@scriptc/compiler 0.0.10 → 0.0.12

package/dist/frontend/lowering/lower-exprs.js

@@ -8,7 +8,7 @@ import * as ts from "../ts7/adapter.js";
 import { dirname } from "node:path";
 import { BOOL, CAUGHT, DYN, DYN_HANDLE_KINDS, F64, JSVAL, NULL_T, REF_TRUTHY_KINDS, REGEX, RUNTIME_ERROR_CLASSES, SEARCH_PARAMS_T, STRING, UNDEFINED_T, VOID, arrayOf, canAdaptDynFuncTo, canBoxFuncIntoDyn, canDynCheckTo, funcOf, isJsonSafeType, isUnitType, jsOpResultKind, shapeHasAccessorSlots, typeEquals, typeKey, unionFuncSetArmsOk } from "../../ir/nodes.js";
 import { cjsClassExprWholeExportOf, cjsExportAssignmentOf, cjsExportDiscardReason, isCjsExportTableLiteral, isCjsJsFile, isJsSourceFile, isModuleExportsAccess, isNodeEsmFile, locOf } from "../program.js";
-import { ARRAY_METHODS, builtinConstLit, builtinFenceHintOf, builtinModuleConstOf, builtinModuleFnOf, ISLAND_SURFACE, isChildSurfaceMember, MAP_METHODS, NARROW_FIRST, SET_METHODS, STR_METHODS, UNSUPPORTED_EXPR, sideEffectFreeOptionValue, stdlibGlobalNameOf } from "./surfaces.js";
+import { ARRAY_METHODS, builtinConstLit, builtinFenceHintOf, builtinModuleConstOf, builtinModulesArrayLit, builtinModuleFnOf, ISLAND_SURFACE, isChildSurfaceMember, MAP_METHODS, NARROW_FIRST, SET_METHODS, STR_METHODS, UNSUPPORTED_EXPR, sideEffectFreeOptionValue, stdlibGlobalNameOf } from "./surfaces.js";
 import { blockedBindingUseDiag, recordShapeMismatchDiag, requiresDynamicPackageDiag, unsupportedDiag } from "../../diagnostics/diagnostic.js";
 import { PoisonError, dynUndefinedExpr, jsFuncNameOf, neverTaintedJsType, nodeThrowExpr, own } from "./lowerer.js";
 import { lowerIndexMergeHelper, lowerNpmStaticSafeIndexRead, strCharsCall } from "./lower-containers.js";
@@ -83,7 +83,22 @@ function lowerExprInner(L, expr) {
     if (chainRecv)
         return { ...chainRecv, loc };
     if (ts.isNumericLiteral(expr)) {
-        return { kind: "numLit", value: Number(expr.text.replace(/_/g, "")), type: F64, loc };
+        const value = Number(expr.text.replace(/_/g, ""));
+        // Ask 4's representability input: a DECIMAL INTEGER source spelling
+        // that does not survive the trip through f64 (parse, format back,
+        // compare) rides the literal so the library integer-boundary check
+        // can refuse on the author's source text. `expr.text` is the
+        // scanner's COOKED value (already the nearest double), so the
+        // source spelling comes from the file text; numeric separators are
+        // spelling sugar and strip first. Round-tripping literals (every
+        // integer within ±(2^53−1)) and non-integer spellings carry
+        // nothing, so the IR is unchanged for programs that held their
+        // numbers.
+        const spelled = expr.getText().replace(/_/g, "");
+        if (/^\d+$/.test(spelled) && String(Number(spelled)) !== spelled) {
+            return { kind: "numLit", value: Number(spelled), spelling: spelled, type: F64, loc };
+        }
+        return { kind: "numLit", value, type: F64, loc };
     }
     if (expr.kind === ts.SyntaxKind.TrueKeyword) {
         return { kind: "boolLit", value: true, type: BOOL, loc };
@@ -207,9 +222,9 @@ function lowerExprInner(L, expr) {
             // A JS variable INITIALIZER whose BINDING registered as a
             // checked-dynamic module global (the typedef-annotated
             // doc-builder consts whose JSDoc types degraded — DYN slots):
-            // the island build could never land (no engine→DOM crossing
+            // the island build could never land (no engine→dyn crossing
             // exists), so the literal takes its own world's path instead —
-            // the DOM literal, or a static record the slot converts.
+            // the dyn literal, or a static record the slot converts.
             if (isJsSourceFile(expr.getSourceFile()) &&
                 ts.isVariableDeclaration(expr.parent) &&
                 expr.parent.initializer === expr &&
@@ -224,7 +239,7 @@ function lowerExprInner(L, expr) {
             // reference degraded to checker-`any` — the tsgo multi-file
             // value-as-type residue) is not an npm slot: when the literal's
             // OWN type maps statically, it builds that way — the binding's
-            // checked-dynamic slot takes the DOM conversion. Genuinely
+            // checked-dynamic slot takes the dyn conversion. Genuinely
             // island slots (npm .d.ts provenance, plain `any`) keep the
             // native build.
             if (ctxTs !== undefined && (ctxTs.flags & ts.TypeFlags.Any) === 0) {
@@ -259,13 +274,22 @@ function lowerExprInner(L, expr) {
             const argsWith = [];
             const getters = [];
             let spread = null;
-            // A MEMBER a JS file cannot lower or marshal (a generic function
-            // as a value, a signature with checked-dynamic parameters — the
-            // doc-builder public aggregate's degraded pieces): defer like a
-            // statement fence — the slot holds a host closure that THROWS the
-            // captured diagnostic when invoked, so building the aggregate
-            // compiles and only a CALL through the island stops the run.
-            const islandMemberFence = (diagsBefore, err, valueNode) => {
+            // A MEMBER a JS file cannot lower or marshal: defer like a
+            // statement fence, shaped by what the member IS. A FUNCTION-shaped
+            // member (a generic function as a value, a signature with
+            // checked-dynamic parameters — the doc-builder public aggregate's
+            // degraded pieces) becomes a host closure that THROWS the captured
+            // diagnostic when invoked — building the aggregate compiles and
+            // only a CALL through the island stops the run. A DATA-shaped
+            // member must NOT become a callable (the retired fence box's
+            // silent wrong answers: typeof said "function", downstream errors
+            // blamed the wrong thing — the withPlugins `plugins:` slot), so it
+            // defines through the engine's getter machinery instead: READING
+            // the member throws the diagnostic — the honest granularity, since
+            // using the value is exactly what cannot be answered. `getterName`
+            // null keeps the closure shape (function-shaped members, and the
+            // conditional-spread arms where getters cannot combine).
+            const islandMemberFence = (diagsBefore, err, valueNode, getterName = null) => {
                 if (!(err instanceof PoisonError) ||
                     !isJsSourceFile(expr.getSourceFile()) ||
                     L.diagSink !== null ||
@@ -295,8 +319,33 @@ function lowerExprInner(L, expr) {
                     loc: locOf(valueNode),
                 });
                 const fence = { kind: "closure", fnName, captures: [], type: funcOf([], VOID), loc: locOf(valueNode) };
+                if (getterName !== null) {
+                    getters.push({ name: getterName, fn: L.jsvalIn(fence, valueNode), loc: locOf(valueNode) });
+                    return null;
+                }
                 return L.jsvalIn(fence, valueNode);
             };
+            // The member's SHAPE decides the fence's granularity: syntactic
+            // functions and checker-callable values keep the call-time
+            // closure; everything else (call results, awaits, data reads —
+            // the withPlugins `plugins:` shape) fences at the READ.
+            const funcShapedMember = (p) => {
+                if (ts.isMethodDeclaration(p))
+                    return true;
+                const src = ts.isPropertyAssignment(p)
+                    ? p.initializer
+                    : ts.isShorthandPropertyAssignment(p)
+                        ? p.name
+                        : null;
+                if (!src || !ts.isExpression(src))
+                    return true; // unknown form: keep the closure shape
+                let inner = src;
+                while (ts.isParenthesizedExpression(inner))
+                    inner = inner.expression;
+                if (ts.isArrowFunction(inner) || ts.isFunctionExpression(inner))
+                    return true;
+                return L.checker.getCallSignatures(L.typeOf(src)).length > 0;
+            };
             const pushProp = (name, value, valueNode, into) => {
                 const diagsBefore = L.diags.length;
                 let marshaled;
@@ -304,7 +353,15 @@ function lowerExprInner(L, expr) {
                     marshaled = L.jsvalIn(value, valueNode);
                 }
                 catch (err) {
-                    marshaled = islandMemberFence(diagsBefore, err, valueNode);
+                    // A value that LOWERED but cannot cross (a promise, a class
+                    // instance): func-typed values keep the call-time closure;
+                    // data-shaped values fence at the read (the getter), unless a
+                    // conditional spread owns the literal (getters cannot combine).
+                    const asGetter = value.type.kind !== "func" && spread === null;
+                    const fence = islandMemberFence(diagsBefore, err, valueNode, asGetter ? name.text : null);
+                    if (fence === null)
+                        return; // registered as a fence getter — no data property
+                    marshaled = fence;
                 }
                 for (const args of into) {
                     args.push({
@@ -388,7 +445,11 @@ function lowerExprInner(L, expr) {
                                 : null;
                 }
                 catch (err) {
-                    value = islandMemberFence(valueDiagsBefore, err, prop);
+                    const nameText = name && (ts.isIdentifier(name) || ts.isStringLiteral(name)) ? name.text : null;
+                    const asGetter = nameText !== null && spread === null && !funcShapedMember(prop);
+                    value = islandMemberFence(valueDiagsBefore, err, prop, asGetter ? nameText : null);
+                    if (value === null)
+                        continue; // registered as a fence getter — no data property
                 }
                 if (value && name && (ts.isIdentifier(name) || ts.isStringLiteral(name))) {
                     pushProp(name, value, prop, [argsWithout, argsWith]);
@@ -479,7 +540,7 @@ function lowerExprInner(L, expr) {
         }
         // A checker-narrowed dyn read arrives as a VALIDATED extraction
         // (maybeNarrow's dynCheck bridge). typeof needs no extraction — the
-        // DOM kind table answers the question directly, and answers it even
+        // dyn kind table answers the question directly, and answers it even
         // where the flow type lied (the extraction would throw instead) —
         // so unwrap back to the dyn value and take the dyn.typeof path.
         if (operand.kind === "dynCheck" && operand.value.type.kind === "dyn") {
@@ -524,7 +585,7 @@ function lowerExprInner(L, expr) {
         if (operand.type.kind === "dyn") {
             // Bare typeof on a dyn value: the runtime's kind→string table
             // (null answers "object", boxed closures "function" — JS-exact
-            // for every DOM kind; "bigint"/"symbol" have no producers).
+            // for every dyn kind; "bigint"/"symbol" have no producers).
             return { kind: "libCall", fn: "dyn.typeof", args: [operand], type: STRING, loc };
         }
         L.unsupported("SC1090", expr, "typeof expressions on statically-typed values");
@@ -534,7 +595,7 @@ function lowerExprInner(L, expr) {
             return { kind: "selfRef", type: L.ctx.selfType, loc };
         }
         // `arguments` in a variadic JS function (the rest-marked form): the
-        // synthetic trailing DOM-array param — lambdaSignature marked the
+        // synthetic trailing dyn-array param — lambdaSignature marked the
         // type and lowerLambda declared the local.
         if (expr.text === "arguments" && L.ctx.argumentsLocal) {
             return { kind: "varRef", localId: L.ctx.argumentsLocal.id, type: DYN, loc };
@@ -603,7 +664,7 @@ function lowerExprInner(L, expr) {
             // optional/default/rest declarations pass the value fence first.
             L.noteEdge(sig.name);
             // dynRest slots stay out of the VALUE type's param list (fn.length
-            // semantics); the rest marker carries the trailing DOM-array ABI.
+            // semantics); the rest marker carries the trailing dyn-array ABI.
             const funcType = {
                 kind: "func",
                 params: sig.params.filter((p) => p.mode !== "dynRest").map((p) => p.type),
@@ -649,6 +710,11 @@ function lowerExprInner(L, expr) {
                 const c = builtinModuleConstOf(L, bi.module, bi.member);
                 if (c !== undefined)
                     return builtinConstLit(c, loc);
+                // module.builtinModules — the baked Node v24 list, a fresh
+                // string[] per read.
+                if (bi.module === "module" && bi.member === "builtinModules") {
+                    return builtinModulesArrayLit(loc);
+                }
                 // JavaScript sources: a builtin member taken as a bare VALUE is
                 // the same identity-token story as stdlib globals above (the
                 // harness adds worker_threads.Worker to its identity Set).
@@ -979,7 +1045,7 @@ function lowerExprInner(L, expr) {
         if (value.type.kind !== "promise") {
             // A CHECKED-DYNAMIC operand (`await v` where v rode an untyped
             // binding — a destructured helper's return, a dyn call result):
-            // the runtime decides — a DOM promise adopts (rejections
+            // the runtime decides — a dyn promise adopts (rejections
             // re-throw), anything else takes JS's one-hop non-thenable await
             // and answers itself. Thenable adoption stays unmodeled
             // (SEMANTICS.md).
@@ -1137,9 +1203,9 @@ function lowerExprInner(L, expr) {
         // bound handle).
         if (L.isIslandExpr(expr.expression)) {
             const receiver = L.lowerExpr(expr.expression);
-            // The checker said 'any' but the VALUE lives in the DOM (`this`
+            // The checker said 'any' but the VALUE lives in the checked-dynamic tree (`this`
             // in a plain JS function — dyn.this — or a checked-dynamic local
-            // behind an any-typed spelling): the property read is the DOM's
+            // behind an any-typed spelling): the property read is the checked-dynamic tree's
             // own keyed read, dyn results and dyn chains exactly like every
             // checked-dynamic member access (a nullish receiver throws V8's
             // catchable TypeError, exactly Node). Never a jsOp over a dyn —
@@ -1177,6 +1243,15 @@ function lowerExprInner(L, expr) {
             }
             return read;
         }
+        // `m.groups` on a match result whose regex is statically known:
+        // the compile-time record projection over the honest slice (or
+        // Node's undefined when the pattern has no named groups) — see
+        // lowerMatchGroupsRead.
+        {
+            const g = lowerMatchGroupsRead(L, expr);
+            if (g !== null)
+                return g;
+        }
         // `m.index` on a for-of-over-matchAll binding reads the companion-
         // index array at this iteration's cursor — always a number: every
         // drained row matched, so the lib's `.index` is never undefined
@@ -1414,14 +1489,14 @@ function lowerExprInner(L, expr) {
         // .length` where the binding is an evolving any[] living as a
         // checked-dynamic global): the stdlib member fence below would blame
         // the unmappable checker type (`any[].length`), but the VALUE is a
-        // DOM node — lower the receiver first and read through the DOM keyed
+        // dyn node — lower the receiver first and read through the dyn keyed
         // read (ARR answers length; everything else JS's own-property
         // answer). Mapped receivers keep the fence-first order: their
         // members' gaps are real surface gaps ([1,2].entries), not
         // representation artifacts. `.length` on a receiver whose checker
         // ARRAY type lowers to the checked-dynamic representation —
         // `unknown[]`, the collapsed `(string | object)[]`, and the `any[]`
-        // an Array.isArray guard narrows a collapsed union to — is the DOM
+        // an Array.isArray guard narrows a collapsed union to — is the checked-dynamic tree
         // array's OWN length (a keyed read the ARR kind answers exactly),
         // never an `Array.prototype` surface gap; both source languages.
         // Prototype-method VALUE reads (`ps.map` unparenthesized) keep the
@@ -1431,7 +1506,7 @@ function lowerExprInner(L, expr) {
         if ((isJsSourceFile(expr.getSourceFile()) &&
             (L.mapTypeOf(L.typeOf(expr.expression)) === null ||
                 // A never-tainted receiver type maps (never rides as f64) but
-                // its VALUE lowered checked-dynamic — same DOM read.
+                // its VALUE lowered checked-dynamic — same dyn read.
                 neverTaintedJsType(L, expr.expression, L.typeOf(expr.expression)))) ||
             (expr.name.text === "length" &&
                 (L.checkerAnyArray(expr.expression) ||
@@ -1542,7 +1617,7 @@ function lowerExprInner(L, expr) {
         // the property and the receiver's type instead of "property access".
         const recvLowered = L.lowerExpr(expr.expression);
         // A dyn receiver — JSON.parse's `any`, or `unknown` the checker
-        // narrowed to `object` — reads through the DOM keyed read: member
+        // narrowed to `object` — reads through the dyn keyed read: member
         // or undefined (JS's own-property answer), throwing JS's TypeError
         // on undefined/null receivers unless an earlier `?.` guards the
         // chain. Scalar-narrowed occurrences bridge via maybeNarrow's
@@ -1552,6 +1627,31 @@ function lowerExprInner(L, expr) {
             const opt = chainGuardedByQuestionDot(expr.expression);
             return L.maybeNarrow({ kind: "dynKeyGet", key, ...(opt ? { optional: true } : {}), value: recvLowered, type: DYN, loc }, expr);
         }
+        // The lowered receiver is a RECORD the checker spelled wider —
+        // `s.match(re).groups.key` in a JS file: the checker says
+        // `{ [key: string]: string } | undefined`, but the groups
+        // projection already answered the record arm (its null trap
+        // included). Declared fields read directly; an index-signature
+        // shape serves undeclared keys through the overflow read, exactly
+        // the dot-access rule on checker-spelled hybrids.
+        if (recvLowered.type.kind === "record") {
+            const recvShape = L.shapes.get(recvLowered.type.shapeId);
+            const field = recvShape?.fields.find((f) => f.name === expr.name.text);
+            if (field) {
+                return L.maybeNarrow({ kind: "recordGet", obj: recvLowered, shapeId: recvLowered.type.shapeId, field: field.name, type: field.type, loc }, expr);
+            }
+            if (recvShape?.indexValue !== undefined && !recvShape.tuple) {
+                return L.maybeNarrow({
+                    kind: "recordKeyGet",
+                    obj: recvLowered,
+                    shapeId: recvLowered.type.shapeId,
+                    key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
+                    overflowOnly: true,
+                    type: recvShape.indexValue,
+                    loc,
+                }, expr);
+            }
+        }
         // An ABSTRACT property through an abstract-typed receiver: the
         // declaration is erased at runtime — Node defines no field for it,
         // each concrete subclass declares its OWN (at its own layout
@@ -1763,11 +1863,11 @@ export function lowerTernary(L, expr, expected) {
         // === "string" ? pkg.name : null` — the lowering world types the
         // unknown-receiver read `any`, which a static build cannot hold):
         // dyn represents null and undefined directly, so the ternary stays
-        // dyn — a unit arm converts to the DOM unit value (the dynFrom form
+        // dyn — a unit arm converts to the dyn unit value (the dynFrom form
         // the index-signature lowerings already use). A FRESH literal arm
         // (`... ? pkg.scripts : {}` — the default-object idiom) converts the
         // same way when it is JSON-safe: nothing else aliases a literal, so
-        // the DOM copy is unobservable.
+        // the dyn copy is unobservable.
         const dynish = (e) => e.type.kind === "dyn" ||
             e.kind === "unitLit" ||
             ((e.kind === "recordLit" || e.kind === "arrayLit") && L.dynConvertible(e.type));
@@ -1853,13 +1953,13 @@ export function maybeNarrow(L, expr, node) {
             (narrowed.kind === "f64" || narrowed.kind === "bool" || narrowed.kind === "string")) {
             return { kind: "dynCheck", value: expr, type: narrowed, loc: expr.loc };
         }
-        // An `instanceof Uint8Array` narrow: the DOM's bytes kind, extracted
+        // An `instanceof Uint8Array` narrow: the checked-dynamic tree's bytes kind, extracted
         // with the same validated copy the checked cast uses (a Buffer that
         // crossed in rides the kind too — it IS a Uint8Array in Node).
         if (narrowed?.kind === "bytes" && narrowed.elem === "u8") {
             return { kind: "dynCheck", value: expr, type: narrowed, loc: expr.loc };
         }
-        // An `instanceof Error` narrow: the DOM's error encoding rebuilds a
+        // An `instanceof Error` narrow: the checked-dynamic tree's error encoding rebuilds a
         // fresh %Error (name/message/code from the marker object — a COPY,
         // the unknown boundary's stance; SEMANTICS.md 67), validated like
         // every dyn extraction.
@@ -2035,7 +2135,7 @@ export function lowerLooseNullCompare(L, expr, loc) {
         return { kind: "boolLit", value: !negated, type: BOOL, loc };
     }
     if (other.type.kind === "dyn") {
-        // `v != null` on unknown: one DOM kind test covers both units.
+        // `v != null` on unknown: one dyn kind test covers both units.
         return {
             kind: "dynTest",
             test: "nullish",
@@ -2194,7 +2294,7 @@ export function lowerNullishCoalesce(L, expr, loc) {
         // runtime kind (scr_dyn_is_nullish — UNDEF/NULL take the default;
         // a wrapped island value routes to the engine's test, defensively:
         // the wrap constructor scalar-normalizes engine null/undefined
-        // away). Both sides live in the DOM — the right converts through
+        // away). Both sides live in the checked-dynamic tree — the right converts through
         // the usual boundary and evaluates lazily in its branch; a default
         // with no dyn representation keeps the fence.
         const right = L.coerceToExpected(L.lowerExpr(expr.right), DYN);
@@ -2476,7 +2576,7 @@ export function lowerOptionalChain(L, expr) {
             }
             // NUMBER-typed indices (`entries?.[0]`): the property key is
             // ToString(i), exactly JS — the canonical number text answers
-            // array indices in the DOM helper, anything else (fractions,
+            // array indices in the dyn helper, anything else (fractions,
             // negatives, NaN) reads as an absent key.
             if (key.type.kind === "f64") {
                 const skey = { kind: "toString", operand: key, type: STRING, loc: key.loc };
@@ -2484,12 +2584,12 @@ export function lowerOptionalChain(L, expr) {
             }
         }
         // The METHOD-call step (`rawName?.match(re)` on a dyn value): a
-        // nullish receiver short-circuits to the undefined DOM singleton
+        // nullish receiver short-circuits to the undefined dyn singleton
         // (dyn represents undefined directly); anything else runs the
         // VALIDATED dynamic dispatch — the same one the truthy-guarded
         // spelling (`v ? v.match(...) : null`) compiles to, Node-shaped
         // TypeError on a kind mismatch included. The dispatch's static
-        // result converts back into the DOM (the chain's checker type is
+        // result converts back into the checked-dynamic tree (the chain's checker type is
         // the error-any world's `any`, so dyn IS its representation).
         if (ts.isCallExpression(expr) &&
             ts.isPropertyAccessExpression(dotNode) &&
@@ -2660,7 +2760,7 @@ export function finishOptionalChain(L, expr, id, receiver, body, loc) {
     }
     // A dyn body (`pricing?.[key]` — an unknown-valued index-signature
     // read) stays dyn: `unknown | undefined` IS unknown, and dyn represents
-    // undefined directly (the unit path yields the undefined DOM value).
+    // undefined directly (the unit path yields the undefined dyn value).
     if (body.type.kind === "dyn") {
         return { kind: "optChain", id, receiver, body, type: DYN, loc };
     }
@@ -2716,8 +2816,8 @@ export function ensureBool(L, e, node) {
         return { kind: "toBool", operand: e, type: BOOL, loc: e.loc };
     }
     if (e.type.kind === "dyn") {
-        // ToBoolean over the DOM (`if (pkg)` on a JSON.parse result): every
-        // DOM kind has a JS-exact answer — the truthy dynTest reads the kind
+        // ToBoolean over the checked-dynamic tree (`if (pkg)` on a JSON.parse result): every
+        // dyn kind has a JS-exact answer — the truthy dynTest reads the kind
         // tag (plus the scalar payload for number/string).
         return { kind: "dynTest", test: "truthy", value: e, type: BOOL, loc: e.loc };
     }
@@ -2743,7 +2843,7 @@ export function ensureBool(L, e, node) {
     L.badType(node, L.typeOf(node));
 }
 /** Truthiness needs a ToBoolean per arm: dyn/caught arms have none (a
-   * dynamic ToBoolean over the DOM / the snapshot box) — fence those
+   * dynamic ToBoolean over the checked-dynamic tree / the snapshot box) — fence those
    * unions; every other arm kind is answerable (units false, scalars and
    * strings by value, refs true, jsval by the engine). */
 export function requireTruthyUnion(L, unionId, node) {
@@ -2772,7 +2872,7 @@ export function lowerIntrinsicProperty(L, expr) {
         return null;
     // A never-tainted JS receiver type lowered checked-dynamic
     // (neverTaintedJsType — `cmd.length` on `const cmd = ['pwd', []]`):
-    // stand down so the DOM keyed read below the chain answers, instead
+    // stand down so the dyn keyed read below the chain answers, instead
     // of an array libCall over a dyn receiver hitting the boundary fence.
     let kind = neverTaintedJsType(L, expr.expression, L.typeOf(expr.expression))
         ? undefined
@@ -2994,8 +3094,8 @@ export function lowerIntrinsicProperty(L, expr) {
             // No ArrayBuffer VALUE exists — `.buffer` compiles only in the
             // one composed position that consumes it, the DataView
             // constructor's first argument (lowerDataViewNew peels it).
-            L.unsupported("SC1090", expr, "'.buffer' outside new DataView(x.buffer, ...) — scriptc typed arrays own their storage: " +
-                "no free-standing ArrayBuffer value exists, and slice()/subarray() copy");
+            L.unsupported("SC1090", expr, "'.buffer' outside new DataView(x.buffer, ...) / Buffer.from(x.buffer, ...) " +
+                "(no free-standing ArrayBuffer value exists; subarray() answers an aliasing view directly)");
         }
         if (name === "slice" || name === "subarray" || name === "set" || name === "toString") {
             L.unsupported("SC1090", expr, `typed-array methods as values (call '${name}' directly)`);
@@ -3036,8 +3136,8 @@ export function lowerIntrinsicProperty(L, expr) {
             return { kind: "jsExit", value: read, type: F64, loc: locOf(expr) };
         }
         // A CHECKED-DYNAMIC value behind an array-typed checker spelling
-        // (`Object.keys(u).length` — the dyn walk answers a DOM array while
-        // tsc spells string[]): the runtime-world dispatch — a DOM keyed
+        // (`Object.keys(u).length` — the dyn walk answers a dyn array while
+        // tsc spells string[]): the runtime-world dispatch — a dyn keyed
         // read validated into the declared number (a lying length throws
         // the catchable TypeError, the dynCheck stance).
         if (receiver.type.kind === "dyn") {
@@ -3080,7 +3180,7 @@ export function lowerArrayLiteral(L, expr, expected) {
     // A JS literal whose OWN inferred type is never-tainted
     // (neverTaintedJsType — the evolving `const gb = []`, the mixed
     // command tuple `['pwd', []]`) carries no element information: route
-    // it to the DOM fallback below rather than letting never's f64
+    // it to the checked-dynamic tree fallback below rather than letting never's f64
     // representation build a static number array (a later dyn push would
     // throw "expected number at $, got string"; the tuple's union arm
     // would re-tag as number[] and fence). A REAL slot still wins:
@@ -3210,14 +3310,14 @@ export function lowerArrayLiteral(L, expr, expected) {
     if (!mapped || mapped.kind !== "array") {
         // The JS declaration fallback, literal-side: an element type with no
         // static home (a string | string[] mixed command tuple, an evolving
-        // []) builds as a DOM ARRAY — one dyn value whose elements each
+        // []) builds as a dyn ARRAY — one dyn value whose elements each
         // convert through the usual boundary (dynFrom's JSON-safe domain);
         // an element that cannot convert fences per element. length/index
-        // reads and dynamic consumers ride the keyed-DOM paths. TS literals
+        // reads and dynamic consumers ride the keyed-dyn paths. TS literals
         // take the same build when the slot ITSELF is checked-dynamic — an
         // `unknown[]` annotation or a collapsed `(string | object)[]` maps
         // to DYN wholesale now (mapType's dyn-element array rule), so the
-        // literal IS the DOM array.
+        // literal IS the dyn array.
         if (isJsSourceFile(expr.getSourceFile()) || mapped?.kind === "dyn") {
             const elems = expr.elements.map((el) => {
                 if (ts.isSpreadElement(el)) {
@@ -3503,12 +3603,12 @@ function propNameText(L, name) {
     return name.text;
 }
 /** The runtime-keyed JS object literal (a computed key that doesn't fold):
-   * builds a DOM object member-by-member. Keys evaluate before their values,
+   * builds a dyn object member-by-member. Keys evaluate before their values,
    * properties in source order — JS's object-literal evaluation exactly.
    * Identifier/string keys are compile-time strings; numeric keys take
    * their canonical number string (`{ 0x10: v }` stores "16" — JS's
    * ToPropertyKey); computed keys evaluate and pass through ToString (the
-   * DOM's String() for dyn operands — `{ [field]: v }` where field is a
+   * dyn's String() for dyn operands — `{ [field]: v }` where field is a
    * checked-dynamic param). Values convert through the usual dyn boundary
    * (dynFrom's domain, functions box); a value with no dyn representation
    * fences per property. Spreads, accessors, and methods stay fenced —
@@ -3601,7 +3701,7 @@ export function lowerDynObjectLiteral(L, expr) {
                 L.unsupported("SC1101", valueExpr, `holding '${L.fmt(v.type)}' values in a runtime-keyed (computed-key) object literal`);
             }
             catch (err) {
-                // A member value the DOM cannot hold — a func whose signature
+                // A member value the checked-dynamic tree cannot hold — a func whose signature
                 // cannot box, an island ('any') handle, a record carrying func
                 // fields (the export aggregate's typed utilities and npm-handle
                 // members): the same call-time fence deferral as an unlowerable
@@ -3671,7 +3771,7 @@ function fenceClosureProbe(L, node, slotType, attempt) {
         return null;
     }
     // The trap's ABI: the field's func slot when one exists; otherwise (the
-    // DOM-object literal path — the value boxes into dyn) the all-dyn
+    // dyn-object literal path — the value boxes into dyn) the all-dyn
     // signature of the lambda's own arity, which canBoxFuncIntoDyn always
     // admits.
     const fieldType = slotType !== undefined && slotType.kind === "func"
@@ -3814,7 +3914,7 @@ export function lowerObjectLiteral(L, expr) {
     const loc = locOf(expr);
     // The RUNTIME-KEYED literal (JS): a computed key that doesn't fold to a
     // compile-time string means the literal's shape is not a compile-time
-    // fact — no record shape can hold it. The whole literal builds as a DOM
+    // fact — no record shape can hold it. The whole literal builds as a dyn
     // object instead (`{ [field]: criteria, actual: 0, ... }` —
     // test/common's _mustCallInner context), where keys are runtime string
     // values. TypeScript keeps the record world and its fence: this shape
@@ -4063,13 +4163,13 @@ export function lowerObjectLiteral(L, expr) {
         const shapeId = L.shapes.intern(fields.map((f) => ({ name: f.name, type: f.value.type })));
         return { kind: "recordLit", fields, type: { kind: "record", shapeId }, loc };
     }
-    // The JS declaration fallback, literal-side (the DOM-array rule's
+    // The JS declaration fallback, literal-side (the checked-dynamic tree-array rule's
     // object form): a literal whose shape has no static home — an
     // unmappable contextual type over unmappable own fields (the
     // PropertyDescriptorMap argument of Object.defineProperties, nested
-    // descriptor records with `any` values) — builds as a DOM OBJECT:
+    // descriptor records with `any` values) — builds as a dyn OBJECT:
     // each field converts through the usual dyn boundary, and dynamic
-    // consumers ride the keyed-DOM paths. TypeScript keeps the fence.
+    // consumers ride the keyed-dyn paths. TypeScript keeps the fence.
     if ((!mapped || mapped.kind === "dyn") && isJsSourceFile(expr.getSourceFile())) {
         return lowerDynObjectLiteral(L, expr);
     }
@@ -4335,8 +4435,8 @@ export function lowerObjectLiteral(L, expr) {
                 const recArm = recArms[0];
                 const recTag = def.arms.indexOf(recArm);
                 // A checked-dynamic VALUE under the union-mapped checker type
-                // (a JS DOM-holding binding): the present/absent desugar tests
-                // union tags a DOM box does not carry — fence honestly instead
+                // (a JS dyn-holding binding): the present/absent desugar tests
+                // union tags a dyn box does not carry — fence honestly instead
                 // of the validator's ICE.
                 const probedSrc = srcLowered ?? probeLower(L, srcNode);
                 if (probedSrc?.type.kind === "dyn") {
@@ -4518,11 +4618,11 @@ export function lowerObjectLiteral(L, expr) {
                     throw new PoisonError();
                 }
                 const obj = srcLowered ?? L.lowerExpr(srcNode);
-                // A record-mapped CHECKER type whose VALUE lives in the DOM (a
+                // A record-mapped CHECKER type whose VALUE lives in the checked-dynamic tree (a
                 // JS file-scope object-literal global): read each field from
-                // the DOM (dynKeyGet) and VALIDATE it into the source shape's
+                // the checked-dynamic tree (dynKeyGet) and VALIDATE it into the source shape's
                 // field type (dynCheck) — the checked-dynamic member-read
-                // discipline. A missing key answers the DOM undefined, exactly
+                // discipline. A missing key answers the dyn undefined, exactly
                 // the undefined-armed optional's absent case; a mismatched
                 // runtime value throws the catchable TypeError, never a silent
                 // wrong copy. Runtime-ADDED keys drop — width subtyping in
@@ -4530,7 +4630,7 @@ export function lowerObjectLiteral(L, expr) {
                 let value;
                 if (obj.type.kind === "dyn") {
                     if (!canDynCheckTo(f.type, (id) => L.shapes.get(id), (id) => L.unions.get(id))) {
-                        L.unsupported("SC1100", prop, `object spread of a checked-dynamic source whose field '${f.name}' ('${L.fmt(f.type)}') cannot validate out of the DOM (copy the fields explicitly)`);
+                        L.unsupported("SC1100", prop, `object spread of a checked-dynamic source whose field '${f.name}' ('${L.fmt(f.type)}') cannot validate out of the checked-dynamic tree (copy the fields explicitly)`);
                     }
                     value = {
                         kind: "dynCheck",
@@ -4669,7 +4769,7 @@ export function lowerObjectLiteral(L, expr) {
                 // lowering: a union field with one array-family arm builds the
                 // literal AS that arm (lowerExprExpecting's IR-directed rule —
                 // the option-table `default: [{ value: [] }]` shape), where the
-                // bare lowering would take the JS DOM fallback and fence.
+                // bare lowering would take the JS dyn fallback and fence.
                 let init = prop.initializer;
                 while (ts.isParenthesizedExpression(init))
                     init = init.expression;
@@ -4714,7 +4814,7 @@ export function lowerObjectLiteral(L, expr) {
         }
         if (!fieldType) {
             // Overflow entry: the value flows into the index signature's value
-            // slot — dyn slots take a DOM conversion (dynFrom), typed slots the
+            // slot — dyn slots take a dyn conversion (dynFrom), typed slots the
             // ordinary coercion path. Later duplicates override (map semantics
             // are last-write-wins already; a duplicate literal key is a tsc
             // error anyway).
@@ -4756,7 +4856,7 @@ export function lowerObjectLiteral(L, expr) {
         for (const f of shape.fields) {
             if (provided.has(f.name))
                 continue;
-            // 'unknown' fields complete with the DOM undefined — the absent
+            // 'unknown' fields complete with the dyn undefined — the absent
             // property reads as undefined in Node, and a dyn slot holds
             // exactly that (the options-record call shape against
             // `{ plugins: unknown, ... }` — a JS caller the checker admits).
@@ -5117,7 +5217,7 @@ export function lowerElementAccess(L, expr) {
     // A never-tainted JS receiver type (neverTaintedJsType — `cmd[1]` on
     // `const cmd = ['pwd', []]`, whose binding lowered checked-dynamic)
     // dispatches as unmapped so the dyn-receiver branch below reads
-    // through the DOM instead of dynChecking into never's f64 residue.
+    // through the checked-dynamic tree instead of dynChecking into never's f64 residue.
     const receiverIr = neverTaintedJsType(L, expr.expression, L.typeOf(expr.expression))
         ? null
         : L.mapTypeOf(L.typeOf(expr.expression));
@@ -5125,7 +5225,7 @@ export function lowerElementAccess(L, expr) {
         // Dispatch follows the RUNTIME world (383(d)): a checker-'any'
         // receiver whose value LOWERED checked-dynamic (`bag.list[0]` where
         // bag.list is a routed keyed read off a wrapped island value) takes
-        // the DOM keyed read below — the routed JSVAL arm reads the real
+        // the dyn keyed read below — the routed JSVAL arm reads the real
         // engine element; a jsval-lowered receiver keeps the island read.
         const recv = L.lowerExpr(expr.expression);
         if (recv.type.kind !== "dyn")
@@ -5204,7 +5304,7 @@ export function lowerElementAccess(L, expr) {
         }
     }
     // `pkg["k"]` / `scripts[name]` / `scopeMatch[1]` on a dyn receiver (a
-    // JSON.parse result): the DOM keyed read, exactly the dot form.
+    // JSON.parse result): the dyn keyed read, exactly the dot form.
     // NUMBER-typed indices convert through ToString first — JS property
     // keys are strings, and the canonical number text answers array
     // indices in the helper (fractions, negatives, and NaN read as
@@ -5314,7 +5414,7 @@ export function lowerElementAccess(L, expr) {
         return islandElementRead(L, expr, arr);
     // The checker sees an array but the VALUE lowered checked-dynamic (a
     // jsdoc-typed default export from a .js module — signature 14): the
-    // read rides the dynCheck boundary when the array shape is one the DOM
+    // read rides the dynCheck boundary when the array shape is one the checked-dynamic tree
     // can validate, and fences by name when it is not — an arrayGet over a
     // dyn receiver is never emitted (the validator ICE).
     if (arr.type.kind === "dyn") {
@@ -5390,7 +5490,7 @@ function islandElementRead(L, expr, obj) {
    * the index signature's value type (dyn for `unknown`), or its
    * undefined-armed union under noUncheckedIndexedAccess. Every declared
    * field must be able to SURFACE as that type (equal, an arm of it, or —
-   * for dyn results — JSON-safe for the DOM conversion); shapes mixing in
+   * for dyn results — JSON-safe for the dyn conversion); shapes mixing in
    * fields outside that stay fenced. Declared-only shapes support reads
    * whose key type proves membership (tsc's keyof check): all fields must
    * share the result type, and a smuggled miss traps. */
@@ -5409,9 +5509,9 @@ export function lowerRecordKeyRead(L, expr, shapeId, shape) {
     // The receiver lowers FIRST (both branches below read it, and JS
     // evaluates the receiver before the key).
     const obj = L.lowerExpr(expr.expression);
-    // A record-mapped CHECKER type over a VALUE living in the DOM (a JS
+    // A record-mapped CHECKER type over a VALUE living in the checked-dynamic tree (a JS
     // file-scope object-literal global): the checked-dynamic keyed read —
-    // dynKeyGet against the runtime keys (a missing key answers the DOM
+    // dynKeyGet against the runtime keys (a missing key answers the checked-dynamic tree
     // undefined, exactly JS); consumers validate (dynCheck) where a
     // static type is required, the member-read discipline.
     if (obj.type.kind === "dyn") {
@@ -5520,8 +5620,8 @@ export function recordKeyTypeLiteralText(L, node) {
 }
 /** Can every value a dynamic key can reach (declared fields + the
  * overflow) surface as the read's result type? dyn results need
- * DOM-convertible fields (JSON-safe, with the undefined arm allowed at
- * the top — an optional field's undefined becomes the undefined DOM
+ * dyn-convertible fields (JSON-safe, with the undefined arm allowed at
+ * the top — an optional field's undefined becomes the undefined dyn
  * value, exactly what the missing-key path produces); typed results need
  * each field to be the type itself or one of its arms, and the overflow
  * value to be the type or wrappable into it. */
@@ -5589,7 +5689,7 @@ export function lowerElementWrite(L, expr) {
     if (receiverIr?.kind === "jsval") {
         const obj = L.lowerExpr(target.expression);
         // Dispatch follows the RUNTIME world (383(d)): a checker-'any'
-        // receiver whose value LOWERED checked-dynamic takes the DOM keyed
+        // receiver whose value LOWERED checked-dynamic takes the dyn keyed
         // write — the routed JSVAL arm lands it on the real engine object.
         if (obj.type.kind === "dyn") {
             const loc = locOf(expr);
@@ -5616,12 +5716,12 @@ export function lowerElementWrite(L, expr) {
         return { kind: "exprStmt", expr: { kind: "jsOp", op: "setIdx", args: [obj, key, value], type: VOID, loc }, loc };
     }
     // A checked-dynamic receiver TYPE (`unknown[]` and the collapsed
-    // `(string | object)[]` map to DYN wholesale now): the DOM keyed
+    // `(string | object)[]` map to DYN wholesale now): the dyn keyed
     // write — dyn.keySet. Number keys canonicalize through the JS-exact
     // formatter; ARR receivers take canonical index keys as element
     // set/extend (undefined-hole padding, JS's length growth exactly),
     // OBJ receivers set the member, and the runtime throws Node's
-    // TypeErrors on every other kind. Values convert into the DOM;
+    // TypeErrors on every other kind. Values convert into the checked-dynamic tree;
     // unconvertible ones fence per site (the dynFrom stance).
     if (receiverIr?.kind === "dyn") {
         const obj = L.lowerExpr(target.expression);
@@ -5635,7 +5735,7 @@ export function lowerElementWrite(L, expr) {
             }
             const value = L.coerceToExpected(L.lowerExpr(expr.right), DYN);
             if (value.type.kind !== "dyn") {
-                L.unsupported("SC1101", expr.right, `storing '${L.fmt(value.type)}' values in a checked-dynamic array (the value cannot convert into the DOM)`);
+                L.unsupported("SC1101", expr.right, `storing '${L.fmt(value.type)}' values in a checked-dynamic array (the value cannot convert into the checked-dynamic tree)`);
             }
             return { kind: "exprStmt", expr: { kind: "libCall", fn: "dyn.keySet", args: [obj, key, value], type: VOID, loc }, loc };
         }
@@ -5675,11 +5775,11 @@ export function lowerElementWrite(L, expr) {
                 const loc = locOf(expr);
                 return { kind: "exprStmt", expr: { kind: "jsOp", op: "setIdx", args: [obj, key, value], type: VOID, loc }, loc };
             }
-            // A record-mapped CHECKER type over a VALUE living in the DOM (a
+            // A record-mapped CHECKER type over a VALUE living in the checked-dynamic tree (a
             // JS file-scope object-literal global): the checked-dynamic keyed
             // write — dyn.keySet (later writes win, insertion order; Node's
             // TypeErrors on non-object receivers), the value converting into
-            // the DOM. Literal and runtime keys alike: the DOM's key set is
+            // the checked-dynamic tree. Literal and runtime keys alike: the checked-dynamic tree's key set is
             // open, so no declared-field collision analysis applies.
             if (obj.type.kind === "dyn") {
                 const loc = locOf(expr);
@@ -5694,7 +5794,7 @@ export function lowerElementWrite(L, expr) {
                 }
                 const value = L.coerceToExpected(L.lowerExpr(expr.right), DYN);
                 if (value.type.kind !== "dyn") {
-                    L.unsupported("SC1101", expr.right, `storing '${L.fmt(value.type)}' values in a checked-dynamic object (the value cannot convert into the DOM)`);
+                    L.unsupported("SC1101", expr.right, `storing '${L.fmt(value.type)}' values in a checked-dynamic object (the value cannot convert into the checked-dynamic tree)`);
                 }
                 return { kind: "exprStmt", expr: { kind: "libCall", fn: "dyn.keySet", args: [obj, key, value], type: VOID, loc }, loc };
             }
@@ -5782,7 +5882,7 @@ export function lowerElementWrite(L, expr) {
             // A LITERAL key naming no declared field is a pure overflow insert
             // — no collision to validate. Runtime keys must be able to collide
             // with every declared field: dyn slots validate through the
-            // dynCheck walker (fields must be DOM-convertible — the same
+            // dynCheck walker (fields must be dyn-convertible — the same
             // convertibility the read needs); typed slots write through
             // directly, so every field must BE the index-value type.
             const overflowOnly = litKey !== null;
@@ -5821,7 +5921,7 @@ export function lowerElementWrite(L, expr) {
     // `result[key] = value`): dyn.keySet, exactly the record-mapped dyn
     // arm above — later writes win in insertion order, number keys
     // canonicalize through the JS-exact formatter (ToPropertyKey's string
-    // side), index keys on DOM arrays set/extend elements, and non-object
+    // side), index keys on dyn arrays set/extend elements, and non-object
     // receivers throw Node's TypeErrors at runtime. An UNMAPPED checker
     // type (static `any` — mapTypeOf answers null without --dynamic)
     // probes the receiver's own lowered world: a dyn value takes the same
@@ -5844,7 +5944,7 @@ export function lowerElementWrite(L, expr) {
             }
             const value = L.coerceToExpected(L.lowerExpr(expr.right), DYN);
             if (value.type.kind !== "dyn") {
-                L.unsupported("SC1101", expr.right, `storing '${L.fmt(value.type)}' values in a checked-dynamic object (the value cannot convert into the DOM)`);
+                L.unsupported("SC1101", expr.right, `storing '${L.fmt(value.type)}' values in a checked-dynamic object (the value cannot convert into the checked-dynamic tree)`);
             }
             return { kind: "exprStmt", expr: { kind: "libCall", fn: "dyn.keySet", args: [obj, key, value], type: VOID, loc }, loc };
         }
@@ -5878,7 +5978,7 @@ export function ensureString(L, e, node) {
     if (e.type.kind === "string")
         return e;
     if (e.type.kind === "dyn") {
-        // String(u) / `${u}`: a runtime dispatch over the DOM kind — Node's
+        // String(u) / `${u}`: a runtime dispatch over the dyn kind — Node's
         // String() exactly (undefined/null texts, JS number formatting,
         // strings verbatim, arrays via join, objects as "[object Object]").
         return { kind: "toString", operand: e, type: STRING, loc: e.loc };
@@ -6004,7 +6104,7 @@ export function lowerTemplate(L, expr) {
    *   documented divergence: a lying cast throws instead of corrupting
    *   memory);
    * - dyn → anything else (closures, class instances, void) is rejected:
-   *   those types cannot be found inside a JSON DOM. */
+   *   those types cannot be found inside a JSON dyn. */
 /** `e as T` and the old-style assertion `<T>e` — one node shape (both
  * carry `.type` and `.expression`), one lowering. */
 export function lowerAsExpression(L, expr) {
@@ -6108,7 +6208,7 @@ export function lowerAsExpression(L, expr) {
         return inner; // `as unknown`: erasure
     if (target.kind === "void" || !L.jsonSafe(target)) {
         // Bare undefined-armed targets pass when every OTHER arm is
-        // JSON-safe: the DOM holds a first-class undefined value now
+        // JSON-safe: the checked-dynamic tree holds a first-class undefined value now
         // (index-signature overflow reads produce it for missing keys), and
         // the undefined arm matches exactly it — `p[key] as string |
         // undefined` is the missing-key idiom. Parsed JSON still never
@@ -6117,7 +6217,7 @@ export function lowerAsExpression(L, expr) {
         if (target.kind === "union" && L.dynConvertible(target)) {
             return { kind: "dynCheck", value: inner, type: target, loc: locOf(expr) };
         }
-        // Uint8Array targets: the DOM carries a bytes kind now (converted
+        // Uint8Array targets: the checked-dynamic tree carries a bytes kind now (converted
         // stdin chunks) — the extraction validates the kind and copies out.
         if (target.kind === "bytes" && target.elem === "u8") {
             return { kind: "dynCheck", value: inner, type: target, loc: locOf(expr) };
@@ -6140,7 +6240,7 @@ export function lowerAsExpression(L, expr) {
         // — the errno-probing idiom): there is nothing to validate (every
         // field is unknown, exactly what the dyn value already answers) and
         // nothing to build — the cast is pure typing, so it ERASES and the
-        // reads ride the DOM keyed read.
+        // reads ride the dyn keyed read.
         if (target.kind === "record") {
             const shape = L.shapes.get(target.shapeId);
             if (shape &&
@@ -6301,7 +6401,7 @@ export function lowerBinary(L, expr) {
         }
         // `events.defaultMaxListeners = v` — the module-property write
         // Node validates (validateNumber(n, 'defaultMaxListeners', 0)):
-        // the value crosses into the DOM and the runtime ladder throws
+        // the value crosses into the checked-dynamic tree and the runtime ladder throws
         // ERR_INVALID_ARG_TYPE / ERR_OUT_OF_RANGE with Node's exact slot
         // name; valid numbers apply. The expression's value is the RHS
         // (JS's assignment yield).
@@ -6474,8 +6574,8 @@ export function lowerBinary(L, expr) {
         }
         if (left.type.kind === "dyn" || right.type.kind === "dyn") {
             // A checked-dynamic operand (`fn.name || '<anonymous>'` —
-            // test/common's _mustCallInner): both sides live in the DOM and
-            // the deciding test is ToBoolean over the DOM kind
+            // test/common's _mustCallInner): both sides live in the checked-dynamic tree and
+            // the deciding test is ToBoolean over the dyn kind
             // (scr_dyn_truthy) — JS value semantics exactly, result dyn. The
             // non-dyn side converts through the usual boundary; a value with
             // no dyn representation keeps the fence.
@@ -6611,7 +6711,7 @@ export function lowerBinary(L, expr) {
     const right = L.lowerExpr(expr.right);
     if (left.type.kind === "dyn" || right.type.kind === "dyn") {
         // The narrowing unit comparisons ARE answerable on unknown: `v ===
-        // undefined` / `v !== null` test the DOM node's kind directly, and
+        // undefined` / `v !== null` test the dyn node's kind directly, and
         // tsc's control flow narrows the branches (reads then bridge through
         // maybeNarrow's validated extraction).
         if (op === ts.SyntaxKind.EqualsEqualsEqualsToken ||
@@ -6631,14 +6731,14 @@ export function lowerBinary(L, expr) {
             }
             // dyn vs SCALAR strict equality (`value !== ""`, `u === 5` — the
             // normalizePricing filter): a guarded kind test + payload compare,
-            // JS-exact (strict equality never coerces; a non-matching DOM kind
+            // JS-exact (strict equality never coerces; a non-matching dyn kind
             // answers false). dyn vs dyn keeps the fence below.
             const dynSide = left.type.kind === "dyn" ? left : right;
             const scalarSide = dynSide === left ? right : left;
             if (dynSide.type.kind === "dyn" &&
                 (scalarSide.type.kind === "f64" || scalarSide.type.kind === "string" || scalarSide.type.kind === "bool" ||
                     // dyn vs dyn (`context.actual !== context.exact` —
-                    // test/common's exit accounting): the runtime's whole-DOM
+                    // test/common's exit accounting): the runtime's whole-dyn
                     // strict equality — scalars by value, units by kind,
                     // reference kinds by node identity (scr_dyn_strict_eq).
                     scalarSide.type.kind === "dyn")) {
@@ -6693,7 +6793,7 @@ export function lowerBinary(L, expr) {
                 }
                 if (other.type.kind === "string") {
                     // String-context `+`: JS's answer is String(unknown) — the
-                    // JS-exact DOM walker (numbers format, arrays join, objects
+                    // JS-exact dyn walker (numbers format, arrays join, objects
                     // print [object Object], handles the same) — never a checked
                     // cast: `'status ' + res.statusCode` concatenates like Node.
                     const strOf = (e) => e.type.kind === "dyn" ? { kind: "toString", operand: e, type: STRING, loc: e.loc } : e;
@@ -6711,7 +6811,7 @@ export function lowerBinary(L, expr) {
             L.anyOpFence(`the '${ts.tokenToString(op) ?? ts.SyntaxKind[op]}' operator`, expr);
         }
         // tsc allows ===/!== on unknown (arithmetic/comparisons it rejects
-        // itself); a dynamic equality would need a DOM walk — validate first.
+        // itself); a dynamic equality would need a dyn walk — validate first.
         L.unsupported("SC1100", expr, "operators on 'unknown' values");
     }
     // Operators over 'any' execute in the island with JS-exact semantics
@@ -7249,7 +7349,7 @@ export function lowerUnionTypeofTest(L, expr, loc) {
     return null;
 }
 /** `typeof v === "lit"` / `typeof v !== "lit"` where v is `unknown`-typed
-   * (dyn): the runtime kind test over the DOM node's tag. Only the kinds a
+   * (dyn): the runtime kind test over the dyn node's tag. Only the kinds a
    * later read can bridge narrow ("string"/"number"/"boolean") plus
    * "undefined" (no payload to read); "object"/"function" tests keep the
    * fence — an object-narrowed `unknown` read has no lowering anyway (a
@@ -7333,7 +7433,7 @@ export function lowerDynTypeofTest(L, expr, loc) {
                 loc,
             };
         }
-        // `typeof v === "object"`: the DOM answers exactly (object, array,
+        // `typeof v === "object"`: the dyn answers exactly (object, array,
         // bytes, and null kinds — JS's oldest wart preserved). tsc narrows
         // the branch to `object | null`; reads past the narrow take the
         // checked-cast path per site.
@@ -7347,7 +7447,7 @@ export function lowerDynTypeofTest(L, expr, loc) {
                 loc,
             };
         }
-        // `typeof v === "function"`: a REAL runtime test since the DOM's
+        // `typeof v === "function"`: a REAL runtime test since the checked-dynamic tree's
         // function kind exists (boxed closures — the mustCall guard
         // `if (typeof fn !== 'function') throw` answers honestly).
         if (b.text === "function") {
@@ -7510,7 +7610,7 @@ export function probeLower(L, node) {
    * over a hierarchy class, `typeof` over a primitive), the read bridges
    * with a kind-unchecked `caughtNarrow` extraction (trust-the-checker,
    * exactly like unionNarrow). Every OTHER read is the narrowness fence:
-   * the binding's payload is a typed exception snapshot, not a dyn DOM, so
+   * the binding's payload is a typed exception snapshot, not a dyn, so
    * un-narrowed uses have nothing sound to lower to. */
 export function caughtRead(L, node, local, loc) {
     const ref = { kind: "varRef", localId: local.id, type: CAUGHT, loc };
@@ -7526,10 +7626,10 @@ export function caughtRead(L, node, local, loc) {
         }
     }
     // An UN-narrowed use — the occurrence still types `unknown` — converts
-    // to a dyn DOM value (`options.onError?.(error)` — the caught snapshot
+    // to a dyn value (`options.onError?.(error)` — the caught snapshot
     // flowing into an unknown slot): the typed→unknown deep-copy stance
     // extended to exception payloads. Error payloads keep their
-    // observability (instanceof Error / .message / String() — the DOM's
+    // observability (instanceof Error / .message / String() — the checked-dynamic tree's
     // error encoding); other object payloads are type-erased at runtime and
     // convert to the "[object Object]" approximation — SEMANTICS.md 67.
     if (narrowed?.kind === "dyn") {
@@ -7635,14 +7735,14 @@ export function lowerInstanceOf(L, expr, loc) {
         L.builtinStreamInfoOf(rhsMemberSymbol) ??
         undefined;
     if (!target) {
-        // `u instanceof Uint8Array` on an `unknown` value: the DOM carries a
+        // `u instanceof Uint8Array` on an `unknown` value: the checked-dynamic tree carries a
         // bytes kind — one runtime tag test, and tsc's narrowing types the
         // true branch (reads bridge through maybeNarrow's validated
         // extraction, like the typeof tests). Node's Buffer IS a Uint8Array
         // subclass and rides the same bytes kind, so both worlds answer true
         // for Buffer payloads — Node-exact (the bytes kind's other
         // divergences are SEMANTICS.md 45). Catch bindings stay out (their
-        // payload is a typed snapshot, not a DOM).
+        // payload is a typed snapshot, not a dyn).
         if (ts.isIdentifier(expr.right) &&
             L.isStdlibGlobal(expr.right, "Uint8Array") &&
             !L.caughtLocalOf(expr.left)) {
@@ -7733,7 +7833,7 @@ export function lowerInstanceOf(L, expr, loc) {
         };
     }
     const left = L.lowerExpr(expr.left);
-    // `u instanceof Error` on an `unknown` value: the DOM's error encoding
+    // `u instanceof Error` on an `unknown` value: the checked-dynamic tree's error encoding
     // (the shape caughtToDyn builds for Error payloads — the reserved
     // "%error" marker) answers the test, so a caught Error passed through
     // an unknown slot narrows like Node (`error instanceof Error ?
@@ -7746,7 +7846,7 @@ export function lowerInstanceOf(L, expr, loc) {
         return { kind: "dynTest", test: "error", value: left, type: BOOL, loc };
     }
     // `u instanceof TypeError` (and the other BUILTIN error classes) on a
-    // dyn value: the from_error cache holds the DOM↔error identity edge,
+    // dyn value: the from_error cache holds the checked-dynamic tree↔error identity edge,
     // so the runtime resolves the encoding back to its error and asks the
     // vtable's stamped interval — exact for every error that crossed the
     // boundary (a hand-built {%error} literal answers false: subclass
@@ -8039,7 +8139,7 @@ export function lowerInExpression(L, expr, loc) {
         }
     }
     // A dyn receiver (`"portless" in pkg` after the `typeof pkg ===
-    // "object"` guard): own-member presence on the DOM — tsc admits `in`
+    // "object"` guard): own-member presence on the checked-dynamic tree — tsc admits `in`
     // only on object-typed operands, so unit receivers are unreachable.
     if (recv.type.kind === "dyn") {
         return { kind: "dynHasKey", key, value: recv, type: BOOL, loc };
@@ -8255,11 +8355,14 @@ function lowerRuntimeKeyIn(L, expr, loc) {
 }
 /** A regex literal `/ab+c/gi` → regexLit (interned per (pattern, flags)
    * by the backend). The TS parser has already syntax-checked the literal;
-   * what remains here are the slice fences: the flag alphabet (d and v are
-   * declared-valid TS flags outside this slice) and named capture groups
-   * (their results are unreachable without exec/match). The engine
-   * validates the pattern itself lazily at first use (SEMANTICS.md
-   * documents the divergence from Node's parse-time SyntaxError). */
+   * what remains here is the flag-alphabet fence (d and v are
+   * declared-valid TS flags outside this slice). Named capture groups
+   * `(?<name>...)` and `\k<name>` backreferences compile — libregexp
+   * executes them natively, replace templates resolve `$<name>` at
+   * runtime, and `.groups` reads desugar at their access sites
+   * (matchResultNamedGroupsOf). The engine validates the pattern itself
+   * lazily at first use (SEMANTICS.md documents the divergence from
+   * Node's parse-time SyntaxError). */
 export function lowerRegexLiteral(L, expr) {
     const text = expr.text;
     const lastSlash = text.lastIndexOf("/");
@@ -8274,12 +8377,414 @@ export function lowerRegexLiteral(L, expr) {
                     : `the regex '${f}' flag`);
         }
     }
-    // (?<name>...) — named groups; (?<= / (?<! are lookbehinds and fine.
-    if (/\(\?<(?![=!])/.test(pattern)) {
-        L.unsupported("SC1120", expr, "named capture groups in regex patterns");
-    }
     return { kind: "regexLit", pattern, flags, type: REGEX, loc: locOf(expr) };
 }
+/** The pattern's named capture groups, in source order: each `(?<name>`
+   * with its 1-based capture index (numbered and named groups share the
+   * numbering — the index IS the match slice's element position). Null
+   * when the scan can't answer confidently (an unterminated construct, a
+   * `\u`-escaped group name) — callers fence rather than guess. Duplicate
+   * names (ES2025 — valid across alternatives) appear once per
+   * declaration; consumers pick the participating occurrence. The scan
+   * only needs to track escapes, character classes, and `(` kinds; tsc
+   * has already syntax-checked the literal, so a malformed pattern here
+   * answers null and the engine's lazy compile reports it. */
+export function namedCaptureGroupsOfPattern(pattern) {
+    const groups = [];
+    let captureIndex = 0;
+    let inClass = false;
+    let i = 0;
+    while (i < pattern.length) {
+        const c = pattern[i];
+        if (c === "\\") {
+            i += 2;
+            continue;
+        }
+        if (inClass) {
+            if (c === "]")
+                inClass = false;
+            i++;
+            continue;
+        }
+        if (c === "[") {
+            inClass = true;
+            i++;
+            continue;
+        }
+        if (c !== "(") {
+            i++;
+            continue;
+        }
+        if (pattern[i + 1] !== "?") {
+            captureIndex++;
+            i++;
+            continue;
+        }
+        // (?<name> captures; (?<= and (?<! are lookbehinds; every other
+        // (?… form — (?:, (?=, (?!, modifier groups (?i: — is non-capturing.
+        if (pattern[i + 2] === "<" && pattern[i + 3] !== "=" && pattern[i + 3] !== "!") {
+            const gt = pattern.indexOf(">", i + 3);
+            if (gt < 0)
+                return null;
+            const name = pattern.slice(i + 3, gt);
+            if (name.includes("\\"))
+                return null; // \u-escaped names: bytecode spells them decoded
+            captureIndex++;
+            groups.push({ name, index: captureIndex });
+            i = gt + 1;
+            continue;
+        }
+        i += 2;
+    }
+    return groups;
+}
+/** The statically-known regex PATTERN behind an expression: a regex
+   * literal, a const local initialized with one (the crypto.js
+   * `const regexp = /(?<m>\d+)/` shape), or `new RegExp("...")` over a
+   * string literal (the cooked text IS the pattern). Null when the regex
+   * only exists at runtime — .groups consumers fence there. */
+export function staticRegexPatternOf(L, e) {
+    let expr = e;
+    for (;;) {
+        if (ts.isParenthesizedExpression(expr) || ts.isNonNullExpression(expr)) {
+            expr = expr.expression;
+            continue;
+        }
+        break;
+    }
+    if (ts.isRegularExpressionLiteral(expr)) {
+        const text = expr.text;
+        return text.slice(1, text.lastIndexOf("/"));
+    }
+    if (ts.isNewExpression(expr) &&
+        ts.isIdentifier(expr.expression) &&
+        expr.expression.text === "RegExp" &&
+        L.isStdlibGlobal(expr.expression, "RegExp") &&
+        expr.arguments !== undefined &&
+        expr.arguments.length >= 1 &&
+        (ts.isStringLiteral(expr.arguments[0]) || ts.isNoSubstitutionTemplateLiteral(expr.arguments[0]))) {
+        return expr.arguments[0].text;
+    }
+    if (ts.isIdentifier(expr)) {
+        const init = constInitializerOf(L, expr);
+        if (init !== null)
+            return staticRegexPatternOf(L, init);
+    }
+    return null;
+}
+/** The initializer behind a CONST identifier binding (a plain
+   * VariableDeclaration under a const list) — the one-hop provenance step
+   * the regex traces walk. Null for let/var (reassignable), params,
+   * destructured bindings, and unresolvable names. */
+function constInitializerOf(L, ident) {
+    const sym = L.resolveValueSymbol(ident);
+    const decl = sym ? L.checker.valueDeclarationOf(sym) : undefined;
+    if (decl === undefined || !ts.isVariableDeclaration(decl) || decl.initializer === undefined)
+        return null;
+    if (!ts.isVariableDeclarationList(decl.parent) || (decl.parent.flags & ts.NodeFlags.Const) === 0)
+        return null;
+    return decl.initializer;
+}
+/** The named-group table of the regex that PRODUCED a match-result
+   * expression — the `.groups` desugar's provenance question. Traces
+   * (through parens, `!`, and const bindings):
+   *   - `re.exec(s)` / `s.match(re)`   → re's static pattern
+   *   - a matchAll ROW: `rows[i]`, the for-of binding over a direct
+   *     `s.matchAll(re)` or a stored const drain → re's static pattern
+   * Answers null when the producing regex isn't statically known (the
+   * caller keeps its fence), or the groups list (possibly empty — a
+   * traced regex WITHOUT named groups is the Node-undefined case). */
+export function matchResultNamedGroupsOf(L, e) {
+    const reExpr = matchProducerRegexOf(L, e);
+    if (reExpr === null)
+        return null;
+    const pattern = staticRegexPatternOf(L, reExpr);
+    if (pattern === null)
+        return null;
+    return namedCaptureGroupsOfPattern(pattern);
+}
+/** The regex EXPRESSION whose match produced `e` (see
+   * matchResultNamedGroupsOf for the traced shapes). */
+function matchProducerRegexOf(L, e) {
+    let expr = e;
+    for (;;) {
+        if (ts.isParenthesizedExpression(expr) || ts.isNonNullExpression(expr)) {
+            expr = expr.expression;
+            continue;
+        }
+        break;
+    }
+    // The direct producers: re.exec(s) / s.match(re) — the receiver's
+    // mapped type pins the STDLIB operation (a regex for exec, a string
+    // or its nullable spelling for match — the claim lower-containers
+    // makes), so a user method that happens to be named `match` with a
+    // regex argument never traces.
+    if (ts.isCallExpression(expr) && ts.isPropertyAccessExpression(expr.expression)) {
+        const name = expr.expression.name.text;
+        const recvT = L.mapTypeOf(L.typeOf(expr.expression.expression));
+        if (name === "exec" && expr.arguments.length === 1 && recvT?.kind === "regex") {
+            return expr.expression.expression;
+        }
+        if (name === "match" && expr.arguments.length === 1 &&
+            (recvT?.kind === "string" || (recvT !== null && recvT !== undefined && nullableStringType(L, recvT))) &&
+            L.mapTypeOf(L.typeOf(expr.arguments[0]))?.kind === "regex") {
+            return expr.arguments[0];
+        }
+    }
+    // A matchAll ROW by element access: rows[i] with rows tracing to the
+    // drain call — or the direct s.matchAll(re)[i] spelling.
+    if (ts.isElementAccessExpression(expr)) {
+        return matchAllRegexOf(L, expr.expression);
+    }
+    if (ts.isIdentifier(expr)) {
+        // The for-of binding over a matchAll drain: `for (const m of
+        // s.matchAll(re))` (or over a stored const rows).
+        const sym = L.resolveValueSymbol(expr);
+        const decl = sym ? L.checker.valueDeclarationOf(sym) : undefined;
+        if (decl !== undefined && ts.isVariableDeclaration(decl) &&
+            ts.isVariableDeclarationList(decl.parent) && ts.isForOfStatement(decl.parent.parent)) {
+            return matchAllRegexOf(L, decl.parent.parent.expression);
+        }
+        // A stored const match result: `const m = re.exec(s)`.
+        const init = constInitializerOf(L, expr);
+        if (init !== null)
+            return matchProducerRegexOf(L, init);
+    }
+    return null;
+}
+/** The regex argument of a (possibly const-stored) `s.matchAll(re)`. */
+function matchAllRegexOf(L, e) {
+    let expr = e;
+    for (;;) {
+        if (ts.isParenthesizedExpression(expr) || ts.isNonNullExpression(expr)) {
+            expr = expr.expression;
+            continue;
+        }
+        break;
+    }
+    if (ts.isCallExpression(expr) && ts.isPropertyAccessExpression(expr.expression) &&
+        expr.expression.name.text === "matchAll" && expr.arguments.length === 1 &&
+        L.mapTypeOf(L.typeOf(expr.expression.expression))?.kind === "string" &&
+        L.mapTypeOf(L.typeOf(expr.arguments[0]))?.kind === "regex") {
+        return expr.arguments[0];
+    }
+    // The eager-spread spelling: `[...s.matchAll(re)]`.
+    if (ts.isArrayLiteralExpression(expr) && expr.elements.length === 1) {
+        const only = expr.elements[0];
+        if (ts.isSpreadElement(only))
+            return matchAllRegexOf(L, only.expression);
+    }
+    if (ts.isIdentifier(expr)) {
+        const init = constInitializerOf(L, expr);
+        if (init !== null)
+            return matchAllRegexOf(L, init);
+    }
+    return null;
+}
+/** `m.groups` on a match result whose producing regex is statically
+   * known: the honest slice already HOLDS every named group's value at
+   * its capture index, so the groups object is a compile-time record
+   * projection — `{ year: m[1], month: m[2] }` — built by one interned
+   * helper per (shape, index list, receiver type). Node's exact shape
+   * decisions:
+   *   - no named groups → `undefined` (the identifier-receiver shapes —
+   *     a call receiver would lose its own null trap, so those keep the
+   *     member fence);
+   *   - a nullable receiver (the JS `s.match(re).groups` idiom) throws
+   *     Node's exact TypeError on the unit arms;
+   *   - every declared name is a key (nonparticipating groups hold "" —
+   *     divergence 51's rule, exactly the slice elements they project);
+   *   - ES2025 duplicate names (distinct alternatives) project the first
+   *     participating occurrence: at most one participates, and a
+   *     participating-empty "" falls through to slots that are "" anyway;
+   *   - key order is group declaration order (declaredOrder), Node's own.
+   * The record has no prototype — Node's groups object is null-prototype,
+   * observable only through util.inspect's "[Object: null prototype]"
+   * prefix (the Object.groupBy stance, ledgered). Null when the receiver
+   * isn't a match slice or the regex isn't traceable — the caller's
+   * member fence (with the groups hint) names the gap. */
+export function lowerMatchGroupsRead(L, expr) {
+    if (expr.name.text !== "groups" || expr.questionDotToken !== undefined)
+        return null;
+    const loc = locOf(expr);
+    const strArr = arrayOf(STRING);
+    const recvT = L.mapTypeOf(L.typeOf(expr.expression));
+    if (!recvT || !isMatchSliceType(L, recvT) || !L.isStdlibMember(expr))
+        return null;
+    const groups = matchResultNamedGroupsOf(L, expr.expression);
+    if (groups === null)
+        return null;
+    if (groups.length === 0) {
+        // Node: a match result of a group-less regex answers undefined —
+        // the unit literal, exactly the `undefined` identifier's lowering.
+        // Identifier receivers only (evaluation-free): a CALL receiver's
+        // exec/match must still run and null-trap, which a folded unit
+        // cannot carry — those keep the fence.
+        let r = expr.expression;
+        while (ts.isParenthesizedExpression(r) || ts.isNonNullExpression(r))
+            r = r.expression;
+        if (ts.isIdentifier(r) && typeEquals(recvT, strArr)) {
+            return { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc };
+        }
+        return null;
+    }
+    const recv = L.lowerExpr(expr.expression);
+    if (!isMatchSliceType(L, recv.type))
+        return null;
+    return lowerGroupsProjection(L, recv, groups, loc);
+}
+/** True when the IR type is a string-or-units union — the Dict<string>
+   * member spelling (`process.versions.openssl`), match's nullable
+   * receiver claim. */
+function nullableStringType(L, t) {
+    if (t.kind !== "union")
+        return false;
+    const arms = L.unions.get(t.unionId)?.arms ?? [];
+    return arms.some((a) => a.kind === "string") && arms.every((a) => a.kind === "string" || isUnitType(a));
+}
+/** True when the IR type is the honest match slice — `string[]`, or a
+   * union of it with unit arms only (`string[] | null`). The groups
+   * projection's receiver gate, shared with the destructure interception. */
+export function isMatchSliceType(L, t) {
+    if (typeEquals(t, arrayOf(STRING)))
+        return true;
+    return t.kind === "union" && matchSliceUnionArms(L, t.unionId) !== null;
+}
+/** The union-arm layout of a nullable match slice (`string[] | null`,
+   * matchAll's checker spellings with undefined arms included): the
+   * string[] arm's tag plus each unit arm's tag and spelling. Null when
+   * the union holds anything else. */
+function matchSliceUnionArms(L, unionId) {
+    const def = L.unions.get(unionId);
+    if (!def)
+        return null;
+    const strArr = arrayOf(STRING);
+    const arrTag = def.arms.findIndex((a) => typeEquals(a, strArr));
+    if (arrTag < 0)
+        return null;
+    const units = [];
+    for (let i = 0; i < def.arms.length; i++) {
+        if (i === arrTag)
+            continue;
+        const a = def.arms[i];
+        if (!isUnitType(a))
+            return null;
+        units.push({ tag: i, unit: a.kind === "nullT" ? "null" : "undefined" });
+    }
+    return { arrTag, units };
+}
+/** The groups-record projection call: the result is the CHECKER'S OWN
+   * shape — `{ [key: string]: string }`, the hybrid index-signature
+   * record with no declared fields — holding one OVERFLOW entry per
+   * group name in declaration order, so every downstream consumer
+   * (recordKeyGet reads, Object.keys, JSON, the `| undefined` union
+   * wrap) meets exactly the type tsc reported. One lifted helper per
+   * (index list, receiver representation) builds it; see
+   * lowerMatchGroupsRead for the semantics the body encodes. */
+export function lowerGroupsProjection(L, recv, groups, loc) {
+    // Name → its capture indices, in declaration order (duplicates keep
+    // every occurrence — the projection picks the participating one).
+    const order = [];
+    const indicesByName = new Map();
+    for (const g of groups) {
+        const got = indicesByName.get(g.name);
+        if (got) {
+            got.push(g.index);
+        }
+        else {
+            indicesByName.set(g.name, [g.index]);
+            order.push(g.name);
+        }
+    }
+    const shapeId = L.shapes.intern([], false, STRING);
+    const recordT = { kind: "record", shapeId };
+    const recvKey = recv.type.kind === "union" ? recv.type.unionId : "arr";
+    const key = `regexgroups:${shapeId}:${groups.map((g) => `${g.name}=${g.index}`).join(",")}:${recvKey}`;
+    let helper = L.widthHelpers.get(key);
+    if (!helper) {
+        helper = `%regex.groups.${L.widthHelpers.size}`;
+        L.widthHelpers.set(key, helper);
+        const body = [];
+        const locals = [{ id: "m.0", name: "m", type: recv.type, mutable: true }];
+        let mRef = { kind: "varRef", localId: "m.0", type: recv.type, loc };
+        if (recv.type.kind === "union") {
+            // Node's exact TypeError per unit arm, then the checked narrow.
+            const arms = matchSliceUnionArms(L, recv.type.unionId);
+            for (const u of arms.units) {
+                body.push({
+                    kind: "if",
+                    cond: { kind: "unionIsTag", unionId: recv.type.unionId, tag: u.tag, negated: false, value: mRef, type: BOOL, loc },
+                    then: [
+                        {
+                            kind: "throw",
+                            value: {
+                                kind: "libCall",
+                                fn: "error.new",
+                                args: [
+                                    { kind: "strLit", value: `Cannot read properties of ${u.unit} (reading 'groups')`, type: STRING, loc },
+                                ],
+                                type: { kind: "object", className: "%TypeError" },
+                                loc,
+                            },
+                            loc,
+                        },
+                    ],
+                    else_: null,
+                    loc,
+                });
+            }
+            const narrowed = { kind: "unionNarrow", unionId: recv.type.unionId, tag: arms.arrTag, value: mRef, type: arrayOf(STRING), loc };
+            locals.push({ id: "arr.0", name: "arr", type: arrayOf(STRING), mutable: false });
+            body.push({ kind: "varDecl", localId: "arr.0", init: narrowed, loc });
+            mRef = { kind: "varRef", localId: "arr.0", type: arrayOf(STRING), loc };
+        }
+        const num = (value) => ({ kind: "numLit", value, type: F64, loc });
+        const elem = (index) => ({ kind: "arrayGet", arr: mRef, index: num(index), type: STRING, loc });
+        const values = new Map();
+        order.forEach((name, i) => {
+            const idxs = indicesByName.get(name);
+            if (idxs.length === 1) {
+                values.set(name, elem(idxs[0]));
+                return;
+            }
+            // Duplicates: the first non-"" occurrence (at most one
+            // participates; all-"" answers "" like any nonparticipating slot).
+            const id = `g${i}.0`;
+            locals.push({ id, name: `g${i}`, type: STRING, mutable: true });
+            body.push({ kind: "varDecl", localId: id, init: elem(idxs[0]), loc });
+            const gRef = { kind: "varRef", localId: id, type: STRING, loc };
+            for (const idx of idxs.slice(1)) {
+                body.push({
+                    kind: "if",
+                    cond: { kind: "strEq", negated: false, left: gRef, right: { kind: "strLit", value: "", type: STRING, loc }, type: BOOL, loc },
+                    then: [{ kind: "assign", localId: id, value: elem(idx), loc }],
+                    else_: null,
+                    loc,
+                });
+            }
+            values.set(name, gRef);
+        });
+        body.push({
+            kind: "return",
+            value: {
+                kind: "recordLit",
+                fields: order.map((name) => ({ name, value: values.get(name), overflow: true })),
+                type: recordT,
+                loc,
+            },
+            loc,
+        });
+        L.liftedFns.push({
+            name: helper,
+            params: [{ localId: "m.0", name: "m", type: recv.type }],
+            returnType: recordT,
+            locals,
+            body,
+            loc,
+        });
+    }
+    return { kind: "call", callee: helper, args: [recv], type: recordT, loc };
+}
 /** Field read `obj.f` on class-instance and record receivers, through the
    * shared FieldTarget union (fieldGet / recordGet). Bound method references
    * on classes are rejected specifically; func-typed record fields are
@@ -8372,8 +8877,8 @@ export function lowerUnionProperty(L, expr) {
     // fallback's discipline.
     // A checker-union receiver whose VALUE lowered checked-dynamic (a
     // never-tainted JS chain — `cmd[1].length` on `const cmd = ['pwd',
-    // []]`, where the element read stayed a DOM node): read through the
-    // DOM keyed read like the unmappable-receiver path below the chain.
+    // []]`, where the element read stayed a dyn node): read through the
+    // dyn keyed read like the unmappable-receiver path below the chain.
     if (value.type.kind === "dyn") {
         const key = { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) };
         return { kind: "dynKeyGet", key, value, type: DYN, loc: locOf(expr) };
@@ -8760,9 +9265,9 @@ export function symbolFieldTarget(L, expr) {
    * tsc-clean (the property types as the setter's param), but Node yields
    * undefined, which these property types cannot represent. */
 export function fieldGetExpr(L, target, loc, blame) {
-    // A record-shaped CHECKER target whose receiver VALUE lives in the DOM
+    // A record-shaped CHECKER target whose receiver VALUE lives in the checked-dynamic tree
     // (a JS file-scope object-literal global): the checked-dynamic keyed
-    // read — dynKeyGet (a missing key answers the DOM undefined, exactly
+    // read — dynKeyGet (a missing key answers the dyn undefined, exactly
     // JS); consumers validate (dynCheck) where a static type is required.
     if ((target.container === "record" || target.container === "recordOvf") &&
         target.obj.type.kind === "dyn") {
@@ -8843,15 +9348,15 @@ export function fieldGetExpr(L, target, loc, blame) {
    * call). A write to a getter-only property never gets here in a clean
    * program (tsc's TS2540 is the fence); the rejection is the backstop. */
 export function fieldSetStmt(L, target, value, loc, blame) {
-    // A record-shaped CHECKER target whose receiver VALUE lives in the DOM:
+    // A record-shaped CHECKER target whose receiver VALUE lives in the checked-dynamic tree:
     // the checked-dynamic keyed write — dyn.keySet (later writes win,
     // insertion order; Node's TypeErrors on non-object receivers), the
-    // value converting into the DOM.
+    // value converting into the checked-dynamic tree.
     if ((target.container === "record" || target.container === "recordOvf") &&
         target.obj.type.kind === "dyn") {
         const v = L.coerceToExpected(value, DYN);
         if (v.type.kind !== "dyn") {
-            L.unsupported("SC1101", blame, `storing '${L.fmt(value.type)}' values in a checked-dynamic object (the value cannot convert into the DOM)`);
+            L.unsupported("SC1101", blame, `storing '${L.fmt(value.type)}' values in a checked-dynamic object (the value cannot convert into the checked-dynamic tree)`);
         }
         return {
             kind: "exprStmt",
@@ -8939,7 +9444,7 @@ export function lowerPromiseRejectCall(L, call, access) {
     const type = ctxT ? L.mapTypeOf(ctxT) : null;
     const reasonNode = call.arguments[0];
     // A CHECKED-DYNAMIC reason (`Promise.reject(value)` where value rode
-    // an untyped binding — the tracingChannel suite's shape): the DOM
+    // an untyped binding — the tracingChannel suite's shape): the checked-dynamic tree
     // value IS the rejection payload (the thrown-dyn representation, so
     // identity survives to catch/unhandledRejection observers), and the
     // result is promise<dyn> when no context names a concrete one.
@@ -9082,7 +9587,7 @@ export function lowerFieldCompound(L, access, op, rhsNode, loc) {
             const concat = {
                 kind: "strConcat",
                 // String-context read: JS's String(unknown) over the field —
-                // the JS-exact DOM walker, never a checked cast.
+                // the JS-exact dyn walker, never a checked cast.
                 left: { kind: "toString", operand: read, type: STRING, loc },
                 right: rhs,
                 type: STRING,