@scriptc/cli-darwin-arm64 0.2.0 → 0.2.2

package/dist/lib/runtime-sources/src/scr_json.c

@@ -23,10 +23,17 @@
  */
 #include "scr_runtime.h"
 
+static SCR_TL ScrDyn *scr_builtin_object_prototype;
+
 /* Constructor capsules expose identity and name/length, but do not model
  * per-class static property tables yet. Never report a fabricated empty view. */
 static bool scr_dyn_class_reflection_fence(const ScrDyn *value) {
-  if (!value || value->kind != SCR_DYN_FUNC || !value->v.fn.class_obj) return false;
+  if (value && value == scr_builtin_object_prototype) {
+    static const char message[] = "scriptc: Object.prototype reflection and mutation are not supported yet";
+    scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
+    return true;
+  }
+  if (!value || value->kind != SCR_DYN_FUNC || !value->v.fn.class_obj || value->v.fn.class_obj->static_data) return false;
   static const char message[] = "scriptc: class reflection through unknown is not supported";
   scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
   return true;
@@ -49,12 +56,22 @@ static void scr_json_oom(void) {
 }
 
 static SCR_TL ScrDyn *scr_iterator_symbol;
+static SCR_TL ScrDyn *scr_async_iterator_symbol;
+static bool scr_dyn_generator(const ScrDyn *value) {
+  return value && value->kind == SCR_DYN_TYPED_REF &&
+    (!strncmp(value->v.typed_ref.type_key, "generator<", 10) || !strncmp(value->v.typed_ref.type_key, "async-generator<", 16));
+}
+static bool scr_dyn_generator_symbol(const ScrDyn *value, const ScrDyn *key) {
+  const ScrDyn *symbol = value->v.typed_ref.type_key[0] == 'a' ? scr_async_iterator_symbol : scr_iterator_symbol;
+  return symbol && key->v.symbol.value == symbol->v.symbol.value;
+}
 static ScrDyn *scr_builtin_iterator_method(const ScrDyn *value);
 static bool scr_builtin_iterable(const ScrDyn *value) {
   return value->kind == SCR_DYN_ARR || value->kind == SCR_DYN_STR || value->kind == SCR_DYN_BYTES ||
+    (scr_dyn_generator(value) && value->v.typed_ref.type_key[0] != 'a') ||
     (value->kind == SCR_DYN_TYPED_REF && scr_dyn_isl_is_array(value)) ||
-    (value->kind == SCR_DYN_HANDLE && (value->v.handle.tag == SCR_DYNH_ITERATOR ||
-      scr_dyn_handle_ops_of(value)->iter_pack));
+    (value->kind == SCR_DYN_HANDLE && (value->v.handle.tag == SCR_DYNH_ITERATOR || value->v.handle.tag == SCR_DYNH_MAP || value->v.handle.tag == SCR_DYNH_SET ||
+      scr_dyn_handle_ops_of(value)->iter_pack || scr_dyn_handle_ops_of(value)->iter_step));
 }
 static bool scr_iterator_object(const ScrDyn *value) {
   switch (value->kind) {
@@ -82,6 +99,17 @@ static void scr_iterator_symbol_cleanup(void) {
   scr_iterator_symbol = NULL;
 }
 
+static void scr_async_iterator_symbol_cleanup(void) {
+  scr_dyn_release(scr_async_iterator_symbol);
+  scr_async_iterator_symbol = NULL;
+}
+
+void scr_dyn_install_async_iterator_symbol(ScrDyn *key) {
+  if (scr_async_iterator_symbol) return;
+  scr_async_iterator_symbol = scr_dyn_retain(key);
+  scr_atexit(scr_async_iterator_symbol_cleanup);
+}
+
 void scr_dyn_install_iterator_symbol(ScrDyn *key) {
   if (scr_iterator_symbol) return;
   scr_iterator_symbol = scr_dyn_retain(key);
@@ -408,6 +436,8 @@ void scr_dyn_trace_v(void *ptr, ScrTraceVisit visit, void *ctx) {
   case SCR_DYN_TYPED_REF:
     visit(d->v.typed_ref.materialized, ctx);
     if (d->v.typed_ref.traced) visit(d->v.typed_ref.ptr, ctx);
+    for (ScrDynTypedCast *cast = d->v.typed_ref.casts; cast; cast = cast->next)
+      if (cast->traced) visit(cast->ptr, ctx);
     break;
   case SCR_DYN_HANDLE:
     if (d->v.handle.traced) visit(d->v.handle.ptr, ctx);
@@ -416,6 +446,56 @@ void scr_dyn_trace_v(void *ptr, ScrTraceVisit visit, void *ctx) {
   }
 }
 
+typedef struct ScrTypedRefIdentity {
+  ScrDyn *value; /* weak; removed before capsule disposal */
+  struct ScrTypedRefIdentity *next;
+} ScrTypedRefIdentity;
+static SCR_TL ScrTypedRefIdentity **scr_typed_ref_identities;
+static SCR_TL size_t scr_typed_ref_capacity, scr_typed_ref_count;
+static size_t scr_typed_ref_bucket(void *ptr) {
+  uintptr_t hash = (uintptr_t)ptr >> 4;
+  hash ^= hash >> 17;
+  hash *= (uintptr_t)0x9e3779b1u;
+  hash ^= hash >> 13;
+  return hash & (scr_typed_ref_capacity - 1);
+}
+static void scr_typed_ref_reserve(void) {
+  if (scr_typed_ref_capacity && scr_typed_ref_count < scr_typed_ref_capacity) return;
+  size_t old_capacity = scr_typed_ref_capacity;
+  ScrTypedRefIdentity **old = scr_typed_ref_identities;
+  scr_typed_ref_capacity = old_capacity ? old_capacity * 2 : 1024;
+  scr_typed_ref_identities = calloc(scr_typed_ref_capacity, sizeof *scr_typed_ref_identities);
+  if (!scr_typed_ref_identities) scr_json_oom();
+  for (size_t i = 0; i < old_capacity; i++) {
+    ScrTypedRefIdentity *entry = old[i];
+    while (entry) {
+      ScrTypedRefIdentity *next = entry->next;
+      size_t bucket = scr_typed_ref_bucket(entry->value->v.typed_ref.ptr);
+      entry->next = scr_typed_ref_identities[bucket];
+      scr_typed_ref_identities[bucket] = entry;
+      entry = next;
+    }
+  }
+  free(old);
+}
+static void scr_typed_ref_forget(ScrDyn *value) {
+  ScrTypedRefIdentity **link = &scr_typed_ref_identities[scr_typed_ref_bucket(value->v.typed_ref.ptr)];
+  while (*link) {
+    if ((*link)->value == value) {
+      ScrTypedRefIdentity *old = *link;
+      *link = old->next;
+      free(old);
+      if (--scr_typed_ref_count == 0) {
+        free(scr_typed_ref_identities);
+        scr_typed_ref_identities = NULL;
+        scr_typed_ref_capacity = 0;
+      }
+      return;
+    }
+    link = &(*link)->next;
+  }
+}
+
 static void scr_dyn_gcfree(void *ptr);
 
 static ScrDyn *scr_dyn_alloc(ScrDynKind kind) {
@@ -444,6 +524,7 @@ static ScrDyn *scr_dyn_alloc(ScrDynKind kind) {
       d->v.arr.properties = NULL;
       d->v.arr.sealed = false;
       d->v.arr.frozen = false;
+      d->v.arr.presence = NULL;
     } else if (kind == SCR_DYN_OBJ) {
       d->v.obj.len = 0; /* cap/entries preserved */
       d->v.obj.source_identity = NULL;
@@ -490,6 +571,8 @@ static void scr_dyn_dispose(ScrDyn *d, bool collected) {
     scr_bytes_release(d->v.bytes);
     break;
   case SCR_DYN_ARR:
+    free(d->v.arr.presence);
+    d->v.arr.presence = NULL;
     if (!collected) {
       for (size_t i = 0; i < d->v.arr.len; i++) scr_dyn_release(d->v.arr.items[i]);
       scr_dyn_release(d->v.arr.properties);
@@ -527,11 +610,12 @@ static void scr_dyn_dispose(ScrDyn *d, bool collected) {
     scr_dyn_jsval_ops()->release(d->v.jsval.cell);
     break;
   case SCR_DYN_TYPED_REF:
+    scr_typed_ref_forget(d);
     if (!collected) scr_dyn_release(d->v.typed_ref.materialized);
     while (d->v.typed_ref.casts) {
       ScrDynTypedCast *cast = d->v.typed_ref.casts;
       d->v.typed_ref.casts = cast->next;
-      cast->release(cast->ptr);
+      if (!collected || !cast->traced) cast->release(cast->ptr);
       free(cast);
     }
     if (!collected || !d->v.typed_ref.traced) d->v.typed_ref.release(d->v.typed_ref.ptr);
@@ -652,11 +736,31 @@ void scr_dyn_arr_push(ScrDyn *arr, ScrDyn *item) {
     ScrDyn **items = realloc(arr->v.arr.items, cap * sizeof *items);
     if (!items) scr_json_oom();
     arr->v.arr.items = items;
+    if (arr->v.arr.presence) {
+      unsigned char *presence = realloc(arr->v.arr.presence, cap);
+      if (!presence) scr_json_oom();
+      arr->v.arr.presence = presence;
+    }
     arr->v.arr.cap = cap;
   }
+  if (arr->v.arr.presence) arr->v.arr.presence[arr->v.arr.len] = 1;
   arr->v.arr.items[arr->v.arr.len++] = item; /* ownership moves in */
 }
 
+bool scr_dyn_arr_has_index(const ScrDyn *arr, size_t index) {
+  return index < arr->v.arr.len && (!arr->v.arr.presence || arr->v.arr.presence[index]);
+}
+
+void scr_dyn_arr_push_hole(ScrDyn *arr) {
+  scr_dyn_arr_push(arr, scr_dyn_retain(scr_dyn_undefined()));
+  if (!arr->v.arr.presence) {
+    arr->v.arr.presence = malloc(arr->v.arr.cap);
+    if (!arr->v.arr.presence) scr_json_oom();
+    memset(arr->v.arr.presence, 1, arr->v.arr.len);
+  }
+  arr->v.arr.presence[arr->v.arr.len - 1] = 0;
+}
+
 /* Spread completion for a runtime-arity argument list (`f(...xs)` in the
  * checked-dynamic tier): JS's spread over the checked-dynamic tree's iterable kinds —
  * arrays element-by-element (retained), strings by code POINT (the string
@@ -793,6 +897,10 @@ ScrDyn *scr_dyn_iter_pack(const ScrDyn *src, const ScrStr *msg) {
   return scr_dyn_not_iterable(src, msg);
 }
 
+ScrDyn *scr_dyn_jsval_iter_n(const ScrDyn *src, double count) {
+  return scr_dyn_jsval_ops()->iter_n(src->v.jsval.cell, count);
+}
+
 /* The for-of-over-dyn pack accessors: the emitted index loop drives them
  * over a scr_dyn_iter_pack result (ARR by construction — the defensive
  * arms cover nothing reachable from that lowering). Never throw. */
@@ -840,7 +948,13 @@ ScrDyn *scr_dyn_arr_at(const ScrDyn *d, double i) {
   if (d->kind != SCR_DYN_ARR || i < 0 || i >= (double)d->v.arr.len) {
     return scr_dyn_retain(scr_dyn_undefined());
   }
-  return scr_dyn_retain(d->v.arr.items[(size_t)i]);
+  if (scr_dyn_arr_has_index(d, (size_t)i)) return scr_dyn_retain(d->v.arr.items[(size_t)i]);
+  char text[32];
+  int length = snprintf(text, sizeof text, "%zu", (size_t)i);
+  ScrStr *key = scr_str_new(text, (size_t)length);
+  ScrDyn *result = scr_dyn_arr_named_get(d, key);
+  scr_str_release(key);
+  return result;
 }
 
 ScrDyn *scr_dyn_arr_named_get(const ScrDyn *d, const ScrStr *key) {
@@ -848,8 +962,13 @@ ScrDyn *scr_dyn_arr_named_get(const ScrDyn *d, const ScrStr *key) {
     return scr_dyn_obj_read_receiver(d->v.arr.properties, key->data, key->len, d);
   const ScrDyn *prototype = d->prototype ? d->prototype :
     d != scr_builtin_array_prototype ? scr_builtin_array_prototype : NULL;
-  return prototype ? scr_dyn_obj_read_receiver(prototype, key->data, key->len, d)
+  ScrDyn *value = prototype ? scr_dyn_obj_read_receiver(prototype, key->data, key->len, d)
     : scr_dyn_retain(scr_dyn_undefined());
+  if (value && value->kind == SCR_DYN_UNDEF && !d->null_proto && key->len == 11 && !memcmp(key->data, "constructor", 11)) {
+    scr_dyn_release(value);
+    return scr_dyn_array_constructor();
+  }
+  return value;
 }
 
 /* Takes ownership of key (malloc'd) and value. Duplicate keys: the LATER
@@ -966,6 +1085,21 @@ static void scr_builtin_array_prototype_cleanup(void) {
   scr_dyn_release(prototype);
 }
 
+static void scr_builtin_object_prototype_cleanup(void) {
+  ScrDyn *prototype = scr_builtin_object_prototype;
+  scr_builtin_object_prototype = NULL;
+  scr_dyn_release(prototype);
+}
+
+ScrDyn *scr_dyn_object_prototype(void) {
+  if (!scr_builtin_object_prototype) {
+    scr_builtin_object_prototype = scr_dyn_alloc(SCR_DYN_OBJ);
+    scr_builtin_object_prototype->null_proto = true;
+    scr_atexit(scr_builtin_object_prototype_cleanup);
+  }
+  return scr_dyn_retain(scr_builtin_object_prototype);
+}
+
 ScrDyn *scr_dyn_array_prototype_base(void) {
   if (!scr_builtin_array_prototype) {
     scr_builtin_array_prototype = scr_dyn_alloc(SCR_DYN_ARR);
@@ -1005,7 +1139,7 @@ ScrDyn *scr_dyn_new_obj_null_proto(void) {
 }
 
 ScrDyn *scr_dyn_obj_create(ScrDyn *prototype) {
-  if (scr_dyn_class_reflection_fence(prototype)) return NULL;
+  if (prototype != scr_builtin_object_prototype && scr_dyn_class_reflection_fence(prototype)) return NULL;
   if (prototype->kind != SCR_DYN_OBJ && prototype->kind != SCR_DYN_ARR && prototype->kind != SCR_DYN_NULL) {
     static const char message[] = "Object prototype may only be an Object or null";
     scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
@@ -1017,7 +1151,15 @@ ScrDyn *scr_dyn_obj_create(ScrDyn *prototype) {
 }
 
 ScrDyn *scr_dyn_get_prototype(ScrDyn *object) {
+  if (object == scr_builtin_object_prototype) return scr_dyn_new_null();
   if (scr_dyn_class_reflection_fence(object)) return NULL;
+  if (object->kind == SCR_DYN_TYPED_REF && strncmp(object->v.typed_ref.type_key, "object:", 7)) {
+    ScrDyn *view = scr_dyn_typed_ref_materialize(object);
+    if (!view) return NULL;
+    ScrDyn *result = scr_dyn_get_prototype(view);
+    scr_dyn_release(view);
+    return result;
+  }
   if (object->kind == SCR_DYN_FUNC && object->v.fn.clo->props) {
     ScrDyn *table = scr_dyn_fn_properties(object);
     ScrDyn *result = table->prototype ? scr_dyn_retain(table->prototype)
@@ -1032,7 +1174,9 @@ ScrDyn *scr_dyn_get_prototype(ScrDyn *object) {
   if (object->kind == SCR_DYN_OBJ) {
     if (object->prototype) return scr_dyn_retain(object->prototype);
     if (object->null_proto) return scr_dyn_new_null();
+    return scr_dyn_object_prototype();
   }
+  if (object == scr_builtin_array_prototype) return scr_dyn_object_prototype();
   if (object->kind == SCR_DYN_NULL || object->kind == SCR_DYN_UNDEF) {
     static const char message[] = "Cannot convert undefined or null to object";
     scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
@@ -1045,6 +1189,15 @@ ScrDyn *scr_dyn_get_prototype(ScrDyn *object) {
 
 ScrDyn *scr_dyn_set_prototype(ScrDyn *object, ScrDyn *prototype) {
   if (scr_dyn_class_reflection_fence(object) || scr_dyn_class_reflection_fence(prototype)) return NULL;
+  if (object->kind == SCR_DYN_TYPED_REF) {
+    ScrDyn *view = scr_dyn_typed_ref_materialize(object);
+    if (scr_exc_pending()) { scr_dyn_release(view); return NULL; }
+    ScrDyn *result = scr_dyn_set_prototype(view, prototype);
+    scr_dyn_release(view);
+    if (!result) return NULL;
+    scr_dyn_release(result);
+    return scr_dyn_retain(object);
+  }
   if (object->kind == SCR_DYN_FUNC) {
     if (prototype->kind == SCR_DYN_FUNC && object->v.fn.clo == prototype->v.fn.clo) {
       static const char message[] = "Cyclic __proto__ value";
@@ -1058,18 +1211,24 @@ ScrDyn *scr_dyn_set_prototype(ScrDyn *object, ScrDyn *prototype) {
     scr_dyn_release(result);
     return scr_dyn_retain(object);
   }
-  if (object->kind != SCR_DYN_OBJ ||
-      (prototype->kind != SCR_DYN_OBJ && prototype->kind != SCR_DYN_NULL)) {
+  if ((object->kind != SCR_DYN_OBJ && object->kind != SCR_DYN_ARR) ||
+      (prototype->kind != SCR_DYN_OBJ && prototype->kind != SCR_DYN_ARR && prototype->kind != SCR_DYN_FUNC && prototype->kind != SCR_DYN_NULL)) {
     static const char message[] = "Object prototype may only be an Object or null";
     scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
     return NULL;
   }
-  for (ScrDyn *current = prototype; current && current->kind == SCR_DYN_OBJ; current = current->prototype) {
+  for (ScrDyn *current = prototype; current;) {
+    if (current->kind == SCR_DYN_FUNC) {
+      ScrDyn *table = scr_dyn_fn_properties(current);
+      current = table;
+      scr_dyn_release(table); /* the function owns the table */
+    }
     if (current == object) {
       static const char message[] = "Cyclic __proto__ value";
       scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
       return NULL;
     }
+    current = current->prototype;
   }
   if (object->non_extensible && (prototype->kind == SCR_DYN_NULL ? object->prototype != NULL || !object->null_proto : object->prototype != prototype)) {
     static const char message[] = "Cannot set prototype of a non-extensible object";
@@ -1131,6 +1290,12 @@ bool scr_dyn_is_sealed(const ScrDyn *object) {
 
 static const ScrDyn *scr_dyn_property_owner(const ScrDyn *object, const char *key, size_t length) {
   for (const ScrDyn *current = object; current; current = current->prototype) {
+    if (current->kind == SCR_DYN_FUNC) {
+      ScrDyn *table = scr_dyn_fn_properties(current);
+      const ScrDyn *owner = scr_dyn_property_owner(table, key, length);
+      scr_dyn_release(table);
+      return owner;
+    }
     if (current->kind != SCR_DYN_OBJ) continue;
     for (size_t i = 0; i < current->v.obj.len; i++) {
       const ScrDynEntry *entry = &current->v.obj.entries[i];
@@ -1143,7 +1308,7 @@ static const ScrDyn *scr_dyn_property_owner(const ScrDyn *object, const char *ke
 static bool scr_dyn_has_object_prototype(const ScrDyn *object) {
   const ScrDyn *current = object;
   while (current->prototype) current = current->prototype;
-  return !current->null_proto;
+  return current == scr_builtin_object_prototype || !current->null_proto;
 }
 
 void scr_dyn_proxy_unsupported(const char *operation) {
@@ -1168,9 +1333,20 @@ ScrDyn *scr_dyn_proxy_new(const ScrDyn *target, const ScrDyn *handler) {
     scr_throw_error_msg(SCR_ERR_TYPE, msg, sizeof msg - 1);
     return NULL;
   }
-  /* Plain dyn objects expose their live property descriptors. Other
-   * representations cannot promise the Proxy invariants or live identity. */
-  if (target->kind != SCR_DYN_OBJ || handler->kind != SCR_DYN_OBJ) {
+  bool native_record = target->kind == SCR_DYN_TYPED_REF &&
+    strncmp(target->v.typed_ref.type_key, "record:", 7) == 0;
+  if (native_record) {
+    ScrDyn *view = scr_dyn_typed_ref_materialize(target);
+    bool plain = view && view->kind == SCR_DYN_OBJ;
+    if (plain) for (size_t i = 0; i < view->v.obj.len; i++) {
+      ScrDynEntry *entry = &view->v.obj.entries[i];
+      if (entry->accessor || !entry->configurable || !entry->writable) plain = false;
+    }
+    scr_dyn_release(view);
+    if (scr_exc_pending()) return NULL;
+    native_record = plain;
+  }
+  if ((target->kind != SCR_DYN_OBJ && target->kind != SCR_DYN_FUNC && !native_record) || handler->kind != SCR_DYN_OBJ) {
     scr_dyn_proxy_unsupported("non-plain targets or handlers");
     return NULL;
   }
@@ -1188,7 +1364,7 @@ static ScrDyn *scr_dyn_proxy_trap(const ScrDyn *proxy, const char *name) {
     scr_dyn_release(method);
     return NULL;
   }
-  if (method->kind != SCR_DYN_FUNC) {
+  if (!scr_dyn_is_callable(method)) {
     ScrJsonBuf msg;
     scr_jb_init(&msg);
     scr_jb_puts(&msg, "Proxy handler '");
@@ -1198,6 +1374,11 @@ static ScrDyn *scr_dyn_proxy_trap(const ScrDyn *proxy, const char *name) {
     scr_dyn_release(method);
     return NULL;
   }
+  if (proxy->v.proxy.target->kind == SCR_DYN_TYPED_REF) {
+    scr_dyn_release(method);
+    scr_dyn_proxy_unsupported("traps over typed native targets");
+    return NULL;
+  }
   return method;
 }
 
@@ -1222,19 +1403,25 @@ static bool scr_dyn_object_proto_key(const ScrDyn *target, const ScrStr *key) {
   return false;
 }
 
-ScrDyn *scr_dyn_proxy_get(const ScrDyn *proxy, const ScrStr *key) {
+static ScrDyn *scr_dyn_proxy_get_receiver(const ScrDyn *proxy, const ScrStr *key, const ScrDyn *receiver) {
   ScrDyn *trap = scr_dyn_proxy_trap(proxy, "get");
   if (scr_exc_pending()) return NULL;
   if (!trap) {
     ScrDyn *target = proxy->v.proxy.target;
+    if (target->kind == SCR_DYN_TYPED_REF) {
+      ScrDyn *view = scr_dyn_typed_ref_materialize(target);
+      ScrDyn *result = scr_exc_pending() ? NULL : scr_dyn_obj_read_receiver(view, key->data, key->len, receiver);
+      scr_dyn_release(view);
+      return result;
+    }
     if (!scr_dyn_obj_get(target, key->data, key->len) && scr_dyn_object_proto_key(target, key)) {
       scr_dyn_proxy_unsupported("inherited Object.prototype member reads");
       return NULL;
     }
-    return scr_dyn_obj_read(target, key->data, key->len);
+    return scr_dyn_obj_read_receiver(target, key->data, key->len, receiver);
   }
   ScrDyn *property = scr_dyn_new_str((ScrStr *)key);
-  ScrDyn *args[] = { proxy->v.proxy.target, property, (ScrDyn *)proxy };
+  ScrDyn *args[] = { proxy->v.proxy.target, property, (ScrDyn *)receiver };
   ScrDyn *result = scr_dyn_proxy_call(proxy, trap, args, 3);
   scr_dyn_release(property);
   ScrDynEntry *entry = scr_dyn_entry(proxy->v.proxy.target, key);
@@ -1248,6 +1435,10 @@ ScrDyn *scr_dyn_proxy_get(const ScrDyn *proxy, const ScrStr *key) {
   return result;
 }
 
+ScrDyn *scr_dyn_proxy_get(const ScrDyn *proxy, const ScrStr *key) {
+  return scr_dyn_proxy_get_receiver(proxy, key, proxy);
+}
+
 bool scr_dyn_proxy_has(const ScrDyn *proxy, const ScrStr *key) {
   ScrDyn *trap = scr_dyn_proxy_trap(proxy, "has");
   if (scr_exc_pending()) return false;
@@ -1306,6 +1497,7 @@ ScrDyn *scr_dyn_own_descriptor(const ScrDyn *value, const ScrStr *key) {
     if (scr_dyn_canonical_own_index(key, value->v.arr.len)) {
       size_t index = 0;
       for (size_t i = 0; i < key->len; i++) index = index * 10 + (size_t)(key->data[i] - '0');
+      if (!scr_dyn_arr_has_index(value, index)) return scr_dyn_retain(scr_dyn_undefined());
       ScrDyn *out = scr_dyn_new_obj();
       scr_dyn_obj_set(out, "value", 5, scr_dyn_retain(value->v.arr.items[index]));
       scr_dyn_obj_set(out, "writable", 8, scr_dyn_new_bool(!value->v.arr.frozen));
@@ -1432,6 +1624,10 @@ void scr_dyn_proxy_set(ScrDyn *proxy, ScrStr *key, ScrDyn *value) {
   ScrDyn *trap = scr_dyn_proxy_trap(proxy, "set");
   if (scr_exc_pending()) return;
   if (!trap) {
+    if (proxy->v.proxy.target->kind == SCR_DYN_TYPED_REF) {
+      scr_dyn_key_set(proxy->v.proxy.target, key, value);
+      return;
+    }
     /* OrdinarySet uses the Proxy receiver's [[GetOwnProperty]] and
      * [[DefineOwnProperty]]. Keep that boundary explicit for now. */
     scr_dyn_proxy_unsupported("assignment without a set trap");
@@ -1498,6 +1694,15 @@ ScrDyn *scr_dyn_new_typed_ref(
     const char *type_key, size_t type_key_len,
     ScrDyn *(*materialize)(void *),
     void (*commit)(void *, const ScrDyn *)) {
+  scr_typed_ref_reserve();
+  size_t bucket = scr_typed_ref_bucket(ptr);
+  for (ScrTypedRefIdentity *entry = scr_typed_ref_identities[bucket]; entry; entry = entry->next) {
+    ScrDyn *value = entry->value;
+    if (value->v.typed_ref.ptr == ptr && value->v.typed_ref.retain == retain &&
+        value->v.typed_ref.materialize == materialize && value->v.typed_ref.commit == commit &&
+        value->v.typed_ref.type_key_len == type_key_len && !memcmp(value->v.typed_ref.type_key, type_key, type_key_len))
+      return scr_dyn_retain(value);
+  }
   ScrDyn *d = scr_dyn_alloc(SCR_DYN_TYPED_REF);
   d->v.typed_ref.ptr = retain(ptr);
   d->v.typed_ref.retain = retain;
@@ -1509,6 +1714,12 @@ ScrDyn *scr_dyn_new_typed_ref(
   d->v.typed_ref.materialized = NULL;
   d->v.typed_ref.casts = NULL;
   d->v.typed_ref.traced = false;
+  d->v.typed_ref.observed = false;
+  ScrTypedRefIdentity *identity = malloc(sizeof *identity);
+  if (!identity) scr_json_oom();
+  identity->value = d; identity->next = scr_typed_ref_identities[bucket];
+  scr_typed_ref_identities[bucket] = identity;
+  scr_typed_ref_count++;
   return d;
 }
 
@@ -1520,6 +1731,16 @@ ScrDyn *scr_dyn_new_typed_ref_traced(
   ScrDyn *value = scr_dyn_new_typed_ref(ptr, retain, release, type_key,
       type_key_len, materialize, commit);
   value->v.typed_ref.traced = true;
+  value->v.typed_ref.observed = true;
+  return value;
+}
+
+ScrDyn *scr_dyn_new_typed_ref_observed(
+    void *ptr, void *(*retain)(void *), void (*release)(void *),
+    const char *type_key, size_t type_key_len,
+    ScrDyn *(*materialize)(void *), void (*commit)(void *, const ScrDyn *)) {
+  ScrDyn *value = scr_dyn_new_typed_ref(ptr, retain, release, type_key, type_key_len, materialize, commit);
+  value->v.typed_ref.observed = true;
   return value;
 }
 
@@ -1601,6 +1822,34 @@ ScrDyn *scr_dyn_typed_ref_materialize(const ScrDyn *d) {
      * detached contents without changing the cached node's address. */
     scr_dyn_typed_ref_preserve_children(
         capsule->v.typed_ref.materialized, fresh);
+    /* Record layouts cannot store properties added through a checked
+     * view. Keep those descriptors in the view across native refreshes. */
+    ScrDyn *cached = capsule->v.typed_ref.materialized;
+    if (fresh->kind == SCR_DYN_OBJ && cached->kind == SCR_DYN_OBJ &&
+        capsule->v.typed_ref.type_key_len >= 7 &&
+        memcmp(capsule->v.typed_ref.type_key, "record:", 7) == 0) {
+      for (size_t i = 0; i < cached->v.obj.len; i++) {
+        ScrDynEntry *entry = &cached->v.obj.entries[i];
+        if (scr_dyn_obj_get(fresh, entry->key, entry->key_len)) continue;
+        ScrStr *name = scr_str_new(entry->key, entry->key_len);
+        ScrDyn *key = scr_dyn_new_str(name);
+        ScrDyn *descriptor = scr_dyn_own_descriptor(cached, name);
+        ScrDyn *defined = scr_dyn_define_property(fresh, key, descriptor);
+        scr_dyn_release(defined);
+        scr_dyn_release(descriptor);
+        scr_dyn_release(key);
+        scr_str_release(name);
+      }
+    }
+    /* A native record stores its own fields, while its checked view owns
+     * prototype changes. Refreshing fields must preserve that prototype. */
+    scr_dyn_release(fresh->prototype);
+    fresh->prototype = capsule->v.typed_ref.materialized->prototype ? scr_dyn_retain(capsule->v.typed_ref.materialized->prototype) : NULL;
+    fresh->null_proto = capsule->v.typed_ref.materialized->null_proto;
+    scr_dyn_release(fresh->symbol_properties);
+    scr_dyn_release(fresh->symbol_keys);
+    fresh->symbol_properties = capsule->v.typed_ref.materialized->symbol_properties ? scr_dyn_retain(capsule->v.typed_ref.materialized->symbol_properties) : NULL;
+    fresh->symbol_keys = capsule->v.typed_ref.materialized->symbol_keys ? scr_dyn_retain(capsule->v.typed_ref.materialized->symbol_keys) : NULL;
     size_t cached_rc = capsule->v.typed_ref.materialized->rc;
     size_t fresh_rc = fresh->rc;
     ScrDyn old = *capsule->v.typed_ref.materialized;
@@ -1635,7 +1884,7 @@ void *scr_dyn_typed_ref_cached_cast(
 
 void scr_dyn_typed_ref_cache_cast(
     ScrDyn *d, const char *type_key, size_t type_key_len, void *ptr,
-    void *(*retain)(void *), void (*release)(void *)) {
+    void *(*retain)(void *), void (*release)(void *), bool traced) {
   if (!ptr) return;
   ScrDynTypedCast *cast = malloc(sizeof *cast);
   if (!cast) scr_trap("scriptc: out of memory\n");
@@ -1644,10 +1893,15 @@ void scr_dyn_typed_ref_cache_cast(
   cast->ptr = retain(ptr);
   cast->retain = retain;
   cast->release = release;
+  cast->traced = traced;
   cast->next = d->v.typed_ref.casts;
   d->v.typed_ref.casts = cast;
 }
 
+bool scr_dyn_typed_array_is(const ScrDyn *d, int elem) {
+  return d && d->kind == SCR_DYN_BYTES && !d->v.bytes->is_data_view && d->v.bytes->elem == (ScrBytesElem)elem;
+}
+
 bool scr_dyn_bytes_is(const ScrDyn *d, int elem) {
   return d && d->kind == SCR_DYN_BYTES && d->v.bytes->elem == (ScrBytesElem)elem;
 }
@@ -1656,6 +1910,146 @@ ScrBytes *scr_dyn_bytes_unbox(const ScrDyn *d) {
   return scr_bytes_retain(d->v.bytes);
 }
 
+/* Numeric typed-array constructor values share native function identity.
+ * The cache owns one reference until runtime cleanup; arbitrary strings or
+ * functions cannot impersonate one of these constructors. */
+static SCR_TL ScrDyn *scr_bytes_ctors[9];
+static void scr_bytes_ctors_cleanup(void) {
+  for (size_t i = 0; i < 9; i++) {
+    scr_dyn_release(scr_bytes_ctors[i]);
+    scr_bytes_ctors[i] = NULL;
+  }
+}
+static ScrDyn *scr_bytes_ctor_call(ScrClosure *closure, ScrDyn *const *args, size_t argc) {
+  (void)args; (void)argc;
+  for (size_t i = 0; i < 9; i++) {
+    if (!scr_bytes_ctors[i] || scr_bytes_ctors[i]->v.fn.clo != closure) continue;
+    ScrJsonBuf message;
+    scr_jb_init(&message);
+    scr_jb_puts(&message, "Constructor ");
+    scr_jb_puts(&message, scr_bytes_elem_name((ScrBytesElem)i));
+    scr_jb_puts(&message, " requires 'new'");
+    scr_throw_error(SCR_ERR_TYPE, scr_jb_finish(&message));
+    return NULL;
+  }
+  scr_trap("scriptc: invalid typed array constructor\n");
+}
+static ScrDyn *scr_dyn_fn_properties(const ScrDyn *function);
+static ScrDyn *scr_bytes_constructor_for(ScrBytesElem elem) {
+  if (!scr_bytes_ctors[elem]) {
+    bool initialized = false;
+    for (size_t i = 0; i < 9; i++) if (scr_bytes_ctors[i]) initialized = true;
+    if (!initialized) scr_atexit(scr_bytes_ctors_cleanup);
+    scr_bytes_ctors[elem] = scr_dyn_new_func(scr_closure_new(NULL, 0),
+        scr_bytes_ctor_call, 3, "typed-array-constructor", scr_bytes_elem_name(elem));
+    ScrDyn *properties = scr_dyn_fn_properties(scr_bytes_ctors[elem]);
+    scr_dyn_obj_set(properties, "BYTES_PER_ELEMENT", 17, scr_dyn_new_num((double)scr_bytes_elem_size(elem)));
+    ScrDynEntry *entry = &properties->v.obj.entries[properties->v.obj.len - 1];
+    entry->writable = entry->enumerable = entry->configurable = false;
+    scr_dyn_release(properties);
+  }
+  return scr_dyn_retain(scr_bytes_ctors[elem]);
+}
+ScrDyn *scr_bytes_constructor(const ScrStr *name) {
+  for (size_t i = 0; i < 9; i++) {
+    const char *candidate = scr_bytes_elem_name((ScrBytesElem)i);
+    if (strlen(candidate) == name->len && memcmp(candidate, name->data, name->len) == 0)
+      return scr_bytes_constructor_for((ScrBytesElem)i);
+  }
+  scr_trap("scriptc: invalid typed array constructor name\n");
+}
+static SCR_TL ScrDyn *scr_array_buffer_ctor;
+static SCR_TL ScrDyn *scr_array_ctor;
+static void scr_array_ctor_cleanup(void) {
+  scr_dyn_release(scr_array_ctor);
+  scr_array_ctor = NULL;
+}
+static ScrDyn *scr_array_ctor_call(ScrClosure *closure, ScrDyn *const *args, size_t argc) {
+  (void)closure;
+  ScrDyn *result = scr_dyn_new_arr();
+  if (argc == 1 && args[0]->kind == SCR_DYN_NUM) {
+    double length = args[0]->v.num;
+    if (!isfinite(length) || length < 0 || length > 4294967295.0 || trunc(length) != length) {
+      scr_dyn_release(result);
+      static const char message[] = "Invalid array length";
+      scr_throw_error_msg(SCR_ERR_RANGE, message, sizeof message - 1);
+      return NULL;
+    }
+    if (length > 1000000) {
+      scr_dyn_release(result);
+      static const char message[] = "Checked array construction exceeds the native allocation limit";
+      scr_throw_error_msg_code(SCR_ERR_ERROR, message, sizeof message - 1, "SC2020");
+      return NULL;
+    }
+    for (size_t i = 0; i < (size_t)length; i++) scr_dyn_arr_push_hole(result);
+  } else for (size_t i = 0; i < argc; i++) scr_dyn_arr_push(result, scr_dyn_retain(args[i]));
+  return result;
+}
+ScrDyn *scr_dyn_array_constructor(void) {
+  if (!scr_array_ctor) {
+    scr_array_ctor = scr_dyn_new_func(scr_closure_new(NULL, 0), scr_array_ctor_call, 1, "native:Array", "Array");
+    scr_atexit(scr_array_ctor_cleanup);
+  }
+  return scr_dyn_retain(scr_array_ctor);
+}
+static void scr_array_buffer_ctor_cleanup(void) {
+  scr_dyn_release(scr_array_buffer_ctor);
+  scr_array_buffer_ctor = NULL;
+}
+static ScrDyn *scr_array_buffer_ctor_call(ScrClosure *closure, ScrDyn *const *args, size_t argc) {
+  (void)closure; (void)args; (void)argc;
+  static const char message[] = "Constructor ArrayBuffer requires 'new'";
+  scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
+  return NULL;
+}
+ScrDyn *scr_array_buffer_constructor(void) {
+  if (!scr_array_buffer_ctor) {
+    scr_array_buffer_ctor = scr_dyn_new_func(scr_closure_new(NULL, 0), scr_array_buffer_ctor_call, 1, "native:ArrayBuffer", "ArrayBuffer");
+    scr_atexit(scr_array_buffer_ctor_cleanup);
+  }
+  return scr_dyn_retain(scr_array_buffer_ctor);
+}
+
+bool scr_bytes_instanceof(const ScrDyn *value, const ScrDyn *callee) {
+  if (!callee || callee->kind != SCR_DYN_FUNC) {
+    static const char message[] = "Right-hand side of 'instanceof' is not callable";
+    scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
+    return false;
+  }
+  if (scr_array_buffer_ctor && callee->v.fn.clo == scr_array_buffer_ctor->v.fn.clo) return scr_array_buffer_is(value);
+  if (scr_array_ctor && callee->v.fn.clo == scr_array_ctor->v.fn.clo) return value->kind == SCR_DYN_ARR || scr_dyn_isl_is_array(value);
+  for (size_t i = 0; i < 9; i++) {
+    if (scr_bytes_ctors[i] && callee->v.fn.clo == scr_bytes_ctors[i]->v.fn.clo)
+      return scr_dyn_typed_array_is(value, (int)i);
+  }
+  static const char message[] = "instanceof against this native constructor is not supported yet";
+  scr_throw_error_msg_code(SCR_ERR_ERROR, message, sizeof message - 1, "SC1090");
+  return false;
+}
+ScrDyn *scr_bytes_construct(const ScrDyn *callee, const ScrDyn *args, const ScrStr *what) {
+  if (callee->kind == SCR_DYN_FUNC && scr_array_ctor && callee->v.fn.clo == scr_array_ctor->v.fn.clo)
+    return scr_array_ctor_call(callee->v.fn.clo, args->v.arr.items, args->v.arr.len);
+  if (callee->kind == SCR_DYN_FUNC && scr_array_buffer_ctor && callee->v.fn.clo == scr_array_buffer_ctor->v.fn.clo)
+    return scr_array_buffer_new(args->v.arr.len ? args->v.arr.items[0] : scr_dyn_undefined());
+  for (size_t i = 0; i < 9; i++) {
+    if (callee->kind != SCR_DYN_FUNC || !scr_bytes_ctors[i] || callee->v.fn.clo != scr_bytes_ctors[i]->v.fn.clo) continue;
+    const ScrDyn *input = args->v.arr.len > 0 ? args->v.arr.items[0] : scr_dyn_undefined();
+    const ScrDyn *offset = args->v.arr.len > 1 ? args->v.arr.items[1] : scr_dyn_undefined();
+    const ScrDyn *length = args->v.arr.len > 2 ? args->v.arr.items[2] : scr_dyn_undefined();
+    ScrBytes *bytes = scr_array_buffer_view((ScrBytesElem)i, input, offset, length);
+    if (!bytes) return NULL;
+    ScrDyn *result = scr_dyn_new_bytes(bytes);
+    scr_bytes_release(bytes);
+    return result;
+  }
+  ScrJsonBuf message;
+  scr_jb_init(&message);
+  scr_jb_write(&message, what->data, what->len);
+  scr_jb_puts(&message, " is not a supported native constructor");
+  scr_throw_error(SCR_ERR_TYPE, scr_jb_finish(&message));
+  return NULL;
+}
+
 /* Shared view metadata and indexed reads for both compiler backends. */
 ScrDyn *scr_dyn_bytes_key_get(const ScrDyn *value, const ScrStr *key) {
   ScrBytes *bytes = value->v.bytes;
@@ -1664,7 +2058,8 @@ ScrDyn *scr_dyn_bytes_key_get(const ScrDyn *value, const ScrStr *key) {
   if (key->len == 10 && memcmp(key->data, "byteOffset", 10) == 0) return scr_dyn_new_num(scr_bytes_byte_offset(bytes));
   if (key->len == 6 && memcmp(key->data, "buffer", 6) == 0) return scr_array_buffer_from_bytes(bytes);
   if (key->len == 11 && memcmp(key->data, "constructor", 11) == 0) {
-    /* Match the compiler's opaque JS builtin identity values. */
+    if (!value->buffer) return scr_bytes_constructor_for(bytes->elem);
+    /* Buffer retains its separate builtin identity. */
     char token[64];
     int length = snprintf(token, sizeof token, "[builtin %s]", value->buffer ? "Buffer" : scr_bytes_elem_name(bytes->elem));
     ScrStr *name = scr_str_new(token, (size_t)length);
@@ -1711,6 +2106,11 @@ ScrDyn *scr_dyn_new_chunk(const ScrBytes *b) {
 /* A boxed static function value (the compiler's static→dyn converters).
  * Ownership of the closure MOVES in; sig/name are static literals. */
 ScrDyn *scr_dyn_new_func(ScrClosure *clo, ScrDynThunk thunk, uint32_t arity, const char *sig, const char *name) {
+  if (clo->function_kind & 8) {
+    ScrDyn *original = scr_box_get_ref(clo->caps[0]);
+    scr_closure_release(clo);
+    return original;
+  }
   ScrDyn *d = scr_dyn_alloc(SCR_DYN_FUNC);
   d->v.fn.clo = clo;
   d->v.fn.thunk = thunk;
@@ -1739,6 +2139,7 @@ static ScrDyn *scr_dyn_class_call(ScrClosure *closure, ScrDyn *const *args, size
 
 ScrDyn *scr_dyn_new_class(ScrClassObj *cls, const char *type_key) {
   ScrClosure *closure = scr_closure_new(NULL, 1);
+  if (cls->static_data) closure->props = scr_box_retain(cls->static_data);
   closure->caps[0] = scr_box_new_obj(scr_classobj_retain_v, scr_classobj_release_v, scr_classobj_trace_v);
   scr_box_set_ref(closure->caps[0], scr_classobj_retain(cls));
   ScrDyn *value = scr_dyn_new_func(closure, scr_dyn_class_call, (uint32_t)cls->length, type_key, cls->name->data);
@@ -1751,6 +2152,10 @@ bool scr_dyn_class_is(const ScrDyn *value, const char *type_key) {
       strcmp(value->v.fn.sig, type_key) == 0;
 }
 
+bool scr_dyn_class_is_key(const ScrDyn *value, const ScrStr *type_key) {
+  return scr_dyn_class_is(value, type_key->data);
+}
+
 ScrClassObj *scr_dyn_class_check(const ScrDyn *value, const char *type_key, const ScrDynPath *path) {
   if (!scr_dyn_class_is(value, type_key)) {
     scr_dyn_check_fail(path, "class constructor", value);
@@ -1783,6 +2188,19 @@ ScrDyn *scr_dyn_class_prototype(ScrDyn *value, ScrDyn *base) {
  * compiled per signature). Args borrowed; result owned (+1) or NULL with
  * the exception pending. */
 ScrDyn *scr_dyn_call(const ScrDyn *d, ScrDyn *const *args, size_t argc, const char *what) {
+  if (d->kind == SCR_DYN_PROXY && scr_dyn_is_callable(d->v.proxy.target)) {
+    ScrDyn *trap = scr_dyn_proxy_trap(d, "apply");
+    if (scr_exc_pending()) return NULL;
+    if (!trap) return scr_dyn_call(d->v.proxy.target, args, argc, what);
+    ScrDyn *receiver = scr_dyn_this_get();
+    ScrDyn *arguments = scr_dyn_new_arr();
+    for (size_t i = 0; i < argc; i++) scr_dyn_arr_push(arguments, scr_dyn_retain(args[i]));
+    ScrDyn *trap_args[] = { d->v.proxy.target, receiver, arguments };
+    ScrDyn *result = scr_dyn_proxy_call(d, trap, trap_args, 3);
+    scr_dyn_release(arguments);
+    scr_dyn_release(receiver);
+    return result;
+  }
   if (d->kind == SCR_DYN_JSVAL) {
     /* An ENGINE callee: the call routes through scr_jsval_call with the
      * uniform argument conversion (wrapped cells by reference, dyn data
@@ -1893,7 +2311,7 @@ const char *scr_dyn_specific_type(const ScrDyn *cb, char *detail, size_t cap) {
   case SCR_DYN_OBJ: d = "an instance of Object"; break;
   case SCR_DYN_ARR: d = "an instance of Array"; break;
   case SCR_DYN_BYTES:
-    snprintf(detail, cap, "an instance of %s", cb->buffer ? "Buffer" : scr_bytes_elem_name(cb->v.bytes->elem));
+    snprintf(detail, cap, "an instance of %s", cb->buffer ? "Buffer" : cb->v.bytes->is_data_view ? "DataView" : scr_bytes_elem_name(cb->v.bytes->elem));
     break;
   case SCR_DYN_FUNC:
     /* determineSpecificType: `function ${value.name}` — anonymous
@@ -1920,6 +2338,18 @@ const char *scr_dyn_specific_type(const ScrDyn *cb, char *detail, size_t cap) {
   case SCR_DYN_BOOL:
     snprintf(detail, cap, "type boolean (%s)", cb->v.b ? "true" : "false");
     break;
+  case SCR_DYN_BIGINT: {
+    ScrStr *value = scr_bigint_inspect(cb->v.bigint);
+    snprintf(detail, cap, "type bigint (%.*s)", (int)value->len, value->data);
+    scr_str_release(value);
+    break;
+  }
+  case SCR_DYN_SYMBOL: {
+    ScrStr *value = cb->v.symbol.render(cb->v.symbol.value);
+    snprintf(detail, cap, "type symbol (%.*s)", (int)value->len, value->data);
+    scr_str_release(value);
+    break;
+  }
   case SCR_DYN_NUM: {
     char num[32];
     size_t n = scr_f64_to_str(cb->v.num, num);
@@ -1927,19 +2357,30 @@ const char *scr_dyn_specific_type(const ScrDyn *cb, char *detail, size_t cap) {
     break;
   }
   case SCR_DYN_STR: {
-    const ScrStr *sv = cb->v.str;
-    char insp[32];
-    size_t n = 0;
-    insp[n++] = '\'';
-    for (size_t i = 0; i < sv->len && n < 28; i++) insp[n++] = sv->data[i];
-    if (sv->len + 2 > 28) {
-      n = 25;
-      memcpy(insp + n, "...", 3);
-      n += 3;
+    ScrStr *value = scr_str_retain(cb->v.str);
+    if (scr_str_utf16_len(value) > 28) {
+      ScrStr *prefix = scr_str_slice(value, 0, 25);
+      ScrStr *dots = scr_str_new("...", 3);
+      scr_str_release(value);
+      value = scr_str_concat(prefix, dots);
+      scr_str_release(prefix);
+      scr_str_release(dots);
+    }
+    ScrJsonBuf shown;
+    scr_jb_init(&shown);
+    scr_jb_puts(&shown, "type string (");
+    if (memchr(value->data, '\'', value->len)) {
+      scr_jb_put_json_str(&shown, value);
     } else {
-      insp[n++] = '\'';
+      scr_jb_putc(&shown, '\'');
+      scr_jb_put_str(&shown, value);
+      scr_jb_putc(&shown, '\'');
     }
-    snprintf(detail, cap, "type string (%.*s)", (int)n, insp);
+    scr_jb_putc(&shown, ')');
+    ScrStr *text = scr_jb_finish(&shown);
+    snprintf(detail, cap, "%.*s", (int)text->len, text->data);
+    scr_str_release(text);
+    scr_str_release(value);
     break;
   }
   default: d = "an instance of Object"; break;
@@ -1961,7 +2402,7 @@ void scr_throw_arg_type(const ScrStr *argname, const ScrStr *expected, const Scr
 }
 
 void scr_dyn_arg_type_fail(const char *argname, const char *expected, const ScrDyn *got) {
-  char detail[64];
+  char detail[256];
   const char *d = scr_dyn_specific_type(got, detail, sizeof detail);
   ScrJsonBuf b;
   scr_jb_init(&b);
@@ -1982,7 +2423,7 @@ void scr_dyn_arg_type_fail(const char *argname, const char *expected, const ScrD
  * wording on the name, but every property-path caller here knows it is
  * one). Same runtime-rendered Received tail; always throws catchably. */
 void scr_dyn_prop_type_fail(const char *name, const char *expected, const ScrDyn *got) {
-  char detail[64];
+  char detail[256];
   const char *d = scr_dyn_specific_type(got, detail, sizeof detail);
   ScrJsonBuf b;
   scr_jb_init(&b);
@@ -2076,8 +2517,9 @@ ScrDyn *scr_dyn_new_handle(void *h, ScrDynHandleTag tag) {
   ScrDyn *d = scr_dyn_alloc(SCR_DYN_HANDLE);
   d->v.handle.ptr = scr_dyn_handle_ops(tag)->retain(h);
   d->v.handle.tag = tag;
-  d->v.handle.traced = (tag == SCR_DYNH_SET || tag == SCR_DYNH_MAP) &&
-    (((ScrMap *)h)->key_trace != NULL || ((ScrMap *)h)->val_trace != NULL);
+  d->v.handle.traced = tag == SCR_DYNH_WEAK_MAP || tag == SCR_DYNH_WEAK_SET ||
+      ((tag == SCR_DYNH_SET || tag == SCR_DYNH_MAP) &&
+       (((ScrMap *)h)->key_trace != NULL || ((ScrMap *)h)->val_trace != NULL));
   return d;
 }
 
@@ -2086,6 +2528,7 @@ ScrDyn *scr_dyn_new_handle(void *h, ScrDynHandleTag tag) {
  * scr_promise_release edge installs HERE — a promise-free link never
  * references the fiber machinery (the unit-test subset links). */
 void (*scr_dyn_promise_release_fn)(ScrPromise *p) = NULL;
+bool (*scr_dyn_promise_identity_fn)(ScrPromise *a, ScrPromise *b) = NULL;
 
 ScrDyn *scr_dyn_alloc_promise(void (*release_fn)(ScrPromise *p)) {
   scr_dyn_promise_release_fn = release_fn;
@@ -2114,6 +2557,7 @@ const ScrDynJsvalOps *scr_dyn_jsval_ops(void) {
 }
 
 bool scr_dyn_isl_typeof_is(const ScrDyn *d, const char *name) {
+  if (scr_dyn_generator(d)) return strcmp(name, "object") == 0;
   if (d->kind == SCR_DYN_TYPED_REF) {
     if (d->v.typed_ref.type_key_len >= 7 &&
         memcmp(d->v.typed_ref.type_key, "object:", 7) == 0)
@@ -2144,10 +2588,12 @@ bool scr_dyn_isl_typeof_is(const ScrDyn *d, const char *name) {
 }
 
 bool scr_dyn_isl_is_array(const ScrDyn *d) {
+  if (scr_dyn_generator(d)) return false;
   if (d->kind == SCR_DYN_TYPED_REF) {
     if (d->v.typed_ref.type_key_len >= 7 &&
         memcmp(d->v.typed_ref.type_key, "object:", 7) == 0) return false;
     ScrDyn *materialized = scr_dyn_typed_ref_materialize(d);
+    if (!materialized) return false;
     bool out = materialized->kind == SCR_DYN_ARR ||
                scr_dyn_isl_is_array(materialized);
     scr_dyn_release(materialized);
@@ -2157,6 +2603,14 @@ bool scr_dyn_isl_is_array(const ScrDyn *d) {
 }
 
 bool scr_dyn_isl_is_error(const ScrDyn *d) {
+  if (scr_dyn_generator(d)) return false;
+  /* Registered native Error capsules retain their brand even when their
+   * public property view omits the internal error marker. */
+  ScrError *error = scr_errdyn_err_of(d);
+  if (error) {
+    scr_error_release(error);
+    return true;
+  }
   if (d->kind == SCR_DYN_TYPED_REF) {
     ScrDyn *materialized = scr_dyn_typed_ref_materialize(d);
     bool out =
@@ -2316,6 +2770,7 @@ static ScrStr *scr_dyn_property_key(const ScrDyn *key) {
 }
 
 static ScrDynEntry *scr_dyn_entry(ScrDyn *obj, const ScrStr *key) {
+  if (obj->kind != SCR_DYN_OBJ) return NULL;
   for (size_t i = 0; i < obj->v.obj.len; i++) {
     ScrDynEntry *entry = &obj->v.obj.entries[i];
     if (entry->key_len == key->len && memcmp(entry->key, key->data, key->len) == 0) return entry;
@@ -2334,6 +2789,10 @@ static bool scr_dyn_property_same_value(const ScrDyn *a, const ScrDyn *b) {
   return scr_dyn_strict_eq(a, b);
 }
 
+bool scr_dyn_same_value(const ScrDyn *left, const ScrDyn *right) {
+  return scr_dyn_property_same_value(left, right);
+}
+
 static void scr_dyn_descriptor_fields_drop(ScrDyn **fields) {
   for (size_t i = 0; i < 6; i++) scr_dyn_release(fields[i]);
 }
@@ -2344,6 +2803,8 @@ static void scr_error_sync_cause(ScrDyn *view, const ScrStr *key);
  * the configurable, non-writable builtin members once so redefinitions and
  * deletions retain the same behavior through every alias. Returns +1. */
 static ScrDyn *scr_dyn_fn_properties(const ScrDyn *function) {
+  if (!function->v.fn.clo->props && function->v.fn.class_obj && function->v.fn.class_obj->static_data)
+    function->v.fn.clo->props = scr_box_retain(function->v.fn.class_obj->static_data);
   if (!function->v.fn.clo->props) {
     ScrDyn *table = scr_dyn_new_obj();
     const char *name = function->v.fn.name ? function->v.fn.name : "";
@@ -2358,6 +2819,7 @@ static ScrDyn *scr_dyn_fn_properties(const ScrDyn *function) {
     ScrBox *box = scr_box_new_obj(&scr_dyn_retain_v, &scr_dyn_release_v, &scr_dyn_trace_v);
     scr_box_set_ref(box, table);
     function->v.fn.clo->props = box;
+    if (function->v.fn.class_obj) function->v.fn.class_obj->static_data = scr_box_retain(box);
     if (function->v.fn.clo->function_kind & 4) {
       ScrDyn *prototype = scr_dyn_new_obj();
       scr_dyn_obj_set(prototype, "constructor", 11, scr_dyn_retain((ScrDyn *)function));
@@ -2371,6 +2833,22 @@ static ScrDyn *scr_dyn_fn_properties(const ScrDyn *function) {
   return (ScrDyn *)scr_box_get_ref(function->v.fn.clo->props);
 }
 
+ScrDyn *scr_dyn_class_inherit(ScrDyn *constructor, ScrDyn *base) {
+  if (constructor->kind != SCR_DYN_FUNC || !constructor->v.fn.class_obj || (base->kind != SCR_DYN_FUNC && base->kind != SCR_DYN_UNDEF)) {
+    static const char message[] = "Class inheritance requires native constructors";
+    scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
+    return NULL;
+  }
+  ScrDyn *table = scr_dyn_fn_properties(constructor);
+  if (base->kind == SCR_DYN_FUNC) scr_dyn_release(scr_dyn_fn_properties(base));
+  ScrClassObj *cls = constructor->v.fn.class_obj;
+  if (!cls->static_data) cls->static_data = scr_box_retain(constructor->v.fn.clo->props);
+  ScrDyn *result = base->kind == SCR_DYN_UNDEF ? NULL : scr_dyn_set_prototype(table, base);
+  scr_dyn_release(table);
+  scr_dyn_release(result);
+  return scr_exc_pending() ? NULL : scr_dyn_retain(constructor);
+}
+
 ScrDyn *scr_dyn_class_base_prototype(ScrDyn *constructor) {
   if (constructor->kind != SCR_DYN_FUNC || constructor->v.fn.class_obj ||
       constructor->v.fn.clo->function_kind != 4) {
@@ -2399,6 +2877,35 @@ void scr_dyn_class_super(ScrDyn *constructor, ScrDyn *receiver, ScrDyn *argument
   scr_dyn_release(result);
 }
 
+bool scr_dyn_data_view_is(const ScrDyn *value) {
+  return value->kind == SCR_DYN_BYTES && value->v.bytes->is_data_view;
+}
+
+/* Ordinary native function constructors retain their live prototype table.
+ * A constructor may replace the fresh receiver with another object. */
+ScrDyn *scr_dyn_construct(const ScrDyn *callee, const ScrDyn *args, const ScrStr *what) {
+  if (callee->kind != SCR_DYN_FUNC || callee->v.fn.class_obj || callee->v.fn.clo->function_kind != 4)
+    return scr_bytes_construct(callee, args, what);
+  ScrDyn *prototype = scr_dyn_fn_get(callee, "prototype", 9);
+  if (!prototype) return NULL;
+  ScrDyn *receiver = scr_iterator_object(prototype) ? scr_dyn_obj_create(prototype) : scr_dyn_new_obj();
+  scr_dyn_release(prototype);
+  if (!receiver) return NULL;
+  scr_dyn_this_push_dyn(receiver);
+  ScrDyn *result = scr_dyn_call(callee, args->v.arr.items, args->v.arr.len, what->data);
+  scr_dyn_this_pop();
+  if (!result) {
+    scr_dyn_release(receiver);
+    return NULL;
+  }
+  if (scr_iterator_object(result)) {
+    scr_dyn_release(receiver);
+    return result;
+  }
+  scr_dyn_release(result);
+  return receiver;
+}
+
 /* Symbol descriptors use the ordinary descriptor implementation in an
  * inaccessible table. Keep a retained key list so identities cannot be
  * recycled while properties exist, and reflection returns real symbols. */
@@ -2409,11 +2916,11 @@ static ScrStr *scr_dyn_symbol_storage_key(const ScrDyn *key) {
 }
 
 static ScrDyn *scr_dyn_symbol_receiver(const ScrDyn *value) {
+  if (value->kind == SCR_DYN_TYPED_REF) return scr_dyn_typed_ref_materialize(value);
   if (value->kind == SCR_DYN_FUNC) return scr_dyn_fn_properties(value);
-  if (value->kind == SCR_DYN_OBJ || value->kind == SCR_DYN_ARR)
+  if (value->kind == SCR_DYN_OBJ || value->kind == SCR_DYN_ARR || value->kind == SCR_DYN_HANDLE)
     return scr_dyn_retain((ScrDyn *)value);
-  if (value->kind == SCR_DYN_TYPED_REF || value->kind == SCR_DYN_HANDLE ||
-      value->kind == SCR_DYN_PROXY || value->kind == SCR_DYN_JSVAL) {
+  if (value->kind == SCR_DYN_PROXY || value->kind == SCR_DYN_JSVAL) {
     static const char message[] = "Symbol properties on this native value have no lowering";
     scr_throw_error_msg_code(SCR_ERR_ERROR, message, sizeof message - 1, "SC2020");
   }
@@ -2425,6 +2932,12 @@ static ScrDynEntry *scr_dyn_symbol_entry(const ScrDyn *receiver, const ScrDyn *k
   ScrDynEntry *entry = NULL;
   for (const ScrDyn *current = receiver; current; current = own ? NULL : current->prototype ? current->prototype
       : current->kind == SCR_DYN_ARR && current != scr_builtin_array_prototype && !current->null_proto ? scr_builtin_array_prototype : NULL) {
+    if (current->kind == SCR_DYN_FUNC) {
+      ScrDyn *table = scr_dyn_fn_properties(current);
+      entry = scr_dyn_symbol_entry(table, key, own);
+      scr_dyn_release(table);
+      break;
+    }
     if (current->symbol_properties) entry = scr_dyn_entry(current->symbol_properties, name);
     if (entry) break;
   }
@@ -2442,14 +2955,19 @@ typedef struct {
   size_t rc;
   ScrDyn *source;
   double index;
-  bool string_iterator;
+  unsigned kind; /* 0: array, 1: string, 2: Map, 3: Set */
+  unsigned selection; /* 0: values, 1: keys, 2: entries */
+  bool array_like;
+  double limit;
 } ScrNativeIterator;
 
-static SCR_TL ScrDyn *scr_iterator_functions[7];
+static ScrDyn *scr_iterator_read(const ScrDyn *value, const char *key, size_t len);
+
+static SCR_TL ScrDyn *scr_iterator_functions[11];
 static SCR_TL bool scr_iterator_functions_registered;
 
 static void scr_iterator_functions_cleanup(void) {
-  for (size_t i = 0; i < 7; i++) {
+  for (size_t i = 0; i < 11; i++) {
     ScrDyn *function = scr_iterator_functions[i];
     scr_iterator_functions[i] = NULL;
     scr_dyn_release(function);
@@ -2475,27 +2993,63 @@ static void *scr_native_iterator_retain(void *ptr) {
 static void scr_native_iterator_release(void *ptr) {
   ScrNativeIterator *iterator = ptr;
   if (--iterator->rc) return;
+  scr_weak_dispose(iterator);
+  if (iterator->source && (iterator->kind == 2 || iterator->kind == 3)) scr_map_iter_exit(iterator->source->v.handle.ptr);
   scr_dyn_release(iterator->source);
   free(iterator);
 }
 
 static ScrDyn *scr_native_iterator_next(ScrNativeIterator *iterator) {
   ScrDyn *source = iterator->source;
+  if (source && iterator->kind == 4) {
+    ScrDyn *result = scr_dyn_handle_ops_of(source)->iter_step(source->v.handle.ptr, &iterator->index, iterator->selection);
+    if (!result) return NULL;
+    if (scr_dyn_truthy(scr_dyn_obj_get(result, "done", 4))) {
+      iterator->source = NULL;
+      scr_dyn_release(source);
+    }
+    return result;
+  }
   /* Native array capsules retain the live array, so refresh its view at each
    * step rather than iterating a snapshot taken when the iterator opened. */
   ScrDyn *view = source && source->kind == SCR_DYN_TYPED_REF ? scr_dyn_typed_ref_materialize(source) : NULL;
   if (scr_exc_pending()) { scr_dyn_release(view); return NULL; }
   ScrDyn *items = view ? view : source;
-  double length = !items ? 0 : items->kind == SCR_DYN_ARR ? (double)items->v.arr.len
+  ScrMap *map = source && (iterator->kind == 2 || iterator->kind == 3) ? source->v.handle.ptr : NULL;
+  if (map) while (iterator->index < scr_map_iter_count(map) && !scr_map_iter_live(map, iterator->index)) iterator->index++;
+  double length = !items ? 0 : iterator->array_like ? iterator->limit : map ? scr_map_iter_count(map) : items->kind == SCR_DYN_ARR ? (double)items->v.arr.len
     : items->kind == SCR_DYN_BYTES ? (double)items->v.bytes->len : scr_str_utf16_len(items->v.str);
   bool done = !source || iterator->index >= length;
   ScrDyn *value;
   if (done) {
     value = scr_dyn_retain(scr_dyn_undefined());
     iterator->source = NULL;
+    if (map) scr_map_iter_exit(map);
     scr_dyn_release(source);
+  } else if (iterator->array_like) {
+    char key[32];
+    int size = snprintf(key, sizeof key, "%.0f", iterator->index++);
+    value = scr_iterator_read(items, key, (size_t)size);
+  } else if (map) {
+    double index = iterator->index++;
+    if (iterator->selection == 2) {
+      value = scr_dyn_new_arr();
+      scr_dyn_arr_push(value, scr_map_dyn_key(map, index));
+      scr_dyn_arr_push(value, iterator->kind == 3 ? scr_map_dyn_key(map, index) : scr_map_dyn_value(map, index));
+    } else value = iterator->selection == 1 || iterator->kind == 3
+      ? scr_map_dyn_key(map, index) : scr_map_dyn_value(map, index);
   } else if (items->kind == SCR_DYN_ARR) {
-    value = scr_dyn_arr_at(items, iterator->index++);
+    double index = iterator->index++;
+    if (iterator->selection == 1) value = scr_dyn_new_num(index);
+    else {
+      value = scr_dyn_arr_at(items, index);
+      if (value && iterator->selection == 2) {
+        ScrDyn *entry = scr_dyn_new_arr();
+        scr_dyn_arr_push(entry, scr_dyn_new_num(index));
+        scr_dyn_arr_push(entry, value);
+        value = entry;
+      }
+    }
   } else if (items->kind == SCR_DYN_BYTES) {
     value = scr_dyn_new_num(scr_bytes_get(items->v.bytes, iterator->index++));
   } else {
@@ -2512,14 +3066,15 @@ static ScrDyn *scr_native_iterator_next(ScrNativeIterator *iterator) {
   return result;
 }
 
-static ScrDyn *scr_native_iterator_next_checked(bool string_iterator) {
+static ScrDyn *scr_native_iterator_next_checked(unsigned kind) {
   ScrDyn *self = scr_dyn_this_get();
   ScrDyn *result = NULL;
   if (self->kind == SCR_DYN_HANDLE && self->v.handle.tag == SCR_DYNH_ITERATOR &&
-      ((ScrNativeIterator *)self->v.handle.ptr)->string_iterator == string_iterator)
+      ((ScrNativeIterator *)self->v.handle.ptr)->kind == kind)
     result = scr_native_iterator_next(self->v.handle.ptr);
   else {
-    const char *message = string_iterator
+    const char *message = kind == 3 ? "Method Set Iterator.prototype.next called on incompatible receiver"
+      : kind == 2 ? "Method Map Iterator.prototype.next called on incompatible receiver" : kind == 1
       ? "Method String Iterator.prototype.next called on incompatible receiver"
       : "Method Array Iterator.prototype.next called on incompatible receiver";
     scr_throw_error_msg(SCR_ERR_TYPE, message, strlen(message));
@@ -2530,17 +3085,35 @@ static ScrDyn *scr_native_iterator_next_checked(bool string_iterator) {
 
 static ScrDyn *scr_native_array_iterator_next_call(ScrClosure *closure, ScrDyn *const *args, size_t argc) {
   (void)closure; (void)args; (void)argc;
-  return scr_native_iterator_next_checked(false);
+  return scr_native_iterator_next_checked(0);
 }
 
 static ScrDyn *scr_native_string_iterator_next_call(ScrClosure *closure, ScrDyn *const *args, size_t argc) {
   (void)closure; (void)args; (void)argc;
-  return scr_native_iterator_next_checked(true);
+  return scr_native_iterator_next_checked(1);
+}
+
+static ScrDyn *scr_native_map_iterator_next_call(ScrClosure *closure, ScrDyn *const *args, size_t argc) {
+  (void)closure; (void)args; (void)argc;
+  return scr_native_iterator_next_checked(2);
+}
+
+static ScrDyn *scr_native_set_iterator_next_call(ScrClosure *closure, ScrDyn *const *args, size_t argc) {
+  (void)closure; (void)args; (void)argc;
+  return scr_native_iterator_next_checked(3);
+}
+
+static ScrDyn *scr_native_handle_iterator_next_call(ScrClosure *closure, ScrDyn *const *args, size_t argc) {
+  (void)closure; (void)args; (void)argc;
+  return scr_native_iterator_next_checked(4);
 }
 
 static ScrDyn *scr_native_iterator_get(void *ptr, const char *key, size_t len) {
   if (len != 4 || memcmp(key, "next", 4)) return NULL;
-  return ((ScrNativeIterator *)ptr)->string_iterator
+  unsigned kind = ((ScrNativeIterator *)ptr)->kind;
+  if (kind == 4) return scr_iterator_function(10, &scr_native_handle_iterator_next_call, "next");
+  return kind == 3 ? scr_iterator_function(8, &scr_native_set_iterator_next_call, "next")
+    : kind == 2 ? scr_iterator_function(7, &scr_native_map_iterator_next_call, "next") : kind == 1
     ? scr_iterator_function(5, &scr_native_string_iterator_next_call, "next")
     : scr_iterator_function(0, &scr_native_array_iterator_next_call, "next");
 }
@@ -2562,12 +3135,26 @@ static ScrDyn *scr_native_iterator_new(ScrDyn *source) {
   ScrNativeIterator *iterator = malloc(sizeof *iterator);
   if (!iterator) scr_json_oom();
   *iterator = (ScrNativeIterator){ .rc = 1, .source = scr_dyn_retain(source), .index = 0,
-    .string_iterator = source->kind == SCR_DYN_STR };
+    .kind = source->kind == SCR_DYN_STR ? 1 : source->kind == SCR_DYN_HANDLE && source->v.handle.tag == SCR_DYNH_MAP ? 2
+      : source->kind == SCR_DYN_HANDLE && source->v.handle.tag == SCR_DYNH_SET ? 3
+      : source->kind == SCR_DYN_HANDLE && scr_dyn_handle_ops_of(source)->iter_step ? 4 : 0,
+    .selection = source->kind == SCR_DYN_HANDLE && (source->v.handle.tag == SCR_DYNH_MAP || scr_dyn_handle_ops_of(source)->iter_step) ? 2 : 0 };
+  if (iterator->kind == 2 || iterator->kind == 3) scr_map_iter_enter(source->v.handle.ptr);
   ScrDyn *result = scr_dyn_new_handle(iterator, SCR_DYNH_ITERATOR);
   scr_native_iterator_release(iterator);
   return result;
 }
 
+static ScrDyn *scr_native_collection_iterator(ScrDyn *source, unsigned selection) {
+  ScrDyn *result = scr_native_iterator_new(source);
+  ((ScrNativeIterator *)result->v.handle.ptr)->selection = selection;
+  return result;
+}
+
+ScrDyn *scr_dyn_native_handle_iterator(ScrDyn *source, unsigned selection) {
+  return scr_native_collection_iterator(source, selection);
+}
+
 static ScrDyn *scr_builtin_iterator_checked(int kind) {
   ScrDyn *self = scr_dyn_this_get();
   ScrDyn *result = NULL;
@@ -2604,6 +3191,11 @@ static ScrDyn *scr_iterator_self_call(ScrClosure *closure, ScrDyn *const *args,
 static ScrDyn *scr_handle_iterator_call(ScrClosure *closure, ScrDyn *const *args, size_t argc) {
   (void)closure; (void)args; (void)argc;
   ScrDyn *self = scr_dyn_this_get();
+  if (self->kind == SCR_DYN_HANDLE && (self->v.handle.tag == SCR_DYNH_MAP || self->v.handle.tag == SCR_DYNH_SET || scr_dyn_handle_ops_of(self)->iter_step)) {
+    ScrDyn *result = scr_native_iterator_new(self);
+    scr_dyn_release(self);
+    return result;
+  }
   ScrDyn *items = scr_dyn_iter_pack(self, NULL);
   ScrDyn *result = items ? scr_native_iterator_new(items) : NULL;
   scr_dyn_release(items);
@@ -2616,10 +3208,11 @@ ScrDyn *scr_dyn_array_values_function(void) {
 }
 
 static ScrDyn *scr_builtin_iterator_method(const ScrDyn *value) {
+  if (scr_dyn_generator(value)) return scr_iterator_function(4, &scr_iterator_self_call, "[Symbol.iterator]");
   if (value->kind == SCR_DYN_ARR || (value->kind == SCR_DYN_TYPED_REF && scr_dyn_isl_is_array(value))) return scr_dyn_array_values_function();
   if (value->kind == SCR_DYN_BYTES) return scr_iterator_function(2, &scr_builtin_bytes_iterator_call, "values");
   if (value->kind == SCR_DYN_STR) return scr_iterator_function(3, &scr_builtin_string_iterator_call, "[Symbol.iterator]");
-  if (value->kind == SCR_DYN_HANDLE && scr_dyn_handle_ops_of(value)->iter_pack)
+  if (value->kind == SCR_DYN_HANDLE && (value->v.handle.tag == SCR_DYNH_MAP || value->v.handle.tag == SCR_DYNH_SET || scr_dyn_handle_ops_of(value)->iter_pack || scr_dyn_handle_ops_of(value)->iter_step))
     return scr_iterator_function(6, &scr_handle_iterator_call, "[Symbol.iterator]");
   return scr_iterator_function(4, &scr_iterator_self_call, "[Symbol.iterator]");
 }
@@ -2644,6 +3237,21 @@ static ScrDyn *scr_iterator_method(const ScrDyn *source) {
 }
 
 /* Compiled class methods are dispatched before this checked-object path. */
+ScrDyn *scr_dyn_iterator_optional(const ScrDyn *source) {
+  ScrDyn *method = scr_iterator_method(source);
+  if (!method) return NULL;
+  if (method->kind == SCR_DYN_UNDEF || method->kind == SCR_DYN_NULL) {
+    scr_dyn_release(method);
+    return NULL;
+  }
+  ScrDyn *iterator = scr_iterator_call(method, source, "value[Symbol.iterator]");
+  scr_dyn_release(method);
+  if (!iterator) return NULL;
+  ScrDyn *checked = scr_dyn_iterator_result(iterator);
+  scr_dyn_release(iterator);
+  return checked;
+}
+
 ScrDyn *scr_dyn_iterator(const ScrDyn *source, const ScrStr *spell) {
   if (source->kind == SCR_DYN_JSVAL) return scr_dyn_jsval_ops()->iterator(source->v.jsval.cell, spell, false);
   if (source->kind == SCR_DYN_NULL || source->kind == SCR_DYN_UNDEF) return scr_dyn_not_iterable(source, spell);
@@ -2662,6 +3270,14 @@ ScrDyn *scr_dyn_iterator(const ScrDyn *source, const ScrStr *spell) {
 }
 
 static ScrDyn *scr_iterator_read(const ScrDyn *value, const char *key, size_t len) {
+  if (value->kind == SCR_DYN_TYPED_REF) {
+    ScrDyn *view = scr_dyn_typed_ref_materialize(value);
+    if (!view) return NULL;
+    ScrDyn *result = scr_iterator_read(view, key, len);
+    scr_dyn_release(view);
+    return result;
+  }
+  if (value->kind == SCR_DYN_PROXY) return scr_dyn_obj_read(value, key, len);
   if (value->kind == SCR_DYN_HANDLE) {
     ScrStr *name = scr_str_new(key, len);
     ScrDyn *result = scr_dyn_handle_key_get(value, name);
@@ -2701,14 +3317,10 @@ ScrDyn *scr_dyn_array_from_iterator(const ScrDyn *source) {
       numeric = false;
     }
     if (!numeric) { scr_dyn_release(out); return NULL; }
-    for (size_t i = 0; (double)i < floor(n); i++) {
-      char key[32];
-      int size = snprintf(key, sizeof key, "%zu", i);
-      ScrDyn *value = scr_iterator_read(source, key, (size_t)size);
-      if (!value) { scr_dyn_release(out); return NULL; }
-      scr_dyn_arr_push(out, value);
-    }
-    ScrDyn *iterator = scr_native_iterator_new(out);
+    ScrDyn *iterator = scr_native_iterator_new((ScrDyn *)source);
+    ScrNativeIterator *state = iterator->v.handle.ptr;
+    state->array_like = true;
+    state->limit = isnan(n) || n < 0 ? 0 : floor(n);
     scr_dyn_release(out);
     return iterator;
   }
@@ -2722,7 +3334,9 @@ ScrDyn *scr_dyn_array_from_iterator(const ScrDyn *source) {
 }
 
 ScrDyn *scr_dyn_symbol_key_get(const ScrDyn *value, const ScrDyn *key, bool optional) {
-  if (value->kind == SCR_DYN_TYPED_REF && scr_dyn_isl_is_array(value)) {
+  if (scr_dyn_generator(value)) return scr_dyn_generator_symbol(value, key)
+    ? scr_iterator_function(4, &scr_iterator_self_call, "[Symbol.iterator]") : scr_dyn_retain(scr_dyn_undefined());
+  if (value->kind == SCR_DYN_TYPED_REF) {
     ScrDyn *view = scr_dyn_typed_ref_materialize(value);
     ScrDyn *result = scr_exc_pending() ? NULL : scr_dyn_symbol_key_get(view, key, optional);
     scr_dyn_release(view);
@@ -2760,6 +3374,15 @@ ScrDyn *scr_dyn_symbol_key_get(const ScrDyn *value, const ScrDyn *key, bool opti
   return out;
 }
 
+/* Native field tables retain presence and attributes without owning a second
+ * copy of the field's value. This internal update bypasses writable flags. */
+void scr_dyn_symbol_key_placeholder(ScrDyn *value, ScrDyn *key) {
+  ScrDynEntry *entry = scr_dyn_symbol_entry(value, key, true);
+  if (!entry || entry->accessor) return;
+  scr_dyn_release(entry->value);
+  entry->value = scr_dyn_retain(scr_dyn_undefined());
+}
+
 void scr_dyn_symbol_key_set(ScrDyn *value, ScrDyn *key, ScrDyn *stored) {
   ScrDyn *receiver = scr_dyn_symbol_receiver(value);
   if (!receiver) {
@@ -2823,7 +3446,12 @@ static bool scr_dyn_key_probe_computed(const ScrDyn *value, const ScrDyn *raw_ke
     scr_dyn_release(key);
     return out;
   }
-  if (value->kind == SCR_DYN_TYPED_REF && scr_dyn_isl_is_array(value)) {
+  if (scr_dyn_generator(value)) {
+    bool found = mode == 0 && scr_dyn_generator_symbol(value, key);
+    scr_dyn_release(key);
+    return found;
+  }
+  if (value->kind == SCR_DYN_TYPED_REF) {
     ScrDyn *view = scr_dyn_typed_ref_materialize(value);
     bool out = !scr_exc_pending() && scr_dyn_key_probe_computed(view, key, mode);
     scr_dyn_release(view);
@@ -2892,7 +3520,7 @@ void scr_dyn_key_delete_computed(ScrDyn *value, const ScrDyn *raw_key, bool stri
  * Refuse overrides until every typed call site observes the property table. */
 static bool scr_dyn_fn_property_fence(const ScrStr *key) {
   static const char *const reserved[] = {
-    "call", "apply", "bind", "toString", "valueOf", "toLocaleString",
+    "call", "apply", "bind", "valueOf", "toLocaleString",
     "hasOwnProperty", "propertyIsEnumerable", "isPrototypeOf",
     "constructor", "caller", "arguments", "__proto__",
   };
@@ -2906,6 +3534,20 @@ static bool scr_dyn_fn_property_fence(const ScrStr *key) {
 }
 
 ScrDyn *scr_dyn_define_property(ScrDyn *target, ScrDyn *key, ScrDyn *descriptor) {
+  if (target->kind == SCR_DYN_TYPED_REF) {
+    ScrDyn *view = scr_dyn_typed_ref_materialize(target);
+    ScrDyn *defined = scr_exc_pending() ? NULL : scr_dyn_define_property(view, key, descriptor);
+    if (!scr_exc_pending()) scr_dyn_typed_ref_commit(target);
+    scr_dyn_release(defined);
+    scr_dyn_release(view);
+    return scr_exc_pending() ? NULL : scr_dyn_retain(target);
+  }
+  if (descriptor->kind == SCR_DYN_TYPED_REF) {
+    ScrDyn *view = scr_dyn_typed_ref_materialize(descriptor);
+    ScrDyn *result = scr_exc_pending() ? NULL : scr_dyn_define_property(target, key, view);
+    scr_dyn_release(view);
+    return result;
+  }
   if (key->kind == SCR_DYN_SYMBOL) return scr_dyn_define_symbol(target, key, descriptor);
   if (target->kind == SCR_DYN_PROXY || descriptor->kind == SCR_DYN_PROXY) {
     scr_dyn_proxy_unsupported("Object.defineProperty");
@@ -3136,6 +3778,7 @@ bool scr_dyn_truthy(const ScrDyn *d) {
  * null answers "object" — JS's oldest wart, preserved. */
 ScrStr *scr_dyn_typeof(const ScrDyn *d) {
   const char *s;
+  if (d->kind == SCR_DYN_PROXY) return scr_dyn_typeof(d->v.proxy.target);
   if (d->kind == SCR_DYN_TYPED_REF) {
     if (d->v.typed_ref.type_key_len >= 7 &&
         memcmp(d->v.typed_ref.type_key, "object:", 7) == 0)
@@ -3170,6 +3813,16 @@ ScrStr *scr_dyn_typeof(const ScrDyn *d) {
   return scr_str_new(s, strlen(s));
 }
 
+bool scr_dyn_is_callable(const ScrDyn *value) {
+  while (value->kind == SCR_DYN_PROXY) value = value->v.proxy.target;
+  return value->kind == SCR_DYN_FUNC || scr_dyn_isl_typeof_is(value, "function");
+}
+
+int scr_dyn_function_kind(const ScrDyn *value) {
+  while (value->kind == SCR_DYN_PROXY) value = value->v.proxy.target;
+  return value->kind == SCR_DYN_FUNC ? value->v.fn.clo->function_kind : 0;
+}
+
 bool scr_dyn_is_object(const ScrDyn *d) {
   ScrStr *type = scr_dyn_typeof(d);
   bool object = type->len == 6 && memcmp(type->data, "object", 6) == 0;
@@ -3415,6 +4068,29 @@ static SCR_TL ScrErrDynEnt *scr_errdyn_cache = NULL;
 static SCR_TL size_t scr_errdyn_n = 0, scr_errdyn_cap = 0;
 static SCR_TL bool scr_errdyn_teardown_registered = false;
 
+typedef struct {
+  const ScrVt *vt;
+  ScrDyn *(*box)(void *);
+} ScrErrorDynType;
+static SCR_TL ScrErrorDynType *scr_error_dyn_types = NULL;
+static SCR_TL size_t scr_error_dyn_type_count = 0;
+
+static void scr_error_dyn_types_drop(void) {
+  free(scr_error_dyn_types);
+  scr_error_dyn_types = NULL;
+  scr_error_dyn_type_count = 0;
+}
+
+void scr_error_register_dyn(const ScrVt *vt, ScrDyn *(*box)(void *)) {
+  for (size_t i = 0; i < scr_error_dyn_type_count; i++) {
+    if (scr_error_dyn_types[i].vt == vt) return;
+  }
+  if (!scr_error_dyn_type_count) scr_atexit(scr_error_dyn_types_drop);
+  scr_error_dyn_types = realloc(scr_error_dyn_types, (scr_error_dyn_type_count + 1) * sizeof *scr_error_dyn_types);
+  if (!scr_error_dyn_types) scr_json_oom();
+  scr_error_dyn_types[scr_error_dyn_type_count++] = (ScrErrorDynType){vt, box};
+}
+
 static void scr_errdyn_teardown(void) {
   for (size_t i = 0; i < scr_errdyn_n; i++) {
     scr_error_release(scr_errdyn_cache[i].err);
@@ -3425,14 +4101,32 @@ static void scr_errdyn_teardown(void) {
   scr_errdyn_n = scr_errdyn_cap = 0;
 }
 
-ScrDyn *scr_dyn_from_error(const ScrError *e) {
-  for (size_t i = 0; i < scr_errdyn_n; i++) {
-    if (scr_errdyn_cache[i].err == e) return scr_dyn_retain(scr_errdyn_cache[i].dyn);
-  }
+ScrDyn *scr_error_dyn_fields(const ScrError *e) {
   ScrDyn *d = scr_dyn_new_obj();
   scr_dyn_obj_set(d, "%error", 6, scr_dyn_new_bool(true)); /* the checked-dynamic tree's error marker */
-  scr_dyn_obj_set(d, "name", 4, scr_dyn_new_str(e->name));
-  scr_dyn_obj_set(d, "message", 7, scr_dyn_new_str(e->message));
+  d->v.obj.entries[d->v.obj.len - 1].enumerable = false;
+  if (e->name_present) {
+    scr_dyn_obj_set(d, "name", 4, scr_dyn_new_str(e->name));
+    d->v.obj.entries[d->v.obj.len - 1].enumerable = e->name_enumerable;
+  }
+  if (!e->name_present || !e->message_present) {
+    ScrDyn *prototype = scr_dyn_new_obj();
+    if (!e->name_present) {
+      scr_dyn_obj_set(prototype, "name", 4, scr_dyn_new_str(e->name));
+      prototype->v.obj.entries[prototype->v.obj.len - 1].enumerable = false;
+    }
+    if (!e->message_present) {
+      scr_dyn_obj_set(prototype, "message", 7, scr_dyn_new_str(e->message));
+      prototype->v.obj.entries[prototype->v.obj.len - 1].enumerable = false;
+    }
+    scr_dyn_release(scr_dyn_set_prototype(d, prototype));
+    scr_dyn_release(prototype);
+  }
+  if (e->message_present) {
+    scr_dyn_obj_set(d, "message", 7, scr_dyn_new_str(e->message));
+    d->v.obj.entries[d->v.obj.len - 1].enumerable = e->message_enumerable;
+  }
+  if (e->stack) scr_dyn_obj_set(d, "stack", 5, scr_dyn_new_str(e->stack));
   if (e->code) scr_dyn_obj_set(d, "code", 4, scr_dyn_new_str(e->code));
   if (e->error_cause) {
     scr_dyn_obj_set(d, "cause", 5, scr_dyn_retain(e->error_cause));
@@ -3446,6 +4140,21 @@ ScrDyn *scr_dyn_from_error(const ScrError *e) {
       scr_dyn_obj_set(d, "cause", 5, scr_domex_cause((ScrError *)e));
     }
   }
+  return d;
+}
+
+ScrDyn *scr_dyn_from_error(const ScrError *e) {
+  for (size_t i = 0; i < scr_errdyn_n; i++) {
+    if (scr_errdyn_cache[i].err == e) return scr_dyn_retain(scr_errdyn_cache[i].dyn);
+  }
+  ScrDyn *d = NULL;
+  for (size_t i = 0; i < scr_error_dyn_type_count; i++) {
+    if (scr_error_dyn_types[i].vt == e->vt) {
+      d = scr_error_dyn_types[i].box((void *)e);
+      break;
+    }
+  }
+  if (!d) d = scr_error_dyn_fields(e);
   if (scr_errdyn_n == scr_errdyn_cap) {
     scr_errdyn_cap = scr_errdyn_cap ? scr_errdyn_cap * 2 : 8;
     scr_errdyn_cache = realloc(scr_errdyn_cache, scr_errdyn_cap * sizeof *scr_errdyn_cache);
@@ -3474,6 +4183,54 @@ ScrDyn *scr_dyn_from_error(const ScrError *e) {
  * its next boxing answers the same dyn node. The dyn node is borrowed. */
 static void scr_error_cause_drop_impl(void *obj);
 
+void scr_error_commit_dyn(ScrError *e, const ScrDyn *view) {
+  ScrDynEntry *name_entry = NULL;
+  for (size_t i = 0; i < view->v.obj.len; i++) {
+    ScrDynEntry *entry = &view->v.obj.entries[i];
+    if (entry->key_len == 4 && memcmp(entry->key, "name", 4) == 0) { name_entry = entry; break; }
+  }
+  ScrDyn *name = name_entry ? name_entry->value : NULL;
+  if (name && name->kind != SCR_DYN_STR) {
+    scr_dyn_check_fail(NULL, "string", name);
+    return;
+  }
+  ScrStr *next_name = name ? scr_str_retain(name->v.str) : scr_error_default_name(e);
+  scr_str_release(e->name);
+  e->name = next_name;
+  e->name_present = name != NULL;
+  e->name_enumerable = name_entry && name_entry->enumerable;
+  ScrDyn *message = scr_dyn_obj_get(view, "message", 7);
+  if (message && message->kind != SCR_DYN_STR) {
+    scr_dyn_check_fail(NULL, "string", message);
+    return;
+  }
+  ScrStr *next_message = message ? scr_str_retain(message->v.str) : scr_str_new("", 0);
+  scr_str_release(e->message);
+  e->message = next_message;
+  e->message_present = message != NULL;
+  e->message_enumerable = false;
+  for (size_t i = 0; message && i < view->v.obj.len; i++) {
+    const ScrDynEntry *entry = &view->v.obj.entries[i];
+    if (entry->key_len == 7 && memcmp(entry->key, "message", 7) == 0) e->message_enumerable = entry->enumerable;
+  }
+  ScrDyn *stack = scr_dyn_obj_get(view, "stack", 5);
+  if (stack && stack->kind == SCR_DYN_STR) {
+    ScrStr *replacement = scr_str_retain(stack->v.str);
+    scr_str_release(e->stack);
+    e->stack = replacement;
+  }
+  ScrDyn *cause = scr_dyn_obj_get(view, "cause", 5);
+  scr_error_install_cause_drop(&scr_error_cause_drop_impl);
+  ScrDyn *replacement = cause ? scr_dyn_retain(cause) : NULL;
+  scr_dyn_release(e->error_cause);
+  e->error_cause = replacement;
+  e->cause_enumerable = false;
+  for (size_t i = 0; cause && i < view->v.obj.len; i++) {
+    const ScrDynEntry *entry = &view->v.obj.entries[i];
+    if (entry->key_len == 5 && memcmp(entry->key, "cause", 5) == 0) e->cause_enumerable = entry->enumerable;
+  }
+}
+
 ScrError *scr_error_from_dyn(const ScrDyn *d) {
   ScrError *hit = scr_errdyn_err_of(d);
   if (hit) return hit;
@@ -3494,6 +4251,8 @@ ScrError *scr_error_from_dyn(const ScrDyn *d) {
   if (en && en->kind == SCR_DYN_STR) {
     scr_str_release(e->name);
     e->name = scr_str_retain(en->v.str);
+    e->name_present = true;
+    e->name_enumerable = true;
   }
   if (ec && ec->kind == SCR_DYN_STR) e->code = scr_str_retain(ec->v.str);
   ScrDyn *cause = scr_dyn_obj_get(d, "cause", 5);
@@ -3539,11 +4298,20 @@ void scr_errdyn_put(ScrError *e, ScrDyn *d) {
 /* Error.cause has one live value even when the Error already crossed a
  * checked-value boundary. Reflective data-property edits update its slot. */
 static void scr_error_sync_cause(ScrDyn *view, const ScrStr *key) {
-  if (key->len != 5 || memcmp(key->data, "cause", 5) != 0) return;
+  bool cause = key->len == 5 && memcmp(key->data, "cause", 5) == 0;
+  bool stack = key->len == 5 && memcmp(key->data, "stack", 5) == 0;
+  if (!cause && !stack) return;
   ScrDynEntry *entry = scr_dyn_entry(view, key);
   for (size_t i = 0; i < scr_errdyn_n; i++) {
     if (scr_errdyn_cache[i].dyn != view) continue;
     ScrError *e = scr_errdyn_cache[i].err;
+    if (stack) {
+      if (entry && entry->value->kind == SCR_DYN_STR) {
+        scr_str_release(e->stack);
+        e->stack = scr_str_retain(entry->value->v.str);
+      }
+      continue;
+    }
     if (e->vt == &scr_error_vts[SCR_ERR_DOMEX]) continue;
     ScrDyn *replacement = entry ? scr_dyn_retain(entry->value) : NULL;
     scr_error_install_cause_drop(&scr_error_cause_drop_impl);
@@ -3687,20 +4455,7 @@ ScrStr *scr_dyn_to_string_argument(const ScrDyn *d, const ScrDyn *argument, cons
     scr_str_release(encoding);
     return result;
   }
-  if (d->kind == SCR_DYN_NUM && argument->kind != SCR_DYN_UNDEF) {
-    double radix;
-    if (!scr_dyn_number_coerce_js(argument, &radix)) return NULL;
-    if (!isfinite(radix) || trunc(radix) < 2 || trunc(radix) > 36) {
-      static const char message[] = "toString() radix argument must be between 2 and 36";
-      scr_throw_error_msg(SCR_ERR_RANGE, message, sizeof message - 1);
-      return NULL;
-    }
-    if (trunc(radix) != 10) {
-      static const char message[] = "Number.toString with a non-decimal radix has no native lowering";
-      scr_throw_error_msg_code(SCR_ERR_ERROR, message, sizeof message - 1, "SC2020");
-      return NULL;
-    }
-  }
+  if (d->kind == SCR_DYN_NUM) return scr_num_to_string_radix(d->v.num, argument);
   if (d->kind == SCR_DYN_OBJ && !scr_dyn_property_owner(d, "toString", 8) && !scr_dyn_has_object_prototype(d)) {
     ScrJsonBuf b;
     scr_jb_init(&b);
@@ -3709,7 +4464,7 @@ ScrStr *scr_dyn_to_string_argument(const ScrDyn *d, const ScrDyn *argument, cons
     scr_throw_error(SCR_ERR_TYPE, scr_jb_finish(&b));
     return scr_str_new("", 0);
   }
-  return scr_dyn_to_string(d, NULL);
+  return scr_dyn_to_string_method(d, NULL, what);
 }
 
 /* JS String() over the dyn kind — the WebIDL ToString the web globals
@@ -3929,6 +4684,46 @@ double scr_dyn_number_constructor(const ScrDyn *d) {
   return result;
 }
 
+static ScrBigInt *scr_dyn_bigint_convert(const ScrDyn *d, bool allow_number) {
+  ScrDyn *primitive = scr_dyn_add_primitive(d);
+  if (!primitive) return NULL;
+  ScrBigInt *result = NULL;
+  switch (primitive->kind) {
+  case SCR_DYN_BIGINT: result = scr_bigint_retain(primitive->v.bigint); break;
+  case SCR_DYN_STR: result = scr_bigint_parse(primitive->v.str); break;
+  case SCR_DYN_NUM:
+    if (allow_number) result = scr_bigint_from_f64(primitive->v.num);
+    else {
+      ScrStr *text = scr_dyn_string_coerce_js(primitive);
+      ScrJsonBuf message;
+      scr_jb_init(&message);
+      scr_jb_puts(&message, "Cannot convert ");
+      for (size_t i = 0; i < text->len; i++) scr_jb_putc(&message, text->data[i]);
+      scr_jb_puts(&message, " to a BigInt");
+      scr_str_release(text);
+      scr_throw_error(SCR_ERR_TYPE, scr_jb_finish(&message));
+    }
+    break;
+  case SCR_DYN_BOOL: result = scr_bigint_from_i64(primitive->v.b ? 1 : 0); break;
+  default: {
+    const char *message = primitive->kind == SCR_DYN_NULL ? "Cannot convert null to a BigInt"
+      : primitive->kind == SCR_DYN_UNDEF ? "Cannot convert undefined to a BigInt" : "Cannot convert Symbol() to a BigInt";
+    scr_throw_error_msg(SCR_ERR_TYPE, message, strlen(message));
+    break;
+  }
+  }
+  scr_dyn_release(primitive);
+  return result;
+}
+
+ScrBigInt *scr_dyn_bigint_constructor(const ScrDyn *d) {
+  return scr_dyn_bigint_convert(d, true);
+}
+
+ScrBigInt *scr_dyn_bigint_coerce(const ScrDyn *d) {
+  return scr_dyn_bigint_convert(d, false);
+}
+
 /* OrdinaryToPrimitive's default hint is numeric for the represented
  * ordinary objects. Retain the primitive itself: addition must choose
  * string concatenation before either side is converted to a number. */
@@ -4037,7 +4832,45 @@ ScrDyn *scr_dyn_increment(const ScrDyn *value, bool increment) {
     scr_bigint_release(one);
     return out;
   }
-  return scr_dyn_new_num(value->v.num + (increment ? 1 : -1));
+  return scr_dyn_new_num(value->v.num + (increment ? 1 : -1));
+}
+
+bool scr_dyn_compare(const ScrDyn *left, const ScrDyn *right, const ScrStr *operation) {
+  // ToPrimitive is observable and always visits the original left operand
+  // first, including the > and <= spellings of relational comparison.
+  ScrDyn *l = scr_dyn_add_primitive(left);
+  if (!l) return false;
+  ScrDyn *r = scr_dyn_add_primitive(right);
+  if (!r) { scr_dyn_release(l); return false; }
+  double order = 2;
+  if (l->kind == SCR_DYN_STR && r->kind == SCR_DYN_STR) {
+    int compared = scr_str_cmp_u16(l->v.str, r->v.str);
+    order = compared < 0 ? -1 : compared > 0 ? 1 : 0;
+  } else if (l->kind == SCR_DYN_BIGINT && r->kind == SCR_DYN_STR) {
+    order = scr_bigint_cmp_string(l->v.bigint, r->v.str);
+  } else if (l->kind == SCR_DYN_STR && r->kind == SCR_DYN_BIGINT) {
+    double opposite = scr_bigint_cmp_string(r->v.bigint, l->v.str);
+    order = opposite == 2 ? 2 : -opposite;
+  } else if (l->kind == SCR_DYN_BIGINT && r->kind == SCR_DYN_BIGINT) {
+    order = scr_bigint_cmp_f64(l->v.bigint, r->v.bigint);
+  } else {
+    double a = 0, b = 0;
+    bool valid = (l->kind == SCR_DYN_BIGINT || scr_dyn_number_coerce_js(l, &a)) &&
+      (r->kind == SCR_DYN_BIGINT || scr_dyn_number_coerce_js(r, &b));
+    if (valid) {
+      if (l->kind == SCR_DYN_BIGINT) order = scr_bigint_cmp_number(l->v.bigint, b);
+      else if (r->kind == SCR_DYN_BIGINT) {
+        double opposite = scr_bigint_cmp_number(r->v.bigint, a);
+        order = opposite == 2 ? 2 : -opposite;
+      } else if (!isnan(a) && !isnan(b)) order = a < b ? -1 : a > b ? 1 : 0;
+    }
+  }
+  scr_dyn_release(l);
+  scr_dyn_release(r);
+  if (scr_exc_pending() || order == 2) return false;
+  return operation->data[0] == '<'
+    ? (operation->len == 2 ? order <= 0 : order < 0)
+    : (operation->len == 2 ? order >= 0 : order > 0);
 }
 
 ScrDyn *scr_dyn_arithmetic(const ScrDyn *left, const ScrDyn *right, const ScrStr *operation) {
@@ -4121,6 +4954,12 @@ static const char *scr_dyn_kind_name(const ScrDyn *d);
  * valid dense index, every other kind false (tsc admits `in` only on
  * object-typed operands). Proxy traps may throw. Borrows both. */
 bool scr_dyn_has_key(const ScrDyn *v, const ScrStr *key) {
+  if (scr_dyn_generator(v)) {
+    static const char *const inherited[] = { "next", "return", "throw", "constructor", "toString", "valueOf", "hasOwnProperty", "propertyIsEnumerable", "isPrototypeOf", "toLocaleString", "__proto__" };
+    for (size_t i = 0; i < sizeof inherited / sizeof inherited[0]; i++)
+      if (key->len == strlen(inherited[i]) && memcmp(key->data, inherited[i], key->len) == 0) return true;
+    return false;
+  }
   if (scr_dyn_class_reflection_fence(v)) return false;
   if (v->kind == SCR_DYN_PROXY) return scr_dyn_proxy_has(v, key);
   if (v->kind == SCR_DYN_JSVAL) return scr_dyn_isl_fence(v, "'in'");
@@ -4131,12 +4970,10 @@ bool scr_dyn_has_key(const ScrDyn *v, const ScrStr *key) {
     return out;
   }
   if (v->kind == SCR_DYN_OBJ) {
-    for (const ScrDyn *current = v; current && current->kind == SCR_DYN_OBJ; current = current->prototype) {
-      if (scr_dyn_obj_get(current, key->data, key->len)) return true;
-    }
-    return false;
+    return scr_dyn_property_owner(v, key->data, key->len) != NULL;
   }
   if (v->kind == SCR_DYN_FUNC) {
+    if (scr_dyn_property_owner(v, key->data, key->len)) return true;
     ScrDyn *descriptor = scr_dyn_own_descriptor(v, key);
     bool present = descriptor && descriptor->kind != SCR_DYN_UNDEF;
     scr_dyn_release(descriptor);
@@ -4155,6 +4992,8 @@ bool scr_dyn_has_key(const ScrDyn *v, const ScrStr *key) {
   if (v->kind == SCR_DYN_ARR) {
     if (key->len == 6 && memcmp(key->data, "length", 6) == 0) return true;
     if (v->v.arr.properties && scr_dyn_obj_get(v->v.arr.properties, key->data, key->len)) return true;
+    const ScrDyn *prototype = v->prototype ? v->prototype : !v->null_proto && v != scr_builtin_array_prototype ? scr_builtin_array_prototype : NULL;
+    if (prototype && scr_dyn_has_key(prototype, key)) return true;
     if (key->len == 0 || key->len > 10) return false;
     size_t idx = 0;
     for (size_t i = 0; i < key->len; i++) {
@@ -4164,7 +5003,7 @@ bool scr_dyn_has_key(const ScrDyn *v, const ScrStr *key) {
       if (idx > (4294967294ULL - (size_t)(c - '0')) / 10) return false;
       idx = idx * 10 + (size_t)(c - '0');
     }
-    return idx < v->v.arr.len;
+    return scr_dyn_arr_has_index(v, idx);
   }
   if (v->kind == SCR_DYN_STR)
     return scr_dyn_canonical_own_index(key, (size_t)scr_str_utf16_len(v->v.str));
@@ -4192,9 +5031,16 @@ static void scr_dyn_object_key_set(ScrDyn *recv, ScrStr *key, ScrDyn *value, con
     }
   }
   if (!scr_dyn_entry(recv, key)) {
-    for (const ScrDyn *current = recv->prototype; current && current->kind == SCR_DYN_OBJ; current = current->prototype) {
-      ScrDynEntry *inherited = scr_dyn_entry((ScrDyn *)current, key);
-      if (!inherited) continue;
+    for (const ScrDyn *current = recv->prototype; current;) {
+      ScrDyn *table = current->kind == SCR_DYN_FUNC ? scr_dyn_fn_properties(current) : NULL;
+      const ScrDyn *object = table ? table : current;
+      if (object->kind != SCR_DYN_OBJ) { scr_dyn_release(table); break; }
+      ScrDynEntry *inherited = scr_dyn_entry((ScrDyn *)object, key);
+      if (!inherited) {
+        current = object->prototype;
+        scr_dyn_release(table);
+        continue;
+      }
       if (inherited->accessor && inherited->setter) {
         ScrDyn *args[] = {value};
         ScrDyn *setter = scr_dyn_retain(inherited->setter);
@@ -4203,13 +5049,16 @@ static void scr_dyn_object_key_set(ScrDyn *recv, ScrStr *key, ScrDyn *value, con
         scr_dyn_this_pop();
         scr_dyn_release(setter);
         scr_dyn_release(result);
+        scr_dyn_release(table);
         return;
       }
       if (inherited->accessor || !inherited->writable) {
         static const char message[] = "Cannot assign to read only property";
         scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
+        scr_dyn_release(table);
         return;
       }
+      scr_dyn_release(table);
       break;
     }
   }
@@ -4263,22 +5112,20 @@ void scr_dyn_key_set(ScrDyn *recv, ScrStr *key, ScrDyn *value) {
         return;
       }
       size_t length = (size_t)number;
-      if (length > recv->v.arr.len && recv->non_extensible) {
-        static const char message[] = "Cannot add property, object is not extensible";
-        scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
-        return;
-      }
-      if (length > recv->v.arr.len) {
-        static const char message[] = "Sparse array lengths are not supported yet";
+      if (length > recv->v.arr.len + 1000000) {
+        static const char message[] = "Checked array growth exceeds the native allocation limit";
         scr_throw_error_msg_code(SCR_ERR_ERROR, message, sizeof message - 1, "SC2020");
         return;
       }
-      if (length < recv->v.arr.len && recv->v.arr.sealed) {
-        static const char message[] = "Cannot delete non-configurable property";
-        scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
-        return;
+      while (recv->v.arr.len < length) scr_dyn_arr_push_hole(recv);
+      while (recv->v.arr.len > length) {
+        if (recv->v.arr.sealed && scr_dyn_arr_has_index(recv, recv->v.arr.len - 1)) {
+          static const char message[] = "Cannot delete non-configurable property";
+          scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
+          return;
+        }
+        scr_dyn_release(recv->v.arr.items[--recv->v.arr.len]);
       }
-      while (recv->v.arr.len > length) scr_dyn_release(recv->v.arr.items[--recv->v.arr.len]);
       return;
     }
     /* Canonical indexes extend the dense portion; other names live in the
@@ -4296,7 +5143,7 @@ void scr_dyn_key_set(ScrDyn *recv, ScrStr *key, ScrDyn *value) {
         scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
         return;
       }
-      if (recv->non_extensible && idx >= recv->v.arr.len) {
+      if (recv->non_extensible && !scr_dyn_arr_has_index(recv, idx)) {
         static const char message[] = "Cannot add property, object is not extensible";
         scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
         return;
@@ -4307,10 +5154,11 @@ void scr_dyn_key_set(ScrDyn *recv, ScrStr *key, ScrDyn *value) {
         return;
       }
       while (recv->v.arr.len <= idx) {
-        scr_dyn_arr_push(recv, scr_dyn_retain(scr_dyn_undefined()));
+        scr_dyn_arr_push_hole(recv);
       }
       ScrDyn *old = recv->v.arr.items[idx];
       recv->v.arr.items[idx] = scr_dyn_retain(value);
+      if (recv->v.arr.presence) recv->v.arr.presence[idx] = 1;
       scr_dyn_release(old);
       return;
     }
@@ -5151,6 +5999,14 @@ static void scr_json_delete_member(ScrDyn *object, const ScrStr *key) {
 void scr_dyn_key_delete(ScrDyn *recv, const ScrStr *key, bool strict) {
   if (scr_dyn_class_reflection_fence(recv)) return;
   if (recv->kind == SCR_DYN_PROXY) { scr_dyn_proxy_delete(recv, key); return; }
+  if (recv->kind == SCR_DYN_TYPED_REF && recv->v.typed_ref.commit &&
+      !strncmp(recv->v.typed_ref.type_key, "record:", 7)) {
+    ScrDyn *materialized = scr_dyn_typed_ref_materialize(recv);
+    if (!scr_exc_pending()) scr_dyn_key_delete(materialized, key, strict);
+    if (!scr_exc_pending()) scr_dyn_typed_ref_commit(recv);
+    scr_dyn_release(materialized);
+    return;
+  }
   if (recv->kind == SCR_DYN_FUNC) {
     if (scr_dyn_fn_property_fence(key)) return;
     ScrDyn *table = scr_dyn_fn_properties(recv);
@@ -5171,6 +6027,27 @@ void scr_dyn_key_delete(ScrDyn *recv, const ScrStr *key, bool strict) {
     scr_error_sync_cause(recv, key);
     return;
   }
+  if (recv->kind == SCR_DYN_ARR && scr_dyn_canonical_own_index(key, recv->v.arr.len)) {
+    size_t index = 0;
+    for (size_t i = 0; i < key->len; i++) index = index * 10 + (size_t)(key->data[i] - '0');
+    if (!scr_dyn_arr_has_index(recv, index)) return;
+    if (recv->v.arr.sealed) {
+      if (strict) {
+        static const char message[] = "Cannot delete non-configurable property";
+        scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
+      }
+      return;
+    }
+    if (!recv->v.arr.presence) {
+      recv->v.arr.presence = malloc(recv->v.arr.cap);
+      if (!recv->v.arr.presence) scr_json_oom();
+      memset(recv->v.arr.presence, 1, recv->v.arr.len);
+    }
+    recv->v.arr.presence[index] = 0;
+    scr_dyn_release(recv->v.arr.items[index]);
+    recv->v.arr.items[index] = scr_dyn_retain(scr_dyn_undefined());
+    return;
+  }
   if (recv->kind == SCR_DYN_ARR && recv->v.arr.properties &&
       scr_dyn_obj_get(recv->v.arr.properties, key->data, key->len)) {
     scr_dyn_key_delete(recv->v.arr.properties, key, strict);
@@ -5242,6 +6119,7 @@ static ScrDyn *scr_json_revive(ScrDyn *holder, const ScrStr *key,
 ScrDyn *scr_json_parse_reviver(ScrStr *text, const ScrDyn *reviver) {
   ScrDyn *parsed = scr_json_parse(text);
   if (!parsed) return NULL; /* No callback runs on invalid input. */
+  if (reviver->kind != SCR_DYN_FUNC) return parsed;
   ScrDyn *holder = scr_dyn_new_obj();
   scr_dyn_obj_set(holder, "", 0, parsed);
   ScrStr *key = scr_str_new("", 0);
@@ -5273,7 +6151,7 @@ static ScrDyn *scr_json_replace(const ScrDyn *holder, const ScrStr *key, const S
   ScrDyn *view = value->kind == SCR_DYN_TYPED_REF ? scr_dyn_typed_ref_materialize(value) : NULL;
   const ScrDyn *inspected = view ? view : value;
   if (scr_exc_pending()) { scr_dyn_release(view); scr_dyn_release(value); return NULL; }
-  if (inspected->kind == SCR_DYN_HANDLE && inspected->v.handle.tag == SCR_DYNH_DATE) {
+  if (inspected->kind == SCR_DYN_HANDLE && (inspected->v.handle.tag == SCR_DYNH_DATE || inspected->v.handle.tag == SCR_DYNH_URL)) {
     const ScrDynHandleOps *ops = scr_dyn_handle_ops_of(inspected);
     ScrDyn *converted = ops->invoke(inspected->v.handle.ptr, value, "toJSON", NULL, 0, "toJSON");
     scr_dyn_release(value);
@@ -5461,7 +6339,7 @@ bool scr_dyn_strict_eq(const ScrDyn *a, const ScrDyn *b) {
     return a->v.handle.tag == b->v.handle.tag && a->v.handle.ptr == b->v.handle.ptr;
   case SCR_DYN_PROMISE:
     /* And the PROMISE: one promise crossing twice is one JS value. */
-    return a->v.promise == b->v.promise;
+    return a->v.promise == b->v.promise || (scr_dyn_promise_identity_fn && scr_dyn_promise_identity_fn(a->v.promise, b->v.promise));
   case SCR_DYN_JSVAL:
     /* Identity is the ENGINE VALUE, not the box or even the cell: two
      * wraps of one engine value compare ===-equal (the engine's own
@@ -5476,6 +6354,36 @@ bool scr_dyn_strict_eq(const ScrDyn *a, const ScrDyn *b) {
   }
 }
 
+bool scr_dyn_abstract_eq(const ScrDyn *a, const ScrDyn *b) {
+  if (a->kind == b->kind) return scr_dyn_strict_eq(a, b);
+  bool an = a->kind == SCR_DYN_NULL || a->kind == SCR_DYN_UNDEF;
+  bool bn = b->kind == SCR_DYN_NULL || b->kind == SCR_DYN_UNDEF;
+  if (an || bn) return an && bn;
+  if (a->kind == SCR_DYN_BOOL || b->kind == SCR_DYN_BOOL) {
+    ScrDyn *numeric = scr_dyn_new_num(a->kind == SCR_DYN_BOOL ? (a->v.b ? 1 : 0) : (b->v.b ? 1 : 0));
+    bool equal = a->kind == SCR_DYN_BOOL ? scr_dyn_abstract_eq(numeric, b) : scr_dyn_abstract_eq(a, numeric);
+    scr_dyn_release(numeric);
+    return equal;
+  }
+  if (scr_dyn_to_primitive_result_is_object(a) || scr_dyn_to_primitive_result_is_object(b)) {
+    if (scr_dyn_to_primitive_result_is_object(a) && scr_dyn_to_primitive_result_is_object(b)) return scr_dyn_strict_eq(a, b);
+    const ScrDyn *object = scr_dyn_to_primitive_result_is_object(a) ? a : b;
+    ScrDyn *primitive = scr_dyn_add_primitive(object);
+    bool equal = primitive && (object == a ? scr_dyn_abstract_eq(primitive, b) : scr_dyn_abstract_eq(a, primitive));
+    scr_dyn_release(primitive);
+    return equal;
+  }
+  if (a->kind == SCR_DYN_SYMBOL || b->kind == SCR_DYN_SYMBOL) return false;
+  if (a->kind == SCR_DYN_BIGINT || b->kind == SCR_DYN_BIGINT) {
+    const ScrDyn *integer = a->kind == SCR_DYN_BIGINT ? a : b;
+    const ScrDyn *other = integer == a ? b : a;
+    return other->kind == SCR_DYN_STR ? scr_bigint_eq_string(integer->v.bigint, other->v.str)
+      : other->kind == SCR_DYN_NUM && scr_bigint_cmp_number(integer->v.bigint, other->v.num) == 0;
+  }
+  double left, right;
+  return scr_dyn_number_coerce_js(a, &left) && scr_dyn_number_coerce_js(b, &right) && left == right;
+}
+
 static SCR_TL ScrDyn *scr_function_constructors[4];
 static SCR_TL bool scr_function_constructors_registered;
 
@@ -5511,6 +6419,8 @@ static ScrDyn *scr_function_constructor(uint32_t kind) {
 /* Keyed read on a FUNC node (see scr_runtime.h): own props first, then
  * the function-instance built-ins name/length. +1 or NULL. */
 ScrDyn *scr_dyn_fn_get(const ScrDyn *d, const char *key, size_t key_len) {
+  if (d->v.fn.class_obj && d->v.fn.class_obj->static_data && !d->v.fn.clo->props)
+    d->v.fn.clo->props = scr_box_retain(d->v.fn.class_obj->static_data);
   if (!d->v.fn.class_obj && key_len == 9 && !memcmp(key, "prototype", 9) && !d->v.fn.clo->props) {
     if (d->v.fn.clo->function_kind & 1) {
       static const char message[] = "Native generator function prototypes have no lowering";
@@ -5551,7 +6461,8 @@ ScrDyn *scr_dyn_fn_get(const ScrDyn *d, const char *key, size_t key_len) {
   if (key_len == 6 && memcmp(key, "length", 6) == 0) {
     return scr_dyn_new_num((double)d->v.fn.arity);
   }
-  if (d->v.fn.class_obj) {
+  if (key_len == 5 && memcmp(key, "apply", 5) == 0) return scr_dyn_function_apply();
+  if (d->v.fn.class_obj && !d->v.fn.class_obj->static_data) {
     static const char message[] = "scriptc: class properties through unknown other than name and length are not supported";
     scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
   }
@@ -5567,6 +6478,12 @@ ScrDyn *scr_dyn_fn_get(const ScrDyn *d, const char *key, size_t key_len) {
 
 void scr_sc_validate_options(const ScrDyn *options) {
   if (options == NULL || options->kind == SCR_DYN_UNDEF || options->kind == SCR_DYN_NULL) return;
+  if (options->kind == SCR_DYN_TYPED_REF) {
+    ScrDyn *view = scr_dyn_typed_ref_materialize(options);
+    if (view && !scr_exc_pending()) scr_sc_validate_options(view);
+    scr_dyn_release(view);
+    return;
+  }
   /* An engine-held options bag IS a dictionary to Node — the "cannot be
    * converted" TypeError would be a wrong claim. Loud fence. */
   if (options->kind == SCR_DYN_JSVAL) {
@@ -5581,10 +6498,14 @@ void scr_sc_validate_options(const ScrDyn *options) {
   }
   ScrDyn *tr = scr_dyn_obj_get(options, "transfer", 8); /* borrowed */
   if (tr == NULL || tr->kind == SCR_DYN_UNDEF) return;
+  ScrDyn *transferView = tr->kind == SCR_DYN_TYPED_REF ? scr_dyn_typed_ref_materialize(tr) : NULL;
+  if (scr_exc_pending()) { scr_dyn_release(transferView); return; }
+  if (transferView) tr = transferView;
   if (tr->kind != SCR_DYN_ARR) {
     static const char msg[] =
         "Failed to execute 'structuredClone': transfer in Options can not be converted to sequence.";
     scr_throw_error_msg_code(SCR_ERR_TYPE, msg, sizeof msg - 1, "ERR_INVALID_ARG_TYPE");
+    scr_dyn_release(transferView);
     return;
   }
   if (tr->v.arr.len > 0) {
@@ -5592,6 +6513,7 @@ void scr_sc_validate_options(const ScrDyn *options) {
      * a non-transferable list member. */
     scr_throw_domex("DataCloneError", "Found invalid value in transferList.");
   }
+  scr_dyn_release(transferView);
 }
 
 /* The parent chain rides the C stack: a revisit is a cycle. */
@@ -5651,6 +6573,7 @@ static ScrDyn *scr_sc_clone(const ScrDyn *v, const ScrScParent *up) {
     if (v->kind == SCR_DYN_ARR) {
       ScrDyn *out = scr_dyn_new_arr();
       for (size_t i = 0; i < v->v.arr.len; i++) {
+        if (!scr_dyn_arr_has_index(v, i)) { scr_dyn_arr_push_hole(out); continue; }
         ScrDyn *c = scr_sc_clone(v->v.arr.items[i], &self);
         if (c == NULL) { /* threw */
           scr_dyn_release(out);
@@ -5745,11 +6668,21 @@ bool scr_dyn_err_instanceof(const ScrDyn *d, double kind) {
 
 static ScrDyn *scr_dyn_obj_read_receiver(const ScrDyn *d, const char *key, size_t key_len, const ScrDyn *receiver) {
   for (const ScrDyn *current = d; current; current = current->prototype) {
+    if (current == scr_builtin_object_prototype) {
+      scr_dyn_class_reflection_fence(current);
+      return NULL;
+    }
+    if (current->kind == SCR_DYN_FUNC) {
+      ScrDyn *table = scr_dyn_fn_properties(current);
+      ScrDyn *result = scr_dyn_obj_read_receiver(table, key, key_len, receiver);
+      scr_dyn_release(table);
+      return result;
+    }
     if (current->kind == SCR_DYN_ARR) {
       if (key_len == 6 && memcmp(key, "length", 6) == 0) return scr_dyn_new_num((double)current->v.arr.len);
       double index;
-      if (scr_dyn_key_is_index(key, key_len, &index) && index < (double)current->v.arr.len)
-        return scr_dyn_arr_at(current, index);
+      if (scr_dyn_key_is_index(key, key_len, &index) && scr_dyn_arr_has_index(current, (size_t)index))
+        return scr_dyn_retain(current->v.arr.items[(size_t)index]);
       if (current->v.arr.properties && scr_dyn_obj_get(current->v.arr.properties, key, key_len))
         return scr_dyn_obj_read_receiver(current->v.arr.properties, key, key_len, receiver);
       continue;
@@ -5793,10 +6726,229 @@ static ScrDyn *scr_dyn_obj_read_receiver(const ScrDyn *d, const char *key, size_
   return scr_dyn_retain(scr_dyn_undefined());
 }
 
+static SCR_TL ScrDyn *scr_function_apply_value;
+
+static void scr_function_apply_cleanup(void) {
+  scr_dyn_release(scr_function_apply_value);
+  scr_function_apply_value = NULL;
+}
+
+ScrDyn *scr_dyn_apply_array_like(const ScrDyn *target, const ScrDyn *receiver, const ScrDyn *arguments, const char *what) {
+  ScrDyn *list = scr_dyn_new_arr();
+  if (arguments && arguments->kind != SCR_DYN_UNDEF && arguments->kind != SCR_DYN_NULL) {
+    if (!scr_iterator_object(arguments)) {
+      static const char message[] = "CreateListFromArrayLike called on non-object";
+      scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
+    } else {
+      ScrDyn *length = scr_iterator_read(arguments, "length", 6);
+      double count = 0;
+      bool ok = length && scr_dyn_number_coerce_js(length, &count);
+      scr_dyn_release(length);
+      if (ok && count > 1000000) {
+        static const char message[] = "Function.prototype.apply exceeds the native argument limit";
+        scr_throw_error_msg_code(SCR_ERR_ERROR, message, sizeof message - 1, "SC2020");
+      } else if (ok) for (size_t i = 0; (double)i < floor(count); i++) {
+        char key[32];
+        int size = snprintf(key, sizeof key, "%zu", i);
+        ScrDyn *value = scr_iterator_read(arguments, key, (size_t)size);
+        if (!value) break;
+        scr_dyn_arr_push(list, value);
+      }
+    }
+  }
+  ScrDyn *result = NULL;
+  if (!scr_exc_pending()) {
+    scr_dyn_this_push_dyn(receiver);
+    result = scr_dyn_call(target, list->v.arr.items, list->v.arr.len, what);
+    scr_dyn_this_pop();
+  }
+  scr_dyn_release(list);
+  return result;
+}
+
+static ScrDyn *scr_function_apply_call(ScrClosure *closure, ScrDyn *const *args, size_t argc) {
+  (void)closure;
+  ScrDyn *receiver = scr_dyn_this_get();
+  if (receiver->kind != SCR_DYN_FUNC) {
+    scr_dyn_release(receiver);
+    static const char message[] = "Function.prototype.apply was called on a non-callable value";
+    scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
+    return NULL;
+  }
+  ScrDyn *result = scr_dyn_apply_array_like(receiver, argc ? args[0] : scr_dyn_undefined(),
+    argc > 1 ? args[1] : scr_dyn_undefined(), "Function.prototype.apply");
+  scr_dyn_release(receiver);
+  return result;
+}
+
+ScrDyn *scr_dyn_function_apply(void) {
+  if (!scr_function_apply_value) {
+    scr_function_apply_value = scr_dyn_new_func(scr_closure_new(NULL, 0), scr_function_apply_call,
+      2, "native:Function.prototype.apply", "apply");
+    scr_atexit(scr_function_apply_cleanup);
+  }
+  return scr_dyn_retain(scr_function_apply_value);
+}
+
 ScrDyn *scr_dyn_obj_read(const ScrDyn *d, const char *key, size_t key_len) {
+  if (d->kind == SCR_DYN_PROXY) {
+    ScrStr *name = scr_str_new(key, key_len);
+    ScrDyn *value = scr_dyn_proxy_get(d, name);
+    scr_str_release(name);
+    return value;
+  }
   return scr_dyn_obj_read_receiver(d, key, key_len, d);
 }
 
+/* Compiler-owned class property tables use their native instance as the
+ * receiver of inherited accessors, retaining field updates on that instance. */
+ScrDyn *scr_dyn_bag_get(ScrDyn *bag, ScrStr *key, ScrDyn *receiver) {
+  return scr_dyn_obj_read_receiver(bag, key->data, key->len, receiver);
+}
+
+void scr_dyn_bag_set(ScrDyn *bag, ScrStr *key, ScrDyn *value, ScrDyn *receiver) {
+  scr_dyn_object_key_set(bag, key, value, receiver);
+}
+
+/* Reflect uses OrdinaryGet/OrdinarySet with an independently supplied
+ * receiver. Failed descriptor writes return false; user callbacks still
+ * propagate their exceptions. Keys are converted once before dispatch. */
+ScrDyn *scr_dyn_reflect_get(ScrDyn *target, ScrDyn *raw_key, ScrDyn *receiver) {
+  if (!scr_dyn_to_primitive_result_is_object(target)) {
+    static const char message[] = "Reflect.get called on non-object";
+    scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
+    return NULL;
+  }
+  ScrDyn *key = scr_dyn_property_key_value(raw_key);
+  if (!key) return NULL;
+  ScrDyn *result = NULL;
+  if (target->kind == SCR_DYN_TYPED_REF) {
+    ScrDyn *view = scr_dyn_typed_ref_materialize(target);
+    if (!scr_exc_pending()) result = scr_dyn_reflect_get(view, key, receiver);
+    scr_dyn_release(view);
+  } else if (key->kind == SCR_DYN_SYMBOL) {
+    ScrDyn *symbols = scr_dyn_symbol_receiver(target);
+    ScrDynEntry *entry = symbols ? scr_dyn_symbol_entry(symbols, key, false) : NULL;
+    if (entry && entry->accessor && entry->getter) {
+      ScrDyn *getter = scr_dyn_retain(entry->getter);
+      scr_dyn_this_push_dyn(receiver);
+      result = scr_dyn_call(getter, NULL, 0, "getter");
+      scr_dyn_this_pop();
+      scr_dyn_release(getter);
+    } else result = scr_dyn_symbol_key_get(target, key, false);
+    scr_dyn_release(symbols);
+  } else if (target->kind == SCR_DYN_PROXY) result = scr_dyn_proxy_get_receiver(target, key->v.str, receiver);
+  else result = scr_dyn_obj_read_receiver(target, key->v.str->data, key->v.str->len, receiver);
+  scr_dyn_release(key);
+  return result;
+}
+
+bool scr_dyn_reflect_define(ScrDyn *receiver, ScrDyn *raw_key, ScrDyn *value) {
+  if (!scr_dyn_to_primitive_result_is_object(receiver)) return false;
+  ScrDyn *key = scr_dyn_property_key_value(raw_key);
+  if (!key) return false;
+  bool ok = false;
+  if (receiver->kind == SCR_DYN_TYPED_REF) {
+    ScrDyn *view = scr_dyn_typed_ref_materialize(receiver);
+    if (!scr_exc_pending()) ok = scr_dyn_reflect_define(view, key, value);
+    if (ok) scr_dyn_typed_ref_commit(receiver);
+    scr_dyn_release(view);
+  } else if (receiver->kind == SCR_DYN_PROXY) {
+    scr_dyn_proxy_unsupported("Reflect.set receiver definition");
+  } else if (receiver->kind == SCR_DYN_FUNC) {
+    ScrDyn *table = scr_dyn_fn_properties(receiver);
+    ok = scr_dyn_reflect_define(table, key, value);
+    scr_dyn_release(table);
+  } else {
+    ScrDyn *symbols = key->kind == SCR_DYN_SYMBOL ? scr_dyn_symbol_receiver(receiver) : NULL;
+    ScrDynEntry *entry = key->kind == SCR_DYN_SYMBOL ? (symbols ? scr_dyn_symbol_entry(symbols, key, true) : NULL)
+      : receiver->kind == SCR_DYN_OBJ ? scr_dyn_entry(receiver, key->v.str)
+      : receiver->kind == SCR_DYN_ARR && receiver->v.arr.properties ? scr_dyn_entry(receiver->v.arr.properties, key->v.str) : NULL;
+    if (!(entry && (entry->accessor || !entry->writable)) && !(receiver->non_extensible && !scr_dyn_has_own_computed(receiver, key))) {
+      if (entry) {
+        ScrDyn *old = entry->value;
+        entry->value = scr_dyn_retain(value);
+        scr_dyn_release(old);
+        ok = true;
+      } else if (key->kind == SCR_DYN_SYMBOL && symbols) {
+        ScrDyn *descriptor = scr_dyn_new_obj();
+        scr_dyn_obj_set(descriptor, "value", 5, scr_dyn_retain(value));
+        scr_dyn_obj_set(descriptor, "writable", 8, scr_dyn_new_bool(true));
+        scr_dyn_obj_set(descriptor, "enumerable", 10, scr_dyn_new_bool(true));
+        scr_dyn_obj_set(descriptor, "configurable", 12, scr_dyn_new_bool(true));
+        ScrDyn *defined = scr_dyn_define_symbol(receiver, key, descriptor);
+        scr_dyn_release(defined);
+        scr_dyn_release(descriptor);
+        ok = !scr_exc_pending();
+      } else if (receiver->kind == SCR_DYN_OBJ) {
+        scr_dyn_obj_set(receiver, key->v.str->data, key->v.str->len, scr_dyn_retain(value));
+        ok = true;
+      } else if (receiver->kind == SCR_DYN_ARR) {
+        if (!receiver->v.arr.frozen) {
+          scr_dyn_key_set(receiver, key->v.str, value);
+          ok = !scr_exc_pending();
+        }
+      }
+    }
+    scr_dyn_release(symbols);
+  }
+  scr_dyn_release(key);
+  return ok && !scr_exc_pending();
+}
+
+bool scr_dyn_reflect_set(ScrDyn *target, ScrDyn *raw_key, ScrDyn *value, ScrDyn *receiver) {
+  if (!scr_dyn_to_primitive_result_is_object(target)) {
+    static const char message[] = "Reflect.set called on non-object";
+    scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
+    return false;
+  }
+  ScrDyn *key = scr_dyn_property_key_value(raw_key);
+  if (!key) return false;
+  bool ok = false;
+  if (target->kind == SCR_DYN_TYPED_REF) {
+    ScrDyn *view = scr_dyn_typed_ref_materialize(target);
+    if (!scr_exc_pending()) ok = scr_dyn_reflect_set(view, key, value, receiver);
+    scr_dyn_release(view);
+  } else if (target->kind == SCR_DYN_PROXY) {
+    ScrDyn *trap = scr_dyn_proxy_trap(target, "set");
+    if (!scr_exc_pending() && !trap) ok = scr_dyn_reflect_set(target->v.proxy.target, key, value, receiver);
+    else if (trap) {
+      ScrDyn *args[] = {target->v.proxy.target, key, value, receiver};
+      ScrDyn *result = scr_dyn_proxy_call(target, trap, args, 4);
+      ok = result && scr_dyn_truthy(result);
+      scr_dyn_release(result);
+      ScrDynEntry *entry = key->kind == SCR_DYN_STR ? scr_dyn_entry(target->v.proxy.target, key->v.str) : NULL;
+      if (ok && entry && !entry->configurable && ((entry->accessor && !entry->setter) || (!entry->accessor && !entry->writable && !scr_dyn_property_same_value(entry->value, value)))) scr_dyn_proxy_invariant();
+    }
+  } else if (target->kind == SCR_DYN_FUNC) {
+    ScrDyn *table = scr_dyn_fn_properties(target);
+    ok = scr_dyn_reflect_set(table, key, value, receiver);
+    scr_dyn_release(table);
+  } else {
+    ScrDyn *symbols = key->kind == SCR_DYN_SYMBOL ? scr_dyn_symbol_receiver(target) : NULL;
+    ScrDynEntry *entry = symbols ? scr_dyn_symbol_entry(symbols, key, false) : NULL;
+    if (key->kind == SCR_DYN_STR) for (ScrDyn *current = target; current; current = current->prototype) {
+      if (current->kind == SCR_DYN_OBJ) entry = scr_dyn_entry(current, key->v.str);
+      else if (current->kind == SCR_DYN_ARR && current->v.arr.properties) entry = scr_dyn_entry(current->v.arr.properties, key->v.str);
+      if (entry) break;
+    }
+    if (entry && entry->accessor) {
+      if (entry->setter) {
+        ScrDyn *setter = scr_dyn_retain(entry->setter);
+        scr_dyn_this_push_dyn(receiver);
+        ScrDyn *result = scr_dyn_call(setter, &value, 1, "setter");
+        scr_dyn_this_pop();
+        scr_dyn_release(result);
+        scr_dyn_release(setter);
+        ok = !scr_exc_pending();
+      }
+    } else if (!entry || entry->writable) ok = scr_dyn_reflect_define(receiver, key, value);
+    scr_dyn_release(symbols);
+  }
+  scr_dyn_release(key);
+  return ok && !scr_exc_pending();
+}
+
 /* ── Object.keys/values/entries over the checked-dynamic tree ──────────────────────────
  * JS own-key order: array-index keys ascending first, then the rest in
  * insertion order. entries answers [key, value] pairs; values RETAIN
@@ -5864,6 +7016,13 @@ ScrDyn *scr_dyn_obj_own_keys(const ScrDyn *v) {
 }
 
 ScrDyn *scr_dyn_get_own_property_names(const ScrDyn *value) {
+  if (value->kind == SCR_DYN_TYPED_REF) {
+    ScrDyn *view = scr_dyn_typed_ref_materialize(value);
+    if (scr_exc_pending()) { scr_dyn_release(view); return NULL; }
+    ScrDyn *result = scr_dyn_get_own_property_names(view);
+    scr_dyn_release(view);
+    return result;
+  }
   if (value->kind == SCR_DYN_FUNC) {
     if (scr_dyn_class_reflection_fence(value)) return NULL;
     ScrDyn *table = scr_dyn_fn_properties(value);
@@ -5878,6 +7037,7 @@ ScrDyn *scr_dyn_get_own_property_names(const ScrDyn *value) {
                     value->kind == SCR_DYN_BYTES ? value->v.bytes->len :
                     (size_t)scr_str_utf16_len(value->v.str);
     for (size_t i = 0; i < length; i++) {
+      if (value->kind == SCR_DYN_ARR && !scr_dyn_arr_has_index(value, i)) continue;
       char name[24];
       int size = snprintf(name, sizeof name, "%zu", i);
       scr_dyn_arr_push(keys, scr_dyn_objwalk_key(name, (size_t)size));
@@ -5905,6 +7065,13 @@ ScrDyn *scr_dyn_get_own_property_names(const ScrDyn *value) {
 }
 
 ScrDyn *scr_dyn_get_own_property_symbols(const ScrDyn *value) {
+  if (value->kind == SCR_DYN_TYPED_REF) {
+    ScrDyn *view = scr_dyn_typed_ref_materialize(value);
+    if (scr_exc_pending()) { scr_dyn_release(view); return NULL; }
+    ScrDyn *result = scr_dyn_get_own_property_symbols(view);
+    scr_dyn_release(view);
+    return result;
+  }
   if (value->kind == SCR_DYN_NULL || value->kind == SCR_DYN_UNDEF) {
     static const char message[] = "Cannot convert undefined or null to object";
     scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
@@ -5920,13 +7087,20 @@ ScrDyn *scr_dyn_get_own_property_symbols(const ScrDyn *value) {
 }
 
 ScrDyn *scr_dyn_get_own_property_descriptors(ScrDyn *object) {
+  if (object->kind == SCR_DYN_TYPED_REF) {
+    ScrDyn *view = scr_dyn_typed_ref_materialize(object);
+    if (scr_exc_pending()) { scr_dyn_release(view); return NULL; }
+    ScrDyn *result = scr_dyn_get_own_property_descriptors(view);
+    scr_dyn_release(view);
+    return result;
+  }
   if (scr_dyn_class_reflection_fence(object)) return NULL;
   if (object->kind == SCR_DYN_UNDEF || object->kind == SCR_DYN_NULL) {
     static const char message[] = "Cannot convert undefined or null to object";
     scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
     return NULL;
   }
-  if (object->kind == SCR_DYN_PROXY || object->kind == SCR_DYN_TYPED_REF ||
+  if (object->kind == SCR_DYN_PROXY ||
       object->kind == SCR_DYN_JSVAL || object->kind == SCR_DYN_HANDLE) {
     static const char message[] = "Object.getOwnPropertyDescriptors on this value is not supported yet";
     scr_throw_error_msg(SCR_ERR_ERROR, message, sizeof message - 1);
@@ -5957,6 +7131,21 @@ ScrDyn *scr_dyn_get_own_property_descriptors(ScrDyn *object) {
   return result;
 }
 
+ScrDyn *scr_dyn_own_keys(const ScrDyn *value) {
+  if (!scr_dyn_to_primitive_result_is_object(value)) {
+    static const char message[] = "Reflect.ownKeys called on non-object";
+    scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
+    return NULL;
+  }
+  ScrDyn *names = scr_dyn_get_own_property_names(value);
+  if (!names) return NULL;
+  ScrDyn *symbols = scr_dyn_get_own_property_symbols(value);
+  if (!symbols) { scr_dyn_release(names); return NULL; }
+  for (size_t i = 0; i < symbols->v.arr.len; i++) scr_dyn_arr_push(names, scr_dyn_retain(symbols->v.arr.items[i]));
+  scr_dyn_release(symbols);
+  return names;
+}
+
 static void scr_dyn_objwalk_push(ScrDyn *out, ScrObjWalk mode, const char *key,
                                  size_t key_len, ScrDyn *value /* borrowed */) {
   switch (mode) {
@@ -6106,6 +7295,7 @@ static ScrDyn *scr_dyn_objwalk(const ScrDyn *v, ScrObjWalk mode) {
   if (v->kind == SCR_DYN_ARR || v->kind == SCR_DYN_BYTES) {
     size_t n = v->kind == SCR_DYN_ARR ? v->v.arr.len : v->v.bytes->len;
     for (size_t i = 0; i < n; i++) {
+      if (v->kind == SCR_DYN_ARR && !scr_dyn_arr_has_index(v, i)) continue;
       char key[24];
       int klen = snprintf(key, sizeof key, "%zu", i);
       ScrDyn *val = NULL;
@@ -6171,7 +7361,8 @@ ScrDyn *scr_dyn_obj_keys(const ScrDyn *v) { return scr_dyn_objwalk(v, SCR_OBJWAL
  * Non-enumerable own names shadow names farther up the chain. */
 ScrDyn *scr_dyn_for_in_keys(const ScrDyn *v) {
   if (scr_dyn_class_reflection_fence(v)) return NULL;
-  if (v->kind == SCR_DYN_TYPED_REF && scr_dyn_isl_is_array(v)) {
+  if (v->kind == SCR_DYN_TYPED_REF && (scr_dyn_isl_is_array(v) ||
+      !strncmp(v->v.typed_ref.type_key, "record:", 7))) {
     ScrDyn *view = scr_dyn_typed_ref_materialize(v);
     ScrDyn *keys = scr_exc_pending() ? NULL : scr_dyn_for_in_keys(view);
     scr_dyn_release(view);
@@ -6386,6 +7577,33 @@ ScrDyn *scr_dyn_copy_data_properties(ScrDyn *target, const ScrDyn *src) {
   return scr_exc_pending() ? NULL : scr_dyn_retain(target);
 }
 
+ScrDyn *scr_dyn_object_rest(const ScrDyn *source, const ScrDyn *excluded) {
+  ScrDyn *out = scr_dyn_new_obj();
+  ScrDyn *names = scr_dyn_get_own_property_names(source);
+  if (!names) { scr_dyn_release(out); return NULL; }
+  ScrDyn *symbols = scr_dyn_get_own_property_symbols(source);
+  if (!symbols) { scr_dyn_release(names); scr_dyn_release(out); return NULL; }
+  for (size_t i = 0; i < symbols->v.arr.len; i++) scr_dyn_arr_push(names, scr_dyn_retain(symbols->v.arr.items[i]));
+  scr_dyn_release(symbols);
+  for (size_t i = 0; i < names->v.arr.len && !scr_exc_pending(); i++) {
+    ScrDyn *key = names->v.arr.items[i];
+    bool skip = false;
+    for (size_t j = 0; j < excluded->v.arr.len; j++) {
+      if (scr_dyn_strict_eq(key, excluded->v.arr.items[j])) { skip = true; break; }
+    }
+    if (skip || !scr_dyn_key_probe_computed(source, key, 2)) continue;
+    ScrDyn *value = key->kind == SCR_DYN_SYMBOL ? scr_dyn_symbol_key_get(source, key, false) : scr_iterator_read(source, key->v.str->data, key->v.str->len);
+    if (!scr_exc_pending()) {
+      if (key->kind == SCR_DYN_SYMBOL) scr_dyn_symbol_key_set(out, key, value);
+      else scr_dyn_obj_set(out, key->v.str->data, key->v.str->len, scr_dyn_retain(value));
+    }
+    scr_dyn_release(value);
+  }
+  scr_dyn_release(names);
+  if (scr_exc_pending()) { scr_dyn_release(out); return NULL; }
+  return out;
+}
+
 /* Compiler-owned native class views retain every property and its flags,
  * including nonenumerable data, without invoking accessors. */
 ScrDyn *scr_dyn_copy_property_descriptors(ScrDyn *target, const ScrDyn *src) {
@@ -6401,6 +7619,19 @@ ScrDyn *scr_dyn_copy_property_descriptors(ScrDyn *target, const ScrDyn *src) {
     if (scr_exc_pending()) break;
   }
   scr_dyn_release(keys);
+  if (!scr_exc_pending()) {
+    ScrDyn *symbols = scr_dyn_get_own_property_symbols(src);
+    if (!symbols) return NULL;
+    for (size_t i = 0; i < symbols->v.arr.len; i++) {
+      ScrDyn *key = symbols->v.arr.items[i];
+      ScrDyn *descriptor = scr_dyn_get_own_property_descriptor((ScrDyn *)src, key);
+      ScrDyn *result = descriptor ? scr_dyn_define_property(target, key, descriptor) : NULL;
+      scr_dyn_release(descriptor);
+      scr_dyn_release(result);
+      if (scr_exc_pending()) break;
+    }
+    scr_dyn_release(symbols);
+  }
   return scr_exc_pending() ? NULL : scr_dyn_retain(target);
 }
 
@@ -6429,6 +7660,19 @@ void scr_dyn_pack_push_spread(ScrDyn *pack, const ScrDyn *src, const ScrStr *wha
  * Symbol(Symbol.iterator))". The compiler picks the variant by the
  * spread's syntactic position. MAY THROW (pending). Borrows src. */
 void scr_dyn_pack_push_spread_iter(ScrDyn *pack, const ScrDyn *src) {
+  if (src->kind == SCR_DYN_TYPED_REF) {
+    ScrDyn *view = scr_dyn_typed_ref_materialize(src);
+    if (!scr_exc_pending()) scr_dyn_pack_push_spread_iter(pack, view);
+    scr_dyn_release(view);
+    return;
+  }
+  if (src->kind == SCR_DYN_HANDLE && scr_dyn_handle_ops_of(src)->iter_pack) {
+    ScrDyn *items = scr_dyn_handle_ops_of(src)->iter_pack(src->v.handle.ptr);
+    if (!items) return;
+    scr_dyn_pack_push_spread_iter(pack, items);
+    scr_dyn_release(items);
+    return;
+  }
   if (src->kind == SCR_DYN_ARR || src->kind == SCR_DYN_BYTES ||
       src->kind == SCR_DYN_STR) {
     scr_dyn_arr_push_spread(pack, src, ""); /* iterable kinds never throw */
@@ -6470,6 +7714,10 @@ void scr_dyn_pack_push_spread_iter(ScrDyn *pack, const ScrDyn *src) {
  * ToObject TypeError first (Node throws before looking at sources), then
  * each source's own-member copy left to right, answering the target
  * retained (+1) — identity, like JS. */
+ScrDyn *scr_dyn_reflect_apply(ScrDyn *target, ScrDyn *receiver, ScrDyn *arguments_list) {
+  return scr_dyn_apply_array_like(target, receiver, arguments_list, "Reflect.apply");
+}
+
 ScrDyn *scr_dyn_assign_all(ScrDyn *target, const ScrDyn *sources) {
   if (target->kind == SCR_DYN_UNDEF || target->kind == SCR_DYN_NULL) {
     const char *m = "Cannot convert undefined or null to object";
@@ -6573,7 +7821,10 @@ bool scr_dyn_has_own(const ScrDyn *v, const ScrStr *key) {
   if (v->kind == SCR_DYN_ARR) {
     if (key->len == 6 && memcmp(key->data, "length", 6) == 0) return true;
     if (v->v.arr.properties && scr_dyn_obj_get(v->v.arr.properties, key->data, key->len)) return true;
-    return scr_dyn_canonical_own_index(key, v->v.arr.len);
+    if (!scr_dyn_canonical_own_index(key, v->v.arr.len)) return false;
+    size_t index = 0;
+    for (size_t i = 0; i < key->len; i++) index = index * 10 + (size_t)(key->data[i] - '0');
+    return scr_dyn_arr_has_index(v, index);
   }
   if (v->kind == SCR_DYN_STR) {
     if (key->len == 6 && memcmp(key->data, "length", 6) == 0) return true;
@@ -6598,6 +7849,12 @@ bool scr_dyn_has_own(const ScrDyn *v, const ScrStr *key) {
 
 bool scr_dyn_property_is_enumerable(const ScrDyn *value, const ScrStr *key) {
   if (scr_dyn_class_reflection_fence(value)) return false;
+  if (value->kind == SCR_DYN_TYPED_REF) {
+    ScrDyn *view = scr_dyn_typed_ref_materialize(value);
+    bool result = !scr_exc_pending() && scr_dyn_property_is_enumerable(view, key);
+    scr_dyn_release(view);
+    return result;
+  }
   if (value->kind == SCR_DYN_UNDEF || value->kind == SCR_DYN_NULL) {
     static const char message[] = "Cannot convert undefined or null to object";
     scr_throw_error_msg(SCR_ERR_TYPE, message, sizeof message - 1);
@@ -6608,7 +7865,7 @@ bool scr_dyn_property_is_enumerable(const ScrDyn *value, const ScrStr *key) {
   if (value->kind == SCR_DYN_STR)
     return scr_dyn_canonical_own_index(key, (size_t)scr_str_utf16_len(value->v.str));
   if (value->kind == SCR_DYN_ARR)
-    return scr_dyn_canonical_own_index(key, value->v.arr.len) ||
+    return (scr_dyn_canonical_own_index(key, value->v.arr.len) && scr_dyn_has_own(value, key)) ||
       (value->v.arr.properties && scr_dyn_obj_enumerable(value->v.arr.properties, key->data, key->len));
   if (value->kind == SCR_DYN_BYTES)
     return scr_dyn_canonical_own_index(key, value->v.bytes->len);
@@ -6641,6 +7898,7 @@ void scr_error_init_options(void *obj, int kind, const ScrDyn *message, const Sc
     return;
   }
   scr_error_init(obj, kind, text);
+  ((ScrError *)obj)->message_present = message && message->kind != SCR_DYN_UNDEF;
   scr_str_release(text);
   ScrDyn *view = options && options->kind == SCR_DYN_TYPED_REF
       ? scr_dyn_typed_ref_materialize(options) : NULL;
@@ -6673,7 +7931,15 @@ ScrError *scr_error_new_options(int kind, const ScrDyn *message, const ScrDyn *o
 
 ScrDyn *scr_error_cause(ScrError *e) {
   for (size_t i = 0; i < scr_errdyn_n; i++) {
-    if (scr_errdyn_cache[i].err == e) return scr_dyn_obj_read(scr_errdyn_cache[i].dyn, "cause", 5);
+    if (scr_errdyn_cache[i].err != e) continue;
+    ScrDyn *value = scr_errdyn_cache[i].dyn;
+    if (value->kind == SCR_DYN_TYPED_REF) {
+      ScrDyn *view = scr_dyn_typed_ref_materialize(value);
+      ScrDyn *cause = scr_dyn_obj_read(view, "cause", 5);
+      scr_dyn_release(view);
+      return cause;
+    }
+    return scr_dyn_obj_read(value, "cause", 5);
   }
   return e->error_cause ? scr_dyn_retain(e->error_cause) : scr_dyn_undefined();
 }
@@ -6693,6 +7959,12 @@ void scr_error_set_cause(ScrError *e, ScrDyn *value) {
   e->error_cause = replacement;
 }
 
+void scr_error_define_cause(ScrError *e, ScrDyn *value) {
+  scr_error_delete_cause(e);
+  scr_error_set_cause(e, value);
+}
+
+
 void scr_error_delete_cause(ScrError *e) {
   for (size_t i = 0; i < scr_errdyn_n; i++) {
     if (scr_errdyn_cache[i].err != e) continue;
@@ -7337,7 +8609,7 @@ typedef struct ScrWeakEntry {
 } ScrWeakEntry;
 
 struct ScrWeakMap { size_t rc; ScrWeakEntry *entries; bool is_set; };
-/* Weak observers borrow key identities. Values remain ordinary RC edges;
+/* Weak observers borrow key identities. Values are traced strong edges;
  * value-to-key cycles require explicit deletion or container disposal. */
 #define SCR_WEAK_BUCKETS 1024
 static SCR_TL ScrWeakEntry *scr_weak_entries[SCR_WEAK_BUCKETS];
@@ -7346,7 +8618,7 @@ static size_t scr_weak_bucket(void *key) {
   return ((bits >> 4) ^ (bits >> 14)) & (SCR_WEAK_BUCKETS - 1);
 }
 
-static void scr_weak_remove(ScrWeakEntry *entry) {
+static void scr_weak_remove_impl(ScrWeakEntry *entry, bool collected) {
   ScrWeakEntry **slot = &entry->owner->entries;
   while (*slot != entry) slot = &(*slot)->next;
   *slot = entry->next;
@@ -7356,7 +8628,22 @@ static void scr_weak_remove(ScrWeakEntry *entry) {
   ScrDyn *value = entry->value;
   free(entry);
   /* Unlink before release: releasing a value can dispose another key. */
-  scr_dyn_release(value);
+  if (!collected) scr_dyn_release(value);
+}
+
+static void scr_weak_remove(ScrWeakEntry *entry) {
+  scr_weak_remove_impl(entry, scr_cyc_hdr(entry->owner)->color == SCR_CYC_DOOMED);
+}
+
+static void scr_weak_map_trace(void *ptr, ScrTraceVisit visit, void *ctx) {
+  for (ScrWeakEntry *entry = ((ScrWeakMap *)ptr)->entries; entry; entry = entry->next)
+    visit(entry->value, ctx);
+}
+
+static void scr_weak_map_gcfree(void *ptr) {
+  ScrWeakMap *map = ptr;
+  while (map->entries) scr_weak_remove_impl(map->entries, true);
+  scr_cyc_free(map);
 }
 
 static void scr_weak_disposed(void *key) {
@@ -7375,10 +8662,11 @@ static void *scr_weak_map_retain(void *ptr) {
 
 static void scr_weak_map_release(void *ptr) {
   ScrWeakMap *map = ptr;
-  if (--map->rc) return;
+  if (--map->rc) { scr_cyc_on_release(map); return; }
+  scr_cyc_on_dead(map);
   scr_weak_dispose(map);
   while (map->entries) scr_weak_remove(map->entries);
-  free(map);
+  scr_cyc_free(map);
 }
 
 /* Return 1 for an observed identity, 0 for a primitive, and -1 for a
@@ -7399,9 +8687,16 @@ static int scr_weak_key(const ScrDyn *key, void **ptr, unsigned *kind) {
     *kind = key->v.fn.class_obj ? 3 : 2; return 1;
   case SCR_DYN_HANDLE:
     if (key->v.handle.tag != SCR_DYNH_ARRAY_BUFFER && key->v.handle.tag != SCR_DYNH_WEAK_MAP &&
-        key->v.handle.tag != SCR_DYNH_WEAK_SET && key->v.handle.tag != SCR_DYNH_STDIO) return -1;
+        key->v.handle.tag != SCR_DYNH_WEAK_SET && key->v.handle.tag != SCR_DYNH_STDIO &&
+        key->v.handle.tag != SCR_DYNH_FETCH_REQUEST && key->v.handle.tag != SCR_DYNH_FETCH_RESPONSE &&
+        key->v.handle.tag != SCR_DYNH_MAP && key->v.handle.tag != SCR_DYNH_SET) return -1;
     *ptr = key->v.handle.ptr; *kind = 4 + key->v.handle.tag; return 1;
-  case SCR_DYN_TYPED_REF: case SCR_DYN_PROMISE: case SCR_DYN_JSVAL:
+  case SCR_DYN_TYPED_REF:
+    if (!key->v.typed_ref.observed) return -1;
+    *ptr = key->v.typed_ref.ptr; *kind = 32; return 1;
+  case SCR_DYN_PROMISE:
+    *ptr = key->v.promise; *kind = 33; return 1;
+  case SCR_DYN_JSVAL:
     return -1;
   default: return 0;
   }
@@ -7533,7 +8828,7 @@ static ScrDyn *scr_weak_collection_new(ScrDyn *seed, bool is_set) {
   ScrDynHandleTag tag = is_set ? SCR_DYNH_WEAK_SET : SCR_DYNH_WEAK_MAP;
   scr_weak_dispose_hook = &scr_weak_disposed;
   scr_dyn_handle_install(tag, is_set ? &set_ops : &map_ops);
-  ScrWeakMap *map = calloc(1, sizeof *map);
+  ScrWeakMap *map = scr_cyc_alloc(sizeof *map, scr_weak_map_trace, scr_weak_map_gcfree);
   if (!map) scr_json_oom();
   map->rc = 1;
   map->is_set = is_set;
@@ -7720,12 +9015,15 @@ static ScrDyn *scr_native_set_invoke(void *ptr, ScrDyn *self, const char *method
   ScrMap *set = ptr;
   ScrDyn *value = argc ? args[0] : scr_dyn_undefined();
   if (strcmp(method, "add") == 0) {
-    scr_map_set_ref_f64(set, value, 1);
+    scr_map_dyn_set(set, value, NULL, true);
+    if (scr_exc_pending()) return NULL;
     return scr_dyn_retain(self);
   }
-  if (strcmp(method, "has") == 0) return scr_dyn_new_bool(scr_map_has_ref(set, value));
-  if (strcmp(method, "delete") == 0) return scr_dyn_new_bool(scr_map_delete_ref(set, value));
+  if (strcmp(method, "has") == 0) return scr_dyn_new_bool(scr_map_dyn_has(set, value, false));
+  if (strcmp(method, "delete") == 0) return scr_dyn_new_bool(scr_map_dyn_has(set, value, true));
   if (strcmp(method, "clear") == 0) { scr_map_clear(set); return scr_dyn_retain(scr_dyn_undefined()); }
+  if (strcmp(method, "values") == 0 || strcmp(method, "keys") == 0) return scr_native_collection_iterator(self, 0);
+  if (strcmp(method, "entries") == 0) return scr_native_collection_iterator(self, 2);
   if (strcmp(method, "forEach") == 0) {
     if (value->kind != SCR_DYN_FUNC &&
         !(value->kind == SCR_DYN_JSVAL && scr_dyn_isl_typeof_is(value, "function"))) {
@@ -7748,7 +9046,7 @@ static ScrDyn *scr_native_set_invoke(void *ptr, ScrDyn *self, const char *method
     scr_map_iter_enter(set);
     for (double i = 0; i < scr_map_iter_count(set); i++) {
       if (!scr_map_iter_live(set, i)) continue;
-      ScrDyn *entry = scr_map_iter_key_ref(set, i);
+      ScrDyn *entry = scr_map_dyn_key(set, i);
       ScrDyn *callback_args[] = {entry, entry, self};
       scr_dyn_this_push_dyn(this_arg);
       ScrDyn *result = scr_dyn_call(value, callback_args, 3, "callback");
@@ -7766,10 +9064,21 @@ static ScrDyn *scr_native_set_invoke(void *ptr, ScrDyn *self, const char *method
   return NULL;
 }
 
+static ScrDyn *scr_native_set_pack(void *ptr) {
+  ScrMap *set = ptr;
+  ScrDyn *values = scr_dyn_new_arr();
+  scr_map_iter_enter(set);
+  for (double i = 0; i < scr_map_iter_count(set); i++) {
+    if (scr_map_iter_live(set, i)) scr_dyn_arr_push(values, scr_map_dyn_key(set, i));
+  }
+  scr_map_iter_exit(set);
+  return values;
+}
+
 ScrDyn *scr_dyn_native_set(ScrMap *value) {
   static const ScrDynHandleOps ops = {
     "Set", &scr_map_retain_v, &scr_map_release_v, &scr_native_set_invoke,
-    &scr_native_set_get, &scr_weak_map_write, NULL, NULL,
+    &scr_native_set_get, &scr_weak_map_write, NULL, &scr_native_set_pack,
   };
   scr_dyn_handle_install(SCR_DYNH_SET, &ops);
   return scr_dyn_new_handle(value, SCR_DYNH_SET);
@@ -7818,16 +9127,44 @@ static ScrDyn *scr_native_map_invoke(void *ptr, ScrDyn *self, const char *method
   ScrMap *map = ptr;
   ScrDyn *key = argc ? args[0] : scr_dyn_undefined();
   if (strcmp(method, "set") == 0) {
-    scr_map_set_ref_ref(map, key, scr_dyn_retain(argc > 1 ? args[1] : scr_dyn_undefined()));
+    scr_map_dyn_set(map, key, argc > 1 ? args[1] : scr_dyn_undefined(), false);
+    if (scr_exc_pending()) return NULL;
     return scr_dyn_retain(self);
   }
   if (strcmp(method, "get") == 0) {
-    ScrDyn *value = scr_map_get_ref_ref(map, key);
-    return value ? value : scr_dyn_retain(scr_dyn_undefined());
+    return scr_map_dyn_get(map, key);
   }
-  if (strcmp(method, "has") == 0) return scr_dyn_new_bool(scr_map_has_ref(map, key));
-  if (strcmp(method, "delete") == 0) return scr_dyn_new_bool(scr_map_delete_ref(map, key));
+  if (strcmp(method, "has") == 0) return scr_dyn_new_bool(scr_map_dyn_has(map, key, false));
+  if (strcmp(method, "delete") == 0) return scr_dyn_new_bool(scr_map_dyn_has(map, key, true));
   if (strcmp(method, "clear") == 0) { scr_map_clear(map); return scr_dyn_retain(scr_dyn_undefined()); }
+  if (strcmp(method, "values") == 0) return scr_native_collection_iterator(self, 0);
+  if (strcmp(method, "keys") == 0) return scr_native_collection_iterator(self, 1);
+  if (strcmp(method, "entries") == 0) return scr_native_collection_iterator(self, 2);
+  if (strcmp(method, "forEach") == 0) {
+    if (key->kind != SCR_DYN_FUNC && !(key->kind == SCR_DYN_JSVAL && scr_dyn_isl_typeof_is(key, "function"))) {
+      /* Validate even when there are no entries to visit. */
+      ScrDyn *result = scr_dyn_call(key, NULL, 0, "callback");
+      scr_dyn_release(result);
+      return NULL;
+    }
+    ScrDyn *this_arg = argc > 1 ? args[1] : scr_dyn_undefined();
+    scr_map_iter_enter(map);
+    for (double i = 0; i < scr_map_iter_count(map); i++) {
+      if (!scr_map_iter_live(map, i)) continue;
+      ScrDyn *entry_key = scr_map_dyn_key(map, i);
+      ScrDyn *value = scr_map_dyn_value(map, i);
+      ScrDyn *callback_args[] = {value, entry_key, self};
+      scr_dyn_this_push_dyn(this_arg);
+      ScrDyn *result = scr_dyn_call(key, callback_args, 3, "callback");
+      scr_dyn_this_pop();
+      scr_dyn_release(entry_key);
+      scr_dyn_release(value);
+      scr_dyn_release(result);
+      if (scr_exc_pending()) break;
+    }
+    scr_map_iter_exit(map);
+    return scr_exc_pending() ? NULL : scr_dyn_retain(scr_dyn_undefined());
+  }
   (void)what;
   static const char message[] = "Native Map method has no lowering";
   scr_throw_error_msg_code(SCR_ERR_ERROR, message, sizeof message - 1, "SC2020");
@@ -7841,8 +9178,8 @@ static ScrDyn *scr_native_map_pack(void *ptr) {
   for (double i = 0; i < scr_map_iter_count(map); i++) {
     if (!scr_map_iter_live(map, i)) continue;
     ScrDyn *pair = scr_dyn_new_arr();
-    scr_dyn_arr_push(pair, scr_map_iter_key_ref(map, i));
-    scr_dyn_arr_push(pair, scr_map_iter_val_ref(map, i));
+    scr_dyn_arr_push(pair, scr_map_dyn_key(map, i));
+    scr_dyn_arr_push(pair, scr_map_dyn_value(map, i));
     scr_dyn_arr_push(entries, pair);
   }
   scr_map_iter_exit(map);
@@ -7852,7 +9189,7 @@ static ScrDyn *scr_native_map_pack(void *ptr) {
 ScrDyn *scr_dyn_native_map(ScrMap *value) {
   static const ScrDynHandleOps ops = {
     "Map", &scr_map_retain_v, &scr_map_release_v, &scr_native_map_invoke,
-    &scr_native_map_get, &scr_weak_map_write, NULL, NULL,
+    &scr_native_map_get, &scr_weak_map_write, NULL, &scr_native_map_pack,
   };
   scr_dyn_handle_install(SCR_DYNH_MAP, &ops);
   return scr_dyn_new_handle(value, SCR_DYNH_MAP);
@@ -7867,7 +9204,40 @@ ScrMap *scr_dyn_native_map_check(const ScrDyn *value, const ScrDynPath *path) {
   return scr_map_retain(value->v.handle.ptr);
 }
 
+bool scr_dyn_native_collection_is(const ScrDyn *value, int map, const char *type) {
+  if (!(map ? scr_dyn_native_map_is(value) : scr_dyn_native_set_is(value))) return false;
+  const ScrMap *storage = value->v.handle.ptr;
+  return type ? storage->dyn_ops && strcmp(storage->dyn_ops->type, type) == 0 : !storage->dyn_ops;
+}
+
+ScrMap *scr_dyn_native_collection_check(const ScrDyn *value, int map, const char *type, const ScrDynPath *path) {
+  if (!scr_dyn_native_collection_is(value, map, type)) {
+    scr_dyn_check_fail(path, type ? type : map ? "Map" : "Set", value);
+    return NULL;
+  }
+  return scr_map_retain(value->v.handle.ptr);
+}
+
 ScrStr *scr_dyn_to_string_method(const ScrDyn *d, const ScrStr *enc, const ScrStr *what) {
+  /* Object.create receivers must run their inherited formatter before the
+   * default object tag; Effect shard keys use it to produce distinct hashes. */
+  const bool object_method = d->kind == SCR_DYN_OBJ && scr_dyn_property_owner(d, "toString", 8);
+  if (d->kind == SCR_DYN_FUNC || object_method) {
+    ScrDyn *member = object_method ? scr_dyn_obj_read(d, "toString", 8) : scr_dyn_fn_get(d, "toString", 8);
+    if (scr_exc_pending()) { scr_dyn_release(member); return NULL; }
+    if (member && (object_method || member->kind != SCR_DYN_UNDEF)) {
+      scr_dyn_this_push_dyn(d);
+      ScrDyn *value = scr_dyn_call(member, NULL, 0, what->data);
+      scr_dyn_this_pop();
+      scr_dyn_release(member);
+      if (!value) return NULL;
+      ScrStr *result = value->kind == SCR_DYN_STR ? scr_str_retain(value->v.str) : NULL;
+      if (!result) scr_dyn_check_fail(NULL, "string", value);
+      scr_dyn_release(value);
+      return result;
+    }
+    scr_dyn_release(member);
+  }
   if (d->kind == SCR_DYN_OBJ && !scr_dyn_property_owner(d, "toString", 8) && !scr_dyn_has_object_prototype(d)) {
     ScrJsonBuf b;
     scr_jb_init(&b);
@@ -7926,3 +9296,88 @@ bool scr_dyn_is_frozen(const ScrDyn *value) {
   scr_throw_error_msg_code(SCR_ERR_ERROR, message, sizeof message - 1, "SC2020");
   return false;
 }
+
+double scr_buffer_byte_length_dyn(ScrDyn *value, ScrStr *encoding) {
+  if (value->kind == SCR_DYN_STR) return scr_bytes_byte_length_str(value->v.str, encoding);
+  if (value->kind == SCR_DYN_BYTES) return scr_bytes_byte_len(value->v.bytes);
+  if (scr_array_buffer_is(value)) return scr_bytes_byte_len(value->v.handle.ptr);
+  static const char message[] = "The string argument must be of type string or an instance of Buffer or ArrayBuffer";
+  scr_throw_error_msg_code(SCR_ERR_TYPE, message, sizeof message - 1, "ERR_INVALID_ARG_TYPE");
+  return 0;
+}
+
+/* Radix digit generation follows V8's DoubleToRadixStringView algorithm.
+ * Copyright 2012 the V8 project authors. BSD license in
+ * ../vendor/v8-number-radix/LICENSE. The decimal path retains Ryū. */
+ScrStr *scr_num_to_string_radix(double value, const ScrDyn *argument) {
+  double requested = 10;
+  if (argument && argument->kind != SCR_DYN_UNDEF &&
+      !scr_dyn_number_coerce_js(argument, &requested)) return NULL;
+  requested = isnan(requested) ? 0 : trunc(requested);
+  if (requested < 2 || requested > 36 || !isfinite(requested)) {
+    static const char message[] = "toString() radix argument must be between 2 and 36";
+    scr_throw_error_msg(SCR_ERR_RANGE, message, sizeof message - 1);
+    return NULL;
+  }
+  int radix = (int)requested;
+  if (radix == 10 || !isfinite(value) || value == 0) return scr_f64_to_scrstr(value);
+  static const char digits[] = "0123456789abcdefghijklmnopqrstuvwxyz";
+  char buffer[2200];
+  const size_t middle = sizeof buffer / 2;
+  size_t begin = middle, end = middle;
+  bool negative = value < 0;
+  value = fabs(value);
+  double integer = floor(value), fraction = value - integer;
+  double tolerance = 0.5 * (nextafter(value, INFINITY) - value);
+  if (tolerance <= 0) tolerance = nextafter(0, INFINITY);
+  if (fraction >= tolerance) {
+    buffer[end++] = '.';
+    do {
+      fraction *= radix;
+      tolerance *= radix;
+      int digit = (int)fraction;
+      buffer[end++] = digits[digit];
+      fraction -= digit;
+      if ((fraction > 0.5 || (fraction == 0.5 && (digit & 1))) && fraction + tolerance > 1) {
+        for (;;) {
+          end--;
+          if (end == middle) { integer += 1; break; }
+          char last = buffer[end];
+          digit = last > '9' ? last - 'a' + 10 : last - '0';
+          if (digit + 1 < radix) { buffer[end++] = digits[digit + 1]; break; }
+        }
+        break;
+      }
+    } while (fraction >= tolerance);
+  }
+  /* V8's Double::Exponent is the unbiased exponent minus 52. Beyond
+   * that precision boundary, trailing digits are unrepresented zeros. */
+  while (integer / radix >= 0x1p53) {
+    integer /= radix;
+    buffer[--begin] = '0';
+  }
+  do {
+    double remainder = fmod(integer, radix);
+    buffer[--begin] = digits[(int)remainder];
+    integer = (integer - remainder) / radix;
+  } while (integer > 0);
+  if (negative) buffer[--begin] = '-';
+  return scr_str_new(buffer + begin, end - begin);
+}
+
+ScrDyn *scr_caught_to_dyn(const ScrCaught *c) {
+  switch (c->kind) {
+  case SCR_EXC_F64: return scr_dyn_new_num(c->f64);
+  case SCR_EXC_BOOL: return scr_dyn_new_bool(c->b);
+  case SCR_EXC_STR: return scr_dyn_new_str((ScrStr *)c->payload);
+  case SCR_EXC_REF:
+  case SCR_EXC_PRIMITIVE_REF:
+    if (c->retain_fn == scr_dyn_retain_v) return scr_dyn_retain((ScrDyn *)c->payload);
+    return scr_dyn_new_obj();
+  case SCR_EXC_OBJ:
+    if (scr_error_is(c->payload)) return scr_dyn_from_error((const ScrError *)c->payload);
+    return scr_dyn_new_obj();
+  default:
+    return scr_dyn_new_obj();
+  }
+}