@scriptc/compiler 0.1.6 → 0.2.0

package/dist/frontend/lowering/lower-exprs.js

@@ -1,4 +1,6 @@
 import { InternalCompilerError } from "../../errors.js";
+import { literalValues } from "../literal-values.js";
+import { literalUnionArm } from "../union-discriminants.js";
 /* Expression lowering: the expression dispatch (lowerExpr), literals
  * (array/object/regex/template), operators (binary incl. compound targets,
  * unary, instanceof, caught-typeof tests), union narrowing and unit
@@ -6,16 +8,19 @@ import { InternalCompilerError } from "../../errors.js";
  * ToBoolean/ToString coercion helpers, and field/element reads and writes
  * (FieldTarget). */
 import * as ts from "../ts7/adapter.js";
-import { dirname, posix } from "node:path";
+import { dirname } from "node:path";
+import * as posix from "node:path/posix";
 import { pathToFileURL } from "node:url";
+import { OBJECT_CALLABLE_VALUES } from "./surfaces.js";
 import { wasiGuestPath } from "../../wasi-paths.js";
-import { BIGINT_T, BOOL, CAUGHT, DYN, DYN_HANDLE_KINDS, F64, JSVAL, NULL_T, REF_TRUTHY_KINDS, REGEX, RUNTIME_ERROR_CLASSES, SEARCH_PARAMS_T, STRING, UNDEFINED_T, VOID, arrayOf, canAdaptDynFuncTo, canBoxFuncIntoDyn, funcOf, isDynTypedRefType, isJsonSafeType, isSupportedArrayElem, isUnitType, jsOpResultKind, shapeHasAccessorSlots, typeEquals, typeKey, unionFuncSetArmsOk } from "../../ir/ir.js";
+import { BIGINT_T, BYTES_ELEMENT_NAME, BOOL, CAUGHT, DYN, DYN_HANDLE_KINDS, F64, JSVAL, NULL_T, REF_TRUTHY_KINDS, REGEX, RUNTIME_ERROR_CLASSES, SEARCH_PARAMS_T, STRING, UNDEFINED_T, VOID, arrayOf, canAdaptDynFuncTo, canDynCheckTo, canBoxFuncIntoDyn, funcOf, isDynTypedRefType, isSupportedArrayElem, isUnitType, jsOpResultKind, shapeHasAccessorSlots, typeEquals, typeKey, unionContainerArmsOk } from "../../ir/ir.js";
 import { cjsClassExprWholeExportOf, cjsExportAssignmentOf, cjsExportDiscardReason, isCjsExportTableLiteral, isCjsJsFile, isJsSourceFile, isModuleExportsAccess, isNodeEsmFile, locOf } from "../program.js";
 import { ARRAY_METHODS, builtinConstLit, builtinFenceHintOf, builtinModuleConstOf, builtinModulesArrayLit, builtinModuleFnOf, COMPOUND_ASSIGN_OPS, ISLAND_SURFACE, isChildSurfaceMember, MAP_METHODS, NARROW_FIRST, SET_METHODS, STRING_INDEX_METHODS, STR_METHODS, UNSUPPORTED_EXPR, sideEffectFreeOptionValue, stdlibGlobalNameOf } from "./surfaces.js";
-import { blockedBindingUseDiag, requiresDynamicPackageDiag, unsupportedDiag } from "../../diagnostics/diagnostic.js";
+import { UNSUPPORTED, blockedBindingUseDiag, requiresDynamicPackageDiag, unsupportedDiag } from "../../diagnostics/diagnostic.js";
 import { PoisonError, dynUndefinedExpr, jsFuncNameOf, neverTaintedJsType, nodeThrowExpr, own } from "./lowerer.js";
-import { lowerNpmStaticSafeIndexRead, lowerSafeIndexRead, strCharsCall, tryLowerNumericIndexRead } from "./lower-containers.js";
-import { arrayValueRead, arrayValueStore } from "./array-values.js";
+import { lowerCollectionSpread, lowerNpmStaticSafeIndexRead, lowerSafeIndexRead, strCharsCall, tryLowerNumericIndexRead } from "./lower-containers.js";
+import { arrayValueRead, arrayValueStore, arrayValueType } from "./array-values.js";
+import { lowerOptionalStringIndex } from "./string-index.js";
 import { tryLowerIndexedComparison } from "./indexed-comparison.js";
 import { npmStaticPackageOfPath } from "../npm-static.js";
 import { unsupportedModuleFeatureOf } from "../builtin-modules.js";
@@ -23,20 +28,32 @@ import { fenceEnumObjectValue, lowerEnumAccess } from "./lower-enums.js";
 import { ambientNsRootOf, ambientUndefReadType, ambientUndefVarRootOf, ambientUndefinedFnSymbolOf, contextualUndefReadType, fenceEarlyAliasUse, fenceEarlyNsMemberRef, lowerNsIdentifierValue, nsMemberIdentOf, nsUndefRead, nsWritableTarget } from "./lower-namespaces.js";
 import { expandoMemberRead, expandoWritableTarget } from "./lower-expando.js";
 import { lowerSocketInstanceOf, lowerTlsRootCertificates } from "./lower-server.js";
-import { findGenericMethodOn, lowerStaticFieldRead } from "./lower-classes.js";
+import { findGenericMethodOn, lowerStaticFieldRead, staticFieldWriteTarget, storedClassValueType } from "./lower-classes.js";
 import { bindingNeverReassigned, funcTypeFromParamShapes, implicitMonoFile, lowerTaggedTemplate, nullishGenericBindingUnitOf, objLitGenericFnInfoOf, objLitGenericFnNodeOf, requireObjLitGenericReceiver } from "./lower-calls.js";
 import { mixinFnOfCallee } from "./lower-mixins.js";
-import { isConstAssertionTypeNode, isGenericCallableMemberType, isParseArgsDynTypeName, underConstAssertion, unitOnlyUnion } from "../type-mapper.js";
+import { isConstAssertionTypeNode, isGenericCallableMemberType, isParseArgsDynTypeName, underConstAssertion, unitOnlyUnion, withUnitArm } from "../type-mapper.js";
 import { lowerYield } from "./lower-generators.js";
+import { errorToStringCall } from "./error-methods.js";
 import { lowerStreamProperty, lowerStreamStateProperty, streamSidesOf } from "./lower-stream.js";
 import { countedFor, numLit, varRef } from "../../ir/build.js";
+import { unionWideningTags } from "../../ir/analysis.js";
 import { isSafeToDiscard, isSafeToMoveConditionEarlier, isSafeToRepeat } from "./expressions/evaluation-safety.js";
+import { globalSymbolKey } from "./expressions/global-symbols.js";
+import { lowerShortCircuitAssignment } from "./expressions/nullish-assignment.js";
 import { hasOptionalChainGuard, isOptionalChainTail, isRequireMainFilename } from "./expressions/optional-chains.js";
 import { conditionalSpreadOf, foldedStringKeyOf } from "./expressions/object-literals.js";
 import { tryLowerExpression } from "./expressions/try-lower-expression.js";
 import { fenceNodeModuleMutation, isNodeModuleValue, lowerNodeModuleIdentifier, lowerNodeModuleProperty, lowerRequireCacheElement, lowerRequireCacheHas, lowerRequireMainProperty } from "./lower-node-module.js";
 import { lowerAbstractEquality } from "./abstract-equality.js";
 import { coerceStringSearchValue, defaultAfterUndefined, lowerStaticallyUndefinedArgument } from "./optional-arguments.js";
+import { recordTextCodecClass } from "../../ir/ir.js";
+import { classSymbolKeyOf } from "./symbol-fields.js";
+import { lowerClassMethodValue } from "./class-method-values.js";
+import { classInstanceOf } from "./class-dynamic-dispatch.js";
+import { lowerGlobalValue } from "./lower-global-value.js";
+import { lowerClassPrototypeData } from "./class-prototypes.js";
+import { lowerArrayIsArrayValue } from "./lower-builtin-values.js";
+import { lowerPerfHooksTypeof } from "./lower-builtins.js";
 /** A template piece's RAW text (String.raw's contract: escapes stay
  * characters). 7's client AST ships no rawText at runtime (the typing
  * declares it; the serialized node data omits it), so the raw span comes
@@ -313,6 +330,12 @@ function lowerExprInner(lowerer, expr) {
                         return !sf.isDeclarationFile && !sf.fileName.includes("/node_modules/");
                     });
                 if (projectDeclared) {
+                    // A spread already stored in the island must copy there too.
+                    // Later overrides can make the literal's own inferred shape
+                    // appear static without making that source a native record.
+                    if (ts.isObjectLiteralExpression(expr) && expr.properties.some((p) => ts.isSpreadAssignment(p) && lowerer.mapTypeOf(lowerer.typeOf(p.expression))?.kind === "jsval")) {
+                        return true;
+                    }
                     const own = lowerer.mapTypeOf(lowerer.typeOf(expr));
                     if (own?.kind === "record" || own?.kind === "array")
                         return false;
@@ -350,7 +373,7 @@ function lowerExprInner(lowerer, expr) {
             // null keeps the closure shape (function-shaped members, and the
             // conditional-spread arms where getters cannot combine).
             const islandMemberFence = (diagsBefore, err, valueNode, getterName = null) => {
-                if (!(err instanceof PoisonError) || !isJsSourceFile(expr.getSourceFile()))
+                if (!isJsSourceFile(expr.getSourceFile()))
                     throw err;
                 const fence = lowerer.deferToRuntimeFence(diagsBefore, valueNode, {
                     kind: "closure",
@@ -398,6 +421,8 @@ function lowerExprInner(lowerer, expr) {
                     // instance): func-typed values keep the call-time closure;
                     // data-shaped values fence at the read (the getter), unless a
                     // conditional spread owns the literal (getters cannot combine).
+                    if (!(err instanceof PoisonError))
+                        throw err;
                     const asGetter = value.type.kind !== "func" && spread === null;
                     const fence = islandMemberFence(diagsBefore, err, valueNode, asGetter ? name.text : null);
                     if (fence === null)
@@ -486,6 +511,8 @@ function lowerExprInner(lowerer, expr) {
                                 : null;
                 }
                 catch (err) {
+                    if (!(err instanceof PoisonError))
+                        throw err;
                     const nameText = name && (ts.isIdentifier(name) || ts.isStringLiteral(name)) ? name.text : null;
                     const asGetter = nameText !== null && spread === null && !funcShapedMember(prop);
                     value = islandMemberFence(valueDiagsBefore, err, prop, asGetter ? nameText : null);
@@ -551,6 +578,11 @@ function lowerExprInner(lowerer, expr) {
         return { kind: "jsOp", op: "arrLit", args, type: JSVAL, loc };
     }
     if (ts.isTypeOfExpression(expr)) {
+        if (lowerer.isStdlibGlobal(expr.expression, "process"))
+            return { kind: "strLit", value: "object", type: STRING, loc };
+        const performance = lowerPerfHooksTypeof(lowerer, expr.expression);
+        if (performance)
+            return performance;
         if (isNodeModuleValue(lowerer, expr.expression)) {
             return { kind: "strLit", value: "object", type: STRING, loc };
         }
@@ -580,8 +612,14 @@ function lowerExprInner(lowerer, expr) {
         // every function and constructor global is "function" (the harness's
         // `typeof queueMicrotask === 'function'` probes). Shadowing locals
         // have non-stdlib symbols and keep the ordinary path.
-        if (ts.isIdentifier(expr.expression)) {
-            const sym = lowerer.checker.getSymbolAtLocation(expr.expression);
+        let tested = expr.expression;
+        while (ts.isParenthesizedExpression(tested))
+            tested = tested.expression;
+        if (ts.isIdentifier(tested)) {
+            const sym = lowerer.checker.getSymbolAtLocation(tested);
+            if (!sym && !lowerer.dynamic) {
+                return { kind: "strLit", value: "undefined", type: STRING, loc };
+            }
             if (lowerer.isStdlibSymbol(sym)) {
                 const t = lowerer.typeOf(expr.expression);
                 if (lowerer.checker.getCallSignatures(t).length > 0 ||
@@ -590,11 +628,9 @@ function lowerExprInner(lowerer, expr) {
                 }
             }
         }
-        // Island values ask the engine; static primitives constant-fold to
-        // the JS answer (the operand still evaluates — JS evaluates typeof
-        // operands too — but primitives here are side-effect-free varRefs/
-        // literals after lowering, so folding away the value is safe only
-        // when the operand is trivial; otherwise keep it simple and reject).
+        // A known static result type fixes typeof's answer, but its producer
+        // still evaluates: calls, getters, and checked reads can have effects
+        // or throw. Only trivial operands may disappear.
         let operand = lowerer.lowerExpr(expr.expression);
         if (operand.type.kind === "jsval") {
             return { kind: "jsOp", op: "typeof", args: [operand], type: STRING, loc };
@@ -612,13 +648,16 @@ function lowerExprInner(lowerer, expr) {
             array: "object", object: "object", record: "object",
             symbol: "symbol",
             map: "object", set: "object", promise: "object", bytes: "object",
-            regexp: "object", generator: "object", classval: "function",
+            regex: "object", generator: "object", classval: "function",
             moduleNs: "object",
             undefinedT: "undefined", nullT: "object",
         };
         const folded = FOLD[operand.type.kind];
-        if (folded && isSafeToDiscard(operand)) {
-            return { kind: "strLit", value: folded, type: STRING, loc };
+        if (folded) {
+            const result = { kind: "strLit", value: folded, type: STRING, loc };
+            return isSafeToDiscard(operand) ? result : {
+                kind: "seqExpr", stmts: [{ kind: "exprStmt", expr: operand, loc }], result, type: STRING, loc,
+            };
         }
         // A union operand: every arm's typeof answer is static, so the value
         // form is a ternary chain over runtime TAG tests (arms grouped by
@@ -653,6 +692,9 @@ function lowerExprInner(lowerer, expr) {
         lowerer.unsupported("SC1090", expr, "typeof expressions on statically-typed values");
     }
     if (ts.isIdentifier(expr)) {
+        if (lowerer.isStdlibGlobal(expr, "console")) {
+            return { kind: "libCall", fn: "console.native", args: [], type: DYN, loc };
+        }
         const moduleValue = lowerNodeModuleIdentifier(lowerer, expr);
         if (moduleValue)
             return moduleValue;
@@ -676,7 +718,7 @@ function lowerExprInner(lowerer, expr) {
             }
             if (projection?.kind === "builtin-function") {
                 if (!isJsSourceFile(expr.getSourceFile())) {
-                    const callable = lowerer.lowerBuiltinCallableValue(projection, loc);
+                    const callable = lowerer.lowerBuiltinCallableValue({ module: projection.module, member: projection.member }, loc);
                     if (callable)
                         return callable;
                 }
@@ -688,6 +730,21 @@ function lowerExprInner(lowerer, expr) {
         // bridges the tagged representation with a unionNarrow.
         const local = lowerer.resolveLocal(expr);
         if (local) {
+            // A switch can dispatch past a lexical declaration. Keep this
+            // previously refused codec form out until switch-scope TDZ boxes
+            // model that skipped initialization, including value aliases.
+            if (local.type.kind === "record" && recordTextCodecClass(lowerer.shapes.get(local.type.shapeId)) !== null) {
+                const symbol = lowerer.resolveValueSymbol(expr);
+                const decl = symbol ? lowerer.checker.valueDeclarationOf(symbol) : undefined;
+                if (decl && ts.isVariableDeclaration(decl) && ts.isVariableDeclarationList(decl.parent)
+                    && (decl.parent.flags & ts.NodeFlags.BlockScoped) !== 0 && ts.isVariableStatement(decl.parent.parent)) {
+                    const clause = decl.parent.parent.parent;
+                    if ((ts.isCaseClause(clause) || ts.isDefaultClause(clause))
+                        && !(expr.getStart() >= clause.getStart() && expr.end <= clause.end)) {
+                        lowerer.unsupported("SC1090", expr, "codec bindings read from another switch clause before initialization is proven");
+                    }
+                }
+            }
             if (local.type.kind === "caught")
                 return lowerer.caughtRead(expr, local, loc);
             const symbol = lowerer.resolveValueSymbol(expr);
@@ -696,7 +753,7 @@ function lowerExprInner(lowerer, expr) {
             const arithmetic = lowerer.runtimeOptionalArithmeticLocals.has(runtimeOptionalRoot);
             const captured = !!symbol &&
                 lowerer.runtimeOptionalStorageLocals.has(runtimeOptionalRoot) &&
-                (lowerer.ctx.captureBySymbol.get(symbol) === local || runtimeOptionalRoot !== local);
+                (local.boxed === true || lowerer.ctx.captureBySymbol.get(symbol) === local || runtimeOptionalRoot !== local);
             if (arithmetic && !runtimeOptionalUseOf(expr)) {
                 return { kind: "varRef", localId: local.id, type: local.type, loc };
             }
@@ -737,7 +794,24 @@ function lowerExprInner(lowerer, expr) {
                 }
                 return { kind: "varRef", localId: local.id, type: local.type, loc };
             }
-            return lowerer.maybeNarrow({ kind: "varRef", localId: local.id, type: local.type, loc }, expr);
+            const narrowed = lowerer.maybeNarrow({ kind: "varRef", localId: local.id, type: local.type, loc }, expr);
+            if (narrowed.type.kind === "union" && lowerer.runtimeOptionalStorageLocals.has(runtimeOptionalRoot) &&
+                lowerer.mapTypeOf(lowerer.typeOf(expr))?.kind === "record") {
+                // A presence guard can be followed by a predicate strengthening
+                // the record's fields. Its refined shape is not a stored union
+                // arm: extract the original layout before reading a member.
+                const use = runtimeOptionalUseOf(expr);
+                if (use && !use.complex && !use.optional) {
+                    if (use.kind === "property")
+                        return runtimeOptionalReceiverRead(lowerer, expr, local, use.access.name.text, loc);
+                    if (use.kind === "element") {
+                        const key = runtimeOptionalElementKey(use.access.argumentExpression);
+                        if (key !== null)
+                            return runtimeOptionalReceiverRead(lowerer, expr, local, key, loc);
+                    }
+                }
+            }
+            return narrowed;
         }
         // `import x = N.y` aliases resolve transparently through globalOf/
         // fnSigOf below; their source-order guards live here (a no-op for
@@ -774,6 +848,7 @@ function lowerExprInner(lowerer, expr) {
                     lowerer.unions.get(g.type.unionId).arms.some((a) => a.kind === "string");
                 if (!arithmeticUnion && g.type.kind === "union" && narrowed && narrowed.kind !== "union" &&
                     !isUnitType(narrowed) &&
+                    !(narrowed.kind === "record" && recordTextCodecClass(lowerer.shapes.get(narrowed.shapeId)) !== null) &&
                     narrowed.kind !== "f64" && narrowed.kind !== "string" && narrowed.kind !== "bool" &&
                     lowerer.armTag(g.type.unionId, narrowed) >= 0) {
                     const helper = lowerer.narrowedArmHelper(g.type.unionId, narrowed, loc);
@@ -817,7 +892,7 @@ function lowerExprInner(lowerer, expr) {
         if ((expr.text === "__dirname" || expr.text === "__filename") &&
             lowerer.isStdlibGlobal(expr, expr.text)) {
             const sf = expr.getSourceFile();
-            if (isNodeEsmFile(sf)) {
+            if (isNodeEsmFile(sf, lowerer.program)) {
                 lowerer.unsupported("SC1090", expr, `'${expr.text}' in an ES module (Node defines the CJS module globals only in CommonJS modules)`);
             }
             // The WASI runner mounts the host cwd at guest `/` and the host temp
@@ -899,17 +974,17 @@ function lowerExprInner(lowerer, expr) {
                     if (roots)
                         return roots;
                 }
-                // JavaScript sources: a builtin member taken as a bare VALUE is
-                // the same identity-token story as stdlib globals above (the
-                // harness adds worker_threads.Worker to its identity Set).
-                if (isJsSourceFile(expr.getSourceFile())) {
-                    return { kind: "strLit", value: `[builtin ${bi.module}.${bi.member}]`, type: STRING, loc };
-                }
                 {
                     const callable = lowerer.lowerBuiltinCallableValue(bi, loc);
                     if (callable)
                         return callable;
                 }
+                // JavaScript sources: an otherwise unsupported builtin VALUE is
+                // the same identity-token story as stdlib globals above (the
+                // harness adds worker_threads.Worker to its identity Set).
+                if (isJsSourceFile(expr.getSourceFile())) {
+                    return { kind: "strLit", value: `[builtin ${bi.module}.${bi.member}]`, type: STRING, loc };
+                }
                 if (builtinModuleFnOf(lowerer, bi.module, bi.member)) {
                     lowerer.unsupported("SC1090", expr, `library functions as values (call '${expr.text}' directly)`);
                 }
@@ -999,6 +1074,9 @@ function lowerExprInner(lowerer, expr) {
         // global, one token; what a token cannot do (be called, answer
         // typeof "function") meets per-site fences/divergences, and
         // SEMANTICS.md documents the stance.
+        if (!lowerer.dynamic && stdlibGlobalNameOf(lowerer, expr) === "globalThis") {
+            return lowerGlobalValue(lowerer, expr);
+        }
         {
             const sym = lowerer.checker.getSymbolAtLocation(expr);
             if (lowerer.isStdlibSymbol(sym) || expr.text === "globalThis") {
@@ -1006,14 +1084,21 @@ function lowerExprInner(lowerer, expr) {
                     const canonical = stdlibGlobalNameOf(lowerer, expr) ?? expr.text;
                     return { kind: "strLit", value: `[builtin ${canonical}]`, type: STRING, loc };
                 }
+                // In a dynamic TypeScript build, the real global object is the
+                // escape hatch for host capabilities without static lowering.
+                // Direct globalThis.member uses still take their static surface
+                // paths; an explicit `as any` or `: any` can reach engine ops.
+                if (lowerer.dynamic && expr.text === "globalThis") {
+                    return { kind: "jsOp", op: "globalGet", name: "globalThis", args: [], type: JSVAL, loc };
+                }
                 // The families with a WHY: each hint states what makes the
                 // surface genuinely non-static (or what to use instead).
                 const globalHints = {
-                    Proxy: "property-access metaprogramming has no static lowering (every property read must resolve at compile time)",
+                    Proxy: "Proxy constructor values have no native lowering; use a direct new Proxy with checked-native plain objects",
                     Reflect: "reflective property access has no static lowering — read and call members directly",
-                    Intl: "locale- and ICU-backed behavior lives outside the static runtime (the localeCompare stance: code-unit order, no collation/locale data) — what lowers: the composed new Intl.NumberFormat(\"en-US\").format(x) and x.toLocaleString(\"en-US\") with default options",
+                    Intl: "native Intl supports default Unicode grapheme segmentation and the composed new Intl.NumberFormat(\"en-US\").format(x); locale negotiation and other ICU-backed operations remain unsupported",
                     SharedArrayBuffer: "no shared-memory threads exist in a compiled program — Uint8Array is the byte storage",
-                    ArrayBuffer: "no free-standing ArrayBuffer value exists — typed arrays own their storage (new Uint8Array(n) allocates; new Uint8Array(new ArrayBuffer(n)) erases the buffer into the view)",
+                    ArrayBuffer: "ArrayBuffer constructor values have no native lowering; use new ArrayBuffer(length) for fixed-length shared storage",
                     WeakRef: "deref()-after-collect exposes GC timing — genuinely dynamic; hold a strong reference instead",
                     FinalizationRegistry: "finalization callbacks expose GC timing — genuinely dynamic; release resources explicitly instead",
                     eval: "runtime code evaluation cannot be compiled ahead of time",
@@ -1363,6 +1448,14 @@ function lowerExprInner(lowerer, expr) {
     if (ts.isConditionalExpression(expr))
         return lowerTernary(lowerer, expr);
     if (ts.isPropertyAccessExpression(expr)) {
+        // Expando statics may still be absent even when JS inference sees
+        // the eventual assignment's scalar type. Preserve the checked value.
+        const staticField = lowerStaticFieldRead(lowerer, expr);
+        if (staticField)
+            return staticField;
+        const prototypeData = lowerClassPrototypeData(lowerer, expr);
+        if (prototypeData)
+            return prototypeData;
         // `super.x`: the base chain's GETTER, called directly (super
         // dispatch is static in JS — never through the dynamic class).
         // super.method() calls are routed at the call site; a bare super
@@ -1404,6 +1497,25 @@ function lowerExprInner(lowerer, expr) {
         const moduleProperty = lowerNodeModuleProperty(lowerer, expr);
         if (moduleProperty)
             return moduleProperty;
+        if (stdlibGlobalNameOf(lowerer, expr.expression) === "Symbol" &&
+            ["iterator", "asyncIterator", "toStringTag", "toPrimitive", "hasInstance", "isConcatSpreadable", "match", "matchAll", "replace", "search", "split", "species", "unscopables", "dispose", "asyncDispose"].includes(expr.name.text)) {
+            return { kind: "libCall", fn: "sym.wellKnown", args: [{ kind: "strLit", value: expr.name.text, type: STRING, loc }], type: { kind: "symbol" }, loc };
+        }
+        if (lowerer.stdlibGlobalMember(expr, "globalThis") === "console") {
+            return { kind: "libCall", fn: "console.native", args: [], type: DYN, loc };
+        }
+        if (lowerer.stdlibGlobalMember(expr, "console") !== null) {
+            return { kind: "dynKeyGet", value: { kind: "libCall", fn: "console.native", args: [], type: DYN, loc },
+                key: { kind: "strLit", value: expr.name.text, type: STRING, loc }, type: DYN, loc };
+        }
+        // Missing host globals (Bun/Deno capability probes) have no binding
+        // in a native program. Declared globals retain their own lowering;
+        // arbitrary global-object mutation remains fenced. Preserve a dyn
+        // undefined value so stored probes compose with optional calls.
+        if (!lowerer.dynamic && stdlibGlobalNameOf(lowerer, expr.expression) === "globalThis" &&
+            !lowerer.checker.getPropertyOfType(lowerer.typeOf(expr.expression), expr.name.text)) {
+            return { kind: "dynFrom", value: { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc }, type: DYN, loc };
+        }
         if (expr.questionDotToken && expr.name.text === "electron") {
             const processProperty = lowerer.lowerProcessProperty(expr);
             if (processProperty)
@@ -1420,6 +1532,12 @@ function lowerExprInner(lowerer, expr) {
         if (!expr.questionDotToken && isOptionalChainTail(lowerer, expr)) {
             return lowerer.lowerOptionalChain(expr);
         }
+        // Known Web handles retain their declared surface even when their
+        // storage uses checked values. Apply this before generic reads.
+        lowerer.fenceStaticAbortControllerMemberRead(expr);
+        lowerer.fenceStaticResponseMember(expr, "read");
+        lowerer.fenceStaticHeadersMember(expr, "read");
+        lowerer.fenceStaticReadableStreamMember(expr, "read");
         // Island receiver: o.x is an engine property read (getProp may throw
         // — reading off null/undefined — bridged catchably like everything
         // at the boundary). `o?.x` arrives here too, through the chain
@@ -1559,11 +1677,11 @@ function lowerExprInner(lowerer, expr) {
         // resolve unconditionally — they run after the module evaluated,
         // the same approximation identifier exports already make. Every
         // other module.exports read keeps its existing story.
-        if (!expr.questionDotToken && isModuleExportsAccess(expr) && isCjsJsFile(expr.getSourceFile())) {
+        if (!expr.questionDotToken && isModuleExportsAccess(expr) && isCjsJsFile(expr.getSourceFile(), lowerer.program)) {
             const whole = cjsClassExprWholeExportOf(expr.getSourceFile());
             if (whole) {
                 let inBody = false;
-                for (let p = expr.parent; !ts.isSourceFile(p); p = p.parent) {
+                for (let p = expr.parent; p !== undefined && !ts.isSourceFile(p); p = p.parent) {
                     if (ts.isFunctionLike(p) || ts.isClassDeclaration(p) || ts.isClassExpression(p)) {
                         inBody = true;
                         break;
@@ -1591,7 +1709,7 @@ function lowerExprInner(lowerer, expr) {
             const writePos = ts.isBinaryExpression(expr.parent) &&
                 expr.parent.left === expr &&
                 expr.parent.operatorToken.kind === ts.SyntaxKind.EqualsToken;
-            if (!expr.questionDotToken && cjsMemberRecv && !writePos && isCjsJsFile(sf)) {
+            if (!expr.questionDotToken && cjsMemberRecv && !writePos && isCjsJsFile(sf, lowerer.program)) {
                 const sym = lowerer.checker.getSymbolAtLocation(expr.name) ??
                     lowerer.cjsModuleExportSymbol(sf, expr.name.text);
                 const resolved = sym !== undefined && sym.flags & ts.SymbolFlags.Alias
@@ -1713,6 +1831,8 @@ function lowerExprInner(lowerer, expr) {
             isJsSourceFile(expr.getSourceFile())) {
             const canonical = stdlibGlobalNameOf(lowerer, expr);
             if (canonical !== null) {
+                if (!lowerer.dynamic && canonical === "globalThis")
+                    return lowerGlobalValue(lowerer, expr);
                 return { kind: "strLit", value: `[builtin ${canonical}]`, type: STRING, loc };
             }
         }
@@ -1736,6 +1856,7 @@ function lowerExprInner(lowerer, expr) {
         // instead.
         if ((isJsSourceFile(expr.getSourceFile()) &&
             (lowerer.mapTypeOf(lowerer.typeOf(expr.expression)) === null ||
+                (lowerer.typeOf(expr.expression).flags & ts.TypeFlags.Never) !== 0 ||
                 // A never-tainted receiver type maps (never rides as f64) but
                 // its VALUE lowered checked-dynamic — same dyn read.
                 neverTaintedJsType(lowerer, expr.expression, lowerer.typeOf(expr.expression)))) ||
@@ -1749,6 +1870,11 @@ function lowerExprInner(lowerer, expr) {
                 const opt = hasOptionalChainGuard(expr.expression);
                 return lowerer.maybeNarrow({ kind: "dynKeyGet", key, ...(opt ? { optional: true } : {}), value: recv, type: DYN, loc }, expr);
             }
+            if (expr.name.text === "length" && (recv.type.kind === "array" || recv.type.kind === "string")) {
+                return recv.type.kind === "array"
+                    ? { kind: "arrIntrinsic", method: "length", receiver: recv, args: [], type: F64, loc }
+                    : { kind: "strIntrinsic", method: "length", receiver: recv, args: [], type: F64, loc };
+            }
         }
         // `f.name` / `f.length` / own properties on a FUNCTION-typed JS
         // value (the mustCall wrapper's function-instance members): read
@@ -1757,11 +1883,24 @@ function lowerExprInner(lowerer, expr) {
         // best-effort static name and the declared arity; anything else is
         // the own-property answer, undefined. Function.prototype METHOD
         // names stay fenced (a stored-member undefined would mis-answer
-        // `f.call` as a value). JS files only; TS keeps the fence.
-        if (!["apply", "bind", "call", "toString", "constructor", "prototype", "caller", "arguments"].includes(expr.name.text) &&
-            isJsSourceFile(expr.getSourceFile())) {
+        // `f.call` as a value). Static callable values keep the existing TS fence; checked callable
+        // storage can expose its own name and length in both source languages.
+        if (!["apply", "bind", "call", "toString", "caller", "arguments"].includes(expr.name.text) &&
+            (isJsSourceFile(expr.getSourceFile()) || expr.name.text === "name" || expr.name.text === "length" || expr.name.text === "constructor")) {
             const probed = tryLowerExpression(lowerer, expr.expression);
-            if (probed?.type.kind === "func" &&
+            // Inferred callable returns can use checked storage even when the
+            // checker still describes a function. Read its actual dyn value;
+            // the ambient Function member must not hide its own properties.
+            const receiverType = lowerer.typeOf(expr.expression);
+            const receiverSymbol = receiverType.getSymbol();
+            const checkedFunction = lowerer.checker.getCallSignatures(receiverType).length > 0 ||
+                (receiverSymbol?.name === "Function" && lowerer.isStdlibSymbol(receiverSymbol));
+            if (probed?.type.kind === "dyn" && checkedFunction) {
+                const key = { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) };
+                const opt = hasOptionalChainGuard(expr.expression);
+                return lowerer.maybeNarrow({ kind: "dynKeyGet", key, value: probed, ...(opt ? { optional: true } : {}), type: DYN, loc }, expr);
+            }
+            if ((isJsSourceFile(expr.getSourceFile()) || expr.name.text === "constructor") && probed?.type.kind === "func" &&
                 canBoxFuncIntoDyn(probed.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
                 const fnName = jsFuncNameOf(expr.expression);
                 const boxed = {
@@ -1816,7 +1955,10 @@ function lowerExprInner(lowerer, expr) {
         // the generic dyn receiver path below. Provenance is limited to the
         // node:util parseArgs family; every other stdlib member keeps its
         // ordinary surface fence.
-        if (isParseArgsDynProperty(lowerer, expr)) {
+        const segmentDataSymbol = lowerer.typeOf(expr.expression).getSymbol();
+        const segmentDataProperty = segmentDataSymbol?.name === "SegmentData" && lowerer.isStdlibSymbol(segmentDataSymbol) &&
+            ["segment", "index", "input", "isWordLike"].includes(expr.name.text);
+        if (isParseArgsDynProperty(lowerer, expr) || segmentDataProperty) {
             const recv = lowerer.lowerExpr(expr.expression);
             if (recv.type.kind === "dyn") {
                 const key = {
@@ -1850,10 +1992,6 @@ function lowerExprInner(lowerer, expr) {
         // The lib fence's PROPERTY chokepoint: a stdlib-declared member that
         // no lowering above claimed ([1,2].entries, Math.SQRT2, Promise.all,
         // re.exec as a value, ...) reports SC2020 here.
-        lowerer.fenceStaticAbortControllerMemberRead(expr);
-        lowerer.fenceStaticResponseMember(expr, "read");
-        lowerer.fenceStaticHeadersMember(expr, "read");
-        lowerer.fenceStaticReadableStreamMember(expr, "read");
         lowerer.stdlibMemberFence(expr);
         // The npm chokepoint: a member on a package-typed receiver in a
         // static build — attributed to the package, like every other site.
@@ -1912,6 +2050,17 @@ function lowerExprInner(lowerer, expr) {
                     loc,
                 }, expr);
             }
+            // An inferred package-JS call specializes a parameter to the
+            // caller's own record shape. Optional option names omitted by that
+            // caller read undefined; the missing field is not a failed type
+            // assertion. Known prototype members were handled/fenced above.
+            if (recvShape && !recvShape.tuple && lowerer.implicitParamTypes !== null &&
+                isJsSourceFile(expr.getSourceFile()) && npmStaticPackageOfPath(expr.getSourceFile().fileName) !== null) {
+                return {
+                    kind: "seqExpr", stmts: [{ kind: "exprStmt", expr: recvLowered, loc }],
+                    result: dynUndefinedExpr(loc), type: DYN, loc,
+                };
+            }
         }
         // An ABSTRACT property through an abstract-typed receiver: the
         // declaration is erased at runtime — Node defines no field for it,
@@ -1921,6 +2070,19 @@ function lowerExprInner(lowerer, expr) {
         if (recvLowered.type.kind === "object" && abstractPropertyDeclOf(lowerer, expr)) {
             lowerer.unsupported("SC1090", expr, `reading the abstract property '${expr.name.text}' through a '${lowerer.checker.typeToString(lowerer.typeOf(expr.expression))}'-typed receiver (abstract property declarations are erased at runtime, so no shared slot exists — type the receiver as the concrete class, or declare an abstract getter instead)`);
         }
+        // Array reads may add an undefined arm even when the checker still
+        // reports a class. Its property bag must remain reachable, while
+        // an absent element takes the normal checked-value TypeError.
+        const nativeReceiver = lowerer.stripUndefinedArm(recvLowered.type);
+        if (isDynTypedRefType(nativeReceiver)) {
+            const info = lowerer.classes.get(nativeReceiver.className);
+            if (info && !info.def.runtime && !info.builtinError && !info.builtinEmitter && !info.builtinStream) {
+                return lowerer.maybeNarrow({
+                    kind: "dynKeyGet", value: lowerer.coerceToExpected(recvLowered, DYN),
+                    key: { kind: "strLit", value: expr.name.text, type: STRING, loc }, type: DYN, loc,
+                }, expr);
+            }
+        }
         lowerer.unsupported("SC1090", expr, `reading '${expr.name.text}' from a value of type '${lowerer.checker.typeToString(lowerer.typeOf(expr.expression))}'`);
     }
     // Meta-properties, named: `new.target` reflects HOW a function was
@@ -1937,7 +2099,7 @@ function lowerExprInner(lowerer, expr) {
     const entry = UNSUPPORTED_EXPR[expr.kind];
     if (entry)
         lowerer.unsupported(entry.code, expr, entry.feature);
-    lowerer.unsupported("SC1090", expr, `syntax '${ts.SyntaxKind[expr.kind]}'`);
+    lowerer.unsupported("SC1090", expr, `syntax '${ts.syntaxKindName(expr.kind)}'`);
 }
 function moduleFileName(lowerer, sf) {
     return lowerer.targetPlatform === "wasi"
@@ -1976,11 +2138,10 @@ function importMetaProperty(lowerer, expr) {
             return null;
     }
 }
-/** `c ? a : b` — see the inline comments. `expected` plays the contextual
-   * array type's role when the caller knows the slot's array type and tsc's
-   * API doesn't surface it (a ternary as a SPREAD source — lowerArrayLiteral
-   * threads the literal's own type in). */
-function lowerTernary(lowerer, expr, expected) {
+/** `c ? a : b`. An explicit destination constructs each branch at that
+ * layout before joining it. Without one, retain the expression's inferred
+ * type and the contextual/sibling rules below. */
+export function lowerTernary(lowerer, expr, expected) {
     const loc = locOf(expr);
     // `Array.isArray(x) ? x : [x]` over a `T | readonly T[]` union: tsc
     // narrows the TRUE branch to `any[]` (maybeNarrow's isArray bridge
@@ -2034,7 +2195,16 @@ function lowerTernary(lowerer, expr, expected) {
         // literals) sit untaken in compiled JS. A boolLit carries no
         // effects, so dropping the condition read loses nothing.
         if (cond.kind === "boolLit") {
-            return lowerer.lowerExpr(cond.value ? expr.whenTrue : expr.whenFalse);
+            return lowerer.lowerExprExpecting(cond.value ? expr.whenTrue : expr.whenFalse, expected);
+        }
+        if (expected) {
+            // Construct fresh literals in their actual destination. Joining
+            // inferred layouts first can erase the literal discriminator or
+            // choose an empty array's uninhabited element representation.
+            // Runtime-optional proofs apply only within the selected true arm.
+            const then = withRuntimeOptionalNarrowed(lowerer, runtimeOptionalTrueIds(lowerer, expr.condition), () => lowerer.lowerExprExpecting(expr.whenTrue, expected));
+            const else_ = lowerer.lowerExprExpecting(expr.whenFalse, expected);
+            return { kind: "ternary", cond, then, else_, type: expected, loc };
         }
         const ctxTs = lowerer.checker.getContextualType(expr);
         const ctxMapped = ctxTs ? lowerer.mapTypeOf(ctxTs) : null;
@@ -2051,7 +2221,7 @@ function lowerTernary(lowerer, expr, expected) {
         // lowerArrayLiteral, and just as unambiguous — tsc already typed the
         // whole ternary by the filled arm alone. Both arms empty stays
         // fenced (no element type exists anywhere).
-        const ctxArray = expected ?? (ctxMapped?.kind === "array" ? ctxMapped : null);
+        const ctxArray = ctxMapped?.kind === "array" ? ctxMapped : null;
         const armLiteral = (e) => {
             let x = e;
             while (ts.isParenthesizedExpression(x))
@@ -2075,7 +2245,21 @@ function lowerTernary(lowerer, expr, expected) {
             }
             return false;
         };
+        // Inferred signature tables often join a populated argument array
+        // with nested empty-array branches. Carry the whole record layout
+        // through those branches before constructing their fresh fields.
+        const ownJoin = lowerer.mapTypeOf(lowerer.typeOf(expr));
+        const recordJoin = ctxMapped?.kind === "record" ? ctxMapped :
+            ownJoin?.kind === "record" ? ownJoin : undefined;
         const lowerArm = (e, siblingType) => {
+            let fresh = e;
+            while (ts.isParenthesizedExpression(fresh))
+                fresh = fresh.expression;
+            if (recordJoin && ts.isConditionalExpression(fresh))
+                return lowerTernary(lowerer, fresh, recordJoin);
+            if (recordJoin && ts.isObjectLiteralExpression(fresh)) {
+                return lowerer.lowerObjectLiteral(fresh, recordJoin);
+            }
             const lit = armLiteral(e);
             if (lit && ctxArray)
                 return lowerer.lowerArrayLiteral(lit, ctxArray);
@@ -2128,11 +2312,14 @@ function lowerTernary(lowerer, expr, expected) {
         const lowerTrueArm = () => withRuntimeOptionalNarrowed(lowerer, runtimeTrueIds, () => lowerArm(expr.whenTrue, ownArrayJoin ?? undefined));
         if (!ctxArray && emptyUntypedArrayArm(expr.whenTrue) && !emptyUntypedArrayArm(expr.whenFalse)) {
             elseRaw = lowerer.lowerExpr(expr.whenFalse);
-            thenRaw = withRuntimeOptionalNarrowed(lowerer, runtimeTrueIds, () => lowerArm(expr.whenTrue, elseRaw.type));
+            thenRaw = withRuntimeOptionalNarrowed(lowerer, runtimeTrueIds, () => lowerArm(expr.whenTrue, elseRaw.type.kind === "dyn" && ownArrayJoin ? ownArrayJoin : elseRaw.type));
         }
         else {
             thenRaw = lowerTrueArm();
-            elseRaw = lowerArm(expr.whenFalse, thenRaw.type);
+            // A checked-dynamic producer (Object.entries(...).filter(...))
+            // can still have a precise checker array type. Empty literal arms
+            // must adopt that element layout before the checked array boundary.
+            elseRaw = lowerArm(expr.whenFalse, thenRaw.type.kind === "dyn" && ownArrayJoin ? ownArrayJoin : thenRaw.type);
         }
         // The ternary's IR type is normally the checker's own: it collapses
         // same-kind literal unions ("a" | "b" → string) and forms tagged
@@ -2204,14 +2391,22 @@ function lowerTernary(lowerer, expr, expected) {
                 }
             }
         }
-        const type = thenRaw.type.kind === "array" && typeEquals(thenRaw.type, elseRaw.type)
-            ? thenRaw.type
-            : dynJoin
-                ? DYN
-                : (anyJoin ??
-                    (useCtx && ctxMapped
-                        ? ctxMapped
-                        : lowerer.irTypeOf(expr)));
+        // JavaScript function selection preserves the chosen closure's full
+        // call ABI. A checker join can erase a rest/arguments pack even though
+        // a later call supplies additional observable arguments.
+        const callableJoin = isJsSourceFile(expr.getSourceFile()) &&
+            thenRaw.type.kind === "func" && elseRaw.type.kind === "func" &&
+            !typeEquals(thenRaw.type, elseRaw.type) &&
+            lowerer.dynConvertible(thenRaw.type) && lowerer.dynConvertible(elseRaw.type);
+        const type = callableJoin ? DYN :
+            thenRaw.type.kind === "array" && typeEquals(thenRaw.type, elseRaw.type)
+                ? thenRaw.type
+                : dynJoin
+                    ? DYN
+                    : (anyJoin ??
+                        (useCtx && ctxMapped
+                            ? ctxMapped
+                            : lowerer.irTypeOf(expr)));
         // Each arm flows into the ternary's type through the slot-coercion
         // path: union arms wrap, dyn slots reject the non-dyn arm with
         // SC1101, mismatched record shapes get SC2002; coerceInto is
@@ -2240,6 +2435,16 @@ function lowerTernary(lowerer, expr, expected) {
    * unrepresentable without a re-tag), or to nothing (`never` in an
    * exhaustive default) leaves the expression union-typed. */
 export function maybeNarrow(lowerer, expr, node) {
+    if ((expr.type.kind === "union" || expr.type.kind === "dyn") &&
+        isJsSourceFile(node.getSourceFile()) && ts.isPropertyAccessExpression(node)) {
+        const symbol = lowerer.checker.getSymbolAtLocation(node.name);
+        if (symbol && lowerer.checker.declarationsOf(symbol).some((decl) => ts.isPropertyDeclaration(decl) && !decl.initializer && !decl.type &&
+            isJsSourceFile(decl.getSourceFile()))) {
+            // Inference describes later writes, not the initial undefined.
+            // A use that requires the inferred type must validate the value.
+            return expr.type.kind === "dyn" ? expr : { kind: "dynFrom", value: expr, type: DYN, loc: expr.loc };
+        }
+    }
     // A dyn read tsc narrowed to a SCALAR (a typeof test proved the kind):
     // bridge with a VALIDATED extraction — dynCheck, the checked-cast
     // machinery — rather than a trusted one. After the guard the check
@@ -2247,15 +2452,40 @@ export function maybeNarrow(lowerer, expr, node) {
     // instead of misreading the payload (the dyn boundary's usual stance).
     // Object/array narrowings stay dyn-typed and keep their fences.
     if (expr.type.kind === "dyn") {
+        if (isJsSourceFile(node.getSourceFile()) && ts.isIdentifier(node)) {
+            const symbol = lowerer.resolveValueSymbol(node);
+            if (symbol && lowerer.checker.declarationsOf(symbol).some((decl) => {
+                if (!ts.isParameter(decl) || decl.type)
+                    return false;
+                const fn = decl.parent;
+                if (!ts.isFunctionExpression(fn) && !ts.isArrowFunction(fn))
+                    return false;
+                const assignment = fn.parent;
+                return ts.isBinaryExpression(assignment) && assignment.right === fn &&
+                    ts.isPropertyAccessExpression(assignment.left) && assignment.left.name.text === "write" &&
+                    lowerer.isStdlibMember(assignment.left);
+            }))
+                return expr;
+        }
+        // Node's TTY declarations promise booleans/numbers even when a pipe
+        // has no such property. Preserve the checked read for JS capability
+        // probes instead of treating a declaration as a runtime type guard.
+        if (isJsSourceFile(node.getSourceFile()) && ts.isPropertyAccessExpression(node) &&
+            ["isTTY", "columns", "rows"].includes(node.name.text) && lowerer.isStdlibMember(node))
+            return expr;
+        // A null-initialized JS field can later receive an object even when
+        // checker flow calls its non-null branch never. The live checked
+        // value remains authoritative; never is not a numeric guard.
+        if (isJsSourceFile(node.getSourceFile()) && (lowerer.typeOf(node).flags & ts.TypeFlags.Never) !== 0)
+            return expr;
         const narrowed = lowerer.mapTypeOf(lowerer.typeOf(node));
         if (narrowed &&
-            (narrowed.kind === "f64" || narrowed.kind === "bool" || narrowed.kind === "string")) {
+            (narrowed.kind === "f64" || narrowed.kind === "bool" || narrowed.kind === "string" || narrowed.kind === "bigint")) {
             return { kind: "dynCheck", value: expr, type: narrowed, loc: expr.loc };
         }
-        // An `instanceof Uint8Array` narrow: the checked-dynamic tree's bytes kind, extracted
-        // with the same validated copy the checked cast uses (a Buffer that
-        // crossed in rides the kind too — it IS a Uint8Array in Node).
-        if (narrowed?.kind === "bytes" && narrowed.elem === "u8") {
+        // An instanceof narrow retains the native view after validating its
+        // exact element kind. Buffer also matches Uint8Array.
+        if (narrowed?.kind === "bytes" || narrowed?.kind === "url") {
             return { kind: "dynCheck", value: expr, type: narrowed, loc: expr.loc };
         }
         // An `instanceof Error` narrow: the checked-dynamic tree's error encoding rebuilds a
@@ -2282,6 +2512,11 @@ export function maybeNarrow(lowerer, expr, node) {
     }
     if (expr.type.kind !== "union")
         return expr;
+    if (ts.isIdentifier(node)) {
+        const symbol = lowerer.resolveValueSymbol(node);
+        if (symbol && lowerer.unstableSwitchBindings.has(symbol))
+            return expr;
+    }
     const narrowedTs = lowerer.typeOf(node);
     const narrowed = lowerer.mapTypeOf(narrowedTs);
     // `Array.isArray(u)` on a union with one readonly array/tuple arm: the
@@ -2307,8 +2542,43 @@ export function maybeNarrow(lowerer, expr, node) {
         return expr;
     }
     const tag = lowerer.armTag(expr.type.unionId, narrowed);
-    if (tag < 0)
+    if (tag < 0) {
+        // The checker may refine fields inside a discriminated record too.
+        // That creates a different mapped shape, but does not change the
+        // stored payload layout. A required literal discriminator proves
+        // which original arm to read; retain all of that arm's field types.
+        const def = lowerer.unions.get(expr.type.unionId);
+        if (narrowed.kind === "record" && def?.discriminant) {
+            const property = lowerer.checker.getPropertyOfType(narrowedTs, def.discriminant.field);
+            if (property && !(property.flags & (ts.SymbolFlags.Optional | ts.SymbolFlags.GetAccessor | ts.SymbolFlags.SetAccessor))) {
+                const values = literalValues(lowerer.checker.getTypeOfSymbol(property));
+                const arm = values && literalUnionArm(def, values, (id) => lowerer.shapes.get(id));
+                if (arm) {
+                    return { kind: "unionNarrow", unionId: expr.type.unionId,
+                        tag: lowerer.armTag(expr.type.unionId, arm), value: expr, type: arm, loc: expr.loc };
+                }
+            }
+        }
+        // A base-class arm can narrow to a subclass after instanceof. The
+        // payload retains its base-class tag even when the union also has
+        // records or other classes. Require one unambiguous containing arm.
+        const arms = lowerer.unions.get(expr.type.unionId)?.arms ?? [];
+        const valueTag = narrowed.kind === "object"
+            ? arms.findIndex((arm) => arm.kind === "object" && lowerer.isSubclassOf(narrowed.className, arm.className))
+            : -1;
+        const valueType = arms[valueTag];
+        if (narrowed.kind === "object" && valueType?.kind === "object" &&
+            arms.every((arm, i) => i === valueTag || arm.kind !== "object" || !lowerer.isSubclassOf(narrowed.className, arm.className)) &&
+            lowerer.isSubclassOf(narrowed.className, valueType.className)) {
+            return {
+                kind: "downcast",
+                value: { kind: "unionNarrow", unionId: expr.type.unionId, tag: valueTag, value: expr, type: valueType, loc: expr.loc },
+                type: narrowed,
+                loc: expr.loc,
+            };
+        }
         return expr;
+    }
     return {
         kind: "unionNarrow",
         unionId: expr.type.unionId,
@@ -2365,12 +2635,11 @@ function runtimeOptionalReceiverRead(lowerer, expr, local, property, loc) {
         }
         return { kind: "call", callee: helper, args: [varRef(local.id, local.type, loc)], type: narrowed, loc };
     }
-    const valueTag = lowerer.armTag(local.type.unionId, narrowed);
     const undefTag = lowerer.armTag(local.type.unionId, UNDEFINED_T);
-    if (valueTag < 0 || undefTag < 0)
-        throw new InternalCompilerError("runtime-optional local is missing its value or undefined arm");
     const def = lowerer.unions.get(local.type.unionId);
-    if (!def || def.arms.length !== 2) {
+    if (!def || undefTag < 0)
+        throw new InternalCompilerError("runtime-optional local is missing its undefined arm");
+    if (def.arms.length !== 2) {
         // The checker may narrow a runtime-optional capture to one arm of a
         // value union (`Circle | Square | undefined` -> `Circle`). The
         // two-arm fast path below cannot extract that arm safely: a later
@@ -2383,10 +2652,19 @@ function runtimeOptionalReceiverRead(lowerer, expr, local, property, loc) {
         }
         return { kind: "call", callee: helper, args: [varRef(local.id, local.type, loc)], type: narrowed, loc };
     }
+    // A predicate can strengthen a record's fields or narrow a base class
+    // to a subclass without changing the slot's stored value arm. Extract
+    // that actual arm first: record reads need its original field layout,
+    // and class reads apply the ordinary downcast bridge afterward.
+    const valueTag = undefTag === 0 ? 1 : 0;
+    const valueType = def.arms[valueTag];
+    if (!valueType || isUnitType(valueType)) {
+        lowerer.unsupported("SC1090", expr, "a runtime-optional receiver without a representable value arm");
+    }
     const message = property === null
         ? `${expr.text} is not a function`
         : `Cannot read properties of undefined (reading '${property}')`;
-    return {
+    return lowerer.maybeNarrow({
         kind: "ternary",
         cond: {
             kind: "unionIsTag",
@@ -2397,18 +2675,18 @@ function runtimeOptionalReceiverRead(lowerer, expr, local, property, loc) {
             type: BOOL,
             loc,
         },
-        then: nodeThrowExpr(1, "", message, narrowed, loc),
+        then: nodeThrowExpr(1, "", message, valueType, loc),
         else_: {
             kind: "unionNarrow",
             unionId: local.type.unionId,
             tag: valueTag,
             value: varRef(local.id, local.type, loc),
-            type: narrowed,
+            type: valueType,
             loc,
         },
-        type: narrowed,
+        type: valueType,
         loc,
-    };
+    }, narrowedNode);
 }
 function runtimeOptionalUseOf(expr) {
     let receiver = expr;
@@ -2669,7 +2947,26 @@ function lowerLooseNullCompare(lowerer, expr, loc) {
    * results (several non-unit arms) and defaults that change the result
    * type are fenced with narrow-first hints. */
 export function lowerNullishCoalesce(lowerer, expr, loc) {
-    const left = lowerAbsenceProbe(lowerer, expr.left) ?? lowerer.lowerExpr(expr.left);
+    // `a ?? b ?? c` is a left-nested AST. Lower its spine bottom-up so
+    // long dispatch chains do not retain a full expression/binary lowering
+    // frame per operand in a native compiler. The pair lowering still
+    // decides each result layout and preserves the lazy right operand.
+    const parents = [];
+    let first = expr;
+    while (ts.isBinaryExpression(first.left) &&
+        first.left.operatorToken.kind === ts.SyntaxKind.QuestionQuestionToken &&
+        !lowerer.chainRecvByNode.has(first.left)) {
+        parents.push(first);
+        first = first.left;
+    }
+    let result = lowerNullishPair(lowerer, first, first === expr ? loc : locOf(first), lowerAbsenceProbe(lowerer, first.left) ?? lowerer.lowerExpr(first.left));
+    for (let i = parents.length - 1; i >= 0; i--) {
+        const parent = parents[i];
+        result = lowerNullishPair(lowerer, parent, parent === expr ? loc : locOf(parent), result);
+    }
+    return result;
+}
+function lowerNullishPair(lowerer, expr, loc, left) {
     if (left.type.kind === "dyn") {
         // `a ?? b` on a CHECKED-DYNAMIC left: the deciding test is the
         // runtime kind (scr_dyn_is_nullish — UNDEF/NULL take the default;
@@ -2698,8 +2995,14 @@ export function lowerNullishCoalesce(lowerer, expr, loc) {
         lowerer.badType(expr.left, lowerer.typeOf(expr.left));
     if (!def.arms.some(isUnitType))
         return left;
-    const type = lowerer.irTypeOf(expr);
     const rest = def.arms.filter((a) => !isUnitType(a));
+    // `optionalMap ?? new Map()` carries its element contract on the left;
+    // the empty fallback may use it without constructing a Map<any, any>
+    // arm that has no first-class union representation.
+    const fresh = rest.length === 1 ? lowerer.emptyCollectionFor(expr.right, rest[0]) : null;
+    if (fresh)
+        return { kind: "nullish", left, right: fresh, type: fresh.type, loc };
+    const type = lowerer.irTypeOf(expr);
     if (typeEquals(type, left.type) || (rest.length === 1 && typeEquals(type, rest[0]))) {
         const right = lowerer.lowerExprExpecting(expr.right, type);
         return { kind: "nullish", left, right, type, loc };
@@ -2707,180 +3010,49 @@ export function lowerNullishCoalesce(lowerer, expr, loc) {
     if (type.kind !== "union" && rest.length > 1 && rest.some((arm) => typeEquals(arm, type))) {
         const helper = lowerer.narrowedArmHelper(left.type.unionId, type, loc);
         if (helper !== null) {
-            const stmts = [];
-            let stable = left;
-            if (!isSafeToRepeat(left)) {
-                const local = lowerer.declareHiddenLocal("%nullish", left.type);
-                stmts.push({ kind: "varDecl", localId: local.id, init: left, loc });
-                stable = varRef(local.id, left.type, loc);
-            }
-            const unitTags = def.arms
-                .map((arm, tag) => ({ arm, tag }))
-                .filter(({ arm }) => isUnitType(arm))
-                .map(({ tag }) => tag);
-            let isNullish = { kind: "unionIsTag", unionId: left.type.unionId, tag: unitTags[0], negated: false, value: stable, type: BOOL, loc };
-            for (const tag of unitTags.slice(1)) {
-                isNullish = {
-                    kind: "logical",
-                    op: "||",
-                    left: isNullish,
-                    right: { kind: "unionIsTag", unionId: left.type.unionId, tag, negated: false, value: stable, type: BOOL, loc },
-                    type: BOOL,
-                    loc,
-                };
-            }
-            const result = {
-                kind: "ternary",
-                cond: isNullish,
-                then: lowerer.lowerExprExpecting(expr.right, type),
-                else_: { kind: "call", callee: helper, args: [stable], type, loc },
-                type,
-                loc,
-            };
-            return stmts.length === 0 ? result : { kind: "seqExpr", stmts, result, type, loc };
+            return nullishBranches(lowerer, left, left.type, def.arms, type, loc, () => lowerer.lowerExprExpecting(expr.right, type), (stable) => ({ kind: "call", callee: helper, args: [stable], type, loc }));
         }
     }
-    // The RETAGGED shape — the default changes the result union (`s ??
-    // null` over `string | undefined` answers `null | string`): every
-    // non-unit arm of the left has a home in the result, so an interned
-    // helper tests the unit tags and re-wraps the payload per arm. The
-    // helper call evaluates the default EAGERLY where JS is lazy, so only
-    // effect-free defaults (the literal null/0/"" spellings) qualify —
-    // anything effectful keeps the fence.
+    // A default may change the union or widen its records. Test the
+    // original tag before coercing: converting the whole left first can
+    // lose nullish arms, and evaluating the default eagerly loses laziness.
     if (type.kind === "union") {
-        const leftT = left.type;
-        const armPairs = rest.map((a) => ({ arm: a, src: lowerer.armTag(leftT.unionId, a), dst: lowerer.armTag(type.unionId, a) }));
-        if (rest.length > 0 && armPairs.every((pair) => pair.src >= 0 && pair.dst >= 0)) {
-            const stmts = [];
-            let stable = left;
-            if (!isSafeToRepeat(left)) {
-                const local = lowerer.declareHiddenLocal("%nullish", leftT);
-                stmts.push({ kind: "varDecl", localId: local.id, init: left, loc });
-                stable = varRef(local.id, leftT, loc);
-            }
-            const unitTags = def.arms
-                .map((arm, tag) => ({ arm, tag }))
-                .filter(({ arm }) => isUnitType(arm))
-                .map(({ tag }) => tag);
-            let isNullish = {
-                kind: "unionIsTag",
-                unionId: leftT.unionId,
-                tag: unitTags[0],
-                negated: false,
-                value: stable,
-                type: BOOL,
-                loc,
-            };
-            for (const tag of unitTags.slice(1)) {
-                isNullish = {
-                    kind: "logical",
-                    op: "||",
-                    left: isNullish,
-                    right: { kind: "unionIsTag", unionId: leftT.unionId, tag, negated: false, value: stable, type: BOOL, loc },
-                    type: BOOL,
-                    loc,
-                };
-            }
-            let present = null;
-            for (let i = armPairs.length - 1; i >= 0; i--) {
-                const pair = armPairs[i];
-                const wrapped = {
-                    kind: "unionWrap",
-                    unionId: type.unionId,
-                    tag: pair.dst,
-                    value: { kind: "unionNarrow", unionId: leftT.unionId, tag: pair.src, value: stable, type: pair.arm, loc },
-                    type,
-                    loc,
-                };
-                present = present === null
-                    ? wrapped
-                    : {
-                        kind: "ternary",
-                        cond: { kind: "unionIsTag", unionId: leftT.unionId, tag: pair.src, negated: false, value: stable, type: BOOL, loc },
-                        then: wrapped,
-                        else_: present,
-                        type,
-                        loc,
-                    };
-            }
-            const result = {
-                kind: "ternary",
-                cond: isNullish,
-                then: lowerer.lowerExprExpecting(expr.right, type),
-                else_: present,
-                type,
-                loc,
-            };
-            return stmts.length === 0 ? result : { kind: "seqExpr", stmts, result, type, loc };
-        }
-        if (armPairs.every((p) => p.src >= 0 && p.dst >= 0)) {
-            const right = lowerer.lowerExprExpecting(expr.right, type);
-            if (isSafeToDiscard(right)) {
-                const helper = nullishRetagHelper(lowerer, leftT, type, loc);
-                return { kind: "call", callee: helper, args: [left, right], type, loc };
-            }
+        const retag = lowerer.unionRetagHelper(left.type.unionId, type.unionId, loc) ??
+            lowerer.narrowedRetagHelper(expr.left, left.type.unionId, type.unionId, loc);
+        if (retag !== null) {
+            // Narrowing may exclude a record/class arm while storage retains
+            // it. The checked retag traps that impossible arm, but only AFTER
+            // the original nullish test: null/undefined must reach the lazy
+            // default even when neither is representable in the result.
+            return nullishBranches(lowerer, left, left.type, def.arms, type, loc, () => lowerer.lowerExprExpecting(expr.right, type), (stable) => ({ kind: "call", callee: retag, args: [stable], type, loc }));
         }
     }
     lowerer.unsupported("SC1090", expr, rest.length !== 1
         ? `'??' on '${lowerer.fmt(left.type)}' (the non-nullish result is a sub-union; check a discriminant field first)`
         : `'??' where the default changes the result type (left is '${lowerer.fmt(left.type)}' but the whole expression is '${lowerer.fmt(type)}' — give both sides one type)`);
 }
-/** Interned `%nullish.retag.<n>(l, r)` — the retagged `??` (see
-   * lowerNullishCoalesce): unit-armed left answers the pre-evaluated
-   * default; every other arm narrows out of the left union and wraps into
-   * the result union's matching arm. */
-function nullishRetagHelper(lowerer, leftT, resT, loc) {
-    const key = `nullish:${leftT.unionId}:${typeKey(resT)}`;
-    const existing = lowerer.widthHelpers.get(key);
-    if (existing)
-        return existing;
-    const name = `%nullish.retag.${lowerer.widthHelpers.size}`;
-    lowerer.widthHelpers.set(key, name);
-    const def = lowerer.unions.get(leftT.unionId);
-    const l = varRef("l.0", leftT, loc);
-    const r = varRef("r.0", resT, loc);
-    const body = [];
-    def.arms.forEach((arm, tag) => {
-        if (isUnitType(arm))
-            return;
-        const dst = lowerer.armTag(resT.unionId, arm);
-        body.push({
-            kind: "if",
-            cond: { kind: "unionIsTag", unionId: leftT.unionId, tag, negated: false, value: l, type: BOOL, loc },
-            then: [
-                {
-                    kind: "return",
-                    value: {
-                        kind: "unionWrap",
-                        unionId: resT.unionId,
-                        tag: dst,
-                        value: { kind: "unionNarrow", unionId: leftT.unionId, tag, value: l, type: arm, loc },
-                        type: resT,
-                        loc,
-                    },
-                    loc,
-                },
-            ],
-            else_: null,
-            loc,
-        });
-    });
-    body.push({ kind: "return", value: r, loc });
-    lowerer.liftedFns.push({
-        name,
-        params: [
-            { localId: "l.0", name: "l", type: leftT },
-            { localId: "r.0", name: "r", type: resT },
-        ],
-        returnType: resT,
-        locals: [
-            { id: "l.0", name: "l", type: leftT, mutable: true },
-            { id: "r.0", name: "r", type: resT, mutable: true },
-        ],
-        body,
-        loc,
-    });
-    return name;
+/** Test the original storage before projecting its present value. Both
+ * branches are lazy, and an effectful receiver is evaluated exactly once.
+ * Keeping the original tags matters when the checker has removed an arm
+ * or the default changes the union's layout. */
+function nullishBranches(lowerer, left, leftType, arms, type, loc, absent, present) {
+    const stmts = [];
+    let stable = left;
+    if (!isSafeToRepeat(left)) {
+        const local = lowerer.declareHiddenLocal("%nullish", leftType);
+        stmts.push({ kind: "varDecl", localId: local.id, init: left, loc });
+        stable = varRef(local.id, leftType, loc);
+    }
+    const unitTags = arms.flatMap((arm, tag) => isUnitType(arm) ? [tag] : []);
+    let test = null;
+    for (const tag of unitTags) {
+        const part = { kind: "unionIsTag", unionId: leftType.unionId, tag, negated: false, value: stable, type: BOOL, loc };
+        test = test === null ? part : { kind: "logical", op: "||", left: test, right: part, type: BOOL, loc };
+    }
+    if (test === null)
+        throw new InternalCompilerError("nullish branch requires an absent arm");
+    const result = { kind: "ternary", cond: test, then: absent(), else_: present(stable), type, loc };
+    return stmts.length === 0 ? result : { kind: "seqExpr", stmts, result, type, loc };
 }
 /** A CONDITION-position expression: the result is consumed as a bool
    * only, so `&&`/`||` descend recursively over ToBoolean'd operands —
@@ -2939,14 +3111,23 @@ function lowerPromiseThenPresence(lowerer, access, result) {
             ? (() => {
                 const arms = lowerer.unions.get(mapped.unionId)?.arms ?? [];
                 const promises = arms.filter((arm) => arm.kind === "promise");
-                return promises.length === 1 && arms.every((arm) => arm.kind === "promise" || isUnitType(arm))
-                    ? promises[0]
+                const promise = promises[0];
+                return promises.length === 1 && promise?.kind === "promise" && arms.every((arm) => arm.kind === "promise" || isUnitType(arm))
+                    ? promise
                     : null;
             })()
             : null;
     if (promiseType === null)
         return null;
     let receiver = lowerer.lowerExpr(access.expression);
+    if (receiver.type.kind === "union" && access.questionDotToken) {
+        const arms = lowerer.unions.get(receiver.type.unionId)?.arms ?? [];
+        if (arms.every((arm) => arm.kind === "promise" || isUnitType(arm))) {
+            return nullishBranches(lowerer, receiver, receiver.type, arms, result.type, locOf(access), () => result.type.kind === "bool"
+                ? { kind: "boolLit", value: false, type: BOOL, loc: result.loc }
+                : { kind: "strLit", value: "undefined", type: STRING, loc: result.loc }, () => result);
+        }
+    }
     if (receiver.type.kind === "union") {
         const optional = lowerer.runtimeOptionalPropertyReceiver(access.expression, receiver, promiseType, access.name.text);
         if (optional !== null)
@@ -2958,6 +3139,29 @@ function lowerPromiseThenPresence(lowerer, access, result) {
             receiver = { kind: "call", callee: helper, args: [receiver], type: promiseType, loc: receiver.loc };
         }
     }
+    if (receiver.type.kind === "dyn") {
+        // A specialized JS parameter can retain checked storage while JSDoc
+        // describes a promise. Probe its actual value, preserving nullish
+        // guards and own-property reads on ordinary thenable objects.
+        const loc = locOf(access);
+        const local = lowerer.declareHiddenLocal("%thenReceiver", DYN);
+        const stable = varRef(local.id, DYN, loc);
+        const member = {
+            kind: "dynKeyGet", value: stable,
+            key: { kind: "strLit", value: "then", type: STRING, loc },
+            ...(access.questionDotToken ? { optional: true } : {}), type: DYN, loc,
+        };
+        const other = result.type.kind === "bool"
+            ? { kind: "dynTest", test: "truthy", value: member, type: BOOL, loc }
+            : { kind: "libCall", fn: "dyn.typeof", args: [member], type: STRING, loc };
+        return {
+            kind: "seqExpr", stmts: [{ kind: "varDecl", localId: local.id, init: receiver, loc }],
+            result: {
+                kind: "ternary", cond: { kind: "dynTest", test: "promise", value: stable, type: BOOL, loc },
+                then: result, else_: other, type: result.type, loc,
+            }, type: result.type, loc,
+        };
+    }
     if (receiver.type.kind !== "promise")
         return null;
     if (isSafeToDiscard(receiver))
@@ -2980,15 +3184,107 @@ function runtimeOptionalLocalOf(lowerer, node) {
     return local && lowerer.runtimeOptionalLocals.has(lowerer.runtimeOptionalRootOf(local)) ? local : null;
 }
 export function runtimeOptionalTrueIds(lowerer, node) {
-    let expr = node;
-    while (ts.isParenthesizedExpression(expr))
-        expr = expr.expression;
-    if (ts.isBinaryExpression(expr) &&
-        expr.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken) {
-        return [...runtimeOptionalTrueIds(lowerer, expr.left), ...runtimeOptionalTrueIds(lowerer, expr.right)];
-    }
-    const local = runtimeOptionalLocalOf(lowerer, expr);
-    return local === null ? [] : [local];
+    return runtimeOptionalGuardIds(lowerer, node, true);
+}
+/** Presence proved by one outcome of a boolean guard. Negation flips
+ * the outcome; all operands of a true AND or false OR have that outcome.
+ * Assignments invalidate a syntactic proof even when checker types hide
+ * the undefined produced by an out-of-bounds read. */
+export function runtimeOptionalGuardIds(lowerer, node, truthy) {
+    const candidates = [];
+    const collect = (expr, outcome) => {
+        if (ts.isParenthesizedExpression(expr))
+            return collect(expr.expression, outcome);
+        if (ts.isPrefixUnaryExpression(expr) && expr.operator === ts.SyntaxKind.ExclamationToken) {
+            return collect(expr.operand, outcome === null ? null : !outcome);
+        }
+        if (ts.isBinaryExpression(expr) &&
+            (outcome === true && expr.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken ||
+                outcome === false && expr.operatorToken.kind === ts.SyntaxKind.BarBarToken)) {
+            collect(expr.left, outcome);
+            collect(expr.right, outcome);
+        }
+        else if (ts.isPropertyAccessExpression(expr) && !expr.questionDotToken) {
+            // A completed ordinary member read checked its receiver even if
+            // the property's value was falsy. Optional chains make no such
+            // promise, and calls/captures retain their separate checked ABI.
+            const local = runtimeOptionalLocalOf(lowerer, expr.expression);
+            if (local !== null)
+                candidates.push(local);
+            else if (ts.isPropertyAccessExpression(expr.expression))
+                collect(expr.expression, outcome);
+        }
+        else if (ts.isBinaryExpression(expr) &&
+            expr.operatorToken.kind !== ts.SyntaxKind.AmpersandAmpersandToken &&
+            expr.operatorToken.kind !== ts.SyntaxKind.BarBarToken &&
+            expr.operatorToken.kind !== ts.SyntaxKind.QuestionQuestionToken) {
+            // Both operands of a comparison/arithmetic operator are evaluated.
+            // Only member reads prove presence; bare identifiers need truth.
+            const member = (operand) => {
+                while (ts.isParenthesizedExpression(operand))
+                    operand = operand.expression;
+                if (ts.isPropertyAccessExpression(operand))
+                    collect(operand, outcome);
+            };
+            member(expr.left);
+            member(expr.right);
+            const op = expr.operatorToken.kind;
+            const equal = op === ts.SyntaxKind.EqualsEqualsEqualsToken || op === ts.SyntaxKind.EqualsEqualsToken;
+            const unequal = op === ts.SyntaxKind.ExclamationEqualsEqualsToken || op === ts.SyntaxKind.ExclamationEqualsToken;
+            if ((equal && outcome === false) || (unequal && outcome === true)) {
+                const present = (value, unit) => {
+                    while (ts.isParenthesizedExpression(unit))
+                        unit = unit.expression;
+                    const excludesUndefined = ts.isIdentifier(unit) && unit.text === "undefined" &&
+                        (lowerer.typeOf(unit).flags & ts.TypeFlags.Undefined) !== 0 ||
+                        unit.kind === ts.SyntaxKind.NullKeyword &&
+                            (op === ts.SyntaxKind.EqualsEqualsToken || op === ts.SyntaxKind.ExclamationEqualsToken);
+                    if (excludesUndefined) {
+                        const local = runtimeOptionalLocalOf(lowerer, value);
+                        if (local !== null)
+                            candidates.push(local);
+                    }
+                };
+                present(expr.left, expr.right);
+                present(expr.right, expr.left);
+            }
+        }
+        else if (outcome) {
+            const local = runtimeOptionalLocalOf(lowerer, expr);
+            if (local !== null)
+                candidates.push(local);
+        }
+    };
+    collect(node, truthy);
+    if (candidates.length === 0)
+        return candidates;
+    const assigned = new Set();
+    const visit = (part) => {
+        if (ts.isFunctionLike(part))
+            return;
+        let target = null;
+        if (ts.isBinaryExpression(part) && part.operatorToken.kind >= ts.SyntaxKind.FirstAssignment &&
+            part.operatorToken.kind <= ts.SyntaxKind.LastAssignment)
+            target = part.left;
+        if ((ts.isPrefixUnaryExpression(part) || ts.isPostfixUnaryExpression(part)) &&
+            (part.operator === ts.SyntaxKind.PlusPlusToken || part.operator === ts.SyntaxKind.MinusMinusToken))
+            target = part.operand;
+        if (target !== null) {
+            // Destructuring assignments can contain several identifiers.
+            const mark = (name) => {
+                if (ts.isIdentifier(name)) {
+                    const local = lowerer.resolveLocal(name);
+                    if (local)
+                        assigned.add(lowerer.runtimeOptionalRootOf(local));
+                }
+                ts.forEachChild(name, mark);
+            };
+            mark(target);
+        }
+        ts.forEachChild(part, visit);
+    };
+    visit(node);
+    return candidates.filter((local) => !assigned.has(lowerer.runtimeOptionalRootOf(local)));
 }
 export function withRuntimeOptionalNarrowed(lowerer, locals, fn) {
     if (locals.length === 0)
@@ -3072,6 +3368,15 @@ export function eqComparableUnion(lowerer, unionId) {
 export function lowerIntrinsicProperty(lowerer, expr) {
     if (lowerer.chainBlocked(expr))
         return null;
+    if (lowerer.stdlibGlobalMember(expr, "Array") === "prototype")
+        return { kind: "libCall", fn: "dyn.arrayPrototype", args: [], type: DYN, loc: locOf(expr) };
+    if (lowerer.stdlibGlobalMember(expr, "Array") === "isArray")
+        return lowerArrayIsArrayValue(lowerer, locOf(expr));
+    if (stdlibGlobalNameOf(lowerer, expr.expression) === "Object") {
+        const fn = own(OBJECT_CALLABLE_VALUES, expr.name.text);
+        if (fn)
+            return lowerer.lowerNativeCallableValue(fn, `Object.${expr.name.text}`, locOf(expr));
+    }
     // A never-tainted JS receiver type lowered checked-dynamic
     // (neverTaintedJsType — `cmd.length` on `const cmd = ['pwd', []]`):
     // stand down so the dyn keyed read below the chain answers, instead
@@ -3107,6 +3412,8 @@ export function lowerIntrinsicProperty(lowerer, expr) {
     const name = expr.name.text;
     const strictReceiver = (expected) => {
         const value = lowerer.lowerExpr(expr.expression);
+        if (value.type.kind === "dyn")
+            return lowerer.coerceInto(expr.expression, value, expected);
         return lowerer.runtimeOptionalPropertyReceiver(expr.expression, value, expected, name) ?? value;
     };
     if (kind === "child") {
@@ -3327,15 +3634,14 @@ export function lowerIntrinsicProperty(lowerer, expr) {
             // SEMANTICS.md notes the divergence from Node's Buffer pooling),
             // the view's real offset for a DataView. A runtime read, so the
             // receiver's evaluation is never discarded.
-            const receiver = lowerer.lowerExpr(expr.expression);
+            const expected = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+            const receiver = expected?.kind === "bytes" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
             return { kind: "bytesIntrinsic", method: "byteOffset", receiver, args: [], type: F64, loc };
         }
         if (name === "buffer") {
-            // No ArrayBuffer VALUE exists — `.buffer` compiles only in the
-            // one composed position that consumes it, the DataView
-            // constructor's first argument (lowerDataViewNew peels it).
-            lowerer.unsupported("SC1090", expr, "'.buffer' outside new DataView(x.buffer, ...) / Buffer.from(x.buffer, ...) " +
-                "(no free-standing ArrayBuffer value exists; subarray() answers an aliasing view directly)");
+            const expected = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+            const receiver = expected?.kind === "bytes" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
+            return { kind: "bytesIntrinsic", method: "buffer", receiver, args: [], type: DYN, loc };
         }
         if (name === "slice" || name === "subarray" || name === "set" || name === "toString") {
             lowerer.unsupported("SC1090", expr, `typed-array methods as values (call '${name}' directly)`);
@@ -3344,7 +3650,8 @@ export function lowerIntrinsicProperty(lowerer, expr) {
     }
     if (kind === "map") {
         if (name === "size") {
-            const receiver = lowerer.lowerExpr(expr.expression);
+            const expected = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+            const receiver = expected?.kind === "map" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
             return { kind: "mapIntrinsic", method: "size", receiver, args: [], type: F64, loc: locOf(expr) };
         }
         if (MAP_METHODS.has(name) || name === "forEach") {
@@ -3354,7 +3661,8 @@ export function lowerIntrinsicProperty(lowerer, expr) {
     }
     if (kind === "set") {
         if (name === "size") {
-            const receiver = lowerer.lowerExpr(expr.expression);
+            const expected = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+            const receiver = expected?.kind === "set" ? strictReceiver(expected) : lowerer.lowerExpr(expr.expression);
             return { kind: "setIntrinsic", method: "size", receiver, args: [], type: F64, loc: locOf(expr) };
         }
         if (SET_METHODS.has(name)) {
@@ -3429,7 +3737,10 @@ export function lowerIntrinsicProperty(lowerer, expr) {
 export function lowerArrayLiteral(lowerer, expr, expected) {
     const loc = locOf(expr);
     const ctxType = lowerer.checker.getContextualType(expr);
-    const tsType = ctxType ?? lowerer.typeOf(expr);
+    // `as const satisfies readonly T[]` checks against an array but keeps
+    // the literal's inferred tuple type. Build that shape; an actual array
+    // destination can use the ordinary tuple-to-array coercion afterward.
+    const tsType = underConstAssertion(expr) ? lowerer.typeOf(expr) : ctxType ?? lowerer.typeOf(expr);
     let mapped = expected ?? lowerer.mapTypeOf(tsType);
     // A JS literal whose OWN inferred type is never-tainted
     // (neverTaintedJsType — the evolving `const gb = []`, the mixed
@@ -3542,13 +3853,13 @@ export function lowerArrayLiteral(lowerer, expr, expected) {
     // literal constructs the tuple's record shape — one positional field
     // per element, source order (which IS index order, so evaluation order
     // is JS-exact). tsc has already checked the arity; the recount below
-    // backstops `as` smuggling. Spreads have no fixed positions — fenced.
+    // backstops `as` smuggling. Fixed tuple spreads have known positions.
     if (mapped?.kind === "record") {
         const shape = lowerer.shapes.get(mapped.shapeId);
         if (shape?.tuple) {
             const spread = expr.elements.find(ts.isSpreadElement);
             if (spread) {
-                lowerer.unsupported("SC1090", spread, "spread elements in tuple literals (positions must be spelled out)");
+                return lowerTupleSpreadLiteral(lowerer, expr, mapped, shape);
             }
             if (expr.elements.length !== shape.fields.length) {
                 // tsc padded an UNDER-LENGTH literal against an optional-element
@@ -3594,6 +3905,13 @@ export function lowerArrayLiteral(lowerer, expr, expected) {
         // to DYN wholesale now (mapType's dyn-element array rule), so the
         // literal IS the dyn array.
         if (isJsSourceFile(expr.getSourceFile()) || mapped?.kind === "dyn") {
+            if (expr.elements.some(ts.isSpreadElement)) {
+                // Native collection drains return vectors of retained dyn
+                // elements. Reuse the ordinary spread builder, then expose the
+                // resulting array through the established unknown[] representation.
+                const vector = lowerArrayLiteral(lowerer, expr, arrayOf(DYN));
+                return lowerer.coerceInto(expr, vector, DYN);
+            }
             const elems = expr.elements.map((el) => {
                 if (ts.isSpreadElement(el)) {
                     lowerer.unsupported("SC1090", el, "spread elements in a dynamic (unknown[]) array literal");
@@ -3644,19 +3962,7 @@ export function lowerArrayLiteral(lowerer, expr, expected) {
                 (ts.isConditionalExpression(srcNode)
                     ? lowerTernary(lowerer, srcNode, type)
                     : lowerer.lowerExpr(el.expression));
-            // `[...someSet]`: a same-element Set drains into a fresh array in
-            // insertion order (setIntrinsic toArray); the spread machinery
-            // then copies like any array source.
-            if (src.type.kind === "set" && typeEquals(src.type.elem, type.elem)) {
-                src = {
-                    kind: "setIntrinsic",
-                    method: "toArray",
-                    receiver: src,
-                    args: [],
-                    type: arrayOf(src.type.elem),
-                    loc: locOf(el),
-                };
-            }
+            src = lowerCollectionSpread(lowerer, src, el.expression) ?? src;
             // `[...new SymbolIterator]`: a CLASS ITERABLE drains through its
             // own protocol into a fresh element array (classIteratorDrainCall
             // — an infinite iterator loops forever, exactly Node), and the
@@ -3688,6 +3994,16 @@ export function lowerArrayLiteral(lowerer, expr, expected) {
                     loc: locOf(el),
                 };
             }
+            // A native checked iterable can supply scalar elements even when
+            // the checker inferred a typed array from its producer. Drain once
+            // and validate the elements before the ordinary spread copy.
+            if (src.type.kind === "dyn" && (type.elem.kind === "dyn" || type.elem.kind === "f64" || type.elem.kind === "string" || type.elem.kind === "bool")) {
+                src = lowerer.coerceInto(el.expression, {
+                    kind: "libCall", fn: "dyn.iterPack", args: [src,
+                        { kind: "strLit", value: el.expression.getText(), type: STRING, loc: locOf(el) }],
+                    type: DYN, loc: locOf(el),
+                }, type);
+            }
             // A same-family array whose ELEMENT lifts (string[] into a
             // (string | symbol)[] literal — per-element wrap/width copy):
             // the interned width helper reshapes before the spread copies.
@@ -3817,6 +4133,62 @@ export function lowerArrayLiteral(lowerer, expr, expected) {
         loc,
     };
 }
+/** Build a fixed tuple from positional elements and fixed tuple spreads.
+ * Capture each value in source order: deferring the reads until recordLit
+ * would observe a later element's mutations of the spread source. */
+function lowerTupleSpreadLiteral(lowerer, expr, type, shape) {
+    const loc = locOf(expr);
+    const byName = new Map(shape.fields.map((field) => [field.name, field.type]));
+    const stmts = [];
+    const fields = [];
+    const append = (node, value) => {
+        const name = String(fields.length);
+        const expected = byName.get(name);
+        if (!expected)
+            lowerer.badType(expr, lowerer.typeOf(expr));
+        const coerced = lowerer.coerceInto(node, value, expected);
+        const temp = lowerer.declareHiddenLocal("%tupleElement", expected);
+        const at = locOf(node);
+        stmts.push({ kind: "varDecl", localId: temp.id, init: coerced, loc: at });
+        fields.push({ name, value: varRef(temp.id, expected, at) });
+    };
+    for (const element of expr.elements) {
+        if (!ts.isSpreadElement(element)) {
+            const expected = byName.get(String(fields.length));
+            if (!expected)
+                lowerer.badType(element, lowerer.typeOf(element));
+            append(element, lowerer.lowerExprExpecting(element, expected));
+            continue;
+        }
+        const source = lowerer.lowerExpr(element.expression);
+        const sourceShape = source.type.kind === "record" ? lowerer.shapes.get(source.type.shapeId) : undefined;
+        if (!sourceShape?.tuple) {
+            // Empty tuples use a zero-length array representation. Preserve a
+            // producing call's effects even though there are no positions to copy.
+            const sourceTs = lowerer.typeOf(element.expression);
+            if (source.type.kind === "array" && lowerer.checker.isTupleType(sourceTs) &&
+                lowerer.checker.getTypeArguments(sourceTs).length === 0) {
+                stmts.push({ kind: "exprStmt", expr: source, loc: locOf(element) });
+                continue;
+            }
+            lowerer.unsupported("SC1090", element, "spreading a variable-length value into a fixed tuple literal");
+        }
+        const temp = lowerer.declareHiddenLocal("%tupleSpread", source.type);
+        const at = locOf(element);
+        stmts.push({ kind: "varDecl", localId: temp.id, init: source, loc: at });
+        const receiver = varRef(temp.id, source.type, at);
+        const positions = [...sourceShape.fields].sort((a, b) => Number(a.name) - Number(b.name));
+        for (const field of positions) {
+            append(element.expression, {
+                kind: "recordGet", obj: receiver, shapeId: sourceShape.id,
+                field: field.name, type: field.type, loc: at,
+            });
+        }
+    }
+    if (fields.length !== shape.fields.length)
+        lowerer.badType(expr, lowerer.typeOf(expr));
+    return { kind: "seqExpr", stmts, result: { kind: "recordLit", fields, type, loc }, type, loc };
+}
 /** Convert an undefined-armed numeric value at an arithmetic use. Ordinary
  * reads preserve their tagged value; JavaScript's ToNumber(undefined) is NaN,
  * so compounds and binary arithmetic use this checked one-time extraction. */
@@ -3891,16 +4263,17 @@ export function lowerElementAccess(lowerer, expr) {
     lowerer.fenceStaticResponseMember(expr, "read");
     lowerer.fenceStaticHeadersMember(expr, "read");
     lowerer.fenceStaticReadableStreamMember(expr, "read");
-    // `globalThis[<expr>]` — the dynamic global probe (the harness's
-    // conditional-globals sweep): a compiled binary's globals are
-    // compile-time bindings, not runtime properties, and none of the
-    // probed web-platform objects exist here — the honest answer is
-    // undefined for every dynamic name (SEMANTICS.md documents the
-    // divergence: statically-known globals are not reachable this way;
-    // the PROPERTY spelling answers the identity token instead — see
-    // lowerPropertyAccess's globalThis rule).
+    // Computed global reads share the stored global object's custom
+    // properties. Symbol keys retain their identity-indexed store.
     if (!expr.questionDotToken && stdlibGlobalNameOf(lowerer, expr.expression) === "globalThis") {
-        return { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc: locOf(expr) };
+        const symbol = globalSymbolKey(lowerer, expr.expression, expr.argumentExpression);
+        if (symbol)
+            return { kind: "libCall", fn: "dyn.globalSymbolGet", args: [symbol], type: DYN, loc: locOf(expr) };
+        const key = lowerer.lowerExpr(expr.argumentExpression);
+        const name = key.type.kind === "string" ? key : {
+            kind: "libCall", fn: "dyn.toStringCoerce", args: [lowerer.coerceInto(expr.argumentExpression, key, DYN)], type: STRING, loc: locOf(expr),
+        };
+        return { kind: "dynKeyGet", value: lowerGlobalValue(lowerer, expr.expression), key: name, type: DYN, loc: locOf(expr) };
     }
     // `req.headers["x-name"]` — the computed twin of `req.headers.host`
     // (the server spoke owns both; the envGet precedent).
@@ -3913,7 +4286,7 @@ export function lowerElementAccess(lowerer, expr) {
     // lower to the ONE process.envGet intrinsic. The read narrows like any
     // union-typed expression when the checker narrowed this occurrence.
     if (lowerer.isProcessEnv(expr.expression)) {
-        const key = lowerer.lowerExpr(expr.argumentExpression);
+        const key = lowerEnvironmentKey(lowerer, expr.argumentExpression);
         if (key.type.kind !== "string") {
             lowerer.unsupported("SC1090", expr.argumentExpression, "indexing process.env with non-string keys");
         }
@@ -3936,17 +4309,27 @@ export function lowerElementAccess(lowerer, expr) {
             return lowerer.maybeNarrow(ex, expr);
     }
     // Symbol-keyed property READS (`this[kLimit]`): when the key is a
-    // statically-resolvable unique-symbol const declared as a field of the
-    // receiver's class (uniqueSymbolKeyOf — the countdown.js idiom), the
+    // statically-resolvable symbol declared as a field of the receiver's
+    // class (classSymbolKeyOf — the countdown.js/OpenTUI idioms), the
     // read IS an ordinary field read of the hidden slot. Every other
     // symbol key stays fenced: record shapes, runtime-identity keys
-    // (symbol parameters, Symbol.for consts), and keys no class declares
+    // (symbol parameters, reassigned bindings), and keys no class declares
     // — the layouts are compile-time field lists.
     if (lowerer.mapTypeOf(lowerer.typeOf(expr.argumentExpression))?.kind === "symbol") {
         const target = symbolFieldTarget(lowerer, expr);
         if (target)
             return lowerer.maybeNarrow(lowerer.fieldGetExpr(target, locOf(expr), expr), expr);
-        lowerer.unsupported("SC1090", expr, "symbol-keyed property access outside class fields keyed by a module-level `const k = Symbol('desc')` (static shapes have no symbol-keyed storage)");
+        let receiver = lowerer.lowerExpr(expr.expression);
+        if (receiver.type.kind === "func") {
+            const fnName = jsFuncNameOf(expr.expression);
+            receiver = { kind: "dynFrom", value: receiver, type: DYN, loc: locOf(expr),
+                ...(fnName !== null ? { fnName } : {}) };
+        }
+        if (receiver.type.kind === "dyn") {
+            const key = lowerer.lowerExprExpecting(expr.argumentExpression, DYN);
+            return lowerer.maybeNarrow({ kind: "dynKeyGet", value: receiver, key, type: DYN, loc: locOf(expr) }, expr);
+        }
+        lowerer.unsupported("SC1090", expr, "symbol-keyed property access outside class fields keyed by a stable module-level literal Symbol()/Symbol.for() (other static shapes have no symbol-keyed storage)");
     }
     // A never-tainted JS receiver type (neverTaintedJsType — `cmd[1]` on
     // `const cmd = ['pwd', []]`, whose binding lowered checked-dynamic)
@@ -3955,6 +4338,16 @@ export function lowerElementAccess(lowerer, expr) {
     let receiverIr = neverTaintedJsType(lowerer, expr.expression, lowerer.typeOf(expr.expression))
         ? null
         : lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
+    if (isJsSourceFile(expr.getSourceFile())) {
+        const receiver = tryLowerExpression(lowerer, expr.expression);
+        if (receiver?.type.kind === "func" && lowerer.dynConvertible(receiver.type)) {
+            const loc = locOf(expr);
+            const fnName = jsFuncNameOf(expr.expression);
+            const boxed = { kind: "dynFrom", value: receiver, type: DYN, loc, ...(fnName !== null ? { fnName } : {}) };
+            const key = lowerRecordPropertyKey(lowerer, lowerer.lowerExpr(expr.argumentExpression), expr.argumentExpression);
+            return lowerer.maybeNarrow({ kind: "dynKeyGet", key, value: boxed, type: DYN, loc }, expr);
+        }
+    }
     // A readonly tuple union under Array.isArray is checker-typed as an
     // intersection with any[], whose structural mapping is not the tuple
     // shape. maybeNarrow on the receiver uses the runtime tag proof to
@@ -3963,6 +4356,19 @@ export function lowerElementAccess(lowerer, expr) {
     const checkerArray = lowerer.checkerArrayValue(expr.expression);
     if (checkerArray)
         receiverIr = checkerArray.type;
+    if (receiverIr?.kind === "object") {
+        const key = recordKeyLiteralText(expr.argumentExpression) ?? recordKeyTypeLiteralText(lowerer, expr.argumentExpression);
+        if (key !== null) {
+            const target = classFieldTarget(lowerer, expr.expression, receiverIr, key);
+            if (target)
+                return lowerer.maybeNarrow(lowerer.fieldGetExpr(target, locOf(expr), expr), expr);
+        }
+        if (isDynTypedRefType(receiverIr)) {
+            const receiver = lowerer.coerceToExpected(lowerer.lowerExpr(expr.expression), DYN);
+            const key = lowerer.lowerExprExpecting(expr.argumentExpression, DYN);
+            return lowerer.maybeNarrow({ kind: "dynKeyGet", value: receiver, key, type: DYN, loc: locOf(expr) }, expr);
+        }
+    }
     if (receiverIr?.kind === "jsval") {
         // Dispatch follows the RUNTIME world (383(d)): a checker-'any'
         // receiver whose value LOWERED checked-dynamic (`bag.list[0]` where
@@ -3988,6 +4394,8 @@ export function lowerElementAccess(lowerer, expr) {
     // read undefined — divergence 4's policy).
     if (receiverIr?.kind === "bytes") {
         let recv = lowerer.lowerExpr(expr.expression);
+        if (recv.type.kind === "dyn")
+            recv = lowerer.coerceInto(expr.expression, recv, receiverIr);
         if (recv.type.kind === "union" && lowerer.armTag(recv.type.unionId, UNDEFINED_T) >= 0) {
             const present = lowerer.stripUndefinedArm(recv.type);
             const helper = present.kind === "bytes"
@@ -4004,6 +4412,9 @@ export function lowerElementAccess(lowerer, expr) {
         if (recv.type.kind === "jsval")
             return islandElementRead(lowerer, expr, recv);
         const index = lowerer.lowerExpr(expr.argumentExpression);
+        if (index.type.kind === "dyn" && recv.type.kind === "bytes") {
+            return { kind: "dynKeyGet", value: lowerer.coerceInto(expr.expression, recv, DYN), key: index, type: DYN, loc: locOf(expr) };
+        }
         if (index.type.kind !== "f64") {
             lowerer.unsupported("SC1090", expr.argumentExpression, "indexing with non-number keys");
         }
@@ -4025,6 +4436,17 @@ export function lowerElementAccess(lowerer, expr) {
             // like the array path.
             if (obj.type.kind === "jsval")
                 return islandElementRead(lowerer, expr, obj);
+            if (obj.type.kind === "dyn") {
+                // Object.entries over a checked value stores each pair in the
+                // dynamic tree even when the checker names a tuple type.
+                const key = lowerRecordPropertyKey(lowerer, lowerer.lowerExpr(expr.argumentExpression), expr.argumentExpression);
+                const optional = hasOptionalChainGuard(expr.expression);
+                return lowerer.maybeNarrow({
+                    kind: "dynKeyGet", value: obj, key,
+                    ...(optional ? { optional: true } : {}),
+                    type: DYN, loc: locOf(expr),
+                }, expr);
+            }
             if (obj.type.kind === "union" && lowerer.armTag(obj.type.unionId, UNDEFINED_T) >= 0) {
                 // The checker sees the outer `arrays[i]` as a tuple when
                 // noUncheckedIndexedAccess is disabled, but the lowered read is
@@ -4080,21 +4502,28 @@ export function lowerElementAccess(lowerer, expr) {
     // (`pkg.workspaces.packages["0"]` — the lowering world types the
     // unknown-rooted chain `any`); a non-dyn lowering falls through to
     // the fences below (re-lowering is pure IR construction).
-    if (receiverIr?.kind === "dyn" || receiverIr === null) {
+    if (receiverIr?.kind === "dyn" || receiverIr?.kind === "union" || receiverIr === null) {
         const obj = lowerer.lowerExpr(expr.expression);
-        if (obj.type.kind === "dyn") {
+        // A generic mapped type can stay unresolved at this body use even
+        // though its instantiated parameter has a concrete record ABI.
+        // Dispatch from that stored shape, as the array fallback below does.
+        if (receiverIr === null && obj.type.kind === "record") {
+            const shape = lowerer.shapes.get(obj.type.shapeId);
+            if (shape && !shape.tuple) {
+                return lowerer.lowerRecordKeyRead(expr, obj.type.shapeId, shape);
+            }
+        }
+        if (obj.type.kind === "dyn" || isDynTypedRefType(obj.type)) {
             const rawKey = lowerer.lowerExpr(expr.argumentExpression);
             // Number, bool, and DYN keys stringify (ToPropertyKey) — the
             // dyn-keyed read `catchWarning[warning.name]` where the property
             // chain itself lowered dyn.
-            const key = rawKey.type.kind === "string"
-                ? rawKey
-                : rawKey.type.kind === "f64" || rawKey.type.kind === "bool" || rawKey.type.kind === "dyn"
-                    ? { kind: "toString", operand: rawKey, type: STRING, loc: rawKey.loc }
-                    : null;
-            if (key) {
+            const key = rawKey.type.kind === "dyn" || rawKey.type.kind === "symbol"
+                ? lowerer.coerceToExpected(rawKey, DYN)
+                : lowerRecordPropertyKey(lowerer, rawKey, expr.argumentExpression);
+            if (key.type.kind === "string" || key.type.kind === "dyn") {
                 const opt = hasOptionalChainGuard(expr.expression);
-                return lowerer.maybeNarrow({ kind: "dynKeyGet", key, ...(opt ? { optional: true } : {}), value: obj, type: DYN, loc: locOf(expr) }, expr);
+                return lowerer.maybeNarrow({ kind: "dynKeyGet", key, ...(opt ? { optional: true } : {}), value: lowerer.coerceToExpected(obj, DYN), type: DYN, loc: locOf(expr) }, expr);
             }
         }
         // A checker-`any` receiver that LOWERS to a static ARRAY
@@ -4104,6 +4533,9 @@ export function lowerElementAccess(lowerer, expr) {
         if (obj.type.kind === "array") {
             const index = lowerer.lowerExpr(expr.argumentExpression);
             if (index.type.kind === "f64") {
+                const safe = lowerSafeIndexRead(lowerer, obj, index, locOf(expr));
+                if (safe)
+                    return safe;
                 return lowerer.maybeNarrow({ kind: "arrayGet", arr: obj, index, type: obj.type.elem, loc: locOf(expr) }, expr);
             }
         }
@@ -4126,7 +4558,7 @@ export function lowerElementAccess(lowerer, expr) {
                     }
                 }
             }
-            if (key.type.kind === "string") {
+            if (key.type.kind === "string" || key.type.kind === "f64") {
                 const lit = ts.isStringLiteral(expr.argumentExpression)
                     ? expr.argumentExpression.text
                     : null;
@@ -4134,33 +4566,20 @@ export function lowerElementAccess(lowerer, expr) {
                 if (keyed)
                     return lowerer.maybeNarrow(keyed, expr);
             }
-            // `u?.split(":")[0]` — a NUMBER index over an undefined-armed
-            // array union: the array arm answers its element (invalid indices
-            // trap — divergence 4's policy), unit arms answer undefined (the
-            // chain's short-circuit value). Every non-unit arm must be the
-            // same array type.
-            if (key.type.kind === "f64") {
-                const def = lowerer.unions.get(value.type.unionId);
-                const arrArms = def?.arms.filter((a) => a.kind === "array") ?? [];
-                if (def &&
-                    arrArms.length > 0 &&
-                    def.arms.every((a) => a.kind === "array" || isUnitType(a)) &&
-                    arrArms.every((a) => typeEquals(a, arrArms[0]))) {
-                    const elem = arrArms[0].elem;
-                    const hasUnit = def.arms.some(isUnitType);
-                    const t = !hasUnit
-                        ? elem
-                        : elem.kind === "union"
-                            ? lowerer.withUndefinedArmOf(elem)
-                            : lowerer.withUndefinedArm(elem);
-                    if (t) {
-                        return lowerer.maybeNarrow({ kind: "unionKeyGet", unionId: value.type.unionId, key, value, type: t, loc: locOf(expr) }, expr);
-                    }
-                }
-            }
         }
     }
     if (receiverIr?.kind !== "array") {
+        {
+            const receiver = tryLowerExpression(lowerer, expr.expression);
+            if (receiver?.type.kind === "func" &&
+                canBoxFuncIntoDyn(receiver.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
+                const key = lowerRecordPropertyKey(lowerer, lowerer.lowerExpr(expr.argumentExpression), expr.argumentExpression);
+                if (key.type.kind === "string") {
+                    const boxed = { kind: "dynFrom", value: receiver, type: DYN, loc: locOf(expr.expression) };
+                    return lowerer.maybeNarrow({ kind: "dynKeyGet", key, value: boxed, type: DYN, loc: locOf(expr) }, expr);
+                }
+            }
+        }
         if (receiverIr?.kind === "string") {
             // `s[i]` with a number index reads a UTF-16 code unit — charAt's
             // exact job (the UTF-16-exact runtime). Without
@@ -4168,16 +4587,23 @@ export function lowerElementAccess(lowerer, expr) {
             // and charAt's "" is the only string-typed answer for an
             // out-of-range or fractional index where JS reads `undefined` —
             // SEMANTICS.md documents the divergence; in-range integer reads
-            // (the loop pattern) are JS-exact. Under noUncheckedIndexedAccess
-            // the read types `string | undefined`, which charAt cannot honor —
-            // fenced.
+            // (the loop pattern) are JS-exact. Optional results instead retain
+            // undefined for missing string properties.
+            const recv = lowerer.lowerExpr(expr.expression);
             const index = lowerer.lowerExpr(expr.argumentExpression);
-            if (index.type.kind === "f64" && lowerer.mapTypeOf(lowerer.typeOf(expr))?.kind === "string") {
-                const recv = lowerer.lowerExpr(expr.expression);
-                return { kind: "strIntrinsic", method: "charAt", receiver: recv, args: [index], type: STRING, loc: locOf(expr) };
+            const resultType = lowerer.mapTypeOf(lowerer.typeOf(expr));
+            if (index.type.kind === "f64" && recv.type.kind === "string") {
+                if (resultType?.kind === "string") {
+                    return { kind: "strIntrinsic", method: "charAt", receiver: recv, args: [index], type: STRING, loc: locOf(expr) };
+                }
+                if (resultType?.kind === "union") {
+                    const arms = lowerer.unions.get(resultType.unionId)?.arms;
+                    if (arms?.length === 2 && lowerer.armTag(resultType.unionId, STRING) >= 0 && lowerer.armTag(resultType.unionId, UNDEFINED_T) >= 0) {
+                        return lowerOptionalStringIndex(lowerer, recv, index, resultType, locOf(expr));
+                    }
+                }
             }
-            lowerer.unsupported("SC1090", expr, "string indexing with this index/result shape (a number index typed 'string' lowers to charAt; " +
-                "use .charAt(i) under noUncheckedIndexedAccess)");
+            lowerer.unsupported("SC1090", expr, "string indexing with this index/result shape (expected a number index and a string or string | undefined result)");
         }
         lowerer.unsupported("SC1090", expr, "element access on non-array values");
     }
@@ -4255,14 +4681,17 @@ export function lowerElementAccess(lowerer, expr) {
     // can validate, and fences by name when it is not — an arrayGet over a
     // dyn receiver is never emitted (the validator ICE).
     if (arr.type.kind === "dyn") {
-        if (isJsonSafeType(receiverIr, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
+        if (canDynCheckTo(receiverIr, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
             arr = { kind: "dynCheck", value: arr, type: receiverIr, loc: locOf(expr) };
         }
         else {
             lowerer.unsupported("SC1090", expr, `element access on checked-dynamic values with '${lowerer.fmt(receiverIr)}' elements`);
         }
     }
-    const index = lowerer.lowerExpr(expr.argumentExpression);
+    // Array reads can themselves supply an index. A missing numeric value
+    // is undefined, whose property lookup misses just like NaN; keep that
+    // value instead of rejecting a checker-number index with optional IR.
+    const index = lowerOptionalNumber(lowerer, lowerer.lowerExpr(expr.argumentExpression), locOf(expr.argumentExpression), expr.argumentExpression);
     if (index.type.kind !== "f64") {
         lowerer.unsupported("SC1090", expr.argumentExpression, "indexing with non-number keys");
     }
@@ -4384,6 +4813,26 @@ export function lowerRecordKeyRead(lowerer, expr, shapeId, shape, includeUndefin
         // to observe the missing value instead of throwing during that check.
         return includeUndefined ? read : lowerer.maybeNarrow(read, expr);
     }
+    if (litKey !== null) {
+        const nominal = representedClassFieldTarget(lowerer, expr.expression, litKey, obj);
+        if (nominal) {
+            const read = lowerer.fieldGetExpr(nominal, loc, expr);
+            return includeUndefined ? read : lowerer.maybeNarrow(read, expr);
+        }
+    }
+    if (hasClassPayload(lowerer, obj.type)) {
+        lowerer.unsupported("SC1090", expr, "computed property reads through structural views of class instances (use a declared literal key)");
+    }
+    // Predicates can strengthen optional fields without changing the
+    // receiver's stored layout. Use that layout for bracket reads just as
+    // fieldTarget does for the corresponding dot reads.
+    if (obj.type.kind === "record") {
+        const actualShape = lowerer.shapes.get(obj.type.shapeId);
+        if (!actualShape)
+            throw new InternalCompilerError("record receiver is missing its stored shape");
+        shapeId = obj.type.shapeId;
+        shape = actualShape;
+    }
     if (litKey !== null) {
         const field = shape.fields.find((f) => f.name === litKey);
         if (field) {
@@ -4429,7 +4878,7 @@ export function lowerRecordKeyRead(lowerer, expr, shapeId, shape, includeUndefin
     let declared = null;
     if (shape.indexValue) {
         declared = shape.indexValue;
-        if (includeUndefined || lowerer.program.getCompilerOptions().noUncheckedIndexedAccess) {
+        if (declared.kind !== "dyn" && (includeUndefined || lowerer.program.getCompilerOptions().noUncheckedIndexedAccess)) {
             declared = lowerer.withUndefinedArmOf(declared);
             if (!declared)
                 lowerer.badType(expr, lowerer.typeOf(expr));
@@ -4439,6 +4888,8 @@ export function lowerRecordKeyRead(lowerer, expr, shapeId, shape, includeUndefin
         shape.fields.every((f) => typeEquals(f.type, shape.fields[0].type))) {
         declared = shape.fields[0].type;
     }
+    if (!declared && isJsSourceFile(expr.getSourceFile()) && recordKeyResultOk(lowerer, shape, DYN))
+        declared = DYN;
     if (!declared) {
         lowerer.unsupported("SC1090", expr, `dynamic keyed reads of '${lowerer.fmt({ kind: "record", shapeId })}' (the declared fields have no one common type)`);
     }
@@ -4483,6 +4934,10 @@ export function lowerAbsenceProbe(lowerer, node) {
     }
     if (ts.isPropertyAccessExpression(expr)) {
         const target = lowerer.fieldTarget(expr);
+        if (target?.container === "class" && target.fieldType.kind === "union" &&
+            lowerer.unions.get(target.fieldType.unionId)?.arms.some(isUnitType)) {
+            return lowerer.fieldGetExpr(target, locOf(expr), expr);
+        }
         if (target?.container !== "recordOvf")
             return null;
         // A JS file-scope object-literal global is record-shaped to the
@@ -4584,6 +5039,7 @@ function recordKeyTypeLiteralText(lowerer, node) {
 function recordKeyResultOk(lowerer, shape, type) {
     const surfaces = (t) => typeEquals(t, type) ||
         (type.kind === "union" && lowerer.armTag(type.unionId, t) >= 0) ||
+        exactUnionWidening(lowerer, t, type) ||
         (type.kind === "dyn" && lowerer.dynConvertible(t));
     if (!shape.fields.every((f) => surfaces(f.type)))
         return false;
@@ -4595,6 +5051,13 @@ function recordKeyResultOk(lowerer, shape, type) {
     }
     return true;
 }
+function exactUnionWidening(lowerer, from, to) {
+    if (from.kind !== "union" || to.kind !== "union")
+        return false;
+    const source = lowerer.unions.get(from.unionId);
+    const target = lowerer.unions.get(to.unionId);
+    return !!source && !!target && unionWideningTags(source.arms, target.arms) !== null;
+}
 /** The literal index of a tuple access, or null when the expression isn't
    * a non-negative integer literal (parentheses tolerated — tsc's own
    * literal-index typing accepts them). */
@@ -4679,16 +5142,71 @@ export function lowerElementCompound(lowerer, expr, op) {
         loc,
     };
 }
-/** `a[i] = v` in statement position → arraySet (element writes, like local
-   * assignment, produce no value in our subset). */
+/** Checked member assignment evaluates the reference before its RHS and
+   * yields the original assigned value, including in a chained assignment. */
+function lowerDynMemberAssignment(lowerer, expr, recv) {
+    const loc = locOf(expr);
+    const target = expr.left;
+    const receiver = lowerer.declareHiddenLocal("%setReceiver", DYN);
+    const keyValue = ts.isElementAccessExpression(target)
+        ? lowerer.lowerExprExpecting(target.argumentExpression, DYN)
+        : lowerer.coerceToExpected({ kind: "strLit", value: target.name.text, type: STRING, loc }, DYN);
+    const key = lowerer.declareHiddenLocal("%setKey", DYN);
+    const raw = lowerer.lowerExpr(expr.right);
+    const value = raw.type.kind === "void"
+        ? {
+            kind: "seqExpr", stmts: [{ kind: "exprStmt", expr: raw, loc }],
+            result: dynUndefinedExpr(loc), type: DYN, loc,
+        }
+        : isUnitType(raw.type) ? lowerer.coerceInto(expr.right, raw, DYN) : raw;
+    const assigned = lowerer.declareHiddenLocal("%setValue", value.type);
+    const result = varRef(assigned.id, value.type, loc);
+    const stored = lowerer.coerceInto(expr.right, result, DYN);
+    // Evaluate the reference before the RHS, but defer key coercion until
+    // PutValue. Yield the RHS without rereading a setter-backed property.
+    return {
+        kind: "seqExpr", stmts: [
+            { kind: "varDecl", localId: receiver.id, init: recv, loc },
+            { kind: "varDecl", localId: key.id, init: keyValue, loc },
+            { kind: "varDecl", localId: assigned.id, init: value, loc },
+            { kind: "exprStmt", expr: { kind: "libCall", fn: "dyn.keySetComputed", args: [varRef(receiver.id, DYN, loc), varRef(key.id, DYN, loc), stored], type: VOID, loc }, loc },
+        ], result, type: result.type, loc,
+    };
+}
+/** JavaScript callable members live on the closure, so aliases and chained
+ * writes share the same storage as Object.defineProperties. */
+export function lowerNativeFunctionAssignment(lowerer, expr) {
+    const target = expr.left;
+    if (!isJsSourceFile(expr.getSourceFile()) ||
+        (!ts.isPropertyAccessExpression(target) && !ts.isElementAccessExpression(target)) ||
+        target.questionDotToken)
+        return null;
+    const receiver = tryLowerExpression(lowerer, target.expression);
+    if (receiver?.type.kind !== "func" ||
+        !canBoxFuncIntoDyn(receiver.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id)))
+        return null;
+    fenceNodeModuleMutation(lowerer, target, "assignment");
+    const fnName = jsFuncNameOf(target.expression);
+    const boxed = {
+        kind: "dynFrom", value: receiver, type: DYN, loc: locOf(target.expression),
+        ...(fnName !== null ? { fnName } : {}),
+    };
+    return lowerDynMemberAssignment(lowerer, expr, boxed);
+}
 export function lowerElementWrite(lowerer, expr) {
     const target = expr.left;
     fenceNodeModuleMutation(lowerer, target, "assignment");
+    const globalKey = globalSymbolKey(lowerer, target.expression, target.argumentExpression);
+    if (globalKey) {
+        const value = lowerer.lowerExprExpecting(expr.right, DYN);
+        const loc = locOf(expr);
+        return { kind: "exprStmt", expr: { kind: "libCall", fn: "dyn.globalSymbolSet", args: [globalKey, value], type: VOID, loc }, loc };
+    }
     // `process.env[key] = v` — the computed twin of the dotted env write:
     // setenv(3), string keys and string values only.
     if (lowerer.isProcessEnv(target.expression) && !target.questionDotToken) {
         const loc = locOf(expr);
-        const key = lowerer.lowerExpr(target.argumentExpression);
+        const key = lowerEnvironmentKey(lowerer, target.argumentExpression);
         if (key.type.kind !== "string") {
             lowerer.unsupported("SC1090", target.argumentExpression, "indexing process.env with non-string keys");
         }
@@ -4712,9 +5230,21 @@ export function lowerElementWrite(lowerer, expr) {
             const value = lowerer.lowerExprExpecting(expr.right, fieldT.fieldType);
             return lowerer.fieldSetStmt(fieldT, value, locOf(expr), target);
         }
-        lowerer.unsupported("SC1090", target, "symbol-keyed property writes outside class fields keyed by a module-level `const k = Symbol('desc')` (static shapes have no symbol-keyed storage)");
+        const receiver = lowerer.lowerExpr(target.expression);
+        if (receiver.type.kind === "dyn")
+            return { kind: "exprStmt", expr: lowerDynMemberAssignment(lowerer, expr, receiver), loc: locOf(expr) };
+        lowerer.unsupported("SC1090", target, "symbol-keyed property writes outside class fields keyed by a stable module-level literal Symbol()/Symbol.for() (other static shapes have no symbol-keyed storage)");
+    }
+    const checkedReceiver = tryLowerExpression(lowerer, target.expression);
+    if (checkedReceiver?.type.kind === "dyn") {
+        return { kind: "exprStmt", expr: lowerDynMemberAssignment(lowerer, expr, checkedReceiver), loc: locOf(expr) };
+    }
+    let receiverIr = lowerer.mapTypeOf(lowerer.typeOf(target.expression));
+    if (receiverIr === null || receiverIr.kind === "dyn") {
+        const receiver = tryLowerExpression(lowerer, target.expression);
+        if (receiver?.type.kind === "array")
+            receiverIr = receiver.type;
     }
-    const receiverIr = lowerer.mapTypeOf(lowerer.typeOf(target.expression));
     if (receiverIr?.kind === "jsval") {
         const obj = lowerer.lowerExpr(target.expression);
         // Dispatch follows the RUNTIME world (383(d)): a checker-'any'
@@ -4756,9 +5286,7 @@ export function lowerElementWrite(lowerer, expr) {
         const obj = lowerer.lowerExpr(target.expression);
         if (obj.type.kind === "dyn") {
             const loc = locOf(expr);
-            let key = lowerer.lowerExpr(target.argumentExpression);
-            if (key.type.kind === "f64")
-                key = lowerer.ensureString(key, target.argumentExpression);
+            const key = lowerRecordPropertyKey(lowerer, lowerer.lowerExpr(target.argumentExpression), target.argumentExpression);
             if (key.type.kind !== "string") {
                 lowerer.unsupported("SC1090", target.argumentExpression, "indexing with non-string or non-number keys");
             }
@@ -4769,6 +5297,20 @@ export function lowerElementWrite(lowerer, expr) {
             return { kind: "exprStmt", expr: { kind: "libCall", fn: "dyn.keySet", args: [obj, key, value], type: VOID, loc }, loc };
         }
     }
+    if (receiverIr?.kind === "object" || receiverIr?.kind === "record") {
+        const key = recordKeyLiteralText(target.argumentExpression) ?? recordKeyTypeLiteralText(lowerer, target.argumentExpression);
+        if (key !== null) {
+            const receiver = lowerer.lowerExpr(target.expression);
+            const field = representedClassFieldTarget(lowerer, target.expression, key, receiver);
+            if (field) {
+                const value = lowerer.lowerExprExpecting(expr.right, field.fieldType);
+                return lowerer.fieldSetStmt(field, value, locOf(expr), target);
+            }
+            if (hasClassPayload(lowerer, receiver.type)) {
+                lowerer.unsupported("SC1090", target, "writing undeclared properties through structural views of class instances");
+            }
+        }
+    }
     // Typed-array element write `b[i] = v` — bytesSet: the value is an f64
     // the runtime coerces JS-exactly; invalid indices trap (no appends —
     // typed arrays are fixed-length; JS would ignore the write).
@@ -4783,6 +5325,9 @@ export function lowerElementWrite(lowerer, expr) {
             return { kind: "exprStmt", expr: { kind: "jsOp", op: "setIdx", args: [recv, key, value], type: VOID, loc }, loc };
         }
         const index = lowerer.lowerExpr(target.argumentExpression);
+        if (index.type.kind === "dyn" && recv.type.kind === "bytes") {
+            return { kind: "exprStmt", expr: lowerDynMemberAssignment(lowerer, expr, lowerer.coerceInto(target.expression, recv, DYN)), loc: locOf(expr) };
+        }
         if (index.type.kind !== "f64") {
             lowerer.unsupported("SC1090", target.argumentExpression, "indexing with non-number keys");
         }
@@ -4798,6 +5343,9 @@ export function lowerElementWrite(lowerer, expr) {
         // a recordSet/recordKeySet over a jsval.
         if (shape) {
             const obj = lowerer.lowerExpr(target.expression);
+            if (hasClassPayload(lowerer, obj.type)) {
+                lowerer.unsupported("SC1090", target, "computed property writes through structural views of class instances (use a declared literal key)");
+            }
             if (obj.type.kind === "jsval") {
                 const key = lowerer.jsvalIn(lowerer.lowerExpr(target.argumentExpression), target.argumentExpression);
                 const value = lowerer.jsvalIn(lowerer.lowerExpr(expr.right), expr.right);
@@ -4949,9 +5497,9 @@ export function lowerElementWrite(lowerer, expr) {
     // type (static `any` — mapTypeOf answers null without --dynamic)
     // probes the receiver's own lowered world: a dyn value takes the same
     // write, anything else falls through to the fences.
-    if (receiverIr?.kind === "dyn" || receiverIr === null) {
+    if (receiverIr?.kind === "dyn" || receiverIr?.kind === "object" || receiverIr === null) {
         const obj = receiverIr !== null ? lowerer.lowerExpr(target.expression) : tryLowerExpression(lowerer, target.expression);
-        if (obj !== null && obj.type.kind === "dyn") {
+        if (obj !== null && (obj.type.kind === "dyn" || isDynTypedRefType(obj.type))) {
             const loc = locOf(expr);
             const litKey = recordKeyLiteralText(target.argumentExpression);
             let key = litKey !== null
@@ -4965,7 +5513,7 @@ export function lowerElementWrite(lowerer, expr) {
             if (value.type.kind !== "dyn") {
                 lowerer.unsupported("SC1101", expr.right, `storing '${lowerer.fmt(value.type)}' values in a checked-dynamic object (the value cannot convert into the checked-dynamic tree)`);
             }
-            return { kind: "exprStmt", expr: { kind: "libCall", fn: "dyn.keySet", args: [obj, key, value], type: VOID, loc }, loc };
+            return { kind: "exprStmt", expr: { kind: "libCall", fn: "dyn.keySet", args: [lowerer.coerceToExpected(obj, DYN), key, value], type: VOID, loc }, loc };
         }
     }
     if (receiverIr?.kind !== "array") {
@@ -4995,19 +5543,42 @@ export function lowerElementWrite(lowerer, expr) {
     if (arr.type.kind !== "array") {
         lowerer.unsupported("SC1090", target.expression, "assignment through a possibly missing nested array receiver");
     }
-    const index = lowerer.lowerExpr(target.argumentExpression);
+    const index = lowerOptionalNumber(lowerer, lowerer.lowerExpr(target.argumentExpression), locOf(target.argumentExpression), target.argumentExpression);
     if (index.type.kind !== "f64") {
         lowerer.unsupported("SC1090", target.argumentExpression, "indexing with non-number keys");
     }
     // Optional array reads carry the source array's payload type plus an
     // undefined arm. arrayValueStore turns that arm into the runtime's
     // UNDEFINED state while keeping number[]/string[] payload storage scalar.
-    const value = lowerer.lowerExpr(expr.right);
-    return arrayValueStore(lowerer, arr, index, value, receiverIr.elem, locOf(expr));
+    let literal = expr.right;
+    while (ts.isParenthesizedExpression(literal) || ts.isSatisfiesExpression(literal))
+        literal = literal.expression;
+    const value = ts.isObjectLiteralExpression(literal) || ts.isArrayLiteralExpression(literal)
+        ? lowerer.lowerExprExpecting(literal, arr.type.elem) : lowerer.lowerExpr(expr.right);
+    // Validate the payload before emitting a native store. A dormant JS
+    // method can contradict its JSDoc element type; retain its call-time
+    // refusal instead of leaving invalid IR in a newly reachable method.
+    const expected = value.type.kind === "undefinedT" ||
+        value.type.kind === "union" && lowerer.armTag(value.type.unionId, UNDEFINED_T) >= 0
+        ? arrayValueType(lowerer, arr.type.elem) : arr.type.elem;
+    return arrayValueStore(lowerer, arr, index, lowerer.coerceInto(expr.right, value, expected), arr.type.elem, locOf(expr));
+}
+/** Environment property names use ToPrimitive with the string hint, so
+ * checked objects must execute their own conversion hooks. */
+export function lowerEnvironmentKey(lowerer, node) {
+    const key = lowerer.lowerExpr(node);
+    if (key.type.kind === "dyn")
+        return { kind: "libCall", fn: "dyn.toStringCoerce", args: [key], type: STRING, loc: key.loc };
+    return lowerRecordPropertyKey(lowerer, key, node);
 }
 export function ensureString(lowerer, e, node) {
     if (e.type.kind === "string")
         return e;
+    if (e.type.kind === "url")
+        return { kind: "libCall", fn: "url.href", args: [e], type: STRING, loc: e.loc };
+    if (e.type.kind === "regex") {
+        return { kind: "regexIntrinsic", method: "toString", receiver: e, args: [], type: STRING, loc: e.loc };
+    }
     if (e.type.kind === "bigint") {
         return {
             kind: "libCall",
@@ -5023,18 +5594,21 @@ export function ensureString(lowerer, e, node) {
         // strings verbatim, arrays via join, objects as "[object Object]").
         return { kind: "toString", operand: e, type: STRING, loc: e.loc };
     }
+    if (e.type.kind === "bytes") {
+        // Preserve the runtime brand: typed arrays join numeric elements,
+        // while a Buffer stored in a Uint8Array slot decodes its bytes.
+        const boxed = { kind: "dynFrom", value: e, type: DYN, loc: e.loc };
+        return { kind: "toString", operand: boxed, type: STRING, loc: e.loc };
+    }
     if (e.type.kind === "jsval") {
         // String(v) in the engine — JS-exact (and Node-exact in templates).
         return { kind: "jsOp", op: "toStr", args: [e], type: STRING, loc: e.loc };
     }
     if (e.type.kind === "object") {
-        // String(err) / `${err}` over the Error hierarchy: Error.prototype
-        // .toString — the ONE runtime implementation (overriding it is
-        // fenced), "name: message" with the empty-side elisions, exactly
-        // Node's String(err), which carries no stack either.
+        // String(err) / `${err}` uses the same dispatch as err.toString().
         for (let c = lowerer.classes.get(e.type.className) ?? null; c; c = c.base) {
             if (c.builtinError) {
-                return { kind: "libCall", fn: "error.toString", args: [lowerer.upcastTo(e, "%Error")], type: STRING, loc: e.loc };
+                return errorToStringCall(lowerer, e);
             }
         }
     }
@@ -5225,6 +5799,38 @@ export function lowerAsExpression(lowerer, expr) {
             return lowerer.jsvalIn(inner, expr.expression);
         }
         const target = lowerer.mapTypeOf(targetTs0);
+        // Unknown-only record views use the checked-dynamic representation.
+        // A native record asserted to such a view still denotes the original
+        // object. Box a live reference instead of erasing the assertion and
+        // handing native storage to a checked-dynamic property operation.
+        if (target?.kind === "dyn" && (targetTs0.flags & ts.TypeFlags.Object) !== 0) {
+            const sourceShape = inner.type.kind === "record" ? lowerer.shapes.get(inner.type.shapeId) : undefined;
+            if (hasClassPayload(lowerer, inner.type) || sourceShape && shapeHasAccessorSlots(sourceShape)) {
+                lowerer.unsupported("SC1090", expr, "opaque structural views of classes or accessor records (name the property's concrete type to retain native accessor dispatch)");
+            }
+            const boxed = lowerer.coerceInto(expr, inner, DYN);
+            return boxed.kind === "dynFrom" ? { ...boxed, liveRef: true } : boxed;
+        }
+        // Collection assertions are interface views only: their backing
+        // value must already have the same native key/element/value layout.
+        // Erasing a mock or a different instantiation here would let member
+        // lowering interpret a record (or another ABI) as a native handle.
+        if (target?.kind === "map" || target?.kind === "set") {
+            return lowerer.coerceInto(expr, inner, target);
+        }
+        // A class-derived interface still names the class's native layout.
+        // An assertion must not let a structural mock acquire that layout;
+        // unions retain their checked extraction below, and real instances
+        // keep the ordinary class narrowing path.
+        if (target?.kind === "object" && inner.type.kind !== "object" && inner.type.kind !== "union") {
+            return lowerer.coerceInto(expr, inner, target);
+        }
+        if (target?.kind === "object" && inner.type.kind === "object" &&
+            !typeEquals(target, inner.type) &&
+            !lowerer.isSubclassOf(inner.type.className, target.className) &&
+            !lowerer.isSubclassOf(target.className, inner.type.className)) {
+            return lowerer.coerceInto(expr, inner, target);
+        }
         // Static assertions normally erase, but record layouts are
         // monomorphic: a consumer selected from the asserted shape must see
         // that shape physically. Reuse the ordinary slot coercion so plain
@@ -5277,7 +5883,21 @@ export function lowerAsExpression(lowerer, expr) {
         lowerer.badType(expr.type, targetTs);
     if (target.kind === "dyn")
         return inner; // `as unknown`: erasure
-    if (target.kind === "void" || !lowerer.jsonSafe(target)) {
+    // An all-`unknown`-fields record target (`err as { code?: unknown }`
+    // — the errno-probing idiom): there is nothing to validate (every
+    // field is unknown, exactly what the dyn value already answers) and
+    // nothing to build — the cast is pure typing, so it ERASES and the
+    // reads ride the dyn keyed read.
+    if (target.kind === "record") {
+        const shape = lowerer.shapes.get(target.shapeId);
+        if (shape &&
+            !shape.tuple &&
+            shape.fields.every((f) => f.type.kind === "dyn") &&
+            (!shape.indexValue || shape.indexValue.kind === "dyn")) {
+            return inner;
+        }
+    }
+    if (target.kind === "void" || !canDynCheckTo(target, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
         // Bare undefined-armed targets pass when every OTHER arm is
         // JSON-safe: the checked-dynamic tree holds a first-class undefined value now
         // (index-signature overflow reads produce it for missing keys), and
@@ -5313,20 +5933,6 @@ export function lowerAsExpression(lowerer, expr) {
         if (DYN_HANDLE_KINDS.has(target.kind)) {
             return { kind: "dynCheck", value: inner, type: target, loc: locOf(expr) };
         }
-        // An all-`unknown`-fields record target (`err as { code?: unknown }`
-        // — the errno-probing idiom): there is nothing to validate (every
-        // field is unknown, exactly what the dyn value already answers) and
-        // nothing to build — the cast is pure typing, so it ERASES and the
-        // reads ride the dyn keyed read.
-        if (target.kind === "record") {
-            const shape = lowerer.shapes.get(target.shapeId);
-            if (shape &&
-                !shape.tuple &&
-                shape.fields.every((f) => f.type.kind === "dyn") &&
-                (!shape.indexValue || shape.indexValue.kind === "dyn")) {
-                return inner;
-            }
-        }
         lowerer.unsupported("SC1090", expr, `a checked cast of 'unknown' to '${target.kind === "void" ? "void" : lowerer.fmt(target)}' ` +
             `(a dynamic value can only be validated against JSON-representable types: ` +
             `number, string, boolean, records, arrays, and unions of those)`);
@@ -5344,7 +5950,10 @@ export function lowerPrefixUnary(lowerer, expr) {
             if (raw.type.kind === "bigint") {
                 return { kind: "libCall", fn: "bigint.neg", args: [raw], type: BIGINT_T, loc };
             }
-            const operand = lowerOptionalNumber(lowerer, raw, loc, expr.operand);
+            // Match the checked numeric boundary used by JS binary arithmetic.
+            const operand = raw.type.kind === "dyn" && isJsSourceFile(expr.getSourceFile())
+                ? { kind: "dynCheck", value: raw, type: F64, loc }
+                : lowerOptionalNumber(lowerer, raw, loc, expr.operand);
             if (operand.type.kind !== "f64")
                 lowerer.unsupported("SC1043", expr);
             if (operand.kind === "numLit")
@@ -5353,6 +5962,9 @@ export function lowerPrefixUnary(lowerer, expr) {
         }
         case ts.SyntaxKind.PlusToken: {
             const raw = lowerer.lowerExpr(expr.operand);
+            if (raw.type.kind === "dyn") {
+                return { kind: "libCall", fn: "dyn.toNumberCoerce", args: [raw], type: F64, loc };
+            }
             // Unary + is ToNumber; on an already-number operand it's identity,
             // and a STRING operand runs the runtime's ECMA-exact StringToNumber
             // (num.fromString — Number(aString)'s lowering, scr_string.c).
@@ -5378,14 +5990,16 @@ export function lowerPrefixUnary(lowerer, expr) {
             if (raw.type.kind === "bigint") {
                 return { kind: "libCall", fn: "bigint.not", args: [raw], type: BIGINT_T, loc };
             }
+            if (raw.type.kind === "dyn")
+                return {
+                    kind: "libCall", fn: "dyn.bitwise", args: [raw, dynUndefinedExpr(loc), { kind: "strLit", value: "~", type: STRING, loc }], type: DYN, loc,
+                };
             // A checked-dynamic value retains enough JavaScript structure to
             // run exact ToNumber, including the object valueOf/toString
             // protocol. This is the static `any`/JS-lane answer for idioms
             // such as `while (~index)`, where inference may have widened an
             // otherwise numeric slot to the checked-dynamic tree.
-            const operand = raw.type.kind === "dyn"
-                ? { kind: "libCall", fn: "dyn.toNumberCoerce", args: [raw], type: F64, loc }
-                : lowerOptionalNumber(lowerer, raw, loc, expr.operand);
+            const operand = lowerOptionalNumber(lowerer, raw, loc, expr.operand);
             if (operand.type.kind !== "f64")
                 lowerer.unsupported("SC1043", expr);
             return { kind: "unary", op: "~", operand, type: F64, loc };
@@ -5395,7 +6009,7 @@ export function lowerPrefixUnary(lowerer, expr) {
             // `++x` / `--x` in expression position: yields the NEW value.
             return lowerIncDec(lowerer, expr, true);
     }
-    lowerer.unsupported("SC1090", expr, `syntax '${ts.SyntaxKind[expr.kind]}'`);
+    lowerer.unsupported("SC1090", expr, `syntax '${ts.syntaxKindName(expr.kind)}'`);
 }
 /** `x++`/`x--`/`++x`/`--x` in EXPRESSION position — the incDec node:
    * read, write ±1, yield old (postfix) or new (prefix) value. Receivers
@@ -5407,6 +6021,14 @@ function lowerIncDec(lowerer, expr, prefix) {
     const loc = locOf(expr);
     const op = expr.operator === ts.SyntaxKind.PlusPlusToken ? "+" : "-";
     if (!ts.isIdentifier(expr.operand)) {
+        if (ts.isPropertyAccessExpression(expr.operand)) {
+            const target = staticFieldWriteTarget(lowerer, expr.operand);
+            if (target) {
+                if (target.type.kind !== "f64")
+                    lowerer.unsupported("SC1043", expr);
+                return { kind: "incDec", op, prefix, localId: target.id, type: F64, loc };
+            }
+        }
         // CLASS-FIELD receivers (`if (--this.limit === 0)` — countdown.js's
         // dec(); `--this[kLimit]` — its symbol-keyed spelling): a single-
         // evaluation read-modify-write over the instance, yielding old/new
@@ -5447,6 +6069,16 @@ function lowerIncDec(lowerer, expr, prefix) {
     if (!target) {
         lowerer.rejectUnresolved(expr.operand, `increment/decrement of '${expr.operand.text}' (not a writable local or module global)`);
     }
+    if (target.type.kind === "dyn") {
+        const old = lowerer.declareHiddenLocal("%numericOld", DYN);
+        const next = lowerer.declareHiddenLocal("%numericNext", DYN);
+        const read = lowerer.lowerExpr(expr.operand);
+        return { kind: "seqExpr", stmts: [
+                { kind: "varDecl", localId: old.id, init: { kind: "libCall", fn: "dyn.toNumeric", args: [read], type: DYN, loc }, loc },
+                { kind: "varDecl", localId: next.id, init: { kind: "libCall", fn: "dyn.increment", args: [varRef(old.id, DYN, loc), { kind: "boolLit", value: op === "+", type: BOOL, loc }], type: DYN, loc }, loc },
+                { kind: "assign", localId: target.id, value: varRef(next.id, DYN, loc), loc },
+            ], result: varRef(prefix ? next.id : old.id, DYN, loc), type: DYN, loc };
+    }
     if (target.type.kind !== "f64")
         lowerer.unsupported("SC1043", expr);
     return { kind: "incDec", op, prefix, localId: target.id, type: F64, loc };
@@ -5498,7 +6130,7 @@ function lowerAnyBinaryInIsland(lowerer, expr, left, right, loc) {
     };
     const jop = JS_BIN[op];
     if (jop === undefined) {
-        lowerer.unsupported("SC1090", expr, `operator '${ts.tokenToString(op) ?? ts.SyntaxKind[op]}' on 'any' values`);
+        lowerer.unsupported("SC1090", expr, `operator '${ts.tokenToString(op) ?? ts.syntaxKindName(op)}' on 'any' values`);
     }
     const type = jsOpResultKind(jop) === "bool" ? BOOL : JSVAL;
     return {
@@ -5507,6 +6139,39 @@ function lowerAnyBinaryInIsland(lowerer, expr, left, right, loc) {
         type, loc,
     };
 }
+export function lowerCompoundValueToTarget(lowerer, expr, compound, target) {
+    const loc = locOf(expr);
+    const read = { kind: "varRef", localId: target.id, type: target.type, loc: locOf(expr.left) };
+    const rhs = lowerer.lowerExpr(expr.right);
+    const numericRhs = lowerOptionalNumber(lowerer, rhs, loc);
+    if (target.type.kind === "jsval" || rhs.type.kind === "jsval") {
+        const JS_COMPOUND = { "+": "add", "-": "sub", "*": "mul", "/": "div", "%": "mod", "**": "pow" };
+        const jop = JS_COMPOUND[compound];
+        if (jop === undefined)
+            lowerer.unsupported("SC1043", expr);
+        const wrapped = {
+            kind: "jsOp", op: jop,
+            args: [lowerer.jsvalIn(read, expr.left), lowerer.jsvalIn(rhs, expr.right)],
+            type: JSVAL, loc,
+        };
+        return lowerer.coerceInto(expr, wrapped, target.type);
+    }
+    if (compound === "+" && target.type.kind === "string") {
+        return { kind: "strConcat", left: read, right: lowerer.ensureString(rhs, expr.right), type: STRING, loc };
+    }
+    if (target.type.kind === "f64" && numericRhs.type.kind === "f64") {
+        return { kind: "bin", op: compound, left: read, right: numericRhs, type: F64, loc };
+    }
+    if ((target.type.kind === "dyn" || rhs.type.kind === "dyn") &&
+        (target.type.kind === "dyn" || target.type.kind === "f64") &&
+        (rhs.type.kind === "dyn" || rhs.type.kind === "f64") &&
+        isJsSourceFile(expr.getSourceFile())) {
+        const checkNum = (value) => value.type.kind === "dyn" ? { kind: "dynCheck", value, type: F64, loc: value.loc } : value;
+        const computed = { kind: "bin", op: compound, left: checkNum(read), right: checkNum(rhs), type: F64, loc };
+        return target.type.kind === "dyn" ? { kind: "dynFrom", value: computed, type: DYN, loc } : computed;
+    }
+    lowerer.unsupported("SC1043", expr);
+}
 export function lowerBinary(lowerer, expr) {
     const loc = locOf(expr);
     const op = expr.operatorToken.kind;
@@ -5514,6 +6179,15 @@ export function lowerBinary(lowerer, expr) {
     if (cacheHas)
         return cacheHas;
     if (op === ts.SyntaxKind.EqualsToken || (op >= ts.SyntaxKind.FirstCompoundAssignment && op <= ts.SyntaxKind.LastCompoundAssignment)) {
+        if (op === ts.SyntaxKind.EqualsToken) {
+            const callableWrite = lowerNativeFunctionAssignment(lowerer, expr);
+            if (callableWrite)
+                return callableWrite;
+        }
+        if (op === ts.SyntaxKind.QuestionQuestionEqualsToken ||
+            op === ts.SyntaxKind.AmpersandAmpersandEqualsToken || op === ts.SyntaxKind.BarBarEqualsToken) {
+            return lowerShortCircuitAssignment(lowerer, expr);
+        }
         if (ts.isPropertyAccessExpression(expr.left) || ts.isElementAccessExpression(expr.left)) {
             fenceNodeModuleMutation(lowerer, expr.left, "assignment");
         }
@@ -5539,8 +6213,29 @@ export function lowerBinary(lowerer, expr) {
         }
         const indexedCompound = COMPOUND_ASSIGN_OPS[op];
         if (indexedCompound !== undefined && ts.isElementAccessExpression(expr.left)) {
+            if (symbolFieldInfo(lowerer, expr.left))
+                return lowerFieldCompoundValue(lowerer, expr.left, indexedCompound, expr.right, loc);
             return lowerElementCompound(lowerer, expr, indexedCompound);
         }
+        if (indexedCompound !== undefined && ts.isIdentifier(expr.left)) {
+            const target = lowerer.resolveWritable(expr.left);
+            if (!target) {
+                lowerer.rejectUnresolved(expr.left, "assignment to an unresolved variable");
+            }
+            const value = lowerCompoundValueToTarget(lowerer, expr, indexedCompound, target);
+            return { kind: "assignExpr", localId: target.id, value, type: target.type, loc };
+        }
+        if (indexedCompound !== undefined &&
+            (ts.isPropertyAccessExpression(expr.left) || ts.isElementAccessExpression(expr.left)) &&
+            !(ts.isPropertyAccessExpression(expr.left) && expr.left.questionDotToken)) {
+            const target = expandoWritableTarget(lowerer, expr.left) ??
+                (ts.isPropertyAccessExpression(expr.left) ? nsWritableTarget(lowerer, expr.left) : null);
+            if (target) {
+                const value = lowerCompoundValueToTarget(lowerer, expr, indexedCompound, target);
+                return { kind: "assignExpr", localId: target.id, value, type: target.type, loc };
+            }
+            return lowerFieldCompoundValue(lowerer, expr.left, indexedCompound, expr.right, loc);
+        }
         // `events.defaultMaxListeners = v` — the module-property write
         // Node validates (validateNumber(n, 'defaultMaxListeners', 0)):
         // the value crosses into the checked-dynamic tree and the runtime ladder throws
@@ -5593,6 +6288,15 @@ export function lowerBinary(lowerer, expr) {
                 const value = lowerer.lowerExprExpecting(expr.right, target.type);
                 return { kind: "assignExpr", localId: target.id, value, type: target.type, loc };
             }
+            // Bundled numeric enums use e[e["name"] = value] = "name".
+            // Capture the receiver and key before the RHS. PutValue coerces the
+            // key afterward, then yields the RHS without rereading the property.
+            if (ts.isElementAccessExpression(expr.left) && !expr.left.questionDotToken) {
+                const recv = tryLowerExpression(lowerer, expr.left.expression);
+                if (recv?.type.kind === "dyn") {
+                    return lowerDynMemberAssignment(lowerer, expr, recv);
+                }
+            }
             // `h.k = v` on an ISLAND receiver in VALUE position: the engine
             // property write (setProp throws the engine's TypeErrors on
             // nullish receivers, bridged catchably), the RHS value threaded
@@ -5659,6 +6363,22 @@ export function lowerBinary(lowerer, expr) {
                         loc,
                     };
                 }
+                const field = lowerer.fieldTarget(expr.left);
+                if (field) {
+                    const recvTmp = lowerer.declareHiddenLocal("%setReceiver", field.obj.type);
+                    const receiver = field.obj;
+                    field.obj = varRef(recvTmp.id, receiver.type, loc);
+                    const value = lowerer.lowerExprExpecting(expr.right, field.fieldType);
+                    const valTmp = lowerer.declareHiddenLocal("%setValue", value.type);
+                    const result = varRef(valTmp.id, value.type, loc);
+                    return {
+                        kind: "seqExpr", stmts: [
+                            { kind: "varDecl", localId: recvTmp.id, init: receiver, loc },
+                            { kind: "varDecl", localId: valTmp.id, init: value, loc },
+                            lowerer.fieldSetStmt(field, result, loc, expr.left),
+                        ], result, type: result.type, loc,
+                    };
+                }
             }
         }
         // Destructuring assignment in VALUE position (`(() => [i] = [i+1])()`,
@@ -5685,221 +6405,7 @@ export function lowerBinary(lowerer, expr) {
         lowerer.unsupported("SC1040", expr, undefined, "object-to-primitive loose equality can call user-defined valueOf/toString methods — compare explicit primitive conversions instead");
     }
     if (op === ts.SyntaxKind.AmpersandAmpersandToken || op === ts.SyntaxKind.BarBarToken) {
-        if (op === ts.SyntaxKind.BarBarToken) {
-            const fallback = lowerAbsenceAwareOrChain(lowerer, expr);
-            if (fallback)
-                return fallback;
-        }
-        // JS value semantics: `a && b` is `toBool(a) ? b : a` — the result is
-        // an operand value, so both operands must share one IR kind (which is
-        // also what tsc's type says, modulo literal-union collapsing that
-        // mapType already handles). Mixed kinds (`n && s`) stay rejected.
-        const left = lowerAbsenceProbe(lowerer, expr.left) ?? lowerer.lowerExpr(expr.left);
-        const right = lowerer.lowerExpr(expr.right);
-        // A LITERAL-unit left operand (a compile-time undefined/null — the
-        // capability-probe members: `process.features.inspector ||
-        // !flag.startsWith('--inspect')` reads undefined in a compiled
-        // binary): statically falsy, so the operator folds JS-exactly —
-        // `unit || X` IS X, `unit && X` IS the unit (X's side effects never
-        // run in JS either; the lowered right is simply dropped). Literal
-        // units only — computed unit-typed values keep the fences below.
-        if (left.kind === "unitLit") {
-            return op === ts.SyntaxKind.BarBarToken ? right : left;
-        }
-        // JS objects and symbols are always truthy. In `ref || fallback`
-        // the fallback is therefore unreachable and the result is the
-        // already-evaluated left value — the browser-fallback idiom used by
-        // packages for `process.argv || []` and `process.env || {}`. The
-        // operand itself remains in the IR, preserving reads/calls that
-        // produce the reference; only the unreachable right lowering drops.
-        if (op === ts.SyntaxKind.BarBarToken && REF_TRUTHY_KINDS.has(left.type.kind)) {
-            return left;
-        }
-        if (left.type.kind === "dyn" || right.type.kind === "dyn") {
-            // A checked-dynamic operand (`fn.name || '<anonymous>'` —
-            // test/common's _mustCallInner): both sides live in the checked-dynamic tree and
-            // the deciding test is ToBoolean over the dyn kind
-            // (scr_dyn_truthy) — JS value semantics exactly, result dyn. The
-            // non-dyn side converts through the usual boundary; a value with
-            // no dyn representation keeps the fence.
-            const l = lowerer.coerceToExpected(left, DYN);
-            const r = lowerer.coerceToExpected(right, DYN);
-            if (l.type.kind !== "dyn" || r.type.kind !== "dyn") {
-                lowerer.unsupported("SC1100", expr, "logical operators on 'unknown' values");
-            }
-            return {
-                kind: "logical",
-                op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
-                left: l,
-                right: r,
-                type: DYN, loc,
-            };
-        }
-        if (left.type.kind === "jsval" || right.type.kind === "jsval") {
-            return {
-                kind: "logical",
-                op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
-                left: lowerer.jsvalIn(left, expr.left),
-                right: lowerer.jsvalIn(right, expr.right),
-                type: JSVAL, loc,
-            };
-        }
-        if (left.type.kind === "union" || right.type.kind === "union") {
-            // JS value semantics over a union: the deciding test is the ARM
-            // value's ToBoolean (a per-union helper), and the result is the
-            // deciding operand. Supported when the checker's type of the whole
-            // expression maps to ONE union both operands coerce into (same
-            // union passes through; a plain arm wraps — `u || undefined`).
-            // Everything else (`u && flag`, whose value would need a wider
-            // re-tagged union) stays fenced — in CONDITION position those
-            // shapes lower through lowerCondition's bool descent instead.
-            let target = lowerer.mapTypeOf(lowerer.typeOf(expr));
-            // A broad-JSDoc npm-static body can leave the CHECKER result `any`
-            // even after declaration-backed specialization has recovered both
-            // operands (`helpOption && args.find(...)` in commander). When the
-            // left consists only of always-truthy references and falsy units,
-            // the static result is exactly the right operand plus those units.
-            if (target === null &&
-                lowerer.implicitParamTypes !== null &&
-                npmStaticPackageOfPath(expr.getSourceFile().fileName) !== null &&
-                (lowerer.typeOf(expr).flags & ts.TypeFlags.Any) !== 0 &&
-                left.type.kind === "union") {
-                const leftArms = lowerer.unions.get(left.type.unionId)?.arms;
-                const rightArms = right.type.kind === "union"
-                    ? lowerer.unions.get(right.type.unionId)?.arms
-                    : [right.type];
-                const rightIsStatic = rightArms?.every((arm) => arm.kind !== "dyn" && arm.kind !== "caught" && arm.kind !== "jsval" && arm.kind !== "void") ?? false;
-                if (leftArms && rightArms && rightIsStatic &&
-                    leftArms.some(isUnitType) &&
-                    leftArms.every((arm) => isUnitType(arm) || REF_TRUTHY_KINDS.has(arm.kind))) {
-                    const byKey = new Map();
-                    for (const arm of [...rightArms, ...leftArms.filter(isUnitType)]) {
-                        byKey.set(typeKey(arm), arm);
-                    }
-                    const arms = [...byKey.values()].sort((a, b) => (typeKey(a) < typeKey(b) ? -1 : 1));
-                    if (arms.length > 1) {
-                        target = { kind: "union", unionId: lowerer.unions.intern(arms) };
-                    }
-                }
-            }
-            if (target?.kind === "union") {
-                // `&&` whose left does NOT fit the result union: the checker
-                // built that result by DROPPING left arms which are always
-                // truthy (`Option | undefined && string | undefined` answers
-                // `string | undefined`, not `Option | string | undefined`).
-                // Evaluate the left once, test it in its own union, and retag it
-                // only on the falsy path. Any stranded reference arms are
-                // unreachable there because every JS object is truthy.
-                if (op === ts.SyntaxKind.AmpersandAmpersandToken && left.type.kind === "union" && !typeEquals(left.type, target)) {
-                    const def = lowerer.unions.get(left.type.unionId);
-                    const trappable = new Set();
-                    def?.arms.forEach((arm, tag) => {
-                        if (lowerer.armTag(target.unionId, arm) < 0 && REF_TRUTHY_KINDS.has(arm.kind)) {
-                            trappable.add(tag);
-                        }
-                    });
-                    const retag = trappable.size === 0
-                        ? null
-                        : lowerer.unionRetagHelper(left.type.unionId, target.unionId, loc, trappable);
-                    if (retag) {
-                        lowerer.requireTruthyUnion(left.type.unionId, expr);
-                        const stmts = [];
-                        let stable = left;
-                        if (!isSafeToRepeat(left)) {
-                            const local = lowerer.declareHiddenLocal("%and", left.type);
-                            stmts.push({ kind: "varDecl", localId: local.id, init: left, loc });
-                            stable = varRef(local.id, left.type, loc);
-                        }
-                        const result = {
-                            kind: "ternary",
-                            cond: lowerer.ensureBool(stable, expr.left),
-                            then: lowerer.coerceInto(expr.right, right, target),
-                            else_: { kind: "call", callee: retag, args: [stable], type: target, loc },
-                            type: target,
-                            loc,
-                        };
-                        return stmts.length === 0 ? result : { kind: "seqExpr", stmts, result, type: target, loc };
-                    }
-                }
-                // `||` whose left does NOT fit the result union: the checker built
-                // that result by DROPPING the left's falsy arms (`process.env.X ||
-                // null` is `string | null`, `|| 3000` is `string | number` — the
-                // `undefined` is gone from both), so coercing the left eagerly, as
-                // the shared shape below does, retags an arm the test is about to
-                // rule out and throws where Node yields the default. Single-eval
-                // instead: test the left in its OWN union and retag only on the
-                // truthy side, where the dropped arms are unreachable.
-                if (op === ts.SyntaxKind.BarBarToken && left.type.kind === "union" && !typeEquals(left.type, target)) {
-                    const retag = lowerer.unionRetagHelper(left.type.unionId, target.unionId, loc);
-                    if (retag) {
-                        lowerer.requireTruthyUnion(left.type.unionId, expr);
-                        return {
-                            kind: "orDefault",
-                            left,
-                            right: lowerer.coerceInto(expr.right, right, target),
-                            retag,
-                            type: target,
-                            loc,
-                        };
-                    }
-                }
-                lowerer.requireTruthyUnion(target.unionId, expr);
-                return {
-                    kind: "logical",
-                    op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
-                    left: lowerer.coerceInto(expr.left, left, target),
-                    right: lowerer.coerceInto(expr.right, right, target),
-                    type: target, loc,
-                };
-            }
-            // `u || d` NARROWED by the default: the checker types the result
-            // as u's single non-unit arm (`marker() || "default"`) — evaluate
-            // u once, truthy extracts the arm, falsy takes d lazily (the
-            // orDefault node, nullish's truthiness sibling). An UNMAPPABLE
-            // checker result takes the same rule (`options.runner ||
-            // defaultRunner` — tsc's union of two structurally-compatible
-            // function types has no representation, while the left's one
-            // non-unit arm is the only representable answer): the default
-            // must coerce into the arm or fence on its own.
-            if (op === ts.SyntaxKind.BarBarToken &&
-                left.type.kind === "union") {
-                const def = lowerer.unions.get(left.type.unionId);
-                const rest = def ? def.arms.filter((a) => !isUnitType(a)) : [];
-                const funcArmDefault = rest[0]?.kind === "func" && (target === null || target.kind === "func");
-                if (rest.length === 1 && ((target !== null && typeEquals(target, rest[0])) || funcArmDefault)) {
-                    lowerer.requireTruthyUnion(left.type.unionId, expr);
-                    const dflt = lowerer.lowerExprExpecting(expr.right, rest[0]);
-                    return { kind: "orDefault", left, right: dflt, type: rest[0], loc };
-                }
-            }
-            lowerer.unsupported("SC1090", expr, `logical operators on union-typed values outside conditions (${NARROW_FIRST})`);
-        }
-        const kind = left.type.kind;
-        if (kind !== right.type.kind ||
-            (kind !== "f64" && kind !== "string" && kind !== "bool")) {
-            // Mixed PLAIN operands (`value || null`, `flag || undefined`,
-            // `s || 0`): JS value semantics still compile when the checker
-            // types the RESULT as one union both operands coerce into — the
-            // same lift the union-operand path above takes, arriving here
-            // with two plain arm values instead.
-            const target = lowerer.mapTypeOf(lowerer.typeOf(expr));
-            if (target?.kind === "union") {
-                lowerer.requireTruthyUnion(target.unionId, expr);
-                return {
-                    kind: "logical",
-                    op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
-                    left: lowerer.coerceInto(expr.left, left, target),
-                    right: lowerer.coerceInto(expr.right, right, target),
-                    type: target, loc,
-                };
-            }
-            lowerer.unsupported("SC1042", expr);
-        }
-        return {
-            kind: "logical",
-            op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
-            left, right, type: left.type, loc,
-        };
+        return lowerLogicalChain(lowerer, expr);
     }
     if (op === ts.SyntaxKind.QuestionQuestionToken) {
         return lowerer.lowerNullishCoalesce(expr, loc);
@@ -5910,7 +6416,7 @@ export function lowerBinary(lowerer, expr) {
         // runs for EFFECT exactly as its statement lowering (JS discards its
         // value), the right operand is the expression's value — a seqExpr.
         // The validator restricts seqExpr statements to straight-line writes
-        // (the C emission point is mid-expression), so a left operand whose
+        // (the lowering point is mid-expression), so a left operand whose
         // statement lowering needs real control flow keeps a pointed fence
         // instead of tripping the validator downstream.
         const effect = lowerer.lowerExprStatement(expr.left);
@@ -5951,7 +6457,7 @@ export function lowerBinary(lowerer, expr) {
             op === ts.SyntaxKind.ExclamationEqualsEqualsToken) {
             const negated = op === ts.SyntaxKind.ExclamationEqualsEqualsToken;
             const unit = left.kind === "unitLit" ? left : right.kind === "unitLit" ? right : null;
-            const other = unit === left ? right : left;
+            const other = left.kind === "unitLit" ? right : left;
             if (unit && other.type.kind === "dyn") {
                 return {
                     kind: "dynTest",
@@ -5968,12 +6474,30 @@ export function lowerBinary(lowerer, expr) {
             // answers false). dyn vs dyn keeps the fence below.
             const dynSide = left.type.kind === "dyn" ? left : right;
             const scalarSide = dynSide === left ? right : left;
+            const reference = scalarSide.type;
+            if ((isDynTypedRefType(reference) || reference.kind === "record" || reference.kind === "array" ||
+                reference.kind === "bytes" || reference.kind === "func" || reference.kind === "regex" || reference.kind === "url" ||
+                reference.kind === "bigint" || reference.kind === "symbol" || reference.kind === "set" || reference.kind === "union" || DYN_HANDLE_KINDS.has(reference.kind)) &&
+                lowerer.dynConvertible(reference)) {
+                const boxed = {
+                    kind: "dynFrom", value: scalarSide, type: DYN, loc: scalarSide.loc,
+                    ...(reference.kind === "record" || reference.kind === "array" || reference.kind === "bytes" ? { liveRef: true } : {}),
+                };
+                return {
+                    kind: "dynScalarEq",
+                    left: scalarSide === left ? boxed : left,
+                    right: scalarSide === right ? boxed : right,
+                    ...(negated ? { negated: true } : {}),
+                    type: BOOL,
+                    loc,
+                };
+            }
             if (dynSide.type.kind === "dyn" &&
                 (scalarSide.type.kind === "f64" || scalarSide.type.kind === "string" || scalarSide.type.kind === "bool" ||
                     // dyn vs dyn (`context.actual !== context.exact` —
                     // test/common's exit accounting): the runtime's whole-dyn
                     // strict equality — scalars by value, units by kind,
-                    // reference kinds by node identity (scr_dyn_strict_eq).
+                    // reference kinds by identity (scr_dyn_strict_eq).
                     scalarSide.type.kind === "dyn")) {
                 return {
                     kind: "dynScalarEq",
@@ -5985,15 +6509,22 @@ export function lowerBinary(lowerer, expr) {
                 };
             }
         }
-        // JS `any`-origin operands (the checked-dynamic declaration story):
-        // arithmetic and ordering CHECK the dyn side to the static side's
-        // scalar kind (dynCheck — a catchable TypeError on mismatch) and
-        // compute natively. Node would ToNumber-coerce instead — the honest
-        // divergence is loud (a throw), never a silent wrong answer
-        // (SEMANTICS.md). tsc rejects these forms on real `unknown`, so only
-        // any-typed JS reaches this; when BOTH sides are dyn a number
-        // context is the only honest guess for arithmetic — both check.
-        if (isJsSourceFile(expr.getSourceFile())) {
+        const bitwise = {
+            [ts.SyntaxKind.AmpersandToken]: "&", [ts.SyntaxKind.BarToken]: "|", [ts.SyntaxKind.CaretToken]: "^",
+            [ts.SyntaxKind.LessThanLessThanToken]: "<<", [ts.SyntaxKind.GreaterThanGreaterThanToken]: ">>",
+            [ts.SyntaxKind.GreaterThanGreaterThanGreaterThanToken]: ">>>",
+        };
+        if (bitwise[op]) {
+            const l = lowerer.coerceToExpected(left, DYN);
+            const r = lowerer.coerceToExpected(right, DYN);
+            if (l.type.kind === "dyn" && r.type.kind === "dyn") {
+                const value = { kind: "libCall", fn: "dyn.bitwise", args: [l, r, { kind: "strLit", value: bitwise[op], type: STRING, loc }], type: DYN, loc };
+                return left.type.kind === "f64" || right.type.kind === "f64" ? { kind: "dynCheck", value, type: F64, loc } : value;
+            }
+        }
+        // Numeric operators dispatch on ToNumeric's actual Number/BigInt
+        // result, including values flowing through native callable properties.
+        if (isJsSourceFile(expr.getSourceFile()) || op === ts.SyntaxKind.PlusToken) {
             const checkNum = (e) => e.type.kind === "dyn" ? { kind: "dynCheck", value: e, type: F64, loc: e.loc } : e;
             const other = left.type.kind === "dyn" ? right : left;
             const NUM_BIN = {
@@ -6011,26 +6542,29 @@ export function lowerBinary(lowerer, expr) {
             };
             const arith = NUM_BIN[op];
             const cmp = NUM_CMP[op];
-            if ((arith || cmp) && (other.type.kind === "f64" || other.type.kind === "dyn")) {
-                const l = checkNum(left);
-                const r = checkNum(right);
-                if (arith)
-                    return { kind: "bin", op: arith, left: l, right: r, type: F64, loc };
-                return { kind: "bin", op: cmp, left: l, right: r, type: BOOL, loc };
-            }
-            // `+`: number when the OTHER side is a number, string concat when
-            // it is a string — the two static homes; dyn+dyn stays a number.
-            if (op === ts.SyntaxKind.PlusToken) {
-                if (other.type.kind === "f64" || other.type.kind === "dyn") {
-                    return { kind: "bin", op: "+", left: checkNum(left), right: checkNum(right), type: F64, loc };
+            if (arith) {
+                const l = lowerer.coerceToExpected(left, DYN);
+                const r = lowerer.coerceToExpected(right, DYN);
+                if (l.type.kind === "dyn" && r.type.kind === "dyn") {
+                    const value = { kind: "libCall", fn: "dyn.arithmetic",
+                        args: [l, r, { kind: "strLit", value: arith, type: STRING, loc }], type: DYN, loc };
+                    const numeric = left.type.kind === "bigint" || right.type.kind === "bigint" ? BIGINT_T
+                        : left.type.kind === "f64" || right.type.kind === "f64" ? F64 : null;
+                    return numeric ? { kind: "dynCheck", value, type: numeric, loc } : value;
                 }
-                if (other.type.kind === "string") {
-                    // String-context `+`: JS's answer is String(unknown) — the
-                    // JS-exact dyn walker (numbers format, arrays join, objects
-                    // print [object Object], handles the same) — never a checked
-                    // cast: `'status ' + res.statusCode` concatenates like Node.
-                    const strOf = (e) => e.type.kind === "dyn" ? { kind: "toString", operand: e, type: STRING, loc: e.loc } : e;
-                    return { kind: "strConcat", left: strOf(left), right: strOf(right), type: STRING, loc };
+            }
+            if (cmp && (other.type.kind === "f64" || other.type.kind === "dyn")) {
+                return { kind: "bin", op: cmp, left: checkNum(left), right: checkNum(right), type: BOOL, loc };
+            }
+            // Untyped addition chooses concatenation or numeric addition only
+            // after both operands have undergone ToPrimitive at runtime.
+            if (op === ts.SyntaxKind.PlusToken) {
+                const l = lowerer.coerceToExpected(left, DYN);
+                const r = lowerer.coerceToExpected(right, DYN);
+                if (l.type.kind === "dyn" && r.type.kind === "dyn") {
+                    const value = { kind: "libCall", fn: "dyn.add", args: [l, r], type: DYN, loc };
+                    // A statically known string operand guarantees a string result.
+                    return other.type.kind === "string" ? { kind: "dynCheck", value, type: STRING, loc } : value;
                 }
             }
         }
@@ -6049,7 +6583,7 @@ export function lowerBinary(lowerer, expr) {
             // retain the SC2011 promise that --dynamic lifts this site.
             if (lowerer.dynamic)
                 return lowerAnyBinaryInIsland(lowerer, expr, left, right, loc);
-            lowerer.anyOpFence(`the '${ts.tokenToString(op) ?? ts.SyntaxKind[op]}' operator`, expr);
+            lowerer.anyOpFence(`the '${ts.tokenToString(op) ?? ts.syntaxKindName(op)}' operator`, expr);
         }
         // tsc allows ===/!== on unknown (arithmetic/comparisons it rejects
         // itself); a dynamic equality would need a dyn walk — validate first.
@@ -6252,6 +6786,14 @@ export function lowerBinary(lowerer, expr) {
             const optionalStringPlus = lowerOptionalStringPlus();
             if (optionalStringPlus)
                 return optionalStringPlus;
+            if (isJsSourceFile(expr.getSourceFile())) {
+                const primitive = (type) => type.kind === "f64" || type.kind === "string" || type.kind === "bool" || isUnitType(type) ||
+                    (type.kind === "union" && (lowerer.unions.get(type.unionId)?.arms.every(primitive) ?? false));
+                if ((left.type.kind === "union" || right.type.kind === "union") && primitive(left.type) && primitive(right.type)) {
+                    lowerer.runtimeOptionalArithmeticTypes.set(expr, DYN);
+                    return { kind: "libCall", fn: "dyn.add", args: [lowerer.coerceToExpected(left, DYN), lowerer.coerceToExpected(right, DYN)], type: DYN, loc };
+                }
+            }
             lowerer.unsupported("SC1043", expr);
             break;
         case ts.SyntaxKind.MinusToken:
@@ -6294,8 +6836,11 @@ export function lowerBinary(lowerer, expr) {
                 return indexed;
             if (plainBothNum)
                 return { kind: "bin", op: negated ? "!==" : "===", left, right, type: BOOL, loc };
-            if (bothStr)
+            if (bothStr) {
+                if (left.kind === "strLit" && right.kind === "strLit")
+                    return { kind: "boolLit", value: (left.value === right.value) !== negated, type: BOOL, loc };
                 return { kind: "strEq", negated, left, right, type: BOOL, loc };
+            }
             // bool === bool: a plain value compare (the config-drift checks'
             // `desired.lanMode !== actual.lanMode` shape).
             if (left.type.kind === "bool" && right.type.kind === "bool") {
@@ -6419,6 +6964,8 @@ export function lowerBinary(lowerer, expr) {
             if ((idLeft.type.kind === "array" ||
                 idLeft.type.kind === "map" ||
                 idLeft.type.kind === "set" ||
+                idLeft.type.kind === "regex" ||
+                idLeft.type.kind === "url" ||
                 idLeft.type.kind === "object" ||
                 idLeft.type.kind === "record" ||
                 // Symbols ARE identity: `Symbol('a') === Symbol('a')` is false,
@@ -6459,21 +7006,283 @@ export function lowerBinary(lowerer, expr) {
         default:
             break;
     }
-    lowerer.unsupported("SC1090", expr, `operator '${ts.tokenToString(op) ?? ts.SyntaxKind[op]}'`);
+    lowerer.unsupported("SC1090", expr, `operator '${ts.tokenToString(op) ?? ts.syntaxKindName(op)}'`);
+}
+function lowerLogicalChain(lowerer, expr) {
+    // Logical chains have a left-nested AST. Keep the native stack bounded
+    // while retaining each pair's checker type and lazy operand evaluation.
+    const parents = [];
+    let current = expr;
+    let result;
+    while (true) {
+        if (current.operatorToken.kind === ts.SyntaxKind.BarBarToken) {
+            const fallback = lowerAbsenceAwareOrChain(lowerer, current);
+            if (fallback !== null) {
+                result = fallback;
+                break;
+            }
+        }
+        const left = current.left;
+        if (ts.isBinaryExpression(left) &&
+            (left.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken ||
+                left.operatorToken.kind === ts.SyntaxKind.BarBarToken) &&
+            !lowerer.chainRecvByNode.has(left)) {
+            parents.push(current);
+            current = left;
+            continue;
+        }
+        result = lowerLogicalPair(lowerer, current, lowerAbsenceProbe(lowerer, left) ?? lowerer.lowerExpr(left));
+        break;
+    }
+    for (let i = parents.length - 1; i >= 0; i--) {
+        result = lowerLogicalPair(lowerer, parents[i], result);
+    }
+    return result;
+}
+function lowerLogicalPair(lowerer, expr, left) {
+    const op = expr.operatorToken.kind;
+    const loc = locOf(expr);
+    const right = lowerer.lowerExpr(expr.right);
+    // A LITERAL-unit left operand (a compile-time undefined/null — the
+    // capability-probe members: `process.features.inspector ||
+    // !flag.startsWith('--inspect')` reads undefined in a compiled
+    // binary): statically falsy, so the operator folds JS-exactly —
+    // `unit || X` IS X, `unit && X` IS the unit (X's side effects never
+    // run in JS either; the lowered right is simply dropped). Literal
+    // units only — computed unit-typed values keep the fences below.
+    if (left.kind === "unitLit") {
+        return op === ts.SyntaxKind.BarBarToken ? right : left;
+    }
+    // JS objects and symbols are always truthy. In `ref || fallback`
+    // the fallback is therefore unreachable and the result is the
+    // already-evaluated left value — the browser-fallback idiom used by
+    // packages for `process.argv || []` and `process.env || {}`. The
+    // operand itself remains in the IR, preserving reads/calls that
+    // produce the reference; only the unreachable right lowering drops.
+    if (op === ts.SyntaxKind.BarBarToken && REF_TRUTHY_KINDS.has(left.type.kind)) {
+        return left;
+    }
+    if (left.type.kind === "dyn" || right.type.kind === "dyn") {
+        // A checked-dynamic operand (`fn.name || '<anonymous>'` —
+        // test/common's _mustCallInner): both sides live in the checked-dynamic tree and
+        // the deciding test is ToBoolean over the dyn kind
+        // (scr_dyn_truthy) — JS value semantics exactly, result dyn. The
+        // non-dyn side converts through the usual boundary; a value with
+        // no dyn representation keeps the fence.
+        const l = lowerer.coerceToExpected(left, DYN);
+        const r = lowerer.coerceToExpected(right, DYN);
+        if (l.type.kind !== "dyn" || r.type.kind !== "dyn") {
+            lowerer.unsupported("SC1100", expr, "logical operators on 'unknown' values");
+        }
+        return {
+            kind: "logical",
+            op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
+            left: l,
+            right: r,
+            type: DYN, loc,
+        };
+    }
+    if (left.type.kind === "jsval" || right.type.kind === "jsval") {
+        return {
+            kind: "logical",
+            op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
+            left: lowerer.jsvalIn(left, expr.left),
+            right: lowerer.jsvalIn(right, expr.right),
+            type: JSVAL, loc,
+        };
+    }
+    if (left.type.kind === "union" || right.type.kind === "union") {
+        // Test the deciding operand in its own representation. The result
+        // contains only the values that can survive short-circuit evaluation.
+        let target = lowerer.mapTypeOf(lowerer.typeOf(expr));
+        // Index reads can be absent without noUncheckedIndexedAccess. Their
+        // explicit nullish fallback still runs, even if the checker discarded it.
+        if (target !== null) {
+            const returned = [right.type, ...(op === ts.SyntaxKind.AmpersandAmpersandToken ? [left.type] : [])];
+            for (const type of returned) {
+                const arms = type.kind === "union" ? lowerer.unions.get(type.unionId)?.arms ?? [] : [type];
+                for (const arm of arms) {
+                    if (arm.kind === "undefinedT" && !isUnitType(target))
+                        target = lowerer.runtimeOptionalType(target);
+                    if (arm.kind === "nullT")
+                        target = withUnitArm(target, arm.kind, lowerer.unions) ?? target;
+                }
+            }
+        }
+        // A broad-JSDoc npm-static body can leave the CHECKER result `any`
+        // even after declaration-backed specialization has recovered both
+        // operands (`helpOption && args.find(...)` in commander). When the
+        // left consists only of always-truthy references and falsy units,
+        // the static result is exactly the right operand plus those units.
+        if (op === ts.SyntaxKind.AmpersandAmpersandToken &&
+            target === null &&
+            lowerer.implicitParamTypes !== null &&
+            npmStaticPackageOfPath(expr.getSourceFile().fileName) !== null &&
+            (lowerer.typeOf(expr).flags & ts.TypeFlags.Any) !== 0 &&
+            left.type.kind === "union") {
+            const leftArms = lowerer.unions.get(left.type.unionId)?.arms;
+            const rightArms = right.type.kind === "union"
+                ? lowerer.unions.get(right.type.unionId)?.arms
+                : [right.type];
+            const rightIsStatic = rightArms?.every((arm) => arm.kind !== "dyn" && arm.kind !== "caught" && arm.kind !== "jsval" && arm.kind !== "void") ?? false;
+            if (leftArms && rightArms && rightIsStatic &&
+                leftArms.some(isUnitType) &&
+                leftArms.every((arm) => isUnitType(arm) || REF_TRUTHY_KINDS.has(arm.kind))) {
+                const byKey = new Map();
+                for (const arm of [...rightArms, ...leftArms.filter(isUnitType)]) {
+                    byKey.set(typeKey(arm), arm);
+                }
+                const arms = [...byKey.values()].sort((a, b) => (typeKey(a) < typeKey(b) ? -1 : 1));
+                if (arms.length > 1) {
+                    const source = right.type.kind === "union" ? lowerer.unions.get(right.type.unionId) : undefined;
+                    target = { kind: "union", unionId: source
+                            ? lowerer.unions.transform(source, arms)
+                            : lowerer.unions.intern(arms) };
+                }
+            }
+        }
+        if (target?.kind === "union") {
+            // `&&` whose left does NOT fit the result union: the checker
+            // built that result by DROPPING left arms which are always
+            // truthy (`Option | undefined && string | undefined` answers
+            // `string | undefined`, not `Option | string | undefined`).
+            // Evaluate the left once, test it in its own union, and retag it
+            // only on the falsy path. Any stranded reference arms are
+            // unreachable there because every JS object is truthy.
+            if (op === ts.SyntaxKind.AmpersandAmpersandToken && left.type.kind === "union" && !typeEquals(left.type, target)) {
+                const def = lowerer.unions.get(left.type.unionId);
+                const trappable = new Set();
+                def?.arms.forEach((arm, tag) => {
+                    if (lowerer.armTag(target.unionId, arm) < 0 && REF_TRUTHY_KINDS.has(arm.kind)) {
+                        trappable.add(tag);
+                    }
+                });
+                const retag = trappable.size === 0
+                    ? null
+                    : lowerer.unionRetagHelper(left.type.unionId, target.unionId, loc, trappable);
+                if (retag) {
+                    lowerer.requireTruthyUnion(left.type.unionId, expr);
+                    const stmts = [];
+                    let stable = left;
+                    if (!isSafeToRepeat(left)) {
+                        const local = lowerer.declareHiddenLocal("%and", left.type);
+                        stmts.push({ kind: "varDecl", localId: local.id, init: left, loc });
+                        stable = varRef(local.id, left.type, loc);
+                    }
+                    const result = {
+                        kind: "ternary",
+                        cond: lowerer.ensureBool(stable, expr.left),
+                        then: lowerer.coerceInto(expr.right, right, target),
+                        else_: { kind: "call", callee: retag, args: [stable], type: target, loc },
+                        type: target,
+                        loc,
+                    };
+                    return stmts.length === 0 ? result : { kind: "seqExpr", stmts, result, type: target, loc };
+                }
+            }
+            // `||` whose left does NOT fit the result union: the checker built
+            // that result by DROPPING the left's falsy arms (`process.env.X ||
+            // null` is `string | null`, `|| 3000` is `string | number` — the
+            // `undefined` is gone from both), so coercing the left eagerly, as
+            // the shared shape below does, retags an arm the test is about to
+            // rule out and throws where Node yields the default. Single-eval
+            // instead: test the left in its OWN union and retag only on the
+            // truthy side, where the dropped arms are unreachable.
+            if (op === ts.SyntaxKind.BarBarToken && left.type.kind === "union" && !typeEquals(left.type, target)) {
+                const retag = lowerer.unionRetagHelper(left.type.unionId, target.unionId, loc);
+                if (retag) {
+                    lowerer.requireTruthyUnion(left.type.unionId, expr);
+                    return {
+                        kind: "orDefault",
+                        left,
+                        right: lowerer.coerceInto(expr.right, right, target),
+                        retag,
+                        type: target,
+                        loc,
+                    };
+                }
+            }
+            lowerer.requireTruthyUnion(target.unionId, expr);
+            return {
+                kind: "logical",
+                op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
+                left: lowerer.coerceInto(expr.left, left, target),
+                right: lowerer.coerceInto(expr.right, right, target),
+                type: target, loc,
+            };
+        }
+        // `u || d` NARROWED by the default: the checker types the result
+        // as u's single non-unit arm (`marker() || "default"`) — evaluate
+        // u once, truthy extracts the arm, falsy takes d lazily (the
+        // orDefault node, nullish's truthiness sibling). An UNMAPPABLE
+        // checker result takes the same rule (`options.runner ||
+        // defaultRunner` — tsc's union of two structurally-compatible
+        // function types has no representation, while the left's one
+        // non-unit arm is the only representable answer): the default
+        // must coerce into the arm or fence on its own.
+        if (op === ts.SyntaxKind.BarBarToken &&
+            left.type.kind === "union") {
+            const def = lowerer.unions.get(left.type.unionId);
+            const rest = def ? def.arms.filter((a) => !isUnitType(a)) : [];
+            const funcArmDefault = rest[0]?.kind === "func" && (target === null || target.kind === "func");
+            if (rest.length === 1 && ((target !== null && typeEquals(target, rest[0])) || funcArmDefault)) {
+                lowerer.requireTruthyUnion(left.type.unionId, expr);
+                const dflt = lowerer.lowerExprExpecting(expr.right, rest[0]);
+                return { kind: "orDefault", left, right: dflt, type: rest[0], loc };
+            }
+        }
+        // JavaScript defaults can join differently inferred object layouts.
+        // When both operands have native checked representations, preserve
+        // the deciding value and short-circuit evaluation in that domain.
+        if (isJsSourceFile(expr.getSourceFile()) &&
+            lowerer.dynConvertible(left.type) && lowerer.dynConvertible(right.type)) {
+            return {
+                kind: "logical", op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
+                left: lowerer.coerceInto(expr.left, left, DYN),
+                right: lowerer.coerceInto(expr.right, right, DYN), type: DYN, loc,
+            };
+        }
+        lowerer.unsupported("SC1090", expr, `logical operators on union-typed values outside conditions (${NARROW_FIRST})`);
+    }
+    const kind = left.type.kind;
+    if (kind !== right.type.kind ||
+        (kind !== "f64" && kind !== "string" && kind !== "bool")) {
+        // Mixed PLAIN operands (`value || null`, `flag || undefined`,
+        // `s || 0`): JS value semantics still compile when the checker
+        // types the RESULT as one union both operands coerce into — the
+        // same lift the union-operand path above takes, arriving here
+        // with two plain arm values instead.
+        const target = lowerer.mapTypeOf(lowerer.typeOf(expr));
+        if (target?.kind === "union") {
+            lowerer.requireTruthyUnion(target.unionId, expr);
+            return {
+                kind: "logical",
+                op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
+                left: lowerer.coerceInto(expr.left, left, target),
+                right: lowerer.coerceInto(expr.right, right, target),
+                type: target, loc,
+            };
+        }
+        lowerer.unsupported("SC1042", expr);
+    }
+    return {
+        kind: "logical",
+        op: op === ts.SyntaxKind.AmpersandAmpersandToken ? "&&" : "||",
+        left, right, type: left.type, loc,
+    };
 }
 function lowerAbsenceAwareOrChain(lowerer, expr) {
     const nodes = [];
-    const collect = (node) => {
-        if (ts.isBinaryExpression(node) &&
-            node.operatorToken.kind === ts.SyntaxKind.BarBarToken) {
-            collect(node.left);
-            collect(node.right);
+    const pending = [expr];
+    while (pending.length !== 0) {
+        const node = pending.pop();
+        if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.BarBarToken) {
+            pending.push(node.right, node.left);
         }
         else {
             nodes.push(node);
         }
-    };
-    collect(expr);
+    }
     if (nodes.length < 3)
         return null;
     const lowered = nodes.map((node) => lowerAbsenceProbe(lowerer, node) ?? lowerer.lowerExpr(node));
@@ -6544,10 +7353,7 @@ function errorRootedObjectOf(lowerer, t) {
    * shape, so the sibling typeof lowerings keep trying. */
 function lowerErrorCodeTypeofTest(lowerer, expr, loc) {
     const negated = expr.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken;
-    for (const [a, b] of [
-        [expr.left, expr.right],
-        [expr.right, expr.left],
-    ]) {
+    for (const [a, b] of operandPairs(expr)) {
         if (!ts.isTypeOfExpression(a))
             continue;
         let prop = a.expression;
@@ -6607,10 +7413,7 @@ function lowerErrorCodeTypeofTest(lowerer, expr, loc) {
 }
 export function lowerCaughtTypeofTest(lowerer, expr, loc) {
     const negated = expr.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken;
-    for (const [a, b] of [
-        [expr.left, expr.right],
-        [expr.right, expr.left],
-    ]) {
+    for (const [a, b] of operandPairs(expr)) {
         if (!ts.isTypeOfExpression(a))
             continue;
         const local = lowerer.caughtLocalOf(a.expression);
@@ -6619,7 +7422,7 @@ export function lowerCaughtTypeofTest(lowerer, expr, loc) {
         if (!ts.isStringLiteral(b)) {
             lowerer.unsupported("SC1090", expr, "'typeof' catch-binding tests against non-literal strings");
         }
-        if (b.text === "string" || b.text === "number" || b.text === "boolean") {
+        if (b.text === "string" || b.text === "number" || b.text === "boolean" || b.text === "object") {
             return {
                 kind: "caughtTest",
                 value: { kind: "varRef", localId: local.id, type: CAUGHT, loc },
@@ -6629,8 +7432,7 @@ export function lowerCaughtTypeofTest(lowerer, expr, loc) {
                 loc,
             };
         }
-        lowerer.unsupported("SC1090", b, `'typeof' catch-binding tests against "${b.text}" (only "string"/"number"/"boolean" ` +
-            `narrow a catch binding; use 'instanceof' for objects)`);
+        lowerer.unsupported("SC1090", b, `'typeof' catch-binding tests against "${b.text}" (only "string"/"number"/"boolean"/"object" are supported)`);
     }
     return null;
 }
@@ -6734,12 +7536,13 @@ export function aliasTypeofNarrows(lowerer, cond, polarity) {
         walk(cond, polarity);
     return out;
 }
+/** Visit both operand orders while keeping the sequence an array of pairs. */
+function operandPairs(expr) {
+    return [[expr.left, expr.right], [expr.right, expr.left]];
+}
 /** One ===/!== leaf of aliasTypeofNarrows — the qualification battery. */
 function aliasTypeofArmOf(lowerer, e, strip) {
-    for (const [a0, b] of [
-        [e.left, e.right],
-        [e.right, e.left],
-    ]) {
+    for (const [a0, b] of operandPairs(e)) {
         if (!ts.isStringLiteral(b))
             continue;
         const a = strip(a0);
@@ -6768,7 +7571,7 @@ function aliasTypeofArmOf(lowerer, e, strip) {
         if (!bindingNeverReassigned(lowerer, valSym, valDecl))
             continue;
         const fn = valDecl.parent;
-        if (!(e.pos >= fn.pos && e.end <= fn.end))
+        if (fn === undefined || !(e.pos >= fn.pos && e.end <= fn.end))
             continue;
         const valT = lowerer.typeOf(opnd); // override-aware: implicit bindings compose
         const mapped = lowerer.mapTypeOf(valT);
@@ -6810,10 +7613,7 @@ function aliasTypeofArmOf(lowerer, e, strip) {
    * bare-typeof value form then composes with strEq for pure operands). */
 function lowerUnionTypeofTest(lowerer, expr, loc) {
     const negated = expr.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken;
-    for (const [a, b] of [
-        [expr.left, expr.right],
-        [expr.right, expr.left],
-    ]) {
+    for (const [a, b] of operandPairs(expr)) {
         if (!ts.isTypeOfExpression(a))
             continue;
         if (lowerer.mapTypeOf(lowerer.typeOf(a.expression))?.kind !== "union")
@@ -6861,12 +7661,13 @@ function lowerUnionTypeofTest(lowerer, expr, loc) {
    * side is a typeof over a dyn-typed operand (not this pattern). */
 function lowerDynTypeofTest(lowerer, expr, loc) {
     const negated = expr.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken;
-    for (const [a, b] of [
-        [expr.left, expr.right],
-        [expr.right, expr.left],
-    ]) {
+    for (const [a, b] of operandPairs(expr)) {
         if (!ts.isTypeOfExpression(a))
             continue;
+        // Non-literal comparisons use the ordinary typeof string value,
+        // preserving both operands' evaluation order without a narrowing test.
+        if (!ts.isStringLiteral(b))
+            continue;
         const declared = lowerer.mapTypeOf(lowerer.typeOf(a.expression));
         let value;
         if (declared?.kind === "dyn") {
@@ -6924,10 +7725,7 @@ function lowerDynTypeofTest(lowerer, expr, loc) {
                 value = probed;
             }
         }
-        if (!ts.isStringLiteral(b)) {
-            lowerer.unsupported("SC1090", expr, "'typeof' tests on 'unknown' values against non-literal strings");
-        }
-        if (b.text === "string" || b.text === "number" || b.text === "boolean" || b.text === "undefined") {
+        if (b.text === "string" || b.text === "number" || b.text === "boolean" || b.text === "undefined" || b.text === "bigint" || b.text === "symbol") {
             return {
                 kind: "dynTest",
                 test: b.text,
@@ -6964,14 +7762,8 @@ function lowerDynTypeofTest(lowerer, expr, loc) {
                 loc,
             };
         }
-        // Kinds a dyn box can NEVER hold — no conversion into 'unknown'
-        // exists for bigints or symbols (dynFrom's domain is JSON-safe data
-        // + bytes + Error + functions), so the test's answer is a
-        // compile-time constant: false for ===, true for !==. The capability
-        // probes this settles (`typeof ms === 'bigint'` in dual-mode number
-        // helpers) then FOLD their impossible arm (lowerTernary), which is
-        // what lets the reachable arm compile statically.
-        if (b.text === "bigint" || b.text === "symbol") {
+        // Native checked values do not yet carry symbols.
+        if (b.text === "symbol") {
             return { kind: "boolLit", value: negated, type: BOOL, loc };
         }
         lowerer.unsupported("SC1090", b, `'typeof' tests against "${b.text}" on 'unknown' values (only "string"/"number"/` +
@@ -6993,7 +7785,7 @@ function lowerReplacedExportsRead(lowerer, expr) {
     if (!ts.isIdentifier(recv) || recv.text !== "exports")
         return null;
     const sf = expr.getSourceFile();
-    if (!isJsSourceFile(sf) || isNodeEsmFile(sf))
+    if (!isJsSourceFile(sf) || isNodeEsmFile(sf, lowerer.program))
         return null;
     if (lowerer.peekLocal(recv) || lowerer.globalOf(recv))
         return null; // a user binding shadows
@@ -7170,6 +7962,34 @@ export function lowerInstanceOf(lowerer, expr, loc) {
         const right = lowerer.lowerExpr(expr.right);
         return { kind: "jsOp", op: "instanceOf", args: [left, right], type: BOOL, loc };
     }
+    if (!lowerer.dynamic && (lowerer.isStdlibGlobal(expr.right, "Set") || lowerer.isStdlibGlobal(expr.right, "Map"))) {
+        const collection = lowerer.isStdlibGlobal(expr.right, "Map") ? "map" : "set";
+        const value = lowerer.lowerExpr(expr.left);
+        if (value.type.kind === "dyn")
+            return { kind: "libCall", fn: collection === "map" ? "dyn.nativeMapIs" : "dyn.nativeSetIs", args: [value], type: BOOL, loc };
+        if (value.type.kind === collection)
+            return { kind: "seqExpr", stmts: [{ kind: "exprStmt", expr: value, loc }],
+                result: { kind: "boolLit", value: true, type: BOOL, loc }, type: BOOL, loc };
+    }
+    if (lowerer.isStdlibGlobal(expr.right, "WeakMap") || lowerer.isStdlibGlobal(expr.right, "WeakSet")) {
+        if (lowerer.dynamic) {
+            const value = lowerer.jsvalIn(lowerer.lowerExpr(expr.left), expr.left);
+            const ctor = { kind: "jsOp", op: "globalGet", name: lowerer.isStdlibGlobal(expr.right, "WeakMap") ? "WeakMap" : "WeakSet", args: [], type: JSVAL, loc };
+            return { kind: "jsOp", op: "instanceOf", args: [value, ctor], type: BOOL, loc };
+        }
+        const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
+        return { kind: "libCall", fn: lowerer.isStdlibGlobal(expr.right, "WeakMap") ? "weakMap.is" : "weakSet.is", args: [value], type: BOOL, loc };
+    }
+    const rhsBuiltin = ts.isIdentifier(expr.right) ? lowerer.builtinImportOf(expr.right) :
+        ts.isPropertyAccessExpression(expr.right) ? lowerer.builtinMemberOf(expr.right) : null;
+    if (lowerer.isStdlibGlobal(expr.right, "URL") || rhsBuiltin?.module === "url" && rhsBuiltin.member === "URL") {
+        const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
+        return { kind: "libCall", fn: "dyn.nativeUrlIs", args: [value], type: BOOL, loc };
+    }
+    if (lowerer.isStdlibGlobal(expr.right, "ArrayBuffer")) {
+        const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
+        return { kind: "libCall", fn: "arrayBuffer.is", args: [value], type: BOOL, loc };
+    }
     const rhsSymbol = ts.isIdentifier(expr.right) ? lowerer.resolveValueSymbol(expr.right) : null;
     // `x instanceof events.EventEmitter` — the namespace-member spelling
     // resolves to the same ambient class as the named import.
@@ -7203,29 +8023,41 @@ export function lowerInstanceOf(lowerer, expr, loc) {
     // decoration result — fall to the class-VALUE path below, whose
     // instanceOfValue reads the interval off the bound class object.
     const directRhs = rhsSymbol ? lowerer.classBySymbol.get(rhsSymbol) : undefined;
-    const target = (directRhs?.classDecorators?.valueGlobalId !== undefined ? undefined : directRhs) ??
+    const target = (directRhs?.localClass || directRhs?.classDecorators?.valueGlobalId !== undefined ? undefined : directRhs) ??
         rhsNsClass ??
         lowerer.builtinErrorInfoOf(rhsSymbol) ??
+        lowerer.builtinErrorInfoOf(rhsMemberSymbol) ??
         lowerer.builtinEmitterInfoOf(rhsSymbol) ??
         lowerer.builtinEmitterInfoOf(rhsMemberSymbol) ??
         lowerer.builtinStreamInfoOf(rhsSymbol) ??
         lowerer.builtinStreamInfoOf(rhsMemberSymbol) ??
         undefined;
     if (!target) {
-        // `u instanceof Uint8Array` on an `unknown` value: the checked-dynamic tree carries a
-        // bytes kind — one runtime tag test, and tsc's narrowing types the
-        // true branch (reads bridge through maybeNarrow's validated
-        // extraction, like the typeof tests). Node's Buffer IS a Uint8Array
-        // subclass and rides the same bytes kind, so both worlds answer true
-        // for Buffer payloads — Node-exact (the bytes kind's other
-        // divergences are SEMANTICS.md 45). Catch bindings stay out (their
-        // payload is a typed snapshot, not a dyn).
-        if (ts.isIdentifier(expr.right) &&
-            lowerer.isStdlibGlobal(expr.right, "Uint8Array") &&
-            !lowerer.caughtLocalOf(expr.left)) {
-            const left = lowerer.lowerExpr(expr.left);
-            if (left.type.kind === "dyn") {
-                return { kind: "dynTest", test: "bytes", value: left, type: BOOL, loc };
+        const date = lowerer.isStdlibGlobal(expr.right, "Date");
+        const url = lowerer.isStdlibGlobal(expr.right, "URL");
+        if ((date || url) && !lowerer.caughtLocalOf(expr.left)) {
+            const value = lowerer.lowerExpr(expr.left);
+            if (value.type.kind === "dyn")
+                return { kind: "libCall", fn: date ? "dyn.nativeDateIs" : "dyn.nativeUrlIs", args: [value], type: BOOL, loc };
+            if (value.type.kind === "union")
+                lowerer.unsupported("SC1090", expr, "Date or URL instanceof over a union");
+            return { kind: "seqExpr", stmts: [{ kind: "exprStmt", expr: value, loc }],
+                result: { kind: "boolLit", value: value.type.kind === (date ? "date" : "url"), type: BOOL, loc }, type: BOOL, loc };
+        }
+        // Unknown storage retains each numeric typed array's exact native brand.
+        if (ts.isIdentifier(expr.right) && !lowerer.caughtLocalOf(expr.left)) {
+            const elem = Object.keys(BYTES_ELEMENT_NAME).find((kind) => lowerer.isStdlibGlobal(expr.right, BYTES_ELEMENT_NAME[kind]));
+            if (elem !== undefined) {
+                const left = lowerer.lowerExpr(expr.left);
+                if (left.type.kind === "dyn") {
+                    return { kind: "dynTest", test: "bytes", bytesElem: elem, value: left, type: BOOL, loc };
+                }
+                if (left.type.kind === "bytes") {
+                    return {
+                        kind: "seqExpr", stmts: [{ kind: "exprStmt", expr: left, loc }],
+                        result: { kind: "boolLit", value: left.type.elem === elem, type: BOOL, loc }, type: BOOL, loc,
+                    };
+                }
             }
         }
         // `x instanceof RegExp` over a union with a regex arm (the
@@ -7238,6 +8070,8 @@ export function lowerInstanceOf(lowerer, expr, loc) {
             lowerer.isStdlibGlobal(expr.right, "RegExp") &&
             !lowerer.caughtLocalOf(expr.left)) {
             const left = lowerer.lowerExpr(expr.left);
+            if (left.type.kind === "dyn")
+                return { kind: "libCall", fn: "dyn.nativeRegexIs", args: [left], type: BOOL, loc };
             if (left.type.kind === "union") {
                 const def = lowerer.unions.get(left.type.unionId);
                 const tag = def ? def.arms.findIndex((a) => a.kind === "regex") : -1;
@@ -7255,7 +8089,7 @@ export function lowerInstanceOf(lowerer, expr, loc) {
         // STANDALONE target class has exactly one possible runtime value
         // (itself — no descendants can flow into the slot), so the answer
         // folds statically exactly like the named-target folds below.
-        const rhsClassval = lowerer.mapTypeOf(lowerer.typeOf(expr.right));
+        const rhsClassval = storedClassValueType(lowerer, expr.right);
         if (rhsClassval?.kind === "classval" && !lowerer.caughtLocalOf(expr.left)) {
             const targetInfo = lowerer.classes.get(rhsClassval.className);
             if (!targetInfo) {
@@ -7272,7 +8106,8 @@ export function lowerInstanceOf(lowerer, expr, loc) {
             const lhsInfo = lowerer.classes.get(left.type.className);
             if (!lhsInfo)
                 throw new InternalCompilerError(`lowerer bug: unknown class ${left.type.className}`);
-            if (lowerer.inHierarchy(targetInfo) && lowerer.inHierarchy(lhsInfo)) {
+            if ((lowerer.inHierarchy(targetInfo) && lowerer.inHierarchy(lhsInfo)) ||
+                (targetInfo.localClass !== undefined && lhsInfo.localClass !== undefined)) {
                 const classValue = lowerer.lowerExpr(expr.right);
                 if (classValue.type.kind !== "classval")
                     lowerer.badType(expr.right, lowerer.typeOf(expr.right));
@@ -7319,6 +8154,9 @@ export function lowerInstanceOf(lowerer, expr, loc) {
     // (name strings are user-writable), so `u instanceof TypeError` keeps
     // the fence. Reads past the narrow bridge through maybeNarrow's
     // validated %Error extraction. SEMANTICS.md 67.
+    if (left.type.kind === "dyn" && !target.def.runtime && !target.builtinError && !target.builtinEmitter && !target.builtinStream && !target.localClass) {
+        return classInstanceOf(lowerer, left, target, loc);
+    }
     if (left.type.kind === "dyn" && target.def.name === "%Error") {
         return { kind: "dynTest", test: "error", value: left, type: BOOL, loc };
     }
@@ -7341,6 +8179,44 @@ export function lowerInstanceOf(lowerer, expr, loc) {
     if (left.type.kind === "dyn") {
         lowerer.unsupported("SC1090", expr, `'instanceof ${target.def.name.replace(/^%/, "")}' on 'unknown' values (only the Error classes answer — test 'instanceof Error' and read '.name')`);
     }
+    if (left.type.kind === "union") {
+        const unionId = left.type.unionId;
+        const arms = lowerer.unions.get(unionId)?.arms;
+        // Ordinary records and scalar values do not carry a class prototype.
+        // Dynamic/opaque runtime objects keep their existing instanceof fences.
+        if (arms?.every((arm) => arm.kind === "object" || arm.kind === "record" ||
+            arm.kind === "f64" || arm.kind === "string" || arm.kind === "bool" ||
+            arm.kind === "bigint" || arm.kind === "symbol" || isUnitType(arm))) {
+            const key = `instanceof.union:${unionId}:${target.def.name}`;
+            let helper = lowerer.widthHelpers.get(key);
+            if (!helper) {
+                helper = `%instanceof.union.${lowerer.widthHelpers.size}`;
+                lowerer.widthHelpers.set(key, helper);
+                const value = { kind: "varRef", localId: "value.0", type: left.type, loc };
+                const body = [];
+                arms.forEach((arm, tag) => {
+                    if (arm.kind !== "object")
+                        return;
+                    const lhsInfo = lowerer.classes.get(arm.className);
+                    if (!lhsInfo)
+                        throw new InternalCompilerError(`lowerer bug: unknown class ${arm.className}`);
+                    const result = lowerer.inHierarchy(lhsInfo) && lowerer.inHierarchy(target)
+                        ? { kind: "instanceOf", value: { kind: "unionNarrow", unionId, tag, value, type: arm, loc }, className: target.def.name, type: BOOL, loc }
+                        : { kind: "boolLit", value: arm.className === target.def.name || lowerer.isSubclassOf(arm.className, target.def.name), type: BOOL, loc };
+                    body.push({
+                        kind: "if", cond: { kind: "unionIsTag", unionId, tag, negated: false, value, type: BOOL, loc },
+                        then: [{ kind: "return", value: result, loc }], else_: null, loc,
+                    });
+                });
+                body.push({ kind: "return", value: { kind: "boolLit", value: false, type: BOOL, loc }, loc });
+                lowerer.liftedFns.push({
+                    name: helper, params: [{ localId: "value.0", name: "value", type: left.type }], returnType: BOOL,
+                    locals: [{ id: "value.0", name: "value", type: left.type, mutable: false }], body, loc,
+                });
+            }
+            return { kind: "call", callee: helper, args: [left], type: BOOL, loc };
+        }
+    }
     if (left.type.kind !== "object") {
         lowerer.unsupported("SC1090", expr, "'instanceof' on values other than class instances (narrow union-typed values first)");
     }
@@ -7513,6 +8389,12 @@ function lowerPrivateIn(lowerer, expr, priv, loc) {
    * and dyn/unknown stay fenced. Keys are literal strings — a computed key
    * over a shape would need the runtime key table. */
 function lowerInExpression(lowerer, expr, loc) {
+    if (lowerer.isStdlibGlobal(expr.right, "process") && lowerer.foldedStringKeyOf(expr.left) === "hrtime") {
+        return { kind: "boolLit", value: true, type: BOOL, loc };
+    }
+    const globalKey = globalSymbolKey(lowerer, expr.right, expr.left);
+    if (globalKey)
+        return { kind: "libCall", fn: "dyn.globalSymbolHas", args: [globalKey], type: BOOL, loc };
     // `#name in obj` — the ergonomic brand check (ES2022) — resolves
     // before any string-key machinery: the left operand is a private
     // NAME, not a value.
@@ -7564,14 +8446,13 @@ function lowerInExpression(lowerer, expr, loc) {
         // `in` shares the coercion).
         {
             const probed = tryLowerExpression(lowerer, expr.right);
-            if (probed?.type.kind === "dyn") {
-                let k = lowerer.lowerExpr(expr.left); // JS order: the key evaluates first
-                if (k.type.kind === "f64" || k.type.kind === "string" || k.type.kind === "dyn") {
-                    k = lowerer.ensureString(k, expr.left);
-                    const recvD = lowerer.lowerExpr(expr.right);
-                    if (recvD.type.kind === "dyn") {
-                        return { kind: "libCall", fn: "dyn.hasKey", args: [recvD, k], type: BOOL, loc };
-                    }
+            if (probed && (probed.type.kind === "dyn" || isDynTypedRefType(probed.type))) {
+                const k = lowerer.lowerExpr(expr.left); // JS order: the key evaluates first
+                if (k.type.kind === "symbol" || k.type.kind === "dyn" || k.type.kind === "string" || k.type.kind === "f64") {
+                    const boxed = lowerer.coerceToExpected(k, DYN);
+                    const keyLocal = lowerer.declareHiddenLocal("%inKey", DYN);
+                    return { kind: "seqExpr", stmts: [{ kind: "varDecl", localId: keyLocal.id, init: boxed, loc }],
+                        result: { kind: "libCall", fn: "dyn.hasKeyComputed", args: [lowerer.coerceToExpected(lowerer.lowerExpr(expr.right), DYN), varRef(keyLocal.id, DYN, loc)], type: BOOL, loc }, type: BOOL, loc };
                 }
             }
         }
@@ -7597,7 +8478,16 @@ function lowerInExpression(lowerer, expr, loc) {
         };
         return { kind: "unionIsTag", unionId: envType.unionId, tag: undefTag, negated: true, value: read, type: BOOL, loc };
     }
-    const recv = lowerer.lowerExpr(expr.right);
+    let recv = lowerer.lowerExpr(expr.right);
+    if (isJsSourceFile(expr.getSourceFile()) && recv.type.kind === "func" && lowerer.dynConvertible(recv.type)) {
+        recv = lowerer.coerceToExpected(recv, DYN);
+    }
+    const siteType = lowerer.mapTypeOf(lowerer.typeOf(expr.right));
+    if (recv.type.kind === "union" && siteType?.kind === "union" && !typeEquals(recv.type, siteType)) {
+        const helper = lowerer.narrowedRetagHelper(expr.right, recv.type.unionId, siteType.unionId, loc);
+        if (helper)
+            recv = { kind: "call", callee: helper, args: [recv], type: siteType, loc };
+    }
     // Error-rooted receivers (builtin or user subclass — the isErrnoException
     // predicate's `err instanceof Error && "code" in err` shape): `code`
     // answers from the runtime error's code slot (stamped by fs/system/
@@ -7622,6 +8512,9 @@ function lowerInExpression(lowerer, expr, loc) {
         while (info && info.base)
             info = info.base;
         if (info?.def.name === "%Error") {
+            if (key === "cause") {
+                return { kind: "libCall", fn: "error.hasCause", args: [recv], type: BOOL, loc };
+            }
             if (key === "code") {
                 const codeType = lowerer.envValueType();
                 if (codeType.kind !== "union")
@@ -8266,12 +9159,24 @@ export function lowerGroupsProjection(lowerer, recv, groups, loc) {
     }
     return { kind: "call", callee: helper, args: [recv], type: recordT, loc };
 }
-/** Field read `obj.f` on class-instance and record receivers, through the
-   * shared FieldTarget union (fieldGet / recordGet). Bound method references
-   * on classes are rejected specifically; func-typed record fields are
-   * ordinary closure values, so bare references to them work (unlike class
-   * methods, which have no bound-value form). */
+/** Field reads use the shared FieldTarget union. Native method reads select
+ * an interned unbound callable; invocation supplies its receiver separately. */
 export function lowerFieldRead(lowerer, expr) {
+    // A checked receiver already owns its property table. An ambient
+    // generic method signature must not divert its value into native
+    // object-literal specialization (Array.prototype.map is one example).
+    if (ts.isIdentifier(expr.expression)) {
+        const stored = lowerer.peekLocal(expr.expression) ?? lowerer.globalOf(expr.expression);
+        if (stored?.type.kind === "dyn") {
+            const value = lowerer.lowerExpr(expr.expression);
+            if (value.type.kind === "dyn")
+                return {
+                    kind: "dynKeyGet", value,
+                    key: { kind: "strLit", value: expr.name.text, type: STRING, loc: locOf(expr.name) },
+                    ...(expr.questionDotToken || hasOptionalChainGuard(expr.expression) ? { optional: true } : {}), type: DYN, loc: locOf(expr),
+                };
+        }
+    }
     const target = lowerer.fieldTarget(expr);
     if (target)
         return lowerer.fieldGetExpr(target, locOf(expr), expr);
@@ -8288,7 +9193,9 @@ export function lowerFieldRead(lowerer, expr) {
     if (receiverIr?.kind === "object" &&
         (lowerer.findMethodOn(lowerer.classes.get(receiverIr.className) ?? null, expr.name.text) ||
             findGenericMethodOn(lowerer, lowerer.classes.get(receiverIr.className) ?? null, expr.name.text))) {
-        lowerer.unsupported("SC1090", expr, `bound method references (call '${expr.name.text}' directly)`);
+        const info = lowerer.classes.get(receiverIr.className);
+        if (info)
+            return lowerClassMethodValue(lowerer, expr, info);
     }
     // An object-literal GENERIC method as a VALUE (`o.m` — the member is
     // excluded from the record shape): the pinned-value rule verbatim when
@@ -8348,16 +9255,22 @@ export function lowerFieldRead(lowerer, expr) {
    * and `switch (r.kind)` work without dedicated test nodes. Anything else
    * on a union receiver is rejected specifically (narrow first). */
 export function lowerUnionProperty(lowerer, expr) {
-    if (expr.questionDotToken)
+    if (lowerer.chainBlocked(expr))
         return null;
     const receiverIr = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
     if (receiverIr?.kind !== "union")
         return null;
-    // Lower the receiver FIRST and read its actual IR union: a partially
-    // narrowed receiver (checker type = a SUB-union of the binding's union)
-    // stays the full union at runtime, and the tag switch must cover the
-    // full union's arms.
-    const value = lowerer.lowerExpr(expr.expression);
+    // Lower the receiver first: its runtime value can still carry the full
+    // binding union even when the checker has removed several variants.
+    let value = lowerer.lowerExpr(expr.expression);
+    // A guard can remove several variants without selecting one record.
+    // Materialize that sub-union before looking for common fields; arms
+    // ruled out by the guard must not veto a field shared by the survivors.
+    if (value.type.kind === "union" && !typeEquals(value.type, receiverIr)) {
+        const helper = lowerer.narrowedRetagHelper(expr.expression, value.type.unionId, receiverIr.unionId, locOf(expr));
+        if (helper)
+            value = { kind: "call", callee: helper, args: [value], type: receiverIr, loc: locOf(expr) };
+    }
     // A checker-union receiver whose VALUE lowered to a plain RECORD (the
     // merged-signature fiction — `runner(cmd, args)` where runner joined
     // a structural runner type with spawnSync's, and the local adopted
@@ -8453,20 +9366,29 @@ export function lowerUnionProperty(lowerer, expr) {
     const keyed = lowerUnionKeyedRead(lowerer, expr, value.type.unionId, value, key, field);
     if (keyed)
         return keyed;
+    // JavaScript overloads commonly inspect a class brand on a scalar-or-
+    // instance argument (e.g. Matrix4.makeTranslation). Preserve primitive
+    // missing-property semantics and dispatch class data through its native
+    // capsule instead of demanding a field shared by every union arm.
+    if (isJsSourceFile(expr.getSourceFile()) && def.arms.some(isDynTypedRefType) && lowerer.dynConvertible(value.type)) {
+        return { kind: "dynKeyGet", value: lowerer.coerceToExpected(value, DYN), key,
+            ...(hasOptionalChainGuard(expr.expression) ? { optional: true } : {}), type: DYN, loc: locOf(expr) };
+    }
     lowerer.unsupported("SC1090", expr, `reading '${field}' on a union-typed value (every arm must be an object/record ` +
         `with a same-typed field '${field}'; ` +
         `${NARROW_FIRST})`);
 }
 /** The unionDisc generalization: a keyed read on a union receiver whose
    * arms answer DIFFERENT (but joinable) types. Each arm contributes its
-   * declared answer — a declared field's type (literal keys), an
+   * declared answer — an array element's type (number keys), a declared field's type (literal keys), an
    * index-signature arm's value type (plus its declared fields' types for
    * runtime keys, which reach them through the keyed-read helper), and
    * UNDEFINED for unit arms (reachable only through optional-chain tails,
    * where JS short-circuits to undefined; a unit arm the checker narrowed
    * away is simply unreachable). The result type is the JOIN of those
-   * answers; every arm's answer must be the join itself or one of its
-   * arms (sub-union RE-TAGGING between distinct unions stays fenced).
+   * answers; every arm's answer must be the join itself, one of its
+   * arms, or a sub-union whose payload representations are unchanged.
+   * Array reads retain the ordinary invalid-index trap policy.
    * Returns null when any arm cannot answer — the caller owns the fence
    * message. The caller (the property/element dispatch) maybeNarrows. */
 function lowerUnionKeyedRead(lowerer, expr, unionId, value, key, literalField) {
@@ -8502,6 +9424,11 @@ function lowerUnionKeyedRead(lowerer, expr, unionId, value, key, literalField) {
             push(UNDEFINED_T);
             continue;
         }
+        if (key.type.kind === "f64") {
+            if (arm.kind !== "array" || !pushAnswer(arm.elem))
+                return null;
+            continue;
+        }
         if (arm.kind !== "record")
             return null;
         const shape = lowerer.shapes.get(arm.shapeId);
@@ -8531,13 +9458,11 @@ function lowerUnionKeyedRead(lowerer, expr, unionId, value, key, literalField) {
     if (joinArms.length === 0)
         return null;
     // The join must be a BUILDABLE union: arm kinds the union invariants
-    // admit (no map/dyn/jsval/generator arms; func arms only beside
-    // func/unit siblings — unionFuncSetArmsOk, the validator's rule). A
-    // join mixing, say, a func answer with data answers has no union to
-    // surface as; the caller owns the fence message.
+    // admit (no dyn/jsval/generator arms; containers only beside unit
+    // siblings). The caller owns the diagnostic for a refused join.
     if (joinArms.length > 1 &&
-        (!unionFuncSetArmsOk(joinArms) ||
-            joinArms.some((a) => a.kind === "map" || a.kind === "dyn" || a.kind === "jsval" || a.kind === "generator" || a.kind === "caught"))) {
+        (!unionContainerArmsOk(joinArms) ||
+            joinArms.some((a) => a.kind === "dyn" || a.kind === "jsval" || a.kind === "generator" || a.kind === "caught"))) {
         return null;
     }
     joinArms.sort((a, b) => (typeKey(a) < typeKey(b) ? -1 : 1));
@@ -8545,13 +9470,19 @@ function lowerUnionKeyedRead(lowerer, expr, unionId, value, key, literalField) {
     // Pass 2: every arm's answer must SURFACE as the join, and index arms
     // must pass the single-record keyed-read constraints (the helper is
     // shared with recordKeyGet, its missing-key policy included).
-    const surfaces = (t) => typeEquals(t, type) || (type.kind === "union" && lowerer.armTag(type.unionId, t) >= 0);
+    const surfaces = (t) => typeEquals(t, type) || (type.kind === "union" && lowerer.armTag(type.unionId, t) >= 0) ||
+        exactUnionWidening(lowerer, t, type);
     for (const arm of def.arms) {
         if (isUnitType(arm)) {
             if (!(type.kind === "union" && lowerer.armTag(type.unionId, UNDEFINED_T) >= 0))
                 return null;
             continue;
         }
+        if (key.type.kind === "f64") {
+            if (arm.kind !== "array" || !surfaces(arm.elem))
+                return null;
+            continue;
+        }
         if (arm.kind !== "record")
             return null;
         const shape = lowerer.shapes.get(arm.shapeId);
@@ -8569,6 +9500,75 @@ function lowerUnionKeyedRead(lowerer, expr, unionId, value, key, literalField) {
     }
     return { kind: "unionKeyGet", unionId, key, value, type, loc: locOf(expr) };
 }
+/** A structural TypeScript view does not change a nominal object's layout
+ * or accessor dispatch. Resolve the property from the represented class;
+ * the optional checker view must not turn its getter into a record read. */
+function classFieldTarget(lowerer, receiverNode, receiverType, fieldName, saved) {
+    const info = lowerer.classes.get(receiverType.className);
+    if (!info) {
+        // A receiver typed as a class whose collection deferred: the
+        // deferred diagnostics are what explains the miss.
+        lowerer.flushDeferredClass(receiverType.className);
+        return null;
+    }
+    const fieldType = info.fields.get(fieldName);
+    const lowerObjectReceiver = () => {
+        let obj = saved ?? lowerer.lowerExpr(receiverNode);
+        if (obj.type.kind === "union") {
+            const helper = lowerer.narrowedArmHelper(obj.type.unionId, receiverType, locOf(receiverNode));
+            obj = helper
+                ? { kind: "call", callee: helper, args: [obj], type: receiverType, loc: locOf(receiverNode) }
+                : lowerer.maybeNarrow(obj, receiverNode);
+        }
+        return obj.type.kind === "dyn" ? lowerer.coerceInto(receiverNode, obj, receiverType) : obj;
+    };
+    if (fieldName === "cause" && receiverType.className !== "%DOMException") {
+        let root = info;
+        while (root.base)
+            root = root.base;
+        if (root.def.name === "%Error") {
+            return { container: "errorCause", obj: lowerObjectReceiver(), field: "cause", fieldType: DYN };
+        }
+    }
+    if (fieldType) {
+        const obj = lowerObjectReceiver();
+        return { container: "class", obj, className: receiverType.className, field: fieldName, fieldType };
+    }
+    // Accessor property: either half declared anywhere on the chain
+    // makes the name an accessor target (fields and accessors share a
+    // namespace — tsc rejects mixing them, so the halves agree on kind).
+    const getF = lowerer.findMethodOn(info, `get:${fieldName}`);
+    const setF = lowerer.findMethodOn(info, `set:${fieldName}`);
+    if (getF || setF) {
+        const obj = lowerObjectReceiver();
+        return {
+            container: "accessor",
+            obj,
+            className: receiverType.className,
+            field: fieldName,
+            fieldType: getF ? getF.sig.ret : setF.sig.params[0].type,
+        };
+    }
+    return null;
+}
+/** A structural assertion can leave the value in its original class
+ * representation, including an unchecked array read's undefined arm. Only
+ * a single nominal payload has an unambiguous property layout. Validate
+ * that payload before dispatching a field or accessor; an absent receiver
+ * must never reach the backend as an object pointer. */
+function hasClassPayload(lowerer, type) {
+    return type.kind === "object" || type.kind === "union" &&
+        (lowerer.unions.get(type.unionId)?.arms.some((arm) => arm.kind === "object") ?? false);
+}
+function representedClassFieldTarget(lowerer, receiverNode, fieldName, value) {
+    const arms = value.type.kind === "union"
+        ? lowerer.unions.get(value.type.unionId)?.arms.filter((arm) => !isUnitType(arm))
+        : [value.type];
+    const objectType = arms?.length === 1 ? arms[0] : null;
+    return objectType?.kind === "object"
+        ? classFieldTarget(lowerer, receiverNode, objectType, fieldName, value)
+        : null;
+}
 /** Recognizes `obj.field` as an assignable field target: receiver is a
    * known class instance OR a record, and the member is a field or (class
    * receivers) a declared accessor property. Returns the pieces of a
@@ -8576,55 +9576,26 @@ function lowerUnionKeyedRead(lowerer, expr, unionId, value, key, literalField) {
 export function fieldTarget(lowerer, access) {
     if (lowerer.chainBlocked(access))
         return null;
-    const receiverIr = lowerer.mapTypeOf(lowerer.typeOf(access.expression));
+    if (access.name.text === "stackTraceLimit" && lowerer.isStdlibGlobal(access.expression, "Error")) {
+        return { container: "errorStackLimit", obj: { kind: "numLit", value: 0, type: F64, loc: locOf(access) }, field: "stackTraceLimit", fieldType: F64 };
+    }
+    const stored = ts.isIdentifier(access.expression)
+        ? lowerer.peekLocal(access.expression)?.type ?? lowerer.globalOf(access.expression)?.type : undefined;
+    const receiverIr = stored?.kind === "record" ? stored : lowerer.mapTypeOf(lowerer.typeOf(access.expression));
     if (receiverIr?.kind === "object") {
-        const info = lowerer.classes.get(receiverIr.className);
-        if (!info) {
-            // A receiver typed as a class whose collection deferred: the
-            // deferred diagnostics are what explains the miss.
-            lowerer.flushDeferredClass(receiverIr.className);
-            return null;
-        }
-        const fieldType = info.fields.get(access.name.text);
-        const lowerObjectReceiver = () => {
-            let obj = lowerer.lowerExpr(access.expression);
-            if (obj.type.kind === "union" && lowerer.armTag(obj.type.unionId, UNDEFINED_T) >= 0) {
-                const present = lowerer.stripUndefinedArm(obj.type);
-                const helper = present.kind === "object"
-                    ? lowerer.narrowedArmHelper(obj.type.unionId, present, locOf(access.expression))
-                    : null;
-                obj = helper
-                    ? { kind: "call", callee: helper, args: [obj], type: present, loc: locOf(access.expression) }
-                    : lowerer.maybeNarrow(obj, access.expression);
-            }
-            return obj;
-        };
-        if (fieldType) {
-            const obj = lowerObjectReceiver();
-            return { container: "class", obj, className: receiverIr.className, field: access.name.text, fieldType };
-        }
-        // Accessor property: either half declared anywhere on the chain
-        // makes the name an accessor target (fields and accessors share a
-        // namespace — tsc rejects mixing them, so the halves agree on kind).
-        const getF = lowerer.findMethodOn(info, `get:${access.name.text}`);
-        const setF = lowerer.findMethodOn(info, `set:${access.name.text}`);
-        if (getF || setF) {
-            const obj = lowerObjectReceiver();
-            return {
-                container: "accessor",
-                obj,
-                className: receiverIr.className,
-                field: access.name.text,
-                fieldType: getF ? getF.sig.ret : setF.sig.params[0].type,
-            };
-        }
-        return null;
+        return classFieldTarget(lowerer, access.expression, receiverIr, access.name.text);
+    }
+    if (receiverIr?.kind === "union" && hasClassPayload(lowerer, receiverIr)) {
+        return representedClassFieldTarget(lowerer, access.expression, access.name.text, lowerer.lowerExpr(access.expression));
     }
     if (receiverIr?.kind === "record") {
         const shape = lowerer.shapes.get(receiverIr.shapeId);
         const fieldType = shape?.fields.find((f) => f.name === access.name.text)?.type;
         if (fieldType) {
             let obj = lowerer.lowerExpr(access.expression);
+            const nominal = representedClassFieldTarget(lowerer, access.expression, access.name.text, obj);
+            if (nominal)
+                return nominal;
             // A checker-record receiver whose VALUE stayed dyn (the erased
             // all-unknown-fields cast — `(err as { code?: unknown }).code`):
             // decline, and the dyn keyed-read fallback answers.
@@ -8758,7 +9729,7 @@ export function uniqueSymbolKeyOf(lowerer, key) {
     // Module level only: a unique-symbol const inside a FUNCTION is a
     // fresh runtime identity per call — one static slot would conflate
     // what JS keeps distinct.
-    if (!ts.isVariableStatement(decl.parent.parent) || !ts.isSourceFile(decl.parent.parent.parent))
+    if (!ts.isVariableStatement(decl.parent?.parent) || !ts.isSourceFile(decl.parent?.parent?.parent))
         return null;
     const init = decl.initializer;
     if (!init || !ts.isCallExpression(init) || init.questionDotToken)
@@ -8791,10 +9762,10 @@ export function symbolFieldInfo(lowerer, expr) {
         lowerer.flushDeferredClass(receiverIr.className);
         return null;
     }
-    const key = uniqueSymbolKeyOf(lowerer, expr.argumentExpression);
+    const key = classSymbolKeyOf(lowerer, expr.argumentExpression);
     if (!key)
         return null;
-    const field = info.symbolFields?.get(key.sym);
+    const field = info.symbolFields?.get(key.identity);
     if (field === undefined)
         return null;
     const fieldType = info.fields.get(field);
@@ -8816,6 +9787,12 @@ function symbolFieldTarget(lowerer, expr) {
    * tsc-clean (the property types as the setter's param), but Node yields
    * undefined, which these property types cannot represent. */
 export function fieldGetExpr(lowerer, target, loc, blame) {
+    if (target.container === "errorStackLimit") {
+        return { kind: "libCall", fn: "error.stackLimitGet", args: [], type: F64, loc };
+    }
+    if (target.container === "errorCause") {
+        return { kind: "libCall", fn: "error.cause", args: [target.obj], type: DYN, loc };
+    }
     // A record-shaped CHECKER target whose receiver VALUE lives in the checked-dynamic tree
     // (a JS file-scope object-literal global): the checked-dynamic keyed
     // read — dynKeyGet (a missing key answers the dyn undefined, exactly
@@ -8912,6 +9889,12 @@ export function fieldGetExpr(lowerer, target, loc, blame) {
    * call). A write to a getter-only property never gets here in a clean
    * program (tsc's TS2540 is the fence); the rejection is the backstop. */
 export function fieldSetStmt(lowerer, target, value, loc, blame) {
+    if (target.container === "errorStackLimit") {
+        return { kind: "exprStmt", expr: { kind: "libCall", fn: "error.stackLimitSet", args: [value], type: VOID, loc }, loc };
+    }
+    if (target.container === "errorCause") {
+        return { kind: "exprStmt", expr: { kind: "libCall", fn: "error.setCause", args: [target.obj, value], type: VOID, loc }, loc };
+    }
     // A record-shaped CHECKER target whose receiver VALUE lives in the checked-dynamic tree:
     // the checked-dynamic keyed write — dyn.keySet (later writes win,
     // insertion order; Node's TypeErrors on non-object receivers), the
@@ -9080,61 +10063,73 @@ export function lowerPromiseAllTupleCall(lowerer, call, access) {
 }
 /** `obj.f op= e` (and `obj.f++` with rhs null ≡ 1) — the element spelling
    * `obj[k] op= e` included when k is a declared symbol-keyed field.
-   * Restricted to side-effect-free receivers (identifier or `this`)
-   * because the desugar evaluates the receiver twice. */
+   * Save the receiver and old value before the RHS, then write through
+   * that same receiver even if the RHS replaces its original binding. */
 export function lowerFieldCompound(lowerer, access, op, rhsNode, loc) {
+    return { kind: "exprStmt", expr: lowerFieldCompoundValue(lowerer, access, op, rhsNode, loc), loc };
+}
+function lowerFieldCompoundValue(lowerer, access, op, rhsNode, loc) {
     if (access.expression.kind === ts.SyntaxKind.SuperKeyword) {
         lowerer.unsupported("SC1090", access, "compound assignment through 'super' (read and write separately)");
     }
-    if (!ts.isIdentifier(access.expression) && access.expression.kind !== ts.SyntaxKind.ThisKeyword) {
-        lowerer.unsupported("SC1090", access, "compound assignment to fields of computed receivers");
-    }
+    const body = [];
+    const save = (value, name) => {
+        const local = lowerer.declareHiddenLocal(name, value.type);
+        body.push({ kind: "varDecl", localId: local.id, init: value, loc: value.loc });
+        return varRef(local.id, value.type, value.loc);
+    };
     // A CHECKED-DYNAMIC receiver (`context.actual++` — test/common's call
     // accounting; dot spelling only — symbol-keyed element targets are
     // static fields): read the member (dynKeyGet), VALIDATE it as a
     // number (dynCheck — a non-number member throws the catchable
     // TypeError where JS would ToNumber-coerce; loud, never a silent
     // NaN — SEMANTICS.md), combine, write back (dyn.keySet). The
-    // receiver is an identifier (checked above), so evaluating it for
-    // read and write matches JS's once-evaluation observably.
+    // receiver and member read are saved before evaluating the RHS.
     if (ts.isPropertyAccessExpression(access)) {
         const probed = tryLowerExpression(lowerer, access.expression);
         if (probed?.type.kind === "dyn") {
+            const receiver = save(probed, "%compoundReceiver");
             const key = { kind: "strLit", value: access.name.text, type: STRING, loc: locOf(access.name) };
-            const read = { kind: "dynKeyGet", key, value: probed, type: DYN, loc };
+            const read = save({ kind: "dynKeyGet", key, value: receiver, type: DYN, loc }, "%compoundOld");
             const cur = { kind: "dynCheck", value: read, type: F64, loc };
-            const rhs = rhsNode
+            const rhs = save(rhsNode
                 ? lowerer.lowerExpr(rhsNode)
-                : { kind: "numLit", value: 1, type: F64, loc };
-            if (rhs.type.kind !== "f64")
+                : { kind: "numLit", value: 1, type: F64, loc }, "%compoundRhs");
+            const numericRhs = rhs.type.kind === "dyn"
+                ? { kind: "dynCheck", value: rhs, type: F64, loc: rhs.loc }
+                : lowerOptionalNumber(lowerer, rhs, loc);
+            if (numericRhs.type.kind !== "f64")
                 lowerer.unsupported("SC1043", access);
-            const value = { kind: "bin", op, left: cur, right: rhs, type: F64, loc };
-            const recv2 = lowerer.lowerExpr(access.expression);
+            const value = save({ kind: "bin", op, left: cur, right: numericRhs, type: F64, loc }, "%compoundResult");
             const boxed = { kind: "dynFrom", value, type: DYN, loc };
-            return {
+            body.push({
                 kind: "exprStmt",
-                expr: { kind: "libCall", fn: "dyn.keySet", args: [recv2, { ...key }, boxed], type: VOID, loc },
+                expr: { kind: "libCall", fn: "dyn.keySet", args: [receiver, { ...key }, boxed], type: VOID, loc },
                 loc,
-            };
+            });
+            return { kind: "seqExpr", stmts: body, result: value, type: value.type, loc };
         }
     }
     const targetOf = () => ts.isPropertyAccessExpression(access) ? lowerer.fieldTarget(access) : symbolFieldTarget(lowerer, access);
     const target = targetOf();
     if (!target)
         lowerer.unsupported("SC1090", access, "compound assignment to unsupported field targets");
-    // Through an accessor target this desugars to get, op, set — with the
-    // receiver an identifier/this, the observable order matches JS exactly:
-    // getter, rhs side effects, setter (verified against Node).
-    const read = lowerer.fieldGetExpr(target, locOf(access), access);
-    const rhs = rhsNode
+    target.obj = save(target.obj, "%compoundReceiver");
+    // Accessors observe getter, RHS side effects, then setter, all through
+    // the saved receiver.
+    const read = save(lowerer.fieldGetExpr(target, locOf(access), access), "%compoundOld");
+    const rhs = save(rhsNode
         ? lowerer.lowerExpr(rhsNode)
-        : { kind: "numLit", value: 1, type: F64, loc };
+        : { kind: "numLit", value: 1, type: F64, loc }, "%compoundRhs");
+    const numericRhs = rhs.type.kind === "dyn" && isJsSourceFile(access.getSourceFile())
+        ? { kind: "dynCheck", value: rhs, type: F64, loc: rhs.loc }
+        : lowerOptionalNumber(lowerer, rhs, loc);
     let value;
     if (op === "+" && target.fieldType.kind === "string") {
         value = { kind: "strConcat", left: read, right: lowerer.ensureString(rhs, rhsNode ?? access), type: STRING, loc };
     }
-    else if (target.fieldType.kind === "f64" && rhs.type.kind === "f64") {
-        value = { kind: "bin", op, left: read, right: rhs, type: F64, loc };
+    else if (target.fieldType.kind === "f64" && numericRhs.type.kind === "f64") {
+        value = { kind: "bin", op, left: read, right: numericRhs, type: F64, loc };
     }
     else if (target.fieldType.kind === "dyn" &&
         isJsSourceFile(access.getSourceFile()) &&
@@ -9170,9 +10165,9 @@ export function lowerFieldCompound(lowerer, access, op, rhsNode, loc) {
     else {
         lowerer.unsupported("SC1043", access);
     }
-    // Second, independent evaluation of the (side-effect-free) receiver.
-    const reevaluatedTarget = targetOf();
-    return lowerer.fieldSetStmt(reevaluatedTarget, value, loc, access);
+    const result = save(value, "%compoundResult");
+    body.push(lowerer.fieldSetStmt(target, result, loc, access));
+    return { kind: "seqExpr", stmts: body, result, type: result.type, loc };
 }
 /** Stream-rooted receivers' property surface (readableEnded, destroyed,
  * ...): the receiver's mapped class dispatches into lower-stream.ts.