library builds do not check the stack, and exhausting it there terminates the process.

native/llvm-codegen/src/emit.cpp

@@ -212,8 +212,8 @@ struct UnnameStructTypes : PassInfoMixin<UnnameStructTypes> {
 // How the --profile-use profile matched the functions it annotated, summed
 // over partitions: functions that received its counts, functions whose
 // control flow changed since it was collected (hash mismatch), and functions
-// it has no record of (new, or never run in training: the merged profile is
-// sparse). A partition reused from the cache without its counts is counted
+// it has no record of (new since it was collected, or never run in training
+// when the profile was merged with --sparse). A partition reused from the cache without its counts is counted
 // in Unknown.
 struct ProfileMatch {
   std::atomic<uint64_t> Annotated{0};

packages/cli/test/target-cpu.test.ts

@@ -54,7 +54,7 @@ test.runIf(process.platform === "linux" && process.arch === "x64")(
       expect(baseline).not.toContain("sanitize_address");
       expect(await build(["--target-cpu=baseline"])).toBe(baseline);
       const v3 = await build(["--target-cpu=x86-64-v3"]);
-      expect(v3).toMatch(/^attributes #0 = \{ "target-cpu"="x86-64-v3" \}$/m);
+      expect(v3).toMatch(/^attributes #0 = \{ uwtable "target-cpu"="x86-64-v3" \}$/m);
       if (runsV3) expect((await execFileAsync(outPath)).stdout).toBe(expected);
       // The bootstrap's cached route builds without a level.
       expect(await build([], true)).toBe(baseline);

packages/compiler/src/backend/link-plan-core.ts

@@ -75,7 +75,7 @@ export function executableLinkInputs(options: {
  * links as needed: the runtime defines the libm functions most programs
  * reach (scr_glibc_math.c) and Math's transcendentals (scr_ieee754.c), so a
  * program that calls no other libm function, such as pow, starts without
- * loading libm.so. */
+ * loading libm.so when it links with lld (see inputsWithoutLld). */
 export function systemLibraryLinkerArgs(
   target: Pick<NativeTargetSpec, "platform">,
   names: readonly string[],

packages/compiler/src/backend/linker.ts

@@ -21,7 +21,7 @@ import {
 import { type NativeArtifactDependency } from "./native/contracts.js";
 import { RuntimePackError, stageRuntimePackArtifacts } from "./runtime-pack.js";
 import type { NativeLinkPlan } from "./link-plan.js";
-import { lldLinkerArgs } from "./lld.js";
+import { inputsWithoutLld, lldLinkerArgs } from "./lld.js";
 import { systemLibraryLinkerArgs } from "./link-plan-core.js";
 import {
   createDarwinDebugSymbols,
@@ -244,15 +244,19 @@ export async function linkNativeExecutable(
     stagedRoot = staged.root;
     // Linux links with lld when the default driver finds it.
     const lld = explicitLinker === undefined ? lldLinkerArgs(plan.target.platform, linker) : [];
-    const args = [
-      ...(explicitLinker === undefined ? plan.target.defaultLinkerArgs : []),
-      ...lld,
-      ...plan.driverFlags,
-      ...plan.inputs.map((input) => staged.replacements.get(input) ?? input),
-      ...systemLibraryLinkerArgs(plan.target, plan.systemLibraries),
-      "-o",
-      privateOut,
-    ];
+    const linkArgs = (withLld: boolean): string[] => {
+      const inputs = plan.inputs.map((input) => staged.replacements.get(input) ?? input);
+      return [
+        ...(explicitLinker === undefined ? plan.target.defaultLinkerArgs : []),
+        ...(withLld ? lld : []),
+        ...plan.driverFlags,
+        ...(withLld ? inputs : inputsWithoutLld(plan.target.platform, inputs)),
+        ...systemLibraryLinkerArgs(plan.target, plan.systemLibraries),
+        "-o",
+        privateOut,
+      ];
+    };
+    const args = linkArgs(lld.length !== 0);
     // The pack snapshots bracket both verification passes and private staging;
     // the program-object snapshot begins before helper emission. Snapshot the
     // remaining cache-bearing inputs before the linker consumes them, then
@@ -285,10 +289,7 @@ export async function linkNativeExecutable(
       // A failed link with lld runs again with the driver's default linker,
       // whose error (if any) is the one reported.
       if (lld.length === 0) throw error;
-      await execFileAsync(
-        linker,
-        args.filter((arg) => !lld.includes(arg)),
-      );
+      await execFileAsync(linker, linkArgs(false));
     });
     const output = await stat(privateOut);
     if (!output.isFile() || output.size === 0) throw new Error("linker produced no executable");

packages/compiler/src/backend/lld.test.ts

@@ -2,7 +2,7 @@ import { chmodSync, mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync }
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, expect, test } from "vitest";
-import { driverFindsLld, lldLinkerArgs } from "./lld.js";
+import { driverFindsLld, inputsWithoutLld, lldLinkerArgs } from "./lld.js";
 
 const directories: string[] = [];
 afterEach(() => {
@@ -59,3 +59,10 @@ test.skipIf(process.platform === "win32")(
     expect(lldLinkerArgs("linux", clang, { ...env, SCRIPTC_LINKER: clang })).toEqual([]);
   },
 );
+
+test("Linux links without lld leave out the glibc math unit", () => {
+  const inputs = ["/pack/scr_lib.o", "/pack/scr_glibc_math.o", "/tmp/program.o"];
+  expect(inputsWithoutLld("linux", inputs)).toEqual(["/pack/scr_lib.o", "/tmp/program.o"]);
+  expect(inputsWithoutLld("darwin", inputs)).toEqual(inputs);
+  expect(inputsWithoutLld("windows", inputs)).toEqual(inputs);
+});

packages/compiler/src/backend/lld.ts

@@ -1,5 +1,5 @@
 import { realpathSync, statSync } from "node:fs";
-import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
+import { basename, delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 
 function isFile(path: string): boolean {
   try {
@@ -47,3 +47,21 @@ export function lldLinkerArgs(
     ? ["-fuse-ld=lld"]
     : [];
 }
+
+/**
+ * The link inputs for a Linux link without lld. The runtime's
+ * scr_glibc_math.c defines glibc's floor, fmod, frexp and a few others as
+ * hidden functions so that a program calling no other libm function starts
+ * without libm.so. That works with lld, which garbage-collects the unused
+ * definitions and decides `--as-needed` from the live code. GNU ld decides
+ * `--as-needed` before section GC, so the runtime's unreachable code keeps
+ * libm needed, and it keeps every regular definition of a name that a needed
+ * shared library also defines, hidden or not: the unit would add all of its
+ * code to every executable and save nothing. Its functions answer what
+ * glibc's do, so linking glibc's own instead is equivalent.
+ */
+export function inputsWithoutLld(platform: string, inputs: readonly string[]): string[] {
+  return platform === "linux"
+    ? inputs.filter((input) => basename(input) !== "scr_glibc_math.o")
+    : [...inputs];
+}

packages/compiler/src/backend/llvm/alloc.ts

@@ -141,7 +141,7 @@ const CYC_GEN = 3;
 /** ScrCycHdr.buf, an i32 at this header offset. */
 export const CYC_BUF = 4;
 /** The emitted descriptor `{ trace, free_fn, kind, id }` (ScrCycType). */
-const CYC_TYPE = "{ ptr, ptr, i32, i32 }";
+export const CYC_TYPE = "{ ptr, ptr, i32, i32 }";
 
 function declareState(host: AllocHost): void {
   if (host.threadLocalAlloc !== true) host.declare(`@scr_sa = external global ${SA_TYPE}`);

packages/compiler/src/backend/llvm/arenas.ts

@@ -0,0 +1,437 @@
+/* Group arenas (runtime scr_arena.h): objects that region-groups.ts proves
+ * die together are bump-allocated in an arena and released at once.
+ *
+ * - A root (a fresh-result call or `new` whose value its caller keeps in
+ *   one scope) opens an arena before it is evaluated and closes it after.
+ *   The scope that holds the value drops the arena when it exits, on every
+ *   path. A statement-frame entry closes the arena too, so an exception
+ *   that skips the close never leaves it the allocation target.
+ * - A call region (a call of a leak-free function that returns no
+ *   reference) opens an arena and drops it as soon as the call returns,
+ *   or when its statement frame unwinds.
+ *
+ * region-sites.ts keeps only the roots and call regions whose groups grow,
+ * and picks the allocations that take the arena: those whose value the
+ * group keeps. Arena-aware functions are the ones reached from the kept
+ * roots and call regions. There, a kept `new`, record or array literal
+ * calls the arena-aware constructor (`<new>.r`, `scr_arr_new*_r`), which
+ * allocates in the current arena when one is open and on the heap
+ * otherwise, and a call whose value the group does not keep runs with the
+ * arena suspended. Every other allocation site stays as it is.
+ *
+ * Arenas are off in programs that construct weak collections, in programs
+ * of more than ARENA_FUNCTION_LIMIT functions, in libraries, and with
+ * lifetime regions. */
+import type { IrClassDef, IrFunction, IrModule, IrType } from "../../ir/ir.js";
+import {
+  analyzeClosedGroups,
+  analyzeRegionGroups,
+  source,
+  type RegionGroups,
+} from "./region-groups.js";
+import { CYC_BUF, CYC_HDR, CYC_TYPE } from "./alloc.js";
+import { ALLOCATIONS, children, forEachNode, isExpr, type Node } from "./region-ir.js";
+import { planRegionSites, reachableFrom, type RegionSites } from "./region-sites.js";
+
+/** The count an arena object starts with (scr_arena.h SCR_ARENA_RC). */
+export const ARENA_RC = 2 ** 29;
+
+/** Group arenas are on unless SCRIPTC_ARENAS=0 (for comparisons). */
+export function arenasRequested(): boolean {
+  return process.env["SCRIPTC_ARENAS"] !== "0";
+}
+
+export interface ArenaPlan {
+  groups: RegionGroups;
+  sites: RegionSites;
+  /** Record shapes and classes that get an arena-aware constructor. */
+  shapes: Set<string>;
+  classes: Set<string>;
+}
+
+export interface ArenaEligibility {
+  shape(shapeId: string): boolean;
+  cls(def: IrClassDef): boolean;
+  /** The reference arm of a union stored as a nullable pointer, or null. */
+  nullableArm(unionId: string): IrType | null;
+  /** Whether values of `t` can be on a reference cycle (the collector
+   * traces them). */
+  traced(t: IrType): boolean;
+}
+
+/** Whether `mod` can construct a WeakMap or WeakSet, directly or through
+ * a stored global constructor. A weak collection's entry for a key goes
+ * when the key is freed, and an arena object is never freed on its own, so
+ * such programs use no arenas. */
+function constructsWeakCollections(mod: IrModule): boolean {
+  let found = false;
+  const visit = (node: Node): void => {
+    if (found) return;
+    if (node.kind === "libCall") {
+      if (node.fn === "weakMap.new" || node.fn === "weakSet.new") found = true;
+      else if (node.fn === "dyn.globalConstructor") {
+        const name = node.args[0];
+        if (name?.kind !== "strLit" || name.value === "WeakMap" || name.value === "WeakSet")
+          found = true;
+      }
+    }
+    const kids: Node[] = [];
+    children(node, kids);
+    for (const k of kids) visit(k);
+  };
+  for (const fn of mod.functions) for (const s of fn.body) visit(s);
+  return found;
+}
+
+/** Programs with more functions than this use no arenas: the analysis
+ * visits every function, and on programs this large it costs more compile
+ * time than their arenas save at run time. */
+const ARENA_FUNCTION_LIMIT = 4000;
+
+/** The arena plan of `mod`, or null when nothing would use an arena. */
+export function planArenas(mod: IrModule, eligible: ArenaEligibility): ArenaPlan | null {
+  if (mod.functions.length > ARENA_FUNCTION_LIMIT || constructsWeakCollections(mod)) return null;
+  const groups = analyzeRegionGroups(mod);
+  const sites = planRegionSites(mod, groups);
+  if (groups.roots.size === 0 && groups.calls.size === 0) return null;
+  const shapes = new Set<string>();
+  const classes = new Set<string>();
+  const defs = new Map((mod.classes ?? []).map((c) => [c.name, c]));
+  const note = (node: Node): void => {
+    const kept = sites.arenaSites.has(node) || groups.roots.has(node);
+    if (
+      kept &&
+      node.kind === "recordLit" &&
+      node.type.kind === "record" &&
+      eligible.shape(node.type.shapeId)
+    )
+      shapes.add(node.type.shapeId);
+    if (kept && node.kind === "new") {
+      const def = defs.get(node.className);
+      if (def !== undefined && eligible.cls(def)) classes.add(node.className);
+    }
+    const kids: Node[] = [];
+    children(node, kids);
+    for (const k of kids) note(k);
+  };
+  for (const fn of mod.functions)
+    if (groups.reachable.has(fn.name)) for (const s of fn.body) note(s);
+  for (const r of groups.roots) if (r.kind === "new") note(r);
+  // A group's heap objects die when its arena drops, unless heap objects
+  // hold each other in a cycle: the collector frees those later, and by
+  // then their references into the arena point at recycled memory. So a
+  // group keeps its arena only if every cycle-capable object it can
+  // allocate takes the arena.
+  const takesArena = (node: Node): boolean =>
+    (sites.arenaSites.has(node) || groups.roots.has(node)) &&
+    ((node.kind === "recordLit" && node.type.kind === "record" && shapes.has(node.type.shapeId)) ||
+      (node.kind === "new" && classes.has(node.className)) ||
+      node.kind === "arrayLit");
+  const unsafe = cycleUnsafeFunctions(mod, groups.reachable, sites, takesArena, eligible.traced);
+  for (const r of [...groups.roots, ...groups.calls]) {
+    const runs = reachableFrom(mod, [r]);
+    if ([...runs].some((f) => unsafe.has(f)) || (r.kind === "new" && !takesArena(r))) {
+      groups.roots.delete(r);
+      groups.calls.delete(r);
+      groups.drops.delete(r);
+    }
+  }
+  if (groups.roots.size === 0 && groups.calls.size === 0) return null;
+  groups.reachable = reachableFrom(mod, [...groups.roots, ...groups.calls]);
+  const arenaType = (t: IrType): boolean => {
+    if (t.kind === "object") return classes.has(t.className);
+    if (t.kind === "record") return shapes.has(t.shapeId);
+    if (t.kind === "union") {
+      const arm = eligible.nullableArm(t.unionId);
+      return arm !== null && arenaType(arm);
+    }
+    // Arrays of arena objects: kept array literals of them take the arena.
+    return t.kind === "array" && t.elem.kind !== "union" && arenaType(t.elem);
+  };
+  const keptSite = (e: Node): boolean => sites.arenaSites.has(e) || groups.roots.has(e);
+  for (const r of analyzeClosedGroups(mod, groups, arenaType, keptSite)) groups.closed.add(r);
+  return { groups, sites, shapes, classes };
+}
+
+/** The functions in `reachable` that can allocate a cycle-capable object
+ * on the heap while an arena is open: one that does not take the arena
+ * (`takesArena`), or a call that runs with the arena suspended and reaches
+ * any cycle-capable allocation. */
+function cycleUnsafeFunctions(
+  mod: IrModule,
+  reachable: ReadonlySet<string>,
+  sites: RegionSites,
+  takesArena: (node: Node) => boolean,
+  traced: (t: IrType) => boolean,
+): Set<string> {
+  const fns = new Map(mod.functions.map((f) => [f.name, f]));
+  const allocatesTraced = (node: Node): boolean =>
+    isExpr(node) &&
+    traced(node.type) &&
+    (node.kind === "closure"
+      ? node.captures.length > 0
+      : (ALLOCATIONS.has(node.kind) || source(node) || node.kind === "libCall") &&
+        node.kind !== "call" &&
+        node.kind !== "callValue");
+  // Functions with a cycle-capable allocation, and what they call.
+  const direct = new Set<string>();
+  const calls = new Map<string, Set<string>>();
+  const heap = new Set<string>();
+  for (const name of reachable) {
+    const fn = fns.get(name);
+    if (fn === undefined) continue;
+    const out = new Set<string>();
+    calls.set(name, out);
+    forEachNode(fn.body, (node) => {
+      if (allocatesTraced(node)) {
+        direct.add(name);
+        if (!takesArena(node)) heap.add(name);
+      }
+      if (node.kind === "call") out.add(node.callee);
+      else if (node.kind === "new") out.add(`%${node.className}.constructor`);
+      else if (node.kind === "closure") out.add(node.fnName);
+    });
+  }
+  const tracedSomewhere = new Set(direct);
+  for (let changed = true; changed;) {
+    changed = false;
+    for (const [name, out] of calls)
+      if (!tracedSomewhere.has(name) && [...out].some((c) => tracedSomewhere.has(c))) {
+        tracedSomewhere.add(name);
+        changed = true;
+      }
+  }
+  for (const name of reachable) {
+    const fn = fns.get(name);
+    if (fn === undefined || heap.has(name)) continue;
+    forEachNode(fn.body, (node) => {
+      if (!sites.heapCalls.has(node)) return;
+      const target =
+        node.kind === "call"
+          ? node.callee
+          : node.kind === "new"
+            ? `%${node.className}.constructor`
+            : null;
+      // A suspended call of an unknown function (a closure, a virtual call)
+      // may allocate anything.
+      if (target === null || tracedSomewhere.has(target)) heap.add(name);
+    });
+  }
+  return heap;
+}
+
+/** The arena-aware constructor of a record shape or class. */
+export function arenaNewSym(newSym: string): string {
+  return `${newSym}.r`;
+}
+
+/** The function that releases an arena object's fields at the drop. */
+export function arenaDisposeSym(newSym: string): string {
+  return `${newSym}.dispose`;
+}
+
+/** Whether `fn` allocates through arena-aware constructors. */
+export function arenaAware(plan: ArenaPlan | null, fn: IrFunction | undefined): boolean {
+  return plan !== null && fn !== undefined && plan.groups.reachable.has(fn.name);
+}
+
+/** What arenaNewLines needs from its host (a subset of ShapeHost). */
+export interface ArenaHost {
+  declare(decl: string): void;
+  threadLocalAlloc?: boolean;
+  inlineAlloc?: boolean;
+  /** The target C ABI's `size_t`: also the pointer width. */
+  readonly sizeType: "i32" | "i64";
+}
+
+/** Instructions that set `dest` to the address of the calling thread's
+ * open arena pointer (scr_arena.c's scr_arena_cur), or null on targets
+ * without the inline allocator, which call scr_arena_current,
+ * scr_arena_suspend and scr_arena_resume instead. In worker programs the
+ * pointer is thread-local. */
+export function arenaCurrentAddress(host: ArenaHost, dest: string): string[] | null {
+  if (host.inlineAlloc !== true) return null;
+  if (host.threadLocalAlloc !== true) {
+    host.declare(`@scr_arena_cur = external global ptr`);
+    return [`${dest} = getelementptr inbounds i8, ptr @scr_arena_cur, i64 0`];
+  }
+  host.declare(`@scr_arena_cur = external thread_local global ptr`);
+  host.declare(`declare nonnull ptr @llvm.threadlocal.address.p0(ptr nonnull)`);
+  return [`${dest} = call ptr @llvm.threadlocal.address.p0(ptr @scr_arena_cur)`];
+}
+
+/**
+ * The arena-aware constructor `<new>.r`: an object of `size` bytes (a
+ * `size_t` constant expression) in the current arena, behind the collector header
+ * `cyc` names (or none), which `init` sets up the way the heap constructor
+ * does (with the count ARENA_RC). When `dispose` names a function and the
+ * arena is not closed, the object goes on the arena's dispose list, which
+ * the drop runs. The heap constructor's object when no arena is open or
+ * the arena is full. The bump, the clear, the header and the dispose entry
+ * are inline (scr_arena.c's ScrArena ABI); scr_arena_obj takes a new chunk
+ * and scr_arena_disposal grows the list.
+ */
+export function arenaNewLines(
+  host: ArenaHost,
+  newSym: string,
+  size: string,
+  cyc: string | null,
+  dispose: string | null,
+  init: string[],
+  result: string,
+): string[] {
+  const S = host.sizeType;
+  // ScrArena's fields and dispose entries are pointer-sized (scr_arena.c).
+  const word = S === "i32" ? 4 : 8;
+  host.declare(`declare ptr @scr_arena_obj(ptr, ${S}, ptr)`);
+  host.declare(`declare void @llvm.memset.p0.${S}(ptr, i8, ${S}, i1)`);
+  const cur = arenaCurrentAddress(host, "%cur");
+  const current =
+    cur === null
+      ? (host.declare(`declare ptr @scr_arena_current()`), [`  %a = call ptr @scr_arena_current()`])
+      : [...cur.map((line) => `  ${line}`), `  %a = load ptr, ptr %cur`];
+  const lines: string[] = [
+    `define internal ptr @${arenaNewSym(newSym)}() nounwind alwaysinline { ; in the open arena`,
+    `entry:`,
+    ...current,
+    `  %on = icmp ne ptr %a, null`,
+    `  br i1 %on, label %arena, label %heap`,
+    `arena:`,
+  ];
+  // A traced type's first object registers its descriptor on the slow path.
+  if (cyc !== null)
+    lines.push(
+      `  %tidp = getelementptr inbounds ${CYC_TYPE}, ptr ${cyc}, i32 0, i32 3`,
+      `  %tid = load atomic i32, ptr %tidp acquire, align 4`,
+      `  %creg = icmp ne i32 %tid, 0`,
+    );
+  const hdr = cyc === null ? 0 : CYC_HDR;
+  lines.push(
+    `  %n0 = add ${S} ${size}, ${hdr + 7}`,
+    `  %n = and ${S} %n0, -8`,
+    `  %bp = load ptr, ptr %a`,
+    `  %limp = getelementptr inbounds i8, ptr %a, ${S} ${word}`,
+    `  %lim = load ptr, ptr %limp`,
+    `  %bpi = ptrtoint ptr %bp to ${S}`,
+    `  %limi = ptrtoint ptr %lim to ${S}`,
+    `  %room = sub ${S} %limi, %bpi`,
+    `  %fits0 = icmp ule ${S} %n, %room`,
+  );
+  if (cyc !== null) lines.push(`  %fits = and i1 %fits0, %creg`);
+  lines.push(
+    `  br i1 ${cyc === null ? "%fits0" : "%fits"}, label %carve, label %slow`,
+    `carve:`,
+    `  %end = getelementptr inbounds i8, ptr %bp, ${S} %n`,
+    `  store ptr %end, ptr %a`,
+    `  call void @llvm.memset.p0.${S}(ptr align 8 %bp, i8 0, ${S} %n, i1 false)`,
+  );
+  if (cyc !== null)
+    lines.push(
+      `  %id = trunc i32 %tid to i16`,
+      `  store i16 %id, ptr %bp ; ScrCycHdr.id`,
+      `  %bufp = getelementptr inbounds i8, ptr %bp, i64 ${CYC_BUF}`,
+      `  store i32 -1, ptr %bufp ; ScrCycHdr.buf = SCR_CYC_ACYCLIC`,
+    );
+  lines.push(
+    `  %of = getelementptr inbounds i8, ptr %bp, ${S} ${hdr}`,
+    `  br label %init`,
+    `slow:`,
+    `  %os = call ptr @scr_arena_obj(ptr %a, ${S} ${size}, ptr ${cyc ?? "null"})`,
+    `  %got = icmp ne ptr %os, null`,
+    `  br i1 %got, label %init, label %heap`,
+    `init:`,
+    `  %o = phi ptr [ %of, %carve ], [ %os, %slow ]`,
+    ...init,
+  );
+  if (dispose !== null) {
+    host.declare(`declare void @scr_arena_disposal(ptr, ptr, ptr)`);
+    lines.push(
+      `  %closedp = getelementptr inbounds i8, ptr %a, ${S} ${4 * word} ; ScrArena.closed`,
+      `  %closed = load i32, ptr %closedp`,
+      `  %skip = icmp ne i32 %closed, 0`,
+      `  br i1 %skip, label %done, label %list`,
+      `list:`,
+      `  %dpp = getelementptr inbounds i8, ptr %a, ${S} ${2 * word} ; ScrArena.disposals`,
+      `  %dp = load ptr, ptr %dpp`,
+      `  %dep = getelementptr inbounds i8, ptr %a, ${S} ${3 * word} ; ScrArena.disposals_end`,
+      `  %de = load ptr, ptr %dep`,
+      `  %full = icmp eq ptr %dp, %de`,
+      `  br i1 %full, label %grow, label %push`,
+      `push:`,
+      `  store ptr %o, ptr %dp ; ScrArenaDisposal.obj`,
+      `  %dfp = getelementptr inbounds i8, ptr %dp, ${S} ${word}`,
+      `  store ptr @${dispose}, ptr %dfp ; ScrArenaDisposal.dispose`,
+      `  %dn = getelementptr inbounds i8, ptr %dp, ${S} ${2 * word}`,
+      `  store ptr %dn, ptr %dpp`,
+      `  br label %done`,
+      `grow:`,
+      `  call void @scr_arena_disposal(ptr %a, ptr %o, ptr @${dispose})`,
+      `  br label %done`,
+      `done:`,
+    );
+  }
+  lines.push(
+    `  ret ptr ${result}`,
+    `heap:`,
+    `  %h = call ptr @${newSym}()`,
+    `  ret ptr %h`,
+    `}`,
+    ``,
+  );
+  return lines;
+}
+
+/** Dispose lines for field `i` of `%o` at `ptr` (a getelementptr into
+ * `%o`), released by `release`: a plain reference (no union encoding) is
+ * released only when it is a heap object, since an arena or immortal
+ * object's count (the rc word's low half) is at least 2^28 and its release
+ * would change nothing. */
+export function disposeFieldLines(
+  i: number,
+  gep: string,
+  plain: boolean,
+  release: string,
+  comment: string,
+): string[] {
+  const load = [`  %f${i} = ${gep}`, `  %v${i} = load ptr, ptr %f${i}`];
+  if (!plain) return [...load, `  call void ${release}(ptr %v${i}) ; ${comment}`];
+  return [
+    ...load,
+    `  %nn${i} = icmp ne ptr %v${i}, null`,
+    `  br i1 %nn${i}, label %chk${i}, label %next${i}`,
+    `chk${i}:`,
+    `  %rc${i} = load i32, ptr %v${i}`,
+    `  %heap${i} = icmp ult i32 %rc${i}, ${2 ** 28}`,
+    `  br i1 %heap${i}, label %rel${i}, label %next${i}`,
+    `rel${i}:`,
+    `  call void ${release}(ptr %v${i}) ; ${comment}`,
+    `  br label %next${i}`,
+    `next${i}:`,
+  ];
+}
+
+/** Whether values of `t` are plain pointers to counted objects. */
+export function plainRefType(t: IrType): boolean {
+  return (
+    t.kind === "object" ||
+    t.kind === "record" ||
+    t.kind === "array" ||
+    t.kind === "map" ||
+    t.kind === "set" ||
+    t.kind === "func" ||
+    t.kind === "string"
+  );
+}
+
+/** The dispose function: releases each reference field (`fields`, lines
+ * that load `%v<i>` and release it) of the object `%o`. */
+export function arenaDisposeLines(newSym: string, fields: string[]): string[] {
+  return [
+    `define internal void @${arenaDisposeSym(newSym)}(ptr %o) nounwind { ; arena drop`,
+    `entry:`,
+    ...fields,
+    `  ret void`,
+    `}`,
+    ``,
+  ];
+}

packages/compiler/src/backend/llvm/bytes-loop-versions.test.ts

@@ -222,6 +222,55 @@ test("negative factors, rebinding, captures and outer loops are not versioned",
   expect(match(fn([outer]), inner)).not.toBeNull();
 });
 
+test("loops with nested loops version only for accesses inside them", () => {
+  // for (let i = 0; i < 64; i++) {
+  //   let t = 0;
+  //   for (let j = 0; j < n; j++) t = t + src[j];
+  //   out[i] = t;
+  // }
+  const sum = (): IrStmt[] => [
+    { kind: "varDecl", localId: "t", init: num(0), loc },
+    counted(
+      [
+        {
+          kind: "assign",
+          localId: "t",
+          value: bin("+", ref("t"), get(ref("src", f64s), ref("j"))),
+          loc,
+        },
+      ],
+      ref("n"),
+      "j",
+    ),
+  ];
+  const extra = [local("t", F64, true)];
+  // The guard would prove only `out[i]`, which runs once per row.
+  const rows = counted([...sum(), set(ref("out", f64s), ref("i"), ref("t"))], num(64));
+  expect(match(fn([rows], extra), rows)).toBeNull();
+  expect(match(fn([rows], extra), rows.body[1] as IrStmt & { kind: "for" })).not.toBeNull();
+  // The guard proves `out[i]` inside a nested loop too.
+  const inside = counted(
+    [...sum(), counted([set(ref("out", f64s), ref("i"), ref("t"))], num(2), "j")],
+    num(64),
+  );
+  expect(match(fn([inside], extra), inside)?.bounds.size).toBe(1);
+  // A loop whose nested loops access no typed array versions for its own
+  // accesses.
+  const scalar = counted(
+    [
+      { kind: "varDecl", localId: "t", init: num(0), loc },
+      counted(
+        [{ kind: "assign", localId: "t", value: bin("+", ref("t"), ref("j")), loc }],
+        ref("n"),
+        "j",
+      ),
+      set(ref("out", f64s), ref("i"), ref("t")),
+    ],
+    num(64),
+  );
+  expect(match(fn([scalar], extra), scalar)?.bounds.size).toBe(1);
+});
+
 test("emitted loops version the body and tag typed-array memory", () => {
   const loop = counted([
     set(ref("out", f64s), ref("i"), bin("*", get(ref("src", f64s), ref("i")), num(2))),

packages/compiler/src/backend/llvm/bytes-loop-versions.ts

@@ -196,9 +196,10 @@ const INVARIANT_OPS = new Set(["+", "-", "*", "&", "|", "^", "<<", ">>", ">>>"])
  * and writes thread-owned views directly.
  *
  * Only small synchronous loops are versioned (nested loops included), and
- * the emitter bounds how deeply versions nest. The checked loop runs
- * whenever the guard fails, and keeps every out-of-bounds read, ignored
- * write and NaN-index behavior. */
+ * the emitter bounds how deeply versions nest. A loop whose nested loops
+ * access typed arrays versions only for an access inside them. The checked
+ * loop runs whenever the guard fails, and keeps every out-of-bounds read,
+ * ignored write and NaN-index behavior. */
 export function matchBytesLoopVersion(
   loop: IrStmt & { kind: "for" | "while" },
   counted: IntegerCountedForLoop | null,
@@ -492,7 +493,15 @@ export function matchBytesLoopVersion(
   const pairedCounters =
     paired !== null && counted === null ? new Set([paired.low.localId, paired.high.localId]) : null;
   const pairedNodes = new Map<number, Node[]>();
+  // Accesses inside the loop's nested loops, and inside its nested while
+  // loops.
+  const nested = new Set<Node>();
+  const nestedWhile = new Set<Node>();
+  let loops = 0,
+    whiles = 0;
   const access = (node: Node, array: IrExpr, index: IrExpr, width: number): void => {
+    if (loops > 0) nested.add(node);
+    if (whiles > 0) nestedWhile.add(node);
     const ref = root(array);
     if (!ref) return;
     if (facts.workers && ref.type.kind === "bytes" && !facts.owned.has(node)) {
@@ -603,7 +612,15 @@ export function matchBytesLoopVersion(
       access(s, s.arr, s.index, 1);
       scope(s, s.arr, true);
     }
-    return everyStmtChild(s, visitExpr, visitStmt);
+    const isLoop =
+      s.kind === "for" || s.kind === "forOf" || s.kind === "while" || s.kind === "doWhile";
+    const isWhile = s.kind === "while" || s.kind === "doWhile";
+    if (isLoop) loops++;
+    if (isWhile) whiles++;
+    const result = everyStmtChild(s, visitExpr, visitStmt);
+    if (isLoop) loops--;
+    if (isWhile) whiles--;
+    return result;
   };
   loop.body.every(visitStmt);
   if (loop.kind === "while") visitExpr(loop.cond);
@@ -714,6 +731,18 @@ export function matchBytesLoopVersion(
     used.add(receiver);
     for (const node of nodes) bounds.add(node);
   }
+  // A loop whose nested loops access typed arrays versions only when the
+  // guard proves the bounds of one of those accesses (or, in a worker
+  // program, the ownership of one inside a nested while loop, which never
+  // versions for ownership alone). Otherwise the guard covers accesses that
+  // run once per pass, while each copy of the body repeats every nested
+  // loop and each nested loop's own version.
+  if (
+    nested.size > 0 &&
+    ![...bounds].some((node) => nested.has(node)) &&
+    ![...ownedNodes].some((node) => nestedWhile.has(node))
+  )
+    return null;
   const counterChecks: CounterCheck[] = [];
   for (const [id, min] of counterMins) {
     const info = whileAccesses!.counters.get(id)!;

packages/compiler/src/backend/llvm/classes.ts

@@ -1,3 +1,11 @@
+import {
+  ARENA_RC,
+  arenaDisposeLines,
+  arenaDisposeSym,
+  arenaNewLines,
+  disposeFieldLines,
+  plainRefType,
+} from "./arenas.js";
 import { InternalCompilerError } from "../../errors.js";
 /** Class layouts, reference counting, hierarchy intervals, virtual tables and
  * constructor values. Opaque LLVM pointers allow virtual slots to store method
@@ -1089,9 +1097,15 @@ export function emitClassShapes(
     // A traced class whose trace visits nothing carries the collector header
     // only because its hierarchy is traced: it is never on a cycle. Its
     // descriptor names scr_cyc_no_children and its objects start out
-    // SCR_CYC_ACYCLIC, so releases never buffer them.
+    // SCR_CYC_ACYCLIC, so releases never buffer them. An Array subclass's
+    // trace also visits its elements by their current element ops
+    // (scr_arr_subclass_trace), so it is never acyclic.
     const acyclic =
-      traced && runtimePrefix === null && !isStreamRooted && tracedFields.length === 0;
+      traced &&
+      runtimePrefix === null &&
+      !isStreamRooted &&
+      tracedFields.length === 0 &&
+      cls.arrayElem === undefined;
     const bounded =
       runtimePrefix !== null ||
       isStreamRooted ||
@@ -1415,6 +1429,8 @@ export function emitClassShapes(
           storedHeaderBytes(meta),
         ),
       );
+    // The header and field set-up, shared with the arena-aware constructor.
+    const initStart = nw.length;
     if (meta.compact && !meta.hierarchy)
       nw.push(`  store i32 ${compactHeaderWord(meta)}, ptr %o ; no count (compactHeaderWord)`);
     else if (meta.compact) {
@@ -1483,6 +1499,7 @@ export function emitClassShapes(
     // Young instances: program-owned traced classes. Classes rooted at a
     // runtime base (errors, emitters, events, streams) carry runtime state
     // and stay with trial deletion, like every runtime family.
+    const init = nw.slice(initStart);
     if (
       traced &&
       !lifetime &&
@@ -1492,6 +1509,52 @@ export function emitClassShapes(
       nw.push(...youngEntryLines(host));
     nw.push(`  ret ptr ${meta.hierarchy ? "%o.vt" : "%o"}`, `}`, ``);
     defs.push(...nw);
+    if (
+      host.arenaClasses?.has(cls.name) === true &&
+      cls.arrayElem === undefined &&
+      !lifetime &&
+      regions === null &&
+      !meta.compact &&
+      runtimePrefix === null &&
+      !isStreamRooted &&
+      !meta.threadSlot
+    ) {
+      // The arena count in place of 1, in the rc word or its low half.
+      const counted = meta.idInRc
+        ? `  store i64 ${classIdRcWord(meta, false)}, ptr %o.vt`
+        : `  store ${host.sizeType} 1, ptr %o`;
+      const arenaCount = meta.idInRc
+        ? `  store i64 ${(BigInt(meta.pre + 1) * 2n ** 32n + BigInt(ARENA_RC)).toString()}, ptr %o.vt`
+        : `  store ${host.sizeType} ${ARENA_RC}, ptr %o`;
+      const newSym = mangleClassNew(cls.name);
+      const dispose = refFields.length > 0 ? arenaDisposeSym(newSym) : null;
+      defs.push(
+        ...arenaNewLines(
+          host,
+          newSym,
+          sizeOf,
+          traced ? cycType : null,
+          dispose,
+          init.map((line) => (line.startsWith(counted) ? arenaCount : line)),
+          meta.hierarchy ? "%o.vt" : "%o",
+        ),
+      );
+      if (dispose !== null)
+        defs.push(
+          ...arenaDisposeLines(
+            newSym,
+            refFields.flatMap((f, t) =>
+              disposeFieldLines(
+                t,
+                `getelementptr inbounds %${struct}, ptr %o, i64 0, i32 ${f.index}`,
+                plainRefType(f.type),
+                releaseSym(host, f.type),
+                llvmCommentText(f.name),
+              ),
+            ),
+          ),
+        );
+    }
 
     if (traced) {
       // trace: visit exactly the cycle-capable fields; gcFree: release

packages/compiler/src/backend/llvm/cpu-dispatch.ts

@@ -18,10 +18,10 @@ const COPY_GROUPS: ReadonlyMap<string, string> = new Map([
   ["2", "4"],
 ]);
 
-export function cpuDispatchAttributes(asan: string): string[] {
+export function cpuDispatchAttributes(common: string): string[] {
   return [
-    `attributes #3 = {${asan} "target-cpu"="x86-64-v3" }`,
-    `attributes #4 = { noinline${asan} "target-cpu"="x86-64-v3" }`,
+    `attributes #3 = {${common} "target-cpu"="x86-64-v3" }`,
+    `attributes #4 = { noinline${common} "target-cpu"="x86-64-v3" }`,
   ];
 }
 

packages/compiler/src/backend/llvm/dense-array-access.ts

@@ -19,6 +19,7 @@
  * length, so reads never reach the state check for it; a write past the
  * bound tests the flag and, without states, appends at the length. */
 
+import { InternalCompilerError } from "../../errors.js";
 import { isRefCounted, type IrExpr, type IrType } from "../../ir/ir.js";
 import {
   f64Lit,
@@ -300,6 +301,9 @@ function loadState(host: LlvmEmitterContext, guard: DenseGuard): string {
   return state;
 }
 
+/** The ScrElemKind of double arrays (scr_array.h). */
+export const SCR_ELEM_F64 = 0;
+
 /** The ScrElemKind of int32 arrays (scr_array.h). */
 export const SCR_ELEM_I32 = 7;
 
@@ -368,7 +372,9 @@ export function emitDenseArrayGet(
 
 /** emitDenseArrayGet, with the int32 of an int32 array's element: the
  * slot itself on the dense path, the runtime getter's double converted
- * (exactly: the element is an int32) on the other. */
+ * (exactly: the element is an int32) on the other. With `inexact`, the
+ * getter's double may be something other than an int32 (NaN from
+ * `scr_arr_get_number`): the read branches there when it is. */
 export function emitDenseArrayRead(
   host: LlvmEmitterContext,
   array: string,
@@ -379,6 +385,7 @@ export function emitDenseArrayRead(
   getter: string,
   retain: boolean,
   proven = false,
+  inexact?: string,
 ): { value: string; int32: string | null } {
   const B = host.B;
   const ty = valueType(acc);
@@ -460,22 +467,68 @@ export function emitDenseArrayRead(
       : READ_FALLBACK;
   B.line(`${slowValue} = call ${ty} @${getter}(ptr ${array}, double ${index.name})${attrs}`);
   let slowInt: string | null = null;
-  if (fastInt !== null) {
+  let slowLabel = slow;
+  if (fastInt !== null && inexact !== undefined) {
+    // An int32 that is not -0, or the inexact branch.
+    host.declare("declare i32 @llvm.fptosi.sat.i32.f64(double)");
+    slowInt = B.tmp();
+    const back = B.tmp(),
+      exact = B.tmp(),
+      bits = B.tmp(),
+      notNegativeZero = B.tmp(),
+      ok = B.tmp();
+    B.line(`${slowInt} = call i32 @llvm.fptosi.sat.i32.f64(double ${slowValue})`);
+    B.line(`${back} = sitofp i32 ${slowInt} to double`);
+    B.line(`${exact} = fcmp oeq double ${back}, ${slowValue}`);
+    B.line(`${bits} = bitcast double ${slowValue} to i64`);
+    B.line(`${notNegativeZero} = icmp ne i64 ${bits}, -9223372036854775808`);
+    B.line(`${ok} = and i1 ${exact}, ${notNegativeZero}`);
+    slowLabel = B.newLabel("arr.get.int32");
+    B.condBr(ok, slowLabel, inexact);
+    B.startBlock(slowLabel);
+  } else if (fastInt !== null) {
     slowInt = B.tmp();
     B.line(`${slowInt} = fptosi double ${slowValue} to i32`);
   }
   B.br(join);
   B.startBlock(join);
   const result = B.tmp();
-  B.line(`${result} = phi ${ty} [ ${fast}, %${fastLabel} ], [ ${slowValue}, %${slow} ]`);
+  B.line(`${result} = phi ${ty} [ ${fast}, %${fastLabel} ], [ ${slowValue}, %${slowLabel} ]`);
   let int32: string | null = null;
   if (fastInt !== null && slowInt !== null) {
     int32 = B.tmp();
-    B.line(`${int32} = phi i32 [ ${fastInt}, %${fastLabel} ], [ ${slowInt}, %${slow} ]`);
+    B.line(`${int32} = phi i32 [ ${fastInt}, %${fastLabel} ], [ ${slowInt}, %${slowLabel} ]`);
   }
   return { value: result, int32 };
 }
 
+/** emitDenseArrayNumber of an int32 array, with the element's int32: a
+ * read that answers NaN (or another value that is not an int32) branches
+ * to `inexact`. */
+export function emitDenseArrayNumberInt32(
+  host: LlvmEmitterContext,
+  array: string,
+  index: LlValue,
+  indexExpr: IrExpr | undefined,
+  proven: boolean,
+  inexact: string,
+): { value: string; int32: string } {
+  const read = emitDenseArrayRead(
+    host,
+    array,
+    index,
+    indexExpr,
+    "i32",
+    { kind: "f64" },
+    "scr_arr_get_number",
+    false,
+    proven,
+    inexact,
+  );
+  if (read.int32 === null) throw new InternalCompilerError("llvm emitter bug: int32 read");
+  return { value: read.value, int32: read.int32 };
+}
+
 /** `scr_arr_get_number`: a numeric element, or NaN for every missing,
  * hole, or present-undefined slot (answered by the runtime). */
 export function emitDenseArrayNumber(

packages/compiler/src/backend/llvm/dyn.ts

@@ -1,5 +1,5 @@
 import { emitPerKeyOrder } from "./key-orders.js";
-import { typedRefConstructor } from "./shapes.js";
+import { rcMembers, typedRefConstructor } from "./shapes.js";
 import { bindLiveArrayOps } from "./expr-stream-bridges.js";
 import {
   BYTES_ELEM_NUM,
@@ -32,10 +32,9 @@ import { InternalCompilerError } from "../../errors.js";
  *            are selected from the target C ABI.
  *            v.num double | v.b i8 | v.str/v.bytes ptr at +16;
  *            v.arr { len +16, cap +24, items +32 };
- *            v.obj { len +16, cap +24, entries +32 };
+ *            v.obj { len +16 } (own properties; read them through
+ *            scr_dyn_member_*, which know both object modes);
  *            v.fn  { clo +16, thunk +24, sig +32, name +40, arity +48 }.
- *   ScrDynEntry { key, key_len, value, getter, setter, accessor, writable,
- *                 enumerable, configurable } — 48 bytes on 64-bit, 24 on 32-bit.
  *   ScrDynKind: NULL=0 BOOL=1 NUM=2 STR=3 ARR=4 OBJ=5 UNDEF=6 BYTES=7
  *               FUNC=8 HANDLE=9.
  *   ScrBytes { rc +0; len +8; elem +16; data +24 }.
@@ -46,6 +45,7 @@ import {
   DYN_HANDLE_KINDS,
   isDirentShape,
   KEY_ORDER_FIELD,
+  shapeHasAccessorSlots,
   shapeKeyOrders,
   isDynTypedRefType,
   isRefCounted,
@@ -261,6 +261,8 @@ export class LlDyn {
   /** Emitted function definitions, in interning order. */
   readonly defs: string[] = [];
 
+  private readonly prefixSources = new Map<string, string[]>();
+
   constructor(private readonly host: DynHost) {}
 
   /** Journal replay (emit-journal.ts): builds or finds the helper a chunk
@@ -420,7 +422,7 @@ export class LlDyn {
    * dyn view: inside a visit session (`wrapped`), a capsule keeps the view
    * it was first given, so an outer visit can keep reading it. */
   private viewFn(wrapped: boolean): string {
-    const fn = wrapped ? "scr_dyn_visit_view" : "scr_dyn_typed_ref_materialize";
+    const fn = wrapped ? "scr_dyn_visit_view" : "scr_dyn_typed_ref_peek";
     this.host.declare(`declare ptr @${fn}(ptr)`);
     return fn;
   }
@@ -849,27 +851,23 @@ export class LlDyn {
     return e;
   }
 
-  /** Object entry field addresses: entries + i*sizeof(ScrDynEntry), with
-   * key, key_len, and value at offsets 0, 8, and 16 on 64-bit targets. */
+  /** Own property i of object `d` (borrowed key bytes, key length and
+   * value), read through the runtime's accessors: the object may be in
+   * layout or dictionary mode (scr_dyn.h). */
   private entryAt(
     B: BlockBuilder,
-    entries: string,
+    d: string,
     i: string,
   ): { key: string; keyLen: string; value: string } {
-    const off = B.tmp();
-    const base = B.tmp();
-    B.line(`${off} = mul ${this.S} ${i}, ${this.abiOffset(48, 24)} ; sizeof(ScrDynEntry)`);
-    B.line(`${base} = getelementptr inbounds i8, ptr ${entries}, ${this.S} ${off}`);
+    this.host.declare(`declare ptr @scr_dyn_member_key(ptr, ${this.S})`);
+    this.host.declare(`declare ${this.S} @scr_dyn_member_key_len(ptr, ${this.S})`);
+    this.host.declare(`declare ptr @scr_dyn_member_value(ptr, ${this.S})`);
     const key = B.tmp();
-    B.line(`${key} = load ptr, ptr ${base}`);
-    const klp = B.tmp();
     const keyLen = B.tmp();
-    B.line(`${klp} = getelementptr inbounds i8, ptr ${base}, i64 ${this.abiOffset(8, 4)}`);
-    B.line(`${keyLen} = load ${this.S}, ptr ${klp}`);
-    const vp = B.tmp();
     const value = B.tmp();
-    B.line(`${vp} = getelementptr inbounds i8, ptr ${base}, i64 ${this.abiOffset(16, 8)}`);
-    B.line(`${value} = load ptr, ptr ${vp}`);
+    B.line(`${key} = call ptr @scr_dyn_member_key(ptr ${d}, ${this.S} ${i})`);
+    B.line(`${keyLen} = call ${this.S} @scr_dyn_member_key_len(ptr ${d}, ${this.S} ${i})`);
+    B.line(`${value} = call ptr @scr_dyn_member_value(ptr ${d}, ${this.S} ${i})`);
     return { key, keyLen, value };
   }
 
@@ -1155,10 +1153,63 @@ export class LlDyn {
    * Class layouts share their base prefix, so unboxing retains the same
    * pointer and virtual dispatch still uses the object's original vtable. */
   private typedRefMatches(B: BlockBuilder, t: IrType): string {
+    return this.typedRefMatchesAny(
+      B,
+      isDynTypedRefType(t)
+        ? this.host.classSubtypes(t.className).map((className) => ({ kind: "object", className }))
+        : [t],
+    );
+  }
+
+  /** The record shapes whose values a pointer of shape `targetId` may
+   * reference unchanged: their struct begins with exactly the target's
+   * fields (same names, types and representations, so the same offsets),
+   * and everything the target's release, teardown and collector support
+   * would get wrong on them is absent. The extra fields hold no
+   * references (the target's release frees the block without visiting
+   * them; frees are size-class agnostic), neither shape carries a shape
+   * word, a cycle header, an overflow map, key order variants or accessor
+   * slots, and both freeze alike. A record that keeps undeclared source
+   * properties is refused at run time (scr_dyn_typed_ref_prefix_view). */
+  private prefixViewSources(targetId: string): string[] {
+    const memo = this.prefixSources.get(targetId);
+    if (memo) return memo;
+    const host = this.host;
+    const plain = (shape: IrRecordShape): boolean =>
+      !shape.tuple &&
+      !shape.indexValue &&
+      !isDirentShape(shape) &&
+      !shapeHasAccessorSlots(shape) &&
+      shapeKeyOrders(shape).length === 1 &&
+      !shape.fields.some((field) => field.name === KEY_ORDER_FIELD) &&
+      host.nullableUnions.shapeNumber(shape.id) === 0 &&
+      !host.tracedShapes.has(`record:${shape.id}`);
+    const target = host.recordsById.get(targetId);
+    const out: string[] = [];
+    if (target && plain(target) && target.fields.length > 0) {
+      const base = host.nullableUnions.fieldBase(targetId);
+      for (const shape of host.recordsById.values()) {
+        if (shape.id === targetId || shape.fields.length <= target.fields.length) continue;
+        if (!plain(shape) || shape.freezable !== target.freezable) continue;
+        if (host.nullableUnions.fieldBase(shape.id) !== base) continue;
+        const prefix = target.fields.every(
+          (field, i) =>
+            shape.fields[i]!.name === field.name &&
+            typeKey(shape.fields[i]!.type) === typeKey(field.type),
+        );
+        if (!prefix) continue;
+        const extra = rcMembers(shape, host.inlineUnions, base).some(
+          (member) => member.index >= target.fields.length + base && isRefCounted(member.type),
+        );
+        if (!extra) out.push(shape.id);
+      }
+    }
+    this.prefixSources.set(targetId, out);
+    return out;
+  }
+
+  private typedRefMatchesAny(B: BlockBuilder, types: readonly IrType[]): string {
     this.host.declare(`declare zeroext i1 @scr_dyn_typed_ref_is(ptr, ptr, ${this.S})`);
-    const types: IrType[] = isDynTypedRefType(t)
-      ? this.host.classSubtypes(t.className).map((className) => ({ kind: "object", className }))
-      : [t];
     let matched = "false";
     for (const type of types) {
       const key = typeKey(type);
@@ -1441,9 +1492,8 @@ export class LlDyn {
         if (shape.indexValue && shape.indexValue.kind !== "dyn") {
           this.host.declare(`declare i32 @memcmp(ptr, ptr, ${this.S})`);
           const n = this.lenOf(B, "%d");
-          const entries = this.itemsOf(B, "%d");
           this.i64Loop(B, "dm.ov", n, (i, brNext) => {
-            const ent = this.entryAt(B, entries, i);
+            const ent = this.entryAt(B, "%d", i);
             // Skip declared keys.
             for (const f of shape.fields) {
               const klen = Buffer.byteLength(f.name, "utf8");
@@ -2172,6 +2222,32 @@ export class LlDyn {
       B.line(`${ref} = call ptr @scr_dyn_typed_ref_unbox(ptr %d)`);
       B.terminate(`ret ptr ${ref}`);
       B.startBlock(lNext);
+      if (t.kind === "record") {
+        // A record whose storage begins with exactly this type's storage
+        // is this type's value too: the conversion passes the pointer, so
+        // both names keep one object (decision D3).
+        const sources = this.prefixViewSources(t.shapeId);
+        if (sources.length > 0) {
+          const viewed = this.typedRefMatchesAny(
+            B,
+            sources.map((shapeId) => ({ kind: "record", shapeId })),
+          );
+          const lView = B.newLabel("dc.prefix");
+          const lOther = B.newLabel("dc.noprefix");
+          B.condBr(viewed, lView, lOther);
+          B.startBlock(lView);
+          host.declare(`declare ptr @scr_dyn_typed_ref_prefix_view(ptr)`);
+          const view = B.tmp();
+          B.line(`${view} = call ptr @scr_dyn_typed_ref_prefix_view(ptr %d)`);
+          const passed = B.tmp();
+          B.line(`${passed} = icmp ne ptr ${view}, null`);
+          const lPass = B.newLabel("dc.prefix.pass");
+          B.condBr(passed, lPass, lOther);
+          B.startBlock(lPass);
+          B.terminate(`ret ptr ${view}`);
+          B.startBlock(lOther);
+        }
+      }
       // A constructor-function stream (scr_dyn_builtin_stream.c) carries
       // its runtime stream.
       const streamKind = t.kind === "object" ? builtinStreamKind(t.className) : null;
@@ -2777,9 +2853,8 @@ export class LlDyn {
             B.line(`store i8 ${np}, ptr ${flagsp}`);
           }
           const n = this.lenOf(B, "%d");
-          const entries = this.itemsOf(B, "%d");
           this.i64Loop(B, "dcv", n, (i, brNext) => {
-            const ent = this.entryAt(B, entries, i);
+            const ent = this.entryAt(B, "%d", i);
             for (const f of shape.fields) {
               const klen = Buffer.byteLength(f.name, "utf8");
               const lenEq = B.tmp();

packages/compiler/src/backend/llvm/emit-function.ts

@@ -338,6 +338,7 @@ export function emitFunction(emitter: LlEmitter, fn: IrFunction): string {
     }
     emitter.currentCoro = {
       kind: fn.generator !== undefined ? "generator" : "async",
+      awaits: fn.async === true,
       id,
       handle,
       self,
@@ -525,6 +526,7 @@ export function emitFunction(emitter: LlEmitter, fn: IrFunction): string {
     }
   }
   emitter.scopes.push(fnScope);
+  emitter.beginArenaFunction(fn);
   // Stackful native fibers and native coroutine frames retain these frames
   // while suspended. The active exception context owns the chain, so
   // concurrent fibers isolate it.
@@ -862,10 +864,14 @@ export function emitGenScaffolding(emitter: LlEmitter): string[] {
     ];
     const genNew = coroBody && !emitter.wasi ? "scr_gen_new_stackless" : "scr_gen_new";
     if (genNew !== "scr_gen_new") emitter.declare(`declare ptr @${genNew}(ptr, ptr, ptr)`);
+    const asyncGenNew =
+      coroBody && !emitter.wasi ? "scr_async_gen_new_stackless" : "scr_async_gen_new";
+    if (settleAsync !== null && asyncGenNew !== "scr_async_gen_new")
+      emitter.declare(`declare ptr @${asyncGenNew}(ptr, ptr, ptr, ptr)`);
     sp.push(
       settleAsync === null
         ? `  %gg = call ptr @${genNew}(ptr @${mangleTrampoline(fn.name)}, ptr %ap, ptr @${mangleGenDrop(fn.name)})`
-        : `  %gg = call ptr @scr_async_gen_new(ptr @${mangleTrampoline(fn.name)}, ptr %ap, ptr @${mangleGenDrop(fn.name)}, ptr @${settleAsync})`,
+        : `  %gg = call ptr @${asyncGenNew}(ptr @${mangleTrampoline(fn.name)}, ptr %ap, ptr @${mangleGenDrop(fn.name)}, ptr @${settleAsync})`,
       ...(fn.generator.tag !== undefined
         ? [`  call void @scr_gen_set_tag(ptr %gg, ptr ${emitter.cstr(fn.generator.tag)})`]
         : []),

packages/compiler/src/backend/llvm/emit-module.ts

@@ -201,19 +201,22 @@ function readRange(dir: string, range: number): { result: ChunkResult; texts: st
 
 /** The attribute groups of the emitted functions: #0 for every function,
  * #1 for coroutine bodies and #2 for out-of-line record clones. Each carries
- * the build's `--target-cpu` level, and `sanitize_address` in sanitized
- * builds. A group needs one attribute: without either, #0 holds a string
- * attribute that LLVM ignores. Dispatching builds add the x86-64-v3 copies'
- * #3 and #4 (cpu-dispatch.ts). */
+ * the build's `--target-cpu` level, `sanitize_address` in sanitized builds,
+ * and `uwtable` on native targets, so every function has an unwind table
+ * entry, including those LLVM infers `nounwind` (profilers and debuggers
+ * unwind through them). A group needs one attribute: without any, #0 holds a
+ * string attribute that LLVM ignores. Dispatching builds add the x86-64-v3
+ * copies' #3 and #4 (cpu-dispatch.ts). */
 function functionAttributes(emitter: LlEmitter, hasNoInlineRecordClone: boolean): string[] {
   const cpu = targetCpuAttribute(emitter.targetCpu);
   const asan = emitter.sanitizeAttributes ? " sanitize_address" : "";
-  const base = `${asan}${cpu}` || ` "scriptc-function"`;
+  const common = `${asan}${emitter.wasi ? "" : " uwtable"}`;
+  const base = `${common}${cpu}` || ` "scriptc-function"`;
   return [
     `attributes #0 = {${base} }`,
-    ...(emitter.usesCoroutines ? [`attributes #1 = {${asan} presplitcoroutine${cpu} }`] : []),
-    ...(hasNoInlineRecordClone ? [`attributes #2 = { noinline${asan}${cpu} }`] : []),
-    ...(emitter.cpuDispatch ? cpuDispatchAttributes(asan) : []),
+    ...(emitter.usesCoroutines ? [`attributes #1 = {${common} presplitcoroutine${cpu} }`] : []),
+    ...(hasNoInlineRecordClone ? [`attributes #2 = { noinline${common}${cpu} }`] : []),
+    ...(emitter.cpuDispatch ? cpuDispatchAttributes(common) : []),
   ];
 }
 

packages/compiler/src/backend/llvm/emit-statements.ts

@@ -96,7 +96,7 @@ import {
 import { emitStringInputs } from "./string-lifetimes.js";
 import { LOOPS } from "./loop-state.js";
 import { loopUnrollAttachment, periodicGuardPeriod } from "./periodic-guards.js";
-import { loopAccessesTypedArrays } from "../loop-polls.js";
+import { containsLoop, loopAccessesTypedArrays } from "../loop-polls.js";
 import { emitConstantChoice, matchConstantChoice } from "./constant-choices.js";
 
 /** A callback loop version copies the loop; keep the copies small. */
@@ -105,8 +105,11 @@ const MAX_CALLBACK_VERSION_COST = 400;
 export function emitStmtBody(emitter: LlEmitter, s: IrStmt): void {
   const B = emitter.B;
   emitter.frames.push([]);
+  if (emitter.arenas !== null)
+    emitter.statementFrames.add(emitter.frames[emitter.frames.length - 1]!);
   switch (s.kind) {
     case "varDecl": {
+      emitter.ownArenasOf(s.localId);
       if (s.init && emitter.int32Locals.has(s.localId)) {
         emitter.storeInt32Local(s.localId, emitter.emitExpr(s.init), s.init);
         break;
@@ -1228,8 +1231,8 @@ export function emitStmtBody(emitter: LlEmitter, s: IrStmt): void {
       };
       // A counted loop over typed arrays, or a loop to a typed array's
       // length, polls between blocks of WORKER_POLL_BLOCK iterations instead
-      // of counting a budget in its body: the inner loop over a block then
-      // has no exit besides its own bound, which LLVM can vectorize. A typed
+      // of in its body: the inner loop over a block then has no exit
+      // besides its own bound, which LLVM can vectorize. A typed
       // array's length is fixed, so each block can take it as its limit when
       // the loop does not assign the array's binding.
       //
@@ -1670,7 +1673,7 @@ export function emitStmtBody(emitter: LlEmitter, s: IrStmt): void {
         B.line(`call void @scr_async_gen_return_awaits()`);
       }
       if (emitter.currentAsyncGenerator && s.awaited !== true && emitter.finallyStack.length > 0) {
-        if (emitter.wasi) emitter.emitWasiSuspend(null);
+        if (emitter.coroAwait) emitter.emitCoroAwait(null);
         else {
           emitter.declare(`declare void @scr_await_hop()`);
           B.line(`call void @scr_await_hop()`);
@@ -2760,8 +2763,8 @@ interface StripMinedCounter {
  * iterations, with the cancellation poll between blocks: the outer header
  * tests the counter against the loop's limit, each block runs the body up
  * to the nearer of the limit and WORKER_POLL_BLOCK steps on, and the poll
- * follows the block. It polls as often as the budget it replaces, and the
- * inner loop's only exit besides `break` and `return` is its bound.
+ * follows the block. It polls once per block, and the inner loop's only
+ * exit besides `break` and `return` is its bound.
  *
  * With `runSlot` (for a loop that another loop of the function encloses), a
  * block that ends at the limit leaves the loop without polling, and a run
@@ -2895,21 +2898,6 @@ function emitStripMinedCountedLoop(
   B.br(lc);
 }
 
-/** Whether `body` holds a loop outside its closures. */
-function containsLoop(body: IrStmt[]): boolean {
-  const inStmt = (s: IrStmt): boolean =>
-    s.kind === "while" ||
-    s.kind === "doWhile" ||
-    s.kind === "for" ||
-    s.kind === "forOf" ||
-    !everyStmtChild(
-      s,
-      () => true,
-      (child) => !inStmt(child),
-    );
-  return body.some(inStmt);
-}
-
 function enterLoopHeader(emitter: LlEmitter, header: string): void {
   const dispatch = emitter.speculationHeader;
   emitter.speculationHeader = null;

packages/compiler/src/backend/llvm/emitter.test.ts

@@ -206,7 +206,7 @@ test("a target CPU level reaches every function attribute group and nothing else
   const plain = emitLlvmModule(module);
   expect(plain).not.toContain("target-cpu");
   const v3 = emitLlvmModule(module, { targetCpu: "x86-64-v3" });
-  expect(v3).toMatch(/^attributes #0 = \{ sanitize_address "target-cpu"="x86-64-v3" \}$/m);
+  expect(v3).toMatch(/^attributes #0 = \{ sanitize_address uwtable "target-cpu"="x86-64-v3" \}$/m);
   expect(v3.replaceAll(' "target-cpu"="x86-64-v3"', "")).toBe(plain);
   expect(emitLlvmModule(module, { targetCpu: "baseline" })).toBe(plain);
 });
@@ -215,13 +215,21 @@ test("only sanitized builds mark the emitted functions sanitize_address", () =>
   const module = moduleFor([call()]);
   const sanitized = emitLlvmModule(module);
   expect(emitLlvmModule(module, { sanitizeAttributes: true })).toBe(sanitized);
-  expect(sanitized).toMatch(/^attributes #0 = \{ sanitize_address \}$/m);
+  expect(sanitized).toMatch(/^attributes #0 = \{ sanitize_address uwtable \}$/m);
   const plain = emitLlvmModule(module, { sanitizeAttributes: false });
   expect(plain).not.toContain("sanitize_address");
-  // A group needs an attribute: an ignored string attribute stands in.
-  expect(plain).toMatch(/^attributes #0 = \{ "scriptc-function" \}$/m);
+  expect(plain).toMatch(/^attributes #0 = \{ uwtable \}$/m);
   const v3 = emitLlvmModule(module, { sanitizeAttributes: false, targetCpu: "x86-64-v3" });
-  expect(v3).toMatch(/^attributes #0 = \{ "target-cpu"="x86-64-v3" \}$/m);
+  expect(v3).toMatch(/^attributes #0 = \{ uwtable "target-cpu"="x86-64-v3" \}$/m);
+});
+
+test("native functions get unwind tables and wasm32-wasi functions do not", () => {
+  const module = moduleFor([call()]);
+  expect(emitLlvmModule(module)).toMatch(/^attributes #0 = \{ sanitize_address uwtable \}$/m);
+  const wasi = emitLlvmModule(module, { wasi: true, pointerBits: 32, sanitizeAttributes: false });
+  expect(wasi).not.toContain("uwtable");
+  // A group needs an attribute: an ignored string attribute stands in.
+  expect(wasi).toMatch(/^attributes #0 = \{ "scriptc-function" \}$/m);
 });
 
 test("inline RC inlines every fast path at speed and keeps box releases as calls in release", () => {

packages/compiler/src/backend/llvm/emitter.ts

@@ -27,7 +27,7 @@ import {
   streamTypedRefEligible,
   undefinedArmTag,
 } from "../../ir/analysis.js";
-import { loopTestsEveryIteration } from "../loop-polls.js";
+import { containsLoop, loopTestsEveryIteration } from "../loop-polls.js";
 import type {
   IrBytesElem,
   IrExpr,
@@ -343,6 +343,15 @@ import {
   type LlClassMeta,
 } from "./classes.js";
 import { LifetimeRegions, REGION_TYPES } from "./regions.js";
+import {
+  arenaAware,
+  arenaCurrentAddress,
+  arenaNewSym,
+  arenasRequested,
+  planArenas,
+  type ArenaPlan,
+} from "./arenas.js";
+import { children, type Node } from "./region-ir.js";
 import { LlDyn, recordDynKeepsIdentity, type DynHost } from "./dyn.js";
 import { VirtualBorrows } from "./virtual-borrows.js";
 import { LlvmUnsupportedError } from "./unsupported.js";
@@ -375,6 +384,7 @@ import {
   retainSym,
   traceArg,
   vAdapters,
+  traceAdapter,
 } from "./shapes.js";
 import type { ExprOf, LibCallExpr, LlStreamTypedRefAdapter, LlValue } from "./expr-context.js";
 import { INLINE_LITERAL_BYTES } from "./string-literal-equality.js";
@@ -421,6 +431,7 @@ import {
   fieldAliasMetadata,
   isStackUnionSource,
 } from "./receivers.js";
+import { findLoopCallees } from "./loop-callees.js";
 
 export { LlvmUnsupportedError } from "./unsupported.js";
 
@@ -465,6 +476,9 @@ export interface LlScopeEntry {
   slot: string;
   type: IrType;
   boxed?: boolean;
+  /** A group arena list slot (arenas.ts), dropped after the scope's other
+   * entries. */
+  arena?: boolean;
   /** A lazily created box: the slot stays null on paths that build no
    * environment, which skip the release call. */
   lazy?: boolean;
@@ -829,6 +843,11 @@ const NO_BORROWED: ReadonlySet<number> = new Set();
 
 /** The nodes that write a binding by its id (numberGlobalWriters). */
 const GLOBAL_WRITE_KINDS: readonly IrNodeKind[] = ["assign", "varDecl", "assignExpr", "incDec"];
+
+/** workerLoopBudget's answer for a loop that polls on every iteration
+ * instead of counting down in a slot. */
+const POLL_EVERY_ITERATION = "%worker.poll.every";
+
 /** Runtime library calls (readsLoopMetrics). */
 const LIB_CALL_KINDS: readonly IrNodeKind[] = ["libCall"];
 
@@ -843,16 +862,23 @@ function isIdentifierByte(code: number): boolean {
 }
 
 /** Runtime entry points (and await-call entries) that may park the running
- * execution context, as they appear in emitted function text. */
+ * execution context, as they appear in emitted function text. An async
+ * generator's next, return and throw only queue a request and run its body
+ * to its next suspension, which returns to the caller, and the body's own
+ * bookkeeping calls do not suspend it. */
 export const SUSPENDS =
-  /@(?:scr_(?:await_|module_await\b|promise_await_settled\b|test_sub\b|gen_yield_|async_gen_|fiber_)|sc_a[wd]_)/;
+  /@(?:scr_(?:await_|module_await\b|promise_await_settled\b|test_sub\b|gen_yield_|async_gen_(?!new\b|next_|return_|throw\b|hop_done\b)|fiber_)|sc_a[wd]_)/;
 /** The suspensions of a fiber body's own awaits, which its stackless
  * coroutine form suspends itself at instead. */
-const AWAIT_SUSPENSIONS = /@(?:scr_await_(?:void|f64|bool|str|ref|hop)\b|sc_a[wd]_[A-Za-z0-9_]+)/g;
+const AWAIT_SUSPENSIONS =
+  /@(?:scr_await_(?:void|f64|bool|str|ref|hop|dyn_value)\b|sc_a[wd]_[A-Za-z0-9_]+)/g;
+/** The suspensions of a fiber generator body's own yields, which its
+ * coroutine form also suspends itself at. */
+const YIELD_SUSPENSIONS = /@scr_(?:gen_yield_(?:f64|bool|ref))\b/g;
 /** SUSPENDS in a stackless coroutine body, whose frame bookkeeping reads its
  * own fiber and promise. */
 const COROUTINE_SUSPENDS =
-  /@(?:scr_(?:await_|module_await\b|promise_await_settled\b|test_sub\b|gen_yield_|async_gen_|fiber_(?!self\b|promise\b))|sc_a[wd]_)/;
+  /@(?:scr_(?:await_|module_await\b|promise_await_settled\b|test_sub\b|gen_yield_|async_gen_(?!new\b|next_|return_|throw\b|hop_done\b)|fiber_(?!self\b|promise\b))|sc_a[wd]_)/;
 /** Captured bindings (boxes a body declares or receives) from which a
  * function compiles without LLVM optimization (see boxSlotCount). */
 export const UNOPTIMIZED_BOX_SLOTS = 512;
@@ -1274,11 +1300,13 @@ export class LlEmitter {
    * generator stacks) and so do debug builds (the debugger reads locals
    * from the native frame). */
   private stacklessGenerators = false;
-  /** Async bodies that suspend only at their own awaits compile to the same
-   * switched coroutines on native targets (selectStacklessAsync), under the
-   * generators' conditions; library and Windows builds keep fibers. */
+  /** Async bodies that suspend only at their own awaits (and an async
+   * generator's yields) compile to the same switched coroutines on native
+   * targets (selectStacklessAsync), under the generators' conditions;
+   * library and Windows builds keep fibers. */
   private stacklessAsyncAllowed = false;
-  /** The async functions selectStacklessAsync lowered as coroutines. */
+  /** The async functions and async generators selectStacklessAsync lowered
+   * as coroutines. */
   readonly stacklessAsync = new Set<string>();
   /** Some function in the module is lowered as a coroutine. */
   usesCoroutines = false;
@@ -1488,6 +1516,9 @@ export class LlEmitter {
   /** Functions that check the native stack guard on entry
    * (stackCheckedFunctions); null where the runtime has no guard. */
   readonly stackChecks: ReadonlySet<string> | null;
+  /** Small leaf functions called only from loops, whose direct calls are
+   * `alwaysinline` (loop-callees.ts). */
+  readonly loopCallees: ReadonlySet<string>;
   /** Static types whose values can be published (@scriptc/threads): their
    * stores carry the frozen-object guard. Null without publish calls. */
   readonly publishedTypes: PublishedTypes | null;
@@ -1674,6 +1705,8 @@ export class LlEmitter {
    * commit back into their objects. Library builds keep their commits:
    * their values cross a native boundary. */
   readonly liveViewsReadOnly: boolean;
+  /** IrModule.sloppyDynWrites: untyped writes in sloppy-mode code. */
+  readonly sloppyDynWrites: ReadonlySet<string>;
   /** IrModule.foreignElementKeys: element keys whose arrays can hold
    * SCR_ARR_FOREIGN elements. */
   readonly foreignElementKeys: ReadonlySet<string>;
@@ -1902,9 +1935,12 @@ export class LlEmitter {
   currentUnionResult = false;
   /** Active only while emitting a body lowered with LLVM's
    * switched-coroutine intrinsics (wasm32 async bodies and generators,
-   * native synchronous generators; see coroLowered). */
+   * native synchronous generators, and the native async bodies
+   * selectStacklessAsync chose; see coroLowered). */
   currentCoro: {
     kind: "async" | "generator";
+    /** The body awaits: an async function or an async generator. */
+    awaits: boolean;
     id: string;
     handle: string;
     self: string;
@@ -1982,6 +2018,7 @@ export class LlEmitter {
           );
     this.constantNumericTables = findConstantNumericTables(mod);
     this.untypedIntegrity = mod.untypedIntegrity === true;
+    this.sloppyDynWrites = new Set(mod.sloppyDynWrites ?? []);
     this.liveViewsReadOnly =
       mod.lib === undefined &&
       !this.untypedIntegrity &&
@@ -2076,6 +2113,7 @@ export class LlEmitter {
         : new Set();
     this.workerEntryPolls = mt.workerEntryPolls ?? null;
     this.stackChecks = mt.stackChecks ?? null;
+    this.loopCallees = findLoopCallees(mod);
     // A stackless call's eager prefix borrows its caller's stack; the
     // runtime moves deep prefix nests to a fresh stack using the guard,
     // which Windows lacks.
@@ -2325,6 +2363,39 @@ export class LlEmitter {
       programLifetime: this.programLifetime,
       regionAliasTag: (word) => this.memoryAliasAttachment(`region.${word}`),
     };
+    // An instance of a class that extends Array is an array: a slot of its
+    // element array type can hold it, and the collector visits it there as
+    // an array, which has a collector header when its element ops trace
+    // (scr_arr_make_ops_kind). Such a class carries a header too, and so
+    // does the rest of its hierarchy. A class whose elements are instances
+    // of another such class follows that class, so repeat until no class
+    // adds one.
+    const arrayClasses = (mod.classes ?? []).filter((c) => c.arrayElem !== undefined);
+    if (arrayClasses.length > 0) {
+      const baseOf = new Map((mod.classes ?? []).map((c) => [c.name, c.base] as const));
+      const rootOf = (name: string): string => {
+        let root = name;
+        for (
+          let base = baseOf.get(root);
+          base !== undefined && baseOf.has(base);
+          base = baseOf.get(root)
+        )
+          root = base;
+        return root;
+      };
+      for (let changed = true; changed;) {
+        changed = false;
+        for (const cls of arrayClasses) {
+          if (this.tracedShapes.has(`object:${cls.name}`)) continue;
+          if (traceAdapter(this.shapeHost, { kind: "array", elem: cls.arrayElem! }) === null)
+            continue;
+          const root = rootOf(cls.name);
+          for (const member of mod.classes ?? [])
+            if (rootOf(member.name) === root) this.tracedShapes.add(`object:${member.name}`);
+          changed = true;
+        }
+      }
+    }
     this.walkers = new LlWalkers(this.shapeHost);
     this.dyn = new LlDyn(this.shapeHost);
     for (const g of mod.globals ?? []) {
@@ -2412,6 +2483,40 @@ export class LlEmitter {
       mod.lib === undefined &&
       options.lowRegion === true &&
       [...this.classMeta.values()].some((m) => m.compact);
+    // Group arenas: off with lifetime regions, which own their classes'
+    // allocation, and in libraries, whose exports any host code calls.
+    if (arenasRequested() && mod.lifetimeRegions !== true && mod.lib === undefined) {
+      this.arenas = planArenas(mod, {
+        shape: (id) => {
+          const shape = this.recordsById.get(id);
+          return (
+            shape !== undefined &&
+            shape.freezable !== true &&
+            shape.indexValue === undefined &&
+            this.publishedTypes?.recordGuarded(id) !== true
+          );
+        },
+        cls: (def) => {
+          const meta = this.classMeta.get(def.name);
+          return (
+            meta !== undefined &&
+            !meta.compact &&
+            !meta.threadSlot &&
+            // An Array subclass's instance is an array (the runtime's header).
+            def.arrayElem === undefined &&
+            meta.root.def.arrayElem === undefined &&
+            !this.programLifetime.has(def.name) &&
+            this.publishedTypes?.classGuarded(def.name) !== true
+          );
+        },
+        nullableArm: (unionId) => this.nullableUnions.single(unionId)?.arm ?? null,
+        traced: (t) => traceAdapter(this.shapeHost, t) !== null,
+      });
+      if (this.arenas !== null) {
+        this.shapeHost.arenaShapes = this.arenas.shapes;
+        this.shapeHost.arenaClasses = this.arenas.classes;
+      }
+    }
     for (const [name, rec] of RUNTIME_ERROR_CLASSES) {
       const meta = this.classMeta.get(name);
       if (!meta) break; // hand-written IR without the builtin defs: no stamps
@@ -2713,19 +2818,21 @@ export class LlEmitter {
     }
   }
 
-  /** Chooses the native async functions whose bodies compile to switched
-   * coroutines instead of running on a fiber: a suspended call then keeps a
-   * heap frame of the values live across its awaits rather than a fiber and
-   * its stack. A body qualifies when its only suspension points are its own
-   * awaits, which the coroutine form suspends itself at (emitCoroAwait), so
-   * nothing it runs can park the stack it borrows. It is first emitted as
-   * usual: that text may suspend only through await runtime calls and
-   * await-call entries, which the coroutine form replaces, and may call no
-   * function that parks. The coroutine form is then emitted and must pass
-   * the same test with no exceptions (its frame bookkeeping excepted);
-   * otherwise the fiber form stays. Bodies that never suspend stay
-   * fiberless, and module evaluation bodies and `dyn` results keep fibers
-   * as they do there. The runtime traps if a stackless body ever parks. */
+  /** Chooses the native async functions and async generators whose bodies
+   * compile to switched coroutines instead of running on a fiber: a
+   * suspended call then keeps a heap frame of the values live across its
+   * awaits and yields rather than a fiber and its stack. A body qualifies
+   * when its only suspension points are its own awaits and yields, which
+   * the coroutine form suspends itself at (emitCoroAwait,
+   * emitCoroSuspendPrepared), so nothing it runs can park the stack it
+   * borrows. It is first emitted as usual: that text may suspend only
+   * through await and yield runtime calls and await-call entries, which the
+   * coroutine form replaces, and may call no function that parks. The
+   * coroutine form is then emitted and must pass the same test with no
+   * exceptions (its frame bookkeeping excepted); otherwise the fiber form
+   * stays. Bodies that never suspend stay fiberless, and module evaluation
+   * bodies and async functions with `dyn` results keep fibers as they do
+   * there. The runtime traps if a stackless body ever parks. */
   selectStacklessAsync(fnDefs: string[]): void {
     if (!this.stacklessAsyncAllowed) return;
     const parks = this.parkingFunctions();
@@ -2740,11 +2847,16 @@ export class LlEmitter {
       return true;
     };
     this.mod.functions.forEach((fn, index) => {
-      if (fn.async !== true || fn.generator !== undefined) return;
+      if (fn.async !== true) return;
       if (fn.asyncCacheGlobal !== undefined || fn.asyncCycleCacheGlobal !== undefined) return;
-      if (fn.returnType.kind === "dyn" || !parks.has(fn.name)) return;
-      const fiberText = fnDefs[index]!;
-      if (!qualifies(fn, fiberText.replace(AWAIT_SUSPENSIONS, ""), SUSPENDS)) return;
+      // A dyn result may adopt a thenable when it settles the promise; an
+      // async generator's completion value settles its request's record.
+      if (fn.generator === undefined && fn.returnType.kind === "dyn") return;
+      if (!parks.has(fn.name)) return;
+      // An async generator's body also suspends at its own yields.
+      let fiberText = fnDefs[index]!.replace(AWAIT_SUSPENSIONS, "");
+      if (fn.generator !== undefined) fiberText = fiberText.replace(YIELD_SUSPENSIONS, "");
+      if (!qualifies(fn, fiberText, SUSPENDS)) return;
       this.stacklessAsync.add(fn.name);
       const coroText = this.emitFunction(fn);
       if (!qualifies(fn, coroText, COROUTINE_SUSPENDS)) {
@@ -3157,7 +3269,7 @@ export class LlEmitter {
    * native async bodies selectStacklessAsync chose. */
   coroLowered(fn: IrFunction): boolean {
     if (this.wasi) return fn.async === true || fn.generator !== undefined;
-    if (fn.async === true) return fn.generator === undefined && this.stacklessAsync.has(fn.name);
+    if (fn.async === true) return this.stacklessAsync.has(fn.name);
     return this.stacklessGenerators && fn.generator !== undefined;
   }
   emitGenScaffolding(): string[] {
@@ -3527,6 +3639,7 @@ export class LlEmitter {
   /** Releases a statement frame's temps and owned slots. */
   releaseTemps(frame: LlValue[]): void {
     for (const v of frame) {
+      if (v.arena !== undefined) continue;
       if (v.slot) {
         const t = this.B.tmp();
         this.B.line(`${t} = load ptr, ptr ${v.name}`);
@@ -3539,10 +3652,19 @@ export class LlEmitter {
         this.releaseFrame(v.name, v.type);
       }
     }
+    // Arena lists last: the frame's temps may be arena objects.
+    for (const v of frame)
+      if (v.arena === "drop") this.B.line(`call void @scr_arena_drop(ptr ${v.name})`);
+      else if (v.arena === "close") {
+        const head = this.B.tmp();
+        this.B.line(`${head} = load ptr, ptr ${v.name}`);
+        this.B.line(`call void @scr_arena_close(ptr ${head})`);
+      }
   }
 
   releaseScope(scope: LlScopeEntry[]): void {
     for (const e of scope) {
+      if (e.arena === true) continue;
       const t = this.B.tmp();
       this.B.line(`${t} = load ptr, ptr ${e.slot}`);
       if (e.boxed && e.lazy) {
@@ -3564,6 +3686,9 @@ export class LlEmitter {
         this.releaseFrame(t, e.type); // runtime releases are NULL-tolerant
       }
     }
+    // Arena lists last: the scope's bindings may hold arena objects.
+    for (const e of scope)
+      if (e.arena === true) this.B.line(`call void @scr_arena_drop(ptr ${e.slot})`);
   }
 
   /** THE release-on-jump path (break/continue/return): pending statement
@@ -3888,6 +4013,15 @@ export class LlEmitter {
    * calls (unwindAbiFunctions excludes their callees). */
   emitDirectCall(line: string, callee: string): boolean {
     const B = this.B;
+    // A small leaf called only from loops inlines into each of them, past
+    // LLVM's cost threshold (loop-callees.ts). Debug builds keep the call.
+    if (this.debug === null && this.loopCallees.has(callee)) {
+      const comment = line.indexOf(" ; ");
+      line =
+        comment < 0
+          ? `${line} alwaysinline`
+          : `${line.slice(0, comment)} alwaysinline${line.slice(comment)}`;
+    }
     if (!this.unwindAbi.has(callee) || this.currentCoro !== null || B.isTerminated()) {
       B.line(line);
       return false;
@@ -4018,10 +4152,22 @@ export class LlEmitter {
     );
   }
 
+  /** The countdown slot of `loop`'s cancellation poll (emitWorkerLoopCheck),
+   * or null when the loop does not poll. An ELF worker executable's poll is
+   * one ordered load of the thread's own pending word. A loop nest keeps
+   * one countdown per loop, which its register pressure often leaves in
+   * memory, so the loops of a nest there poll on every iteration and get
+   * POLL_EVERY_ITERATION instead of a slot. A loop on its own keeps its
+   * countdown in a register, which costs less than the load. */
   workerLoopBudget(
     loop: Extract<IrStmt, { kind: "while" | "doWhile" | "for" | "forOf" }>,
   ): string | null {
     if (!this.workerLoopPolls(loop)) return null;
+    if (
+      this.executableTls &&
+      (this.jumpTargets.some((target) => target.kind === "loop") || containsLoop(loop.body))
+    )
+      return POLL_EVERY_ITERATION;
     const slot = this.B.slot();
     this.B.entryAllocas.push(`${slot} = alloca i32 ; worker cancellation budget`);
     this.B.line(`store i32 0, ptr ${slot}`);
@@ -4126,6 +4272,10 @@ export class LlEmitter {
    * stay in the loop. */
   emitWorkerLoopCheck(slot: string | null): void {
     if (slot === null) return;
+    if (slot === POLL_EVERY_ITERATION) {
+      this.emitWorkerPoll();
+      return;
+    }
     const B = this.B;
     const budget = B.tmp(),
       due = B.tmp(),
@@ -4145,9 +4295,9 @@ export class LlEmitter {
   }
 
   /** The cancellation poll itself. Calls and throwing operations retain
-   * their own checks. Loops amortize this extra poll across bounded
-   * batches of iterations so scalar work does not cross the runtime ABI on
-   * every iteration. */
+   * their own checks. Outside ELF worker executables, loops amortize this
+   * extra poll across bounded batches of iterations so scalar work does not
+   * cross the runtime ABI on every iteration. */
   emitWorkerPoll(): void {
     this.emitPendingCheck(undefined, true);
   }
@@ -5212,7 +5362,7 @@ export class LlEmitter {
   /** Awaits in the current body suspend its coroutine: every wasm32 async
    * body, and native stackless async bodies (selectStacklessAsync). */
   get coroAwait(): boolean {
-    return this.wasi || this.currentCoro?.kind === "async";
+    return this.wasi || this.currentCoro?.awaits === true;
   }
 
   /** Suspends the current coroutine body at an await of `promise` (null: a
@@ -5251,7 +5401,7 @@ export class LlEmitter {
    * coroutine has already suspended until the promise settled, so its
    * extraction takes no further turn. */
   awaitResultFn(kind: "void" | "f64" | "bool" | "str" | "ref"): string {
-    return !this.wasi && this.currentCoro?.kind === "async"
+    return !this.wasi && this.currentCoro?.awaits === true
       ? `scr_coro_await_${kind}`
       : `scr_await_${kind}`;
   }
@@ -6319,6 +6469,7 @@ export class LlEmitter {
         type: local.type,
         slot: true,
         ...(local.boxed ? { boxed: true } : {}),
+        ...(local.arena === true ? { arena: "drop" as const } : {}),
       });
     }
     return result;
@@ -7413,9 +7564,196 @@ export class LlEmitter {
   }
 
   emitExpr(e: IrExpr): LlValue {
+    return this.arenas === null ? emitExpr(this, e) : this.emitArenaExpr(e, this.arenas);
+  }
+
+  /** emitExpr when group arenas are planned. Kept out of emitExpr, whose
+   * frame each level of a nested expression holds while it is emitted. */
+  private emitArenaExpr(e: IrExpr, arenas: ArenaPlan): LlValue {
+    if (arenas.groups.calls.has(e)) {
+      // A call region: everything the call allocates dies when it returns.
+      // The statement drops the arena after its temps, which an
+      // arena-aware caller can have allocated in it while evaluating the
+      // arguments; any other caller drops it as soon as the call returns.
+      const slot = this.arenaSlot(e);
+      this.statementFrame().push({ name: slot, type: e.type, slot: true, arena: "drop" });
+      this.B.line(`call ptr @scr_arena_open(ptr ${slot}, i32 ${this.arenaClosed(e)})`);
+      const value = emitExpr(this, e);
+      if (!arenaAware(arenas, this.fnByName.get(this.currentFunctionName)))
+        this.B.line(`call void @scr_arena_drop(ptr ${slot})`);
+      return value;
+    }
+    if (arenas.sites.heapCalls.has(e) && this.arenaSite(null)) {
+      // A call whose value the group does not keep: everything it allocates
+      // takes the heap.
+      const saved = this.suspendArena();
+      const value = emitExpr(this, e);
+      this.resumeArena(saved);
+      return value;
+    }
+    if (this.opensArena(e)) {
+      // A root: its group lives until the scope holding its value exits
+      // (the statement frame for a value used in place).
+      const slot = this.arenaSlot(e);
+      const local = arenas.groups.drops.get(e) ?? null;
+      this.statementFrame().push({
+        name: slot,
+        type: e.type,
+        slot: true,
+        arena: local === null ? "drop" : "close",
+      });
+      const arena = this.B.tmp();
+      this.B.line(`${arena} = call ptr @scr_arena_open(ptr ${slot}, i32 ${this.arenaClosed(e)})`);
+      const value = emitExpr(this, e);
+      this.B.line(`call void @scr_arena_close(ptr ${arena})`);
+      return value;
+    }
     return emitExpr(this, e);
   }
 
+  /** Group arenas (arenas.ts): the plan, the list slot of each root and
+   * call region, and which locals' scopes drop which roots' arenas. */
+  arenas: ArenaPlan | null = null;
+  private arenaSlots = new Map<Node, string>();
+  /** The frames emitStmtBody opens for whole statements (arenas only). */
+  readonly statementFrames = new Set<LlValue[]>();
+
+  /** The frame of the statement being emitted: a nested frame (call
+   * arguments, branches) ends before the values built in it do. */
+  statementFrame(): LlValue[] {
+    for (let i = this.frames.length - 1; i >= 0; i--)
+      if (this.statementFrames.has(this.frames[i]!)) return this.frames[i]!;
+    return this.currentFrame();
+  }
+
+  /** The arena list slot of root or call region `e`: allocated, cleared and
+   * (for a root dropped with a local) owned by that local's scope when the
+   * function starts or the local is declared. */
+  arenaSlot(e: Node): string {
+    let slot = this.arenaSlots.get(e);
+    if (slot === undefined) {
+      slot = this.B.tmp();
+      this.B.entryAllocas.push(`${slot} = alloca ptr`, `store ptr null, ptr ${slot}`);
+      this.arenaSlots.set(e, slot);
+      this.declare(`declare ptr @scr_arena_open(ptr, i32)`);
+      this.declare(`declare void @scr_arena_close(ptr)`);
+      this.declare(`declare void @scr_arena_drop(ptr)`);
+    }
+    return slot;
+  }
+
+  /** Whether emitExpr opens an arena for `e`: a root call or `new` of a
+   * counted value. */
+  opensArena(e: Node): e is Extract<IrExpr, { kind: "call" | "new" }> {
+    return (
+      this.arenas !== null &&
+      this.arenas.groups.roots.has(e) &&
+      (e.kind === "call" || e.kind === "new") &&
+      isRefCounted(e.type)
+    );
+  }
+
+  /** 1 when the group of root or call region `e` is closed: its objects
+   * hold only each other and immortal values. */
+  arenaClosed(e: Node): number {
+    return this.arenas?.groups.closed.has(e) === true ? 1 : 0;
+  }
+
+  /** Registers on the innermost scope the arena lists of the roots whose
+   * arenas `localId`'s scope drops. */
+  ownArenasOf(localId: string): void {
+    const roots = this.arenaDropsByLocal.get(localId);
+    if (roots === undefined) return;
+    const scope = this.scopes[this.scopes.length - 1]!;
+    for (const { root, type } of roots)
+      scope.push({ slot: this.arenaSlot(root), type, arena: true });
+  }
+
+  /** The roots of the function being emitted, by the local that drops
+   * them; set when a function's emission starts. */
+  arenaDropsByLocal = new Map<string, { root: Node; type: IrType }[]>();
+
+  /** Starts a function's arena bookkeeping: its roots by dropping local,
+   * with the lists of locals the body never declares (parameters, loop
+   * and catch bindings) owned by the function's own scope. */
+  beginArenaFunction(fn: IrFunction): void {
+    this.arenaSlots.clear();
+    this.statementFrames.clear();
+    this.arenaDropsByLocal = new Map();
+    const arenas = this.arenas;
+    if (arenas === null) return;
+    const declared = new Set<string>();
+    const visit = (node: Node): void => {
+      if (node.kind === "varDecl") declared.add(node.localId);
+      if (this.opensArena(node)) {
+        const local = arenas.groups.drops.get(node);
+        if (local !== undefined && local !== null) {
+          const list = this.arenaDropsByLocal.get(local) ?? [];
+          list.push({ root: node, type: node.type });
+          this.arenaDropsByLocal.set(local, list);
+        }
+      }
+      const kids: Node[] = [];
+      children(node, kids);
+      for (const kid of kids) visit(kid);
+    };
+    for (const s of fn.body) visit(s);
+    for (const local of [...this.arenaDropsByLocal.keys()])
+      if (!declared.has(local)) this.ownArenasOf(local);
+  }
+
+  /** Whether allocation site `e` (null: any) in the function being
+   * emitted takes the open arena: the function is arena-aware and the group
+   * keeps the site's value (region-sites.ts). */
+  arenaSite(e: IrExpr | null): boolean {
+    const arenas = this.arenas;
+    if (!arenaAware(arenas, this.fnByName.get(this.currentFunctionName))) return false;
+    return e === null || arenas!.sites.arenaSites.has(e);
+  }
+
+  /** Stops any arena being the allocation target; returns what restores it. */
+  suspendArena(): string {
+    const saved = this.B.tmp();
+    const cur = this.B.tmp();
+    const lines = arenaCurrentAddress(this.shapeHost, cur);
+    if (lines === null) {
+      this.declare(`declare ptr @scr_arena_suspend()`);
+      this.B.line(`${saved} = call ptr @scr_arena_suspend()`);
+    } else {
+      for (const line of lines) this.B.line(line);
+      this.B.line(`${saved} = load ptr, ptr ${cur}`);
+      this.B.line(`store ptr null, ptr ${cur}`);
+    }
+    return saved;
+  }
+
+  /** Makes the arena suspendArena stopped (`saved`) the target again. */
+  resumeArena(saved: string): void {
+    const cur = this.B.tmp();
+    const lines = arenaCurrentAddress(this.shapeHost, cur);
+    if (lines === null) {
+      this.declare(`declare void @scr_arena_resume(ptr)`);
+      this.B.line(`call void @scr_arena_resume(ptr ${saved})`);
+    } else {
+      for (const line of lines) this.B.line(line);
+      this.B.line(`store ptr ${saved}, ptr ${cur}`);
+    }
+  }
+
+  /** The arena-aware constructor of `newSym` for an allocation of a
+   * record shape or class in the function being emitted, or `newSym`. */
+  allocSym(newSym: string, e: IrExpr): string {
+    const arenas = this.arenas;
+    if (arenas === null) return newSym;
+    const planned =
+      e.type.kind === "record"
+        ? arenas.shapes.has(e.type.shapeId)
+        : e.kind === "new" && arenas.classes.has(e.className);
+    if (!planned) return newSym;
+    const aware = this.arenaSite(e) || arenas.groups.roots.has(e);
+    return aware ? arenaNewSym(newSym) : newSym;
+  }
+
   /** The helper classification of this module's inline-cache sites. */
   get jsIcSites(): JsIcSites {
     return (this.jsIcSitesMemo ??= new JsIcSites(this.mod));

packages/compiler/src/backend/llvm/expr-calls.ts

@@ -1104,7 +1104,7 @@ export function emitCallExpr(
           `llvm emitter bug: new ${e.className} without a constructor`,
         );
       const o = B.tmp();
-      B.line(`${o} = call ptr @${mangleClassNew(e.className)}()`);
+      B.line(`${o} = call ptr @${host.allocSym(mangleClassNew(e.className), e)}()`);
       const out = host.own({ name: o, type: e.type });
       emitConstruction(host, e, o, ctor);
       return out;

packages/compiler/src/backend/llvm/expr-containers.ts

@@ -62,12 +62,14 @@ import {
 import { exactInteger, widenInteger } from "./integer-values.js";
 import {
   emitDenseArrayNumber,
+  emitDenseArrayNumberInt32,
   emitDenseArrayPop,
   emitDenseArrayPush,
   runtimeAccess,
   type ArrayAccess,
 } from "./dense-array-access.js";
 import { INT32_ARRAY_METHODS } from "../../ir/int32-arrays.js";
+import { INT32_RANGE } from "../../ir/integer-ranges.js";
 import { emitUnionWiden } from "./expr-records.js";
 import { registerReplay } from "./emit-journal.js";
 
@@ -694,6 +696,25 @@ export function emitArrIntrinsic(
         )!;
         return { name: value, type: e.type };
       }
+      // In a store statement of an int32 kind loop's fast copy, a read that
+      // is not an int32 (a missing element's NaN) leaves for the
+      // statement's resume point, so the element is at hand as an i32.
+      if (!table && elem.kind === "f64" && access === "i32" && host.int32KindResume !== null) {
+        const read = emitDenseArrayNumberInt32(
+          host,
+          r.name,
+          index,
+          e.args[0],
+          host.provenDenseIndex(e.receiver, e.args[0]!),
+          host.int32KindResume,
+        );
+        return {
+          name: read.value,
+          type: e.type,
+          uint32: read.int32,
+          integer: { name: read.int32, type: "i32", signed: true, range: INT32_RANGE },
+        };
+      }
       if (!table && elem.kind === "f64")
         return {
           name: emitDenseArrayNumber(

packages/compiler/src/backend/llvm/expr-context.ts

@@ -33,6 +33,9 @@ export interface LlValue {
   slot?: boolean;
   /** A sequence local held in a capture box; release the box itself. */
   boxed?: boolean;
+  /** A group arena list slot (arenas.ts): the frame closes the newest
+   * arena on it, or drops the whole list, after its other temps. */
+  arena?: "close" | "drop";
 }
 
 export interface WideInteger {

packages/compiler/src/backend/llvm/expr-control.ts

@@ -11,6 +11,10 @@ import { emitRecordKeyGetOr } from "./expr-records.js";
 import { NULLABLE_NULL, SHAPE_WORD_INDEX, shapeWordHeader } from "./nullable-unions.js";
 import { emitUnionTag } from "./union-repr.js";
 
+/** Each kind emits in a function of its own: emitting a nested chain of
+ * these expressions holds one emitControlExpr frame per level, and in an
+ * unoptimized build of the compiler a frame holds every local of the
+ * function. */
 export function emitControlExpr(
   host: LlvmEmitterContext,
   e: ExprOf<
@@ -25,446 +29,25 @@ export function emitControlExpr(
     | "nullish"
   >,
 ): LlValue {
-  const B = host.B;
   switch (e.kind) {
-    case "dynDestrCheck": {
-      // RequireObjectCoercible with V8's destructuring TypeError. dyn
-      // values check in the runtime helper and pass through unchanged.
-      const v = host.emitExpr(e.value);
-      const first = e.firstProp !== undefined ? host.cstr(e.firstProp) : "null";
-
-      const helper = host.dyn.dynDestrCheckHelper();
-      B.line(`call void @${helper}(ptr ${v.name}, ptr ${host.cstr(e.spelling)}, ptr ${first})`);
-      host.emitPendingCheck();
-      return v;
-    }
-    case "dynIterN": {
-      // GetIterator + first-N steps as a fresh array (V8's exact
-      // not-iterable TypeError on non-iterables) through the native dyn helper.
-      const v = emitBorrowedInput(host, e.value);
-
-      const helper = host.dyn.dynIterNHelper();
-      const t = B.tmp();
-      B.line(
-        `${t} = call ptr @${helper}(ptr ${v.name}, ${host.sizeType} ${e.count}, ptr ${e.notIterableMessage ? host.cstr(e.notIterableMessage) : "null"})`,
-      );
-      const out = host.own({ name: t, type: e.type });
-      host.emitPendingCheck();
-      return out;
-    }
+    case "dynDestrCheck":
+      return emitDynDestrCheck(host, e);
+    case "dynIterN":
+      return emitDynIterN(host, e);
     case "toBool":
       return { name: host.truthy(host.emitUnionProjection(e.operand)), type: e.type };
-    case "logical": {
-      const tagSet = e.op === "||" ? unionTagSet(e) : null;
-      if (tagSet) return { name: emitUnionTagSet(host, tagSet), type: e.type };
-      // JS value semantics: the result is the deciding operand itself.
-      // Left evaluates once, ownership moves into the result slot; when
-      // the branch takes the right operand the stale left releases first
-      // and the right runs in its own frame.
-      const ty = host.llType(e.type);
-      const l = host.emitExpr(e.left);
-      host.toFrame(l);
-      const slot = B.slot();
-      B.entryAllocas.push(`${slot} = alloca ${ty}`);
-      B.line(`store ${ty} ${l.name}, ptr ${slot}`);
-      const integerSlot = e.type.kind === "f64" && l.uint32 !== undefined ? B.slot() : undefined;
-      if (integerSlot !== undefined) {
-        B.entryAllocas.push(`${integerSlot} = alloca i32`);
-        B.line(`store i32 ${l.uint32!}, ptr ${integerSlot}`);
-      }
-      const truthy = host.truthy(l);
-      const rightLabel = B.newLabel("log.r");
-      const joinLabel = B.newLabel("log.j");
-      if (e.op === "&&") B.condBr(truthy, rightLabel, joinLabel);
-      else B.condBr(truthy, joinLabel, rightLabel);
-      B.startBlock(rightLabel);
-      if (isRefCounted(e.type)) host.releaseFrame(l.name, e.type);
-      const rightInteger = host.emitBranchInto(slot, e.right, integerSlot);
-      B.br(joinLabel);
-      B.startBlock(joinLabel);
-      const t = B.tmp();
-      B.line(`${t} = load ${ty}, ptr ${slot}`);
-      if (integerSlot !== undefined && rightInteger) {
-        const uint32 = B.tmp();
-        B.line(`${uint32} = load i32, ptr ${integerSlot}`);
-        return { name: t, type: e.type, uint32 };
-      }
-      return host.own({ name: t, type: e.type });
-    }
-    case "ternary": {
-      // Exactly one arm evaluates; each arm runs in its own frame and
-      // moves the chosen value into the result slot.
-      const ty = host.llType(e.type);
-      const c = host.emitExpr(e.cond);
-      const slot = B.slot();
-      B.entryAllocas.push(`${slot} = alloca ${ty}`);
-      const integerSlot = e.type.kind === "f64" ? B.slot() : undefined;
-      if (integerSlot !== undefined) B.entryAllocas.push(`${integerSlot} = alloca i32`);
-      const lt = B.newLabel("tern.t");
-      const lf = B.newLabel("tern.f");
-      const lj = B.newLabel("tern.j");
-      B.condBr(c.name, lt, lf);
-      B.startBlock(lt);
-      const thenInteger = host.emitBranchInto(slot, e.then, integerSlot);
-      B.br(lj);
-      B.startBlock(lf);
-      const elseInteger = host.emitBranchInto(slot, e.else_, integerSlot);
-      B.br(lj);
-      B.startBlock(lj);
-      const t = B.tmp();
-      B.line(`${t} = load ${ty}, ptr ${slot}`);
-      // A view is available only when every incoming branch wrote it.
-      // Incomplete views are unused and disappear during promotion.
-      if (integerSlot !== undefined && thenInteger && elseInteger) {
-        const uint32 = B.tmp();
-        B.line(`${uint32} = load i32, ptr ${integerSlot}`);
-        return { name: t, type: e.type, uint32 };
-      }
-      // A choice between interned literals is an interned literal: like a
-      // strLit operand, nothing owns it (retain and release are no-ops).
-      if (literalChoice(e)) return host.markImmortal({ name: t, type: e.type });
-      return host.own({ name: t, type: e.type });
-    }
-    case "optChain": {
-      // `a?.b` / `f?.()`: the nullish test inverted. The receiver
-      // evaluates once into an ordinary frame temp (borrowed); on a unit
-      // tag the result is the interned undefined arm and the body never
-      // runs; otherwise the narrowed payload fills the bind slot (+1,
-      // frame-owned through a SLOT entry — NULL on the unit path, where
-      // the frame's release is a no-op) and the body reads it through
-      // chainRecv.
-      if (e.receiver.type.kind === "dyn") {
-        // A dyn (dyn) receiver — the `rawName?.match(re)` step: the
-        // nullish test reads the node's kind tag; the unit path is the
-        // undefined dyn singleton (dyn results) or nothing (void
-        // bodies), the body runs over the bound receiver otherwise.
-        const r = host.emitExpr(e.receiver);
-        const kd = host.dynKind(r.name);
-        const isU = B.tmp();
-        const isN = B.tmp();
-        const isUnit = B.tmp();
-        B.line(`${isU} = icmp eq i32 ${kd}, ${DYN_KIND.UNDEF}`);
-        B.line(`${isN} = icmp eq i32 ${kd}, ${DYN_KIND.NULL}`);
-        B.line(`${isUnit} = or i1 ${isU}, ${isN}`);
-        const bind = B.slot();
-        B.entryAllocas.push(`${bind} = alloca ptr`);
-        B.line(`store ptr null, ptr ${bind}`);
-        host.ownSlot(bind, e.receiver.type);
-        host.declare(`declare ptr @scr_dyn_retain_v(ptr)`);
-        if (e.type.kind === "void") {
-          const lb = B.newLabel("ocd.b");
-          const lj = B.newLabel("ocd.j");
-          B.condBr(isUnit, lj, lb);
-          B.startBlock(lb);
-          const rr = B.tmp();
-          B.line(`${rr} = call ptr @scr_dyn_retain_v(ptr ${r.name})`);
-          B.line(`store ptr ${rr}, ptr ${bind}`);
-          host.chainSlots.set(e.id, { name: bind, type: e.receiver.type, slot: true });
-          host.frames.push([]);
-          host.emitExpr(e.body);
-          host.releaseTemps(host.frames.pop()!);
-          host.chainSlots.delete(e.id);
-          B.br(lj);
-          B.startBlock(lj);
-          return { name: "", type: e.type };
-        }
-        if (e.type.kind !== "dyn")
-          throw new InternalCompilerError("llvm emitter bug: dyn optChain result kind");
-        const slot = B.slot();
-        B.entryAllocas.push(`${slot} = alloca ptr`);
-        const lu = B.newLabel("ocd.u");
-        const lb = B.newLabel("ocd.b");
-        const lj = B.newLabel("ocd.j");
-        B.condBr(isUnit, lu, lb);
-        B.startBlock(lu);
-        host.declare(`declare ptr @scr_dyn_undefined()`);
-        const un = B.tmp();
-        const ur = B.tmp();
-        B.line(`${un} = call ptr @scr_dyn_undefined()`);
-        B.line(`${ur} = call ptr @scr_dyn_retain_v(ptr ${un})`);
-        B.line(`store ptr ${ur}, ptr ${slot}`);
-        B.br(lj);
-        B.startBlock(lb);
-        const rr = B.tmp();
-        B.line(`${rr} = call ptr @scr_dyn_retain_v(ptr ${r.name})`);
-        B.line(`store ptr ${rr}, ptr ${bind}`);
-        host.chainSlots.set(e.id, { name: bind, type: e.receiver.type, slot: true });
-        host.emitBranchInto(slot, e.body);
-        host.chainSlots.delete(e.id);
-        B.br(lj);
-        B.startBlock(lj);
-        const t = B.tmp();
-        B.line(`${t} = load ptr, ptr ${slot}`);
-        return host.own({ name: t, type: e.type });
-      }
-
-      const { isUnit, bindPresent } = emitOptionalChainReceiver(host, e);
-      if (e.type.kind === "void") {
-        // Statement form (cb?.()): no result value at all.
-        const lb = B.newLabel("oc.b");
-        const lj = B.newLabel("oc.j");
-        B.condBr(isUnit, lj, lb);
-        B.startBlock(lb);
-        bindPresent();
-        host.frames.push([]);
-        host.emitExpr(e.body);
-        host.releaseTemps(host.frames.pop()!);
-        host.chainSlots.delete(e.id);
-        B.br(lj);
-        B.startBlock(lj);
-        return { name: "", type: e.type };
-      }
-      if (e.type.kind === "dyn") {
-        // A dyn-typed chain (`pricing?.[key]` over an unknown-valued
-        // index signature): the unit path is the undefined dyn value —
-        // dyn represents undefined directly, no union wrapper exists.
-        const slotD = B.slot();
-        B.entryAllocas.push(`${slotD} = alloca ptr`);
-        const lu = B.newLabel("ocu.u");
-        const lb = B.newLabel("ocu.b");
-        const lj = B.newLabel("ocu.j");
-        B.condBr(isUnit, lu, lb);
-        B.startBlock(lu);
-        host.declare(`declare ptr @scr_dyn_undefined()`);
-        host.declare(`declare ptr @scr_dyn_retain_v(ptr)`);
-        const un = B.tmp();
-        const ur = B.tmp();
-        B.line(`${un} = call ptr @scr_dyn_undefined()`);
-        B.line(`${ur} = call ptr @scr_dyn_retain_v(ptr ${un})`);
-        B.line(`store ptr ${ur}, ptr ${slotD}`);
-        B.br(lj);
-        B.startBlock(lb);
-        bindPresent();
-        host.emitBranchInto(slotD, e.body);
-        host.chainSlots.delete(e.id);
-        B.br(lj);
-        B.startBlock(lj);
-        const t = B.tmp();
-        B.line(`${t} = load ptr, ptr ${slotD}`);
-        return host.own({ name: t, type: e.type });
-      }
-      if (e.type.kind !== "union")
-        throw new LlvmUnsupportedError(`optChainResult:${e.type.kind}`, e.loc);
-      const undefTag = undefinedArmTag(e.type, host.unionsById);
-      if (undefTag < 0)
-        throw new InternalCompilerError(
-          "llvm emitter bug: optChain result lacks its undefined arm",
-        );
-      const ty = host.llType(e.type);
-      const slot = B.slot();
-      B.entryAllocas.push(`${slot} = alloca ${ty}`);
-      const lu = B.newLabel("oc.u");
-      const lb = B.newLabel("oc.b");
-      const lj = B.newLabel("oc.j");
-      B.condBr(isUnit, lu, lb);
-      B.startBlock(lu);
-      B.line(`store ptr ${host.unitInstanceRef(e.type.unionId, undefTag)}, ptr ${slot}`);
-      B.br(lj);
-      B.startBlock(lb);
-      bindPresent();
-      host.emitBranchInto(slot, e.body);
-      host.chainSlots.delete(e.id);
-      B.br(lj);
-      B.startBlock(lj);
-      const t = B.tmp();
-      B.line(`${t} = load ${ty}, ptr ${slot}`);
-      return host.own({ name: t, type: e.type });
-    }
-    case "chainRecv": {
-      const bound = host.chainSlots.get(e.id);
-      if (!bound)
-        throw new InternalCompilerError(`llvm emitter bug: chainRecv "${e.id}" outside its chain`);
-      const v = B.tmp();
-      B.line(`${v} = load ${host.llType(bound.type)}, ptr ${bound.name}`);
-      if (!isRefCounted(e.type)) return { name: v, type: e.type };
-      return host.own({ name: host.retainFrame(v, e.type), type: e.type });
-    }
-    case "orDefault": {
-      // `u || d` narrowed to the single non-unit arm: nullish's dance
-      // with the union TRUTHY switch as the test — truthy extracts the
-      // arm (+1 for ref kinds), falsy releases and runs the default.
-      if (e.left.type.kind !== "union")
-        throw new InternalCompilerError("llvm emitter bug: orDefault left is not a union");
-      if (
-        e.retag === undefined &&
-        !host.nullableUnions.has(e.left.type.unionId) &&
-        host.isStackUnionSource(e.left)
-      ) {
-        // A stack box (`arr[i] || d`): test truthiness and extract the
-        // payload (+1). The box is never retained or released.
-        const l = host.emitUnionProjection(e.left);
-        const ty = host.llType(e.type);
-        const slot = B.slot();
-        B.entryAllocas.push(`${slot} = alloca ${ty}`);
-        const lt = B.newLabel("ord.t"),
-          lf = B.newLabel("ord.f"),
-          lj = B.newLabel("ord.j");
-        B.condBr(host.truthy(l), lt, lf);
-        B.startBlock(lt);
-        B.line(
-          `store ${ty} ${host.unionExtract(l.name, e.left.type.unionId, e.type)}, ptr ${slot}`,
-        );
-        B.br(lj);
-        B.startBlock(lf);
-        host.emitBranchInto(slot, e.right);
-        B.br(lj);
-        B.startBlock(lj);
-        const t = B.tmp();
-        B.line(`${t} = load ${ty}, ptr ${slot}`);
-        return host.own({ name: t, type: e.type });
-      }
-      const l = host.emitExpr(e.left);
-      host.toFrame(l);
-      const ty = host.llType(e.type);
-      const slot = B.slot();
-      B.entryAllocas.push(`${slot} = alloca ${ty}`);
-      const truthy = host.truthy(l);
-      const lt = B.newLabel("ord.t");
-      const lf = B.newLabel("ord.f");
-      const lj = B.newLabel("ord.j");
-      B.condBr(truthy, lt, lf);
-      B.startBlock(lt);
-      if (e.retag !== undefined) {
-        // Retagged shape: the whole box goes to the union→union helper,
-        // which CONSUMES it (callees own their params) — no release on
-        // this side. The store precedes the pending check so an unwind
-        // leaves only the NULL dummy behind, in a slot nothing reads.
-        const t = B.tmp();
-        B.line(
-          `${t} = call ${ty} @${host.callTarget(e.retag)}(${host.llType(e.left.type)} ${l.name})`,
-        );
-        B.line(`store ${ty} ${t}, ptr ${slot}`);
-        if (host.mayThrow.has(e.retag)) host.emitPendingCheck();
-      } else if (host.nullableUnions.single(e.left.type.unionId)) {
-        // The owned nullable pointer IS the owned arm value.
-        B.line(`store ${ty} ${l.name}, ptr ${slot}`);
-      } else {
-        B.line(
-          `store ${ty} ${host.unionExtract(l.name, e.left.type.unionId, e.type)}, ptr ${slot}`,
-        );
-        host.releaseFrame(l.name, e.left.type);
-      }
-      B.br(lj);
-      B.startBlock(lf);
-      host.releaseFrame(l.name, e.left.type);
-      host.emitBranchInto(slot, e.right);
-      B.br(lj);
-      B.startBlock(lj);
-      const t = B.tmp();
-      B.line(`${t} = load ${ty}, ptr ${slot}`);
-      return host.own({ name: t, type: e.type });
-    }
-    case "nullish": {
-      // `a ?? b`: logical's move/release dance with the left's runtime
-      // TAG against its unit arms as the test. Pass-through shape: the
-      // result IS the left box. Narrowed shape: the single non-unit
-      // arm's payload extracts (+1 for ref kinds) and the box releases.
-
-      if (e.left.type.kind === "dyn") {
-        // The native checked-value kind decides whether the left is
-        // nullish; the right runs lazily in its branch.
-        const l = host.emitExpr(e.left);
-        host.toFrame(l);
-        host.declare(`declare zeroext i1 @scr_dyn_is_nullish(ptr)`);
-        const slot = B.slot();
-        B.entryAllocas.push(`${slot} = alloca ptr`);
-        const isN = B.tmp();
-        B.line(`${isN} = call zeroext i1 @scr_dyn_is_nullish(ptr ${l.name})`);
-        const lu = B.newLabel("nuld.u");
-        const lv = B.newLabel("nuld.v");
-        const lj = B.newLabel("nuld.j");
-        B.condBr(isN, lu, lv);
-        B.startBlock(lu);
-        host.releaseFrame(l.name, e.left.type);
-        host.emitBranchInto(slot, e.right);
-        B.br(lj);
-        B.startBlock(lv);
-        B.line(`store ptr ${l.name}, ptr ${slot}`);
-        B.br(lj);
-        B.startBlock(lj);
-        const t = B.tmp();
-        B.line(`${t} = load ptr, ptr ${slot}`);
-        return host.own({ name: t, type: e.type });
-      }
-      if (e.left.type.kind !== "union")
-        throw new InternalCompilerError("llvm emitter bug: nullish left is not a union");
-      const def = host.unionsById.get(e.left.type.unionId);
-      if (!def)
-        throw new InternalCompilerError(
-          `llvm emitter bug: nullish of unknown union ${e.left.type.unionId}`,
-        );
-      const unitTags = def.arms.flatMap((a, i) => (isUnitType(a) ? [i] : []));
-      if (unitTags.length === 0)
-        throw new InternalCompilerError("llvm emitter bug: nullish union lacks unit arms");
-      const fused = emitNullishOptionalChain(host, e);
-      if (fused) return fused;
-      if (
-        e.left.kind === "recordKeyGet" &&
-        e.left.missNaN !== true &&
-        typeEquals(e.type, e.left.type) &&
-        storesNoUnit(host, e.left)
-      )
-        return emitRecordKeyGetOr(host, e.left, e.right);
-      if (
-        !typeEquals(e.type, e.left.type) &&
-        (e.left.kind === "varRef" ||
-          host.isStackUnionSource(e.left) ||
-          host.nullableFieldGet(e.left) !== null)
-      ) {
-        // Narrowed shape over a binding or a stack box (`arr[i] ?? d`,
-        // `map.get(k) ?? d`): test the tag and extract the payload (+1).
-        // The box is never retained or released. A binding is borrowed:
-        // no code runs between its read and the extraction, and the
-        // default never touches it. Bindings proven projection-only may
-        // hold stack boxes, which must never reach RC entry points.
-        const l = host.emitUnionProjection(e.left);
-        const ty = host.llType(e.type);
-        const slot = B.slot();
-        B.entryAllocas.push(`${slot} = alloca ${ty}`);
-        const isUnit = host.tagInSet(l.name, def.id, unitTags);
-        const lu = B.newLabel("nul.u");
-        const lv = B.newLabel("nul.v");
-        const lj = B.newLabel("nul.j");
-        B.condBr(isUnit, lu, lv);
-        B.startBlock(lu);
-        host.emitBranchInto(slot, e.right);
-        B.br(lj);
-        B.startBlock(lv);
-        B.line(`store ${ty} ${host.unionExtract(l.name, def.id, e.type)}, ptr ${slot}`);
-        B.br(lj);
-        B.startBlock(lj);
-        const t = B.tmp();
-        B.line(`${t} = load ${ty}, ptr ${slot}`);
-        return host.own({ name: t, type: e.type });
-      }
-      const l = host.emitExpr(e.left);
-      host.toFrame(l);
-      const ty = host.llType(e.type);
-      const slot = B.slot();
-      B.entryAllocas.push(`${slot} = alloca ${ty}`);
-      const isUnit = host.tagInSet(l.name, def.id, unitTags);
-      const lu = B.newLabel("nul.u");
-      const lv = B.newLabel("nul.v");
-      const lj = B.newLabel("nul.j");
-      B.condBr(isUnit, lu, lv);
-      B.startBlock(lu);
-      host.releaseFrame(l.name, e.left.type);
-      host.emitBranchInto(slot, e.right);
-      B.br(lj);
-      B.startBlock(lv);
-      if (typeEquals(e.type, e.left.type) || host.nullableUnions.single(def.id)) {
-        // Pass-through, or a nullable pointer that IS its owned arm value.
-        B.line(`store ${ty} ${l.name}, ptr ${slot}`);
-      } else {
-        B.line(`store ${ty} ${host.unionExtract(l.name, def.id, e.type)}, ptr ${slot}`);
-        host.releaseFrame(l.name, e.left.type);
-      }
-      B.br(lj);
-      B.startBlock(lj);
-      const t = B.tmp();
-      B.line(`${t} = load ${ty}, ptr ${slot}`);
-      return host.own({ name: t, type: e.type });
-    }
+    case "logical":
+      return emitLogical(host, e);
+    case "ternary":
+      return emitTernary(host, e);
+    case "optChain":
+      return emitOptChain(host, e);
+    case "chainRecv":
+      return emitChainRecv(host, e);
+    case "orDefault":
+      return emitOrDefault(host, e);
+    case "nullish":
+      return emitNullish(host, e);
     default: {
       const _exhaustive: never = e;
       void _exhaustive;
@@ -473,6 +56,450 @@ export function emitControlExpr(
   }
 }
 
+function emitDynDestrCheck(host: LlvmEmitterContext, e: ExprOf<"dynDestrCheck">): LlValue {
+  const B = host.B;
+  // RequireObjectCoercible with V8's destructuring TypeError. dyn
+  // values check in the runtime helper and pass through unchanged.
+  const v = host.emitExpr(e.value);
+  const first = e.firstProp !== undefined ? host.cstr(e.firstProp) : "null";
+
+  const helper = host.dyn.dynDestrCheckHelper();
+  B.line(`call void @${helper}(ptr ${v.name}, ptr ${host.cstr(e.spelling)}, ptr ${first})`);
+  host.emitPendingCheck();
+  return v;
+}
+
+function emitDynIterN(host: LlvmEmitterContext, e: ExprOf<"dynIterN">): LlValue {
+  const B = host.B;
+  // GetIterator + first-N steps as a fresh array (V8's exact
+  // not-iterable TypeError on non-iterables) through the native dyn helper.
+  const v = emitBorrowedInput(host, e.value);
+
+  const helper = host.dyn.dynIterNHelper();
+  const t = B.tmp();
+  B.line(
+    `${t} = call ptr @${helper}(ptr ${v.name}, ${host.sizeType} ${e.count}, ptr ${e.notIterableMessage ? host.cstr(e.notIterableMessage) : "null"})`,
+  );
+  const out = host.own({ name: t, type: e.type });
+  host.emitPendingCheck();
+  return out;
+}
+
+function emitLogical(host: LlvmEmitterContext, e: ExprOf<"logical">): LlValue {
+  const B = host.B;
+  const tagSet = e.op === "||" ? unionTagSet(e) : null;
+  if (tagSet) return { name: emitUnionTagSet(host, tagSet), type: e.type };
+  // JS value semantics: the result is the deciding operand itself.
+  // Left evaluates once, ownership moves into the result slot; when
+  // the branch takes the right operand the stale left releases first
+  // and the right runs in its own frame.
+  const ty = host.llType(e.type);
+  const l = host.emitExpr(e.left);
+  host.toFrame(l);
+  const slot = B.slot();
+  B.entryAllocas.push(`${slot} = alloca ${ty}`);
+  B.line(`store ${ty} ${l.name}, ptr ${slot}`);
+  const integerSlot = e.type.kind === "f64" && l.uint32 !== undefined ? B.slot() : undefined;
+  if (integerSlot !== undefined) {
+    B.entryAllocas.push(`${integerSlot} = alloca i32`);
+    B.line(`store i32 ${l.uint32!}, ptr ${integerSlot}`);
+  }
+  const truthy = host.truthy(l);
+  const rightLabel = B.newLabel("log.r");
+  const joinLabel = B.newLabel("log.j");
+  if (e.op === "&&") B.condBr(truthy, rightLabel, joinLabel);
+  else B.condBr(truthy, joinLabel, rightLabel);
+  B.startBlock(rightLabel);
+  if (isRefCounted(e.type)) host.releaseFrame(l.name, e.type);
+  const rightInteger = host.emitBranchInto(slot, e.right, integerSlot);
+  B.br(joinLabel);
+  B.startBlock(joinLabel);
+  const t = B.tmp();
+  B.line(`${t} = load ${ty}, ptr ${slot}`);
+  if (integerSlot !== undefined && rightInteger) {
+    const uint32 = B.tmp();
+    B.line(`${uint32} = load i32, ptr ${integerSlot}`);
+    return { name: t, type: e.type, uint32 };
+  }
+  return host.own({ name: t, type: e.type });
+}
+
+function emitTernary(host: LlvmEmitterContext, e: ExprOf<"ternary">): LlValue {
+  const B = host.B;
+  // Exactly one arm evaluates; each arm runs in its own frame and
+  // moves the chosen value into the result slot.
+  const ty = host.llType(e.type);
+  const c = host.emitExpr(e.cond);
+  const slot = B.slot();
+  B.entryAllocas.push(`${slot} = alloca ${ty}`);
+  const integerSlot = e.type.kind === "f64" ? B.slot() : undefined;
+  if (integerSlot !== undefined) B.entryAllocas.push(`${integerSlot} = alloca i32`);
+  const lt = B.newLabel("tern.t");
+  const lf = B.newLabel("tern.f");
+  const lj = B.newLabel("tern.j");
+  B.condBr(c.name, lt, lf);
+  B.startBlock(lt);
+  const thenInteger = host.emitBranchInto(slot, e.then, integerSlot);
+  B.br(lj);
+  B.startBlock(lf);
+  const elseInteger = host.emitBranchInto(slot, e.else_, integerSlot);
+  B.br(lj);
+  B.startBlock(lj);
+  const t = B.tmp();
+  B.line(`${t} = load ${ty}, ptr ${slot}`);
+  // A view is available only when every incoming branch wrote it.
+  // Incomplete views are unused and disappear during promotion.
+  if (integerSlot !== undefined && thenInteger && elseInteger) {
+    const uint32 = B.tmp();
+    B.line(`${uint32} = load i32, ptr ${integerSlot}`);
+    return { name: t, type: e.type, uint32 };
+  }
+  // A choice between interned literals is an interned literal: like a
+  // strLit operand, nothing owns it (retain and release are no-ops).
+  if (literalChoice(e)) return host.markImmortal({ name: t, type: e.type });
+  return host.own({ name: t, type: e.type });
+}
+
+function emitOptChain(host: LlvmEmitterContext, e: ExprOf<"optChain">): LlValue {
+  const B = host.B;
+  // `a?.b` / `f?.()`: the nullish test inverted. The receiver
+  // evaluates once into an ordinary frame temp (borrowed); on a unit
+  // tag the result is the interned undefined arm and the body never
+  // runs; otherwise the narrowed payload fills the bind slot (+1,
+  // frame-owned through a SLOT entry — NULL on the unit path, where
+  // the frame's release is a no-op) and the body reads it through
+  // chainRecv.
+  if (e.receiver.type.kind === "dyn") {
+    // A dyn (dyn) receiver — the `rawName?.match(re)` step: the
+    // nullish test reads the node's kind tag; the unit path is the
+    // undefined dyn singleton (dyn results) or nothing (void
+    // bodies), the body runs over the bound receiver otherwise.
+    const r = host.emitExpr(e.receiver);
+    const kd = host.dynKind(r.name);
+    const isU = B.tmp();
+    const isN = B.tmp();
+    const isUnit = B.tmp();
+    B.line(`${isU} = icmp eq i32 ${kd}, ${DYN_KIND.UNDEF}`);
+    B.line(`${isN} = icmp eq i32 ${kd}, ${DYN_KIND.NULL}`);
+    B.line(`${isUnit} = or i1 ${isU}, ${isN}`);
+    const bind = B.slot();
+    B.entryAllocas.push(`${bind} = alloca ptr`);
+    B.line(`store ptr null, ptr ${bind}`);
+    host.ownSlot(bind, e.receiver.type);
+    host.declare(`declare ptr @scr_dyn_retain_v(ptr)`);
+    if (e.type.kind === "void") {
+      const lb = B.newLabel("ocd.b");
+      const lj = B.newLabel("ocd.j");
+      B.condBr(isUnit, lj, lb);
+      B.startBlock(lb);
+      const rr = B.tmp();
+      B.line(`${rr} = call ptr @scr_dyn_retain_v(ptr ${r.name})`);
+      B.line(`store ptr ${rr}, ptr ${bind}`);
+      host.chainSlots.set(e.id, { name: bind, type: e.receiver.type, slot: true });
+      host.frames.push([]);
+      host.emitExpr(e.body);
+      host.releaseTemps(host.frames.pop()!);
+      host.chainSlots.delete(e.id);
+      B.br(lj);
+      B.startBlock(lj);
+      return { name: "", type: e.type };
+    }
+    if (e.type.kind !== "dyn")
+      throw new InternalCompilerError("llvm emitter bug: dyn optChain result kind");
+    const slot = B.slot();
+    B.entryAllocas.push(`${slot} = alloca ptr`);
+    const lu = B.newLabel("ocd.u");
+    const lb = B.newLabel("ocd.b");
+    const lj = B.newLabel("ocd.j");
+    B.condBr(isUnit, lu, lb);
+    B.startBlock(lu);
+    host.declare(`declare ptr @scr_dyn_undefined()`);
+    const un = B.tmp();
+    const ur = B.tmp();
+    B.line(`${un} = call ptr @scr_dyn_undefined()`);
+    B.line(`${ur} = call ptr @scr_dyn_retain_v(ptr ${un})`);
+    B.line(`store ptr ${ur}, ptr ${slot}`);
+    B.br(lj);
+    B.startBlock(lb);
+    const rr = B.tmp();
+    B.line(`${rr} = call ptr @scr_dyn_retain_v(ptr ${r.name})`);
+    B.line(`store ptr ${rr}, ptr ${bind}`);
+    host.chainSlots.set(e.id, { name: bind, type: e.receiver.type, slot: true });
+    host.emitBranchInto(slot, e.body);
+    host.chainSlots.delete(e.id);
+    B.br(lj);
+    B.startBlock(lj);
+    const t = B.tmp();
+    B.line(`${t} = load ptr, ptr ${slot}`);
+    return host.own({ name: t, type: e.type });
+  }
+
+  const { isUnit, bindPresent } = emitOptionalChainReceiver(host, e);
+  if (e.type.kind === "void") {
+    // Statement form (cb?.()): no result value at all.
+    const lb = B.newLabel("oc.b");
+    const lj = B.newLabel("oc.j");
+    B.condBr(isUnit, lj, lb);
+    B.startBlock(lb);
+    bindPresent();
+    host.frames.push([]);
+    host.emitExpr(e.body);
+    host.releaseTemps(host.frames.pop()!);
+    host.chainSlots.delete(e.id);
+    B.br(lj);
+    B.startBlock(lj);
+    return { name: "", type: e.type };
+  }
+  if (e.type.kind === "dyn") {
+    // A dyn-typed chain (`pricing?.[key]` over an unknown-valued
+    // index signature): the unit path is the undefined dyn value —
+    // dyn represents undefined directly, no union wrapper exists.
+    const slotD = B.slot();
+    B.entryAllocas.push(`${slotD} = alloca ptr`);
+    const lu = B.newLabel("ocu.u");
+    const lb = B.newLabel("ocu.b");
+    const lj = B.newLabel("ocu.j");
+    B.condBr(isUnit, lu, lb);
+    B.startBlock(lu);
+    host.declare(`declare ptr @scr_dyn_undefined()`);
+    host.declare(`declare ptr @scr_dyn_retain_v(ptr)`);
+    const un = B.tmp();
+    const ur = B.tmp();
+    B.line(`${un} = call ptr @scr_dyn_undefined()`);
+    B.line(`${ur} = call ptr @scr_dyn_retain_v(ptr ${un})`);
+    B.line(`store ptr ${ur}, ptr ${slotD}`);
+    B.br(lj);
+    B.startBlock(lb);
+    bindPresent();
+    host.emitBranchInto(slotD, e.body);
+    host.chainSlots.delete(e.id);
+    B.br(lj);
+    B.startBlock(lj);
+    const t = B.tmp();
+    B.line(`${t} = load ptr, ptr ${slotD}`);
+    return host.own({ name: t, type: e.type });
+  }
+  if (e.type.kind !== "union")
+    throw new LlvmUnsupportedError(`optChainResult:${e.type.kind}`, e.loc);
+  const undefTag = undefinedArmTag(e.type, host.unionsById);
+  if (undefTag < 0)
+    throw new InternalCompilerError("llvm emitter bug: optChain result lacks its undefined arm");
+  const ty = host.llType(e.type);
+  const slot = B.slot();
+  B.entryAllocas.push(`${slot} = alloca ${ty}`);
+  const lu = B.newLabel("oc.u");
+  const lb = B.newLabel("oc.b");
+  const lj = B.newLabel("oc.j");
+  B.condBr(isUnit, lu, lb);
+  B.startBlock(lu);
+  B.line(`store ptr ${host.unitInstanceRef(e.type.unionId, undefTag)}, ptr ${slot}`);
+  B.br(lj);
+  B.startBlock(lb);
+  bindPresent();
+  host.emitBranchInto(slot, e.body);
+  host.chainSlots.delete(e.id);
+  B.br(lj);
+  B.startBlock(lj);
+  const t = B.tmp();
+  B.line(`${t} = load ${ty}, ptr ${slot}`);
+  return host.own({ name: t, type: e.type });
+}
+
+function emitChainRecv(host: LlvmEmitterContext, e: ExprOf<"chainRecv">): LlValue {
+  const B = host.B;
+  const bound = host.chainSlots.get(e.id);
+  if (!bound)
+    throw new InternalCompilerError(`llvm emitter bug: chainRecv "${e.id}" outside its chain`);
+  const v = B.tmp();
+  B.line(`${v} = load ${host.llType(bound.type)}, ptr ${bound.name}`);
+  if (!isRefCounted(e.type)) return { name: v, type: e.type };
+  return host.own({ name: host.retainFrame(v, e.type), type: e.type });
+}
+
+function emitOrDefault(host: LlvmEmitterContext, e: ExprOf<"orDefault">): LlValue {
+  const B = host.B;
+  // `u || d` narrowed to the single non-unit arm: nullish's dance
+  // with the union TRUTHY switch as the test — truthy extracts the
+  // arm (+1 for ref kinds), falsy releases and runs the default.
+  if (e.left.type.kind !== "union")
+    throw new InternalCompilerError("llvm emitter bug: orDefault left is not a union");
+  if (
+    e.retag === undefined &&
+    !host.nullableUnions.has(e.left.type.unionId) &&
+    host.isStackUnionSource(e.left)
+  ) {
+    // A stack box (`arr[i] || d`): test truthiness and extract the
+    // payload (+1). The box is never retained or released.
+    const l = host.emitUnionProjection(e.left);
+    const ty = host.llType(e.type);
+    const slot = B.slot();
+    B.entryAllocas.push(`${slot} = alloca ${ty}`);
+    const lt = B.newLabel("ord.t"),
+      lf = B.newLabel("ord.f"),
+      lj = B.newLabel("ord.j");
+    B.condBr(host.truthy(l), lt, lf);
+    B.startBlock(lt);
+    B.line(`store ${ty} ${host.unionExtract(l.name, e.left.type.unionId, e.type)}, ptr ${slot}`);
+    B.br(lj);
+    B.startBlock(lf);
+    host.emitBranchInto(slot, e.right);
+    B.br(lj);
+    B.startBlock(lj);
+    const t = B.tmp();
+    B.line(`${t} = load ${ty}, ptr ${slot}`);
+    return host.own({ name: t, type: e.type });
+  }
+  const l = host.emitExpr(e.left);
+  host.toFrame(l);
+  const ty = host.llType(e.type);
+  const slot = B.slot();
+  B.entryAllocas.push(`${slot} = alloca ${ty}`);
+  const truthy = host.truthy(l);
+  const lt = B.newLabel("ord.t");
+  const lf = B.newLabel("ord.f");
+  const lj = B.newLabel("ord.j");
+  B.condBr(truthy, lt, lf);
+  B.startBlock(lt);
+  if (e.retag !== undefined) {
+    // Retagged shape: the whole box goes to the union→union helper,
+    // which CONSUMES it (callees own their params) — no release on
+    // this side. The store precedes the pending check so an unwind
+    // leaves only the NULL dummy behind, in a slot nothing reads.
+    const t = B.tmp();
+    B.line(`${t} = call ${ty} @${host.callTarget(e.retag)}(${host.llType(e.left.type)} ${l.name})`);
+    B.line(`store ${ty} ${t}, ptr ${slot}`);
+    if (host.mayThrow.has(e.retag)) host.emitPendingCheck();
+  } else if (host.nullableUnions.single(e.left.type.unionId)) {
+    // The owned nullable pointer IS the owned arm value.
+    B.line(`store ${ty} ${l.name}, ptr ${slot}`);
+  } else {
+    B.line(`store ${ty} ${host.unionExtract(l.name, e.left.type.unionId, e.type)}, ptr ${slot}`);
+    host.releaseFrame(l.name, e.left.type);
+  }
+  B.br(lj);
+  B.startBlock(lf);
+  host.releaseFrame(l.name, e.left.type);
+  host.emitBranchInto(slot, e.right);
+  B.br(lj);
+  B.startBlock(lj);
+  const t = B.tmp();
+  B.line(`${t} = load ${ty}, ptr ${slot}`);
+  return host.own({ name: t, type: e.type });
+}
+
+function emitNullish(host: LlvmEmitterContext, e: ExprOf<"nullish">): LlValue {
+  const B = host.B;
+  // `a ?? b`: logical's move/release dance with the left's runtime
+  // TAG against its unit arms as the test. Pass-through shape: the
+  // result IS the left box. Narrowed shape: the single non-unit
+  // arm's payload extracts (+1 for ref kinds) and the box releases.
+
+  if (e.left.type.kind === "dyn") {
+    // The native checked-value kind decides whether the left is
+    // nullish; the right runs lazily in its branch.
+    const l = host.emitExpr(e.left);
+    host.toFrame(l);
+    host.declare(`declare zeroext i1 @scr_dyn_is_nullish(ptr)`);
+    const slot = B.slot();
+    B.entryAllocas.push(`${slot} = alloca ptr`);
+    const isN = B.tmp();
+    B.line(`${isN} = call zeroext i1 @scr_dyn_is_nullish(ptr ${l.name})`);
+    const lu = B.newLabel("nuld.u");
+    const lv = B.newLabel("nuld.v");
+    const lj = B.newLabel("nuld.j");
+    B.condBr(isN, lu, lv);
+    B.startBlock(lu);
+    host.releaseFrame(l.name, e.left.type);
+    host.emitBranchInto(slot, e.right);
+    B.br(lj);
+    B.startBlock(lv);
+    B.line(`store ptr ${l.name}, ptr ${slot}`);
+    B.br(lj);
+    B.startBlock(lj);
+    const t = B.tmp();
+    B.line(`${t} = load ptr, ptr ${slot}`);
+    return host.own({ name: t, type: e.type });
+  }
+  if (e.left.type.kind !== "union")
+    throw new InternalCompilerError("llvm emitter bug: nullish left is not a union");
+  const def = host.unionsById.get(e.left.type.unionId);
+  if (!def)
+    throw new InternalCompilerError(
+      `llvm emitter bug: nullish of unknown union ${e.left.type.unionId}`,
+    );
+  const unitTags = def.arms.flatMap((a, i) => (isUnitType(a) ? [i] : []));
+  if (unitTags.length === 0)
+    throw new InternalCompilerError("llvm emitter bug: nullish union lacks unit arms");
+  const fused = emitNullishOptionalChain(host, e);
+  if (fused) return fused;
+  if (
+    e.left.kind === "recordKeyGet" &&
+    e.left.missNaN !== true &&
+    typeEquals(e.type, e.left.type) &&
+    storesNoUnit(host, e.left)
+  )
+    return emitRecordKeyGetOr(host, e.left, e.right);
+  if (
+    !typeEquals(e.type, e.left.type) &&
+    (e.left.kind === "varRef" ||
+      host.isStackUnionSource(e.left) ||
+      host.nullableFieldGet(e.left) !== null)
+  ) {
+    // Narrowed shape over a binding or a stack box (`arr[i] ?? d`,
+    // `map.get(k) ?? d`): test the tag and extract the payload (+1).
+    // The box is never retained or released. A binding is borrowed:
+    // no code runs between its read and the extraction, and the
+    // default never touches it. Bindings proven projection-only may
+    // hold stack boxes, which must never reach RC entry points.
+    const l = host.emitUnionProjection(e.left);
+    const ty = host.llType(e.type);
+    const slot = B.slot();
+    B.entryAllocas.push(`${slot} = alloca ${ty}`);
+    const isUnit = host.tagInSet(l.name, def.id, unitTags);
+    const lu = B.newLabel("nul.u");
+    const lv = B.newLabel("nul.v");
+    const lj = B.newLabel("nul.j");
+    B.condBr(isUnit, lu, lv);
+    B.startBlock(lu);
+    host.emitBranchInto(slot, e.right);
+    B.br(lj);
+    B.startBlock(lv);
+    B.line(`store ${ty} ${host.unionExtract(l.name, def.id, e.type)}, ptr ${slot}`);
+    B.br(lj);
+    B.startBlock(lj);
+    const t = B.tmp();
+    B.line(`${t} = load ${ty}, ptr ${slot}`);
+    return host.own({ name: t, type: e.type });
+  }
+  const l = host.emitExpr(e.left);
+  host.toFrame(l);
+  const ty = host.llType(e.type);
+  const slot = B.slot();
+  B.entryAllocas.push(`${slot} = alloca ${ty}`);
+  const isUnit = host.tagInSet(l.name, def.id, unitTags);
+  const lu = B.newLabel("nul.u");
+  const lv = B.newLabel("nul.v");
+  const lj = B.newLabel("nul.j");
+  B.condBr(isUnit, lu, lv);
+  B.startBlock(lu);
+  host.releaseFrame(l.name, e.left.type);
+  host.emitBranchInto(slot, e.right);
+  B.br(lj);
+  B.startBlock(lv);
+  if (typeEquals(e.type, e.left.type) || host.nullableUnions.single(def.id)) {
+    // Pass-through, or a nullable pointer that IS its owned arm value.
+    B.line(`store ${ty} ${l.name}, ptr ${slot}`);
+  } else {
+    B.line(`store ${ty} ${host.unionExtract(l.name, def.id, e.type)}, ptr ${slot}`);
+    host.releaseFrame(l.name, e.left.type);
+  }
+  B.br(lj);
+  B.startBlock(lj);
+  const t = B.tmp();
+  B.line(`${t} = load ${ty}, ptr ${slot}`);
+  return host.own({ name: t, type: e.type });
+}
+
 /** The receiver half of a union-receiver `a?.b`. The receiver evaluates
  * once; `isUnit` tests its unit arms, and `bindPresent` fills the chain's
  * bind slot with the narrowed payload for the body to read through

packages/compiler/src/backend/llvm/expr-primitives.ts

@@ -1080,16 +1080,21 @@ export function emitContainerExpr(
           B.line(`${fits} = icmp ule ${host.sizeType} ${capacity}, ${SMALL_ARRAY_SLOTS}`);
           B.condBr(fits, smallLabel, sizedLabel);
           B.startBlock(smallLabel);
-          B.line(`${smallArr} = ${arrNewCall(host.shapeHost, elem, "0", true)}`);
+          B.line(`${smallArr} = ${arrNewCall(host.shapeHost, elem, "0", true, host.arenaSite(e))}`);
           B.br(joined);
           B.startBlock(sizedLabel);
-          B.line(`${sizedArr} = ${arrNewCall(host.shapeHost, elem, capacity)}`);
+          B.line(
+            `${sizedArr} = ${arrNewCall(host.shapeHost, elem, capacity, false, host.arenaSite(e))}`,
+          );
           B.br(joined);
           B.startBlock(joined);
           B.line(
             `${arr} = phi ptr [ ${smallArr}, %${smallLabel} ], [ ${sizedArr}, %${sizedLabel} ]`,
           );
-        } else B.line(`${arr} = ${arrNewCall(host.shapeHost, elem, String(capacity), small)}`);
+        } else
+          B.line(
+            `${arr} = ${arrNewCall(host.shapeHost, elem, String(capacity), small, host.arenaSite(e))}`,
+          );
       }
       const out = host.own({ name: arr, type: e.type });
       const acc: ArrayAccess = int32 ? "i32" : elemAccess(elem);
@@ -1362,7 +1367,7 @@ export function emitRecordExpr(
         throw new InternalCompilerError("llvm emitter bug: recordLit of non-record type");
       const shapeId = e.type.shapeId;
       const rec = B.tmp();
-      B.line(`${rec} = call ptr @${mangleRecordNew(shapeId)}()`);
+      B.line(`${rec} = call ptr @${host.allocSym(mangleRecordNew(shapeId), e)}()`);
       const out = host.own({ name: rec, type: e.type });
       // A null-prototype record: SCR_MAP_NULL_PROTO on the fresh map.
       if (e.nullProto) B.line(`store i8 1, ptr ${host.recordMapFlagsPtr(rec, shapeId)}`);

packages/compiler/src/backend/llvm/expr-stream-bridges.test.ts

@@ -141,7 +141,7 @@ test("live record capsules bind field hooks in snapshot order", () => {
   const llvm = emitLlvmModule(module, { pointerBits: 64 });
   const tables = [
     ...llvm.matchAll(
-      /^@(\S+)_rops = internal global \{ i64, ptr, ptr, ptr, i8, ptr, ptr \} \{ i64 (\d+), /gm,
+      /^@(\S+)_rops = internal global \{ i64, ptr, ptr, ptr, i8, ptr, ptr, ptr \} \{ i64 (\d+), /gm,
     ),
   ];
   // root and leaf get field hooks; the record with an index-like field name

packages/compiler/src/backend/llvm/expr-stream-bridges.ts

@@ -1484,6 +1484,10 @@ function liveRecordOps(
   G.startBlock(bad);
   G.terminate(`unreachable`);
 
+  // Only a program that writes through a dynamic view needs the store
+  // hook (and its checked conversions), as for the commit adapter.
+  const setDefs = host.liveViewsReadOnly ? [] : liveRecordSet(host, t, `${snapshot}_set`, fields);
+
   const literals = fields.map((field) => `ptr ${host.internLiteral(field.name)}`);
   host.resolveThunkDefs.push(
     `define internal zeroext i1 @${has}(ptr %p, ${host.sizeType} %i) ${FN_ATTRS} { ; live field presence of ${typeKey(t)}`,
@@ -1494,13 +1498,90 @@ function liveRecordOps(
     G.render(),
     `}`,
     ``,
+    ...setDefs,
     `@${names} = internal constant [${fields.length} x ptr] [${literals.join(", ")}]`,
-    // Mutable: the runtime fills the trailing key-array slot on first use.
-    `@${ops} = internal global { ${host.sizeType}, ptr, ptr, ptr, i8, ptr, ptr } { ${host.sizeType} ${fields.length}, ptr @${names}, ptr @${has}, ptr @${get}, i8 ${optional.length === 0 ? 1 : 0}, ptr null, ptr null }`,
+    // Mutable: the runtime fills the key-array slot on first use.
+    `@${ops} = internal global { ${host.sizeType}, ptr, ptr, ptr, i8, ptr, ptr, ptr } { ${host.sizeType} ${fields.length}, ptr @${names}, ptr @${has}, ptr @${get}, i8 ${optional.length === 0 ? 1 : 0}, ptr null, ptr null, ptr ${setDefs.length ? `@${snapshot}_set` : "null"} }`,
     ``,
   );
 }
 
+/** The `set` hook of a live record's ops table: stores a dynamic write of
+ * present field `index` into the native record in place, so the capsule
+ * never becomes a snapshot for it. A value the field type does not accept
+ * answers false with no side effects, leaving the snapshot path to raise
+ * the commit's diagnostic; an inline union field always does. */
+function liveRecordSet(
+  host: LlvmEmitterContext,
+  t: IrType & { kind: "record" },
+  sym: string,
+  fields: readonly IrRecordShape["fields"][number][],
+): string[] {
+  const shape = host.recordsById.get(t.shapeId)!;
+  const struct = mangleRecordStruct(t.shapeId);
+  const S = new BlockBuilder();
+  const labels = fields.map(() => S.newLabel("live.record.store"));
+  const refuse = S.newLabel("live.record.refuse");
+  S.terminate(
+    `switch ${host.sizeType} %i, label %${refuse} [ ${fields
+      .map((_, position) => `${host.sizeType} ${position}, label %${labels[position]}`)
+      .join(" ")} ]`,
+  );
+  fields.forEach((field, position) => {
+    S.startBlock(labels[position]!);
+    const inline = host.inlineUnions.record(field.type);
+    if (inline) {
+      S.br(refuse);
+      return;
+    }
+    const fits = S.tmp();
+    S.line(`${fits} = call zeroext i1 @${host.dyn.dynMatchHelper(field.type)}(ptr %v)`);
+    const check = S.newLabel("live.record.check");
+    S.condBr(fits, check, refuse);
+    S.startBlock(check);
+    const valueTy = host.llType(field.type);
+    const next = S.tmp();
+    S.line(
+      `${next} = call ${valueTy === "i1" ? "zeroext " : ""}${valueTy} @${host.dyn.dynCheckHelper(field.type)}(ptr %v, ptr null)`,
+    );
+    // A conversion that throws has already raised the write's error.
+    const pending = S.tmp();
+    for (const line of host.pendingTestLines(pending)) S.line(line.trimStart());
+    const write = S.newLabel("live.record.write");
+    const done = S.newLabel("live.record.done");
+    S.condBr(pending, done, write);
+    S.startBlock(write);
+    const index = shape.fields.indexOf(field) + host.nullableUnions.fieldBase(t.shapeId);
+    const fieldPtr = S.tmp();
+    S.line(`${fieldPtr} = getelementptr inbounds %${struct}, ptr %p, i64 0, i32 ${index}`);
+    const fieldTy = llFieldType(field.type, false);
+    let stored = next;
+    if (fieldTy === "i8") {
+      stored = S.tmp();
+      S.line(`${stored} = zext i1 ${next} to i8`);
+    }
+    if (isRefCounted(field.type)) {
+      const old = S.tmp();
+      S.line(`${old} = load ptr, ptr ${fieldPtr}`);
+      S.line(`store ptr ${stored}, ptr ${fieldPtr} ; takes ownership`);
+      S.line(`call void ${releaseSym(host.shapeHost, field.type)}(ptr ${old})`);
+    } else {
+      S.line(`store ${fieldTy} ${stored}, ptr ${fieldPtr}`);
+    }
+    S.br(done);
+    S.startBlock(done);
+    S.terminate(`ret i1 true`);
+  });
+  S.startBlock(refuse);
+  S.terminate(`ret i1 false`);
+  return [
+    `define internal zeroext i1 @${sym}(ptr %p, ${host.sizeType} %i, ptr %v) ${FN_ATTRS} { ; live field store into ${typeKey(t)}`,
+    S.render(),
+    `}`,
+    ``,
+  ];
+}
+
 /** `@<snapshot>_rops` for a shape with orderVariants: a record-ops table
  * whose `select` hook answers the `_o<i>_rops` table (liveRecordOps) of the
  * record's current key order, which a write of an optional key can change
@@ -1524,7 +1605,7 @@ function liveRecordOrderSelect(
     B.render(),
     `}`,
     ``,
-    `@${snapshot}_rops = internal global { ${host.sizeType}, ptr, ptr, ptr, i8, ptr, ptr } { ${host.sizeType} 0, ptr null, ptr null, ptr null, i8 0, ptr null, ptr @${snapshot}_select }`,
+    `@${snapshot}_rops = internal global { ${host.sizeType}, ptr, ptr, ptr, i8, ptr, ptr, ptr } { ${host.sizeType} 0, ptr null, ptr null, ptr null, i8 0, ptr null, ptr @${snapshot}_select, ptr null }`,
     ``,
   );
 }

packages/compiler/src/backend/llvm/int32-kind-loops.ts

@@ -57,6 +57,8 @@ function isPure(e: IrExpr): boolean {
     case "arrayGet":
     case "arrayHas":
       return e.arr.kind === "varRef" && isPure(e.index);
+    case "arrIntrinsic":
+      return e.method === "getNumber" && e.receiver.kind === "varRef" && isPure(e.args[0]!);
     default:
       return false;
   }

packages/compiler/src/backend/llvm/integer-clones.ts

@@ -3,6 +3,7 @@ import type { IrExpr, IrFunction, IrLocal, IrModule, IrStmt, IrType } from "../.
 import { mangleFunction } from "../mangle.js";
 import { BlockBuilder } from "./blocks.js";
 import { SCR_ARR_FIELD } from "./common.js";
+import { SCR_ELEM_F64, SCR_ELEM_I32 } from "./dense-array-access.js";
 
 /** Speculative integer clones of pure number-valued functions.
  *
@@ -191,6 +192,8 @@ function cloneShape(fn: IrFunction, borrowed?: BorrowedParameter): Set<string> |
       case "ternary":
         return expr(e.cond, "bool") && expr(e.then, want) && expr(e.else_, want);
       case "arrIntrinsic":
+        if (e.method === "getNumber")
+          return want === "num" && arrayRef(e.receiver) && expr(e.args[0]!, "num");
         return (
           want === "num" && e.method === "length" && e.args.length === 0 && arrayRef(e.receiver)
         );
@@ -268,6 +271,9 @@ function callsMatch(fn: IrFunction, byName: ReadonlyMap<string, IrFunction>): bo
       case "arrayGet":
         visit(e.index);
         return;
+      case "arrIntrinsic":
+        if (e.method === "getNumber") visit(e.args[0]!);
+        return;
       default:
         return;
     }
@@ -432,6 +438,8 @@ function callsAnything(e: IrExpr): boolean {
       return callsAnything(e.cond) || callsAnything(e.then) || callsAnything(e.else_);
     case "arrayGet":
       return callsAnything(e.index);
+    case "arrIntrinsic":
+      return e.method === "getNumber" && callsAnything(e.args[0]!);
     default:
       return false;
   }
@@ -1020,10 +1028,10 @@ class CloneEmitter {
    * keeps every slot below `filled` a present value) whose element is
    * exactly an int32. Everything else (holes, indices outside the prefix,
    * other numbers) bails: the ordinary body reads it. */
-  private emitElement(e: Extract<IrExpr, { kind: "arrayGet" }>): string {
+  private emitElement(arr: IrExpr, indexExpr: IrExpr): string {
     const { B } = this;
-    const array = this.emitArray(e.arr);
-    const index = this.narrow(this.emitNum(e.index));
+    const array = this.emitArray(arr);
+    const index = this.narrow(this.emitNum(indexExpr));
     const filledField = B.tmp();
     const filled = B.tmp();
     const inside = B.tmp();
@@ -1044,9 +1052,39 @@ class CloneEmitter {
     );
     B.line(`${data} = load ptr, ptr ${dataField}`);
     B.line(`${offset} = zext i32 ${index} to i64`);
+    // A number array keeps 8-byte doubles, or 4-byte int32 slots when it is
+    // proven to hold only int32s (SCR_ELEM_I32); any other storage bails.
+    const kindField = B.tmp();
+    const kind = B.tmp();
+    const isInt32 = B.tmp();
+    B.line(
+      `${kindField} = getelementptr inbounds %ScrArr, ptr ${array}, i32 0, i32 ${SCR_ARR_FIELD.elem}`,
+    );
+    B.line(`${kind} = load i8, ptr ${kindField}`);
+    B.line(`${isInt32} = icmp eq i8 ${kind}, ${SCR_ELEM_I32}`);
+    const int32Slots = B.newLabel("elem.i32");
+    const doubleSlots = B.newLabel("elem.f64");
+    const join = B.newLabel("elem.join");
+    B.condBr(isInt32, int32Slots, doubleSlots);
+    B.startBlock(int32Slots);
+    const int32Slot = B.tmp();
+    const int32 = B.tmp();
+    B.line(`${int32Slot} = getelementptr inbounds i32, ptr ${data}, i64 ${offset}`);
+    B.line(`${int32} = load i32, ptr ${int32Slot}`);
+    B.br(join);
+    B.startBlock(doubleSlots);
+    const isDouble = B.tmp();
+    B.line(`${isDouble} = icmp eq i8 ${kind}, ${SCR_ELEM_F64}`);
+    this.require(isDouble);
     B.line(`${slot} = getelementptr inbounds double, ptr ${data}, i64 ${offset}`);
     B.line(`${number} = load double, ptr ${slot}`);
-    return this.exactInt32(number);
+    const exact = this.exactInt32(number);
+    const doubleEnd = B.currentLabel();
+    B.br(join);
+    B.startBlock(join);
+    const value = B.tmp();
+    B.line(`${value} = phi i32 [ ${int32}, %${int32Slots} ], [ ${exact}, %${doubleEnd} ]`);
+    return value;
   }
 
   /** The int32 the double `number` equals bit for bit (never -0, NaN, a
@@ -1157,9 +1195,13 @@ class CloneEmitter {
         if (this.inlines(e)) return { name: this.emitInlineCall(e), wide: false };
         return { name: this.emitCall(e), wide: true };
       case "arrIntrinsic":
+        // `getNumber` reads an element like `arrayGet`: a missing one bails,
+        // and the ordinary body reads it as NaN.
+        if (e.method === "getNumber")
+          return { name: this.emitElement(e.receiver, e.args[0]!), wide: false };
         return { name: this.emitLength(this.emitArray(e.receiver)), wide: false };
       case "arrayGet":
-        return { name: this.emitElement(e), wide: false };
+        return { name: this.emitElement(e.arr, e.index), wide: false };
       case "unary": {
         const operand = this.narrow(this.emitNum(e.operand));
         const value = B.tmp();

packages/compiler/src/backend/llvm/js-ic.ts

@@ -4,13 +4,12 @@
  * A property site in a dynamic-tier function owns one zeroed thread-local
  * ScrJsIc record (`@sc_js_ic_N`). The code at the site is fixed:
  *
- *   load   ordinary object whose shape is entry 0's own-property shape:
- *          read entry `slot` inline unless it is an accessor; otherwise
- *          scr_js_get_probe (polymorphic, prototype hits, absent keys,
- *          misses)
- *   store  ordinary object whose shape is entry 0's replace shape, outside
- *          an intact parse region, writable data entry: replace inline;
- *          otherwise scr_js_store_probe (adds, polymorphic, misses)
+ *   load   ordinary object whose layout is entry 0's own-property layout:
+ *          read slot `slot` inline; otherwise scr_js_get_probe
+ *          (polymorphic, prototype hits, absent keys, misses)
+ *   store  ordinary object whose layout is entry 0's replace layout,
+ *          outside an intact parse region: replace inline; otherwise
+ *          scr_js_store_probe (adds, polymorphic, misses)
  *   keyed  dense array element at an integral number key: inline;
  *          otherwise scr_js_keyed_probe (string keys of ordinary objects)
  *   method dynInvoke's method read: scr_js_load_probe
@@ -22,16 +21,19 @@
  * defines the operation's semantics; nothing is ever patched.
  *
  * Layout facts (64-bit only; 32-bit targets keep the helper calls):
- *   ScrDyn       kind +8; v.obj {len +16, entries +32, region +72,
- *                shape +80}; v.arr {len +16, items +32, presence +56};
- *                v.num +16
- *   ScrDynEntry  48 bytes: value +16, accessor bit 0 of +40, writable +41
- *   ScrJsIc      entries of 40 bytes {shape, target, holder, holder_shape,
- *                slot}; 168 bytes in all */
-import { BOOL, DYN, F64, STRING, type IrExpr, type IrFunction } from "../../ir/ir.js";
+ *   ScrDyn       kind +8; v.obj {len +16, slots +32, region +72,
+ *                layout +80}; v.arr {len +16, items +32, presence +56};
+ *                v.num +16. Every property of an object with a layout is
+ *                a writable data property (scr_dyn.h's layout mode);
+ *                dictionary-mode objects have a null layout.
+ *                v.typed_ref {ptr +16, type_key +40}.
+ *   ScrJsIc      entries of 40 bytes {layout, target, holder,
+ *                holder_layout, slot}; 168 bytes in all */
+import { BOOL, DYN, F64, STRING, type IrExpr, type IrFunction, type IrStmt } from "../../ir/ir.js";
 import { jsIcMethodSites, type JsIcSite } from "../../ir/js-ic.js";
 import { mangleBorrowedFunction } from "../mangle.js";
 import { emitBorrowedInput } from "./borrowed-inputs.js";
+import { classFieldBase, classFieldIndex } from "./classes.js";
 import { DYN_KIND } from "./dyn.js";
 import type { ExprOf, LlValue, LlvmEmitterContext } from "./expr-context.js";
 import { JS_BITS } from "./jsval-encoding.js";
@@ -42,8 +44,6 @@ type Host = LlvmEmitterContext;
 /** Words of one ScrJsIc record. */
 export const JS_IC_WORDS = 21;
 
-const ENTRY_STRIDE = 48;
-
 /** The cache site a call is, when it is emitted in a dynamic-tier function
  * of a 64-bit target. */
 export function jsIcSiteOf(host: Host, e: ExprOf<"call">): JsIcSite | null {
@@ -86,34 +86,22 @@ function kindIs(host: Host, d: string, kind: number, yes: string, no: string): v
  * inline made polymorphic reads 7-10% faster (the design prototype's W2/W3)
  * and monomorphic method code no faster, for 65-225 more bytes per site;
  * the prototype hit made method-heavy code 3-6% faster for 15-90 bytes.
- * So a site tests entry 0, own or prototype, and its probe does the rest.
- * (0 makes every access probe: with a runtime built with SCR_JS_VERIFY,
- * that checks every cached shape against its object.) */
-const INLINE_WAYS: number = 1;
+ * Two entries cover the common two-layout site (object literals of one
+ * record built in two key orders): on bench:runtime's dynamic-properties
+ * they made the run 13% faster than one entry, and 26% faster without its
+ * class instances; four were no faster than two. So a site tests entries
+ * 0 and 1, own or prototype, and its probe does the rest. (0 makes every access probe: with a runtime
+ * built with SCR_JS_VERIFY, that probes every access.) */
+const INLINE_WAYS: number = 2;
 const INLINE_PROTO = true;
 
-/** The address of entry `slot` of object `d`'s entries. */
-function entryAt(host: Host, d: string, slot: string): string {
+/** The address of slot `slot` of layout-mode object `d`. */
+function slotAt(host: Host, d: string, slot: string): string {
   const B = host.B;
-  const entries = load(host, "ptr", d, 32);
-  const offset = B.tmp();
-  const entry = B.tmp();
-  B.line(`${offset} = mul i64 ${slot}, ${ENTRY_STRIDE}`);
-  B.line(`${entry} = getelementptr inbounds i8, ptr ${entries}, i64 ${offset}`);
-  return entry;
-}
-
-/** Branches to `miss` when the entry at `entry` is an accessor. */
-function dataEntry(host: Host, entry: string, miss: string): void {
-  const B = host.B;
-  const flags = load(host, "i8", entry, 40);
-  const accessor = B.tmp();
-  const isAccessor = B.tmp();
-  B.line(`${accessor} = and i8 ${flags}, 1`);
-  B.line(`${isAccessor} = icmp ne i8 ${accessor}, 0`);
-  const data = B.newLabel("ic.data");
-  B.condBr(isAccessor, miss, data);
-  B.startBlock(data);
+  const slots = load(host, "ptr", d, 32);
+  const address = B.tmp();
+  B.line(`${address} = getelementptr inbounds ptr, ptr ${slots}, i64 ${slot}`);
+  return address;
 }
 
 /** The inline part of a load site, entered for an ordinary object `d`:
@@ -137,7 +125,7 @@ function inlineLoad(
     B.br(miss);
     return;
   }
-  const shape = load(host, "ptr", d, 80);
+  const shape = load(host, "ptr", d, 80); // v.obj.layout
   const present = B.tmp();
   B.line(`${present} = icmp ne ptr ${shape}, null`);
   let next = B.newLabel("ic.w");
@@ -160,9 +148,7 @@ function inlineLoad(
     B.condBr(own, ownLabel, protoLabel);
     const hit = (holder: string): void => {
       const slot = load(host, "i64", ic, base + 32);
-      const entry = entryAt(host, holder, slot);
-      dataEntry(host, entry, miss);
-      const value = load(host, "ptr", entry, 16);
+      const value = load(host, "ptr", slotAt(host, holder, slot), 0);
       const out = result(value);
       incoming.push(`[ ${out}, %${B.currentLabel()} ]`);
       B.br(join);
@@ -194,7 +180,7 @@ function inlineLoad(
 /** The inline part of a store site that replaces an own data property,
  * entered for an ordinary object `d` outside an intact parse region:
  * tests the first `ways` cache entries; a hit calls `store` with the
- * address of the entry's value word, which must end its block by
+ * address of the property's slot, which must end its block by
  * branching to the site's join. */
 function inlineReplace(
   host: Host,
@@ -209,7 +195,7 @@ function inlineReplace(
     B.br(miss);
     return;
   }
-  const shape = load(host, "ptr", d, 80);
+  const shape = load(host, "ptr", d, 80); // v.obj.layout
   const present = B.tmp();
   B.line(`${present} = icmp ne ptr ${shape}, null`);
   let next = B.newLabel("ic.w");
@@ -230,21 +216,7 @@ function inlineReplace(
     B.condBr(ok, matched, next);
     B.startBlock(matched);
     const slot = load(host, "i64", ic, base + 32);
-    const entry = entryAt(host, d, slot);
-    const flags = load(host, "i8", entry, 40);
-    const writable = load(host, "i8", entry, 41);
-    const accessor = B.tmp();
-    const data = B.tmp();
-    const canWrite = B.tmp();
-    const writes = B.tmp();
-    B.line(`${accessor} = and i8 ${flags}, 1`);
-    B.line(`${data} = icmp eq i8 ${accessor}, 0`);
-    B.line(`${canWrite} = icmp ne i8 ${writable}, 0`);
-    B.line(`${writes} = and i1 ${data}, ${canWrite}`);
-    const hit = B.newLabel("ic.st");
-    B.condBr(writes, hit, miss);
-    B.startBlock(hit);
-    store(gep(host, entry, 16));
+    store(slotAt(host, d, slot));
   }
 }
 
@@ -347,6 +319,222 @@ function keyString(host: Host, key: string, e: IrExpr): string {
   return host.emitExpr({ kind: "strLit", value: key, type: STRING, loc: e.loc }).name;
 }
 
+/** A class instance's answer that a read helper gives by loading one
+ * declared field: the branch `if (dyn.typedRefIs(p, KEY)) { r =
+ * dynCheck(p); return [js.fromDyn](fieldGet C.f(r)) }`. */
+interface CapsuleRead {
+  key: string;
+  className: string;
+  field: string;
+}
+
+/** The class branches of a read helper that a site can answer inline for
+ * capsules (class instances boxed as dyn values), or none.
+ *
+ * The helper first normalizes its receiver (`%dyn.class.normalize`
+ * reboxes a capsule keyed with a base class whose instance belongs to a
+ * subclass), then tests each class branch in turn. The site loads the
+ * field of a capsule whose key is a branch's key without normalizing, so
+ * a branch qualifies only when every subclass the normalization can
+ * rebox its key to has a branch that loads the same field from the same
+ * slot of a layout that extends the class's. Every other capsule, and
+ * every helper or normalization of another form, keeps the helper. */
+function capsuleReads(host: Host, helper: IrFunction): CapsuleRead[] {
+  const receiver = helper.params[0]?.localId;
+  if (receiver === undefined || helper.params.length !== 1) return [];
+  const reads = new Map<string, CapsuleRead | null>();
+  for (const stmt of helper.body) {
+    if (normalizes(stmt, receiver)) continue;
+    if (stmt.kind !== "if" || stmt.else_ !== null) break;
+    if (notCapsule(stmt.cond, receiver)) continue;
+    const key = brandKey(stmt.cond, receiver);
+    if (key === null) return [];
+    if (!reads.has(key)) reads.set(key, capsuleRead(stmt, receiver, key));
+  }
+  const reboxes = normalizationTargets(host);
+  if (reboxes === null) return [];
+  const out: CapsuleRead[] = [];
+  for (const read of reads.values()) {
+    if (read === null || !plainField(host, read.className, read.field)) continue;
+    const targets = reboxes.get(read.key) ?? [];
+    const same = targets.every((target) => {
+      const other = reads.get(`object:${target}`);
+      return (
+        other != null &&
+        other.field === read.field &&
+        plainField(host, target, read.field) &&
+        extendsLayout(host, target, read.className, read.field)
+      );
+    });
+    if (same) out.push(read);
+  }
+  return out;
+}
+
+/** `p = %dyn.class.normalize(p)`. */
+function normalizes(stmt: IrStmt, receiver: string): boolean {
+  return (
+    stmt.kind === "assign" &&
+    stmt.localId === receiver &&
+    stmt.value.kind === "call" &&
+    stmt.value.callee === "%dyn.class.normalize" &&
+    stmt.value.args.length === 1 &&
+    isLocal(stmt.value.args[0]!, receiver)
+  );
+}
+
+/** `!classCapsule(p)`: false for every capsule of a compiled class, so a
+ * capsule never enters the branch it guards. */
+function notCapsule(cond: IrExpr, receiver: string): boolean {
+  return (
+    cond.kind === "dynTest" &&
+    cond.test === "classCapsule" &&
+    cond.negated === true &&
+    isLocal(cond.value, receiver)
+  );
+}
+
+function isLocal(e: IrExpr, id: string): boolean {
+  return e.kind === "varRef" && e.localId === id;
+}
+
+/** The capsule key `dyn.typedRefIs(p, "object:C")` tests, or null. */
+function brandKey(cond: IrExpr, receiver: string): string | null {
+  if (cond.kind !== "libCall" || cond.fn !== "dyn.typedRefIs" || cond.args.length !== 2)
+    return null;
+  const [value, key] = cond.args;
+  if (!isLocal(value!, receiver) || key?.kind !== "strLit" || !key.value.startsWith("object:"))
+    return null;
+  return key.value;
+}
+
+/** The field a class branch loads, or null for a branch of another form. */
+function capsuleRead(
+  branch: IrStmt & { kind: "if" },
+  receiver: string,
+  key: string,
+): CapsuleRead | null {
+  const [decl, ret] = branch.then;
+  if (branch.then.length !== 2 || decl?.kind !== "varDecl" || ret?.kind !== "return") return null;
+  if (decl.init?.kind !== "dynCheck" || !isLocal(decl.init.value, receiver)) return null;
+  let value = ret.value;
+  if (value?.kind === "libCall" && value.fn === "js.fromDyn" && value.args.length === 1)
+    value = value.args[0]!;
+  if (value?.kind !== "fieldGet" || !isLocal(value.obj, decl.localId)) return null;
+  if (key !== `object:${value.className}`) return null;
+  return { key, className: value.className, field: value.field };
+}
+
+/** For each capsule key `%dyn.class.normalize` reboxes, the classes it
+ * may rebox to; null when the normalization has another form. */
+function normalizationTargets(host: Host): Map<string, string[]> | null {
+  const targets = new Map<string, string[]>();
+  const normalize = host.fnByName.get("%dyn.class.normalize");
+  if (normalize === undefined) return targets;
+  const value = normalize.params[0]?.localId;
+  if (value === undefined) return null;
+  for (const stmt of normalize.body) {
+    if (stmt.kind === "return") {
+      if (stmt.value !== null && isLocal(stmt.value, value)) continue;
+      return null;
+    }
+    if (stmt.kind !== "if" || stmt.else_ !== null) return null;
+    if (notCapsule(stmt.cond, value)) continue;
+    const key = brandKey(stmt.cond, value);
+    if (key === null) return null;
+    const [decl, ...checks] = stmt.then;
+    if (decl?.kind !== "varDecl" || decl.init?.kind !== "dynCheck") return null;
+    const into = targets.get(key) ?? [];
+    for (const check of checks) {
+      if (
+        check.kind !== "if" ||
+        check.else_ !== null ||
+        check.cond.kind !== "instanceOf" ||
+        !isLocal(check.cond.value, decl.localId)
+      )
+        return null;
+      into.push(check.cond.className);
+    }
+    targets.set(key, into);
+  }
+  return targets;
+}
+
+/** A declared field of a compiled class that holds a plain dyn cell
+ * pointer: not compact, compressed, int32 or an inline union. */
+function plainField(host: Host, className: string, field: string): boolean {
+  const meta = host.classMeta.get(className);
+  if (meta === undefined || meta.compact) return false;
+  const decl = meta.def.fields.find((f) => f.name === field);
+  if (decl === undefined || decl.type.kind !== "dyn") return false;
+  if (classFieldIndex(meta, field, "compressed").compressed) return false;
+  return (
+    !host.int32Slots.isField(className, field) && !host.inlineUnions.classField(className, field)
+  );
+}
+
+/** Whether `sub`'s layout starts with `base`'s through `field`: the same
+ * header and the same fields in the same slots, so a load through
+ * `base`'s struct reads `sub`'s field. */
+function extendsLayout(host: Host, sub: string, base: string, field: string): boolean {
+  const a = host.classMeta.get(base);
+  const b = host.classMeta.get(sub);
+  if (a === undefined || b === undefined || b.compact) return false;
+  if (classFieldBase(a) !== classFieldBase(b)) return false;
+  const end = a.def.fields.findIndex((f) => f.name === field);
+  if (end < 0 || end >= b.def.fields.length) return false;
+  for (let i = 0; i <= end; i++) {
+    const x = a.def.fields[i]!;
+    const y = b.def.fields[i]!;
+    if (x.name !== y.name || x.type.kind !== y.type.kind) return false;
+  }
+  return (
+    classFieldIndex(a, field, "compressed").index === classFieldIndex(b, field, "compressed").index
+  );
+}
+
+/** The inline part of a read site for a capsule `d`: a capsule whose key
+ * is one of `reads`' keys answers with the (borrowed) field cell, branching
+ * to `join` and recording its phi input; anything else, including a field
+ * not yet set, branches to `miss`. */
+function inlineCapsuleLoad(
+  host: Host,
+  d: string,
+  reads: readonly CapsuleRead[],
+  incoming: string[],
+  join: string,
+  miss: string,
+): void {
+  const B = host.B;
+  const capsule = B.newLabel("icc.cap");
+  kindIs(host, d, DYN_KIND.TYPED_REF, capsule, miss);
+  B.startBlock(capsule);
+  // Capsules boxed by this program share its key constants.
+  const key = load(host, "ptr", d, 40);
+  let next = B.newLabel("icc.k");
+  B.br(next);
+  reads.forEach((read, i) => {
+    B.startBlock(next);
+    next = i + 1 < reads.length ? B.newLabel("icc.k") : miss;
+    const same = B.tmp();
+    B.line(`${same} = icmp eq ptr ${key}, ${host.cstr(read.key)}`);
+    const matched = B.newLabel("icc.m");
+    B.condBr(same, matched, next);
+    B.startBlock(matched);
+    const instance = load(host, "ptr", d, 16);
+    const { ptr } = host.classFieldPtr(instance, read.className, read.field);
+    const cell = B.tmp();
+    B.line(`${cell} = load ptr, ptr ${ptr}`);
+    const set = B.tmp();
+    B.line(`${set} = icmp ne ptr ${cell}, null`);
+    const hit = B.newLabel("icc.hit");
+    B.condBr(set, hit, miss);
+    B.startBlock(hit);
+    incoming.push(`[ ${cell}, %${B.currentLabel()} ]`);
+    B.br(join);
+  });
+}
+
 /** Emits a call to a classified helper as a cache site. */
 export function emitJsIcCall(
   host: Host,
@@ -401,9 +589,15 @@ function emitGet(host: Host, e: ExprOf<"call">, callee: IrFunction, key: string)
   // conversion to the result type.
   const hit = B.newLabel("icg.hit");
   const hits: string[] = [];
-  kindIs(host, receiver.name, DYN_KIND.OBJ, object, probe);
+  const reads = capsuleReads(host, callee);
+  const other = reads.length > 0 ? B.newLabel("icg.other") : probe;
+  kindIs(host, receiver.name, DYN_KIND.OBJ, object, other);
   B.startBlock(object);
   inlineLoad(host, receiver.name, ic, INLINE_WAYS, INLINE_PROTO, (cell) => cell, hits, hit, probe);
+  if (reads.length > 0) {
+    B.startBlock(other);
+    inlineCapsuleLoad(host, receiver.name, reads, hits, hit, probe);
+  }
   B.startBlock(probe);
   // The read's probe also answers keys the receiver's plain chain lacks.
   // Only `length` and `next` reads can be answered for a native array or

packages/compiler/src/backend/llvm/lib-dispatch.ts

@@ -218,7 +218,7 @@ export function emitGenericLibCall(host: LlvmEmitterContext, e: LibCallExpr): Ll
     host.emitCoroAwait(null);
     return { name: "", type: e.type };
   }
-  if (host.wasi && e.fn === "async.awaitDyn") {
+  if (host.coroAwait && e.fn === "async.awaitDyn") {
     const value = host.emitExpr(e.args[0]!);
     host.declare(`declare ptr @scr_dyn_promise_of(ptr)`);
     const promise = B.tmp();
@@ -230,15 +230,16 @@ export function emitGenericLibCall(host: LlvmEmitterContext, e: LibCallExpr): Ll
     B.line(`${isPromise} = icmp ne ptr ${promise}, null`);
     B.condBr(isPromise, wait, hop);
     B.startBlock(wait);
-    host.emitWasiSuspend(promise);
+    host.emitCoroAwait(promise);
     B.br(ready);
     B.startBlock(hop);
-    host.emitWasiSuspend(null);
+    host.emitCoroAwait(null);
     B.br(ready);
     B.startBlock(ready);
-    host.declare(`declare ptr @scr_await_dyn_value_settled(ptr)`);
+    const extract = host.wasi ? "scr_await_dyn_value_settled" : "scr_coro_await_dyn_value";
+    host.declare(`declare ptr @${extract}(ptr)`);
     const result = B.tmp();
-    B.line(`${result} = call ptr @scr_await_dyn_value_settled(ptr ${value.name})`);
+    B.line(`${result} = call ptr @${extract}(ptr ${value.name})`);
     const output = host.own({ name: result, type: e.type });
     host.emitPendingCheck();
     return output;
@@ -755,7 +756,10 @@ export function emitGenericLibCall(host: LlvmEmitterContext, e: LibCallExpr): Ll
             // stream behind it (scr_dyn_for_await_stream.c)
             e.fn === "dyn.asyncIteratorOpen" && host.dynForAwaitStreams
             ? "scr_stream_dyn_async_iterator_open"
-            : LIB_FN_SYMS[e.fn]);
+            : (e.fn === "dyn.keySet" || e.fn === "dyn.keySetComputed") &&
+                host.sloppyDynWrites.has(`${e.loc.file}\0${e.loc.start}\0${e.loc.end}`)
+              ? `${LIB_FN_SYMS[e.fn]}_sloppy`
+              : LIB_FN_SYMS[e.fn]);
   if (sym === undefined) throw new LlvmUnsupportedError(`libCall:${e.fn}`, e.loc);
   // The runtime's Date functions take and answer time values: a Date
   // operand passes its time value, read at once from the borrowed object,

packages/compiler/src/backend/llvm/loop-callees.test.ts

@@ -0,0 +1,83 @@
+import { expect, test } from "vitest";
+import {
+  BOOL,
+  F64,
+  VOID,
+  type IrExpr,
+  type IrFunction,
+  type IrModule,
+  type IrStmt,
+} from "../../ir/ir.js";
+import { findLoopCallees } from "./loop-callees.js";
+
+const loc = { file: "callees.ts", start: 0, end: 0 };
+const num = (value: number): IrExpr => ({ kind: "numLit", value, type: F64, loc });
+const ref = (localId: string): IrExpr => ({ kind: "varRef", localId, type: F64, loc });
+const call = (callee: string): IrExpr => ({ kind: "call", callee, args: [num(1)], type: F64, loc });
+const run = (e: IrExpr): IrStmt => ({ kind: "exprStmt", expr: e, loc });
+const ret = (e: IrExpr): IrStmt => ({ kind: "return", value: e, loc });
+const loop = (body: IrStmt[]): IrStmt => ({
+  kind: "while",
+  cond: { kind: "bin", op: "<", left: ref("i"), right: num(10), type: BOOL, loc },
+  body,
+  loc,
+});
+const fn = (name: string, body: IrStmt[], extra: Partial<IrFunction> = {}): IrFunction => ({
+  name,
+  params: [{ localId: "x", name: "x", type: F64 }],
+  returnType: F64,
+  locals: [{ id: "x", name: "x", type: F64, mutable: false }],
+  body,
+  loc,
+  ...extra,
+});
+const module = (functions: IrFunction[]): IrModule => ({
+  irVersion: 17,
+  sourceFile: loc.file,
+  entry: "__main",
+  functions: [
+    { name: "__main", params: [], returnType: VOID, locals: [], body: [], loc },
+    ...functions,
+  ],
+});
+
+test("a small leaf called only from loops is a loop callee", () => {
+  const callees = findLoopCallees(
+    module([
+      fn("leaf", [loop([run(ref("x"))]), ret(ref("x"))]),
+      fn("caller", [loop([run(call("leaf"))]), loop([run(call("leaf"))]), ret(num(0))]),
+    ]),
+  );
+  expect([...callees]).toEqual(["leaf"]);
+});
+
+test("a call outside a loop, a third call site, an own call or a large body keeps the call", () => {
+  const leaf = fn("leaf", [ret(ref("x"))]);
+  // A call site outside any loop.
+  expect(
+    findLoopCallees(module([leaf, fn("caller", [run(call("leaf")), loop([run(call("leaf"))])])]))
+      .size,
+  ).toBe(0);
+  // Three call sites.
+  const three = fn("caller", [loop([run(call("leaf")), run(call("leaf")), run(call("leaf"))])]);
+  expect(findLoopCallees(module([leaf, three])).size).toBe(0);
+  // A callee that calls another function.
+  const calling = fn("calling", [ret(call("leaf"))]);
+  const caller = fn("caller", [loop([run(call("calling"))])]);
+  // (leaf is then called outside a loop, from calling.)
+  expect(findLoopCallees(module([leaf, calling, caller])).size).toBe(0);
+  // Two loops, or more than 12 statements.
+  const twoLoops = fn("leaf", [loop([]), loop([]), ret(ref("x"))]);
+  expect(findLoopCallees(module([twoLoops, fn("caller", [loop([run(call("leaf"))])])])).size).toBe(
+    0,
+  );
+  const long = fn("leaf", [...Array.from({ length: 12 }, () => run(ref("x"))), ret(ref("x"))]);
+  expect(findLoopCallees(module([long, fn("caller", [loop([run(call("leaf"))])])])).size).toBe(0);
+  // Async functions and library modules.
+  const asyncLeaf = fn("leaf", [ret(ref("x"))], { async: true });
+  expect(findLoopCallees(module([asyncLeaf, fn("caller", [loop([run(call("leaf"))])])])).size).toBe(
+    0,
+  );
+  const lib = { ...module([leaf, fn("caller", [loop([run(call("leaf"))])])]), lib: {} } as IrModule;
+  expect(findLoopCallees(lib).size).toBe(0);
+});

packages/compiler/src/backend/llvm/loop-callees.ts

@@ -0,0 +1,110 @@
+import type { IrExpr, IrFunction, IrModule, IrStmt } from "../../ir/ir.js";
+import { everyExprChild, everyStmtChild } from "../../ir/traverse.js";
+
+/** Statements a callee may have, counting nested ones. */
+const MAX_STATEMENTS = 12;
+/** Direct call sites a callee may have. */
+const MAX_CALL_SITES = 2;
+
+/** Expressions that run other code: a callee that has none calls nothing,
+ * so inlining it never inlines a call chain or a recursion. */
+const CALLS = new Set<string>([
+  "call",
+  "callValue",
+  "virtualCall",
+  "dynCall",
+  "dynInvoke",
+  "new",
+  "newValue",
+  "newPromise",
+  "ffiCall",
+  "awaitExpr",
+  "awaitUnionExpr",
+]);
+
+function isLoop(s: IrStmt): boolean {
+  return s.kind === "for" || s.kind === "while" || s.kind === "doWhile" || s.kind === "forOf";
+}
+
+/** Small functions that are called only from inside loops: a per-element
+ * helper such as
+ *
+ *     function pick(list: Gene[], rand: number): number {
+ *       for (const gene of list) if (rand < gene.c) return gene.sc;
+ *       return list[list.length - 1]!.sc;
+ *     }
+ *
+ * called from a loop over the elements. After its loop versions and
+ * checks, such a function is often past LLVM's inline cost threshold, so
+ * every element pays a call, the spills around it, and checks that the
+ * caller's loop could hoist once inlined.
+ *
+ * A function qualifies when it is a synchronous, non-generator function
+ * with no captures and no own call (CALLS), has at most MAX_STATEMENTS
+ * statements and one loop, and has one to MAX_CALL_SITES direct call sites
+ * in the module, each inside a loop body of its caller. The emitter marks
+ * those calls `alwaysinline`. Functions the module exports as a library
+ * keep the cost model's decision. */
+export function findLoopCallees(mod: IrModule): Set<string> {
+  const result = new Set<string>();
+  if (mod.lib !== undefined) return result;
+  const candidates = new Map<string, IrFunction>();
+  for (const fn of mod.functions) {
+    if (fn.async || fn.generator || fn.captures !== undefined || fn.classCaptures !== undefined)
+      continue;
+    let statements = 0;
+    let loops = 0;
+    let calls = false;
+    const expr = (e: IrExpr): boolean => {
+      if (CALLS.has(e.kind)) calls = true;
+      return !calls && everyExprChild(e, expr, stmt);
+    };
+    const stmt = (s: IrStmt): boolean => {
+      statements++;
+      if (isLoop(s)) loops++;
+      return statements <= MAX_STATEMENTS && loops <= 1 && everyStmtChild(s, expr, stmt);
+    };
+    if (!fn.body.every(stmt) || calls) continue;
+    candidates.set(fn.name, fn);
+  }
+  if (candidates.size === 0) return result;
+  // Call sites of each candidate, and whether every one is inside a loop.
+  const sites = new Map<string, { count: number; inLoops: boolean }>();
+  for (const fn of mod.functions) {
+    let depth = 0;
+    const expr = (e: IrExpr): boolean => {
+      if (e.kind === "call" && candidates.has(e.callee)) {
+        const site = sites.get(e.callee) ?? { count: 0, inLoops: true };
+        site.count++;
+        if (depth === 0 || e.callee === fn.name) site.inLoops = false;
+        sites.set(e.callee, site);
+      }
+      return everyExprChild(e, expr, stmt);
+    };
+    const stmt = (s: IrStmt): boolean => {
+      if (!isLoop(s)) return everyStmtChild(s, expr, stmt);
+      // A loop's header runs per iteration too, except a for's init.
+      if (s.kind === "for" && s.init) stmt(s.init);
+      depth++;
+      if (s.kind === "for") {
+        if (s.cond) expr(s.cond);
+        if (s.update) stmt(s.update);
+        s.body.every(stmt);
+      } else if (s.kind === "forOf") {
+        depth--;
+        expr(s.iterable);
+        depth++;
+        s.body.every(stmt);
+      } else if (s.kind === "while" || s.kind === "doWhile") {
+        expr(s.cond);
+        s.body.every(stmt);
+      }
+      depth--;
+      return true;
+    };
+    fn.body.every(stmt);
+  }
+  for (const [name, site] of sites)
+    if (site.inLoops && site.count >= 1 && site.count <= MAX_CALL_SITES) result.add(name);
+  return result;
+}

packages/compiler/src/backend/llvm/region-groups.test.ts

@@ -0,0 +1,205 @@
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { expect, test } from "vitest";
+import { compile, deserializeModule } from "../../index.js";
+import type { IrExpr, IrModule, IrType } from "../../ir/ir.js";
+import { analyzeClosedGroups, analyzeRegionGroups } from "./region-groups.js";
+import { children, type Node } from "./region-ir.js";
+
+async function moduleFor(source: string): Promise<IrModule> {
+  const dir = await mkdtemp(join(tmpdir(), "scriptc-region-groups-"));
+  try {
+    const entry = join(dir, "main.ts"),
+      output = join(dir, "main.ir.json");
+    await writeFile(entry, source);
+    const result = await compile(entry, { outDir: dir, outPath: output, outputKind: "ir" });
+    if (!result.ok)
+      throw new Error(result.diagnostics.map((item) => `${item.code}: ${item.message}`).join("\n"));
+    return deserializeModule(await readFile(output, "utf8"));
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+/** The calls of `callee` in the module, in order. */
+function callsOf(mod: IrModule, callee: string): IrExpr[] {
+  const out: IrExpr[] = [];
+  const visit = (node: Node): void => {
+    if (node.kind === "call" && node.callee === callee) out.push(node);
+    const kids: Node[] = [];
+    children(node, kids);
+    for (const k of kids) visit(k);
+  };
+  for (const fn of mod.functions) for (const s of fn.body) visit(s);
+  return out;
+}
+
+// Every object and record is an arena type here, and every union a nullable
+// pointer to one (the emitter decides both from layouts).
+const everyObject = (t: IrType): boolean =>
+  t.kind === "object" || t.kind === "record" || t.kind === "union";
+
+const TREE = `
+class Node {
+  left: Node | null;
+  right: Node | null;
+  constructor(left: Node | null, right: Node | null) {
+    this.left = left;
+    this.right = right;
+  }
+  count(): number {
+    return 1 + (this.left === null ? 0 : this.left.count()) + (this.right === null ? 0 : this.right.count());
+  }
+}
+function tree(depth: number): Node {
+  return depth === 0 ? new Node(null, null) : new Node(tree(depth - 1), tree(depth - 1));
+}
+`;
+
+test("a builder whose result its caller only reads is a closed root", async () => {
+  const mod = await moduleFor(`${TREE}
+let total = 0;
+for (let d = 0; d < 4; d++) total += tree(d).count();
+console.log(total);
+`);
+  const groups = analyzeRegionGroups(mod);
+  expect(groups.fresh.has("tree")).toBe(true);
+  const [root] = callsOf(mod, "tree").filter((c) => groups.roots.has(c));
+  expect(root).toBeDefined();
+  expect(groups.drops.get(root!)).toBeNull();
+  expect(groups.reachable.has("tree")).toBe(true);
+  expect(analyzeClosedGroups(mod, groups, everyObject).has(root!)).toBe(true);
+});
+
+test("a result kept past its caller's frame is no root", async () => {
+  const mod = await moduleFor(`${TREE}
+const kept: Node[] = [];
+for (let d = 0; d < 4; d++) kept.push(tree(d));
+console.log(kept.length);
+`);
+  const groups = analyzeRegionGroups(mod);
+  expect(callsOf(mod, "tree").some((c) => groups.roots.has(c))).toBe(false);
+});
+
+test("a function that stores what it allocates in a global is not leak-free", async () => {
+  const mod = await moduleFor(`
+interface P { x: number }
+const seen: P[] = [];
+function note(x: number): void {
+  seen.push({ x });
+}
+function sum(n: number): number {
+  let s = 0;
+  for (let i = 0; i < n; i++) {
+    const p = { x: i };
+    s += p.x;
+  }
+  return s;
+}
+note(1);
+console.log(sum(3), seen.length);
+`);
+  const groups = analyzeRegionGroups(mod);
+  expect(groups.leakFree.has("note")).toBe(false);
+  expect(callsOf(mod, "note").some((c) => groups.calls.has(c))).toBe(false);
+  expect(groups.leakFree.has("sum")).toBe(true);
+});
+
+test("a leak-free call that returns no reference is a call region", async () => {
+  const mod = await moduleFor(`
+interface V { x: number; y: number }
+function add(a: V, b: V): V {
+  return { x: a.x + b.x, y: a.y + b.y };
+}
+function walk(n: number): number {
+  let at: V = { x: 0, y: 0 };
+  for (let i = 0; i < n; i++) at = add(at, { x: i, y: 1 });
+  return at.x + at.y;
+}
+console.log(walk(10));
+`);
+  const groups = analyzeRegionGroups(mod);
+  const [region] = callsOf(mod, "walk");
+  expect(groups.calls.has(region!)).toBe(true);
+});
+
+test("a graph that holds strings or outside objects is not closed", async () => {
+  const mod = await moduleFor(`
+class Tag {
+  name: string;
+  constructor(name: string) {
+    this.name = name;
+  }
+}
+class Box {
+  tag: Tag;
+  owner: Tag | null;
+  constructor(tag: Tag, owner: Tag | null) {
+    this.tag = tag;
+    this.owner = owner;
+  }
+}
+const shared = new Tag("shared");
+function labelled(n: number): Box {
+  let box = new Box(new Tag("t" + n), null);
+  for (let i = 0; i < n; i++) box = new Box(new Tag("t" + i), null);
+  return box;
+}
+function owned(n: number): Box {
+  let box = new Box(new Tag("x"), shared);
+  for (let i = 0; i < n; i++) box = new Box(new Tag("x"), shared);
+  return box;
+}
+let n = 0;
+for (let i = 0; i < 3; i++) n += labelled(i).tag.name.length + owned(i).tag.name.length;
+console.log(n);
+`);
+  const groups = analyzeRegionGroups(mod);
+  const closed = analyzeClosedGroups(mod, groups, everyObject);
+  const labelled = callsOf(mod, "labelled").filter((c) => groups.roots.has(c));
+  const owned = callsOf(mod, "owned").filter((c) => groups.roots.has(c));
+  expect(labelled.length).toBe(1);
+  expect(owned.length).toBe(1);
+  expect(closed.has(labelled[0]!)).toBe(false);
+  expect(closed.has(owned[0]!)).toBe(false);
+});
+
+test("a root bound in a loop body is dropped with that body's local", async () => {
+  const mod = await moduleFor(`${TREE}
+function run(n: number): number {
+  let total = 0;
+  for (let i = 0; i < n; i++) {
+    const t = tree(i % 4);
+    total += t.count();
+  }
+  return total;
+}
+console.log(run(10));
+`);
+  const groups = analyzeRegionGroups(mod);
+  const [root] = callsOf(mod, "tree").filter((c) => groups.roots.has(c));
+  const run = mod.functions.find((f) => f.name === "run")!;
+  const local = groups.drops.get(root!);
+  expect(run.locals.find((l) => l.id === local)?.name).toBe("t");
+});
+
+test("a root whose value a callee writes into is not closed", async () => {
+  const mod = await moduleFor(`${TREE}
+function graft(n: Node, extra: Node): void {
+  n.left = extra;
+}
+const spare = new Node(null, null);
+let total = 0;
+for (let d = 0; d < 3; d++) {
+  const t = tree(d);
+  graft(t, spare);
+  total += t.count();
+}
+console.log(total);
+`);
+  const groups = analyzeRegionGroups(mod);
+  const closed = analyzeClosedGroups(mod, groups, everyObject);
+  for (const root of callsOf(mod, "tree").filter((c) => groups.roots.has(c)))
+    expect(closed.has(root)).toBe(false);
+});

packages/compiler/src/backend/llvm/region-ir.ts

@@ -0,0 +1,271 @@
+/* IR helpers shared by the region analyses (region-groups.ts): node
+ * traversal, allocation kinds, and how a use of a value passes it on or
+ * keeps it in the frame. */
+import type { IrExpr, IrStmt, IrType } from "../../ir/ir.js";
+import { everyExprChild, everyStmtChild } from "../../ir/traverse.js";
+
+export type Node = IrExpr | IrStmt;
+
+/** The kinds of heap allocation sites counted. */
+export const ALLOCATIONS = new Set([
+  "arrayLit",
+  "arrayNewLen",
+  "mapNew",
+  "setNew",
+  "new",
+  "recordLit",
+  "recordClone",
+  "closure",
+]);
+
+/** Array methods that return a fresh array without keeping the receiver. */
+export const FRESH_ARRAY_METHODS = new Set([
+  "slice",
+  "concatSpread",
+  "toReversed",
+  "toSpliced",
+  "with",
+  "withUndefined",
+  "flatCopy",
+  "flatOne",
+  "toSortedPrimitive",
+  "splice",
+]);
+/** Array methods that return the receiver itself. */
+export const RECEIVER_RESULT = new Set([
+  "reverse",
+  "fill",
+  "fillUndefined",
+  "copyWithin",
+  "sortPrimitive",
+]);
+/** Array methods whose arguments are only read (compared, copied from). */
+export const READ_ARGS = new Set([
+  "includes",
+  "indexOf",
+  "indexEq",
+  "getNumber",
+  "join",
+  "slice",
+  "concatSpread",
+  "pushSpread",
+  "unshiftSpread",
+  "nextPresent",
+  "length",
+]);
+
+export function refType(t: IrType): boolean {
+  return (
+    t.kind === "array" ||
+    t.kind === "map" ||
+    t.kind === "set" ||
+    t.kind === "object" ||
+    t.kind === "record" ||
+    t.kind === "func" ||
+    t.kind === "union"
+  );
+}
+
+export function children(node: Node, out: Node[]): void {
+  const push = (child: Node): boolean => {
+    out.push(child);
+    return true;
+  };
+  if ("type" in node && (node as IrExpr).type !== undefined && isExpr(node))
+    everyExprChild(node as IrExpr, push, push);
+  else everyStmtChild(node as IrStmt, push, push);
+}
+
+const STMT_KINDS = new Set([
+  "varDecl",
+  "assign",
+  "exprStmt",
+  "if",
+  "while",
+  "doWhile",
+  "switch",
+  "for",
+  "arraySet",
+  "arraySetLength",
+  "arraySetUndefined",
+  "arrayDelete",
+  "bytesSet",
+  "forOf",
+  "return",
+  "fieldSet",
+  "recordSet",
+  "recordKeySet",
+  "recordKeyDelete",
+  "break",
+  "continue",
+  "block",
+  "throw",
+  "runtimeFence",
+  "rethrow",
+  "tryCatch",
+]);
+export function isExpr(node: Node): node is IrExpr {
+  return !STMT_KINDS.has(node.kind);
+}
+
+/** Whether `a` and `b` are the same node. */
+export function same(a: Node | undefined, b: Node): boolean {
+  return a !== undefined && a === b;
+}
+
+/** Whether `parent` passes `child`'s value on as its own value (a branch of
+ * a conditional, a union wrap or narrow, a class up- or downcast, the
+ * result of a sequence), so the value's fate is the parent's. */
+export function transparent(child: Node, parent: Node | undefined): boolean {
+  if (parent === undefined) return false;
+  switch (parent.kind) {
+    case "ternary":
+      return same(parent.then, child) || same(parent.else_, child);
+    case "nullish":
+    case "logical":
+      return true;
+    case "seqExpr":
+      return same(parent.result, child);
+    case "unionWrap":
+    case "unionRetype":
+    case "unionNarrow":
+    case "upcast":
+    case "downcast":
+      return same(parent.value, child);
+    default:
+      return false;
+  }
+}
+
+/** Whether a use of a local's value as `child` of `parent` keeps it in the
+ * frame (given the current parameter summaries). */
+export function keepsInFrame(
+  child: Node,
+  parent: Node | undefined,
+  summaries: ReadonlyMap<string, Set<number>>,
+): boolean {
+  if (parent === undefined) return false;
+  switch (parent.kind) {
+    case "exprStmt":
+      return true;
+    case "arrayGet":
+    case "arrayHas":
+    case "arrayState":
+    case "arraySetUndefined":
+    case "arrayDelete":
+    case "arraySetLength":
+    case "arraySet":
+      return same(parent.arr, child);
+    case "fieldGet":
+    case "recordGet":
+    case "recordKeyGet":
+    case "recordHas":
+    case "recordOvfHas":
+    case "recordOvfKeys":
+    case "fieldSet":
+    case "recordSet":
+    case "recordKeySet":
+    case "recordKeyDelete":
+      return same(parent.obj, child);
+    case "forOf":
+      return same(parent.iterable, child);
+    case "arrIntrinsic":
+      if (same(parent.receiver, child)) return !RECEIVER_RESULT.has(parent.method);
+      return READ_ARGS.has(parent.method);
+    case "mapIntrinsic":
+      if (same(parent.receiver, child)) return true;
+      return parent.method === "get" || parent.method === "has" || parent.method === "delete";
+    case "setIntrinsic":
+      if (same(parent.receiver, child)) return true;
+      return parent.method === "has" || parent.method === "delete";
+    case "bin":
+      return parent.op === "===" || parent.op === "!==";
+    case "toBool":
+    case "unary":
+    case "unionIsTag":
+    case "unionEq":
+      return true;
+    case "unionDisc":
+    case "unionKeyGet":
+      return same(parent.value, child);
+    case "callValue":
+      return same(parent.callee, child);
+    case "call": {
+      const index = indexOfNode(parent.args, child);
+      return index >= 0 && summaries.get(parent.callee)?.has(index) === true;
+    }
+    default:
+      return false;
+  }
+}
+
+/** The index of `node` in `list`, or -1. */
+export function indexOfNode(list: readonly IrExpr[], node: Node): number {
+  for (let i = 0; i < list.length; i++) if (same(list[i], node)) return i;
+  return -1;
+}
+
+/** The arguments of a node that takes them (calls, constructions,
+ * intrinsics), or null. */
+export function argsOf(node: Node): readonly IrExpr[] | null {
+  switch (node.kind) {
+    case "call":
+    case "callValue":
+    case "virtualCall":
+    case "new":
+    case "newValue":
+    case "ffiCall":
+    case "dynCall":
+    case "dynInvoke":
+    case "intrinsic":
+    case "libCall":
+    case "arrIntrinsic":
+    case "bytesIntrinsic":
+    case "mapIntrinsic":
+    case "setIntrinsic":
+    case "strIntrinsic":
+    case "regexIntrinsic":
+      return node.args;
+    default:
+      return null;
+  }
+}
+
+const LOOP_STMTS = new Set(["while", "doWhile", "for", "forOf"]);
+
+/** Calls `visit(node, parent, loops)` for every node of `body`, parents
+ * before their children (siblings in no set order), where `loops` counts
+ * the loops around `node`. Allocates nothing per node. */
+export function forEachNode(
+  body: readonly IrStmt[],
+  visit: (node: Node, parent: Node | undefined, loops: number) => void,
+): void {
+  const nodes: Node[] = [];
+  const parents: (Node | undefined)[] = [];
+  const depths: number[] = [];
+  let parent: Node | undefined = undefined;
+  let depth = 0;
+  const pushExpr = (child: IrExpr): boolean => {
+    nodes.push(child);
+    parents.push(parent);
+    depths.push(depth);
+    return true;
+  };
+  const pushStmt = (child: IrStmt): boolean => {
+    nodes.push(child);
+    parents.push(parent);
+    depths.push(depth);
+    return true;
+  };
+  for (const st of body) pushStmt(st);
+  while (nodes.length > 0) {
+    const node = nodes.pop()!;
+    const above = parents.pop();
+    const loops = depths.pop()!;
+    visit(node, above, loops);
+    parent = node;
+    depth = loops + (LOOP_STMTS.has(node.kind) ? 1 : 0);
+    if (isExpr(node)) everyExprChild(node, pushExpr, pushStmt);
+    else everyStmtChild(node, pushExpr, pushStmt);
+  }
+}

packages/compiler/src/backend/llvm/region-sites.test.ts

@@ -0,0 +1,223 @@
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { expect, test } from "vitest";
+import { compile, deserializeModule } from "../../index.js";
+import type { IrExpr, IrModule } from "../../ir/ir.js";
+import { analyzeRegionGroups } from "./region-groups.js";
+import { children, type Node } from "./region-ir.js";
+import { planRegionSites } from "./region-sites.js";
+
+async function moduleFor(source: string): Promise<IrModule> {
+  const dir = await mkdtemp(join(tmpdir(), "scriptc-region-sites-"));
+  try {
+    const entry = join(dir, "main.ts"),
+      output = join(dir, "main.ir.json");
+    await writeFile(entry, source);
+    const result = await compile(entry, { outDir: dir, outPath: output, outputKind: "ir" });
+    if (!result.ok)
+      throw new Error(result.diagnostics.map((item) => `${item.code}: ${item.message}`).join("\n"));
+    return deserializeModule(await readFile(output, "utf8"));
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+/** The nodes in function `fn` matching `pick`, in order. */
+function nodesIn(mod: IrModule, fn: string, pick: (e: IrExpr) => boolean): IrExpr[] {
+  const out: IrExpr[] = [];
+  const visit = (node: Node): void => {
+    if (pick(node as IrExpr)) out.push(node as IrExpr);
+    const kids: Node[] = [];
+    children(node, kids);
+    for (const k of kids) visit(k);
+  };
+  for (const s of mod.functions.find((f) => f.name === fn)!.body) visit(s);
+  return out;
+}
+
+const calls = (callee: string) => (e: IrExpr) => e.kind === "call" && e.callee === callee;
+const records = (e: IrExpr) => e.kind === "recordLit";
+
+function plan(mod: IrModule) {
+  const groups = analyzeRegionGroups(mod);
+  const sites = planRegionSites(mod, groups);
+  return { groups, sites };
+}
+
+const TREE = `
+class Node {
+  left: Node | null;
+  right: Node | null;
+  constructor(left: Node | null, right: Node | null) {
+    this.left = left;
+    this.right = right;
+  }
+  count(): number {
+    return 1 + (this.left === null ? 0 : this.left.count()) + (this.right === null ? 0 : this.right.count());
+  }
+}
+function tree(depth: number): Node {
+  return depth === 0 ? new Node(null, null) : new Node(tree(depth - 1), tree(depth - 1));
+}
+`;
+
+test("a recursive builder's root takes an arena for every node", async () => {
+  const mod = await moduleFor(`${TREE}
+let total = 0;
+for (let d = 0; d < 4; d++) total += tree(d).count();
+console.log(total);
+`);
+  const { groups, sites } = plan(mod);
+  const roots = nodesIn(mod, "%init.0", calls("tree")).filter((c) => groups.roots.has(c));
+  expect(roots.length).toBe(1);
+  for (const n of nodesIn(mod, "tree", (e) => e.kind === "new"))
+    expect(sites.arenaSites.has(n)).toBe(true);
+  for (const c of nodesIn(mod, "tree", calls("tree"))) expect(sites.arenaSites.has(c)).toBe(true);
+});
+
+test("a builder of a bounded number of objects is no root", async () => {
+  const mod = await moduleFor(`
+interface V { x: number; y: number }
+function add(a: V, b: V): V {
+  return { x: a.x + b.x, y: a.y + b.y };
+}
+let at: V = { x: 0, y: 0 };
+let sum = 0;
+for (let i = 0; i < 10; i++) {
+  const step = add(at, { x: i, y: 1 });
+  sum += step.x;
+}
+console.log(sum, at.y);
+`);
+  const { groups } = plan(mod);
+  expect(groups.roots.size).toBe(0);
+  expect(groups.calls.size).toBe(0);
+  expect(groups.reachable.size).toBe(0);
+});
+
+test("a list a builder appends to in a loop takes the arena", async () => {
+  const mod = await moduleFor(`
+interface Row { id: number; score: number }
+function rows(n: number): Row[] {
+  const out: Row[] = [];
+  for (let i = 0; i < n; i++) {
+    const row: Row = { id: i, score: i * 2 };
+    out.push(row);
+  }
+  return out;
+}
+let total = 0;
+for (let k = 0; k < 3; k++) total += rows(10 + k).length;
+console.log(total);
+`);
+  const { groups, sites } = plan(mod);
+  expect(nodesIn(mod, "%init.0", calls("rows")).some((c) => groups.roots.has(c))).toBe(true);
+  const [row] = nodesIn(mod, "rows", records);
+  expect(sites.arenaSites.has(row!)).toBe(true);
+  const [out] = nodesIn(mod, "rows", (e) => e.kind === "arrayLit");
+  expect(sites.arenaSites.has(out!)).toBe(true);
+});
+
+test("values that replace elements or die in the loop take the heap", async () => {
+  const mod = await moduleFor(`
+interface V { x: number; y: number }
+function vec(x: number, y: number): V {
+  return { x, y };
+}
+function add(a: V, b: V): V {
+  return { x: a.x + b.x, y: a.y + b.y };
+}
+function simulate(n: number, steps: number): number {
+  const points: V[] = [];
+  for (let i = 0; i < n; i++) points.push(vec(i, i));
+  for (let s = 0; s < steps; s++)
+    for (let i = 0; i < n; i++) points[i] = add(points[i]!, vec(0, 1));
+  let sum = 0;
+  for (const p of points) sum += p.x + p.y;
+  return sum;
+}
+console.log(simulate(100, 10));
+`);
+  const { groups, sites } = plan(mod);
+  // The list's elements are replaced, so it keeps nothing: no group grows.
+  expect(groups.calls.size).toBe(0);
+  expect(groups.roots.size).toBe(0);
+  expect(sites.arenaSites.size).toBe(0);
+});
+
+test("a value reassigned in a loop and returned takes the heap", async () => {
+  const mod = await moduleFor(`
+class C {
+  re: number;
+  im: number;
+  constructor(re: number, im: number) {
+    this.re = re;
+    this.im = im;
+  }
+  times(o: C): C {
+    return new C(this.re * o.re - this.im * o.im, this.re * o.im + this.im * o.re);
+  }
+}
+function power(c: C, n: number): C {
+  let z = new C(1, 0);
+  for (let i = 0; i < n; i++) z = z.times(c);
+  return z;
+}
+let s = 0;
+for (let k = 0; k < 5; k++) s += power(new C(0.5, 0.5), k).re;
+console.log(s);
+`);
+  const { groups } = plan(mod);
+  expect(nodesIn(mod, "%init.0", calls("power")).some((c) => groups.roots.has(c))).toBe(false);
+});
+
+test("calls in an arena-aware function whose values die take the heap", async () => {
+  const mod = await moduleFor(`
+interface P { x: number; next: P | null }
+function weight(p: P): number {
+  return p.x * 2;
+}
+function probe(x: number): P {
+  return { x, next: null };
+}
+function chain(n: number): P {
+  let head: P = { x: 0, next: null };
+  const first = head;
+  for (let i = 1; i < n; i++) {
+    const node: P = { x: weight(probe(i)), next: null };
+    head.next = node;
+    head = node;
+  }
+  return first;
+}
+let total = 0;
+for (let k = 0; k < 3; k++) total += chain(5).x;
+console.log(total);
+`);
+  const { groups, sites } = plan(mod);
+  expect(nodesIn(mod, "%init.0", calls("chain")).some((c) => groups.roots.has(c))).toBe(true);
+  const [probe] = nodesIn(mod, "chain", calls("probe"));
+  expect(sites.arenaSites.has(probe!)).toBe(false);
+  expect(sites.heapCalls.has(probe!)).toBe(true);
+  for (const node of nodesIn(mod, "chain", records)) expect(sites.arenaSites.has(node)).toBe(true);
+});
+
+test("a root assigned in a loop to a local declared outside it is no root", async () => {
+  const mod = await moduleFor(`${TREE}
+function run(n: number): number {
+  let t = tree(1);
+  let total = t.count();
+  for (let d = 0; d < n; d++) {
+    t = tree(d);
+    total += t.count();
+  }
+  return total;
+}
+console.log(run(6));
+`);
+  const { groups } = plan(mod);
+  const [first, inLoop] = nodesIn(mod, "run", calls("tree"));
+  expect(groups.roots.has(first!)).toBe(true);
+  expect(groups.roots.has(inLoop!)).toBe(false);
+});

packages/compiler/src/backend/llvm/region-sites.ts

@@ -0,0 +1,349 @@
+/* Which allocations of a region group take its arena (arenas.ts), and
+ * which roots and call regions are worth one.
+ *
+ * An arena pays off for objects that live until the group is dropped: it
+ * saves their frees and teardown, but holds their memory until the drop.
+ * A temporary that dies early is cheaper on the heap, which reuses its
+ * memory at once. So in an arena-aware function an allocation takes the
+ * arena only when its value is kept by the group (its fate is the arena):
+ * - it is returned;
+ * - it is content of a new value that is kept;
+ * - it is stored, other than by an element write, into the graph of a
+ *   local that is kept (`out.push(row)`, `last.next = member`);
+ * - it is bound to a local that is kept.
+ * A local is kept when its value is returned or stored or put into
+ * something kept; a constructor's `this` is kept (its object follows its
+ * `new`); and in the callee of a call region, a local declared at the top
+ * of the body lives until the region drops. An element write (`a[i] = v`)
+ * usually replaces a value, so its value takes the heap.
+ *
+ * Every other allocation takes the heap, and so does everything a call
+ * allocates when the call's value is not kept: the emitter suspends the
+ * arena around such a call (heapCalls). Heap objects are always safe in a
+ * group; only arena objects need the group's proof.
+ *
+ * A root or call region is worth an arena when its group grows: a kept
+ * allocation runs in a loop, or a kept value comes from a recursive call
+ * or from a call of a function whose group grows. Other groups are small,
+ * and opening and dropping their arenas costs more than their frees. */
+import type { IrFunction, IrModule } from "../../ir/ir.js";
+import { contentOf, source, storeOf, storeTarget, type RegionGroups } from "./region-groups.js";
+import {
+  argsOf,
+  children,
+  indexOfNode,
+  isExpr,
+  refType,
+  same,
+  transparent,
+  type Node,
+} from "./region-ir.js";
+import { VirtualTargets } from "./reference-effects.js";
+
+export interface RegionSites {
+  /** Allocation sites (and calls) whose value the group keeps. */
+  arenaSites: Set<Node>;
+  /** Calls, constructions and closure calls in arena-aware functions whose
+   * value the group does not keep and whose callee may allocate: the
+   * arena is suspended while they run. */
+  heapCalls: Set<Node>;
+}
+
+const LOOPS = new Set(["while", "doWhile", "for", "forOf"]);
+
+/** Collection methods that remove what their receiver holds. */
+const REMOVALS = new Set(["pop", "shift", "splice", "delete", "clear"]);
+
+/** The local whose graph `node` drops values from (an element write, a
+ * length write, a delete, a removing method), or null. */
+function removalTarget(node: Node): string | null {
+  switch (node.kind) {
+    case "arraySet":
+    case "arraySetLength":
+    case "arraySetUndefined":
+    case "arrayDelete":
+      return storeTarget(node.arr);
+    case "recordKeyDelete":
+      return storeTarget(node.obj);
+    case "arrIntrinsic":
+    case "mapIntrinsic":
+    case "setIntrinsic":
+      return REMOVALS.has(node.method) ? storeTarget(node.receiver) : null;
+    default:
+      return null;
+  }
+}
+
+/** The functions a call-like node may run, or null when unknown. */
+function targetsOf(vt: VirtualTargets, node: Node): readonly string[] | null {
+  if (node.kind === "call") return [node.callee];
+  if (node.kind === "new") return [`%${node.className}.constructor`];
+  if (node.kind === "virtualCall") {
+    const t = vt.targets(node.className, node.method);
+    return t !== null && t.length > 0 ? t : null;
+  }
+  return null;
+}
+
+const callLike = (node: Node): boolean =>
+  node.kind === "call" ||
+  node.kind === "new" ||
+  node.kind === "virtualCall" ||
+  node.kind === "callValue" ||
+  node.kind === "newValue";
+
+/** The functions that run inside the arenas of `roots`: what they call,
+ * transitively, with the closures they pass. */
+export function reachableFrom(mod: IrModule, roots: Iterable<Node>): Set<string> {
+  const fns = new Map(mod.functions.map((f) => [f.name, f]));
+  const vt = new VirtualTargets(mod.classes ?? []);
+  const reachable = new Set<string>();
+  const queue: string[] = [];
+  const visit = (node: Node): void => {
+    const reach = (name: string): void => {
+      if (fns.has(name) && !reachable.has(name)) {
+        reachable.add(name);
+        queue.push(name);
+      }
+    };
+    if (node.kind === "closure") reach(node.fnName);
+    else for (const t of targetsOf(vt, node) ?? []) reach(t);
+    const kids: Node[] = [];
+    children(node, kids);
+    for (const k of kids) visit(k);
+  };
+  for (const r of roots) visit(r);
+  while (queue.length > 0) for (const st of fns.get(queue.pop()!)!.body) visit(st);
+  return reachable;
+}
+
+interface FnSites {
+  /** Kept call-like nodes and allocations, with whether each is in a loop. */
+  kept: Map<Node, boolean>;
+  /** Call-like nodes whose value is not kept. */
+  dropped: Node[];
+}
+
+/** Classifies the allocations and calls of `fn`. */
+function classify(fn: IrFunction, topLocalsKept: boolean): FnSites {
+  const locals = new Set(fn.locals.map((l) => l.id));
+  // Alias classes: a local bound to another local shares its fate.
+  const parent = new Map<string, string>();
+  const find = (id: string): string => {
+    let r = id;
+    while (parent.has(r)) r = parent.get(r)!;
+    return r;
+  };
+  const unite = (a: string, b: string): void => {
+    const ra = find(a),
+      rb = find(b);
+    if (ra !== rb) parent.set(ra, rb);
+  };
+  const kept = new Set<string>();
+  const keep = (id: string): boolean => {
+    const r = find(id);
+    if (kept.has(r)) return false;
+    kept.add(r);
+    return true;
+  };
+  const isKept = (id: string): boolean => kept.has(find(id));
+  // Kept from the start (applied once the alias classes are known).
+  const seeds: string[] = [];
+  if (fn.name.endsWith(".constructor") && fn.params.length > 0) seeds.push(fn.params[0]!.localId);
+  if (topLocalsKept) {
+    const types = new Map(fn.locals.map((l) => [l.id, l.type]));
+    for (const st of fn.body)
+      if (st.kind === "varDecl" && refType(types.get(st.localId) ?? { kind: "void" }))
+        seeds.push(st.localId);
+  }
+
+  // Uses of locals and of value-producing nodes, recorded once.
+  type Fate =
+    | { kind: "kept" }
+    | { kind: "local"; id: string }
+    | { kind: "target"; id: string }
+    | { kind: "node"; node: Node }
+    | { kind: "heap" };
+  const fateOf = (node: Node, parents: readonly Node[]): Fate => {
+    let value: Node = node;
+    let at = parents.length - 1;
+    while (at >= 0 && transparent(value, parents[at])) value = parents[at--]!;
+    const p = at >= 0 ? parents[at] : undefined;
+    if (p === undefined) return { kind: "heap" };
+    if (p.kind === "return") return { kind: "kept" };
+    if (
+      (p.kind === "varDecl" && p.init !== null && same(p.init, value)) ||
+      (p.kind === "assign" && same(p.value, value))
+    ) {
+      const id = p.localId;
+      // A local assigned in a loop usually drops its old value.
+      if (!locals.has(id) || (p.kind === "assign" && depth > 0)) return { kind: "heap" };
+      return { kind: "local", id };
+    }
+    const target = storeOf(value, p);
+    if (target !== undefined) {
+      if (p.kind === "arraySet") return { kind: "heap" };
+      const id = storeTarget(target);
+      return id !== null && locals.has(id) ? { kind: "target", id } : { kind: "heap" };
+    }
+    if (isExpr(p) && contentOf(value, p)) return { kind: "node", node: p };
+    // An argument of a call that returns a reference follows the call's
+    // value: the callee may put it into its result.
+    const args = argsOf(p);
+    if (
+      callLike(p) &&
+      isExpr(p) &&
+      refType(p.type) &&
+      args !== null &&
+      indexOfNode(args, value) >= 0
+    )
+      return { kind: "node", node: p };
+    return { kind: "heap" };
+  };
+
+  // Lossy locals: their graphs drop values (element writes, removals), so
+  // what is stored into them is not kept.
+  const lossy = new Set<string>();
+  const fates = new Map<Node, Fate>();
+  const loops = new Map<Node, boolean>();
+  const localUses: [string, Fate][] = [];
+  const parents: Node[] = [];
+  let depth = 0;
+  const walk = (node: Node): void => {
+    const removal = removalTarget(node);
+    if (removal !== null) lossy.add(removal);
+    if (source(node) || callLike(node)) {
+      fates.set(node, fateOf(node, parents));
+      loops.set(node, depth > 0);
+    } else if (node.kind === "varRef" && locals.has(node.localId) && refType(node.type)) {
+      const f = fateOf(node, parents);
+      if (f.kind !== "heap") localUses.push([node.localId, f]);
+    }
+    const loop = LOOPS.has(node.kind);
+    if (loop) depth++;
+    const kids: Node[] = [];
+    children(node, kids);
+    parents.push(node);
+    for (const k of kids) walk(k);
+    parents.pop();
+    if (loop) depth--;
+  };
+  for (const st of fn.body) walk(st);
+
+  // A local bound to another local joins its class.
+  for (const [id, f] of localUses) if (f.kind === "local") unite(id, f.id);
+  for (const id of [...lossy]) lossy.add(find(id));
+  for (const id of seeds) keep(id);
+  const keptFate = (f: Fate, seen = 0): boolean => {
+    if (seen > 64) return false;
+    switch (f.kind) {
+      case "kept":
+        return true;
+      case "local":
+        return isKept(f.id);
+      case "target":
+        return isKept(f.id) && !lossy.has(find(f.id));
+      case "node": {
+        const g = fates.get(f.node);
+        return g !== undefined && keptFate(g, seen + 1);
+      }
+      case "heap":
+        return false;
+    }
+  };
+  for (let changed = true; changed;) {
+    changed = false;
+    for (const [id, f] of localUses)
+      if (f.kind !== "local" && keptFate(f) && keep(id)) changed = true;
+  }
+  const out: FnSites = { kept: new Map(), dropped: [] };
+  for (const [e, f] of fates)
+    if (keptFate(f)) out.kept.set(e, loops.get(e)!);
+    else if (callLike(e)) out.dropped.push(e);
+  return out;
+}
+
+/**
+ * Narrows `groups` to the roots and call regions worth an arena (with
+ * `reachable` recomputed for them) and classifies the allocations of the
+ * functions that run in their arenas.
+ */
+export function planRegionSites(mod: IrModule, groups: RegionGroups): RegionSites {
+  const fns = new Map(mod.functions.map((f) => [f.name, f]));
+  const vt = new VirtualTargets(mod.classes ?? []);
+  const regionCallees = new Set<string>();
+  for (const c of groups.calls) if (c.kind === "call") regionCallees.add(c.callee);
+  const sites = new Map<string, FnSites>();
+  for (const name of groups.reachable) {
+    const fn = fns.get(name);
+    if (fn !== undefined) sites.set(name, classify(fn, regionCallees.has(name)));
+  }
+  // Which functions reach which (for recursion), over the reachable ones.
+  const calleesOf = (name: string): Set<string> => {
+    const out = new Set<string>();
+    const s = sites.get(name);
+    if (s === undefined) return out;
+    for (const e of [...s.kept.keys(), ...s.dropped])
+      for (const t of targetsOf(vt, e) ?? []) if (sites.has(t)) out.add(t);
+    return out;
+  };
+  const edges = new Map([...sites.keys()].map((n) => [n, calleesOf(n)]));
+  const reaches = (from: string, to: string): boolean => {
+    const seen = new Set<string>();
+    const stack = [from];
+    while (stack.length > 0) {
+      const n = stack.pop()!;
+      if (n === to) return true;
+      if (seen.has(n)) continue;
+      seen.add(n);
+      for (const m of edges.get(n) ?? new Set<string>()) stack.push(m);
+    }
+    return false;
+  };
+  const grows = new Set<string>();
+  for (let changed = true; changed;) {
+    changed = false;
+    for (const [name, s] of sites) {
+      if (grows.has(name)) continue;
+      let g = false;
+      for (const [e, inLoop] of s.kept) {
+        if (inLoop) g = true;
+        for (const t of targetsOf(vt, e) ?? []) if (grows.has(t) || reaches(t, name)) g = true;
+        if (g) break;
+      }
+      if (g) {
+        grows.add(name);
+        changed = true;
+      }
+    }
+  }
+  const worth = (r: Node): boolean => {
+    // Module code runs once, and its groups hold the program's own state.
+    if (r.kind === "call") return grows.has(r.callee) && !r.callee.startsWith("%init.");
+    if (r.kind !== "new") return false;
+    if (grows.has(`%${r.className}.constructor`)) return true;
+    return r.args.some((a) => a.kind === "call" && grows.has(a.callee));
+  };
+  for (const r of [...groups.roots])
+    if (!worth(r)) {
+      groups.roots.delete(r);
+      groups.drops.delete(r);
+    }
+  for (const c of [...groups.calls]) if (!worth(c)) groups.calls.delete(c);
+  groups.reachable = reachableFrom(mod, [...groups.roots, ...groups.calls]);
+
+  const arenaSites = new Set<Node>();
+  const heapCalls = new Set<Node>();
+  const mayAllocate = (e: Node): boolean => {
+    const t = targetsOf(vt, e);
+    return t === null || t.some((n) => groups.allocates.has(n) || !fns.has(n));
+  };
+  for (const name of groups.reachable) {
+    const s = sites.get(name);
+    if (s === undefined) continue;
+    for (const e of s.kept.keys()) arenaSites.add(e);
+    for (const e of s.dropped)
+      if (!groups.roots.has(e) && !groups.calls.has(e) && mayAllocate(e)) heapCalls.add(e);
+  }
+  return { arenaSites, heapCalls };
+}

packages/compiler/src/backend/llvm/shapes.ts

@@ -60,6 +60,14 @@ import {
   type InlineUnionFields,
 } from "./inline-unions.js";
 import { JS_BITS, JS_TAGS } from "./jsval-encoding.js";
+import {
+  ARENA_RC,
+  arenaDisposeLines,
+  arenaDisposeSym,
+  arenaNewLines,
+  disposeFieldLines,
+  plainRefType,
+} from "./arenas.js";
 import { recordMayKeepSource } from "./record-sources.js";
 import { LlvmUnsupportedError } from "./unsupported.js";
 
@@ -137,6 +145,10 @@ export interface ShapeHost {
    * allocate in regions and count references in their region chunk instead
    * of being empty (llvm/regions.ts). */
   regions?: RegionHooks | null;
+  /** Record shapes and classes with an arena-aware constructor
+   * (arenas.ts). */
+  arenaShapes?: ReadonlySet<string>;
+  arenaClasses?: ReadonlySet<string>;
   /** The target C ABI's `size_t` / refcount integer type. */
   readonly sizeType: "i32" | "i64";
   /** Worker executables: the inline allocator state is thread-local. */
@@ -1198,22 +1210,25 @@ export function arrNewCall(
   /** An empty array expected to receive a few elements (its first slots
    * live in its own block): capText must be "0". */
   small = false,
+  /** In the current group arena when one is open (arenas.ts). */
+  arena = false,
 ): string {
+  const r = arena ? "_r" : "";
   const useRef = arrUsesRef(host, elem);
   if (!useRef) {
     if (small) {
-      host.declare(`declare ptr @scr_arr_new_small(i32)`);
-      return `call ptr @scr_arr_new_small(i32 ${elemKindNum(elem)})`;
+      host.declare(`declare ptr @scr_arr_new_small${r}(i32)`);
+      return `call ptr @scr_arr_new_small${r}(i32 ${elemKindNum(elem)})`;
     }
-    host.declare(`declare ptr @scr_arr_new(i32, ${host.sizeType})`);
-    return `call ptr @scr_arr_new(i32 ${elemKindNum(elem)}, ${host.sizeType} ${capText})`;
+    host.declare(`declare ptr @scr_arr_new${r}(i32, ${host.sizeType})`);
+    return `call ptr @scr_arr_new${r}(i32 ${elemKindNum(elem)}, ${host.sizeType} ${capText})`;
   }
   if (small) {
-    host.declare(`declare ptr @scr_arr_new_ops_small(ptr)`);
-    return `call ptr @scr_arr_new_ops_small(ptr ${arrOps(host, elem)})`;
+    host.declare(`declare ptr @scr_arr_new_ops_small${r}(ptr)`);
+    return `call ptr @scr_arr_new_ops_small${r}(ptr ${arrOps(host, elem)})`;
   }
-  host.declare(`declare ptr @scr_arr_new_ops(ptr, ${host.sizeType})`);
-  return `call ptr @scr_arr_new_ops(ptr ${arrOps(host, elem)}, ${host.sizeType} ${capText})`;
+  host.declare(`declare ptr @scr_arr_new_ops${r}(ptr, ${host.sizeType})`);
+  return `call ptr @scr_arr_new_ops${r}(ptr ${arrOps(host, elem)}, ${host.sizeType} ${capText})`;
 }
 
 /** The ScrElemKind and ops descriptor (or `null`) an array of `elem`
@@ -2327,6 +2342,34 @@ export function emitRecordShapes(
     if (traced) nw.push(...youngEntryLines(host));
     nw.push(`  ret ptr %o`, `}`, ``);
     defs.push(...nw);
+    if (host.arenaShapes?.has(shape.id) === true && !shape.indexValue) {
+      const newSym = mangleRecordNew(shape.id);
+      const dispose = refMembers.length > 0 ? arenaDisposeSym(newSym) : null;
+      const init = [`  store ${host.sizeType} ${ARENA_RC}, ptr %o`];
+      if (shapeNumber !== 0)
+        init.push(
+          `  %shp = getelementptr inbounds %${struct}, ptr %o, i64 0, i32 ${SHAPE_WORD_INDEX}`,
+          `  store i32 ${shapeNumber}, ptr %shp ; shape number`,
+        );
+      defs.push(
+        ...arenaNewLines(host, newSym, sizeOf, traced ? cycType : null, dispose, init, "%o"),
+      );
+      if (dispose !== null)
+        defs.push(
+          ...arenaDisposeLines(
+            newSym,
+            refMembers.flatMap((m, i) =>
+              disposeFieldLines(
+                i,
+                `getelementptr inbounds %${struct}, ptr %o, i64 0, i32 ${m.index}`,
+                plainRefType(m.type),
+                releaseSym(host, m.type),
+                llvmCommentText(m.name),
+              ),
+            ),
+          ),
+        );
+    }
 
     if (host.recordCloneShapes.has(shape.id)) {
       const attrs = shape.fields.length >= 16 ? "#2" : FN_ATTRS;

packages/compiler/src/backend/llvm/stack-objects.ts

@@ -57,8 +57,9 @@ export function canStackObject(host: LlvmEmitterContext, e: IrExpr): e is StackO
   if (e.type.kind === "record" && host.recordsById.get(e.type.shapeId)?.freezable === true)
     return false;
   // A producer with a result-slot entry builds its fresh result in the
-  // caller's storage.
-  if (e.kind === "call") return host.fnByName.has(resultEntryName(e.callee));
+  // caller's storage, unless the call roots a group: then the result goes
+  // in the group's arena with the objects it holds (arenas.ts).
+  if (e.kind === "call") return host.fnByName.has(resultEntryName(e.callee)) && !host.opensArena(e);
   if (e.kind === "recordLit") {
     if (e.type.kind !== "record") return false;
     const shape = host.recordsById.get(e.type.shapeId);

packages/compiler/src/backend/loop-polls.ts

@@ -137,3 +137,18 @@ export function loopAccessesTypedArrays(loop: Loop): boolean {
   };
   return loop.body.some(inStmt);
 }
+
+/** Whether `body` holds a loop outside its closures. */
+export function containsLoop(body: readonly IrStmt[]): boolean {
+  const inStmt = (s: IrStmt): boolean =>
+    s.kind === "while" ||
+    s.kind === "doWhile" ||
+    s.kind === "for" ||
+    s.kind === "forOf" ||
+    !everyStmtChild(
+      s,
+      () => true,
+      (child) => !inStmt(child),
+    );
+  return body.some(inStmt);
+}

packages/compiler/src/backend/may-throw.test.ts

@@ -406,7 +406,7 @@ test("worker programs poll for termination only where execution can be unbounded
   expect(computeMayThrow({ ...mod, workers: false }).workerEntryPolls).toBeUndefined();
 });
 
-test("stack checks cover recursive components and recursion through reentrant operations", () => {
+test("stack checks cover every recursive cycle, including recursion through reentrant operations", () => {
   const mod = moduleWith(
     fn("caller", [call("self"), call("left"), call("leaf"), call("walker")], []),
     fn("self", [call("self"), call("leaf")], []),
@@ -420,7 +420,12 @@ test("stack checks cover recursive components and recursion through reentrant op
     fn("visitor", [callClosure("leaf")], []),
   );
   const answer = computeMayThrow(mod, { stackChecks: true });
-  expect([...answer.stackChecks!].sort()).toEqual(["left", "right", "self", "step", "walker"]);
+  // One check per cycle: self, one of left and right, and one of walker and
+  // step (the earlier function on ties).
+  expect([...answer.stackChecks!].sort()).toEqual(["left", "self", "walker"]);
+  expect(
+    [...computeMayThrow(mod, { stackChecks: "everyCycleMember" }).stackChecks!].sort(),
+  ).toEqual(["left", "right", "self", "step", "walker"]);
   // Checked functions throw the overflow RangeError, so their callers poll;
   // a throwing closure target makes every indirect call poll as well.
   expect(answer.indirect).toBe(true);
@@ -437,7 +442,7 @@ test("stack checks cover recursive components and recursion through reentrant op
   expect(computeMayThrow(mod).fns.size).toBe(0);
 });
 
-test("stack-checked synchronous functions skip the worker entry poll", () => {
+test("synchronous functions on a checked cycle skip the worker entry poll", () => {
   const asyncSelf: IrFunction = { ...fn("asyncSelf", [call("asyncSelf")], []), async: true };
   const mod: IrModule = {
     ...moduleWith(
@@ -452,10 +457,11 @@ test("stack-checked synchronous functions skip the worker entry poll", () => {
     workers: true,
   };
   const answer = computeMayThrow(mod, { stackChecks: true });
-  expect([...answer.stackChecks!].sort()).toEqual(["asyncSelf", "caller", "left", "right", "self"]);
-  // Callers test after every call of a stack-checked function, and its
-  // overflow unwinds through those tests, so only the module entry, async
-  // bodies and unbounded functions without a stack check poll on entry.
+  expect([...answer.stackChecks!].sort()).toEqual(["asyncSelf", "caller", "left", "self"]);
+  // Callers test after every call of a function on a checked cycle (it may
+  // throw), and an overflow unwinds through those tests, so only the module
+  // entry, async bodies and unbounded functions off any cycle poll on entry;
+  // right needs no poll although left holds the cycle's check.
   expect([...answer.workerEntryPolls!].sort()).toEqual(["asyncSelf", "caller", "walker"]);
   expect(answer.fns.has("self") && answer.fns.has("left") && answer.fns.has("right")).toBe(true);
   // Without stack checks (WASI, Windows, libraries) every cycle keeps its poll.
@@ -469,6 +475,48 @@ test("stack-checked synchronous functions skip the worker entry poll", () => {
   ]);
 });
 
+test("stack checks meet every cycle once and bound the runs between checks", () => {
+  // A ring of 80 functions, with a chord from fn10 back to fn0, and a
+  // separate ring of three whose functions also call each other backwards.
+  const ring = Array.from({ length: 80 }, (_, i) =>
+    fn(`fn${i}`, i === 10 ? [call("fn11"), call("fn0")] : [call(`fn${(i + 1) % 80}`)], []),
+  );
+  const mod = moduleWith(
+    ...ring,
+    fn("a", [call("b"), call("c")], []),
+    fn("b", [call("c"), call("a")], []),
+    fn("c", [call("a"), call("b")], []),
+  );
+  const checks = computeMayThrow(mod, { stackChecks: true }).stackChecks!;
+  // Removing the checked functions leaves no cycle, and no run of more than
+  // 32 unchecked calls.
+  const callees = new Map(
+    mod.functions.map((f) => [
+      f.name,
+      f.body.flatMap((s) =>
+        s.kind === "exprStmt" && s.expr.kind === "call" ? [s.expr.callee] : [],
+      ),
+    ]),
+  );
+  const longest = new Map<string, number>();
+  const visiting = new Set<string>();
+  const run = (name: string): number => {
+    if (checks.has(name)) return 0;
+    expect(visiting.has(name)).toBe(false);
+    const known = longest.get(name);
+    if (known !== undefined) return known;
+    visiting.add(name);
+    const depth = 1 + Math.max(0, ...callees.get(name)!.map(run));
+    visiting.delete(name);
+    longest.set(name, depth);
+    return depth;
+  };
+  for (const f of mod.functions) expect(run(f.name)).toBeLessThanOrEqual(32);
+  // fn0 breaks both ring cycles, fn33 and fn66 bound the run along the
+  // ring, and two of a, b and c break their four cycles.
+  expect([...checks].sort()).toEqual(["a", "b", "fn0", "fn33", "fn66"]);
+});
+
 test("class members are reachable from reentrant operations", () => {
   const mod: IrModule = {
     ...moduleWith(

packages/compiler/src/backend/may-throw.ts

@@ -37,7 +37,11 @@ export type MayThrowReason =
 export function computeMayThrow(
   mod: IrModule,
   options: {
-    stackChecks?: boolean;
+    /** Native stack checks: true for the functions that check on entry (one
+     * per call cycle, see stackCheckedFunctions); "everyCycleMember" for a
+     * model in which every function on a cycle checks, which answers a
+     * superset that does not depend on that choice. */
+    stackChecks?: boolean | "everyCycleMember";
     explain?: boolean;
     /** computePublishedTypes(mod), when the caller already has it. */
     published?: ReturnType<typeof computePublishedTypes>;
@@ -56,8 +60,16 @@ export function computeMayThrow(
   stackChecks?: Set<string>;
 } {
   const terminations = mod.workers === true ? workerTerminationPolls(mod, options.nodes) : null;
+  const stackGraph =
+    options.stackChecks === undefined || options.stackChecks === false
+      ? null
+      : stackCheckGraph(mod, options.nodes);
   const stackChecks =
-    options.stackChecks === true ? stackCheckedFunctions(mod, options.nodes) : null;
+    stackGraph === null
+      ? null
+      : options.stackChecks === "everyCycleMember"
+        ? stackGraph.cyclic
+        : cycleGuards(stackGraph);
   // Stores that can reach a published object throw the frozen TypeError.
   const published =
     options.published !== undefined ? options.published : computePublishedTypes(mod);
@@ -488,7 +500,9 @@ export function computeMayThrow(
     fns: may,
     ...(why !== null ? { why } : {}),
     indirect,
-    ...(terminations ? { workerEntryPolls: entryPolls(mod, terminations.entry, stackChecks) } : {}),
+    ...(terminations
+      ? { workerEntryPolls: entryPolls(mod, terminations.entry, stackGraph?.cyclic ?? null, may) }
+      : {}),
     ...(stackChecks ? { stackChecks } : {}),
   };
 }
@@ -720,28 +734,32 @@ function describeThrowingNode(rec: IrExpr | IrStmt): string {
 }
 
 /** The termination polls a worker program places on function entry. A
- * stack-checked synchronous function needs none: it may throw (the stack
- * guard seeds the fixpoint), so every caller tests the pending state after
- * the call, and a descent that never returns ends at the stack guard, whose
- * RangeError unwinds through those tests. An outstanding terminate request
- * keeps the alert word nonzero, so the first test that runs afterwards (a
- * post-call test, a loop poll or the unwinding) stops the thread; dropping
- * the entry poll only delays the stop by bounded work, which Node's
- * asynchronous terminate allows. The entry poll's slow path rejoins the
- * body, so every polled function kept its arguments live across a call. */
+ * synchronous function on a call cycle that may throw needs none: every
+ * caller tests the pending state after the call, and a descent that never
+ * returns passes a stack-checked function of each cycle again and again
+ * (stackCheckedFunctions) and ends at its guard, whose RangeError unwinds
+ * through those tests. An outstanding terminate request keeps the alert word
+ * nonzero, so the first test that runs afterwards (a post-call test, a loop
+ * poll or the unwinding) stops the thread; dropping the entry poll only
+ * delays the stop by bounded work, which Node's asynchronous terminate
+ * allows. The entry poll's slow path rejoins the body, so every polled
+ * function kept its arguments live across a call. */
 function entryPolls(
   mod: IrModule,
   entry: Set<string>,
-  stackChecks: Set<string> | null,
+  cyclic: Set<string> | null,
+  may: Set<string>,
 ): Set<string> {
-  if (stackChecks === null) return entry;
+  if (cyclic === null) return entry;
   // Calling an async or generator function never tests the caller's pending
   // state, and the module entry has no caller: those keep their polls.
   const keep = new Set(
     mod.functions.filter((fn) => fn.async || fn.generator !== undefined).map((fn) => fn.name),
   );
   keep.add(mod.entry);
-  return new Set([...entry].filter((name) => keep.has(name) || !stackChecks.has(name)));
+  return new Set(
+    [...entry].filter((name) => keep.has(name) || !cyclic.has(name) || !may.has(name)),
+  );
 }
 
 /** Statement and expression kinds that cannot reenter scriptc code except
@@ -971,16 +989,31 @@ export function workerTerminationPolls(
   return { entry, polls };
 }
 
-/** The functions that can take part in unbounded recursion, which check the
- * native stack guard on entry: every function on a cycle of the call graph.
- * Direct edges are calls, constructions and virtual dispatch. A function
- * containing any operation that can reenter scriptc code other than through
- * those edges (an indirect call, a callback-taking or dynamic operation, a
- * library call; see boundedNode) also reaches every function that such an
- * operation can invoke: closure targets and class members. Non-recursive
- * functions, including leaf callbacks, stay check-free. */
+/** The call graph that bounds recursion, and the functions on its cycles:
+ * the ones that can take part in unbounded recursion. Direct edges are
+ * calls, constructions and virtual dispatch. A function containing any
+ * operation that can reenter scriptc code other than through those edges
+ * (an indirect call, a callback-taking or dynamic operation, a library call;
+ * see boundedNode) also reaches every function that such an operation can
+ * invoke: closure targets and class members, behind one shared `reentry`
+ * node. */
+interface StackCheckGraph {
+  edges: Map<string, string[]>;
+  cyclic: Set<string>;
+}
+
+const REENTRY = "\0reentry";
+
+/** The functions that check the native stack guard on entry: one function
+ * of every cycle of the call graph (stackCheckGraph), which bounds every
+ * unbounded recursion, since its frames repeat the cycle's guarded function
+ * again and again. Non-recursive functions, including leaf callbacks, stay
+ * check-free. See cycleGuards for the choice. */
 export function stackCheckedFunctions(mod: IrModule, nodes?: IrNodeIndex): Set<string> {
-  const reentry = "\0reentry";
+  return cycleGuards(stackCheckGraph(mod, nodes));
+}
+
+function stackCheckGraph(mod: IrModule, nodes?: IrNodeIndex): StackCheckGraph {
   const methodImpls = new Map<string, string[]>();
   const memberPrefixes = new Set<string>();
   for (const cls of mod.classes ?? []) {
@@ -1019,16 +1052,157 @@ export function stackCheckedFunctions(mod: IrModule, nodes?: IrNodeIndex): Set<s
     };
     eachNodeOfKinds(fn, scan, visit);
     const callees = out.filter((callee) => names.has(callee));
-    if (reenters) callees.push(reentry);
+    if (reenters) callees.push(REENTRY);
     edges.set(fn.name, callees);
   }
   edges.set(
-    reentry,
+    REENTRY,
     [...targets].filter((name) => names.has(name)),
   );
   const cyclic = cyclicFunctions(edges);
-  cyclic.delete(reentry);
-  return cyclic;
+  cyclic.delete(REENTRY);
+  return { edges, cyclic };
+}
+
+/** The longest run of calls between unchecked functions of a cycle that
+ * cycleGuards allows; deeper runs get a check. Acyclic call chains below a
+ * check are as deep as the program makes them already, so this keeps the
+ * stack used between two checks of the same order. */
+const MAX_UNCHECKED_CYCLE_RUN = 32;
+
+/** A small set of functions that meets every cycle of the stack-check graph
+ * (a feedback vertex set), chosen greedily: functions that cannot lie on a
+ * remaining cycle (no caller or no callee left among the candidates) drop
+ * out, a function that calls itself is chosen, and otherwise the function
+ * with the most caller-callee pairs, the one that breaks the most cycles,
+ * is chosen and removed; ties go to the earlier function. The reentry node
+ * is not a function and is never chosen. A last pass in topological order
+ * of the unchosen cycle functions adds a check where a run of them would
+ * exceed MAX_UNCHECKED_CYCLE_RUN calls. */
+function cycleGuards(graph: StackCheckGraph): Set<string> {
+  const { edges, cyclic } = graph;
+  const chosen = new Set<string>();
+  if (cyclic.size === 0) return chosen;
+  const order = new Map<string, number>();
+  const callees = new Map<string, Set<string>>();
+  const callers = new Map<string, Set<string>>();
+  const candidates = [...[...edges.keys()].filter((name) => cyclic.has(name)), REENTRY];
+  for (const name of candidates) {
+    order.set(name, order.size);
+    callees.set(name, new Set());
+    callers.set(name, new Set());
+  }
+  for (const name of candidates)
+    for (const callee of edges.get(name) ?? [])
+      if (callees.has(callee)) {
+        callees.get(name)!.add(callee);
+        callers.get(callee)!.add(name);
+      }
+  // Max-heap of [score, order, name]; an entry is stale once its function
+  // is gone or its score changed, and is skipped when popped.
+  const heap: [number, number, string][] = [];
+  const score = (name: string): number =>
+    name === REENTRY ? -1 : callers.get(name)!.size * callees.get(name)!.size;
+  const above = (x: [number, number, string], y: [number, number, string]): boolean =>
+    x[0] > y[0] || (x[0] === y[0] && x[1] < y[1]);
+  const push = (name: string): void => {
+    heap.push([score(name), order.get(name)!, name]);
+    for (let i = heap.length - 1; i > 0;) {
+      const parent = (i - 1) >> 1;
+      if (!above(heap[i]!, heap[parent]!)) break;
+      [heap[i], heap[parent]] = [heap[parent]!, heap[i]!];
+      i = parent;
+    }
+  };
+  const pop = (): [number, number, string] => {
+    const top = heap[0]!;
+    const last = heap.pop()!;
+    if (heap.length > 0) {
+      heap[0] = last;
+      for (let i = 0; ;) {
+        let best = i;
+        for (const child of [2 * i + 1, 2 * i + 2])
+          if (child < heap.length && above(heap[child]!, heap[best]!)) best = child;
+        if (best === i) break;
+        [heap[i], heap[best]] = [heap[best]!, heap[i]!];
+        i = best;
+      }
+    }
+    return top;
+  };
+  const doomed: string[] = [];
+  const remove = (name: string): void => {
+    const out = callees.get(name)!;
+    const into = callers.get(name)!;
+    callees.delete(name);
+    callers.delete(name);
+    for (const callee of out)
+      if (callee !== name) {
+        const set = callers.get(callee)!;
+        set.delete(name);
+        if (set.size === 0) doomed.push(callee);
+        else push(callee);
+      }
+    for (const caller of into)
+      if (caller !== name) {
+        const set = callees.get(caller)!;
+        set.delete(name);
+        if (set.size === 0) doomed.push(caller);
+        else push(caller);
+      }
+  };
+  // Removes the functions that can no longer lie on a cycle, transitively.
+  const settle = (): void => {
+    while (doomed.length > 0) {
+      const name = doomed.pop()!;
+      if (callees.has(name)) remove(name);
+    }
+  };
+  for (const name of candidates) {
+    if (callees.get(name)!.size === 0 || callers.get(name)!.size === 0) doomed.push(name);
+    else push(name);
+  }
+  settle();
+  for (const name of candidates)
+    if (callees.get(name)?.has(name) === true) {
+      chosen.add(name);
+      remove(name);
+      settle();
+    }
+  while (heap.length > 0) {
+    const [entryScore, , name] = pop();
+    if (!callees.has(name) || entryScore !== score(name) || name === REENTRY) continue;
+    chosen.add(name);
+    remove(name);
+    settle();
+  }
+  // Bound the runs of unchecked cycle functions (acyclic once the chosen
+  // ones are removed; the reentry node takes no frame): the longest run
+  // ending at each function, in topological order, and a check where it
+  // would grow too long.
+  const unchecked = candidates.filter((name) => !chosen.has(name));
+  const pending = new Map<string, number>(unchecked.map((name) => [name, 0]));
+  for (const name of unchecked)
+    for (const callee of new Set(edges.get(name)))
+      if (pending.has(callee)) pending.set(callee, pending.get(callee)! + 1);
+  const run = new Map<string, number>();
+  const ready = unchecked.filter((name) => pending.get(name) === 0);
+  for (let i = 0; i < ready.length; i++) {
+    const name = ready[i]!;
+    let depth = (run.get(name) ?? 0) + (name === REENTRY ? 0 : 1);
+    if (depth > MAX_UNCHECKED_CYCLE_RUN && name !== REENTRY) {
+      chosen.add(name);
+      depth = 0;
+    }
+    for (const callee of new Set(edges.get(name))) {
+      if (!pending.has(callee)) continue;
+      run.set(callee, Math.max(run.get(callee) ?? 0, depth));
+      const left = pending.get(callee)! - 1;
+      pending.set(callee, left);
+      if (left === 0) ready.push(callee);
+    }
+  }
+  return chosen;
 }
 
 /** Functions on a cycle of the call graph (Tarjan's strongly connected

packages/compiler/src/backend/native-toolchain.test.ts

@@ -39,6 +39,8 @@ import {
   warmNativeCaches,
 } from "./native-toolchain.js";
 import { splitLlvmProgram } from "./llvm/split.js";
+import { implicitToolchainFingerprints } from "./native/compiler-fingerprint.js";
+import { fingerprintDependencyPaths } from "./native/dependency-files.js";
 
 const scratch: string[] = [];
 const TEST_CACHE_IDENTITY = "cc-cache-tests-v1";
@@ -326,9 +328,9 @@ test.skipIf(
 
       let vendorEntries = await readdir(vendorRoot);
       expect(vendorEntries.filter((name) => name.startsWith("mbedtls-")).length).toBe(2);
-      // Host clang uses system zlib, so only the Zig build materializes a zlib
-      // object family in the shared vendor root.
-      expect(vendorEntries.filter((name) => name.startsWith("zlib-")).length).toBe(1);
+      // Host clang and Zig each materialize their own vendored zlib object
+      // family in the shared vendor root.
+      expect(vendorEntries.filter((name) => name.startsWith("zlib-")).length).toBe(2);
       // Invalidate the host archive. A targetless Zig rebuild must continue to
       // use the separately keyed Zig archive instead of repairing or consuming
       // the host-clang entry.
@@ -630,20 +632,27 @@ test.skipIf(clangExecutable === undefined)(
   async () => {
     // clang ships its x86 intrinsic headers (<emmintrin.h>, ...) for every
     // target, so __has_include finds them on arm64, where including them is
-    // an #error, and the same holds for the ARM headers on x86. The probe
-    // must guard them by target. Only the compiler's own freestanding
-    // headers are visible here, so the result does not depend on the host's
-    // C library.
+    // an #error, and the same holds for the ARM headers on x86 and for
+    // <riscv_vector.h> (zlib's RVV code) outside RISC-V with the vector
+    // extension. The probe must guard them by target. Only the compiler's own
+    // freestanding headers are visible here, so the result does not depend on
+    // the host's C library.
     const includes = (await implicitDependencyProbeIncludes(runtimeSrcDir())).filter(
       (include) =>
-        include !== "<intrin.h>" && /intrin\.h>$|^<cpuid\.h>$|^<arm_(neon|acle)\.h>$/.test(include),
+        include !== "<intrin.h>" &&
+        /intrin\.h>$|^<cpuid\.h>$|^<arm_(neon|acle)\.h>$|^<riscv_vector\.h>$/.test(include),
     );
     expect(includes).toContain("<emmintrin.h>");
+    expect(includes).toContain("<riscv_vector.h>");
     const resourceDir = execFileSync(clangExecutable!, ["-print-resource-dir"], {
       encoding: "utf8",
     }).trim();
     const source = includes.map(implicitDependencyIncludeDirective).join("");
-    for (const target of ["aarch64-unknown-linux-gnu", "x86_64-unknown-linux-gnu"]) {
+    for (const target of [
+      "aarch64-unknown-linux-gnu",
+      "riscv64-unknown-linux-gnu",
+      "x86_64-unknown-linux-gnu",
+    ]) {
       const result = spawnSync(
         clangExecutable!,
         [
@@ -665,6 +674,29 @@ test.skipIf(clangExecutable === undefined)(
   },
 );
 
+test.skipIf(clangExecutable === undefined)(
+  "the implicit toolchain probe leaves out a header the compiler rejects",
+  async () => {
+    // A system header that the runtime spells, shadowed by one that is an
+    // #error, as clang 18's <riscv_vector.h> is outside RISC-V. The probe
+    // still covers the other headers.
+    const dir = await mkdtemp(join(tmpdir(), "scriptc-probe-header-"));
+    scratch.push(dir);
+    await mkdir(join(dir, "sys"));
+    const rejected = join(dir, "sys", "auxv.h");
+    await writeFile(rejected, '#error "not for this target"\n');
+    const includes = await implicitDependencyProbeIncludes(runtimeSrcDir());
+    expect(includes).toContain("<sys/auxv.h>");
+    const fingerprints = await implicitToolchainFingerprints(
+      { argv: [clangExecutable!, "-isystem", dir], targetArgs: [], target: null },
+      "probe-rejected-header",
+    );
+    const dependencies = fingerprintDependencyPaths(fingerprints.complete);
+    expect(dependencies).not.toContain(rejected);
+    expect(dependencies.some((path) => path.endsWith("/stdatomic.h"))).toBe(true);
+  },
+);
+
 test.skipIf(
   process.platform === "win32" ||
     clangExecutable === undefined ||

packages/compiler/src/backend/native/compiler-fingerprint.ts

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { type CcDriver } from "./driver.js";
 import { resolvedToolIdentity, resolvedTool } from "./tool-identity.js";
 import { execFileAsync } from "./process.js";
@@ -168,7 +168,7 @@ export function effectiveCompilerInvocationFingerprint(
 export async function implicitDependencyProbeIncludes(rtDir: string): Promise<string[]> {
   const vendor = join(rtDir, "..", "vendor");
   const quickjsSources = new Set<string>(LRE_SOURCES);
-  const zlibSources = new Set<string>(ZLIB_SOURCES);
+  const zlibSources = new Set<string>(ZLIB_SOURCES.map((source) => basename(source)));
   const fileGroups = await Promise.all([
     nativeSourceFiles(rtDir, false),
     nativeSourceFiles(join(vendor, "ryu"), false),
@@ -181,7 +181,7 @@ export async function implicitDependencyProbeIncludes(rtDir: string): Promise<st
     nativeSourceFiles(join(vendor, "mbedtls", "library"), true),
     nativeSourceFiles(
       join(vendor, "zlib"),
-      false,
+      true,
       (name) => name.endsWith(".h") || zlibSources.has(name),
     ),
   ]);
@@ -199,13 +199,16 @@ export async function implicitDependencyProbeIncludes(rtDir: string): Promise<st
  * __has_include finds them on arm64 too, where including them is an
  * #error. Covers the SSE/AVX intrinsic families (<emmintrin.h>,
  * <immintrin.h>, ...), <x86intrin.h>, <x86gprintrin.h> and <cpuid.h>. */
+/** clang's x86 intrinsic headers: every <...intrin.h> but the Windows
+ * <intrin.h> (<xsaveintrin.h>, <immintrin.h>, ...), and <cpuid.h>. */
 function x86OnlyHeader(include: string): boolean {
-  return include === "<cpuid.h>" || /^<(x86|x86gpr|[a-z]*mm)intrin\.h>$/.test(include);
+  return include === "<cpuid.h>" || /^<[a-z0-9_]+intrin\.h>$/.test(include);
 }
 
 /** One guarded line of the implicit-toolchain probe source: the header is
  * included only when the compiler can find it and it belongs to the target
- * being probed. */
+ * being probed. clang ships <riscv_vector.h> for every target, and through
+ * clang 18 including it without the RISC-V vector extension is an #error. */
 export function implicitDependencyIncludeDirective(include: string): string {
   const targetCondition = x86OnlyHeader(include)
     ? " && (defined(__i386__) || defined(__x86_64__) || defined(_M_IX86) || defined(_M_X64))"
@@ -213,7 +216,9 @@ export function implicitDependencyIncludeDirective(include: string): string {
       ? " && defined(_WIN32)"
       : include === "<arm64_neon.h>" || include === "<arm_acle.h>" || include === "<arm_neon.h>"
         ? " && (defined(__arm__) || defined(__aarch64__) || defined(_M_ARM) || defined(_M_ARM64))"
-        : "";
+        : include === "<riscv_vector.h>"
+          ? " && defined(__riscv_vector)"
+          : "";
   return `#if __has_include(${include})${targetCondition}\n#include ${include}\n#endif\n`;
 }
 
@@ -394,11 +399,8 @@ async function implicitToolchainFingerprintsFresh(
       ];
       const [dependencyResults, linker, assembler, compilerInvocation] = await Promise.all([
         Promise.all(
-          sources.map((source) =>
-            execFileAsync(compiler, [...probeArgs, source], {
-              cwd: probeDir,
-              maxBuffer: 16 * 1024 * 1024,
-            }),
+          sources.map((source, index) =>
+            probeIncludeDependencies(compiler, probeArgs, probeDir, source, sourceGroups[index]!),
           ),
         ),
         execFileAsync(compiler, [...prefix, "-print-prog-name=ld"], { cwd: probeDir }),
@@ -418,14 +420,7 @@ async function implicitToolchainFingerprintsFresh(
       const toolSpellings = [linker.stdout.trim(), assemblerSpelling].filter(
         (value, index, all) => value !== "" && all.indexOf(value) === index,
       );
-      const sourceSet = new Set(sources);
-      const dependencyPaths = [
-        ...new Set(
-          dependencyResults
-            .flatMap((dependencies) => parseMakeDependencies(dependencies.stdout))
-            .filter((path) => !sourceSet.has(path)),
-        ),
-      ].sort();
+      const dependencyPaths = [...new Set(dependencyResults.flat())].sort();
       probe = {
         compilerIdentity: compilerIdentity ?? `<unresolved>\0${compiler}`,
         compilerInvocation: normalizedProbeInvocation(compilerInvocation, probeDir),
@@ -508,6 +503,51 @@ async function implicitToolchainFingerprintsFresh(
   };
 }
 
+/** Headers the dependency probe preprocesses at a time when it probes them
+ * one by one. */
+const SINGLE_HEADER_PROBES = 8;
+
+/** The files the compiler reads to preprocess `source`, a probe source that
+ * includes `includes`, apart from the probe's own sources. When the compiler
+ * rejects `source`, for example for a header it finds that is an #error
+ * outside its target (<riscv_vector.h> through clang 18 without the RISC-V
+ * vector extension), each header is preprocessed on its own, and a header
+ * that the compiler rejects on its own is left out, as an absent one is.
+ * Throws the compiler's error when it rejects every header. */
+async function probeIncludeDependencies(
+  compiler: string,
+  probeArgs: readonly string[],
+  probeDir: string,
+  source: string,
+  includes: readonly string[],
+): Promise<string[]> {
+  const dependencies = async (path: string): Promise<string[]> => {
+    const result = await execFileAsync(compiler, [...probeArgs, path], {
+      cwd: probeDir,
+      maxBuffer: 16 * 1024 * 1024,
+    });
+    return parseMakeDependencies(result.stdout).filter((dependency) => dependency !== path);
+  };
+  try {
+    return await dependencies(source);
+  } catch (error) {
+    const found: string[][] = [];
+    for (let start = 0; start < includes.length; start += SINGLE_HEADER_PROBES) {
+      const batch = includes.slice(start, start + SINGLE_HEADER_PROBES);
+      const results = await Promise.all(
+        batch.map(async (include, offset) => {
+          const single = `${source.slice(0, -2)}-${start + offset}.c`;
+          await writeFile(single, implicitDependencyIncludeDirective(include));
+          return dependencies(single).catch(() => null);
+        }),
+      );
+      for (const result of results) if (result !== null) found.push(result);
+    }
+    if (found.length === 0) throw error;
+    return found.flat();
+  }
+}
+
 const stableImplicitToolchainMemos = new Map<string, Promise<ImplicitToolchainFingerprints>>();
 export function implicitToolchainFingerprints(
   driver: Pick<CcDriver, "argv" | "targetArgs" | "target">,

packages/compiler/src/backend/native/contracts.ts

@@ -76,14 +76,9 @@ export interface CcOptions {
   fetch?: boolean;
   /** The program uses zlib (index.ts detects zlib.* libCalls on the IR):
    * compiles scr_zlib.c — the regex gating precedent, so zlib-free
-   * binaries keep their exact link line. The default host-clang build links
-   * the SYSTEM libz (macOS ships it), byte-identical to the historical line;
-   * every Zig build compiles the vendored zlib with the selected driver instead
-   * (ensureZlibObjects — zig has no libz in its sysroots). Compressed bytes may
-   * differ between the
-   * system and vendored libraries, which is why the corpus only ever
-   * compares round-trips and fixed-blob inflation, never raw deflate
-   * output. */
+   * binaries keep their exact link line. Every driver compiles the vendored
+   * zlib, the copy Node bundles (ensureZlibObjects), so compressed bytes match
+   * Node's. */
   zlib?: boolean;
   /** The program uses node:zlib's Brotli forms (with zlib): compiles
    * scr_brotli.c and links the vendored brotli archive. */

packages/compiler/src/backend/native/executable.ts

@@ -217,18 +217,13 @@ const RUNTIME_UNITS: readonly RuntimeUnit[] = [
   // Blob and File (every blob.* call selects dynAsync, whose unit boxes
   // their reads as dyn promises).
   unit((u) => u.opts.dynAsync, "scr_blob.c"),
-  // The zlib UNIT (scr_zlib.c) gates on zlib.* IR use; the LINK (system
-  // libz on the default host-clang build, vendored objects on Zig builds)
-  // also serves the native fetch's gzip decoder — spread exactly once.
+  // The zlib UNIT (scr_zlib.c) gates on zlib.* IR use; the vendored zlib
+  // objects also serve the native fetch's gzip decoder — spread exactly once.
   unitArgs((u) =>
     u.opts.zlib
-      ? isZigDriver(u.driver)
-        ? ["-I", vendorZlibDir(), u.rt(join(u.rtDir, "scr_zlib.c")), ...u.zlibObjects]
-        : [u.rt(join(u.rtDir, "scr_zlib.c"))]
+      ? ["-I", vendorZlibDir(), u.rt(join(u.rtDir, "scr_zlib.c")), ...u.zlibObjects]
       : u.nativeFetch
-        ? isZigDriver(u.driver)
-          ? ["-I", vendorZlibDir(), ...u.zlibObjects]
-          : []
+        ? ["-I", vendorZlibDir(), ...u.zlibObjects]
         : [],
   ),
   // Brotli (scr_brotli.c) plugs into the zlib engine and links the
@@ -390,7 +385,7 @@ const RUNTIME_DEFINES: readonly {
   when: (opts: CcOptions) => boolean | undefined;
 }[] = [
   { define: "SCR_TEXT_DECODER_LEGACY", when: (opts) => opts.textDecoderLegacy },
-  // Checked objects carry the dynamic tier's shapes (scr_json.c's SCR_JS_TIER build); only
+  // scr_json.c's SCR_JS_TIER build exports the dynamic tier's cache primitives; only
   // programs with dynamic-tier code select it.
   { define: "SCR_JS_TIER", when: (opts) => opts.dynTier === true },
   { define: "SCR_WARNING_REPLACE", when: (opts) => opts.warningReplace },
@@ -676,11 +671,11 @@ export async function compileCInternal(
   let lreObjects = regex
     ? lreObjectPaths(sanitize, driver, vendorBuildIdentity, vendorCacheRoot)
     : [];
-  // Vendored zlib is the Zig story — default host-clang builds keep the exact
-  // historical `-lz` system link (see CcOptions.zlib). The native fetch's
-  // gzip decoder rides the same objects/link.
+  // Every driver links the vendored zlib (the copy Node bundles), so
+  // compressed bytes match Node's. The native fetch's gzip decoder rides the
+  // same objects.
   let zlibObjects =
-    ((opts.zlib ?? false) || nativeFetch) && isZigDriver(driver)
+    (opts.zlib ?? false) || nativeFetch
       ? zlibObjectPaths(sanitize, driver, vendorBuildIdentity, vendorCacheRoot)
       : [];
   const materializeVendorPrerequisites = async (
@@ -829,11 +824,6 @@ export async function compileCInternal(
     ...(opts.linkInputs ?? []),
     ...(opts.systemLibraries ?? []).map((name) => `-l${name}`),
     ...(opts.frameworks ?? []).flatMap((name) => ["-framework", name]),
-    // GNU ld resolves libraries from left to right and commonly enables
-    // --as-needed: host-clang libz must follow scr_zlib.c/scr_fetch.c and every
-    // generated/native input that references inflate symbols. Cross
-    // and targetless Zig builds use vendored zlib objects in the input section above.
-    ...(((opts.zlib ?? false) || nativeFetch) && !isZigDriver(driver) ? ["-lz"] : []),
     ...unwinderLinkArgs(driver),
     // glibc keeps libm separate from libc. This must trail the generated
     // program and every native FFI input because GNU ld resolves archives
@@ -1087,7 +1077,6 @@ export async function compileCInternal(
     ...(targetPlatform(driver) === "win32" ? ["-ladvapi32", "-liphlpapi", "-lws2_32"] : []),
     ...(mbedtls && targetPlatform(driver) === "win32" ? ["-lbcrypt"] : []),
     ...(tlsCa && targetPlatform(driver) === "win32" ? ["-lcrypt32"] : []),
-    ...(((opts.zlib ?? false) || nativeFetch) && !isZigDriver(driver) ? ["-lz"] : []),
     ...unwinderLinkArgs(driver),
     ...driver.linkArgs,
     ...executableLinkFlags,
@@ -1100,7 +1089,6 @@ export async function compileCInternal(
     ...(targetPlatform(driver) === "win32" ? ["-ladvapi32", "-liphlpapi", "-lws2_32"] : []),
     ...(mbedtls && targetPlatform(driver) === "win32" ? ["-lbcrypt"] : []),
     ...(tlsCa && targetPlatform(driver) === "win32" ? ["-lcrypt32"] : []),
-    ...(((opts.zlib ?? false) || nativeFetch) && !isZigDriver(driver) ? ["-lz"] : []),
     ...unwinderLinkArgs(driver),
     ...driver.linkArgs,
     ...executableLinkFlags,

packages/compiler/src/backend/native/library.ts

@@ -78,9 +78,8 @@ import { CacheInputsChangedError } from "./session.js";
  * External-symbol contract: undefined references only to the target's C/math
  * runtime and system APIs. Windows embedders additionally link advapi32,
  * iphlpapi, and ws2_32; the platform driver supplies its ordinary CRT and
- * kernel imports. Zlib rides the VENDORED per-flavor objects here even on
- * hosts because the executable lane's system `-lz` cannot ride inside an
- * archive. */
+ * kernel imports. Zlib rides the vendored per-flavor objects, as in the
+ * executable lane. */
 
 export async function compileLibArchive(opts: LibArchiveOptions): Promise<void> {
   clearCcCaches();

packages/compiler/src/backend/native/runtime-inputs.ts

@@ -70,6 +70,7 @@ export const EXECUTABLE_RUNTIME_SOURCES = [
   "scr_cycle.c",
   "scr_publish.c",
   "scr_region.c",
+  "scr_arena.c",
   "scr_itable.c",
   "scr_slots.c",
   "scr_alloc.c",

packages/compiler/src/backend/vendor-archives.ts

@@ -18,6 +18,12 @@ const execFileAsync = promisify(execFile);
  * runtime pack's executable_section_elimination flags). */
 const LRE_SECTION_FLAGS = ["-ffunction-sections", "-fdata-sections"];
 
+/** A vendored source's object file name: sources in subdirectories
+ * (zlib's contrib/optimizations/inflate.c) flatten to one directory. */
+function vendorObjectName(source: string): string {
+  return source.replaceAll("/", "-").replace(/\.c$/, ".o");
+}
+
 import {
   QJS_COMMIT,
   MBEDTLS_VERSION,
@@ -25,6 +31,7 @@ import {
   BROTLI_VERSION,
   LRE_SOURCES,
   ZLIB_SOURCES,
+  zlibInputs,
 } from "./vendor-inputs.js";
 export {
   QJS_COMMIT,
@@ -243,11 +250,18 @@ export function createVendorArchives(context: VendorArchiveContext) {
     return join(runtimeSrcDir(), "..", "vendor", "zlib");
   }
 
-  /** The vendored zlib TUs behind Zig zlib support: every root *.c
-   * except the gzFile file-I/O units (gz*.c — nothing in scr_zlib.c
-   * references the gzFile API, and those TUs alone want unistd/io headers).
-   * The default host-clang build links the system libz; Zig builds use this
-   * list so targetless and explicit-target Zig inputs stay on one toolchain. */
+  /** The vendored zlib TUs every C-lane build links (zlibInputs picks them
+   * per target; the gzFile file-I/O units are never compiled, nothing in
+   * scr_zlib.c references the gzFile API). */
+
+  /** The triple zlibInputs reads for a driver: its explicit target, else
+   * the host. */
+  function zlibTriple(driver: Pick<CcDriver, "target">): string {
+    if (driver.target !== null) return driver.target;
+    const cpu =
+      process.arch === "x64" ? "x86_64" : process.arch === "arm64" ? "aarch64" : process.arch;
+    return `${cpu}-${process.platform === "win32" ? "windows" : process.platform}`;
+  }
 
   function zlibObjectPaths(
     sanitize: boolean,
@@ -260,15 +274,15 @@ export function createVendorArchives(context: VendorArchiveContext) {
       (driver.argv.length === 1 && driver.argv[0] === "clang" ? "" : "-zigcc") +
       `-${vendorCacheTargetFlavor(driver)}-${buildIdentity}`;
     const cacheDir = join(cacheRoot, `zlib-${ZLIB_VERSION}-${flavor}`);
-    return ZLIB_SOURCES.map((f) => join(cacheDir, f.replace(/\.c$/, ".o")));
+    return zlibInputs(zlibTriple(driver)).sources.map((f) => join(cacheDir, vendorObjectName(f)));
   }
 
   /** The zlib objects for one flavor, compiled lazily on the first zlib-using
-   * Zig build (~1s) and cached like the lre objects —
+   * C-lane build (~1s) and cached like the lre objects —
    * <build-cache>/vendor/zlib-<version>-<flavor>-<target>-<toolchain>/*.o — with the same atomic-rename
    * publish (parallel first builds race safely; losers discard their work).
-   * Plain is -Os, asan matches the final link so the sanitized lane
-   * instruments the codec too. The flavor keys the driver and target exactly
+   * Plain is -O3, as Node builds zlib; asan matches the final link so the
+   * sanitized lane instruments the codec too. The flavor keys the driver and target exactly
    * like the lre flavor: the keying
    * must never hand a zig-built object set to a clang link off a shared
    * directory. */
@@ -282,6 +296,7 @@ export function createVendorArchives(context: VendorArchiveContext) {
       (sanitize ? "asan" : "plain") +
       (driver.argv.length === 1 && driver.argv[0] === "clang" ? "" : "-zigcc") +
       `-${vendorCacheTargetFlavor(driver)}-${buildIdentity}`;
+    const inputs = zlibInputs(zlibTriple(driver));
     return ensureVendorObjects({
       sanitize,
       driver,
@@ -289,8 +304,9 @@ export function createVendorArchives(context: VendorArchiveContext) {
       flavor,
       name: "zlib",
       vendor: vendorZlibDir(),
-      sources: ZLIB_SOURCES,
+      sources: inputs.sources,
       objects: zlibObjectPaths(sanitize, driver, buildIdentity, cacheRoot),
+      flags: [...(sanitize ? [] : ["-O3"]), ...inputs.defines.map((define) => `-D${define}`)],
     });
   }
 
@@ -327,7 +343,7 @@ export function createVendorArchives(context: VendorArchiveContext) {
             "-c",
             join(vendor, f),
             "-o",
-            join(buildDir, f.replace(/\.c$/, ".o")),
+            join(buildDir, vendorObjectName(f)),
           ],
           { cwd: buildDir },
         );

packages/compiler/src/backend/vendor-inputs.test.ts

@@ -0,0 +1,80 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { expect, test } from "vitest";
+import { ZLIB_SOURCES, zlibInputs } from "./vendor-inputs.js";
+
+const repoRoot = fileURLToPath(new URL("../../../..", import.meta.url));
+const zlibDir = join(repoRoot, "packages/runtime/vendor/zlib");
+
+const TRIPLES = [
+  // The runtime packs' targets.
+  "x86_64-unknown-linux-gnu",
+  "x86_64-unknown-linux-musl",
+  "aarch64-unknown-linux-gnu",
+  "aarch64-unknown-linux-musl",
+  "aarch64-unknown-linux-android26",
+  "arm64-apple-macosx14.0.0",
+  "x86_64-apple-macosx14.0.0",
+  "arm64-apple-ios15.0",
+  "arm64-apple-ios15.0-simulator",
+  "x86_64-pc-windows-msvc",
+  "wasm32-unknown-wasi",
+  // Zig cross targets and host spellings.
+  "x86_64-linux-gnu",
+  "aarch64-linux-musl",
+  "aarch64-macos",
+  "x86_64-windows-gnu",
+  "aarch64-windows-gnu",
+  "wasm32-wasi",
+  "x86_64-linux",
+  "aarch64-darwin",
+];
+
+test("the compiler's zlib inputs match the runtime packs' for every target", async () => {
+  const packInputs = (await import(
+    pathToFileURL(join(repoRoot, "packages/runtime-pack-common/scripts/zlib-inputs.mjs")).href
+  )) as { zlibInputs(triple: string): { sources: string[]; defines: string[] } };
+  for (const triple of TRIPLES) {
+    expect(zlibInputs(triple), triple).toEqual(packInputs.zlibInputs(triple));
+  }
+});
+
+test("every zlib input exists, and ZLIB_SOURCES lists every source a target compiles", () => {
+  const listed = new Set<string>(ZLIB_SOURCES);
+  for (const triple of TRIPLES) {
+    for (const source of zlibInputs(triple).sources) {
+      expect(listed.has(source), `${triple}: ${source}`).toBe(true);
+      expect(existsSync(join(zlibDir, source)), source).toBe(true);
+    }
+  }
+});
+
+test("zlib inputs follow Node's deps/zlib/zlib.gyp", () => {
+  const x64 = zlibInputs("x86_64-unknown-linux-gnu");
+  expect(x64.sources).toContain("adler32_simd.c");
+  expect(x64.sources).toContain("contrib/optimizations/inflate.c");
+  expect(x64.sources).not.toContain("inflate.c");
+  expect(x64.defines).toEqual([
+    "HAVE_HIDDEN",
+    "ADLER32_SIMD_SSSE3",
+    "X86_NOT_WINDOWS",
+    "INFLATE_CHUNK_SIMD_SSE2",
+    "INFLATE_CHUNK_READ_64LE",
+    "DEFLATE_SLIDE_HASH_SSE2",
+  ]);
+  expect(zlibInputs("x86_64-pc-windows-msvc").defines).toContain("X86_WINDOWS");
+  const mac = zlibInputs("arm64-apple-macosx14.0.0");
+  expect(mac.sources).toContain("crc32_simd.c");
+  expect(mac.defines).toContain("ARMV8_OS_MACOS");
+  expect(mac.defines).toContain("CRC32_ARMV8_CRC32");
+  const ios = zlibInputs("arm64-apple-ios15.0");
+  expect(ios.sources).not.toContain("crc32_simd.c");
+  expect(ios.defines).not.toContain("CRC32_ARMV8_CRC32");
+  expect(ios.defines).toContain("INFLATE_CHUNK_SIMD_NEON");
+  expect(zlibInputs("aarch64-unknown-linux-android26").defines).toContain("ARMV8_OS_LINUX");
+  const wasm = zlibInputs("wasm32-unknown-wasi");
+  expect(wasm.sources).toContain("inflate.c");
+  expect(wasm.sources).not.toContain("contrib/optimizations/inflate.c");
+  expect(wasm.defines).toEqual(["HAVE_HIDDEN", "CPU_NO_SIMD"]);
+});

packages/compiler/src/backend/vendor-inputs.ts

@@ -1,22 +1,98 @@
 /** The pinned QuickJS, mbedTLS, zlib, and brotli inputs used by native recipes. */
 export const QJS_COMMIT = "3c8f3d68953955950074c41c6e4d999562ae82a7";
 export const MBEDTLS_VERSION = "3.6.7";
-export const ZLIB_VERSION = "1.3.1";
+/** The zlib Node v24.22.0 bundles (`process.versions.zlib` there), the
+ * Chromium fork in Node's deps/zlib (packages/runtime/vendor/zlib). */
+export const ZLIB_VERSION = "1.3.2.1-motley-285e94b";
 /** The brotli release Node v24.22.0 bundles (packages/runtime/vendor/brotli). */
 export const BROTLI_VERSION = "1.2.0";
 /** Exact translation-unit membership shared by cache builds and external
  * source-pack recipes. */
 export const LRE_SOURCES = ["libregexp.c", "libunicode.c"] as const;
-export const ZLIB_SOURCES = [
+const ZLIB_COMMON_SOURCES = [
   "adler32.c",
   "compress.c",
+  "cpu_features.c",
   "crc32.c",
   "deflate.c",
   "infback.c",
   "inffast.c",
-  "inflate.c",
   "inftrees.c",
   "trees.c",
   "uncompr.c",
   "zutil.c",
 ] as const;
+
+/** Every zlib translation unit some target compiles (zlibInputs). */
+export const ZLIB_SOURCES = [
+  ...ZLIB_COMMON_SOURCES,
+  "adler32_simd.c",
+  "crc32_simd.c",
+  "inflate.c",
+  "contrib/optimizations/inffast_chunk.c",
+  "contrib/optimizations/inflate.c",
+] as const;
+
+/** The zlib translation units and defines for a target, chosen the way
+ * Node's deps/zlib/zlib.gyp chooses them. The SIMD units carry their own
+ * target attributes and check the CPU at run time, so every unit builds with
+ * the same flags, and compressed output does not depend on the choice.
+ * packages/runtime-pack-common/scripts/zlib-inputs.mjs keeps the same table
+ * for the runtime packs. `triple` is an LLVM or Zig target triple. */
+export function zlibInputs(triple: string): { sources: string[]; defines: string[] } {
+  const [cpu = "", ...rest] = triple.split("-");
+  const system = rest.join("-");
+  const architecture =
+    cpu === "x86_64" || cpu === "amd64"
+      ? "x64"
+      : cpu === "aarch64" || cpu === "arm64"
+        ? "arm64"
+        : cpu;
+  const ios = system.includes("ios");
+  const windows =
+    system.includes("windows") || system.includes("win32") || system.includes("mingw");
+  // Android reads the CPU features through getauxval, as Linux does: Node's
+  // ARMV8_OS_ANDROID path needs the NDK's cpu-features library.
+  const linux = system.includes("linux") || system.includes("android");
+  const mac = !ios && (system.includes("darwin") || system.includes("macos"));
+  const sources: string[] = [...ZLIB_COMMON_SOURCES];
+  const defines = windows ? [] : ["HAVE_HIDDEN"];
+  if (architecture === "x64" && !ios) {
+    sources.push(
+      "adler32_simd.c",
+      "contrib/optimizations/inffast_chunk.c",
+      "contrib/optimizations/inflate.c",
+    );
+    defines.push(
+      "ADLER32_SIMD_SSSE3",
+      windows ? "X86_WINDOWS" : "X86_NOT_WINDOWS",
+      "INFLATE_CHUNK_SIMD_SSE2",
+      "INFLATE_CHUNK_READ_64LE",
+      "DEFLATE_SLIDE_HASH_SSE2",
+    );
+  } else if (architecture === "arm64") {
+    sources.push("contrib/optimizations/inffast_chunk.c", "contrib/optimizations/inflate.c");
+    defines.push(
+      "INFLATE_CHUNK_SIMD_NEON",
+      "INFLATE_CHUNK_READ_64LE",
+      "__ARM_NEON__",
+      "DEFLATE_SLIDE_HASH_NEON",
+    );
+    if (windows) {
+      defines.push("ARMV8_OS_WINDOWS");
+    } else if (linux || mac) {
+      // Node builds the Adler-32 and CRC-32 units for every arm64 target but
+      // iOS and Windows.
+      sources.push("adler32_simd.c", "crc32_simd.c");
+      defines.push(
+        "ADLER32_SIMD_NEON",
+        "CRC32_ARMV8_CRC32",
+        linux ? "ARMV8_OS_LINUX" : "ARMV8_OS_MACOS",
+      );
+    }
+  } else {
+    sources.push("inflate.c");
+    defines.push("CPU_NO_SIMD");
+  }
+  return { sources, defines };
+}

packages/compiler/src/contracts/check.ts

@@ -519,8 +519,10 @@ class ContractChecker {
           for (const fn of this.fnByLoc.get(key) ?? []) targets.push({ fn, note });
     if (targets.length === 0) return;
     // Target-independent: the native stack guard (Linux, macOS) counts, so a
-    // contract holds on every platform.
-    const mt = computeMayThrow(this.mod, { stackChecks: true, explain: true });
+    // contract holds on every platform. Every function on a call cycle counts
+    // as checking it, a superset of the functions the backend picks, so the
+    // answer does not depend on that choice.
+    const mt = computeMayThrow(this.mod, { stackChecks: "everyCycleMember", explain: true });
     const proven: string[] = [];
     for (const { fn, note } of targets) {
       if (fn.async === true || fn.generator !== undefined) {
@@ -1582,6 +1584,15 @@ class ImmutableContracts {
     for (let steps = 0; steps < 16; steps++) {
       if (root.kind === "fieldGet" || root.kind === "recordGet") root = root.obj;
       else if (root.kind === "arrayGet") root = root.arr;
+      else if (root.kind === "seqExpr") root = root.result;
+      // A receiver that is the element when it is present and otherwise
+      // throws (`xs[i]!.push(v)`) is that element read.
+      else if (
+        root.kind === "ternary" &&
+        root.else_.kind === "libCall" &&
+        root.else_.fn === "error.nodeThrow"
+      )
+        root = root.then;
       else if (
         root.kind === "upcast" ||
         root.kind === "downcast" ||

packages/compiler/src/frontend/contract-types.ts

@@ -12,6 +12,7 @@ import type { ScrDiagnostic } from "../diagnostics/diagnostic.js";
 import type { SrcLoc } from "../ir/ir.js";
 import { locOf } from "./program.js";
 import * as ts from "./ts7/adapter.js";
+import { type HeritageElement, isHeritageElement } from "./heritage-elements.js";
 
 export const CONTRACT_TYPES_MODULE = "@scriptc/types";
 
@@ -87,11 +88,11 @@ function markerOf(checker: ts.TypeChecker, ref: ts.TypeReferenceNode): ContractM
 }
 
 /** The marker a heritage clause names (`implements Acyclic`,
- * `implements sc.ProgramLifetime`). */
-function markerOfHeritage(
-  checker: ts.TypeChecker,
-  node: ts.ExpressionWithTypeArguments,
-): ContractMarker | null {
+ * `implements sc.ProgramLifetime`), as an ExpressionWithTypeArguments or,
+ * in TypeScript 7.1's interface `extends` and class `implements`, a
+ * TypeReference. */
+function markerOfHeritage(checker: ts.TypeChecker, node: HeritageElement): ContractMarker | null {
+  if (ts.isTypeReferenceNode(node)) return markerOf(checker, node);
   const e = node.expression;
   if (ts.isIdentifier(e)) return markerNamed(checker, e, e.text, false);
   if (ts.isPropertyAccessExpression(e) && ts.isIdentifier(e.expression) && ts.isIdentifier(e.name))
@@ -169,7 +170,7 @@ export function collectContractAnnotations(
     ts.walkPreorder(
       sf,
       (node) => {
-        if (ts.isExpressionWithTypeArguments(node)) {
+        if (isHeritageElement(node)) {
           const marker = markerOfHeritage(checker, node);
           if (marker === null) return;
           out.count++;
@@ -232,7 +233,7 @@ function unsupported(out: ContractAnnotations, node: ts.Node, marker: ContractMa
 function placeHeritage(
   out: ContractAnnotations,
   checker: ts.TypeChecker,
-  node: ts.ExpressionWithTypeArguments,
+  node: HeritageElement,
   marker: ContractMarker,
   resolveUnit: ContractUnitResolver,
 ): void {

packages/compiler/src/frontend/heritage-elements.test.ts

@@ -0,0 +1,82 @@
+import { fileURLToPath } from "node:url";
+import { dirname } from "node:path";
+import { expect, test } from "vitest";
+import { collectContractAnnotations } from "./contract-types.js";
+import { isHeritageElement, heritageElementTarget } from "./heritage-elements.js";
+import * as ts from "./ts7/adapter.js";
+import { Ts7Api } from "./ts7/api.js";
+import { Ts7Host } from "./ts7/program-host.js";
+import { Ts7RpcClient } from "./ts7/rpc-client.js";
+import { TS7_FILE_SYSTEM_CALLBACKS } from "./ts7/rpc-filesystem.js";
+import { spawnTs7Wire } from "./ts7/rpc-process.js";
+import { ts7TestServers, type Ts7TestServer } from "./ts7/test-servers.js";
+
+const corpus = fileURLToPath(new URL("../../../../tests/corpus/", import.meta.url));
+
+/** Corpus programs whose classes implement contract markers and interfaces. */
+const programs = [
+  "4636-contract-program-lifetime-references.ts",
+  "5010-lifetime-region-generations.ts",
+  "7401-program-lifetime-array-teardown.ts",
+];
+
+function host(server: Ts7TestServer): Ts7Host {
+  return new Ts7Host(
+    (options) =>
+      new Ts7Api(
+        new Ts7RpcClient(
+          spawnTs7Wire(server.executable, [
+            "--api",
+            "--cwd",
+            options.cwd,
+            `--callbacks=${TS7_FILE_SYSTEM_CALLBACKS}`,
+          ]),
+        ),
+        options.fs,
+        options.collectTiming,
+      ),
+    { cwd: dirname(corpus) },
+  );
+}
+
+/** Each heritage element's clause token, kind and the text it refers to,
+ * and the program's contract annotations. */
+function facts(server: Ts7TestServer, file: string) {
+  const programHost = host(server);
+  try {
+    const program = programHost.createProgram([corpus + file], {
+      strict: true,
+      types: [],
+      target: ts.ScriptTarget.ESNext,
+    });
+    const source = program.getSourceFile(corpus + file)!;
+    const elements: string[] = [];
+    ts.walkPreorder(source, (node) => {
+      if (!isHeritageElement(node)) return undefined;
+      const clause = node.parent as ts.HeritageClause;
+      elements.push(
+        `${clause.token === ts.SyntaxKind.ImplementsKeyword ? "implements" : "extends"} ${ts.getTextOfNode(heritageElementTarget(node))}`,
+      );
+      return undefined;
+    });
+    const contracts = collectContractAnnotations(program.getTypeChecker(), [source]);
+    return {
+      elements,
+      classes: [...contracts.classes.values()].map((note) => `${note.marker} ${note.name}`),
+      acyclic: contracts.acyclic.map((entry) => entry.note.name),
+      diagnostics: contracts.diagnostics.map((diagnostic) => diagnostic.code),
+    };
+  } finally {
+    programHost.close();
+  }
+}
+
+test("heritage elements and the contracts they name read the same from tsc 7.0 and tsc 7.1", () => {
+  const [old, next] = ts7TestServers();
+  for (const file of programs) {
+    const expected = facts(old!, file);
+    expect(expected.classes.length, file).toBeGreaterThan(0);
+    expect(expected.diagnostics, file).toEqual([]);
+    expect(facts(next!, file), file).toEqual(expected);
+  }
+});

packages/compiler/src/frontend/heritage-elements.ts

@@ -0,0 +1,28 @@
+import * as ts from "./ts7/adapter.js";
+
+/** An element of a heritage clause. TypeScript 7.0 parses every element as
+ * an ExpressionWithTypeArguments. TypeScript 7.1 parses the elements of an
+ * interface's `extends` and a class's `implements` as TypeReference nodes,
+ * whose names are entity names (an Identifier or a QualifiedName); a class's
+ * `extends` element stays an ExpressionWithTypeArguments. */
+export type HeritageElement = ts.ExpressionWithTypeArguments | ts.TypeReferenceNode;
+
+/** Whether `node` is a TypeReference that is a heritage clause element. */
+export function isHeritageTypeReference(node: ts.Node): node is ts.TypeReferenceNode {
+  return (
+    ts.isTypeReferenceNode(node) && node.parent !== undefined && ts.isHeritageClause(node.parent)
+  );
+}
+
+/** Whether `node` is a heritage clause element in either form. */
+export function isHeritageElement(node: ts.Node): node is HeritageElement {
+  return ts.isExpressionWithTypeArguments(node) || isHeritageTypeReference(node);
+}
+
+/** The name or expression a heritage clause element refers to: its
+ * expression (an ExpressionWithTypeArguments) or its type name (a
+ * TypeReference). */
+export function heritageElementTarget(element: ts.Node): ts.Expression | ts.EntityName {
+  if (ts.isTypeReferenceNode(element)) return element.typeName;
+  return (element as ts.ExpressionWithTypeArguments).expression;
+}

packages/compiler/src/frontend/lowering/builtins/array-classes.ts

@@ -10,6 +10,7 @@ import * as ts from "../../ts7/adapter.js";
 import { type Lowerer } from "../lowerer.js";
 import { isJsSourceFile, locOf } from "../../program.js";
 import { stripTypeWrappers } from "../typed-arguments.js";
+import { keyedHelperName } from "../stable-names.js";
 import { dynUndefinedExpr, nodeThrowExpr } from "../../../ir/build.js";
 import { lowerArrayFromCall, lowerArrayOfCall } from "../containers/array-construction.js";
 import { boundedArrayHofHelper } from "../containers/array-callbacks.js";
@@ -305,6 +306,7 @@ export function lowerArrayClassInstanceOf(
   const value = lowerer.lowerExpr(expr.left);
   if (value.type.kind === "array")
     return { kind: "instanceOf", value, className: info.def.name, type: BOOL, loc };
+  if (value.type.kind === "union") return arrayClassUnionInstanceOf(lowerer, value, info, loc);
   if (value.type.kind === "dyn")
     return {
       kind: "libCall",
@@ -324,6 +326,62 @@ export function lowerArrayClassInstanceOf(
   return null;
 }
 
+/** `x instanceof X` for a class X declared `extends Array` on a union (an
+ * element read of an array of X instances is `X | undefined`): an array arm
+ * tests the array's class at run time, a checked-dynamic arm asks the
+ * runtime, and every other arm is no instance. */
+function arrayClassUnionInstanceOf(
+  lowerer: Lowerer,
+  value: IrExpr,
+  info: ClassInfo,
+  loc: SrcLoc,
+): IrExpr | null {
+  if (value.type.kind !== "union") return null;
+  const unionId = value.type.unionId;
+  const arms = lowerer.unions.get(unionId)?.arms;
+  if (arms === undefined) return null;
+  const className = info.def.name;
+  const key = `instanceof.arrayClass:${unionId}:${className}`;
+  let helper = lowerer.valueHelpers.get(key);
+  if (!helper) {
+    helper = keyedHelperName(lowerer, "%instanceof.arrayClass", key);
+    lowerer.valueHelpers.set(key, helper);
+    const param: IrExpr = { kind: "varRef", localId: "value.0", type: value.type, loc };
+    const body: IrStmt[] = [];
+    arms.forEach((arm, tag) => {
+      if (arm.kind !== "array" && arm.kind !== "dyn") return;
+      const narrowed: IrExpr = { kind: "unionNarrow", unionId, tag, value: param, type: arm, loc };
+      const test: IrExpr =
+        arm.kind === "array"
+          ? { kind: "instanceOf", value: narrowed, className, type: BOOL, loc }
+          : {
+              kind: "libCall",
+              fn: "array.dynIsClass",
+              args: [narrowed, { kind: "strLit", value: className, type: STRING, loc }],
+              type: BOOL,
+              loc,
+            };
+      body.push({
+        kind: "if",
+        cond: { kind: "unionIsTag", unionId, tag, negated: false, value: param, type: BOOL, loc },
+        then: [{ kind: "return", value: test, loc }],
+        else_: null,
+        loc,
+      });
+    });
+    body.push({ kind: "return", value: { kind: "boolLit", value: false, type: BOOL, loc }, loc });
+    lowerer.liftedFns.push({
+      name: helper,
+      params: [{ localId: "value.0", name: "value", type: value.type }],
+      returnType: BOOL,
+      locals: [{ id: "value.0", name: "value", type: value.type, mutable: false }],
+      body,
+      loc,
+    });
+  }
+  return { kind: "call", callee: helper, args: [value], type: BOOL, loc };
+}
+
 /** The class declared `extends Array` that a value of `type` is an instance
  * of, or null. */
 export function arrayClassOfType(lowerer: Lowerer, type: ts.Type): ClassInfo | null {

packages/compiler/src/frontend/lowering/class-dynamic-dispatch.test.ts

@@ -41,6 +41,7 @@ function context() {
     protocolDispatches: new Map(),
     classMethodValueSelections: new Map(),
     isSubclassOf: () => false,
+    nodeAtLoc: () => null,
   } as unknown as Lowerer;
   const boxed = fn("box", [
     statement({

packages/compiler/src/frontend/lowering/class-dynamic-dispatch.ts

@@ -38,6 +38,7 @@ import {
 import { streamTypedRefEligible } from "../../ir/analysis.js";
 import { everyStmtList, transformExpr, transformStmtList } from "../../ir/traverse.js";
 import { PoisonError, type Lowerer } from "./lowerer.js";
+import { isSloppyAt } from "./frozen-records.js";
 import { erasedGenericInstance, implicitDefaultInstance } from "./generic-functions.js";
 import { type ParamShape } from "./call-signatures.js";
 import {
@@ -2418,6 +2419,11 @@ export class ClassDynamicDispatch {
               computedRead.key.operand.type.kind === "f64"
                 ? computedRead.key
                 : null;
+            // A sloppy-mode write ignores a refused assignment
+            // (sloppyDynamicWrites), so its sites share their own helper,
+            // whose write takes the first such site's source range.
+            const sloppyWrite =
+              !!computedWrite && !reflect && isSloppyAt(lowerer, computedWrite.loc);
             const key = JSON.stringify([
               !!computedWrite,
               computedRead?.optional ?? false,
@@ -2426,6 +2432,7 @@ export class ClassDynamicDispatch {
               numericKey,
               reflect,
               !!indexKey,
+              ...(sloppyWrite ? ["sloppy"] : []),
             ]);
             let dispatch = this.computed.get(key);
             if (!dispatch) {

packages/compiler/src/frontend/lowering/expressions/binary.ts

@@ -37,6 +37,7 @@ import {
   dynCompoundValue,
   lowerAbsenceProbe,
   lowerDynMemberAssignment,
+  lowerDereferencedElementAssignment,
   lowerOptionalNumber,
   lowerPresenceOperand,
   nullishBranches,
@@ -334,6 +335,25 @@ function isMemberReceiver(node: ts.Expression): boolean {
   );
 }
 
+/** A literal default (`0`, `-1`, `""`, `true`): it always has its own type.
+ * Other defaults, such as an element read that can be undefined, keep the
+ * dynamic path. */
+function literalDefault(node: ts.Expression): boolean {
+  while (ts.isParenthesizedExpression(node)) node = node.expression;
+  if (
+    ts.isPrefixUnaryExpression(node) &&
+    (node.operator === ts.SyntaxKind.MinusToken || node.operator === ts.SyntaxKind.PlusToken)
+  )
+    node = node.operand;
+  return (
+    ts.isNumericLiteral(node) ||
+    ts.isStringLiteral(node) ||
+    ts.isNoSubstitutionTemplateLiteral(node) ||
+    node.kind === ts.SyntaxKind.TrueKeyword ||
+    node.kind === ts.SyntaxKind.FalseKeyword
+  );
+}
+
 export function lowerNullishPair(
   lowerer: Lowerer,
   expr: ts.BinaryExpression,
@@ -388,6 +408,26 @@ export function lowerNullishPair(
     lowerer.runtimeOptionalArithmeticTypes.set(expr, type);
   }
   if (type.kind === "dyn" && lowerer.dynConvertible(left.type)) {
+    // `counts.get(k) ?? 0` in JavaScript: a scalar optional left and a
+    // default of its value's type give a scalar, so the test and the default
+    // run on the typed path and only the result converts. Converting the
+    // optional left itself would allocate a union for every read.
+    if (
+      rest.length === 1 &&
+      primitive(rest[0]!) &&
+      rightType &&
+      typeEquals(rightType, rest[0]!) &&
+      literalDefault(expr.right)
+    ) {
+      const typed: IrExpr = {
+        kind: "nullish",
+        left,
+        right: lowerer.lowerExprExpecting(expr.right, rest[0]!),
+        type: rest[0]!,
+        loc,
+      };
+      return lowerer.coerceToExpected(typed, DYN);
+    }
     return {
       kind: "nullish",
       left: lowerer.coerceToExpected(left, DYN),
@@ -1029,6 +1069,8 @@ export function lowerBinary(lowerer: Lowerer, expr: ts.BinaryExpression): IrExpr
       if (prototypeWrite) return prototypeWrite;
       const callableWrite = lowerNativeFunctionAssignment(lowerer, expr);
       if (callableWrite) return callableWrite;
+      const dereferenced = lowerDereferencedElementAssignment(lowerer, expr);
+      if (dereferenced) return dereferenced;
     }
     if (
       op === ts.SyntaxKind.QuestionQuestionEqualsToken ||

packages/compiler/src/frontend/lowering/expressions/relational.ts

@@ -840,9 +840,10 @@ export function lowerInstanceOf(lowerer: Lowerer, expr: ts.BinaryExpression, loc
   if (left.type.kind === "union") {
     const unionId = left.type.unionId;
     const arms = lowerer.unions.get(unionId)?.arms;
-    // Ordinary records, arrays and scalar values do not carry a class
-    // prototype (no program class extends Array). Dynamic/opaque runtime
-    // objects keep their existing instanceof fences.
+    // Records, arrays and scalar values are no instances of a class that
+    // does not extend Array (lowerArrayClassInstanceOf tests the classes
+    // that do). Dynamic/opaque runtime objects keep their existing
+    // instanceof fences.
     if (
       arms?.every(
         (arm) =>

packages/compiler/src/frontend/lowering/frozen-records.ts

@@ -362,3 +362,37 @@ export function freezableRecordType(lowerer: Lowerer, type: IrType): type is Rec
   const shape = lowerer.shapes.get(type.shapeId);
   return shape !== undefined && !shapeHasAccessorSlots(shape);
 }
+
+/** The source ranges (writeKey) of untyped property writes in sloppy-mode
+ * code (IrModule.sloppyDynWrites): an assignment there that strict mode
+ * refuses with a TypeError (a frozen or non-extensible object, a read-only
+ * property) leaves the object unchanged instead. Only programs with such
+ * writes list any; the backend calls the sloppy entry points for them. */
+export function sloppyDynamicWrites(lowerer: Lowerer, functions: readonly IrFunction[]): string[] {
+  const keys = new Set<string>();
+  const strictness = new Map<string, boolean>();
+  for (const fn of functions) {
+    everyStmtList(fn.body, {
+      stmt: () => true,
+      expr: (e) => {
+        if (e.kind !== "libCall" || (e.fn !== "dyn.keySet" && e.fn !== "dyn.keySetComputed"))
+          return true;
+        const key = writeKey(e.loc);
+        let sloppy = strictness.get(key);
+        if (sloppy === undefined) {
+          sloppy = isSloppyAt(lowerer, e.loc);
+          strictness.set(key, sloppy);
+        }
+        if (sloppy) keys.add(key);
+        return true;
+      },
+    });
+  }
+  return [...keys].sort();
+}
+
+/** Whether the source at `loc` is sloppy-mode code (isStrictCode). */
+export function isSloppyAt(lowerer: Lowerer, loc: SrcLoc): boolean {
+  const node = lowerer.nodeAtLoc(loc);
+  return node !== null && !isStrictCode(node);
+}

packages/compiler/src/frontend/lowering/generator-dynamic-dispatch.ts

@@ -1,7 +1,8 @@
-import { dynUndefinedExpr, varRef } from "../../ir/build.js";
+import { dynUndefinedExpr, numLit, varRef } from "../../ir/build.js";
 import {
   BOOL,
   DYN,
+  F64,
   STRING,
   canConvertToDyn,
   funcOf,
@@ -16,7 +17,7 @@ import {
 import { transformStmtList } from "../../ir/traverse.js";
 import { genResultRecord } from "../type-mapper.js";
 import type { DispatchSites } from "./dispatch-sites.js";
-import type { Lowerer } from "./lowerer.js";
+import type { Lowerer, UntypedLoopSite } from "./lowerer.js";
 
 type GeneratorType = Extract<IrType, { kind: "generator" }>;
 type Invoke = Extract<IrExpr, { kind: "dynInvoke" }>;
@@ -401,6 +402,310 @@ export class GeneratorDynamicDispatch {
         });
         changed = true;
       }
+    return this.stepUntypedLoops(lowerer, functions) || changed;
+  }
+
+  /** The generator types a loop over an untyped iterable can step natively:
+   * sync generators for `for … of`, and both kinds for `for await` (a sync
+   * generator through the async-from-sync rules). Insertion order, so a
+   * type keeps its index as later waves add types. */
+  private loopTypes(lowerer: Lowerer, site: UntypedLoopSite): [string, GeneratorType][] {
+    const out: [string, GeneratorType][] = [];
+    for (const [key, type] of this.generators) {
+      if (type.async === true && !site.async) continue;
+      const result = genResultRecord(type.yieldT, type.retT, lowerer.shapes, lowerer.unions);
+      if (result === null) continue;
+      // next() with no argument, as the protocol calls it.
+      const channel = type.nextT;
+      if (channel.kind !== "undefinedT" && channel.kind !== "void" && channel.kind !== "dyn")
+        continue;
+      if (
+        !canConvertToDyn(
+          result,
+          (id) => lowerer.shapes.get(id),
+          (id) => lowerer.unions.get(id),
+        )
+      )
+        continue;
+      out.push([key, type]);
+    }
+    return out;
+  }
+
+  /** Loops over untyped iterables step the program's own generators on the
+   * typed path. Once the loop has its iterator and next method, a kind local
+   * records which generator type the iterator is, when its next method is
+   * the generator's own (`%dyn.generator.method.next`); each step then
+   * resumes the generator directly and boxes only the value, where the
+   * protocol would box the result record and its promise and read them
+   * back. Every other iterator, and every early exit (return() through the
+   * protocol), keeps the dynamic path. The awaits are the protocol's: a
+   * `for await` over an async generator awaits next()'s promise, and over a
+   * sync generator awaits once for the result and, reached through
+   * Symbol.iterator, once for the value. */
+  private stepUntypedLoops(lowerer: Lowerer, functions: readonly IrFunction[]): boolean {
+    if (this.generators.size === 0 || lowerer.untypedLoops.size === 0) return false;
+    // The loop reads next through the getter only once it exists.
+    if (!this.properties.has("next")) return false;
+    let changed = false;
+    for (const fn of functions) {
+      if (this.generated.has(fn)) continue;
+      const byKind = new Map<string, UntypedLoopSite>();
+      const byValue = new Map<string, UntypedLoopSite>();
+      for (const local of fn.locals) {
+        const site = lowerer.untypedLoops.get(local);
+        if (site === undefined) continue;
+        byKind.set(site.kind, site);
+        byValue.set(site.value, site);
+      }
+      if (byKind.size === 0) continue;
+      fn.body = transformStmtList(fn.body, {
+        expr: (expr) => expr,
+        stmt: (stmt) => {
+          if (stmt.kind !== "varDecl" || stmt.init === null) return stmt;
+          const opened = byKind.get(stmt.localId);
+          if (opened !== undefined) {
+            const types = this.loopTypes(lowerer, opened);
+            const init = this.loopKind(opened, types, stmt.loc);
+            if (this.loopKindCount(stmt.init) === types.length) return stmt;
+            changed = true;
+            return { ...stmt, init };
+          }
+          const site = byValue.get(stmt.localId);
+          if (site === undefined) return stmt;
+          const types = this.loopTypes(lowerer, site);
+          // The protocol step is the innermost else of the type chain.
+          let fallback = stmt.init;
+          let present = 0;
+          while (
+            fallback.kind === "ternary" &&
+            fallback.cond.kind === "bin" &&
+            fallback.cond.left.kind === "varRef" &&
+            fallback.cond.left.localId === site.kind
+          ) {
+            fallback = fallback.else_;
+            present++;
+          }
+          if (present === types.length) return stmt;
+          let init = fallback;
+          for (let i = types.length - 1; i >= 0; i--) {
+            const [, type] = types[i]!;
+            const record = `${site.kind}.r${i + 1}`;
+            init = {
+              kind: "ternary",
+              cond: {
+                kind: "bin",
+                op: "===",
+                left: varRef(site.kind, F64, stmt.loc),
+                right: numLit(i + 1, stmt.loc),
+                type: BOOL,
+                loc: stmt.loc,
+              },
+              then: this.loopStep(lowerer, fn, site, type, record, stmt.loc),
+              else_: init,
+              type: DYN,
+              loc: stmt.loc,
+            };
+          }
+          changed = true;
+          return { ...stmt, init };
+        },
+      });
+    }
     return changed;
   }
+
+  /** How many generator types a loop's kind initializer tests: the chain
+   * inside its own-method test (loopKind). */
+  private loopKindCount(init: IrExpr): number {
+    if (init.kind !== "ternary") return 0;
+    let count = 0;
+    for (let chain = init.then; chain.kind === "ternary"; chain = chain.else_) count++;
+    return count;
+  }
+
+  /** The loop's kind: the 1-based index of the generator type its iterator
+   * is, when the next method it read is that generator's own, else 0. */
+  private loopKind(
+    site: UntypedLoopSite,
+    types: readonly [string, GeneratorType][],
+    loc: IrExpr["loc"],
+  ): IrExpr {
+    const own: IrExpr = {
+      kind: "libCall",
+      fn: "dyn.sameValue",
+      args: [
+        varRef(site.next, DYN, loc),
+        {
+          kind: "dynFrom",
+          value: {
+            kind: "closure",
+            fnName: "%dyn.generator.method.next",
+            captures: [],
+            type: funcOf([DYN], DYN),
+            loc,
+          },
+          type: DYN,
+          loc,
+        },
+      ],
+      type: BOOL,
+      loc,
+    };
+    let kind: IrExpr = numLit(0, loc);
+    for (let i = types.length - 1; i >= 0; i--)
+      kind = {
+        kind: "ternary",
+        cond: {
+          kind: "libCall",
+          fn: "dyn.typedRefIs",
+          args: [
+            varRef(site.iterator, DYN, loc),
+            { kind: "strLit", value: types[i]![0], type: STRING, loc },
+          ],
+          type: BOOL,
+          loc,
+        },
+        then: numLit(i + 1, loc),
+        else_: kind,
+        type: F64,
+        loc,
+      };
+    return types.length === 0
+      ? kind
+      : { kind: "ternary", cond: own, then: kind, else_: numLit(0, loc), type: F64, loc };
+  }
+
+  /** One step of a loop over an untyped iterable that is a `type`
+   * generator: sets the loop's done flag and answers the value, boxed. */
+  private loopStep(
+    lowerer: Lowerer,
+    fn: IrFunction,
+    site: UntypedLoopSite,
+    type: GeneratorType,
+    recordId: string,
+    loc: IrExpr["loc"],
+  ): IrExpr {
+    const gen: IrExpr = { kind: "dynCheck", value: varRef(site.iterator, DYN, loc), type, loc };
+    const setDone = (value: IrExpr): IrStmt => ({ kind: "assign", localId: site.done, value, loc });
+    const doneRef = varRef(site.done, BOOL, loc);
+    const result = genResultRecord(type.yieldT, type.retT, lowerer.shapes, lowerer.unions)!;
+    if (!fn.locals.some((local) => local.id === recordId))
+      fn.locals.push({ id: recordId, name: recordId, type: result, mutable: false });
+    const field = (name: "value" | "done", fieldType: IrType): IrExpr => ({
+      kind: "recordGet",
+      obj: varRef(recordId, result, loc),
+      shapeId: result.shapeId,
+      field: name,
+      type: fieldType,
+      loc,
+    });
+    const valueType = lowerer.shapes
+      .get(result.shapeId)!
+      .fields.find((f) => f.name === "value")!.type;
+    const boxed: IrExpr = { kind: "dynFrom", value: field("value", valueType), type: DYN, loc };
+    const awaitDyn = (value: IrExpr): IrExpr => ({
+      kind: "libCall",
+      fn: "async.awaitDyn",
+      args: [value],
+      type: DYN,
+      loc,
+    });
+    const resumed: IrExpr = {
+      kind: "genResume",
+      mode: "next",
+      gen,
+      arg: null,
+      type: type.async === true ? { kind: "promise", inner: result } : result,
+      loc,
+    };
+    if (!site.async)
+      return {
+        kind: "seqExpr",
+        stmts: [
+          { kind: "varDecl", localId: recordId, init: resumed, loc },
+          setDone(field("done", BOOL)),
+        ],
+        result: {
+          kind: "ternary",
+          cond: doneRef,
+          then: dynUndefinedExpr(loc),
+          else_: boxed,
+          type: DYN,
+          loc,
+        },
+        type: DYN,
+        loc,
+      };
+    if (type.async === true)
+      return {
+        kind: "seqExpr",
+        stmts: [
+          {
+            kind: "varDecl",
+            localId: recordId,
+            init: { kind: "awaitExpr", value: resumed, type: result, loc },
+            loc,
+          },
+          setDone(field("done", BOOL)),
+        ],
+        result: {
+          kind: "ternary",
+          cond: doneRef,
+          then: dynUndefinedExpr(loc),
+          else_: boxed,
+          type: DYN,
+          loc,
+        },
+        type: DYN,
+        loc,
+      };
+    // for await over a sync generator: the result awaits once. When the
+    // loop reached it through Symbol.iterator, the async-from-sync iterator
+    // also awaits the value (the final one too); a sync generator that an
+    // object's Symbol.asyncIterator returns passes the value as it is, as
+    // the protocol does.
+    const fromSync: IrExpr =
+      site.sync === null
+        ? { kind: "boolLit", value: false, type: BOOL, loc }
+        : varRef(site.sync, BOOL, loc);
+    return {
+      kind: "seqExpr",
+      stmts: [
+        { kind: "varDecl", localId: recordId, init: resumed, loc },
+        setDone(field("done", BOOL)),
+        { kind: "exprStmt", expr: awaitDyn(dynUndefinedExpr(loc)), loc },
+      ],
+      result: {
+        kind: "ternary",
+        cond: doneRef,
+        then: {
+          kind: "ternary",
+          cond: fromSync,
+          then: {
+            kind: "seqExpr",
+            stmts: [{ kind: "exprStmt", expr: awaitDyn(boxed), loc }],
+            result: dynUndefinedExpr(loc),
+            type: DYN,
+            loc,
+          },
+          else_: dynUndefinedExpr(loc),
+          type: DYN,
+          loc,
+        },
+        else_: {
+          kind: "ternary",
+          cond: fromSync,
+          then: awaitDyn(boxed),
+          else_: boxed,
+          type: DYN,
+          loc,
+        },
+        type: DYN,
+        loc,
+      },
+      type: DYN,
+      loc,
+    };
+  }
 }

packages/compiler/src/frontend/lowering/generic-functions.ts

@@ -4,6 +4,7 @@ import { staticNameBindings } from "./static-function-names.js";
 import { positionTag } from "./structural-positions.js";
 import { keyedHelperName } from "./stable-names.js";
 import * as ts from "../ts7/adapter.js";
+import { heritageElementTarget, isHeritageTypeReference } from "../heritage-elements.js";
 import { bodyReadsArguments } from "../arguments-usage.js";
 import type { Lowerer } from "./lowerer.js";
 import {
@@ -655,8 +656,9 @@ function extendsParameter(
   }
   for (const clause of decl.heritageClauses?.nodes ?? [])
     for (const base of clause.types.nodes) {
-      const symbol = ts.isIdentifier(base.expression)
-        ? lowerer.checker.getSymbolAtLocation(base.expression)
+      const target = heritageElementTarget(base);
+      const symbol = ts.isIdentifier(target)
+        ? lowerer.checker.getSymbolAtLocation(target)
         : undefined;
       if (symbol !== undefined && params.has(symbol)) return true;
     }
@@ -3036,7 +3038,12 @@ function bindingReferences(
       resolved = lowerer.checker.getShorthandAssignmentValueSymbol(parent) ?? resolved;
     if (resolved !== symbol) return false;
     for (let p: ts.Node | undefined = parent; p !== undefined; p = p.parent) {
-      if (ts.isTypeNode(p) && p.kind !== ts.SyntaxKind.ExpressionWithTypeArguments) return false;
+      if (
+        ts.isTypeNode(p) &&
+        p.kind !== ts.SyntaxKind.ExpressionWithTypeArguments &&
+        !isHeritageTypeReference(p)
+      )
+        return false;
       if (ts.isStatement(p) || ts.isFunctionLike(p)) break;
     }
     return true;

packages/compiler/src/frontend/lowering/lower-calls.ts

@@ -8732,7 +8732,13 @@ function lowerObjectStaticCall(
       return { kind: "libCall", fn: "dyn.freeze", args: [value], type: DYN, loc: locOf(call) };
     }
     if (ts.isObjectLiteralExpression(inner) || ts.isArrayLiteralExpression(inner)) {
-      return value; // fresh — freeze is identity here, honestly
+      // A fresh literal can still reach untyped code, which observes and
+      // must honor its frozen state: records and arrays keep the bit.
+      if (freezableRecordType(lowerer, value.type))
+        return lowerNativeFreeze(lowerer, "record.freeze", value, locOf(call));
+      if (value.type.kind === "array")
+        return lowerNativeFreeze(lowerer, "array.freeze", value, locOf(call));
+      return value;
     }
     if (
       value.type.kind === "string" ||

packages/compiler/src/frontend/lowering/lower-exprs.ts

@@ -83,6 +83,8 @@ import { unitOnlyUnion } from "../type-mapper.js";
 import { lowerYield } from "./lower-generators.js";
 import { unionWideningTags } from "../../ir/analysis.js";
 import { isSafeToDiscard, isSafeToRepeat } from "./expressions/evaluation-safety.js";
+import { everyExprChild } from "../../ir/traverse.js";
+import { declareContextLocal } from "./function-context.js";
 import { hasOptionalChainGuard, isOptionalChainTail } from "./expressions/optional-chains.js";
 import { classToStringConversion, classUnionToString } from "./class-to-primitive.js";
 import { lowerCjsTopLevelThis, lowerRequireCacheElement } from "./lower-node-module.js";
@@ -413,6 +415,10 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
       const probe = lowerAbsenceProbe(lowerer, expr.expression);
       if (probe?.type.kind === "union") return probe;
     }
+    const dereferenced = dereferencedElementReceiver(lowerer, expr, loc);
+    if (dereferenced) return dereferenced;
+    const element = assertedElementOperand(lowerer, expr, loc);
+    if (element) return element;
     const inner = lowerer.lowerExpr(expr.expression);
     if (inner.type.kind === "union") {
       // `!` performs no runtime check: a missing array element stays
@@ -1075,18 +1081,10 @@ function assertionOperand(
   loc: SrcLoc,
 ): IrExpr | null {
   if (inner.type.kind !== "union" || target === null || target.kind === "union") return null;
-  const arms = lowerer.unions.get(inner.type.unionId)?.arms;
-  if (
-    !arms?.some(isUnitType) ||
-    !arms.every(
-      (arm) =>
-        arm.kind === "f64" || arm.kind === "string" || arm.kind === "bool" || isUnitType(arm),
-    )
-  )
-    return null;
-  // Array element reads keep their own handling of a missing element. A
-  // typed-array read is optional here only where its use tells undefined
-  // from NaN (assertedReadObservesUndefined).
+  if (!scalarUnion(lowerer, inner.type.unionId)) return null;
+  // Array element reads take assertedElementOperand or keep their own
+  // handling of a missing element. A typed-array read is optional here only
+  // where its use tells undefined from NaN (assertedReadObservesUndefined).
   let operand: ts.Expression = expr.expression;
   while (ts.isParenthesizedExpression(operand)) operand = operand.expression;
   if (ts.isElementAccessExpression(operand)) {
@@ -1095,19 +1093,489 @@ function assertionOperand(
   }
   const use = convertingUseOf(lowerer, expr);
   if (use === null) return null;
-  if (use === "value") return inner;
+  if (use === "value" || use === "string") return inner;
   return lowerPrimitiveUnionNumber(lowerer, inner, expr, loc);
 }
 
-/** How the converting use of `x!` (see assertionOperand) reads it:
- * "number" where the use applies ToNumber, "value" where the consumer
- * lowers the union itself (strings, equality, truthiness), null for other
+/** `xs[i]!` on an array as the operand of a converting use (see
+ * assertionOperand). The read answers undefined for a missing element, as
+ * in Node, instead of trapping: a numeric use reads NaN for it, and other
+ * uses get the optional element value. Returns null for other reads and
  * uses. */
-function convertingUseOf(lowerer: Lowerer, expr: ts.NonNullExpression): "number" | "value" | null {
+function assertedElementOperand(
+  lowerer: Lowerer,
+  expr: ts.NonNullExpression,
+  loc: SrcLoc,
+): IrExpr | null {
+  let read: ts.Expression = expr.expression;
+  while (ts.isParenthesizedExpression(read)) read = read.expression;
+  if (!ts.isElementAccessExpression(read) || read.questionDotToken) return null;
+  // Plain arrays only: regex match results and other array subtypes keep
+  // their own element reads.
+  const receiverType = lowerer.typeOf(read.expression);
+  if (
+    !lowerer.checker.isArrayType(receiverType) ||
+    lowerer.mapTypeOf(receiverType)?.kind !== "array"
+  )
+    return null;
+  // A counter below the length reads an existing index: the read keeps
+  // its plain element access.
+  if (lowerer.nanCodedReads?.counterIndexInBounds(read)) return null;
+  const target = lowerer.mapTypeOf(lowerer.typeOf(expr));
+  if (!target || !isScalarArm(target)) return null;
+  const use = convertingUseOf(lowerer, expr);
+  if (use === null) return null;
+  if (use === "string" && target.kind === "string")
+    return stringElementOrUndefined(lowerer, read, loc);
+  const probe = lowerAbsenceProbe(lowerer, read);
+  if (probe?.type.kind !== "union" || !scalarUnion(lowerer, probe.type.unionId)) return null;
+  if (use === "value" || use === "string") return probe;
+  return lowerer.stripUndefinedArm(probe.type).kind === "f64"
+    ? lowerOptionalNumber(lowerer, probe, loc)
+    : lowerPrimitiveUnionNumber(lowerer, probe, expr, loc);
+}
+
+/** `xs[i]!` on an array as the receiver of a member read
+ * (`xs[i]!.name`, `xs[i]!.size()`, `xs[i]![0]`). `!` performs no runtime
+ * check, so a missing element is undefined there and the member access
+ * throws Node's TypeError ("Cannot read properties of undefined (reading
+ * 'name')") instead of the bounds trap. The receiver is the element when it
+ * is present. A write (`xs[i]!.name = v`) is lowered as a statement by
+ * lowerDereferencedElementWrite, which evaluates the value before the
+ * receiver throws; elsewhere it keeps the bounds trap. Returns null for
+ * other reads and uses. */
+function dereferencedElementReceiver(
+  lowerer: Lowerer,
+  expr: ts.NonNullExpression,
+  loc: SrcLoc,
+): IrExpr | null {
+  const use = runtimeOptionalUseOf(expr);
+  if (!use || isAssignmentTarget(use.access)) return null;
+  const parts = dereferencedElementParts(lowerer, expr, loc, false);
+  if (parts?.message == null) return null;
+  const message = parts.message;
+  const value: IrExpr = {
+    kind: "ternary",
+    cond: parts.present,
+    then: parts.element,
+    else_: nodeTypeError(message, parts.element.type, loc),
+    type: parts.element.type,
+    loc,
+  };
+  return parts.stmts.length === 0
+    ? value
+    : { kind: "seqExpr", stmts: parts.stmts, result: value, type: value.type, loc };
+}
+
+/** The parts of a member access through `xs[i]!` (see
+ * dereferencedElementReceiver): statements that evaluate the array and the
+ * index, whether the element is present, the element read, and Node's
+ * TypeError message for a missing one. A `write` holds its key, so its
+ * message may be left for dereferencedElementWrite to build from the key. */
+export function dereferencedElementParts(
+  lowerer: Lowerer,
+  expr: ts.NonNullExpression,
+  loc: SrcLoc,
+  write: boolean,
+): { stmts: IrStmt[]; present: IrExpr; element: IrExpr; message: IrExpr | null } | null {
+  let read: ts.Expression = expr.expression;
+  while (ts.isParenthesizedExpression(read)) read = read.expression;
+  if (!ts.isElementAccessExpression(read) || read.questionDotToken) return null;
+  const receiverType = lowerer.typeOf(read.expression);
+  if (
+    !lowerer.checker.isArrayType(receiverType) ||
+    lowerer.mapTypeOf(receiverType)?.kind !== "array"
+  )
+    return null;
+  if (lowerer.nanCodedReads?.counterIndexInBounds(read)) return null;
+  const use = runtimeOptionalUseOf(expr);
+  if (!use || use.optional || use.complex || use.comma || use.kind === "call") return null;
+  // A write holds its key, so the message can name any number or string
+  // key (dereferencedElementWrite builds it).
+  const message =
+    memberAccessMessage(lowerer, use.access) ??
+    (write && ts.isElementAccessExpression(use.access) && namedKey(lowerer, use.access)
+      ? null
+      : undefined);
+  if (message === undefined) return null;
+  if (lowerer.mapTypeOf(lowerer.typeOf(read.argumentExpression))?.kind !== "f64") return null;
+  // The element must already have the asserted type: an element union the
+  // assertion or a guard narrows keeps its checked narrow.
+  const target = lowerer.mapTypeOf(lowerer.typeOf(expr));
+  const declared = lowerer.mapTypeOf(receiverType);
+  if (
+    !target ||
+    declared?.kind !== "array" ||
+    declared.elem.kind === "void" ||
+    !typeEquals(declared.elem, target)
+  )
+    return null;
+  const arr = lowerer.lowerExpr(read.expression);
+  if (arr.type.kind !== "array" || !typeEquals(arr.type.elem, target)) return null;
+  const elem = arr.type.elem;
+  const index = lowerer.lowerExprExpecting(read.argumentExpression, F64);
+  // Plain reads (a local, a field of one) evaluate once more instead of
+  // through a hidden local: the receiver then stays a borrowed element
+  // read, like the plain `xs[i]` it replaces. An index that can assign
+  // can replace the array binding or field (`xs[(xs = other, 0)]!`), so the
+  // array is held before it, as JavaScript reads it first.
+  const stmts: IrStmt[] = [];
+  const plain = (value: IrExpr): boolean => isSafeToRepeat(value) || plainProjection(value);
+  const held = (value: IrExpr, name: string): IrExpr => {
+    const tmp = lowerer.declareHiddenLocal(name, value.type);
+    stmts.push({ kind: "varDecl", localId: tmp.id, init: value, loc });
+    return varRef(tmp.id, value.type, loc);
+  };
+  const a = !mayAssign(index) && plain(arr) ? arr : held(arr, "%elementArray");
+  const i = plain(index) ? index : held(index, "%elementIndex");
+  return {
+    stmts,
+    present: {
+      kind: "bin",
+      op: "===",
+      left: { kind: "arrayState", arr: a, index: i, type: F64, loc },
+      right: numLit(1, loc),
+      type: BOOL,
+      loc,
+    },
+    element: { kind: "arrayGet", arr: a, index: i, type: elem, loc },
+    message,
+  };
+}
+
+/** A write through `xs[i]!` (`xs[i]!.name = v`, `xs[i]![k] = v`): as in
+ * Node, the array, the index, the key and the value evaluate in order (the
+ * statements), then a missing element makes the write throw Node's
+ * TypeError and a present one takes the write, which reads the element,
+ * the key and the value through `overrides`. Null for other targets. */
+export function dereferencedElementWrite(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+): {
+  stmts: IrStmt[];
+  present: IrExpr;
+  message: IrExpr;
+  overrides: { node: ts.Expression; value: IrExpr }[];
+} | null {
+  if (expr.operatorToken.kind !== ts.SyntaxKind.EqualsToken) return null;
+  const target = expr.left;
+  if (
+    !(ts.isPropertyAccessExpression(target) || ts.isElementAccessExpression(target)) ||
+    target.questionDotToken ||
+    lowerer.chainRecvByNode.has(target.expression)
+  )
+    return null;
+  let receiver: ts.Expression = target.expression;
+  while (ts.isParenthesizedExpression(receiver)) receiver = receiver.expression;
+  if (!ts.isNonNullExpression(receiver)) return null;
+  const loc = locOf(expr);
+  const keyValue = ts.isElementAccessExpression(target)
+    ? lowerer.lowerExpr(target.argumentExpression)
+    : null;
+  const rightValue = lowerer.lowerExpr(expr.right);
+  const parts = dereferencedElementParts(lowerer, receiver, loc, true);
+  if (parts === null) return null;
+  const stmts = [...parts.stmts];
+  let present = parts.present;
+  let element = parts.element;
+  // JavaScript reads the element before the key and the value. When either
+  // has an effect, which can replace, remove or add the element, its
+  // presence and value are read first; otherwise the write tests and reads
+  // it after them.
+  if (!unobservable(rightValue) || (keyValue !== null && !unobservable(keyValue))) {
+    const presentLocal = lowerer.declareHiddenLocal("%elementPresent", BOOL);
+    // Assigned only when the element is present.
+    const elementLocal = declareContextLocal(
+      lowerer.ctx,
+      "%elementValue",
+      element.type,
+      true,
+      undefined,
+      undefined,
+    );
+    stmts.push(
+      { kind: "varDecl", localId: presentLocal.id, init: present, loc },
+      { kind: "varDecl", localId: elementLocal.id, init: null, loc },
+    );
+    present = varRef(presentLocal.id, BOOL, loc);
+    stmts.push({
+      kind: "if",
+      cond: present,
+      then: [{ kind: "assign", localId: elementLocal.id, value: element, loc }],
+      else_: null,
+      loc,
+    });
+    element = varRef(elementLocal.id, element.type, loc);
+  }
+  const overrides: { node: ts.Expression; value: IrExpr }[] = [];
+  // The write lowers the node with or without its parentheses.
+  const override = (node: ts.Expression, value: IrExpr): void => {
+    for (let n: ts.Expression = node; ; n = n.expression) {
+      overrides.push({ node: n, value });
+      if (!ts.isParenthesizedExpression(n)) break;
+    }
+  };
+  const held = (value: IrExpr, name: string, inline: boolean): IrExpr => {
+    if (inline) return value;
+    // A call without a result evaluates to undefined.
+    if (value.type.kind === "void") {
+      stmts.push({ kind: "exprStmt", expr: value, loc });
+      return { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc };
+    }
+    const tmp = lowerer.declareHiddenLocal(name, value.type);
+    stmts.push({ kind: "varDecl", localId: tmp.id, init: value, loc });
+    return varRef(tmp.id, value.type, loc);
+  };
+  override(target.expression, element);
+  let message = parts.message;
+  if (ts.isElementAccessExpression(target) && keyValue !== null) {
+    // The key evaluates before the value, which can assign the binding or
+    // field it reads; a literal, or an unobservable key the value cannot
+    // change, may evaluate in the write.
+    const key = held(
+      keyValue,
+      "%elementWriteKey",
+      keyValue.kind === "numLit" ||
+        keyValue.kind === "strLit" ||
+        (unobservable(keyValue) && !mayAssign(rightValue)),
+    );
+    override(target.argumentExpression, key);
+    // The message names the key's value as the write evaluated it.
+    if (key !== keyValue || message === null)
+      message = keyMessage(messageHead(target), key, loc) ?? message;
+  }
+  // A value whose evaluation is unobservable may evaluate in the write
+  // itself, after the element is tested.
+  override(
+    expr.right,
+    held(rightValue, "%elementWriteValue", isSafeToRepeat(rightValue) || unobservable(rightValue)),
+  );
+  if (message === null) return null;
+  return { stmts, present, message, overrides };
+}
+
+/** dereferencedElementWrite in value position (`f(xs[i]!.name = v)`). */
+export function lowerDereferencedElementAssignment(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+): IrExpr | null {
+  const write = dereferencedElementWrite(lowerer, expr);
+  if (write === null) return null;
+  const loc = locOf(expr);
+  const value = lowerer.withExpressionOverrides(write.overrides, () => lowerer.lowerExpr(expr));
+  return {
+    kind: "seqExpr",
+    stmts: write.stmts,
+    result: {
+      kind: "ternary",
+      cond: write.present,
+      then: value,
+      else_: nodeTypeError(write.message, value.type, loc),
+      type: value.type,
+      loc,
+    },
+    type: value.type,
+    loc,
+  };
+}
+
+/** Whether evaluating `e` has no effect and cannot throw: a discardable
+ * expression, or the compiler's element-or-undefined read of one. */
+function unobservable(e: IrExpr): boolean {
+  if (e.kind === "call" && e.callee.startsWith("%arr.idxOr.")) return e.args.every(unobservable);
+  return isSafeToDiscard(e);
+}
+
+/** Whether evaluating `e` can assign a binding or a field: it contains an
+ * assignment, an increment, statements, a suspension, or a call that can
+ * run program code (a library call only through a function it is given). */
+function mayAssign(e: IrExpr): boolean {
+  switch (e.kind) {
+    case "call":
+      // The compiler's element-or-undefined read and union narrows run no
+      // program code.
+      if (!e.callee.startsWith("%arr.idxOr.") && !e.callee.startsWith("%union.narrow."))
+        return true;
+      break;
+    case "assignExpr":
+    case "incDec":
+    case "seqExpr":
+    case "callValue":
+    case "virtualCall":
+    case "dynCall":
+    case "dynInvoke":
+    case "ffiCall":
+    case "new":
+    case "newValue":
+    case "awaitExpr":
+    case "awaitUnionExpr":
+    case "yieldExpr":
+      return true;
+    case "closure":
+      return false;
+    case "libCall":
+      if (e.args.some((arg) => arg.type.kind === "func")) return true;
+      break;
+  }
+  return !everyExprChild(
+    e,
+    (child) => !mayAssign(child),
+    () => false,
+  );
+}
+
+/** Node's TypeError, thrown in place of a value of `type`. */
+export function nodeTypeError(message: IrExpr, type: IrType, loc: SrcLoc): IrExpr {
+  return {
+    kind: "libCall",
+    fn: "error.nodeThrow",
+    args: [numLit(1, loc), strLit("", loc), message],
+    type,
+    loc,
+  };
+}
+
+/** Whether `access` is the target of `=`. */
+function isAssignmentTarget(access: ts.Expression): boolean {
+  let outer: ts.Expression = access;
+  while (ts.isParenthesizedExpression(outer.parent)) outer = outer.parent;
+  const parent = outer.parent;
+  return (
+    ts.isBinaryExpression(parent) &&
+    parent.left === outer &&
+    parent.operatorToken.kind === ts.SyntaxKind.EqualsToken
+  );
+}
+
+/** A local, a number literal, or a field or record member read through a
+ * local: reading it again has no effect and yields the same value. */
+function plainProjection(e: IrExpr): boolean {
+  if (e.kind === "varRef" || e.kind === "numLit") return true;
+  return (e.kind === "fieldGet" || e.kind === "recordGet") && plainProjection(e.obj);
+}
+
+/** Node's TypeError message for a member access on undefined: reading the
+ * member, or setting it when the access is the target of `=`. Null when
+ * the key is not a name, a literal, or a plain read of a number or string
+ * (which the message reads a second time). */
+function memberAccessMessage(
+  lowerer: Lowerer,
+  access: ts.PropertyAccessExpression | ts.ElementAccessExpression | ts.CallExpression,
+): IrExpr | null {
+  const head = messageHead(access);
+  const loc = locOf(access);
+  if (ts.isPropertyAccessExpression(access)) {
+    if (ts.isPrivateIdentifier(access.name)) return null;
+    return strLit(`${head}${access.name.text}')`, loc);
+  }
+  if (!ts.isElementAccessExpression(access)) return null;
+  const key = runtimeOptionalElementKey(access.argumentExpression);
+  if (key !== null) return strLit(`${head}${key}')`, loc);
+  let keyNode = access.argumentExpression;
+  while (ts.isParenthesizedExpression(keyNode)) keyNode = keyNode.expression;
+  if (!ts.isIdentifier(keyNode)) return null;
+  const keyType = lowerer.mapTypeOf(lowerer.typeOf(keyNode))?.kind;
+  if (keyType !== "f64" && keyType !== "string") return null;
+  const keyValue = lowerer.lowerExpr(keyNode);
+  if (!isSafeToRepeat(keyValue) || keyValue.type.kind !== keyType) return null;
+  return keyMessage(head, keyValue, loc);
+}
+
+/** The start of Node's TypeError message for a member access on undefined:
+ * setting the member when the access is the target of `=`, else reading
+ * it. */
+function messageHead(access: ts.Expression): string {
+  return isAssignmentTarget(access)
+    ? "Cannot set properties of undefined (setting '"
+    : "Cannot read properties of undefined (reading '";
+}
+
+/** Whether `access`'s key is typed a number or a string, which the message
+ * can name from its value. */
+function namedKey(lowerer: Lowerer, access: ts.ElementAccessExpression): boolean {
+  const kind = lowerer.mapTypeOf(lowerer.typeOf(access.argumentExpression))?.kind;
+  return kind === "f64" || kind === "string";
+}
+
+/** The message naming a key from its value (a number or a string), or null
+ * for another type. */
+function keyMessage(head: string, key: IrExpr, loc: SrcLoc): IrExpr | null {
+  if (key.type.kind !== "f64" && key.type.kind !== "string") return null;
+  const text: IrExpr =
+    key.type.kind === "string" ? key : { kind: "toString", operand: key, type: STRING, loc };
+  const concat = (left: IrExpr, right: IrExpr): IrExpr => ({
+    kind: "strConcat",
+    left,
+    right,
+    type: STRING,
+    loc,
+  });
+  return concat(concat(strLit(head, loc), text), strLit("')", loc));
+}
+
+/** A string array's element converted to a string: the element, or
+ * "undefined" for a missing index or a hole. */
+function stringElementOrUndefined(
+  lowerer: Lowerer,
+  read: ts.ElementAccessExpression,
+  loc: SrcLoc,
+): IrExpr | null {
+  if (lowerer.mapTypeOf(lowerer.typeOf(read.argumentExpression))?.kind !== "f64") return null;
+  const arr = lowerer.lowerExpr(read.expression);
+  if (arr.type.kind !== "array" || arr.type.elem.kind !== "string") return null;
+  const index = lowerer.lowerExprExpecting(read.argumentExpression, F64);
+  const stmts: IrStmt[] = [];
+  const held = (value: IrExpr, name: string): IrExpr => {
+    const tmp = lowerer.declareHiddenLocal(name, value.type);
+    stmts.push({ kind: "varDecl", localId: tmp.id, init: value, loc });
+    return varRef(tmp.id, value.type, loc);
+  };
+  // An index that can assign can replace the array binding or field, so
+  // the array is held before it, as JavaScript reads it first.
+  const a = !mayAssign(index) && isSafeToRepeat(arr) ? arr : held(arr, "%elementArray");
+  const i = isSafeToRepeat(index) ? index : held(index, "%elementIndex");
+  const value: IrExpr = {
+    kind: "ternary",
+    cond: {
+      kind: "bin",
+      op: "===",
+      left: { kind: "arrayState", arr: a, index: i, type: F64, loc },
+      right: numLit(1, loc),
+      type: BOOL,
+      loc,
+    },
+    then: { kind: "arrayGet", arr: a, index: i, type: STRING, loc },
+    else_: strLit("undefined", loc),
+    type: STRING,
+    loc,
+  };
+  return stmts.length === 0 ? value : { kind: "seqExpr", stmts, result: value, type: STRING, loc };
+}
+
+function isScalarArm(arm: IrType): boolean {
+  return arm.kind === "f64" || arm.kind === "string" || arm.kind === "bool" || isUnitType(arm);
+}
+
+/** A union of numbers, strings, booleans, null and undefined with at least
+ * one unit arm. */
+function scalarUnion(lowerer: Lowerer, unionId: string): boolean {
+  const arms = lowerer.unions.get(unionId)?.arms;
+  return !!arms?.some(isUnitType) && arms.every(isScalarArm);
+}
+
+/** How the converting use of `x!` (see assertionOperand) reads it:
+ * "number" where the use applies ToNumber, "string" where it converts the
+ * value to a string (a template span, `+` with a string), "value" where the
+ * consumer lowers the union itself (equality, truthiness, a comparison with
+ * a string), null for other uses. */
+function convertingUseOf(
+  lowerer: Lowerer,
+  expr: ts.NonNullExpression,
+): "number" | "string" | "value" | null {
   let outer: ts.Expression = expr;
   while (ts.isParenthesizedExpression(outer.parent)) outer = outer.parent;
   const parent = outer.parent;
-  if (ts.isTemplateSpan(parent)) return parent.expression === outer ? "value" : null;
+  if (ts.isTemplateSpan(parent)) return parent.expression === outer ? "string" : null;
   if (ts.isTypeOfExpression(parent)) return "value";
   if (ts.isPrefixUnaryExpression(parent)) {
     if (parent.operator === ts.SyntaxKind.ExclamationToken) return "value";
@@ -1140,7 +1608,7 @@ function convertingUseOf(lowerer: Lowerer, expr: ts.NonNullExpression): "number"
     if (op === ts.SyntaxKind.PlusEqualsToken && parent.right !== outer) return null;
     let partner = other;
     while (ts.isParenthesizedExpression(partner)) partner = partner.expression;
-    if (isString(other)) return ts.isNonNullExpression(partner) ? null : "value";
+    if (isString(other)) return ts.isNonNullExpression(partner) ? null : "string";
     if (!numericPartner(lowerer.typeOf(other))) return "value";
     return isString(expr) ? null : "number";
   }
@@ -1226,7 +1694,8 @@ export function assertedReadObservesUndefined(
   lowerer: Lowerer,
   node: ts.NonNullExpression,
 ): boolean {
-  if (convertingUseOf(lowerer, node) === "value") return true;
+  const use = convertingUseOf(lowerer, node);
+  if (use === "value" || use === "string") return true;
   let outer: ts.Expression = node;
   while (ts.isParenthesizedExpression(outer.parent)) outer = outer.parent;
   const parent = outer.parent;

packages/compiler/src/frontend/lowering/lower-stmts.ts

@@ -242,10 +242,12 @@ import { globalSymbolKey } from "./expressions/global-symbols.js";
 import { identifiersNamed } from "./identifier-uses.js";
 import { lowerShortCircuitAssignment } from "./expressions/nullish-assignment.js";
 import {
+  dereferencedElementWrite,
   jsHoldsDynObject,
   lowerEnvironmentKey,
   lowerNativeFunctionAssignment,
   lowerStrictEquality,
+  nodeTypeError,
 } from "./lower-exprs.js";
 import { keptIdentityAssertion } from "./assertion-identity.js";
 import { isNativeProxyInitializer } from "./expressions/native-proxy.js";
@@ -7992,6 +7994,29 @@ function lowerCjsSingleValueExport(
  * assignment, and `({ a, b } = e);` (destructuring ASSIGNMENT, which JS
  * requires parenthesized in statement position) lands in the
  * object-literal-target branch below. */
+/** dereferencedElementWrite in statement position. */
+function lowerDereferencedElementWrite(lowerer: Lowerer, expr: ts.BinaryExpression): IrStmt | null {
+  const write = dereferencedElementWrite(lowerer, expr);
+  if (write === null) return null;
+  const loc = locOf(expr);
+  return {
+    kind: "block",
+    body: [
+      ...write.stmts,
+      {
+        kind: "if",
+        cond: write.present,
+        then: [
+          lowerer.withExpressionOverrides(write.overrides, () => lowerExprStatement(lowerer, expr)),
+        ],
+        else_: [{ kind: "exprStmt", expr: nodeTypeError(write.message, VOID, loc), loc }],
+        loc,
+      },
+    ],
+    loc,
+  };
+}
+
 export function lowerExprStatement(lowerer: Lowerer, expr: ts.Expression): IrStmt {
   const stmtNode = expr.parent;
   while (ts.isParenthesizedExpression(expr)) expr = expr.expression;
@@ -8254,6 +8279,10 @@ export function lowerExprStatement(lowerer: Lowerer, expr: ts.Expression): IrStm
         const ex = lowerExpandoAssignStmt(lowerer, expr);
         if (ex) return ex;
       }
+      {
+        const dereferenced = lowerDereferencedElementWrite(lowerer, expr);
+        if (dereferenced) return dereferenced;
+      }
       if (ts.isElementAccessExpression(expr.left)) return lowerer.lowerElementWrite(expr);
       if (ts.isPropertyAccessExpression(expr.left)) {
         fenceNodeModuleMutation(lowerer, expr.left, "assignment");
@@ -8951,13 +8980,17 @@ export function lowerExprStatement(lowerer: Lowerer, expr: ts.Expression): IrStm
     return { kind: "block", body: [], loc: locOf(expr) };
   }
   if (
-    stmtNode !== undefined &&
-    ts.isExpressionStatement(stmtNode) &&
     ts.isBinaryExpression(expr) &&
     (expr.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken ||
       expr.operatorToken.kind === ts.SyntaxKind.BarBarToken)
   ) {
-    return lowerDiscardedLogical(lowerer, expr);
+    // A right operand without a value (`skip || (flag ? warnA() : warnB())`,
+    // where both arms are void calls) leaves the logical nothing to join:
+    // it is the branch `if (!skip) ...` wherever its result is discarded,
+    // a for loop's initializer and update included.
+    if (needsNoValue(lowerer, expr.right)) return lowerLogicalBranch(lowerer, expr);
+    if (stmtNode !== undefined && ts.isExpressionStatement(stmtNode))
+      return lowerDiscardedLogical(lowerer, expr);
   }
   const value = lowerer.lowerExpr(expr);
   // A bare unit-literal statement (`undefined;`): a pure no-op in JS,
@@ -9000,6 +9033,32 @@ function lowerDiscardedLogical(lowerer: Lowerer, expr: ts.BinaryExpression): IrS
     if (!local) throw e;
     lowerer.diags.length = diagsBefore;
   }
+  return lowerLogicalBranch(lowerer, expr);
+}
+
+/** True when the discarded `expr` needs no value: its type maps to void,
+ * or it is a logical or comma expression whose last operand needs none. A
+ * discarded logical whose right operand needs no value lowers as a branch
+ * that runs the operand as a statement. */
+function needsNoValue(lowerer: Lowerer, expr: ts.Expression): boolean {
+  while (ts.isParenthesizedExpression(expr)) expr = expr.expression;
+  if (
+    ts.isBinaryExpression(expr) &&
+    (expr.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken ||
+      expr.operatorToken.kind === ts.SyntaxKind.BarBarToken ||
+      expr.operatorToken.kind === ts.SyntaxKind.CommaToken)
+  )
+    return needsNoValue(lowerer, expr.right);
+  const type = lowerer.typeOf(expr);
+  return (
+    (type.flags & (ts.TypeFlags.Void | ts.TypeFlags.TypeParameter)) !== 0 &&
+    lowerer.mapTypeOf(type)?.kind === "void"
+  );
+}
+
+/** `a && b` as `if (a) b;` and `a || b` as `if (!a) b;`, with `b` lowered
+ * as a statement under the narrowing `a` gives it. */
+function lowerLogicalBranch(lowerer: Lowerer, expr: ts.BinaryExpression): IrStmt {
   const and = expr.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken;
   const cond = lowerer.lowerCondition(expr.left);
   if (cond.kind === "boolLit") {
@@ -11794,6 +11853,7 @@ function lowerForOfDyn(
   const iterator = lowerer.declareHiddenLocal("%dofIterator", DYN);
   const next = lowerer.declareHiddenLocal("%dofNext", DYN);
   const fast = lowerer.declareHiddenLocal("%dofNative", BOOL);
+  const generator = lowerer.declareHiddenLocal("%dofGenerator", F64);
   const done = lowerer.declareHiddenLocal("%dofDone", BOOL);
   done.mutable = true;
   const value = lowerer.declareHiddenLocal("%dofValue", DYN);
@@ -11803,6 +11863,15 @@ function lowerForOfDyn(
   needsClose.mutable = true;
   const error = lowerer.declareHiddenLocal("%dofError", CAUGHT);
   const syncIterator = asyncLoop ? lowerer.declareHiddenLocal("%dofSync", BOOL) : null;
+  lowerer.untypedLoops.set(generator, {
+    kind: generator.id,
+    value: value.id,
+    iterator: iterator.id,
+    next: next.id,
+    done: done.id,
+    async: asyncLoop,
+    sync: syncIterator?.id ?? null,
+  });
   const awaitDyn = (value: IrExpr): IrExpr => ({
     kind: "libCall",
     fn: "async.awaitDyn",
@@ -12077,6 +12146,14 @@ function lowerForOfDyn(
             : iteratorCanStep(varRef(iterator.id, DYN, loc), varRef(next.id, DYN, loc), loc),
           loc,
         },
+        // Which of the program's generator types the iterator is, once
+        // generator-dynamic-dispatch.ts knows them; 0 keeps the protocol.
+        {
+          kind: "varDecl",
+          localId: generator.id,
+          init: { kind: "numLit", value: 0, type: F64, loc },
+          loc,
+        },
         {
           kind: "varDecl",
           localId: done.id,

packages/compiler/src/frontend/lowering/lowerer.ts

@@ -21,7 +21,7 @@ import {
 import { isDeclBoundaryFile } from "../decl-projection.js";
 import { relieveHeapPressure } from "../../heap-pressure.js";
 import { moduleNamespaceObject, moduleNamespaceValue } from "./module-namespace-elements.js";
-import { keyedHelperName } from "./stable-names.js";
+import { keyedHelperName, moduleTagNumber, portableRelativePath } from "./stable-names.js";
 import { positionTag, StructuralPositions } from "./structural-positions.js";
 import { bindingSymbolOfRead, onlyForwarded, stripTypeWrappers } from "./typed-arguments.js";
 import {
@@ -181,6 +181,7 @@ import {
 } from "./class-dynamic-dispatch.js";
 import { addUntypedIntegrityWords, guardClassAttributeWrites } from "./class-attributes.js";
 import { inferredCollectionType } from "./js-collection-types.js";
+import { sloppyDynamicWrites } from "./frozen-records.js";
 import { guardFrozenWrites, markSloppyRecordWrites } from "./frozen-records.js";
 import { applyHandleProperties } from "./handle-properties.js";
 import { installBufferValue } from "./containers/bytes.js";
@@ -217,7 +218,7 @@ export { newFnCtx, type FnCtx } from "./function-context.js";
  * - Lexical scoping is resolved here: locals get function-unique ids
  *   ("x.0", "x.1" for shadowing); the IR is scope-flat.
  */
-import { dirname, relative, resolve } from "node:path";
+import { dirname, resolve } from "node:path";
 import { bindingSource } from "../binding-source.js";
 import { compilerOwnedFileName, tsgoPath } from "../dts-paths.js";
 import * as ts from "../ts7/adapter.js";
@@ -2069,6 +2070,21 @@ function byName(fns: readonly IrFunction[]): IrFunction[] {
   );
 }
 
+/** A loop over an untyped iterable (lowerForOfDyn). `kind` is a local the
+ * loop sets once it has opened the iterator: 0 for the dynamic protocol,
+ * or the 1-based index of the program's generator type it steps natively.
+ * `value` is the per-step local whose initializer takes one step. */
+export interface UntypedLoopSite {
+  kind: string;
+  value: string;
+  iterator: string;
+  next: string;
+  done: string;
+  /** `for await`; `sync` names its async-from-sync flag. */
+  async: boolean;
+  sync: string | null;
+}
+
 /** The program module a createRequire binding requires. */
 type CreateRequireTarget = NonNullable<ReturnType<typeof createRequireProgramModuleOf>>;
 
@@ -3605,6 +3621,11 @@ export class Lowerer {
    * values other than fresh literals (noteUntypedIntegrity). */
   untypedIntegrity = false;
   readonly liftedFns: IrFunction[] = [];
+  /** `for … of` and `for await` loops over untyped iterables, by their
+   * generator-kind local (generator-dynamic-dispatch.ts steps the program's
+   * own generators there on the typed path). Local ids repeat across
+   * functions; the local itself is in its function's locals. */
+  readonly untypedLoops = new Map<IrLocal, UntypedLoopSite>();
   /** global-values.ts's answer per JavaScript source: the receiver of its
    * first read of the global object by a computed name, or null. */
   readonly computedGlobalReads = new Map<ts.SourceFile, ts.Expression | null>();
@@ -3630,12 +3651,17 @@ export class Lowerer {
    * names do not depend on where the program sits, default library files
    * by their base name (two checkers install them in different
    * directories), and the files scriptc ships by their name inside scriptc,
-   * so names do not depend on where scriptc is installed either. */
-  readonly positions = new StructuralPositions((sf) =>
-    this.program.isSourceFileDefaultLibrary(sf)
+   * so names do not depend on where scriptc is installed either. Relative
+   * paths use `/` on every platform. */
+  readonly positions = new StructuralPositions((sf) => this.stableFileName(sf));
+
+  /** The name of `sf` in positions and module tags. */
+  stableFileName(sf: ts.SourceFile): string {
+    return this.program.isSourceFileDefaultLibrary(sf)
       ? `lib:${sf.fileName.slice(sf.fileName.lastIndexOf("/") + 1)}`
-      : (compilerOwnedFileName(sf.fileName) ?? relative(dirname(this.entry.fileName), sf.fileName)),
-  );
+      : (compilerOwnedFileName(sf.fileName) ??
+          portableRelativePath(dirname(this.entry.fileName), sf.fileName));
+  }
 
   /** The outermost node whose token span is exactly `loc`, or null. */
   nodeAtLoc(loc: SrcLoc): ts.Node | null {
@@ -4334,9 +4360,20 @@ export class Lowerer {
     // moduleOrder BEFORE any pass constructed — lowerToIr runs
     // appendDynamicImportModules once on the shared array (a per-pass run
     // here would repeatedly extend the graph and duplicate cycle reports).
-    this.moduleOrder.forEach((sf, i) => {
-      this.fileTag.set(sf, sf === entry ? "" : `%m${i}.`);
-    });
+    // A module's tag hashes its stable file name rather than numbering its
+    // place in moduleOrder, so adding or reordering modules leaves the other
+    // modules' function names, and the closure names keyed by them,
+    // unchanged. The native compiler's profile matches functions by name.
+    const tagNumbers = new Set<number>();
+    for (const sf of this.moduleOrder) {
+      if (sf === entry) {
+        this.fileTag.set(sf, "");
+        continue;
+      }
+      const n = moduleTagNumber(this.stableFileName(sf), tagNumbers);
+      tagNumbers.add(n);
+      this.fileTag.set(sf, `%m${n}.`);
+    }
     if (this.moduleOrder.length === 0) this.fileTag.set(entry, "");
     const jsDynamic = jsDynamicDeclarations(this.moduleOrder, this.checker);
     if (jsDynamic.size > 0) this.typeCtx.jsDynamicDeclaration = (decl) => jsDynamic.has(decl);
@@ -8826,6 +8863,7 @@ export class Lowerer {
     checkRequireBindingAccesses(this, functions);
     refuseX509DynValues(this, functions);
     markInferredFactChecks(functions, this.program);
+    const sloppyDynWrites = sloppyDynamicWrites(this, functions);
     const module: IrModule | null =
       this.diags.length > 0
         ? null
@@ -8860,6 +8898,7 @@ export class Lowerer {
               ? { freezableArrays: [...this.freezableArrays].sort() }
               : {}),
             ...(this.untypedIntegrity ? { untypedIntegrity: true as const } : {}),
+            ...(sloppyDynWrites.length > 0 ? { sloppyDynWrites } : {}),
             ...(isNodeEsmFile(this.entry, this.program) ? {} : { commonJsEntry: true }),
             ...(this.ffiImports.length > 0 ? { ffiImports: [...this.ffiImports] } : {}),
           };

packages/compiler/src/frontend/lowering/nan-coded-reads.ts

@@ -451,6 +451,19 @@ export class NanCodedReads {
 
   // ---- present reads ------------------------------------------------------
 
+  /** `xs[i]` whose index is a non-negative integer counter of the reading
+   * function and that a dominating `i < xs.length` guard bounds by the
+   * length: the read names an existing index. */
+  counterIndexInBounds(read: ts.ElementAccessExpression): boolean {
+    const index = peelTransparent(read.argumentExpression);
+    if (!ts.isIdentifier(index)) return false;
+    const symbol = this.symbolOf(index);
+    if (!symbol || !this.nonNegativeCounter(symbol)) return false;
+    const decl = this.host.declarationOf(symbol);
+    if (!decl || this.containingFunction(decl) !== this.containingFunction(read)) return false;
+    return indexReadInBounds(read);
+  }
+
   /** `t[i]` names an existing element: `i` is a non-negative integer
    * counter and a dominating guard bounds it by `t.length` (or by the
    * length of a typed array that always has the same length).

packages/compiler/src/frontend/lowering/narrowing-stability.ts

@@ -1,4 +1,5 @@
 import * as ts from "../ts7/adapter.js";
+import { heritageElementTarget } from "../heritage-elements.js";
 import { InternalCompilerError } from "../../errors.js";
 import { typeEquals } from "../../ir/ir.js";
 import type { IrType } from "../../ir/ir.js";
@@ -674,8 +675,9 @@ export class NarrowingStability {
       if (node.modifiers?.nodes.some((m) => m.kind === ts.SyntaxKind.Decorator)) return true;
       for (const clause of node.heritageClauses?.nodes ?? []) {
         for (const heritage of clause.types.nodes) {
-          const e = heritage.expression;
-          if (!ts.isIdentifier(e) && !ts.isPropertyAccessExpression(e)) return true;
+          const e = heritageElementTarget(heritage);
+          if (!ts.isIdentifier(e) && !ts.isPropertyAccessExpression(e) && !ts.isQualifiedName(e))
+            return true;
         }
       }
       return node.members.nodes.some(

packages/compiler/src/frontend/lowering/stable-names.test.ts

@@ -0,0 +1,21 @@
+import { expect, test } from "vitest";
+import { moduleTagNumber, portableRelativePath } from "./stable-names.js";
+
+test("module tag numbers depend only on the file name and stay distinct", () => {
+  const first = moduleTagNumber("lib/a.ts", new Set());
+  expect(moduleTagNumber("lib/a.ts", new Set([7, 8]))).toBe(first);
+  expect(moduleTagNumber("lib/b.ts", new Set())).not.toBe(first);
+  expect(moduleTagNumber("lib/a.ts", new Set([first]))).toBe((first + 1) >>> 0);
+  expect(moduleTagNumber("lib/a.ts", new Set([first, (first + 1) >>> 0]))).toBe((first + 2) >>> 0);
+});
+
+test("relative module paths use / on every platform", () => {
+  expect(portableRelativePath("/repo/src", "/repo/src/lib/a.ts", "linux")).toBe("lib/a.ts");
+  expect(portableRelativePath("C:/repo/src", "C:/repo/src/lib/a.ts", "win32")).toBe("lib/a.ts");
+  expect(portableRelativePath("C:\\repo\\src", "C:/repo/node_modules/x/index.d.ts", "win32")).toBe(
+    "../node_modules/x/index.d.ts",
+  );
+  expect(
+    moduleTagNumber(portableRelativePath("C:/repo", "C:/repo/lib/a.ts", "win32"), new Set()),
+  ).toBe(moduleTagNumber(portableRelativePath("/repo", "/repo/lib/a.ts", "linux"), new Set()));
+});

packages/compiler/src/frontend/lowering/stable-names.ts

@@ -1,4 +1,7 @@
+import * as posix from "node:path/posix";
+import * as win32 from "node:path/win32";
 import { InternalCompilerError } from "../../errors.js";
+import { tsgoPath } from "../ts7/session-path.js";
 
 /** The owner of the names keyedHelperName hands out. */
 export interface KeyedNameOwner {
@@ -46,3 +49,26 @@ export function keyedHelperName(
     throw new InternalCompilerError(`helper name ${name} is shared by two helper keys`);
   return name;
 }
+
+/** The number in the `%m<number>.` tag of the module named `fileName`: a
+ * 32-bit FNV-1a hash of the name, so a module keeps its tag when other
+ * modules are added, removed or reordered. A number in `taken` moves to the
+ * next free one, which keeps tags distinct. */
+export function moduleTagNumber(fileName: string, taken: ReadonlySet<number>): number {
+  let h = 0x811c9dc5;
+  for (let i = 0; i < fileName.length; i++) h = Math.imul(h ^ fileName.charCodeAt(i), 0x01000193);
+  let n = h >>> 0;
+  while (taken.has(n)) n = (n + 1) >>> 0;
+  return n;
+}
+
+/** The path of `file` relative to the directory `from`, with `/` separators
+ * on every platform, so names built from it match across hosts. */
+export function portableRelativePath(
+  from: string,
+  file: string,
+  platform: NodeJS.Platform = process.platform,
+): string {
+  const path = platform === "win32" ? win32.relative(from, file) : posix.relative(from, file);
+  return tsgoPath(path, platform);
+}

packages/compiler/src/ir/fields.generated.ts

@@ -2069,3 +2069,252 @@ export function walkTypeFields(node: IrType, walker: IrFieldWalker, skipType: bo
     }
   }
 }
+
+/** A field ir.ts declares that this file does not read. */
+type FieldsNotRead<T, Read extends PropertyKey> = Exclude<keyof T, Read>;
+/** The string or object values a field read as a scalar can hold. */
+type ValuesNotRead<T> = Extract<NonNullable<T>, string | object>;
+/** Fails type checking unless `T` is never: run `pnpm generate:ir-fields`. */
+type Unread<T extends never> = T;
+
+/** Every walked object type's fields as ir.ts declared them when this file
+ * was generated. */
+export type IrFieldsCurrent = [
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "arrIntrinsic" }>, "kind" | "method" | "receiver" | "args" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "arrayGet" }>, "kind" | "arr" | "index" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "arrayHas" }>, "kind" | "arr" | "index" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "arrayLit" }>, "kind" | "elems" | "spreads" | "capacity" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "arrayLit" }>["capacity"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "arrayNewLen" }>, "kind" | "length" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "arrayState" }>, "kind" | "arr" | "index" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "assignExpr" }>, "kind" | "localId" | "value" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "awaitExpr" }>, "kind" | "value" | "type" | "adopt" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "awaitExpr" }>["adopt"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "awaitUnionExpr" }>, "kind" | "value" | "promiseTag" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "awaitUnionExpr" }>["promiseTag"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "bin" }>, "kind" | "op" | "left" | "right" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "boolLit" }>, "kind" | "value" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "boolLit" }>["value"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "bytesIntrinsic" }>, "kind" | "method" | "receiver" | "args" | "type" | "loc" | "invalidNaN">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "bytesIntrinsic" }>["invalidNaN"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "bytesNew" }>, "kind" | "source" | "from" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "bytesNew" }>["from"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "call" }>, "kind" | "callee" | "args" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "callValue" }>, "kind" | "callee" | "receiver" | "args" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "caughtCheck" }>, "kind" | "value" | "className" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "caughtNarrow" }>, "kind" | "value" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "caughtTest" }>, "kind" | "value" | "test" | "className" | "negated" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "caughtTest" }>["negated"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "caughtToDyn" }>, "kind" | "value" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "chainRecv" }>, "kind" | "id" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "classRef" }>, "kind" | "className" | "captures" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "closure" }>, "kind" | "fnName" | "captures" | "adapts" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "closure" }>["adapts"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "downcast" }>, "kind" | "value" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "dynArrLit" }>, "kind" | "elems" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<NonNullable<Extract<NonNullable<Extract<IrExpr, { kind: "dynCall" }>["spreads"]>, readonly unknown[]>[number]>, object>, "arg" | "what">>,
+  Unread<ValuesNotRead<Extract<NonNullable<Extract<NonNullable<Extract<IrExpr, { kind: "dynCall" }>["spreads"]>, readonly unknown[]>[number]>, object>["arg"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "dynCall" }>, "kind" | "callee" | "receiver" | "calleeName" | "calleeNameValue" | "args" | "spreads" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "dynCheck" }>, "kind" | "value" | "preserveRefs" | "adopt" | "exact" | "inferredSite" | "origin" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "dynCheck" }>["preserveRefs"]>>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "dynCheck" }>["adopt"]>>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "dynCheck" }>["exact"]>>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "dynCheck" }>["origin"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "dynDestrCheck" }>, "kind" | "value" | "spelling" | "firstProp" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "dynFrom" }>, "kind" | "value" | "fnName" | "fnLength" | "liveRef" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "dynFrom" }>["fnLength"]>>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "dynFrom" }>["liveRef"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "dynHasKey" }>, "kind" | "key" | "negated" | "value" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "dynHasKey" }>["negated"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "dynInvoke" }>, "kind" | "recv" | "method" | "calleeName" | "calleeNameValue" | "args" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "dynIterN" }>, "kind" | "value" | "count" | "notIterableMessage" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "dynIterN" }>["count"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "dynKeyGet" }>, "kind" | "key" | "optional" | "value" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "dynKeyGet" }>["optional"]>>,
+  Unread<FieldsNotRead<Extract<NonNullable<Extract<NonNullable<Extract<IrExpr, { kind: "dynObjLit" }>["fields"]>, readonly unknown[]>[number]>, object>, "key" | "value">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "dynObjLit" }>, "kind" | "fields" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "dynScalarEq" }>, "kind" | "left" | "right" | "negated" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "dynScalarEq" }>["negated"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "dynTest" }>, "kind" | "test" | "bytesElem" | "negated" | "value" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "dynTest" }>["negated"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "ffiCall" }>, "kind" | "import" | "args" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "fieldAbsent" }>, "kind" | "unionId" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "fieldGet" }>, "kind" | "obj" | "className" | "field" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "fieldIncDec" }>, "kind" | "op" | "prefix" | "obj" | "className" | "field" | "fieldDyn" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "fieldIncDec" }>["prefix"]>>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "fieldIncDec" }>["fieldDyn"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "genResume" }>, "kind" | "mode" | "gen" | "arg" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "incDec" }>, "kind" | "op" | "prefix" | "localId" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "incDec" }>["prefix"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "instanceOf" }>, "kind" | "value" | "className" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "instanceOfValue" }>, "kind" | "value" | "classValue" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "intrinsic" }>, "kind" | "name" | "args" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "jsonStringify" }>, "kind" | "value" | "indent" | "circular" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "jsonStringify" }>["circular"]>>,
+  Unread<FieldsNotRead<Extract<NonNullable<Extract<IrExpr, { kind: "libCall" }>["assertOptions"]>, object>, "diff" | "skipPrototype">>,
+  Unread<ValuesNotRead<Extract<NonNullable<Extract<IrExpr, { kind: "libCall" }>["assertOptions"]>, object>["skipPrototype"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "libCall" }>, "kind" | "fn" | "args" | "type" | "loc" | "prototypeIdentityOnly" | "realTimer" | "assertOptions">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "libCall" }>["prototypeIdentityOnly"]>>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "libCall" }>["realTimer"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "logical" }>, "kind" | "op" | "left" | "right" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "mapIntrinsic" }>, "kind" | "method" | "receiver" | "args" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<NonNullable<Extract<NonNullable<Extract<IrExpr, { kind: "mapNew" }>["seed"]>, readonly unknown[]>[number]>, object>, "key" | "value">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "mapNew" }>, "kind" | "seed" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "moduleNsRef" }>, "kind" | "moduleId" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "new" }>, "kind" | "className" | "args" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "newPromise" }>, "kind" | "executor" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "newValue" }>, "kind" | "callee" | "args" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "nullish" }>, "kind" | "left" | "right" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "numLit" }>, "kind" | "value" | "spelling" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "numLit" }>["value"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "optChain" }>, "kind" | "id" | "receiver" | "body" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "orDefault" }>, "kind" | "left" | "right" | "retag" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "promiseVoidWiden" }>, "kind" | "value" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "promiseWithResolvers" }>, "kind" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<NonNullable<Extract<NonNullable<Extract<IrExpr, { kind: "recordClone" }>["overrides"]>, readonly unknown[]>[number]>, object>, "name" | "value">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "recordClone" }>, "kind" | "source" | "overrides" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "recordGet" }>, "kind" | "obj" | "shapeId" | "field" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "recordHas" }>, "kind" | "obj" | "shapeId" | "field" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "recordKeyGet" }>, "kind" | "obj" | "shapeId" | "key" | "overflowOnly" | "missNaN" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "recordKeyGet" }>["overflowOnly"]>>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "recordKeyGet" }>["missNaN"]>>,
+  Unread<FieldsNotRead<Extract<NonNullable<Extract<NonNullable<Extract<IrExpr, { kind: "recordLit" }>["fields"]>, readonly unknown[]>[number]>, object>, "name" | "value" | "overflow">>,
+  Unread<ValuesNotRead<Extract<NonNullable<Extract<NonNullable<Extract<IrExpr, { kind: "recordLit" }>["fields"]>, readonly unknown[]>[number]>, object>["overflow"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "recordLit" }>, "kind" | "fields" | "nullProto" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "recordLit" }>["nullProto"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "recordNullProto" }>, "kind" | "obj" | "shapeId" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "recordOvfHas" }>, "kind" | "obj" | "shapeId" | "key" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "recordOvfKeys" }>, "kind" | "obj" | "shapeId" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "regexIntrinsic" }>, "kind" | "method" | "receiver" | "args" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "regexLit" }>, "kind" | "pattern" | "flags" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "selfRef" }>, "kind" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "seqExpr" }>, "kind" | "stmts" | "result" | "generatorDelegate" | "diverges" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "seqExpr" }>["generatorDelegate"]>>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "seqExpr" }>["diverges"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "setIntrinsic" }>, "kind" | "method" | "receiver" | "args" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "setNew" }>, "kind" | "seed" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "strCmp" }>, "kind" | "op" | "left" | "right" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "strConcat" }>, "kind" | "left" | "right" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "strEq" }>, "kind" | "negated" | "left" | "right" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "strEq" }>["negated"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "strIntrinsic" }>, "kind" | "method" | "receiver" | "args" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "strLit" }>, "kind" | "value" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "templateStrings" }>, "kind" | "key" | "cooked" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "ternary" }>, "kind" | "cond" | "then" | "else_" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "toBool" }>, "kind" | "operand" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "toString" }>, "kind" | "operand" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "unary" }>, "kind" | "op" | "operand" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "unionDisc" }>, "kind" | "unionId" | "field" | "value" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "unionEq" }>, "kind" | "unionId" | "negated" | "sameValue" | "left" | "right" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "unionEq" }>["negated"]>>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "unionEq" }>["sameValue"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "unionFuncEq" }>, "kind" | "unionId" | "tag" | "union" | "func" | "negated" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "unionFuncEq" }>["tag"]>>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "unionFuncEq" }>["negated"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "unionIsTag" }>, "kind" | "unionId" | "tag" | "negated" | "value" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "unionIsTag" }>["tag"]>>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "unionIsTag" }>["negated"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "unionKeyGet" }>, "kind" | "unionId" | "key" | "value" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "unionNarrow" }>, "kind" | "unionId" | "tag" | "value" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "unionNarrow" }>["tag"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "unionRetype" }>, "kind" | "fromId" | "unionId" | "tags" | "value" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "unionWrap" }>, "kind" | "unionId" | "tag" | "value" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "unionWrap" }>["tag"]>>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "unitLit" }>, "kind" | "unit" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "upcast" }>, "kind" | "value" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "varRef" }>, "kind" | "localId" | "type" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "virtualCall" }>, "kind" | "className" | "method" | "args" | "type" | "loc" | "targets">>,
+  Unread<FieldsNotRead<Extract<NonNullable<Extract<IrExpr, { kind: "yieldExpr" }>["captureCompletion"]>, object>, "returnType">>,
+  Unread<FieldsNotRead<Extract<IrExpr, { kind: "yieldExpr" }>, "kind" | "value" | "awaited" | "delegated" | "captureCompletion" | "type" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "yieldExpr" }>["awaited"]>>,
+  Unread<ValuesNotRead<Extract<IrExpr, { kind: "yieldExpr" }>["delegated"]>>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "arrayDelete" }>, "kind" | "arr" | "index" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "arraySet" }>, "kind" | "arr" | "index" | "value" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "arraySetLength" }>, "kind" | "arr" | "length" | "loc" | "pop" | "reserve">>,
+  Unread<ValuesNotRead<Extract<IrStmt, { kind: "arraySetLength" }>["pop"]>>,
+  Unread<ValuesNotRead<Extract<IrStmt, { kind: "arraySetLength" }>["reserve"]>>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "arraySetUndefined" }>, "kind" | "arr" | "index" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "assign" }>, "kind" | "localId" | "value" | "initializes" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrStmt, { kind: "assign" }>["initializes"]>>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "block" }>, "kind" | "body" | "labels" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "break" }>, "kind" | "label" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "bytesSet" }>, "kind" | "arr" | "index" | "value" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "continue" }>, "kind" | "label" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "doWhile" }>, "kind" | "body" | "cond" | "labels" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "exprStmt" }>, "kind" | "expr" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "fieldSet" }>, "kind" | "obj" | "className" | "field" | "value" | "sloppy" | "define" | "attributesChecked" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrStmt, { kind: "fieldSet" }>["sloppy"]>>,
+  Unread<ValuesNotRead<Extract<IrStmt, { kind: "fieldSet" }>["define"]>>,
+  Unread<ValuesNotRead<Extract<IrStmt, { kind: "fieldSet" }>["attributesChecked"]>>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "for" }>, "kind" | "init" | "cond" | "update" | "body" | "labels" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "forOf" }>, "kind" | "localId" | "iterable" | "body" | "labels" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "if" }>, "kind" | "cond" | "then" | "else_" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "recordKeyDelete" }>, "kind" | "obj" | "shapeId" | "key" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "recordKeySet" }>, "kind" | "obj" | "shapeId" | "key" | "value" | "overflowOnly" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrStmt, { kind: "recordKeySet" }>["overflowOnly"]>>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "recordSet" }>, "kind" | "obj" | "shapeId" | "field" | "value" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "rethrow" }>, "kind" | "localId" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "return" }>, "kind" | "value" | "awaited" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrStmt, { kind: "return" }>["awaited"]>>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "runtimeFence" }>, "kind" | "code" | "message" | "loc">>,
+  Unread<FieldsNotRead<Extract<NonNullable<Extract<NonNullable<Extract<IrStmt, { kind: "switch" }>["cases"]>, readonly unknown[]>[number]>, object>, "test" | "body">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "switch" }>, "kind" | "disc" | "cases" | "labels" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "throw" }>, "kind" | "value" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "tryCatch" }>, "kind" | "tryBody" | "catchBody" | "catchLocalId" | "finallyBody" | "suppressFinallyErrors" | "dropFinallyErrors" | "loc">>,
+  Unread<ValuesNotRead<Extract<IrStmt, { kind: "tryCatch" }>["suppressFinallyErrors"]>>,
+  Unread<ValuesNotRead<Extract<IrStmt, { kind: "tryCatch" }>["dropFinallyErrors"]>>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "varDecl" }>, "kind" | "localId" | "init" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrStmt, { kind: "while" }>, "kind" | "cond" | "body" | "labels" | "loc">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "array" }>, "kind" | "elem" | "optionalElements">>,
+  Unread<ValuesNotRead<Extract<IrType, { kind: "array" }>["optionalElements"]>>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "bigint" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "bool" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "bytes" }>, "kind" | "elem">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "caught" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "child" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "childStream" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "childWriter" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "classval" }>, "kind" | "className">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "cryptoHash" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "cryptoHmac" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "date" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "dgramSocket" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "dir" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "dyn" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "f64" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "fileHandle" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "fsWatcher" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "func" }>, "kind" | "params" | "ret" | "rest" | "restAbi" | "argumentsAll">>,
+  Unread<ValuesNotRead<Extract<IrType, { kind: "func" }>["rest"]>>,
+  Unread<ValuesNotRead<Extract<IrType, { kind: "func" }>["argumentsAll"]>>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "generator" }>, "kind" | "async" | "yieldT" | "retT" | "nextT">>,
+  Unread<ValuesNotRead<Extract<IrType, { kind: "generator" }>["async"]>>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "http2Session" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "http2Stream" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "httpClientReq" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "httpReq" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "httpRes" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "jsval" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "map" }>, "kind" | "key" | "value">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "moduleNs" }>, "kind" | "moduleId">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "netServer" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "netSocket" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "nullT" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "object" }>, "kind" | "className">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "procStream" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "promise" }>, "kind" | "inner">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "record" }>, "kind" | "shapeId">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "regex" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "searchParams" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "secureCtx" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "set" }>, "kind" | "elem">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "spawnRes" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "stats" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "string" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "symbol" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "testCtx" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "undefinedT" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "union" }>, "kind" | "unionId">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "url" }>, "kind">>,
+  Unread<FieldsNotRead<Extract<IrType, { kind: "void" }>, "kind">>,
+];

packages/compiler/src/ir/function-references.test.ts

@@ -234,6 +234,7 @@ const MODULE_FIELDS: Record<StringFields<Omit<IrModule, "functions">>, Role> = {
   "nodeIsland.modules.files[].sha256": "other",
   "nodeIsland.modules.links[].path": "other",
   "nodeIsland.modules.links[].target": "other",
+  "sloppyDynWrites[]": "other",
   "inferredFactFiles[].file": "other",
   "inferredFactFiles[].pkg": "other",
   "declOrigins[]": "other",

packages/compiler/src/ir/int32-slots.ts

@@ -1484,6 +1484,39 @@ export function analyzeInt32Slots(mod: IrModule, inputs: Int32SlotInputs = {}):
       continue;
     }
     const int32 = (e: IrExpr): boolean => withinInt32(ranges.get(e));
+    // The range of an exact integer that may also be NaN: an element read
+    // of a candidate through `getNumber` (`a[k]!` in arithmetic, NaN for a
+    // missing element), and `+`, `-` and `*` over such values and integers.
+    // A checked store widens the array at a NaN like at any value that is
+    // not an int32.
+    const integerOrNaN = (e: IrExpr): IntegerRange | null => {
+      const range = ranges.get(e);
+      if (range) return range;
+      if (e.kind === "numLit")
+        return Number.isInteger(e.value) ? { min: e.value, max: e.value } : null;
+      if (e.kind === "arrIntrinsic" && e.method === "getNumber" && e.receiver.kind === "varRef")
+        return slots.hasInt32ElementSlot(int32ArraySlot(int32ArrayKey(fn.name, e.receiver.localId)))
+          ? INT32_RANGE
+          : null;
+      if (e.kind !== "bin" || (e.op !== "+" && e.op !== "-" && e.op !== "*")) return null;
+      const left = integerOrNaN(e.left);
+      const right = left && integerOrNaN(e.right);
+      if (!left || !right) return null;
+      const bounds =
+        e.op === "+"
+          ? [left.min + right.min, left.max + right.max]
+          : e.op === "-"
+            ? [left.min - right.max, left.max - right.min]
+            : [
+                left.min * right.min,
+                left.min * right.max,
+                left.max * right.min,
+                left.max * right.max,
+              ];
+      const min = Math.min(...bounds);
+      const max = Math.max(...bounds);
+      return Math.abs(min) < 2 ** 53 && Math.abs(max) < 2 ** 53 ? { min, max } : null;
+    };
     // Every element stored into an int32 array candidate must be an int32
     // under the facts that assume the candidates' own elements are; a
     // failing store drops its array's element facts, and the function is
@@ -1513,6 +1546,10 @@ export function analyzeInt32Slots(mod: IrModule, inputs: Int32SlotInputs = {}):
       for (const [id, values] of int32ArrayStores(fn, arrays)) {
         const key = int32ArrayKey(fn.name, id);
         if (!slots.hasInt32ElementSlot(int32ArraySlot(key)) || values.every(int32)) continue;
+        // Checked stores serve a lone local: its allocations are the only
+        // arrays it holds. Its stores are judged under the element facts
+        // the ranges were computed with.
+        const checkable = values.every((value) => int32(value) || integerOrNaN(value) !== null);
         // The array's group drops together: every function reading a
         // member is analyzed again without its facts.
         const group = arrayGroups.group.get(key) ?? [key];
@@ -1523,17 +1560,11 @@ export function analyzeInt32Slots(mod: IrModule, inputs: Int32SlotInputs = {}):
             if (names) for (const name of names) requeue(name);
           } else requeue(member.slice(0, member.indexOf("\0")));
         }
-        // Checked stores serve a lone local: its allocations are the only
-        // arrays it holds.
-        const checkable = (value: IrExpr): boolean => {
-          const range = ranges.get(value);
-          return int32(value) || range != null;
-        };
         if (
           group.length === 1 &&
           !key.startsWith("\0") &&
           !params.has(id) &&
-          values.every(checkable) &&
+          checkable &&
           checkableInt32Allocations(fn, id)
         )
           slots.checkedInt32Arrays.add(key);

packages/compiler/src/ir/ir.ts

@@ -1101,6 +1101,11 @@ export interface IrModule {
    * (frontend frozen-records.ts): their writes test the array's frozen bit
    * (SCR_ARR_FROZEN) and throw Node's TypeError when it is set. */
   freezableArrays?: string[];
+  /** Source ranges ("file\0start\0end") of untyped property writes in
+   * sloppy-mode code (frontend frozen-records.ts sloppyDynamicWrites):
+   * their dyn.keySet/keySetComputed calls ignore an assignment that strict
+   * mode refuses with a TypeError. */
+  sloppyDynWrites?: string[];
   /** The program freezes, seals or prevents extensions of untyped values
    * (frontend frozen-records.ts noteUntypedIntegrity). Class hierarchies
    * that can be held there carry an integrity word, which the runtime sets

packages/compiler/src/ir/parameter-versions.ts

@@ -122,7 +122,7 @@ function numericLoop(loop: IrStmt, functions: ReadonlyMap<string, IrFunction>):
       const target = functions.get(e.callee);
       allowed = target !== undefined && simple(target);
     } else if (e.kind === "libCall") allowed = e.fn.startsWith("math.");
-    else if (e.kind === "arrIntrinsic") allowed = e.method === "length";
+    else if (e.kind === "arrIntrinsic") allowed = e.method === "length" || e.method === "getNumber";
     return allowed && everyExprChild(e, expr, stmt);
   };
   const stmt = (s: IrStmt): boolean =>

packages/compiler/src/ir/runtime-features.ts

@@ -1373,7 +1373,7 @@ function scanRuntimeFeatures(
     for (const t of nodes.types) type(t);
   } else if (keepGoing()) everyModuleNode(mod, { expr, stmt: keepGoing, type });
   for (const { name, scan } of scans) if (scan.result()) features[name] = true;
-  // Inline-cache sites of dynamic-tier functions use the tier's shapes
+  // Inline-cache sites of dynamic-tier functions use the tier's caches
   // (scr_js_object.c, with the SCR_JS_TIER build of scr_json.c).
   if (!features.dynTier && mod.functions.some((fn) => fn.tier === "dynamic")) {
     const sites = new JsIcSites(mod);

packages/compiler/src/native/compiler.ts

@@ -70,7 +70,7 @@ import {
 import { splitLlvmLibraryProgram } from "../backend/llvm/split.js";
 import { prepareNativeExecutable, prepareNativeLibrary } from "./prepare.js";
 import { buildSanitizedRuntime, sanitizerDriver, sanitizerFlags } from "./sanitizer.js";
-import { lldLinkerArgs } from "../backend/lld.js";
+import { inputsWithoutLld, lldLinkerArgs } from "../backend/lld.js";
 import { openNativeExecutableCache } from "./executable-cache.js";
 import { LinkerJobs } from "./linker-job.js";
 import { nativeFileIdentity } from "./file-identity.js";
@@ -569,15 +569,16 @@ export class NativeCompiler {
         });
         // Linux links with lld when the driver finds it.
         const lld = options.sanitize ? [] : lldLinkerArgs(target.platform, toolchain.linker);
-        const linkArgs = [
+        const linkArgsWith = (withLld: boolean): string[] => [
           ...(options.sanitize ? ["-fsanitize=address"] : toolchain.linkerArgs),
-          ...lld,
+          ...(withLld ? lld : []),
           ...plan.driverFlags,
-          ...plan.inputs,
+          ...(withLld ? plan.inputs : inputsWithoutLld(target.platform, plan.inputs)),
           ...systemLibraryLinkerArgs(target, plan.systemLibraries),
           "-o",
           stagedOutput,
         ];
+        const linkArgs = linkArgsWith(lld.length !== 0);
         // Host Linux links with lld run the linker job the driver would.
         const jobs = LinkerJobs.open(this.cache, toolchain, lld, options.sanitize ?? false);
         const job = jobs?.link([...plan.inputs, stagedOutput], stage);
@@ -593,10 +594,7 @@ export class NativeCompiler {
             // A failed link with lld runs again with the driver's default
             // linker, whose error (if any) is the one reported.
             if (lld.length === 0) throw error;
-            runNativeTool(
-              driver,
-              linkArgs.filter((arg) => !lld.includes(arg)),
-            );
+            runNativeTool(driver, linkArgsWith(false));
           }
         }
         timing("native-link");

packages/compiler/src/native/sanitizer.ts

@@ -14,7 +14,7 @@ import {
   selectedRuntimeUnits,
   type RuntimePackMode,
 } from "../backend/runtime-pack-core.js";
-import { LRE_SOURCES, ZLIB_SOURCES } from "../backend/vendor-inputs.js";
+import { LRE_SOURCES, zlibInputs } from "../backend/vendor-inputs.js";
 import { contentDigest, type NativeCache } from "./cache.js";
 import type { NativeToolchain } from "./toolchain.js";
 
@@ -171,9 +171,10 @@ export function buildSanitizedRuntime(
       directory = quickjs;
       args = ["-std=c11", "-I", quickjs];
     } else if (name === "zlib") {
-      sources = ZLIB_SOURCES;
+      const inputs = zlibInputs(toolchain.target.llvmTriple);
+      sources = inputs.sources;
       directory = zlib;
-      args = ["-std=c11", "-I", zlib];
+      args = ["-std=c11", ...inputs.defines.map((define) => "-D" + define), "-I", zlib];
     } else if (name === "mbedtls") {
       directory = join(mbedtls, "library");
       sources = readdirSync(directory)

packages/compiler/test/await-call-emission.test.ts

@@ -9,13 +9,19 @@ afterEach(async () => {
   await Promise.all(directories.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
 });
 
-async function emit(source: string): Promise<string> {
+async function emit(source: string, optimization?: "dev"): Promise<string> {
   const outDir = await mkdtemp(join(tmpdir(), "scriptc-await-call-"));
   directories.push(outDir);
   const entry = join(outDir, "main.ts");
   await writeFile(entry, source);
   const outPath = join(outDir, "program.ll");
-  const result = await compile(entry, { entry, outDir, outPath, outputKind: "llvm" });
+  const result = await compile(entry, {
+    entry,
+    outDir,
+    outPath,
+    outputKind: "llvm",
+    ...(optimization !== undefined ? { optimization } : {}),
+  });
   expect(result.ok, JSON.stringify(result)).toBe(true);
   return readFile(outPath, "utf8");
 }
@@ -28,8 +34,9 @@ function definition(llvm: string, symbol: string): string {
   return match![0];
 }
 
-// Consuming an async generator keeps a body on its fiber: the await-call
-// entries serve fiber bodies (stackless bodies suspend at their awaits).
+// The await-call entries serve fiber bodies (stackless bodies suspend at
+// their awaits). Debug builds keep every async body on its fiber, so the
+// sources below that test them build with optimization "dev".
 const tick = `
 async function* tick(): AsyncGenerator<number, void, undefined> {
   yield 0;
@@ -58,7 +65,7 @@ void main();
 `;
 
 test("awaiting a direct call to a body that never suspends skips the promise", async () => {
-  const llvm = await emit(source);
+  const llvm = await emit(source, "dev");
   expect(definition(llvm, "sc_f_middle")).toContain("call double @sc_aw_leaf(double");
   const entry = definition(llvm, "sc_aw_leaf");
   expect(entry).toContain("call double @sc_f_leaf(double %a0)");
@@ -74,7 +81,7 @@ test("awaiting a direct call to a body that never suspends skips the promise", a
 });
 
 test("awaiting a direct call to a suspending body spawns and awaits in one call", async () => {
-  const llvm = await emit(source);
+  const llvm = await emit(source, "dev");
   const main = definition(llvm, "sc_f_main");
   expect(main).toContain("call double @sc_aw_middle(double");
   // A call whose promise is kept keeps the promise-returning entry.
@@ -82,7 +89,7 @@ test("awaiting a direct call to a suspending body spawns and awaits in one call"
   expect(definition(llvm, "sc_aw_middle")).toContain(
     "call double @scr_async_spawn_await_f64(ptr @sc_tr_middle, ptr %ap)",
   );
-  // middle consumes an async generator, so it keeps its fiber.
+  // The debug build keeps middle on its fiber.
   expect(definition(llvm, "sc_as_middle")).toContain("@scr_async_spawn(");
 });
 
@@ -119,7 +126,7 @@ void main();
 `;
 
 test("returning a direct call adopts its promise one microtask turn later", async () => {
-  const llvm = await emit(adoptSource);
+  const llvm = await emit(adoptSource, "dev");
   expect(definition(llvm, "sc_f_relay")).toContain("call double @sc_ad_leaf(double");
   // A body that never suspends: the adoption's then-job turn, then the
   // settled promise's own turn, still without materializing the promise.
@@ -141,7 +148,7 @@ test("returning a direct call adopts its promise one microtask turn later", asyn
 });
 
 test("a returned promise is adopted after finally regions, outside catch handlers", async () => {
-  const llvm = await emit(adoptSource);
+  const llvm = await emit(adoptSource, "dev");
   const guarded = definition(llvm, "sc_f_guarded");
   // The call produces the promise; the finally body runs; only then the
   // adoption turn and the await.
@@ -167,7 +174,7 @@ async function middle(x: number): Promise<number> {
   const z = await leaf(y);
   return y * 2 + z;
 }
-async function fibered(): Promise<number> {
+async function fibered(): Promise<any> {
   let s = 0;
   for await (const t of tick()) s += t;
   return s + (await middle(1));
@@ -206,8 +213,9 @@ test("bodies that suspend only at their own awaits compile to stackless coroutin
   expect(middle).not.toContain("@scr_await_f64(");
   expect(definition(llvm, "sc_as_middle")).toContain("@scr_async_spawn_stackless(");
   expect(definition(llvm, "sc_f_main")).toContain("@scr_coro_await_prepare(");
-  // A body that keeps its fiber still awaits a stackless callee in one
-  // call: spawn, then the ordinary await of its promise.
+  // A body with a dynamic result keeps its fiber, and still awaits a
+  // stackless callee in one call: spawn, then the ordinary await of its
+  // promise.
   expect(definition(llvm, "sc_as_fibered")).toContain("@scr_async_spawn(");
   expect(definition(llvm, "sc_f_fibered")).toContain("call double @sc_aw_middle(double");
   const entry = definition(llvm, "sc_aw_middle");

packages/compiler/test/bytes-element-emission.test.ts

@@ -404,7 +404,7 @@ test("large record clones stay outlined while small clones remain inlineable", (
   expect(small).toContain("define internal ptr @sc_rclone_small(ptr %src) #0");
   expect(small).not.toContain("attributes #2");
   expect(large).toContain("define internal ptr @sc_rclone_large(ptr %src) #2");
-  expect(large).toContain("attributes #2 = { noinline sanitize_address }");
+  expect(large).toContain("attributes #2 = { noinline sanitize_address uwtable }");
 });
 
 test("Uint8ClampedArray stores clamp and round without a runtime call", () => {

packages/compiler/test/counted-loop-emission.test.ts

@@ -137,6 +137,59 @@ test("worker programs poll counted loops over typed arrays between blocks of ite
   }
 });
 
+test("ELF worker executables poll the loops of a nest on every iteration", async () => {
+  const dir = await mkdtemp(join(tmpdir(), "scriptc-nest-poll-"));
+  try {
+    const entry = join(dir, "nest.ts");
+    await writeFile(
+      entry,
+      [
+        'import { isMainThread, Worker } from "node:worker_threads";',
+        "export function steps(limit: number): number {",
+        "  let total = 0;",
+        "  for (let start = 1; start < limit; start++) {",
+        "    let x = start;",
+        "    while (x !== 1) {",
+        "      x = x % 2 === 0 ? x / 2 : 3 * x + 1;",
+        "      total++;",
+        "    }",
+        "  }",
+        "  return total;",
+        "}",
+        "export function mix(n: number): number {",
+        "  let t = 0;",
+        "  for (let i = 0; i < n; i++) t = (t * 31 + i) % 1000003;",
+        "  return t;",
+        "}",
+        "console.log(steps(8), mix(8));",
+        "if (!isMainThread) new Worker(new URL(import.meta.url));",
+      ].join("\n"),
+    );
+    const outPath = join(dir, "nest.ir.json");
+    const result = await compile(entry, { outPath, outDir: dir, outputKind: "ir" });
+    if (!result.ok) throw new Error(result.diagnostics.map((d) => d.message).join("\n"));
+    const mod = deserializeModule(await readFile(outPath, "utf8"));
+    const body = (ll: string, name: string): string =>
+      ll.match(
+        new RegExp(
+          `define internal [^\\n]+ @sc_b?f_${name}(?:\\.i32)?\\([^\\n]*\\n([\\s\\S]*?)\\n\\}`,
+        ),
+      )![1]!;
+    // Both loops of the nest test the thread's pending word on every
+    // iteration and keep no countdown; a loop on its own keeps one.
+    const elf = emitLlvmModule(mod, { targetTriple: "x86_64-unknown-linux-gnu" });
+    const steps = body(elf, "steps");
+    expect(steps).not.toContain("worker cancellation budget");
+    expect(steps.match(/= load atomic i32, ptr @scr_exc_flag monotonic/g)?.length).toBe(2);
+    expect(body(elf, "mix")).toContain("worker cancellation budget");
+    // Elsewhere the poll reads the process-wide alert word: the nest counts.
+    const darwin = emitLlvmModule(mod, { targetTriple: "arm64-apple-macosx14.0.0" });
+    expect(body(darwin, "steps").match(/worker cancellation budget/g)?.length).toBe(2);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
 test("worker programs poll no loop whose proven ranges bound its runs inside another loop", async () => {
   const dir = await mkdtemp(join(tmpdir(), "scriptc-bounded-loop-polls-"));
   try {

packages/compiler/test/cpu-dispatch-emission.test.ts

@@ -119,10 +119,10 @@ test("a dispatching x86-64 build gives each program function a baseline and an x
   for (const [name] of coroutines) expect(defs.has(`${name}.v3`), name).toBe(false);
   // Functions used as values are referenced by their dispatching name.
   expect(ll).not.toMatch(/ptr @[\w.$-]+\.(v3|base)(?!\()/);
-  expect(ll).toMatch(/^attributes #3 = \{ sanitize_address "target-cpu"="x86-64-v3" \}$/m);
+  expect(ll).toMatch(/^attributes #3 = \{ sanitize_address uwtable "target-cpu"="x86-64-v3" \}$/m);
   // Unsanitized builds leave sanitize_address out of the copies' groups too.
   expect(emit({ ...x86, cpuDispatch: true, sanitizeAttributes: false })).toMatch(
-    /^attributes #3 = \{ "target-cpu"="x86-64-v3" \}$/m,
+    /^attributes #3 = \{ uwtable "target-cpu"="x86-64-v3" \}$/m,
   );
   // main sets the level before anything else runs.
   expect(defs.get("main")).toMatch(

packages/compiler/test/forin-keys.test.ts

@@ -36,7 +36,7 @@ console.log(count(row), count(JSON.parse('{"b":1}')));
   expect(llvm).not.toContain("@scr_dyn_for_in_keys(");
   // Fully required record shapes are marked fixed for the stable walk.
   expect(llvm).toMatch(
-    /_rops = internal global \{ i64, ptr, ptr, ptr, i8, ptr, ptr \} \{[^}]*i8 1, ptr null, ptr null \}/,
+    /_rops = internal global \{ i64, ptr, ptr, ptr, i8, ptr, ptr, ptr \} \{[^}]*i8 1, ptr null, ptr null, ptr null \}/,
   );
 });
 

packages/compiler/test/generator-emission.test.ts

@@ -9,13 +9,19 @@ afterEach(async () => {
   await Promise.all(directories.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
 });
 
-async function emit(source: string): Promise<string> {
+async function emit(source: string, optimization?: "dev"): Promise<string> {
   const outDir = await mkdtemp(join(tmpdir(), "scriptc-generator-"));
   directories.push(outDir);
   const entry = join(outDir, "main.ts");
   await writeFile(entry, source);
   const outPath = join(outDir, "program.ll");
-  const result = await compile(entry, { entry, outDir, outPath, outputKind: "llvm" });
+  const result = await compile(entry, {
+    entry,
+    outDir,
+    outPath,
+    outputKind: "llvm",
+    ...(optimization !== undefined ? { optimization } : {}),
+  });
   expect(result.ok, JSON.stringify(result)).toBe(true);
   return readFile(outPath, "utf8");
 }
@@ -50,7 +56,7 @@ console.log(sum);
   expect(definition(llvm, "sc_f_range")).not.toContain("@scr_coro_yield_f64(");
   expect(llvm).not.toContain("@scr_gen_take_out_f64(");
   expect(llvm).toContain("%ScrGenHead = type { i64, ptr, ptr, i32, %ScrGenSlot }");
-  expect(llvm).toContain("attributes #1 = { presplitcoroutine }");
+  expect(llvm).toContain("attributes #1 = { uwtable presplitcoroutine }");
   expect(definition(llvm, "sc_gs_range")).toContain("call ptr @scr_gen_new_stackless(");
   expect(llvm).not.toContain("@scr_gen_yield_f64(");
 });
@@ -117,7 +123,7 @@ console.log(sum, r.value);
   expect(llvm).toMatch(/define internal ptr @sc_gres_\d+\(ptr %g\)[^\n]*\(dyn channel\)/);
 });
 
-test("async generators keep their fibers", async () => {
+test("async generators that suspend only at their own awaits and yields compile to stackless coroutines", async () => {
   const llvm = await emit(`
 async function* ticks(n: number): AsyncGenerator<number, void, undefined> {
   for (let i = 0; i < n; i++) {
@@ -130,6 +136,36 @@ async function main(): Promise<void> {
 }
 void main();
 `);
+  const body = definition(llvm, "sc_f_ticks");
+  expect(body).toMatch(/^define internal void @sc_f_ticks(?:\.i32)?\(double [^)]*\) #1 /);
+  // The await suspends the coroutine (one turn for a non-promise operand),
+  // and the yield stores OUT before its own suspension.
+  expect(body).toContain("call zeroext i1 @scr_coro_hop_prepare(ptr");
+  expect(body).toContain("call void @scr_coro_yield_f64(ptr");
+  expect(body).toContain("call void @scr_gen_coro_finish(ptr");
+  expect(body).not.toContain("@scr_await_hop(");
+  expect(body).not.toContain("@scr_gen_yield_f64(");
+  expect(definition(llvm, "sc_gs_ticks")).toContain("call ptr @scr_async_gen_new_stackless(");
+  // Consuming the generator does not park its consumer.
+  expect(definition(llvm, "sc_as_main")).toContain("@scr_async_spawn_stackless(");
+});
+
+test("debug builds keep async generators on their fibers", async () => {
+  const llvm = await emit(
+    `
+async function* ticks(n: number): AsyncGenerator<number, void, undefined> {
+  for (let i = 0; i < n; i++) {
+    await null;
+    yield i;
+  }
+}
+async function main(): Promise<void> {
+  for await (const t of ticks(3)) console.log(t);
+}
+void main();
+`,
+    "dev",
+  );
   expect(definition(llvm, "sc_gs_ticks")).toContain("call ptr @scr_async_gen_new(");
   expect(llvm).not.toContain("presplitcoroutine");
 });

packages/compiler/test/js-ic-emission.test.ts

@@ -50,6 +50,10 @@ console.log(read(o), at(dyn([5, 6]), 1), call(o), o.n);
     );
     expect(body(llvm, "read")).toContain("@scr_js_get_probe(");
     expect(body(llvm, "write")).toContain("@scr_js_store_probe(");
+    // Reads and writes test the first two entries inline: the second
+    // starts 40 bytes into the record.
+    for (const site of ["read", "write"])
+      expect(body(llvm, site)).toMatch(/getelementptr inbounds i8, ptr @sc_js_ic_\d+, i64 40$/m);
     expect(body(llvm, "at")).toContain("@scr_js_keyed_probe(");
     expect(body(llvm, "call")).toContain("@scr_js_load_probe(");
     // A compound assignment stores its number result from the jsval: an
@@ -139,6 +143,50 @@ console.log(read(o), read(p), read(t), at(dyn([5, 6]), 1), at(p, "x"), at(t, "ta
   }
 });
 
+test("property reads answer class instances' declared fields inline", async () => {
+  const dir = await mkdtemp(join(tmpdir(), "scriptc-js-ic-capsule-"));
+  try {
+    const entry = join(dir, "main.js");
+    const outPath = join(dir, "main.ir.json");
+    await writeFile(
+      entry,
+      `
+class Point {
+  constructor(x) { this.x = x; }
+}
+class Tagged extends Point {
+  constructor(x, tag) { super(x); this.tag = tag; }
+}
+class Gauge {
+  get x() { return 9; }
+}
+function dyn(v) { return v; }
+function read(o) { return o.x; }
+function tag(o) { return o.tag; }
+var p = dyn(new Point(4));
+var t = dyn(new Tagged(6, "t"));
+console.log(read(p), read(t), read(dyn(new Gauge())), read({ x: 1 }), tag(t));
+`,
+    );
+    const result = await compile(entry, { outDir: dir, outPath, outputKind: "ir" });
+    if (!result.ok)
+      throw new Error(result.diagnostics.map((d) => `${d.code}: ${d.message}`).join("\n"));
+    const mod = deserializeModule(await readFile(outPath, "utf8"));
+    expect(validateModule(mod)).toEqual([]);
+    const llvm = emitLlvmModule(mod);
+    const read = body(llvm, "read");
+    // Point and Tagged instances load the field after one key compare
+    // each; Gauge's getter, and every other receiver, keeps the probe and
+    // the helper.
+    expect(read.match(/^icc\.m\d+:/gm)).toHaveLength(2);
+    expect(read).toContain("@scr_js_get_probe(");
+    expect(read).toMatch(/@sc_b?f__x25_dyn_class_property_\d+\(ptr %t\d+\) noinline cold/);
+    expect(body(llvm, "tag").match(/^icc\.m\d+:/gm)).toHaveLength(1);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
 test("typed programs have no cache sites and keep the ordinary runtime", async () => {
   const dir = await mkdtemp(join(tmpdir(), "scriptc-js-ic-typed-"));
   try {

packages/compiler/test/stable-names.test.ts

@@ -117,3 +117,44 @@ test("names do not depend on the directory the program sits in", async () => {
   const [second] = await lower(recursive);
   expect(names(second!)).toEqual(names(first!));
 });
+
+/** Lowers a program of several files; `main.ts` is the entry. */
+async function lowerFiles(files: Record<string, string>): Promise<IrModule> {
+  const dir = await mkdtemp(join(tmpdir(), "scriptc-stable-names-"));
+  try {
+    for (const [name, source] of Object.entries(files)) await writeFile(join(dir, name), source);
+    const outPath = join(dir, "main.ir.json");
+    const result = await compile(join(dir, "main.ts"), { outDir: dir, outPath, outputKind: "ir" });
+    if (!result.ok)
+      throw new Error(result.diagnostics.map((d) => `${d.code}: ${d.message}`).join("\n"));
+    return deserializeModule(await readFile(outPath, "utf8"));
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+test("a module's names do not depend on the modules loaded before it", async () => {
+  const shapes = `
+export class Box {
+  constructor(private value: number) {}
+  scaled(by: number): number { return this.value * by; }
+}
+export function boxes(count: number): number[] {
+  return Array.from({ length: count }, (_, i) => new Box(i).scaled(2));
+}
+`;
+  const before = await lowerFiles({
+    "shapes.ts": shapes,
+    "main.ts": `import { boxes } from "./shapes";\nconsole.log(boxes(3).join(","));\n`,
+  });
+  const after = await lowerFiles({
+    "offsets.ts": `export function offset(x: number): number { return x + 1; }\n`,
+    "shapes.ts": shapes,
+    "main.ts": `import { offset } from "./offsets";\nimport { boxes } from "./shapes";\nconsole.log(offset(1), boxes(3).join(","));\n`,
+  });
+  // The class, its methods, the function and the closure it lifts.
+  const ofShapes = (mod: IrModule) =>
+    names(mod).filter((name) => /Box|boxes/.test(name) || name.startsWith("%fn."));
+  expect(ofShapes(before).length).toBeGreaterThanOrEqual(4);
+  expect(ofShapes(after)).toEqual(ofShapes(before));
+});

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7393-non-null-element-operands.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7393-non-null-element-operands.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7395-non-null-element-dereference.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7395-non-null-element-dereference.ts"
+ ],
+ "diags": []
+}