@geastack/compiler 1.0.15 → 1.0.16

package/dist/ir/integers.js

@@ -240,8 +240,30 @@ export const narrowableIntegersOf = (body, storage = noStorageFacts) => {
             return true;
         if (compute.form === 'update')
             return integral.has(left.value);
-        if (compute.form === 'unary')
-            return (compute.operator === '-' || compute.operator === '+') && integral.has(left.value);
+        if (compute.form === 'unary') {
+            if (compute.operator !== '-' && compute.operator !== '+')
+                return false;
+            // Negating a zero this census can SEE is the one negation whose result a
+            // 64-bit integer cannot carry. `-0` is an integer by every arithmetic
+            // test -- `Number.isSafeInteger(-0)` is true and `-0 === 0` -- so nothing
+            // else here strikes it; but two's complement has a single zero, and the
+            // sign is gone at the store. ECMA-262 can read that sign back
+            // (`Object.is(x, -0)` is true where `Object.is(x, 0)` is false, and
+            // `1 / -0` is `-Infinity`), so a slot narrowed on the strength of a `-0`
+            // answers both the other way with no diagnostic. `emit.ts` already
+            // spells this operand `-0.0` for exactly that reason; the value it
+            // carefully produces is then rounded away by the storage this census
+            // hands out.
+            //
+            // Only the statically visible one is refused. A `-0` that arises at
+            // runtime -- `x * -1`, `-1 % 1`, `x - x` never, but `x * y` with either
+            // zero -- is the same class of hazard as an overflowing sum, which this
+            // design already tolerates: refusing every product and remainder that
+            // COULD be a negative zero would narrow nothing at all.
+            if (compute.operator === '-' && constants.get(left.value) === 0)
+                return false;
+            return integral.has(left.value);
+        }
         if (compute.form !== 'binary' || !right)
             return false;
         if (compute.operator === '%') {

package/dist/ir/transfer.js

@@ -137,7 +137,6 @@ export const ownedDyingValuesOf = (body) => {
         }
     }
     const graph = controlFlowGraphOf(body);
-    const cyclic = cyclicBlocksOf(body);
     const dying = new Set();
     for (const [value, definition] of definitions) {
         const readers = uses.get(value);
@@ -146,17 +145,27 @@ export const ownedDyingValuesOf = (body) => {
         const use = readers[0];
         if (use === undefined)
             continue;
-        // A value defined outside a loop can still have its sole SSA use inside
-        // the loop. Moving at that use empties the storage on the first iteration
-        // and every later iteration observes a null Ref. The CFG re-entry check
-        // below only handles distinct definition/use blocks, so exclude cyclic
-        // uses before the same-block fast path as well.
-        if (cyclic.has(use))
-            continue;
+        // Defined and consumed in ONE block: the definition dominates the use, so
+        // every execution of the block writes the storage before the use reads it.
+        // A loop re-entering the block re-runs the definition first, so the move
+        // can never be observed by a later iteration -- the same argument
+        // `buildDyingArgumentIndex` makes for a value a block defines and passes.
+        // This is what a `for`/`for-in` body is made of: `b = read(k)` inside a
+        // loop copied a whole string or union per iteration because its block was
+        // cyclic, although nothing could ever read the temporary again.
         if (use === definition) {
             dying.add(value);
             continue;
         }
+        // A value defined outside a loop can still have its sole SSA use inside
+        // the loop. Moving at that use empties the storage on the first iteration
+        // and every later iteration observes a null Ref. That is exactly what the
+        // re-entry search below decides: it walks forward from the use with the
+        // DEFINITION block removed from the graph, so it finds the use again only
+        // when some path re-enters it without redefining the value first. A use in
+        // a loop whose every trip runs the definition (`k = cursor.next()` in one
+        // block, `key = k` in the next) is not re-entered by that measure, and a
+        // use in a loop the definition sits outside of is.
         // Exceptional region edges are not represented by this CFG.
         if (body.tryRegions.length > 0 || (body.iteratorCloseRegions?.length ?? 0) > 0)
             continue;

package/dist/semantics/frontend.js

@@ -44,7 +44,7 @@ import { censusRefusalCounts } from './normalize/census-refusal.js';
 import { createCellPolicyRegistry, defaultCellEvidencePolicies, buildCellFactsTable, publishCellFacts } from './normalize/cells/index.js';
 import { settleBindingCensus } from './normalize/binding-fixpoint.js';
 import { withJsDocTypeNames } from './normalize/jsdoc-type-names.js';
-import { censusReachability, moduleEvaluationOrder, nodeIsReachable } from './normalize/reachability.js';
+import { censusReachability, fileEvaluates, moduleEvaluationOrder, nodeIsReachable } from './normalize/reachability.js';
 import { createProgram, defaultCompilerOptions } from './program.js';
 import { createFrontendTiming } from './frontend-timing.js';
 import { classHeritageOf } from './class-heritage.js';
@@ -1105,7 +1105,10 @@ export const runFrontend = (input) => {
         // reachability walk pruned whole, or one whose top level censused nothing,
         // has no region -- and a name in this list that no region answers would be
         // a call to a function nothing defines.
+        // `fileEvaluates` is the reached-statement half of that: a file kept only
+        // for a layout-only class has a region and, by design, no body.
         moduleOrder: moduleEvaluationOrder({ checker: compiled.checker, files: compiled.sourceFiles, entries: compiled.entryFiles })
+            .filter((file) => fileEvaluates(reachable, file))
             .map((file) => regionId(identities.nodeIdOf(file), 'module-body'))
             .filter((region) => normalized.graph.regions.has(region)),
         sourceFileNames: identities.sourceFileNames,

package/dist/semantics/normalize/flow/callable-reach.js

@@ -5146,9 +5146,7 @@ const closedMemberCallableUses = (checker, flow, member, countedCalls, givenRece
             const origins = key === null ? null : allocationOriginsOf(receiver);
             traceClosedCallee(call, 'invocationTargetsOf/origins', `key=${key ?? 'null'} origins=${origins === null ? 'null' : origins.classes.size}`);
             if (origins !== null) {
-                const privateDeclarations = ts.isPropertyAccessExpression(callee) && ts.isPrivateIdentifier(callee.name)
-                    ? privateMemberDeclarationsOf(callee.name)
-                    : null;
+                const privateDeclarations = ts.isPropertyAccessExpression(callee) && ts.isPrivateIdentifier(callee.name) ? privateMemberDeclarationsOf(callee.name) : null;
                 const selected = new Set();
                 for (const owner of origins.classes) {
                     const slotDeclarations = privateDeclarations ??

package/dist/semantics/normalize/global-host-mutations.js

@@ -4416,7 +4416,7 @@ computedKeysOf = () => null, trustSeed = initialCensusSeed) => {
         // value.
         if ((ts.isImportSpecifier(parent) || ts.isExportSpecifier(parent)) && parent.propertyName === node)
             return true;
-        return (((ts.isVariableDeclaration(parent) ||
+        return ((ts.isVariableDeclaration(parent) ||
             ts.isImportSpecifier(parent) ||
             ts.isExportSpecifier(parent) ||
             ts.isImportClause(parent) ||
@@ -4441,7 +4441,7 @@ computedKeysOf = () => null, trustSeed = initialCensusSeed) => {
             ts.isPropertyAssignment(parent) ||
             ts.isShorthandPropertyAssignment(parent) ||
             ts.isTypeParameterDeclaration(parent)) &&
-            parent.name === node));
+            parent.name === node);
     };
     let globalEscapeAnswer = null;
     const globalObjectEscapesIntoData = () => {

package/dist/semantics/normalize/reachability.d.ts

@@ -37,17 +37,16 @@ import ts from 'typescript';
  * - A **function declaration**. Its evaluation is `InstantiateFunctionObject`:
  *   a closure is created and bound. Nothing observable happens, and the body
  *   does not run.
- * - A **class declaration** with no decorators, no `extends` clause, no static
+ * - A **class declaration** with no decorators, no static
  *   block, no static field initializer and no computed member name.
  *   `ClassDefinitionEvaluation` for such a class evaluates nothing at all, and
  *   this compiler lowers class evaluation to *no runtime step at all*
  *   (`ir/lower.ts`, `case 'class-lifecycle'`): the struct and the construct
  *   function it emits already are the layout the definition events record. A
  *   static block or a static initializer is the opposite -- each is a real
- *   region with a body -- so a class carrying one is kept; so is a class with
- *   a heritage clause, whose one definition-time step (the heritage read) is
- *   the event the projection takes the struct's base from (see
- *   `classDefinitionIsInert`).
+ *   region with a body -- so a class carrying one is kept. An `extends`
+ *   clause is tolerated only in the two spellings `heritageIsInert` proves
+ *   evaluate nothing; any other base keeps the class.
  * - A **variable statement** whose every declarator binds a plain name and has
  *   either no initializer or an initializer drawn from `initializerIsInert`'s
  *   whitelist: literals, function/arrow/class expressions, and object/array
@@ -185,5 +184,21 @@ export interface ReachabilityInput {
      */
     readonly hostReachedMemberKeys?: ReadonlySet<string>;
 }
+/**
+ * Whether the statements this program REACHES in `file` evaluate anything.
+ *
+ * `evaluatesNothing` above is the syntactic answer for a whole file;
+ * this is the same question after pruning, and it is the one the entry needs:
+ * a module body is called because something in it runs. A class retained for
+ * its LAYOUT alone is the case that separates them. It is a live statement --
+ * it publishes a class-lifecycle operation, so the census gives its file a
+ * module-body region -- and by `layoutClasses`' own definition it runs no
+ * constructor, no initializer and no module effect, so lowering gives that
+ * region no body. A rooted script whose every class is pruned except one some
+ * annotation names (node-compat's `whatwg-streams.ts`, in a program that
+ * touches no stream) was scheduled on the strength of the region and refused
+ * by the printer for want of the body.
+ */
+export declare const fileEvaluates: (reachable: ProgramReachability, file: ts.SourceFile) => boolean;
 export declare const moduleEvaluationOrder: (input: ReachabilityInput) => readonly ts.SourceFile[];
 export declare const censusReachability: (input: ReachabilityInput) => ProgramReachability;

package/dist/semantics/normalize/reachability.js

@@ -92,21 +92,63 @@ const computedKeyIsInert = (checker, name) => {
     const declarations = checker.getSymbolAtLocation(root)?.declarations ?? [];
     return declarations.length > 0 && declarations.every((declaration) => declaration.getSourceFile().isDeclarationFile);
 };
+/**
+ * Whether evaluating a class's `extends` clause is provably not an action.
+ *
+ * `ClassDefinitionEvaluation` (15.7.14) evaluates the heritage expression and
+ * requires a constructor. Two spellings cannot do anything else. A bare
+ * identifier naming a class DECLARED EARLIER at the top level of the same file
+ * is a read of an initialized binding -- past its temporal dead zone, never a
+ * getter, always a constructor. And a bare identifier whose every declaration
+ * is ambient names the language's own intrinsic (`Error`), for the reason
+ * `computedKeyIsInert` gives. Everything else is kept: a call (`mixin(Base)`),
+ * a property read (`ns.Base`, which can be a getter), a base declared later
+ * (a TDZ throw), and an imported base, whose module a cycle may not have
+ * evaluated yet.
+ *
+ * This used to answer `false` for every `extends`, for a reason that was never
+ * about evaluation: `projection/classes.ts` takes a struct's base from the
+ * heritage event a LIVE class publishes, so pruning a subclass some type still
+ * named left `struct One final {}` with no base under an upcast. That is a
+ * question about who names the class, and `markTypeNamedClasses` now answers
+ * it where it belongs -- a class any live annotation, alias or interface names
+ * is opened for its layout and publishes that event. What is pruned here is a
+ * subclass NOTHING names, whose struct nothing emits.
+ *
+ * The blanket rule's cost was every unused hierarchy in a rooted script:
+ * node-compat's `whatwg-streams.ts` and `abort-events.ts` are roots of every
+ * program, so every program carried `ReadableByteStreamController`,
+ * `TextEncoderStream`, `DOMException` and, through them, the whole stream
+ * implementation -- ~2.4k emitted lines in a program that prints one number.
+ */
+const heritageIsInert = (checker, node) => {
+    for (const clause of node.heritageClauses ?? []) {
+        if (clause.token !== ts.SyntaxKind.ExtendsKeyword)
+            continue;
+        for (const type of clause.types) {
+            if (!ts.isIdentifier(type.expression))
+                return false;
+            const declarations = checker.getSymbolAtLocation(type.expression)?.declarations ?? [];
+            if (declarations.length === 0)
+                return false;
+            if (declarations.every((declaration) => declaration.getSourceFile().isDeclarationFile))
+                continue;
+            const file = node.getSourceFile();
+            const settled = declarations.every((declaration) => ts.isClassDeclaration(declaration) &&
+                declaration.getSourceFile() === file &&
+                declaration.parent === file &&
+                declaration.end <= node.pos);
+            if (!settled)
+                return false;
+        }
+    }
+    return true;
+};
 /** Whether a class's *definition* evaluates anything beyond binding its own name. */
 const classDefinitionIsInert = (checker, node) => {
     if (ts.canHaveDecorators(node) && (ts.getDecorators(node)?.length ?? 0) > 0)
         return false;
-    // The one step `ClassDefinitionEvaluation` performs for a decorator-free
-    // class is its heritage read, and that step is not inert in THIS compiler
-    // even though it calls nothing: `projection/classes.ts` reads a class's
-    // `base` link off the class-lifecycle heritage event the census publishes
-    // for the definition, and `records.ts` spells `struct D : B` from that
-    // link alone -- while the struct itself is emitted whenever the class's
-    // shape is reachable, which a type position keeps it. Pruning an
-    // un-instantiated `class One extends Base` whose type still names a union
-    // arm emitted `struct One final {}` with no base, and the upcast
-    // `Ref<Base>(Ref<One>)` the union's recast renders stopped compiling.
-    if (node.heritageClauses?.some((clause) => clause.token === ts.SyntaxKind.ExtendsKeyword))
+    if (!heritageIsInert(checker, node))
         return false;
     return node.members.every((member) => {
         if (ts.canHaveDecorators(member) && (ts.getDecorators(member)?.length ?? 0) > 0)
@@ -238,6 +280,31 @@ const objectMemberIsInert = (checker, member) => {
  * module (TS2448, which this compiler refuses the program for), it does not
  * across an import cycle.
  */
+/**
+ * `Symbol()` / `Symbol('description')` on the language's own `Symbol`.
+ *
+ * ECMA-262 20.4.1.1 does one thing a program could observe: `ToString` of the
+ * description, and `ToString` of a string literal (or of nothing) runs no
+ * code. What is left is minting a symbol, and a symbol bound to a name nothing
+ * reads is not observable -- which is the only case this is ever asked about,
+ * because a binding something names is opened regardless. The callee must be
+ * the ambient intrinsic for the reason `computedKeyIsInert` gives: a user
+ * `Symbol` is an ordinary call.
+ *
+ * A module-private brand token is what reaches it: node-compat's
+ * `abort-events.ts` is a root of every program and declares
+ * `const abortSignalConstructionToken = Symbol('AbortSignal construction')`,
+ * so every program kept a module body whose whole content was that call.
+ */
+const intrinsicSymbolCallIsInert = (checker, node) => {
+    if (!ts.isIdentifier(node.expression) || node.expression.text !== 'Symbol' || node.arguments.length > 1)
+        return false;
+    const description = node.arguments[0];
+    if (description !== undefined && !ts.isStringLiteral(description) && !ts.isNoSubstitutionTemplateLiteral(description))
+        return false;
+    const declarations = checker.getSymbolAtLocation(node.expression)?.declarations ?? [];
+    return declarations.length > 0 && declarations.every((declaration) => declaration.getSourceFile().isDeclarationFile);
+};
 const initializerIsInert = (checker, node) => {
     if (ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isSatisfiesExpression(node))
         return initializerIsInert(checker, node.expression);
@@ -286,7 +353,7 @@ const initializerIsInert = (checker, node) => {
             declarations.every((declaration) => ts.isClassDeclaration(declaration) && declaration.getSourceFile() === node.getSourceFile()));
     }
     if (ts.isCallExpression(node))
-        return closureFactoryCallIsInert(checker, node);
+        return intrinsicSymbolCallIsInert(checker, node) || closureFactoryCallIsInert(checker, node);
     // `-1` and `+1` are how a negative numeric constant is spelled; nothing else
     // unary is admitted, because every other operand form can reach user code.
     if (ts.isPrefixUnaryExpression(node)) {
@@ -547,9 +614,33 @@ const evaluatesNothing = (file) => file.statements.every((statement) => {
             return true;
         if (statement.moduleSpecifier !== undefined)
             return false;
-        return statement.exportClause !== undefined && ts.isNamedExports(statement.exportClause) && statement.exportClause.elements.length === 0;
+        return (statement.exportClause !== undefined && ts.isNamedExports(statement.exportClause) && statement.exportClause.elements.length === 0);
     }
-    return ts.canHaveModifiers(statement) && (ts.getModifiers(statement) ?? []).some((modifier) => modifier.kind === ts.SyntaxKind.DeclareKeyword);
+    return (ts.canHaveModifiers(statement) &&
+        (ts.getModifiers(statement) ?? []).some((modifier) => modifier.kind === ts.SyntaxKind.DeclareKeyword));
+});
+/**
+ * Whether the statements this program REACHES in `file` evaluate anything.
+ *
+ * `evaluatesNothing` above is the syntactic answer for a whole file;
+ * this is the same question after pruning, and it is the one the entry needs:
+ * a module body is called because something in it runs. A class retained for
+ * its LAYOUT alone is the case that separates them. It is a live statement --
+ * it publishes a class-lifecycle operation, so the census gives its file a
+ * module-body region -- and by `layoutClasses`' own definition it runs no
+ * constructor, no initializer and no module effect, so lowering gives that
+ * region no body. A rooted script whose every class is pruned except one some
+ * annotation names (node-compat's `whatwg-streams.ts`, in a program that
+ * touches no stream) was scheduled on the strength of the region and refused
+ * by the printer for want of the body.
+ */
+export const fileEvaluates = (reachable, file) => reachable.statementsOf(file).some((statement) => {
+    if (ts.isInterfaceDeclaration(statement) || ts.isTypeAliasDeclaration(statement))
+        return false;
+    if (ts.isClassDeclaration(statement) && reachable.classIsLayoutOnly(statement))
+        return false;
+    return !(ts.canHaveModifiers(statement) &&
+        (ts.getModifiers(statement) ?? []).some((modifier) => modifier.kind === ts.SyntaxKind.DeclareKeyword));
 });
 export const moduleEvaluationOrder = (input) => {
     const compiled = new Set(input.files);
@@ -787,11 +878,25 @@ export const censusReachability = (input) => {
      * header already gives, and layout-only is the smallest promotion there is:
      * no module evaluation, no constructor, no member body.
      */
+    // A type alias or interface is a NAME for the types inside it, so a class it
+    // names is named by whatever names the alias: `type Arm = One | Two` then
+    // `let v: Arm` types a live cell as `One`. The walk never enters a type
+    // declaration on its own (`markReferences` returns on both), so it is entered
+    // here, once, from the reference that makes it matter. This is what lets
+    // `heritageIsInert` prune an unnamed subclass without losing a named one.
+    const followedTypeDeclarations = new Set();
     const markTypeNamedClasses = (node) => {
         const named = ts.isTypeReferenceNode(node) ? node.typeName : ts.isExpressionWithTypeArguments(node) ? node.expression : null;
         if (named !== null) {
             const symbol = input.checker.getSymbolAtLocation(named);
             for (const declaration of symbol ? declarationsOf(input.checker, symbol) : []) {
+                if (ts.isTypeAliasDeclaration(declaration) || ts.isInterfaceDeclaration(declaration)) {
+                    if (followedTypeDeclarations.has(declaration))
+                        continue;
+                    followedTypeDeclarations.add(declaration);
+                    ts.forEachChild(declaration, markTypeNamedClasses);
+                    continue;
+                }
                 if (!ts.isClassDeclaration(declaration))
                     continue;
                 const file = declaration.getSourceFile();

package/dist/semantics/normalize/specialization.js

@@ -1781,10 +1781,7 @@ export const censusSpecializations = (checker, sourceFiles, reachable, namespace
                 // refusal it replaces. Those copies are two layouts and split.
                 const stored = parametersInInstanceStorage(checker, declaration);
                 const foldable = (candidate) => ![...layoutRelevant].some((index) => stored.has(index) &&
-                    fillings.some((other, at) => minted[at] === true &&
-                        other[index] !== candidate[index] &&
-                        !openFilling(other[index]) &&
-                        !openFilling(candidate[index])));
+                    fillings.some((other, at) => minted[at] === true && other[index] !== candidate[index] && !openFilling(other[index]) && !openFilling(candidate[index])));
                 // The chosen layout must be one the program actually builds.
                 return (fillings.find((candidate, at) => minted[at] === true && differs(candidate) && foldable(candidate) && fillings.every((other) => absorbs(candidate, other))) ?? null);
             })();

package/dist/targets/cpp/class-layout.d.ts

@@ -6,6 +6,7 @@ import { classFamilyOverridesOf } from '../../projection/dispatch.js';
 export { classFamilyOverridesOf };
 import { classMemberOf, classStaticMemberOf, type ClassMemberSite } from '../../projection/fields.js';
 export { classMemberOf, classStaticMemberOf, type ClassMemberSite };
+import type { ConstantLiteral } from '../../semantics/model/operands.js';
 import { type RecordField, type Representation } from '../../representation/model.js';
 import { type ConversionSite } from './emit-narrowing.js';
 /**
@@ -167,6 +168,45 @@ export declare const lazyArrowFieldGetPlanOf: (ctx: Pick<EmitContext, "classes"
  * the snapshot in hand.
  */
 export declare const lazyCalleeReadsOf: (ctx: EmitContext, body: IrBody) => ReadonlySet<IrValueId>;
+/**
+ * A class field initializer that is one constant and nothing else.
+ *
+ * Carried as the constant's own `text`/`literal` rather than as a decided
+ * boolean because the question "is this redundant" cannot be answered here:
+ * it depends on the PHYSICAL storage the field was given, which
+ * `cppFieldInitializerStatements` learns from its `storedFieldOf` and this
+ * census never sees. This says what the initializer is; that site says what
+ * the storage is; the two together decide.
+ */
+export interface ConstantFieldInitializer {
+    readonly text: string;
+    readonly literal: ConstantLiteral;
+}
+/** Publishes one compile's constant-field-initializer census. Called once, before any body renders -- mirrors `publishLazyArrowFieldPlans`. */
+export declare const publishConstantFieldInitializers: (classes: ReadonlyMap<DeclarationId, ClassLayout>, constants: ReadonlyMap<DeclarationId, ReadonlyMap<string, ConstantFieldInitializer>>) => void;
+/** The single constant one class field's initializer evaluates to, or `null` when it is anything else (including in a compile that published no census). */
+export declare const constantFieldInitializerOf: (classes: ReadonlyMap<DeclarationId, ClassLayout>, declaration: DeclarationId, key: string) => ConstantFieldInitializer | null;
+/**
+ * Every class field whose initializer is a single constant.
+ *
+ * The shape admitted is the narrowest one that proves "evaluating this thunk
+ * does nothing but produce this value": one block, one operation in it, that
+ * operation a `constant`, and the block returning that constant's own result.
+ * A thunk with two operations may have computed something; one that returns a
+ * different value than it built is not what it looks like. Neither gets in.
+ *
+ * A REACTIVE field is refused. Its storage is `Cell<T>`, not `T`
+ * (`records.ts`'s `fieldStorageType`), so the assignment runs the cell's own
+ * `operator=` and what a value-initialized cell holds is the cell's business,
+ * not this function's. The refusal reads the plugin's own per-class statement
+ * (`ReactiveCellPlan.fields`) rather than `cell`: gea names a cell spelling in
+ * every compile, reactive or not, so testing `cell !== null` would switch the
+ * census off for every program. It also cannot wait for the settled
+ * `celledFields`, which `cppRecordDeclarations` produces only after this
+ * census has to be published -- but that set is derived from these same
+ * `fields`, so refusing all of them refuses a superset.
+ */
+export declare const censusConstantFieldInitializers: (bodies: readonly IrBody[], classes: ReadonlyMap<DeclarationId, ClassLayout>, reactiveFields: ReadonlyMap<DeclarationId, ReadonlySet<string>>) => ReadonlyMap<DeclarationId, ReadonlyMap<string, ConstantFieldInitializer>>;
 /**
  * Which class fields qualify for lazy materialization, computed once for the
  * whole translation unit.

package/dist/targets/cpp/class-layout.js

@@ -62,6 +62,31 @@ classDeclaration, fields, receiver, storedFieldOf) => {
             return `field "${field.key}" initializer has no complete physical storage contract`;
         }
         const stored = storage.value;
+        // A field whose initializer writes the value its storage ALREADY holds.
+        //
+        // `makeRef<T>()` value-initializes -- these structs have no user-provided
+        // constructor, so `T()` zero-initializes and then default-constructs every
+        // member: a `std::string` field is `""` and a `bool` field is `false`
+        // before any statement here runs. `statusMessage = ''` then calls the
+        // field's initializer thunk and assigns its result, and for a
+        // `std::string` that assignment is an out-of-line libstdc++ `_M_replace`
+        // -- per field, per construction. `node:http`'s `ServerResponse` alone
+        // declares five, and it is built once per request.
+        //
+        // Only the store is dropped, and only where dropping it is invisible:
+        // the initializer must BE one constant (`censusConstantFieldInitializers`
+        // proved the thunk is a single `constant` and a `return` of it, so it has
+        // no side effect to lose), its representation must already be the
+        // storage's (no conversion to skip), the field must be required (an
+        // optional's presence bit is `false` by declaration and would still need
+        // setting), and the constant must be the carrier's own value-initialized
+        // value.
+        const constant = constantFieldInitializerOf(site.classes, classDeclaration, field.key);
+        if (constant !== null &&
+            storage.required &&
+            representationKey(field.representation) === representationKey(stored) &&
+            storesTheValueInitializedDefault(stored, constant))
+            continue;
         const markPresent = !storage.required ? ` ${receiver}->${cppRecordFieldPresenceName(field.key)} = true;` : '';
         // A widening may inspect a tagged union's live arm and therefore name its
         // input more than once. A field initializer runs exactly once, so bind its
@@ -236,6 +261,93 @@ export const lazyCalleeReadsOf = (ctx, body) => {
     }
     return result;
 };
+const constantFieldInitializerSidecar = new WeakMap();
+/** Publishes one compile's constant-field-initializer census. Called once, before any body renders -- mirrors `publishLazyArrowFieldPlans`. */
+export const publishConstantFieldInitializers = (classes, constants) => {
+    constantFieldInitializerSidecar.set(classes, constants);
+};
+/** The single constant one class field's initializer evaluates to, or `null` when it is anything else (including in a compile that published no census). */
+export const constantFieldInitializerOf = (classes, declaration, key) => constantFieldInitializerSidecar.get(classes)?.get(declaration)?.get(key) ?? null;
+/**
+ * Whether `storage` value-initializes to exactly what `constant` spells.
+ *
+ * Deliberately only the two carriers whose C++ value-initialized state is a
+ * single known value: `std::string()` is empty and a scalar is zero. Anything
+ * else -- an optional, a union, a `Ref`, a record -- either has a presence or
+ * tag byte the caller must still write or a default this cannot state, and
+ * gets no answer rather than a guessed one.
+ *
+ * `-0` is refused although `Number('-0') === 0`: a value-initialized `double`
+ * is `+0.0`, and the two differ under `Object.is` and `1 / x`. Any negative
+ * spelling that reaches here is one of that family, so the sign test is the
+ * whole check.
+ */
+const storesTheValueInitializedDefault = (storage, constant) => {
+    if (storage.kind === 'string')
+        return constant.literal === 'string' && constant.text === '';
+    if (storage.kind !== 'scalar')
+        return false;
+    if (storage.domain === 'boolean')
+        return constant.literal === 'boolean' && constant.text === 'false';
+    if (storage.domain === 'bigint')
+        return false;
+    return constant.literal === 'number' && !constant.text.startsWith('-') && Number(constant.text) === 0;
+};
+/**
+ * Every class field whose initializer is a single constant.
+ *
+ * The shape admitted is the narrowest one that proves "evaluating this thunk
+ * does nothing but produce this value": one block, one operation in it, that
+ * operation a `constant`, and the block returning that constant's own result.
+ * A thunk with two operations may have computed something; one that returns a
+ * different value than it built is not what it looks like. Neither gets in.
+ *
+ * A REACTIVE field is refused. Its storage is `Cell<T>`, not `T`
+ * (`records.ts`'s `fieldStorageType`), so the assignment runs the cell's own
+ * `operator=` and what a value-initialized cell holds is the cell's business,
+ * not this function's. The refusal reads the plugin's own per-class statement
+ * (`ReactiveCellPlan.fields`) rather than `cell`: gea names a cell spelling in
+ * every compile, reactive or not, so testing `cell !== null` would switch the
+ * census off for every program. It also cannot wait for the settled
+ * `celledFields`, which `cppRecordDeclarations` produces only after this
+ * census has to be published -- but that set is derived from these same
+ * `fields`, so refusing all of them refuses a superset.
+ */
+export const censusConstantFieldInitializers = (bodies, classes, reactiveFields) => {
+    const result = new Map();
+    const bodyBySourceOwner = new Map();
+    for (const body of bodies)
+        bodyBySourceOwner.set(body.sourceOwner, body);
+    for (const [declaration, layout] of classes) {
+        for (const field of layout.fields) {
+            if (field.initializer === null)
+                continue;
+            if (reactiveFields.get(declaration)?.has(field.key))
+                continue;
+            const thunkBody = bodyBySourceOwner.get(field.initializer);
+            if (!thunkBody || thunkBody.blocks.size !== 1)
+                continue;
+            const block = [...thunkBody.blocks.values()][0];
+            if (!block || block.operations.length !== 1)
+                continue;
+            const only = block.operations[0];
+            if (!only || only.kind !== 'constant')
+                continue;
+            const terminator = block.terminator;
+            if (terminator.kind !== 'return' || terminator.value === null)
+                continue;
+            if (terminator.value.value !== only.result.id)
+                continue;
+            let byKey = result.get(declaration);
+            if (!byKey) {
+                byKey = new Map();
+                result.set(declaration, byKey);
+            }
+            byKey.set(field.key, { text: only.text, literal: only.literal });
+        }
+    }
+    return result;
+};
 /**
  * Which class fields qualify for lazy materialization, computed once for the
  * whole translation unit.

package/dist/targets/cpp/emit-callable.js

@@ -523,7 +523,8 @@ const emitLazyArrowFieldCall = (ctx, lines, operation) => {
     // conversion below then adapts the stored result to the read's, or refuses
     // and declines the fusion.
     const storedField = ctx.classes.get(site.owner)?.fields.find((field) => field.key === fieldName)?.representation ?? null;
-    const storedAbi = storedField !== null && (storedField.kind === 'function' || storedField.kind === 'function-family' || storedField.kind === 'function-value-dispatch')
+    const storedAbi = storedField !== null &&
+        (storedField.kind === 'function' || storedField.kind === 'function-family' || storedField.kind === 'function-value-dispatch')
         ? storedField.abi
         : callee.abi;
     const bodyAbi = ctx.abiOfCallable(plan.body);

package/dist/targets/cpp/emit-narrowing.js

@@ -3828,6 +3828,13 @@ const ownsItsStorage = (carrier) => {
         return carrier.ownership === 'shared-refcount';
     if (carrier.kind === 'optional')
         return ownsItsStorage(carrier.payload);
+    // A sum owns whatever its live arm owns. `gea::TaggedUnion` has a real move
+    // constructor (`TaggedUnionOps::moveConstruct`), so a dying union hands its
+    // string or reference over instead of `copyConstruct`ing it and then
+    // destroying the original -- per header value, per request, in node-compat's
+    // `writeHead`, where this was three heap copies of one content-type string.
+    if (carrier.kind === 'tagged-union')
+        return carrier.arms.some((arm) => ownsItsStorage(arm.value));
     return false;
 };
 /**

package/dist/targets/cpp/emit-properties.js

@@ -592,7 +592,7 @@ export const emitGet = (ctx, lines, operation) => {
     // struct-member fallthrough at the end would take `re.test` and emit
     // `re->test`, which is a clang error naming a member instead of a refusal
     // naming the method.
-    const regexpMember = regexpMemberText(ctx, operation.receiver, operation.key, operation.result.id, operation.result.representation, (fieldName, storage) => narrowedFieldReadText(ctx, operation, fieldName, storage)) ?? stringObjectMemberText(ctx, operation.receiver, operation.key, operation.result.representation);
+    const regexpMember = regexpMemberText(ctx, operation.receiver, operation.key, operation.result.id, operation.result.representation, (fieldName, storage, declared) => narrowedFieldReadText(ctx, operation, fieldName, storage, null, declared)) ?? stringObjectMemberText(ctx, operation.receiver, operation.key, operation.result.representation);
     if (regexpMember !== null) {
         // An empty rendering is a deferred RegExp.prototype method read -- see
         // the identical comment on the array-access branch above.
@@ -911,8 +911,18 @@ const fixedFieldPresenceText = (ctx, receiver, fieldName) => {
  * the original defect got in. A disagreement it declines to convert is a
  * defect upstream, not a spelling this may invent, so that refuses by name.
  */
-const narrowedFieldReadText = (ctx, operation, fieldName, storage, presence = null) => {
-    const declared = declaredFieldRepresentation(ctx, operation.receiver, fieldName);
+const narrowedFieldReadText = (ctx, operation, fieldName, storage, presence = null, 
+/**
+ * The member's physical carrier, supplied by a caller that HAS it where the
+ * lookup below cannot. A compiler-owned native layout
+ * (`ExecResult`/`MatchResult`) never gets a sealed record layout, so
+ * `declaredFieldRepresentation` answers null for its members and this
+ * function would hand back the bare load -- correct until the read is
+ * narrowed, and a type error the moment it is. The caller that knows the
+ * struct says so instead of this function guessing.
+ */
+declaredStorage = null) => {
+    const declared = declaredStorage ?? declaredFieldRepresentation(ctx, operation.receiver, fieldName);
     if (declared === null)
         return storage;
     const published = operation.result.representation;

package/dist/targets/cpp/prototype/emit-prototype-regexp.d.ts

@@ -72,7 +72,7 @@ export declare const regExpConstructionFromObject: (ctx: EmitContext, argument:
  * Stated once; `regexpMemberText` and the prototype-read walk both ask it.
  */
 export declare const deferredRegexpMethodClaim: (staticKeyTexts: ReadonlyMap<IrValueId, string>, receiver: IrOperand, key: IrOperand) => PrototypeMethodRead | null;
-export declare const regexpMemberText: (ctx: EmitContext, receiver: IrOperand, key: IrOperand, result: IrValueId | null, resultRepresentation: Representation | undefined, narrow: (fieldName: string, storage: string) => string) => string | null;
+export declare const regexpMemberText: (ctx: EmitContext, receiver: IrOperand, key: IrOperand, result: IrValueId | null, resultRepresentation: Representation | undefined, narrow: (fieldName: string, storage: string, declared: Representation | null) => string) => string | null;
 /**
  * `regexpStoreRefusal`'s whole decision, spelled as three outcomes rather than
  * collapsed into "throws or doesn't":

package/dist/targets/cpp/prototype/emit-prototype-regexp.js

@@ -216,6 +216,57 @@ const patternMethods = new Set(['test', 'exec', 'toString']);
  * report group positions for non-participating groups at all.
  */
 const resultDataMembers = new Set(['index', 'input', 'length', 'groups']);
+/**
+ * What each of those members PHYSICALLY holds, per role.
+ *
+ * Stated here because nothing else can state it. These two structs are
+ * compiler-owned native layouts: `representation/derive.ts` deliberately does
+ * NOT seal a record layout for `RegExpExecArray`/`RegExpMatchArray` -- see its
+ * own comment on why sealing "a plausible-looking struct" for them would emit
+ * a program that compiles and is not a regular expression -- so
+ * `recordFieldsOfShape` answers nothing for their shape id and the generic
+ * `narrowedFieldReadText` has no declared carrier to reconcile against. It
+ * therefore returned the bare member load for every read, which is right only
+ * while the read is NOT narrowed.
+ *
+ * It is wrong the moment it is. `if (m.groups !== undefined) m.groups['id']`
+ * publishes the payload while the field stores the optional, and the bare load
+ * emitted `Optional<Ref<Dictionary<std::string>>>` where a
+ * `Ref<Dictionary<std::string>>` was wanted -- `->has` then resolved on
+ * `gea::Ref`, which has no such member, and every program that read a named
+ * capture group by key failed to compile (node-compat's `apps/http-parity`
+ * router was the first). The narrowing obligation the `narrow` parameter
+ * documents was being honoured at the call and dropped inside it, for want of
+ * this table.
+ *
+ * The three optionals are the two interfaces' own `?`, and they differ by
+ * role on purpose: `RegExpExecArray` declares `index`/`input` REQUIRED and
+ * `RegExpMatchArray` declares them optional, because a global pattern's match
+ * really does answer an array with neither. `length` is `double` on an exec
+ * result and the inherited `ArrayObject::length()` on a match result; neither
+ * is optional. Keep this in step with `ExecResult`/`MatchResult` in
+ * `runtime/gea_runtime.h` -- they are the same two facts, and clang checks
+ * only one of them.
+ */
+const namedGroupsStorage = {
+    kind: 'optional',
+    payload: { kind: 'dictionary', key: 'string', value: { kind: 'string' }, ownership: 'shared-refcount' },
+    absence: 'undefined'
+};
+const numberStorage = { kind: 'scalar', domain: 'number' };
+const stringStorage = { kind: 'string' };
+const optionalOf = (payload) => ({ kind: 'optional', payload, absence: 'undefined' });
+const resultDataMemberStorage = (role, key) => {
+    if (key === 'groups')
+        return namedGroupsStorage;
+    if (key === 'length')
+        return numberStorage;
+    if (key === 'index')
+        return role === 'match-result' ? optionalOf(numberStorage) : numberStorage;
+    if (key === 'input')
+        return role === 'match-result' ? optionalOf(stringStorage) : stringStorage;
+    return null;
+};
 /** Whether `text` is a canonical array index -- a run of digits with no sign, point, or leading zero. */
 const canonicalCaptureSlot = (text) => {
     if (text.length === 0)
@@ -318,6 +369,11 @@ export const regexpMemberText = (ctx, receiver, key, result, resultRepresentatio
 // fails to assign. The capture reads below do NOT go through it: they choose
 // between `capture` and `capturedOrAbsent` on the published carrier already,
 // and are not fields at all.
+//
+// `declared` is what the member physically holds. The caller cannot look it
+// up for these two receivers -- their layout is never sealed -- so this
+// supplies it from `resultDataMemberStorage`, and passing `null` (a RegExp
+// pattern member) leaves the caller on its own lookup exactly as before.
 narrow) => {
     const role = regexpRoleOf(receiver.representation);
     if (role === null)
@@ -349,7 +405,7 @@ narrow) => {
             return unboxedReadText(resultRepresentation ?? { kind: 'dynamic', reason: 'declared-any-never-narrowed' }, `gea::runtime::regex::dynamicGet(${receiverText}, ${propertyKeyText(ctx, key, site)})`, site);
         }
         if (patternDataMembers.has(staticKey))
-            return narrow(staticKey, `${receiverText}->${staticKey}`);
+            return narrow(staticKey, `${receiverText}->${staticKey}`, null);
         if (deferredRegexpMethodClaim(ctx.staticKeyTexts, receiver, key) !== null) {
             if (result === null) {
                 throw createCppEmitBlockedError(`host-invocation:RegExp.prototype.${staticKey}`, `"${staticKey}" is a RegExp.prototype method, and this access publishes no value for its call to consume`);
@@ -369,7 +425,7 @@ narrow) => {
         // `MatchResult`; one spelling for both compiled the exec result's read as
         // a call on a `double`.
         const member = staticKey === 'length' && role === 'match-result' ? 'length()' : staticKey;
-        return narrow(staticKey, `${receiverText}->${member}`);
+        return narrow(staticKey, `${receiverText}->${member}`, resultDataMemberStorage(role, staticKey));
     }
     if (canonicalCaptureSlot(staticKey))
         return captureReadText(role, receiverText, staticKey, resultRepresentation);

package/dist/targets/cpp/translation-unit.js

@@ -17,7 +17,7 @@ import { createCppDocumentBuilder, emptyCppFacts, render, spliceRendered } from
 import { beginUnionAliasing, endUnionAliasing } from './types.js';
 import { cppConstructedThunkName, cppConstructThunkName, cppFormalName, cppReceiverName, cppThunkName, emitBody, isCppEmitBlockedError } from './emit.js';
 import { cppCaptureFieldName, cppCaptureReceiverFieldName, cppEnvironmentLocalName, cppEnvironmentParamName, cppEnvironmentSlotName, cppEnvironmentStructName, effectiveAbiOf, symbolKeyDefinitions, templateObjectDefinitions } from './emit-context.js';
-import { censusClassStaticFieldStorage, censusLazyArrowFields, classBoxable, cppFieldInitializerStatements, publishBoxableClasses, publishClassStaticFieldStorage, publishLazyArrowFieldPlans } from './class-layout.js';
+import { censusClassStaticFieldStorage, censusConstantFieldInitializers, censusLazyArrowFields, classBoxable, cppFieldInitializerStatements, publishBoxableClasses, publishClassStaticFieldStorage, publishConstantFieldInitializers, publishLazyArrowFieldPlans } from './class-layout.js';
 import { classStaticFieldStorageRows, cppRecordDeclarations, cppStructNameOf, declaredFieldRepresentationOf, declaredRecordFieldOf, recordAccessorBodiesOf, representationNamesMintedStruct, withUnreadParametersUnnamed } from './records.js';
 import { prototypeReadHooks, virtualMethodEmission, virtualMethodFamiliesOf } from './virtual-methods.js';
 import { virtualDispatchVerdictOf } from '../../projection/dispatch.js';
@@ -1395,6 +1395,13 @@ export const renderTranslationUnit = (input) => {
     // actual reader in this same function -- `cppRecordDeclarations` itself --
     // so it cannot be published after, the way that one is.
     publishLazyArrowFieldPlans(input.classes, censusLazyArrowFields(input.bodies, input.classes, captures));
+    // Published alongside it, and read by the same constructor emission: which
+    // field initializers are a single constant, so a store that writes what
+    // value-initialization already wrote can be dropped. Passed the plugin's own
+    // `reactive.fields` rather than the settled `celledFields`, which
+    // `cppRecordDeclarations` has not produced yet -- see the census's own
+    // comment for why that is the right superset to refuse.
+    publishConstantFieldInitializers(input.classes, censusConstantFieldInitializers(input.bodies, input.classes, input.hosts.reactive.fields));
     const structs = cppRecordDeclarations(input.plan, deriver, input.classes, input.hosts.reactive, boundRecordFields, structMembers, narrowedStorage.slots, input.wellKnownSymbols, perFile, input.reflection, emissionRepresentations, input.physicalClasses ?? input.classes, (body) => captures.of(body).kind === 'ok', fixedFieldStateConstant, singleEvaluationClasses);
     const recursiveContainers = cppRecursiveContainerDeclarations(input.plan, emissionRepresentations);
     // Real storage for every `ClassName.KEY = value` site the whole program

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geastack/compiler",
-  "version": "1.0.15",
+  "version": "1.0.16",
   "description": "The geastack TypeScript-to-C++ compiler: one semantic spine, no source-shaped authority, no boxing of statically typed values.",
   "license": "Apache-2.0",
   "repository": {
@@ -67,7 +67,7 @@
     "check:contracts": "npm run build && node test/contracts.mjs"
   },
   "dependencies": {
-    "@geastack/node-compat": "^1.0.7",
+    "@geastack/node-compat": "^1.0.12",
     "typescript": "^5.9.3"
   },
   "devDependencies": {
@@ -77,9 +77,9 @@
     "prettier": "^3.8.3"
   },
   "peerDependencies": {
-    "@geastack/apple": ">=0.1.0",
-    "@geastack/geatsc-plugin-apple-native": ">=0.1.0",
-    "@geastack/geatsc-plugin-gea": ">=0.1.0"
+    "@geastack/apple": ">=0.2.8",
+    "@geastack/geatsc-plugin-apple-native": ">=0.1.3",
+    "@geastack/geatsc-plugin-gea": ">=0.1.6"
   },
   "peerDependenciesMeta": {
     "@geastack/apple": {

package/src/targets/cpp/runtime/gea_dynamic_proxy.h

@@ -89,8 +89,46 @@ inline Value ordinaryToPrimitive(const Value& value, ToPrimitiveHint hint) {
   host::throwRuntimeError("TypeError", "Cannot convert object to primitive value");
 }
 
+/**
+ * ToPrimitive of a boxed typed array, which is always its ToString.
+ *
+ * A typed array is a native carrier with no dynamic property surface: it has no
+ * `@@toPrimitive`, its `valueOf` is Object's and returns the object, and
+ * nothing a program can do installs either on it. So 7.1.1 lands on
+ * `%TypedArray%.prototype.toString` for every hint, and that is knowable from
+ * the payload type alone -- without it the generic path below asks the box for
+ * `@@toPrimitive` and the box, having no field table, refuses by name. A view
+ * whose host brand states its own ToString (Node's Buffer) answers with that.
+ */
+template <typename Element>
+inline bool boxedTypedArrayToStringAs(const Value& value, std::string& out) {
+  using Handle = gea::Ref<TypedArray<Element>>;
+  if (value.payloadType() != detail::payloadTypeTagFor<Handle>()) return false;
+  const Handle& view = value.as<Handle>();
+  if constexpr (std::is_same_v<Element, std::uint8_t>) {
+    if (view) {
+      if (const detail::HostViewToString render = detail::hostViewToStringFor(view->hostBrand())) {
+        out = render(*view);
+        return true;
+      }
+    }
+  }
+  out = runtime::array::join(view);
+  return true;
+}
+
+inline bool boxedTypedArrayToString(const Value& value, std::string& out) {
+  if (value.tag() != Value::Tag::Object || value.isProxy()) return false;
+  return boxedTypedArrayToStringAs<std::uint8_t>(value, out) || boxedTypedArrayToStringAs<std::int8_t>(value, out) ||
+         boxedTypedArrayToStringAs<ClampedUint8>(value, out) || boxedTypedArrayToStringAs<std::int16_t>(value, out) ||
+         boxedTypedArrayToStringAs<std::uint16_t>(value, out) || boxedTypedArrayToStringAs<std::int32_t>(value, out) ||
+         boxedTypedArrayToStringAs<std::uint32_t>(value, out) || boxedTypedArrayToStringAs<float>(value, out) ||
+         boxedTypedArrayToStringAs<double>(value, out);
+}
+
 inline Value dynamicToPrimitive(const Value& value, ToPrimitiveHint hint = ToPrimitiveHint::Default) {
   if (!isObjectValue(value)) return value;
+  if (std::string text; boxedTypedArrayToString(value, text)) return Value::box(Value::Tag::String, std::move(text));
   const Value exotic = value.getProperty(PropertyKey::symbol(wellKnownSymbol(detail::WellKnownSymbol::ToPrimitive)));
   if (exotic.tag() != Value::Tag::Undefined && exotic.tag() != Value::Tag::Null) {
     if (exotic.tag() != Value::Tag::Function) host::throwRuntimeError("TypeError", "@@toPrimitive is not callable");

package/src/targets/cpp/runtime/gea_runtime.h

@@ -5649,6 +5649,7 @@ class TypedArray {
    */
   void setHostBrand(const void* brand) { hostBrand_ = brand; }
   bool hasHostBrand(const void* brand) const { return brand != nullptr && hostBrand_ == brand; }
+  const void* hostBrand() const { return hostBrand_; }
 
   /**
    * ECMA-262 23.2.3.26 `%TypedArray%.prototype.set`, over a source view of any
@@ -5833,6 +5834,41 @@ class TypedArray {
   const void* hostBrand_ = nullptr;
 };
 
+/**
+ * What a host brand's views answer to ToString.
+ *
+ * A brand is identity only (see `setHostBrand`), which is enough while the
+ * view's type is known: `buffer.toString()` lowers to the host's own function.
+ * Behind a box it is not. `body + chunk` in a `'data'` listener -- where Node
+ * declares `chunk` as `any` and hands out a Buffer -- is ToPrimitive over an
+ * erased byte view, and the generic answer for a byte view (23.2.3.32, the
+ * comma-joined elements) is not Buffer's, which decodes the bytes as UTF-8.
+ * The host that minted the brand is the only party that knows that, so it
+ * states it here once, keyed by the same opaque address.
+ *
+ * `GEA_HOST_VIEW_TO_STRING` lets a host header register only when this runtime
+ * has the table, so it still builds against a runtime that predates it.
+ */
+#define GEA_HOST_VIEW_TO_STRING 1
+namespace detail {
+using HostViewToString = std::string (*)(const TypedArray<std::uint8_t>&);
+inline std::vector<std::pair<const void*, HostViewToString>>& hostViewToStrings() {
+  static std::vector<std::pair<const void*, HostViewToString>> table;
+  return table;
+}
+inline bool registerHostViewToString(const void* brand, HostViewToString render) {
+  hostViewToStrings().emplace_back(brand, render);
+  return true;
+}
+inline HostViewToString hostViewToStringFor(const void* brand) {
+  if (brand == nullptr) return nullptr;
+  for (const auto& [known, render] : hostViewToStrings()) {
+    if (known == brand) return render;
+  }
+  return nullptr;
+}
+}  // namespace detail
+
 namespace runtime::atomics {
 
 template <typename T>
@@ -6544,6 +6580,32 @@ struct MaxAlignOf<T, Rest...> {
   static constexpr std::size_t value = alignof(T) > MaxAlignOf<Rest...>::value ? alignof(T) : MaxAlignOf<Rest...>::value;
 };
 
+/**
+ * Whether an arm may be the one a default-constructed union holds.
+ *
+ * A default-constructed `TaggedUnion` has to hold SOMETHING, and which arm it
+ * picks is arbitrary -- the emitter only ever produces one to declare an SSA
+ * slot that is assigned before it is read. Arm 0 is not always a legal choice:
+ * `FunctionValue` deliberately has no default (a Function arm holding a
+ * non-function is the bug its constructors exist to catch), so picking it
+ * aborts a program that has done nothing wrong. Arms opt out here and the
+ * default walks past them.
+ */
+template <typename Arm>
+struct UnionDefaultArm : std::true_type {};
+
+/** The first arm that may be default-constructed; 0 when none opts in. */
+template <typename... Arms>
+struct DefaultUnionArmIndex {
+  static constexpr std::size_t value = [] {
+    constexpr bool allowed[] = {UnionDefaultArm<Arms>::value...};
+    for (std::size_t index = 0; index < sizeof...(Arms); ++index) {
+      if (allowed[index]) return index;
+    }
+    return static_cast<std::size_t>(0);
+  }();
+};
+
 /** Lifetime dispatch over a closed arm set, by index: a raw byte buffer holds whichever arm is live, so construct/copy/move/destroy need a hand-written vtable-by-recursion in place of what the language generates for a real union of non-trivial arms. */
 template <typename... Arms>
 struct TaggedUnionOps;
@@ -6588,7 +6650,9 @@ class TaggedUnion {
     }(std::index_sequence_for<Arms...>{});
   }
 
-  TaggedUnion() : index_(0) { detail::TaggedUnionOps<Arms...>::defaultConstruct(0, &storage_); }
+  TaggedUnion() : index_(detail::DefaultUnionArmIndex<Arms...>::value) {
+    detail::TaggedUnionOps<Arms...>::defaultConstruct(index_, &storage_);
+  }
 
   TaggedUnion(const TaggedUnion& other) : index_(other.index_) {
     detail::TaggedUnionOps<Arms...>::copyConstruct(index_, &storage_, &other.storage_);
@@ -10021,6 +10085,19 @@ class FunctionValue : public Value {
   }
 };
 
+namespace detail {
+/**
+ * Never the arm a default-constructed union holds.
+ *
+ * `FunctionValue()` aborts on purpose, so a union with a Function arm first
+ * could not be declared at all: `gea_union_N v1;` -- the ordinary way the
+ * emitter opens an SSA slot it assigns further down -- killed the process
+ * before the assignment ran. `node:net`'s `Socket.pipe` is one such union.
+ */
+template <>
+struct UnionDefaultArm<FunctionValue> : std::false_type {};
+}
+
 namespace runtime {
 namespace string {
 inline std::size_t utf16Length(const std::string& value);
@@ -14682,6 +14759,50 @@ inline const Ref<DynamicObject>& Value::functionProperties() const {
 
 Value dynamicFunctionPrototypeGet(const PropertyKey& key);
 
+namespace detail {
+/**
+ * The own, non-method surface of a boxed typed array: `length`, `byteLength`,
+ * `byteOffset` and the element at a canonical numeric index (ECMA-262 10.4.5,
+ * 23.2.3).
+ *
+ * A typed array reaches a box wherever a library types it `any` -- Node's
+ * `'data'` chunk is the measured case, and `total += chunk.length` is what a
+ * byte-counting handler does with it. The payload type names the element type
+ * exactly, so these four are answerable from the box with no table. Every other
+ * key keeps the refusal below: a method (`slice`, `toString`) needs a callable
+ * this runtime does not mint for an erased view, and answering `undefined`
+ * would be the plausible wrong answer.
+ */
+template <typename Element>
+inline bool boxedTypedArrayOwnAs(const Value& value, const PropertyKey& key, Value& out) {
+  using Handle = gea::Ref<TypedArray<Element>>;
+  if (value.payloadType() != payloadTypeTagFor<Handle>()) return false;
+  const Handle& view = value.as<Handle>();
+  if (!view || key.isSymbol()) return false;
+  std::size_t index = 0;
+  if (arrayIndexOfKey(key, index)) {
+    // 10.4.5.15: an index past the end reads `undefined`, never the prototype.
+    out = index < view->size() ? Value::box(Value::Tag::Number, static_cast<double>((*view)[index])) : Value();
+    return true;
+  }
+  if (key.isNumericSource()) return false;
+  const std::string& name = key.text();
+  if (name == "length") out = Value::box(Value::Tag::Number, static_cast<double>(view->size()));
+  else if (name == "byteLength") out = Value::box(Value::Tag::Number, view->byteLength());
+  else if (name == "byteOffset") out = Value::box(Value::Tag::Number, view->byteOffset());
+  else return false;
+  return true;
+}
+
+inline bool boxedTypedArrayOwn(const Value& value, const PropertyKey& key, Value& out) {
+  return boxedTypedArrayOwnAs<std::uint8_t>(value, key, out) || boxedTypedArrayOwnAs<std::int8_t>(value, key, out) ||
+         boxedTypedArrayOwnAs<ClampedUint8>(value, key, out) || boxedTypedArrayOwnAs<std::int16_t>(value, key, out) ||
+         boxedTypedArrayOwnAs<std::uint16_t>(value, key, out) || boxedTypedArrayOwnAs<std::int32_t>(value, key, out) ||
+         boxedTypedArrayOwnAs<std::uint32_t>(value, key, out) || boxedTypedArrayOwnAs<float>(value, key, out) ||
+         boxedTypedArrayOwnAs<double>(value, key, out);
+}
+}  // namespace detail
+
 inline Value Value::getProperty(const PropertyKey& key) const {
   return getProperty(key, *this);
 }
@@ -14739,6 +14860,8 @@ inline Value Value::getProperty(const PropertyKey& key, const Value& receiver) c
   if (tag_ == Tag::Object) {
     Value method;
     if (detail::boxedPromiseMethod(*this, key, method)) return method;
+    Value own;
+    if (detail::boxedTypedArrayOwn(*this, key, own)) return own;
   }
   if (tag_ == Tag::Object || tag_ == Tag::Function) detail::refuseOpaquePropertyAccess("a property read", key);
   // Every remaining box is a primitive, whose properties all live on a