@scriptc/compiler 0.1.7 → 0.2.0

package/dist/frontend/lowering/lower-calls.js

@@ -1,28 +1,34 @@
+import { objectEnumerationReceiver } from "./object-enumeration-receiver.js";
 import { InternalCompilerError } from "../../errors.js";
 /* Call lowering: the lowerCall dispatch chain, parameter-shape analysis and
  * argument completion (optional/default/rest, explicit-undefined ≡ omission),
  * function/lambda lowering and signature collection, and monomorphizing
  * generic instantiation (bounded by MAX_GENERIC_INSTANCES). */
 import * as ts from "../ts7/adapter.js";
+import { AstNode } from "../ts7/ast-node.js";
 import { bodyReadsArguments } from "../arguments-usage.js";
 import { lowerGenMethodCall } from "./lower-generators.js";
-import { BIGINT_T, BOOL, CAUGHT, DYN, F64, JSVAL, STRING, SYMBOL_T, UNDEFINED_T, VOID, arrayOf, canBoxFuncIntoDyn, canConvertToDyn, canDynCheckTo, canMarshalTypedFuncIntoIsland, ffiClassType, ffiSourceParamTypes, funcOf, isFfiCallbackParam, isFfiContextParam, isFfiReleaseParam, isUnitType, shapeHasAccessorSlots, typeEquals } from "../../ir/ir.js";
-import { isJsSourceFile, isNodeEsmFile, locOf } from "../program.js";
-import { genResultRecord, isGenericCallableMemberType, typeKey } from "../type-mapper.js";
+import { lowerClassSymbolMethodCall } from "./symbol-methods.js";
+import { errorToStringCall } from "./error-methods.js";
+import { lowerClassPrototypeAssign } from "./class-prototypes.js";
+import { BYTES_ELEMENT_NAME, BIGINT_T, BOOL, CAUGHT, DYN, F64, JSVAL, NULL_T, STRING, SYMBOL_T, UNDEFINED_T, VOID, arrayOf, canBoxFuncIntoDyn, canConvertToDyn, canDynCheckTo, canMarshalTypedFuncIntoIsland, ffiClassType, ffiSourceParamTypes, funcOf, isDynTypedRefType, isFfiCallbackParam, isFfiContextParam, isFfiReleaseParam, isUnitType, shapeHasAccessorSlots, typeEquals } from "../../ir/ir.js";
+import { isJsSourceFile, isNodeEsmFile, locOf, requireSpecOf } from "../program.js";
+import { genResultRecord, isGenericCallableMemberType, jsOpenObjectType, typeKey } from "../type-mapper.js";
 import { PoisonError, dynFallbackType, dynUndefinedExpr, importCallHandleType, jsFuncNameOf, newFnCtx, nodeThrowExpr, staticImportNamespaceType } from "./lowerer.js";
 import { enforceLibBoundary } from "./lib-boundary.js";
 import { NARROW_FIRST, STRING_INDEX_METHODS, STR_METHODS, builtinFenceHintOf, builtinModuleFnOf } from "./surfaces.js";
 import { ffiBindingDiag, ffiSignatureDiag, libCallbackDiag, requiresDynamicDiag } from "../../diagnostics/diagnostic.js";
 import { mixinFnShapeOf } from "./lower-mixins.js";
 import { dynStringReceiver, lowerArrayConstructor, lowerArrayFromCall, lowerArrayOfCall, lowerDynArrayFilterCall, lowerDynArrayFlatMapCall, lowerGroupByStaticCall, lowerIteratorHelperCall, lowerObjectAssignIndexShape, lowerObjectFromEntriesCall, lowerObjectIterOverIndexShape, lowerTupleReadMethodCall } from "./lower-containers.js";
-import { bufEncoding } from "./containers/bytes.js";
+import { lowerBytesStaticCall } from "./containers/bytes.js";
 import { lowerRegexMethodCall, lowerStringIndexCall, lowerStringMethodCall, lowerStringPaddingCall, lowerStringSplitCall } from "./containers/string-and-regexp.js";
-import { lowerChildStreamMethodCall, lowerChildWriterMethodCall, lowerCreateRequireCall, lowerCryptoHashMethodCall, lowerDirentMethodCall, lowerFileHandleMethodCall, lowerImportMetaResolveCall, lowerNodeModuleCall, lowerPerfHooksCall, lowerProcStreamMethodCall, lowerReflectApplyCall, lowerRequireResolveCall, lowerWatcherMethodCall } from "./lower-builtins.js";
+import { createRequireSpecOf, lowerChildStreamMethodCall, lowerChildWriterMethodCall, lowerCreateRequireCall, lowerCryptoHashMethodCall, lowerDirentMethodCall, lowerFileHandleMethodCall, lowerImportMetaResolveCall, lowerNodeModuleCall, lowerPerfHooksCall, lowerProcStreamMethodCall, lowerReflectApplyCall, lowerRequireResolveCall, lowerWatcherMethodCall } from "./lower-builtins.js";
 import { lowerAbsenceProbe, lowerPromiseAllTupleCall, lowerPromiseRejectCall, stringWrapperToString, templateRawTextOf } from "./lower-exprs.js";
 import { isSafeToDiscard } from "./expressions/evaluation-safety.js";
 import { tryLowerExpression } from "./expressions/try-lower-expression.js";
 import { httpClientFnBindingOf, isStreamUndefCallExpr, lowerCompatReqStreamOptionalCall, lowerHttpClientFnCall } from "./lower-server.js";
-import { EMITTER_API_MEMBERS, exactInstanceClassOf, findGenericMethodOn, lowerClassGenericMethodCall, lowerStaticMethodCall } from "./lower-classes.js";
+import { EMITTER_API_MEMBERS, exactInstanceClassOf, findGenericMethodOn, lowerClassGenericMethodCall, lowerStaticMethodCall, returnsOnlyThis } from "./lower-classes.js";
+import { classCallbackCall, isClassCallback } from "./class-callbacks.js";
 import { emitterRooted, lowerEmitterMethodCall } from "./lower-event-emitter.js";
 import { lowerConsoleInspectArg, lowerFormatCall } from "./lower-inspect.js";
 import { STREAM_API_MEMBERS, lowerStreamMethodCall, lowerStreamModuleCall, lowerStreamStaticCall, streamSidesOf } from "./lower-stream.js";
@@ -30,10 +36,13 @@ import { ambientNsRootOf, ambientUndefReadType, ambientUndefVarRootOf, ambientUn
 import { declSymbolOf } from "./lower-modules.js";
 import { expandoMemberRead } from "./lower-expando.js";
 import { npmStaticPackageOfPath } from "../npm-static.js";
-import { countedFor, varRef } from "../../ir/build.js";
+import { countedFor, numLit, varRef } from "../../ir/build.js";
 import { rejectStaticThis } from "./static-this.js";
 import { fenceNodeModuleMutationCall, lowerRequireCacheKeys } from "./lower-node-module.js";
 import { defaultAfterUndefined, lowerOptionalArgument, lowerStaticallyUndefinedArgument, positionNumber } from "./optional-arguments.js";
+import { fenceSymbolFieldCopy } from "./symbol-fields.js";
+import { lowerClassDataDescriptor, lowerClassDescriptorRead } from "./class-descriptors.js";
+import { classStaticDataFor } from "./class-static-data.js";
 export { bodyReadsArguments };
 /** The one func-type projection of completed parameter shapes. Typed rest
  * parameters keep their packed array as the trailing native ABI slot and
@@ -51,11 +60,7 @@ export function funcTypeFromParamShapes(shapes, ret) {
         ret,
         ...(typedRest || dynRest || islandRest || argumentsAll ? { rest: true } : {}),
         ...(argumentsAll ? { argumentsAll: true } : {}),
-        ...(typedRest
-            ? { restAbi: "typed" }
-            : islandRest
-                ? { restAbi: "jsval" }
-                : {}),
+        ...(typedRest || islandRest ? { restAbi: typedRest ? "typed" : "jsval" } : {}),
     };
 }
 /** Registers `const alias = overloadedDeclaration` as a compile-time
@@ -118,6 +123,11 @@ export const MAX_GENERIC_INSTANCES = 100;
    * - `...xs: T[]`: the ABI type is the array; call sites pack the surplus.
    */
 export function paramShape(lowerer, param) {
+    if (lowerer.checkedCallbackParams.has(param)) {
+        return param.initializer
+            ? { type: DYN, mode: "omittable", bodyType: DYN }
+            : { type: DYN, mode: "required" };
+    }
     const moduleNs = lowerer.moduleNsParamOverrides.get(param);
     if (moduleNs !== undefined) {
         return { type: moduleNs, mode: param.questionToken ? "omittable" : "required" };
@@ -159,21 +169,7 @@ export function paramShape(lowerer, param) {
             // default when the argument was omitted or undefined, then the
             // pattern destructures the picked value (declareParams).
             const raw = lowerer.irTypeOf(param.name);
-            // A DYNAMIC-TIER pattern source (`function f({} = a)` with
-            // `a: any` — jsval for island values, dyn for the checked-dynamic
-            // dyn): the slot holds its tier's undefined DIRECTLY, so the ABI
-            // is the slot itself — no synthesized union; the prologue tests
-            // undefined at runtime (declareParams).
-            if (raw.kind === "dyn" || raw.kind === "jsval") {
-                return { type: raw, mode: "omittable", bodyType: raw };
-            }
-            const bodyType = lowerer.stripUndefinedArm(raw);
-            lowerer.checkDefaultParamBodyType(param, bodyType);
-            const abi = bodyType.kind === "union" ? lowerer.withUndefinedArmOf(bodyType) : lowerer.withUndefinedArm(bodyType);
-            if (!abi) {
-                lowerer.badType(param.name, lowerer.typeOf(param.name)); // defensive: unknown union id
-            }
-            return { type: abi, mode: "omittable", bodyType };
+            return defaultParameterShape(lowerer, param, raw);
         }
         return { type: lowerer.runtimeOptionalBindingType(param.name, lowerer.irTypeOf(param.name)), mode: "required" };
     }
@@ -207,41 +203,12 @@ export function paramShape(lowerer, param) {
     }
     if (param.initializer) {
         const raw = lowerer.irTypeOf(param.name);
-        // A DYNAMIC-TIER defaulted param (`function f(x = a)` with `a: any`
-        // — tsc types x any; jsval for island values, dyn for the checked-
-        // dynamic dyn): the slot holds its tier's undefined directly, so
-        // the ABI is the slot itself and the prologue's default test is the
-        // runtime undefined test (declareParams).
-        if (raw.kind === "dyn" || raw.kind === "jsval") {
-            return { type: raw, mode: "omittable", bodyType: raw };
-        }
-        // A default that may ITSELF be undefined (`x = process.env.FOO`):
-        // tsc keeps undefined in the body's type, so there is nothing to
-        // narrow — the ABI union IS the body type and the prologue passes a
-        // present argument through unchanged (declareParams's pass-through
-        // branch). The generic strip-and-narrow below would demand a
-        // `string`-typed default and fence on the union re-tag.
-        if (lowerer.bareUndefinedArmedUnion(raw)) {
-            const initT = lowerer.mapTypeOf(lowerer.typeOf(param.initializer));
-            if (initT && (initT.kind === "undefinedT" || lowerer.bareUndefinedArmedUnion(initT))) {
-                return { type: raw, mode: "omittable", bodyType: raw };
-            }
-        }
-        const bodyType = lowerer.stripUndefinedArm(raw);
-        lowerer.checkDefaultParamBodyType(param, bodyType);
-        // A UNION body type (`tlds: string | string[] = "localhost"`) arms
-        // the ABI with undefined ON TOP of the body's arms; the prologue
-        // re-tags a present argument back into the body union (undefined
-        // sorts last among arm typeKeys in practice, so the mapping is
-        // usually the identity prefix — the interned retag helper handles
-        // any order).
-        const abi = bodyType.kind === "union" ? lowerer.withUndefinedArmOf(bodyType) : lowerer.withUndefinedArm(bodyType);
-        if (!abi) {
-            lowerer.badType(param.name, lowerer.typeOf(param.name)); // defensive: unknown union id
-        }
-        return { type: abi, mode: "omittable", bodyType };
+        return defaultParameterShape(lowerer, param, raw);
     }
     const type = lowerer.runtimeOptionalBindingType(param.name, lowerer.irTypeOf(param.name));
+    if (type.kind === "void") {
+        lowerer.unsupported("SC1090", param, "function parameters with void type");
+    }
     if (param.questionToken && !lowerer.bareUndefinedArmedUnion(type) && type.kind !== "dyn" && type.kind !== "jsval") {
         // `x?: unknown` where unknown came from an annotation: undefined is
         // absorbed into the hole type, so no undefined ARM exists — but a
@@ -269,7 +236,7 @@ export function paramShapes(lowerer, params, signature, blameOf) {
     return params.map((declParam, i) => {
         const symbol = signature.getParameters()[i];
         const tsType = symbol ? lowerer.checker.getTypeOfSymbol(symbol) : lowerer.typeOf(declParam.name);
-        const mapped = lowerer.runtimeOptionalBindingType(declParam.name, lowerer.mapTypeOf(tsType) ?? lowerer.irTypeOf(declParam.name));
+        const mapped = jsOpenObjectType(declParam, lowerer.runtimeOptionalBindingType(declParam.name, lowerer.mapTypeOf(tsType) ?? lowerer.irTypeOf(declParam.name)), lowerer.shapes, lowerer.unions);
         if (!mapped || mapped.kind === "void")
             lowerer.badType(blameOf?.(declParam, i) ?? declParam.name, tsType);
         if (declParam.dotDotDotToken) {
@@ -277,30 +244,46 @@ export function paramShapes(lowerer, params, signature, blameOf) {
                 lowerer.badType(blameOf?.(declParam, i) ?? declParam.name, tsType);
             return { type: mapped, mode: "rest" };
         }
-        if (declParam.initializer) {
-            if (mapped.kind === "dyn" || mapped.kind === "jsval") {
-                return { type: mapped, mode: "omittable", bodyType: mapped };
-            }
-            const bodyType = lowerer.stripUndefinedArm(mapped);
-            lowerer.checkDefaultParamBodyType(declParam, bodyType);
-            return { type: lowerer.withUndefinedArm(bodyType), mode: "omittable", bodyType };
-        }
+        if (declParam.initializer)
+            return defaultParameterShape(lowerer, declParam, mapped);
         if (declParam.questionToken && !lowerer.bareUndefinedArmedUnion(mapped)) {
             lowerer.unsupported("SC1090", declParam, `optional parameters of type '${lowerer.fmt(mapped)}'`);
         }
         return { type: mapped, mode: declParam.questionToken ? "omittable" : "required" };
     });
 }
+/** A default expression may itself yield undefined. Keep that arm in the
+ * body and parameter-property storage, including for literal `undefined`
+ * and void expressions: the general type mapper represents those as VOID,
+ * so checking only a mapped undefinedT silently erased a valid value.
+ * Shared by declared and instantiated signatures, including destructuring. */
+function defaultParameterShape(lowerer, param, raw) {
+    if (raw.kind === "dyn" || raw.kind === "jsval") {
+        return { type: raw, mode: "omittable", bodyType: raw };
+    }
+    if (lowerer.bareUndefinedArmedUnion(raw) && param.initializer) {
+        const initializer = lowerer.typeOf(param.initializer);
+        const parts = initializer.isUnionType() ? ts.constituentTypes(initializer) : [initializer];
+        if (parts.some((part) => (part.flags & (ts.TypeFlags.Undefined | ts.TypeFlags.Void)) !== 0)) {
+            return { type: raw, mode: "omittable", bodyType: raw };
+        }
+    }
+    const bodyType = lowerer.stripUndefinedArm(raw);
+    lowerer.checkDefaultParamBodyType(param, bodyType);
+    const abi = bodyType.kind === "union" ? lowerer.withUndefinedArmOf(bodyType) : lowerer.withUndefinedArm(bodyType);
+    if (!abi)
+        lowerer.badType(param.name, lowerer.typeOf(param.name));
+    return { type: abi, mode: "omittable", bodyType };
+}
 /** The fences on a defaulted parameter's body type: it becomes the value
    * arm of the synthesized `T | undefined` ABI union, so it must be a valid
-   * single arm. func and Set ARE valid here: the ABI union's only test is
+   * single arm. Functions, Maps and Sets are valid: the ABI union's test is
    * the prologue's own undefined-tag check (never a user narrowing, which
-   * is what keeps map/set out of general unions), so `runner: Runner =
+   * is what keeps containers out of unions with data siblings), so `runner: Runner =
    * defaultRunner` and `skip: Set<string> = new Set()` arm like any ref
    * kind — the nullable-callback union shape, built by the compiler. */
 export function checkDefaultParamBodyType(lowerer, param, bodyType) {
     if (bodyType.kind === "void" ||
-        bodyType.kind === "map" ||
         bodyType.kind === "regex" ||
         bodyType.kind === "date" ||
         bodyType.kind === "dyn" ||
@@ -336,7 +319,62 @@ export function completeArgs(lowerer, argNodes, shapes, loc, blame,
  * coercion an ordinary argument gets (coerceInto against its shape,
  * DYN conversion in a dyn rest, element coercion in a typed rest). */
 leading) {
-    const isIr = (s) => s !== undefined && !("kind" in s);
+    // Conversion eligibility can traverse the whole recursive parameter
+    // graph. Ordinary calls and fixed tuples never need that analysis.
+    if (argNodes.some((arg) => ts.isSpreadElement(arg) && !fixedTupleSpreadInfo(lowerer, arg.expression)) &&
+        canCompleteRuntimeSpread(lowerer, shapes)) {
+        // Runtime-length spreads determine the complete argument list before
+        // any parameter default runs. Build it once in source order, then
+        // extract the fixed native ABI slots; missing elements are undefined.
+        const pack = lowerer.declareHiddenLocal("%spreadArgs", DYN);
+        const ref = () => ({ kind: "varRef", localId: pack.id, type: DYN, loc });
+        const stmts = [{ kind: "varDecl", localId: pack.id, init: { kind: "dynArrLit", elems: [], type: DYN, loc }, loc }];
+        const push = (value, fn) => {
+            stmts.push({ kind: "exprStmt", expr: { kind: "libCall", fn, args: [ref(), value], type: VOID, loc: value.loc }, loc: value.loc });
+        };
+        for (const value of leading ?? [])
+            push(lowerer.coerceInto(blame, value, DYN), "dyn.packPush");
+        const spreads = argNodes.filter(ts.isSpreadElement).length;
+        argNodes.forEach((arg, index) => {
+            if (!ts.isSpreadElement(arg)) {
+                push(lowerer.lowerExprExpecting(arg, DYN), "dyn.packPush");
+                return;
+            }
+            let value = lowerer.lowerExpr(arg.expression);
+            if (value.type.kind === "set") {
+                value = { kind: "setIntrinsic", method: "toArray", receiver: value, args: [], type: arrayOf(value.type.elem), loc: value.loc };
+            }
+            else if (value.type.kind === "object") {
+                value = lowerer.classIteratorDrainCall(value, locOf(arg)) ?? value;
+            }
+            if (value.type.kind === "array") {
+                // Argument iteration materializes holes as present undefined
+                // before conversion to the dense checked-dynamic argument pack.
+                value = { kind: "arrayLit", elems: [value], spreads: [0], type: value.type, loc: value.loc };
+            }
+            value = lowerer.coerceInto(arg.expression, value, DYN);
+            if (spreads === 1 && index === argNodes.length - 1) {
+                stmts.push({ kind: "exprStmt", expr: {
+                        kind: "libCall", fn: "dyn.packPushSpread", args: [ref(), value, { kind: "strLit", value: arg.expression.getText(), type: STRING, loc }], type: VOID, loc,
+                    }, loc });
+            }
+            else
+                push(value, "dyn.packPushSpreadIter");
+        });
+        const args = shapes.map((shape, index) => {
+            if (shape.mode === "arguments")
+                return ref();
+            const value = shape.mode === "rest" || shape.mode === "dynRest"
+                ? { kind: "dynInvoke", recv: ref(), method: "slice", calleeName: "arguments.slice", args: [{ kind: "dynFrom", value: { kind: "numLit", value: index, type: F64, loc }, type: DYN, loc }], type: DYN, loc }
+                : { kind: "dynKeyGet", value: ref(), key: { kind: "strLit", value: String(index), type: STRING, loc }, type: DYN, loc };
+            return lowerer.coerceInto(blame, value, shape.type);
+        });
+        // Every supported form has at least one native slot to carry the
+        // evaluation prefix, including calls whose only slot is their rest.
+        args[0] = { kind: "seqExpr", stmts, result: args[0], type: args[0].type, loc };
+        return args;
+    }
+    const isIr = (s) => s !== undefined && !(s instanceof AstNode);
     const sources = leading?.map((ir) => ({ ir })) ?? [];
     for (const arg of argNodes) {
         if (!ts.isSpreadElement(arg)) {
@@ -399,9 +437,20 @@ leading) {
                 lowerer.unsupported("SC1090", source, "spread arguments into fixed parameter positions (a spread can only fill a rest parameter)");
             }
             const slotType = i < restAt ? positional[i].type : DYN;
-            const value = isIr(source)
-                ? lowerer.coerceInto(blame, source.ir, slotType)
-                : lowerer.lowerExprExpecting(source, slotType);
+            let value;
+            if (isIr(source)) {
+                let ir = source.ir;
+                // Tuple-spread storage also feeds later arguments. Declare it in
+                // this shared sequence, not inside one argument's initializer,
+                // whose statement frame ends before the next field is read.
+                if (ir.kind === "seqExpr") {
+                    stmts.push(...ir.stmts);
+                    ir = ir.result;
+                }
+                value = lowerer.coerceInto(blame, ir, slotType);
+            }
+            else
+                value = lowerer.lowerExprExpecting(source, slotType);
             const saved = lowerer.declareHiddenLocal("%callArg", slotType);
             stmts.push({ kind: "varDecl", localId: saved.id, init: value, loc: value.loc });
             return { kind: "varRef", localId: saved.id, type: slotType, loc: value.loc };
@@ -409,7 +458,7 @@ leading) {
         const fixed = positional.map((shape, i) => {
             if (i < passed.length)
                 return passed[i];
-            if (shape.mode === "omittable")
+            if (shape.mode === "omittable" || lowerer.bareUndefinedArmedUnion(shape.type))
                 return shape.callDefault ?? lowerer.undefinedArgFor(shape.type, loc, blame);
             if (shape.type.kind === "dyn")
                 return { kind: "dynFrom", value: { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc }, type: DYN, loc };
@@ -434,9 +483,19 @@ leading) {
             // completion has no home for that. Spreads fill REST slots only.
             lowerer.unsupported("SC1090", arg, "spread arguments into fixed parameter positions (a spread can only fill a rest parameter)");
         }
-        if (arg)
+        if (arg) {
+            let operand = arg;
+            while (ts.isParenthesizedExpression(operand))
+                operand = operand.expression;
+            if (ts.isVoidExpression(operand)) {
+                const absent = omittedArgFor(lowerer, shape.type, loc);
+                const effect = lowerStaticallyUndefinedArgument(lowerer, operand);
+                if (absent && effect)
+                    return defaultAfterUndefined(effect, absent);
+            }
             return lowerer.lowerExprExpecting(arg, shape.type);
-        if (shape.mode !== "omittable") {
+        }
+        if (shape.mode !== "omittable" && !lowerer.bareUndefinedArmedUnion(shape.type)) {
             // A missing argument for a CHECKED-DYNAMIC param (an implicit-any
             // JS signature called short — `mustCall(fn)` with `expected`
             // omitted): JS fills undefined, and the dyn slot holds exactly
@@ -690,7 +749,9 @@ export function requireExactArityValue(lowerer, blame, contextual, shapes, funcT
     // slot): judge by the expression's OWN completed type; the slot's
     // coercion still enforces (or adapts) the flow it lands in.
     if (mappedFn?.kind !== "func" && contextual) {
-        mappedFn = lowerer.mapTypeOf(lowerer.typeOf(contextual));
+        const ownType = lowerer.typeOf(contextual);
+        mappedFn = lowerer.mapTypeOf(ownType) ??
+            (isJsSourceFile(contextual.getSourceFile()) ? dynFallbackType(lowerer, contextual, ownType) : null);
     }
     if (mappedFn && typeEquals(mappedFn, funcType))
         return;
@@ -810,6 +871,10 @@ export function declaredReturnType(lowerer, decl, blame) {
     if (!sig)
         lowerer.unsupported("SC1090", decl, "this function form");
     const retTsType = lowerer.checker.getReturnTypeOfSignature(sig);
+    // An inferred null/undefined return in JS can read a mutable checked-value
+    // field. Keep the actual value instead of restricting it to the initializer.
+    if (isJsSourceFile(decl.getSourceFile()) && (retTsType.flags & (ts.TypeFlags.Null | ts.TypeFlags.Undefined)) !== 0)
+        return DYN;
     // A body that always throws infers `never` — as a RETURN type that is
     // void with a stronger guarantee (`() => never` is assignable to
     // `() => void`), and throw-only callbacks are ordinary code
@@ -817,10 +882,34 @@ export function declaredReturnType(lowerer, decl, blame) {
     if (retTsType.flags & ts.TypeFlags.Never)
         return VOID;
     const mappedReturn = lowerer.mapTypeOf(retTsType);
+    if (isJsSourceFile(decl.getSourceFile()) && !decl.type && !hasExplicitJsDocReturn(decl) && mappedReturn?.kind === "date")
+        return DYN;
+    // JS inference assigns Number to arithmetic over any, although the
+    // runtime operands can both be BigInts. Preserve that native result.
+    if (isJsSourceFile(decl.getSourceFile()) && !decl.type && !hasExplicitJsDocReturn(decl) &&
+        mappedReturn?.kind === "f64") {
+        let numericAnyReturn = false;
+        const numeric = new Set([ts.SyntaxKind.MinusToken, ts.SyntaxKind.AsteriskToken,
+            ts.SyntaxKind.SlashToken, ts.SyntaxKind.PercentToken, ts.SyntaxKind.AsteriskAsteriskToken]);
+        const check = (node) => {
+            if (node !== decl && ts.isFunctionLike(node))
+                return;
+            const value = ts.isReturnStatement(node) ? node.expression
+                : node === decl && ts.isArrowFunction(decl) && !ts.isBlock(decl.body) ? decl.body : undefined;
+            if (value && ts.isBinaryExpression(value) && numeric.has(value.operatorToken.kind) &&
+                [value.left, value.right].some((operand) => (lowerer.typeOf(operand).flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !== 0))
+                numericAnyReturn = true;
+            node.forEachChild(check);
+        };
+        check(decl);
+        if (numericAnyReturn)
+            return DYN;
+    }
     if (isJsSourceFile(decl.getSourceFile()) &&
         !hasExplicitJsDocReturn(decl) &&
         mappedReturn !== null &&
         promiseCarriesDyn(lowerer, mappedReturn) &&
+        !decl.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.AsyncKeyword) &&
         decl.parameters.some((param) => {
             const mapped = lowerer.mapTypeOf(lowerer.typeOf(param.name));
             return mapped === null || mapped.kind === "dyn";
@@ -852,14 +941,19 @@ export function declaredReturnType(lowerer, decl, blame) {
     // checked-dynamic (or none): a lambda with RECORD-typed parameters
     // (a reduce reducer over a typed array) legitimately returns its
     // parameters' records and keeps the static type.
+    // Native-only members (such as Int32Array layout offsets) cannot cross
+    // that boundary; their factories keep the native record ABI.
+    const asyncReturn = decl.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.AsyncKeyword) && mappedReturn?.kind === "promise";
+    const recordReturn = asyncReturn ? mappedReturn.inner : mappedReturn;
     if (isJsSourceFile(decl.getSourceFile()) &&
         decl.type === undefined &&
-        lowerer.mapTypeOf(retTsType)?.kind === "record" &&
+        recordReturn?.kind === "record" &&
+        lowerer.dynConvertible(recordReturn) &&
         decl.parameters.every((p) => {
             const mt = lowerer.mapTypeOf(lowerer.typeOf(p));
             return mt === null || mt.kind === "dyn";
         })) {
-        return DYN;
+        return asyncReturn ? { kind: "promise", inner: DYN } : DYN;
     }
     const returnType = lowerer.mapTypeOf(retTsType);
     if (!returnType) {
@@ -884,7 +978,7 @@ export function declaredReturnType(lowerer, decl, blame) {
    * other unmappable type (the caller's badType reports those). */
 function fenceGenericSignatureResult(lowerer, blame, t) {
     const parts = t.isUnionType() ? ts.constituentTypes(t) : [t];
-    if (!parts.some((p) => lowerer.checker.getCallSignatures(p).some((s) => (s.typeParameters?.length ?? 0) > 0))) {
+    if (!parts.some((p) => lowerer.checker.getCallSignatures(p).some((s) => s.getTypeParameters().length > 0))) {
         return;
     }
     lowerer.unsupported("SC1090", blame, `results that are themselves generic functions ('${lowerer.checker.typeToString(t)}' keeps its type parameters — no call-site instantiation pins them, and the returned value would need the producing call's frame; restructure to one generic function taking all arguments)`);
@@ -961,7 +1055,7 @@ export function collectSignatureInner(lowerer, decl) {
     if (!params.some((sh) => sh.mode === "rest" || sh.mode === "dynRest" || sh.mode === "islandRest") &&
         isJsSourceFile(decl.getSourceFile()) &&
         bodyReadsArguments(decl)) {
-        if (decl.parameters.length > 0 && !isNodeEsmFile(decl.getSourceFile())) {
+        if (decl.parameters.length > 0 && !isNodeEsmFile(decl.getSourceFile(), lowerer.program)) {
             lowerer.unsupported("SC1090", decl, "parameterized 'arguments' outside an ES module (sloppy-mode parameter aliases)");
         }
         params.push({ type: DYN, mode: decl.parameters.length > 0 ? "arguments" : "dynRest" });
@@ -1193,7 +1287,7 @@ export function inferTypeParamBindings(lowerer, expr, info, rsig, tsBindings) {
             return;
         const taT = lowerer.checker.getTypeFromTypeNode(ta);
         const mapped = lowerer.mapTypeOf(taT);
-        if (mapped && mapped.kind !== "void") {
+        if (mapped) {
             bindings.set(tp, mapped);
             tsBindings?.set(tp, taT);
         }
@@ -1213,7 +1307,7 @@ function bindDefaultTypeParams(lowerer, typeParams, typeParamDecls, bindings, ts
             return;
         const defT = lowerer.checker.getTypeFromTypeNode(tpDecl.defaultType);
         const mapped = lowerer.mapTypeOf(defT);
-        if (mapped && mapped.kind !== "void") {
+        if (mapped) {
             bindings.set(tp, mapped);
             tsBindings?.set(tp, defT);
         }
@@ -1255,7 +1349,10 @@ function unifySignatureBindings(lowerer, info, rsig, bindings, tsBindings) {
                 }
                 if (!bindings.has(sym)) {
                     const mapped = lowerer.mapTypeOf(inst);
-                    if (mapped && mapped.kind !== "void")
+                    // A visitor's inferred T can be void. It still binds the
+                    // return convention of `(node) => T`; discarding it leaves
+                    // the callback's return type spuriously uninstantiated.
+                    if (mapped)
                         bindings.set(sym, mapped);
                 }
             }
@@ -1270,10 +1367,20 @@ function unifySignatureBindings(lowerer, info, rsig, bindings, tsBindings) {
         // unbound type parameter surfaces as a mapping diagnostic later).
         if (declared.isUnionType()) {
             const unitFlags = ts.TypeFlags.Undefined | ts.TypeFlags.Null;
-            const dParts = ts.constituentTypes(declared).filter((t) => !(t.flags & unitFlags));
-            const iParts = inst.isUnionType() ? ts.constituentTypes(inst).filter((t) => !(t.flags & unitFlags)) : [inst];
+            const declaredParts = ts.constituentTypes(declared);
+            const declaredUnits = declaredParts.reduce((flags, t) => flags | (t.flags & unitFlags), 0);
+            const dParts = declaredParts.filter((t) => !(t.flags & unitFlags));
+            const iParts = inst.isUnionType() ? ts.constituentTypes(inst).filter((t) => !(t.flags & declaredUnits)) : [inst];
             if (dParts.length === 1 && iParts.length === 1)
                 unify(dParts[0], iParts[0], depth + 1);
+            else if (dParts.length === 1 && iParts.length > 1 &&
+                iParts.every((t) => (t.flags & unitFlags) === 0)) {
+                // T | undefined can receive boolean | undefined: boolean itself
+                // has two literal arms. There is still one declared data slot,
+                // so match it against the whole remaining union. Removing null
+                // too is safe only when no undeclared null arm remains.
+                unify(dParts[0], lowerer.checker.getNonNullableType(inst), depth + 1);
+            }
             return;
         }
         // Instantiations of the SAME generic ALIAS (Partial<T> vs
@@ -1426,16 +1533,21 @@ export function lowerGenericInstance(lowerer, info, inst) {
         fnCtx.generator = generatorMeta(lowerer, inst.returnType);
     }
     lowerer.fnStack.push(fnCtx);
+    lowerer.localClassInstantiations.push({ owner: decl, name: inst.name });
     try {
-        // STATIC generic methods: `this`/`super` name the RECEIVER class (a
-        // dynamic value) — the lowerStaticMethod fence, applied here because
-        // generic statics have no non-generic lowering pass. Arrow functions
-        // are transparent (they inherit the method's `this`); this-binding
-        // function forms are opaque.
+        // Static specializations bind lexical this only when the caller
+        // proved its exact receiver. Other instances retain the fence;
+        // super remains unsupported. Arrows inherit the lexical receiver.
         if (info.member?.kind === "static" && decl.body) {
-            rejectStaticThis(lowerer, decl.body, (keyword) => `'${keyword}' in static methods (it names the RECEIVER class — a dynamic value; reference the class by name instead)`);
+            rejectStaticThis(lowerer, decl.body, (keyword) => `'${keyword}' in static methods (it names the RECEIVER class — a dynamic value; reference the class by name instead)`, false, info.staticReceiver !== undefined);
         }
         const params = [];
+        const receiverInit = [];
+        if (info.staticReceiver) {
+            const value = lowerer.classValueRef(info.staticReceiver, decl);
+            const local = lowerer.declareThis(value.type);
+            receiverInit.push({ kind: "varDecl", localId: local.id, init: value, loc: locOf(decl) });
+        }
         if (cls && info.member.kind === "method") {
             // Instance methods take `this` as param 0, exactly like plain
             // `%C.method` functions (lowerClassMethodMemberInner).
@@ -1447,7 +1559,7 @@ export function lowerGenericInstance(lowerer, info, inst) {
         // threaded — a default mentioning T resolves like any body expression.
         const declared = lowerer.declareParams(decl.parameters, inst.params);
         params.push(...declared.params);
-        const body = [...declared.prologue];
+        const body = [...receiverInit, ...declared.prologue];
         const bodyBlock = blockBodyOf(decl);
         if (bodyBlock) {
             body.push(...lowerer.lowerStmts(bodyBlock.statements));
@@ -1490,6 +1602,8 @@ export function lowerGenericInstance(lowerer, info, inst) {
         }
         const fn = {
             name: inst.name,
+            sourceName: info.baseName,
+            ...(!isAsync && !decl.asteriskToken && (ts.isFunctionDeclaration(decl) || ts.isFunctionExpression(decl)) ? { ownsPrototype: true } : {}),
             params,
             returnType: bodyReturn,
             locals: lowerer.ctx.locals,
@@ -1509,6 +1623,7 @@ export function lowerGenericInstance(lowerer, info, inst) {
         lowerer.typeParamTsBindings = prevTsBindings;
         lowerer.implicitParamTypes = prevImplicit;
         lowerer.instantiationContext = prevContext;
+        lowerer.localClassInstantiations.pop();
         lowerer.suppressStats = prevSuppress;
     }
 }
@@ -1531,7 +1646,6 @@ function resolveInferredReturn(lowerer, inst, infer, body, decl) {
     // returning — JS answers undefined.
     const last = body[body.length - 1];
     const mayFallThrough = !last || !(last.kind === "return" || last.kind === "throw" || last.kind === "rethrow" || last.kind === "runtimeFence");
-    const valued = infer.entries.filter((e) => e.stmt.kind === "return" && e.stmt.value !== null && e.stmt.value !== undefined);
     const sawBare = mayFallThrough || infer.entries.some((e) => e.stmt.kind === "return" && (e.stmt.value === null || e.stmt.value === undefined));
     let final;
     if (inst.returnPinned) {
@@ -1539,16 +1653,19 @@ function resolveInferredReturn(lowerer, inst, infer, body, decl) {
     }
     else {
         const distinct = [];
-        for (const e of valued) {
-            if (!distinct.some((t) => typeEquals(t, e.stmt.value.type)))
-                distinct.push(e.stmt.value.type);
+        for (const e of infer.entries) {
+            if (e.stmt.kind !== "return" || e.stmt.value === null || e.stmt.value === undefined)
+                continue;
+            const type = e.stmt.value.type;
+            if (!distinct.some((t) => typeEquals(t, type)))
+                distinct.push(type);
         }
         if (distinct.length === 0) {
             final = DYN; // no valued return: JS completes with undefined — the dyn undefined, today's slot
         }
         else if (distinct.length === 1) {
             const t = distinct[0];
-            final = !sawBare ? t : t.kind === "dyn" ? DYN : (lowerer.withUndefinedArmOf(t) ?? DYN);
+            final = isUnitType(t) ? DYN : !sawBare ? t : t.kind === "dyn" ? DYN : (lowerer.withUndefinedArmOf(t) ?? DYN);
         }
         else {
             final = DYN; // disagreeing returns: the checked-dynamic join
@@ -1559,23 +1676,24 @@ function resolveInferredReturn(lowerer, inst, infer, body, decl) {
     for (const e of infer.entries) {
         if (e.stmt.kind !== "return")
             continue;
-        const st = e.stmt;
+        // Write through the recorded statement. A narrowed local can acquire a
+        // different record layout and copy it in the native compiler.
         const diagsBefore = lowerer.diags.length;
         try {
-            if (st.value === null || st.value === undefined) {
+            if (e.stmt.value === null || e.stmt.value === undefined) {
                 if (final.kind === "dyn")
-                    st.value = dynUndefinedExpr(st.loc);
+                    e.stmt.value = dynUndefinedExpr(e.stmt.loc);
                 else if (final.kind === "union") {
-                    const wrapped = lowerer.wrappedUndefined(final, st.loc);
+                    const wrapped = lowerer.wrappedUndefined(final, e.stmt.loc);
                     if (!wrapped) {
                         lowerer.unsupported("SC1090", e.node ?? decl, `bare 'return' in a function whose inferred return type is '${lowerer.fmt(final)}'`);
                     }
-                    st.value = wrapped;
+                    e.stmt.value = wrapped;
                 }
                 // void final: bare return stands as-is
             }
-            else if (!typeEquals(st.value.type, final)) {
-                st.value = lowerer.coerceInto(e.node ?? decl, st.value, final);
+            else if (!typeEquals(e.stmt.value.type, final)) {
+                e.stmt.value = lowerer.coerceInto(e.node ?? decl, e.stmt.value, final);
             }
         }
         catch (err) {
@@ -1590,7 +1708,7 @@ function resolveInferredReturn(lowerer, inst, infer, body, decl) {
                 lowerer.diags.push(...ice);
             lowerer.runtimeFences.push(...captured.filter((d) => d.code !== "SC9001"));
             const first = captured.find((d) => d.code !== "SC9001");
-            const mutable = st;
+            const mutable = e.stmt;
             delete mutable["value"];
             mutable["kind"] = "runtimeFence";
             mutable["code"] = first?.code ?? "SC1090";
@@ -1848,10 +1966,12 @@ function broadPromiseParam(lowerer, type) {
 }
 /** The implicit-type-parameter slots of a JS function-like: parallel to
    * decl.parameters, the param SYMBOL where the slot is a bindable
-   * implicit-any param (identifier-named, no annotation/JSDoc type, not
-   * rest/optional/defaulted, never written), null elsewhere. Null overall
-   * when nothing qualifies — the declaration keeps today's path. */
-export function implicitAnyParamSymbolsOf(lowerer, decl) {
+   * implicit param (identifier-named, broad inferred/JSDoc type, not
+   * rest/optional/defaulted, never written), null elsewhere. Package JS
+   * methods may also specialize class parameters: JSDoc names a nominal
+   * class even when the body accepts other objects with the same members.
+   * Null overall when nothing qualifies — the declaration keeps its ABI. */
+export function implicitAnyParamSymbolsOf(lowerer, decl, classParams = false) {
     if (!decl.body)
         return null;
     if (decl.asteriskToken)
@@ -1877,7 +1997,9 @@ export function implicitAnyParamSymbolsOf(lowerer, decl) {
         const broadFunction = lowerer.checker.typeToString(t) === "Function";
         const broadArray = lowerer.checkerAnyArrayType(t);
         const broadPromise = broadPromiseParam(lowerer, t);
-        if ((t.flags & ts.TypeFlags.Any) === 0 && !broadFunction && !broadArray && !broadPromise)
+        const declaredKind = classParams ? lowerer.mapTypeOf(t)?.kind : undefined;
+        const classParam = classParams && (declaredKind === "object" || declaredKind === "array");
+        if ((t.flags & ts.TypeFlags.Any) === 0 && !broadFunction && !broadArray && !broadPromise && !classParam)
             return null;
         const sym = lowerer.checker.getSymbolAtLocation(param.name);
         if (!sym)
@@ -1896,6 +2018,11 @@ export function implicitAnyParamSymbolsOf(lowerer, decl) {
    * selects return INFERENCE with DYN as the recursion pin. */
 function implicitDeclaredReturn(lowerer, info) {
     try {
+        // Static JS helpers can accept a structurally compatible class despite
+        // narrower JSDoc (for example a Vector2 target documented as Vector3).
+        // Infer their result from the specialized body as well.
+        if (info.member?.kind === "static" && info.decl.parameters.some((param, index) => info.implicitParams?.[index] && lowerer.mapTypeOf(lowerer.typeOf(param.name))?.kind === "object"))
+            return null;
         const broadCallbackSymbols = new Set(info.decl.parameters.flatMap((param, index) => {
             const symbol = info.implicitParams?.[index];
             return symbol !== null && symbol !== undefined &&
@@ -1915,7 +2042,10 @@ function implicitDeclaredReturn(lowerer, info) {
                     expression = expression.expression;
                 if (ts.isCallExpression(expression) &&
                     ts.isIdentifier(expression.expression) &&
-                    broadCallbackSymbols.has(lowerer.checker.getSymbolAtLocation(expression.expression) ?? {})) {
+                    (() => {
+                        const symbol = lowerer.checker.getSymbolAtLocation(expression.expression);
+                        return symbol !== undefined && broadCallbackSymbols.has(symbol);
+                    })()) {
                     returnsBroadCallback = true;
                     return "stop";
                 }
@@ -1930,7 +2060,12 @@ function implicitDeclaredReturn(lowerer, info) {
         const retTs = lowerer.checker.getReturnTypeOfSignature(declSig);
         if (retTs.flags & ts.TypeFlags.Any)
             return null;
+        if (retTs.flags & (ts.TypeFlags.Null | ts.TypeFlags.Undefined))
+            return DYN;
         if (lowerer.checker.isArrayType(retTs)) {
+            if (info.decl.parameters.some((param, index) => info.implicitParams?.[index] &&
+                lowerer.mapTypeOf(lowerer.typeOf(param.name))?.kind === "array"))
+                return null;
             const elem = lowerer.checker.getTypeArguments(retTs)[0];
             // An implicit-any parameter poisons an inferred array result to
             // any[] even when this instance's body produces one concrete
@@ -1941,6 +2076,11 @@ function implicitDeclaredReturn(lowerer, info) {
                 return null;
         }
         const mapped = lowerer.mapTypeOf(retTs);
+        // Inferred variadic results carry runtime argument packs. Their
+        // factory must retain the lowered callable rather than extracting a
+        // fixed native signature from a checked value.
+        if (mapped?.kind === "func" && mapped.rest === true && mapped.restAbi === undefined && !hasExplicitJsDocReturn(info.decl))
+            return null;
         if (mapped !== null && promiseCarriesDyn(lowerer, mapped) && !hasExplicitJsDocReturn(info.decl))
             return null;
         return mapped;
@@ -1972,6 +2112,30 @@ function bindableImplicitIr(t) {
         t.kind !== "void" && t.kind !== "dyn" && t.kind !== "jsval" &&
         t.kind !== "caught" && t.kind !== "undefinedT" && t.kind !== "nullT");
 }
+/** A represented binding or direct callable result can be wider than the
+ * checker's inferred shape. Preserve that boundary when specializing JS. */
+function storedImplicitArgumentType(lowerer, arg) {
+    while (ts.isParenthesizedExpression(arg))
+        arg = arg.expression;
+    if (ts.isAwaitExpression(arg)) {
+        const awaited = storedImplicitArgumentType(lowerer, arg.expression);
+        return awaited?.kind === "promise" ? awaited.inner : awaited;
+    }
+    if (ts.isObjectLiteralExpression(arg) && isJsSourceFile(arg.getSourceFile()) && arg.properties.some((property) => !ts.isSpreadAssignment(property) && property.name !== undefined && ts.isComputedPropertyName(property.name) &&
+        lowerer.foldedStringKeyOf(property.name.expression) === null))
+        return DYN;
+    if (ts.isIdentifier(arg))
+        return lowerer.peekLocal(arg)?.type ?? lowerer.globalOf(arg)?.type ?? null;
+    if (ts.isCallExpression(arg) && ts.isIdentifier(arg.expression)) {
+        const callee = storedImplicitArgumentType(lowerer, arg.expression);
+        if (callee?.kind === "dyn")
+            return DYN;
+        if (callee?.kind === "func")
+            return callee.ret;
+        return lowerer.fnSigOf(arg.expression)?.returnType ?? null;
+    }
+    return null;
+}
 /** The instance a CALL of an implicit-any function-like names: each
    * bindable implicit param takes the call's WIDENED argument checker type
    * when it maps statically (DYN otherwise — today's slot), typed params
@@ -1994,19 +2158,52 @@ export function implicitCallInstance(lowerer, call, info) {
             bound = declared.type;
         const arg = call.arguments[i];
         if (arg && !ts.isSpreadElement(arg)) {
-            const runtimeLocal = ts.isIdentifier(arg) ? lowerer.peekLocal(arg) : null;
-            if (runtimeLocal?.type.kind === "dyn") {
+            const stored = storedImplicitArgumentType(lowerer, arg);
+            if (stored?.kind === "dyn") {
                 bound = DYN;
                 argTypes.set(sym, lowerer.checker.getUnknownType());
                 shapes.push({ type: bound, mode: "required" });
                 return;
             }
+            // A represented native array must keep its storage when a direct
+            // inferred helper receives it. Re-boxing a checker-any array would
+            // copy it, losing writes (and attempting to read unfilled slots).
+            if (stored?.kind === "array") {
+                argTypes.set(sym, lowerer.typeOf(arg));
+                shapes.push({ type: stored, mode: "required" });
+                return;
+            }
             // The argument's own checker type, literal-widened ('add' binds
             // string) — typeOf consults the ACTIVE instance's bindings, so a
             // bound param forwarded into another implicit call transitively
             // instantiates it (this._initCommandGroup(command)).
             const t = lowerer.checker.getBaseTypeOfLiteralType(lowerer.typeOf(arg));
             const mapped = lowerer.mapTypeOf(t) ?? dynFallbackType(lowerer, arg, t);
+            // JavaScript arguments-based callables travel as checked functions.
+            // Specializing a parameter to the inferred rest signature would
+            // require extracting a native variadic ABI that the value does not
+            // expose. Its checked invocation preserves the complete argument pack.
+            if (mapped?.kind === "func" && mapped.rest === true && mapped.restAbi === undefined) {
+                argTypes.set(sym, lowerer.checker.getUnknownType());
+                shapes.push({ type: DYN, mode: "required" });
+                return;
+            }
+            // JS inference can absorb heterogeneous loop values into `{}`.
+            // That checker supertype is not an empty-record runtime layout:
+            // preserve represented arms through the checked boundary instead
+            // of specializing a call to a union that would discard them.
+            const mappedArms = mapped?.kind === "union" ? lowerer.unions.get(mapped.unionId)?.arms ?? [] : mapped ? [mapped] : [];
+            const hasTopObject = mappedArms.some((arm) => {
+                const shape = arm.kind === "record" ? lowerer.shapes.get(arm.shapeId) : undefined;
+                return shape && !shape.tuple && !shape.indexValue && shape.fields.length === 0;
+            });
+            if (stored?.kind === "union" && hasTopObject && lowerer.dynConvertible(stored) &&
+                lowerer.unions.get(stored.unionId)?.arms.some((arm) => !isUnitType(arm) &&
+                    !mappedArms.some((target) => lowerer.widthLiftPlan(arm, target) !== null))) {
+                argTypes.set(sym, lowerer.checker.getUnknownType());
+                shapes.push({ type: DYN, mode: "required" });
+                return;
+            }
             if (ts.isArrowFunction(arg) &&
                 arg.type === undefined &&
                 mapped?.kind === "func" &&
@@ -2031,15 +2228,32 @@ export function implicitCallInstance(lowerer, call, info) {
 /** The all-dyn DEFAULT instance — today's compiled body exactly: what a
    * VALUE reference of an implicit-any function names (indirect calls
    * carry no per-site types to bind). */
-function implicitDefaultInstance(lowerer, blame, info) {
+export function implicitDefaultInstance(lowerer, blame, info) {
     const shapes = info.decl.parameters.map((param, i) => info.implicitParams[i] ? { type: DYN, mode: "required" } : lowerer.paramShape(param));
-    return internImplicitInstance(lowerer, blame, info, shapes, new Map());
+    const argTypes = new Map();
+    // Newly bindable nominal class parameters must not retain their JSDoc
+    // receiver type in the checked fallback. Keep existing broad JS inference.
+    for (let i = 0; i < info.decl.parameters.length; i++) {
+        const symbol = info.implicitParams?.[i];
+        const kind = lowerer.mapTypeOf(lowerer.typeOf(info.decl.parameters[i].name))?.kind;
+        if (symbol && (kind === "object" || kind === "array")) {
+            argTypes.set(symbol, lowerer.checker.getUnknownType());
+        }
+    }
+    return internImplicitInstance(lowerer, blame, info, shapes, argTypes);
 }
 function internImplicitInstance(lowerer, blame, info, shapes, argTypes) {
     const key = shapes.map((s) => typeKey(s.type)).join(",");
     let inst = info.instances.get(key);
-    if (inst)
+    if (inst?.implicitState === "failed")
+        lowerer.unsupported("SC1090", blame, `the failed specialization of '${info.baseName}'`);
+    if (inst) {
+        // A recursive caller has observed this ABI before inference settles.
+        // Keep the promised return slot and coerce the completed body's returns.
+        if (inst.implicitState === "lowering")
+            inst.returnPinned = true;
         return inst;
+    }
     if (info.instances.size >= MAX_GENERIC_INSTANCES) {
         lowerer.unsupported("SC1090", blame, `unbounded implicit-any instantiation ('${info.baseName}' exceeded ` +
             `${MAX_GENERIC_INSTANCES} instances — polymorphic recursion?)`);
@@ -2065,11 +2279,15 @@ function internImplicitInstance(lowerer, blame, info, shapes, argTypes) {
         ...(declared === null ? { implicitInferReturn: true } : {}),
     };
     info.instances.set(key, inst);
-    // EAGER lowering (nested, the lambda discipline): the call site needs
-    // the settled return type NOW. A body-level poison (a fenced parameter
-    // form) skips the function like lowerFunction's rule — calls then meet
-    // the pinned signature over a missing body, which the linker never
-    // sees because the poison also fenced the call statement.
+    // Eager lowering settles the return ABI before callers use it. A failed
+    // JS body must still have a throwing implementation: later references
+    // (including recursive ones) can already hold its cached signature.
+    const diagsBefore = lowerer.diags.length;
+    // The instance is cached even when a receiver probe requested it.
+    // Its body must retain statement fences instead of dropping failures
+    // into that probe's temporary diagnostic sink and caching empty code.
+    const previousSink = lowerer.diagSink;
+    lowerer.diagSink = null;
     try {
         // Implicit-any instances lower EAGERLY at the call site so their
         // inferred return type is available immediately. They therefore do
@@ -2087,8 +2305,20 @@ function internImplicitInstance(lowerer, blame, info, shapes, argTypes) {
     catch (e) {
         if (!(e instanceof PoisonError))
             throw e;
-        inst.implicitState = "done";
-        throw e;
+        inst.implicitState = "failed";
+        const types = shapes.map((shape) => shape.type);
+        if (info.member?.kind === "method")
+            types.unshift({ kind: "object", className: info.member.cls.def.name });
+        const fn = lowerer.deferToRuntimeFence(diagsBefore, info.decl, {
+            kind: "function", name: inst.name, returnType: inst.returnType,
+            params: types.map((type, index) => ({ localId: `p.${index}`, name: `p${index}`, type })),
+        });
+        if (!fn)
+            throw e;
+        lowerer.implicitFns.push(fn);
+    }
+    finally {
+        lowerer.diagSink = previousSink;
     }
     inst.implicitState = "done";
     return inst;
@@ -2194,11 +2424,11 @@ export function implicitLocalFnInfoOf(lowerer, decl, fnNode) {
     const implicit = implicitAnyParamSymbolsOf(lowerer, fnNode);
     if (!implicit)
         lowerer.unsupported("SC1090", fnNode, "this function form"); // defensive: the probe proved it
-    const stmt = decl.parent.parent;
+    const stmt = decl.parent?.parent;
     const info = {
         decl: fnNode,
         baseName: name,
-        qualifiedName: lowerer.qualify(decl.getSourceFile(), nsPathPrefix(stmt, decl) + `${name}%l${decl.getStart()}`),
+        qualifiedName: lowerer.qualify(decl.getSourceFile(), nsPathPrefix(stmt ?? decl, decl) + `${name}%l${decl.getStart()}`),
         typeParams: [],
         instances: new Map(),
         implicitParams: implicit,
@@ -2409,6 +2639,7 @@ function makeTimerArgsThunk(lowerer, cbNode, argNodes, what, loc) {
                         kind: "dynCall",
                         callee: { kind: "varRef", localId: "f.0", type: DYN, loc },
                         calleeName: "callback",
+                        receiver: { kind: "libCall", fn: "dyn.this", args: [], type: DYN, loc },
                         args: args.map((_, i) => ({ kind: "varRef", localId: `a${i}.0`, type: DYN, loc })),
                         type: DYN,
                         loc,
@@ -2573,7 +2804,12 @@ export function lowerTimersMemberCall(lowerer, expr, member, loc) {
     return null;
 }
 function ffiSourceParams(binding) {
-    return binding.params.filter((param) => !isFfiContextParam(param));
+    const params = [];
+    for (const param of binding.params) {
+        if (!isFfiContextParam(param))
+            params.push(param);
+    }
+    return params;
 }
 function ffiParamDisplay(param) {
     return isFfiCallbackParam(param)
@@ -2590,7 +2826,11 @@ function ffiCallbackInputDiagnostic(lowerer, descriptor, callbackType) {
     const signatures = lowerer.checker.getCallSignatures(callbackType);
     if (signatures.length !== 1)
         return null;
-    const nativeParams = descriptor.callback.params.filter((param) => !isFfiContextParam(param));
+    const nativeParams = [];
+    for (const param of descriptor.callback.params) {
+        if (!isFfiContextParam(param))
+            nativeParams.push(param);
+    }
     let nativeIndex = 0;
     const params = signatures[0].getParameters();
     for (let i = 0; i < params.length; i++) {
@@ -2608,12 +2848,13 @@ function ffiCallbackInputDiagnostic(lowerer, descriptor, callbackType) {
         }
         if (nativeClass === "bytes")
             continue;
-        const domain = nativeClass === "bool"
+        const wide = nativeClass === "i64" || nativeClass === "u64" || nativeClass === "pointer";
+        const domain = wide ? "bigint" : nativeClass === "bool"
             ? "boolean"
             : nativeClass === "cstring" || nativeClass === "string"
                 ? "string"
                 : "number";
-        const coversDomain = nativeClass === "bool"
+        const coversDomain = wide ? (paramType.flags & ts.TypeFlags.BigInt) !== 0 : nativeClass === "bool"
             ? (paramType.flags & ts.TypeFlags.Boolean) !== 0
             : nativeClass === "cstring" || nativeClass === "string"
                 ? (paramType.flags & ts.TypeFlags.String) !== 0
@@ -2636,8 +2877,9 @@ function ffiCallbackInputDiagnostic(lowerer, descriptor, callbackType) {
 function ffiReturnDomainDiagnostic(lowerer, nativeClass, returnType) {
     if (nativeClass === "void")
         return null;
-    const domain = nativeClass === "bool" ? "boolean" : "number";
-    const coversDomain = nativeClass === "bool"
+    const wide = nativeClass === "i64" || nativeClass === "u64" || nativeClass === "pointer";
+    const domain = wide ? "bigint" : nativeClass === "bool" ? "boolean" : "number";
+    const coversDomain = wide ? (returnType.flags & ts.TypeFlags.BigInt) !== 0 : nativeClass === "bool"
         ? (returnType.flags & ts.TypeFlags.Boolean) !== 0
         : (returnType.flags & ts.TypeFlags.Number) !== 0;
     return coversDomain
@@ -2745,7 +2987,7 @@ function libraryCallbackOwnsFile(lowerer, file) {
 export function validateFfiImports(lowerer) {
     const diagnostics = [];
     const symbolsByName = new Map();
-    const configuredNames = new Set(lowerer.ffiImports.map((binding) => binding.name));
+    const configuredNames = new Set(lowerer.ffiImports.filter(binding => binding.library === undefined).map((binding) => binding.name));
     const candidates = new Map();
     if (configuredNames.size === 0)
         return { diagnostics, symbolsByName };
@@ -2775,6 +3017,8 @@ export function validateFfiImports(lowerer) {
         });
     }
     for (const binding of lowerer.ffiImports) {
+        if (binding.library !== undefined)
+            continue;
         const bySymbol = candidates.get(binding.name);
         if (bySymbol === undefined || bySymbol.size === 0) {
             // A native-manifest binding with no declaration is a broken build
@@ -2822,6 +3066,8 @@ export function lowerFfiCall(lowerer, expr) {
     if (!ts.isIdentifier(expr.expression))
         return null;
     const binding = lowerer.ffiImportsByName.get(expr.expression.text);
+    if (binding?.library !== undefined)
+        return null;
     if (binding === undefined) {
         // LIBRARY mode with a declared callback surface: a CALL of a
         // program-authored signature-only ambient function that names no
@@ -2855,7 +3101,8 @@ export function lowerFfiCall(lowerer, expr) {
         lowerer.pushDiag(signatureFlavor(binding.name, detail, loc));
         throw new PoisonError();
     };
-    const symbol = lowerer.resolveValueSymbol(expr.expression) ??
+    const symbol = lowerer.resolveValueSymbol(expr.expression);
+    if (!symbol)
         bindingError("the call has no resolved TypeScript symbol");
     if (lowerer.ffiBindingSymbols !== null) {
         const validSymbols = lowerer.ffiBindingSymbols.get(binding.name);
@@ -2938,7 +3185,7 @@ export function lowerFfiCall(lowerer, expr) {
             }
             // An inline function value at a RELEASE site can never match:
             // lifted lambdas always carry a captures list (even an empty one),
-            // so both backends mint a fresh closure per evaluation of the
+            // so the backend creates a fresh closure per evaluation of the
             // expression — the release argument is a pointer no registration
             // holds, a guaranteed runtime trap. Declared functions stay valid
             // here — their value is the interned immortal closure (captures
@@ -3145,6 +3392,18 @@ export function lowerCall(lowerer, expr) {
     }
     const consoleMember = lowerer.consoleCallMember(expr);
     if (consoleMember !== null) {
+        // A namespace returned by user code must evaluate before the log
+        // arguments. Only the global and literal builtin require plumbing
+        // have no receiver evaluation to preserve.
+        const access = ts.isPropertyAccessExpression(expr.expression) ? expr.expression : null;
+        const created = access && ts.isCallExpression(access.expression) ? createRequireSpecOf(lowerer, access.expression) : null;
+        const receiver = access && !lowerer.isStdlibGlobal(access.expression, "console") &&
+            requireSpecOf(access.expression) === null &&
+            created?.spec !== "node:console" && created?.spec !== "console"
+            ? lowerer.lowerExpr(access.expression) : null;
+        const withReceiver = (result) => receiver === null ? result : {
+            kind: "seqExpr", stmts: [{ kind: "exprStmt", expr: receiver, loc }], result, type: result.type, loc,
+        };
         // console.log/info/debug write stdout; console.error and console.warn
         // are one stream in Node (warn IS error, info and debug ARE log) and
         // write stderr with the exact same formatting. Node's formatter is
@@ -3166,13 +3425,13 @@ export function lowerCall(lowerer, expr) {
             (ts.isStringLiteral(expr.arguments[0]) || ts.isNoSubstitutionTemplateLiteral(expr.arguments[0])) &&
             /%[sdifjoOc%]/.test(expr.arguments[0].text)) {
             const formatted = lowerFormatCall(lowerer, expr, loc, false);
-            return {
+            return withReceiver({
                 kind: "intrinsic",
                 name: stdoutMember ? "console.log" : "console.error",
                 args: [formatted],
                 type: VOID,
                 loc,
-            };
+            });
         }
         const args = expr.arguments.map((a) => {
             const lowered = lowerer.lowerExpr(a);
@@ -3233,13 +3492,13 @@ export function lowerCall(lowerer, expr) {
             // render fence honestly with the reason.
             return lowerConsoleInspectArg(lowerer, a, lowered, surface, loc);
         });
-        return {
+        return withReceiver({
             kind: "intrinsic",
             name: stdoutMember ? "console.log" : "console.error",
             args,
             type: VOID,
             loc,
-        };
+        });
     }
     // The timer globals — setTimeout/clearTimeout, setInterval/
     // clearInterval, setImmediate/clearImmediate. Provenance-checked (a
@@ -3390,25 +3649,12 @@ export function lowerCall(lowerer, expr) {
             lowerer.noLowering(`BigInt with ${expr.arguments.length} arguments`, expr);
         }
         const argNode = expr.arguments[0];
-        const arg = lowerer.lowerExpr(argNode);
-        if (arg.type.kind === "bigint")
-            return arg;
-        if (arg.type.kind === "string") {
-            return { kind: "libCall", fn: "bigint.parse", args: [arg], type: BIGINT_T, loc };
-        }
-        if (arg.type.kind === "f64") {
-            return { kind: "libCall", fn: "bigint.fromF64", args: [arg], type: BIGINT_T, loc };
-        }
-        if (arg.type.kind === "bool") {
-            return {
-                kind: "ternary",
-                cond: arg,
-                then: { kind: "libCall", fn: "bigint.parse", args: [{ kind: "strLit", value: "1", type: STRING, loc }], type: BIGINT_T, loc },
-                else_: { kind: "libCall", fn: "bigint.parse", args: [{ kind: "strLit", value: "0", type: STRING, loc }], type: BIGINT_T, loc },
-                type: BIGINT_T,
-                loc,
-            };
-        }
+        // Captured optional storage can change after TypeScript's guard.
+        // BigInt consumes the stored value, including its nullish tag.
+        const arg = optionalCallValue(lowerer, argNode) ?? lowerer.lowerExpr(argNode);
+        const converted = lowerBigIntConstructorValue(lowerer, arg, loc);
+        if (converted)
+            return converted;
         lowerer.noLowering(`BigInt of ${lowerer.fmt(arg.type)} values`, argNode, "string, number, boolean, and bigint arguments are supported");
     }
     if (ts.isIdentifier(expr.expression) &&
@@ -3446,6 +3692,9 @@ export function lowerCall(lowerer, expr) {
         if (name === "Number")
             return lowerNumberConstructorValue(lowerer, argNode, loc);
         const arg = lowerer.lowerExpr(argNode);
+        if (name === "String" && arg.type.kind === "dyn") {
+            return { kind: "libCall", fn: "dyn.stringConstructor", args: [arg], type: STRING, loc };
+        }
         if (name === "String")
             return lowerer.ensureString(arg, argNode);
     }
@@ -3463,6 +3712,29 @@ export function lowerCall(lowerer, expr) {
         const code = lowerer.lowerExprExpecting(expr.arguments[0], STRING);
         return { kind: "libCall", fn: "island.eval", args: [code], type: STRING, loc };
     }
+    // Computed calls preserve their evaluated receiver just like dotted
+    // calls, including when the property is keyed by a native symbol.
+    if (ts.isElementAccessExpression(expr.expression) && !lowerer.chainBlocked(expr, expr.expression)) {
+        const access = expr.expression;
+        lowerer.fenceStaticResponseMember(access, "call");
+        lowerer.fenceStaticHeadersMember(access, "call");
+        lowerer.fenceStaticReadableStreamMember(access, "call");
+        const source = tryLowerExpression(lowerer, access.expression);
+        if (source && (source.type.kind === "dyn" || isDynTypedRefType(source.type) &&
+            lowerer.foldedStringKeyOf(access.argumentExpression) === null &&
+            lowerer.mapTypeOf(lowerer.typeOf(access.argumentExpression))?.kind !== "symbol")) {
+            const local = lowerer.declareHiddenLocal("%computedReceiver", DYN);
+            const receiver = varRef(local.id, DYN, loc);
+            const key = lowerer.lowerExprExpecting(access.argumentExpression, DYN);
+            const callee = { kind: "dynKeyGet", value: receiver, key, type: DYN, loc };
+            const args = expr.arguments.map((arg) => lowerer.lowerExprExpecting(ts.isSpreadElement(arg) ? arg.expression : arg, DYN));
+            const spreads = expr.arguments.flatMap((arg, index) => ts.isSpreadElement(arg) ? [{ arg: index, what: arg.expression.getText() }] : []);
+            return { kind: "seqExpr", stmts: [{ kind: "varDecl", localId: local.id, init: lowerer.coerceToExpected(source, DYN), loc }], result: {
+                    kind: "dynCall", callee, receiver, calleeName: access.getText(), args,
+                    ...(spreads.length > 0 ? { spreads } : {}), type: DYN, loc,
+                }, type: DYN, loc };
+        }
+    }
     // Island calls. A property-access callee whose receiver is an 'any'
     // value is an engine method call (this = receiver, JS-exact); any other
     // 'any'-typed callee is an engine function call. Arguments marshal in;
@@ -4061,6 +4333,9 @@ export function lowerCall(lowerer, expr) {
             let callee = lowerer.lowerExpr(nsMember);
             if (callee.type.kind === "record")
                 callee = lowerer.hybridCallUnwrap(callee);
+            const checked = lowerCheckedCallableValue(lowerer, expr, callee, loc);
+            if (checked)
+                return checked;
             if (callee.type.kind !== "func")
                 lowerer.badType(expr.expression, lowerer.typeOf(expr.expression));
             const args = completeFuncValueArgs(lowerer, expr, callee.type, loc);
@@ -4114,6 +4389,9 @@ export function lowerCall(lowerer, expr) {
         let callee = lowerer.lowerExpr(nameId);
         if (callee.type.kind === "record")
             callee = lowerer.hybridCallUnwrap(callee);
+        const checked = lowerCheckedCallableValue(lowerer, expr, callee, loc);
+        if (checked)
+            return checked;
         if (callee.type.kind !== "func")
             lowerer.badType(expr.expression, lowerer.typeOf(expr.expression));
         const args = completeFuncValueArgs(lowerer, expr, callee.type, loc);
@@ -4193,6 +4471,7 @@ export function lowerCall(lowerer, expr) {
             // TestContext surface (t.test/t.skip/t.diagnostic), t.assert.*.
             lowerer.lowerTestMethodCall(expr, expr.expression) ??
             lowerer.lowerTimeoutMethodCall(expr, expr.expression) ??
+            lowerArrayPrototypeBorrowCall(lowerer, expr, expr.expression) ??
             lowerObjectOwnPrototypeCall(lowerer, expr, expr.expression) ??
             lowerObjectPrototypeCall(lowerer, expr, expr.expression) ??
             lowerStringPrototypeCall(lowerer, expr, expr.expression) ??
@@ -4200,6 +4479,7 @@ export function lowerCall(lowerer, expr) {
             // Typed-array/Buffer receivers and the Buffer statics — before the
             // island path (bytes never cross the boundary).
             lowerer.lowerBytesMethodCall(expr, expr.expression) ??
+            lowerBytesStaticCall(lowerer, expr, expr.expression) ??
             lowerBufferStaticCallWithNarrowedArg(lowerer, expr, expr.expression) ??
             // URL.revokeObjectURL's zero-argument contract (the one-argument
             // form keeps the fence — createObjectURL does too).
@@ -4267,8 +4547,8 @@ export function lowerCall(lowerer, expr) {
             lowerArrayFromCall(lowerer, expr, expr.expression) ??
             lowerArrayOfCall(lowerer, expr, expr.expression) ??
             lowerer.lowerArrayMethodCall(expr, expr.expression) ??
-            // Read-only array methods (slice/map) on TUPLE receivers — the
-            // positions snapshot into a fresh array (the for-of stance).
+            // Tuple reads preserve the receiver through argument evaluation;
+            // callbacks read each position when visited.
             lowerTupleReadMethodCall(lowerer, expr, expr.expression) ??
             lowerGenMethodCall(lowerer, expr, expr.expression) ??
             lowerer.lowerMapMethodCall(expr, expr.expression) ??
@@ -4283,6 +4563,18 @@ export function lowerCall(lowerer, expr) {
             lowerObjLitGenericMethodCall(lowerer, expr, expr.expression);
         if (intrinsic)
             return intrinsic;
+        const accessorTarget = lowerer.fieldTarget(expr.expression);
+        if (accessorTarget?.container === "accessor") {
+            const callee = lowerer.fieldGetExpr(accessorTarget, locOf(expr.expression), expr.expression);
+            if (callee.type.kind === "func") {
+                const args = completeFuncValueArgs(lowerer, expr, callee.type, locOf(expr));
+                return { kind: "callValue", callee, args, type: callee.type.ret, loc: locOf(expr) };
+            }
+            if (callee.type.kind === "dyn" && !expr.arguments.some((arg) => ts.isSpreadElement(arg))) {
+                const args = expr.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN));
+                return { kind: "dynCall", callee, calleeName: expr.expression.getText(), args, type: DYN, loc: locOf(expr) };
+            }
+        }
         // A method call rooted at an initializer-less ambient `declare
         // const/var` whose declared type has no mapping: Node throws the
         // catchable ReferenceError at the ROOT read before the member, the
@@ -4332,6 +4624,9 @@ export function lowerCall(lowerer, expr) {
     // The element spelling of an unsupported native Web method must fence
     // before lowering the callee into a checked-dynamic keyed read.
     if (ts.isElementAccessExpression(expr.expression)) {
+        const symbolMethod = lowerClassSymbolMethodCall(lowerer, expr);
+        if (symbolMethod)
+            return symbolMethod;
         const headersIterator = lowerer.lowerDynamicHeadersIteratorCall(expr, expr.expression);
         if (headersIterator)
             return headersIterator;
@@ -4347,8 +4642,41 @@ export function lowerCall(lowerer, expr) {
     if (ts.isElementAccessExpression(expr.expression) &&
         !expr.expression.questionDotToken &&
         !expr.questionDotToken &&
-        ts.isStringLiteralLike(expr.expression.argumentExpression)) {
-        const memberName = expr.expression.argumentExpression.text;
+        (ts.isStringLiteralLike(expr.expression.argumentExpression) || ts.isNumericLiteral(expr.expression.argumentExpression))) {
+        const memberName = ts.isNumericLiteral(expr.expression.argumentExpression)
+            ? String(Number(expr.expression.argumentExpression.text))
+            : expr.expression.argumentExpression.text;
+        const receiverType = lowerer.mapTypeOf(lowerer.typeOf(expr.expression.expression));
+        if (receiverType?.kind === "object") {
+            const info = lowerer.classes.get(receiverType.className);
+            const found = info ? lowerer.findMethodOn(info, memberName) : null;
+            if (info && found) {
+                if (found.declarer.builtinError)
+                    return errorToStringCall(lowerer, lowerer.lowerExpr(expr.expression.expression));
+                const virtual = lowerer.overrideBelow(info, memberName);
+                if (found.sig.abstract === true && !virtual) {
+                    lowerer.unsupported("SC1090", expr, `calls of the abstract method '${memberName}' with no concrete implementation below the receiver's static class`);
+                }
+                if (virtual)
+                    lowerer.noteVirtualEdge(info, memberName);
+                else
+                    lowerer.noteEdge(`%${found.declarer.def.name}.${memberName}`);
+                const receiver = lowerer.lowerExpr(expr.expression.expression);
+                const args = lowerer.completeArgs(expr.arguments, found.sig.params, locOf(expr), expr);
+                const callArgs = [lowerer.upcastTo(receiver, virtual ? info.def.name : found.declarer.def.name), ...args];
+                const loc = locOf(expr);
+                if (virtual) {
+                    return reconcileOverloadReturn(lowerer, expr, {
+                        kind: "virtualCall", className: info.def.name, method: memberName,
+                        args: callArgs, type: found.sig.ret, loc,
+                    });
+                }
+                return reconcileOverloadReturn(lowerer, expr, {
+                    kind: "call", callee: `%${found.declarer.def.name}.${memberName}`,
+                    args: callArgs, type: found.sig.ret, loc,
+                });
+            }
+        }
         // ts7's getSymbolAtLocation does not resolve element accesses; the
         // member symbol comes from the receiver's (apparent) type instead —
         // same provenance answer as the dot spelling's name symbol.
@@ -4446,7 +4774,7 @@ export function lowerCall(lowerer, expr) {
     // JS arity exactly (the thunk ignores extras). Result dyn, checked
     // per use like every any-origin value.
     if ((expr.arguments.length > callee.type.params.length || callee.type.rest === true) &&
-        isJsSourceFile(expr.getSourceFile()) &&
+        (isJsSourceFile(expr.getSourceFile()) || callee.type.rest === true && callee.type.restAbi === undefined) &&
         !expr.arguments.some((a) => ts.isSpreadElement(a)) &&
         canBoxFuncIntoDyn(callee.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
         const args = expr.arguments.map((a) => lowerer.lowerExprExpecting(a, DYN));
@@ -4457,6 +4785,29 @@ export function lowerCall(lowerer, expr) {
     const args = completeFuncValueArgs(lowerer, expr, callee.type, loc);
     return { kind: "callValue", callee, args, type: callee.type.ret, loc };
 }
+/** Exported checked and variadic callables use the same runtime-arity ABI
+ * whether the caller spells a bare import or a namespace member. */
+function lowerCheckedCallableValue(lowerer, call, value, loc) {
+    let callee = value;
+    if (callee.type.kind !== "dyn") {
+        if (callee.type.kind !== "func" ||
+            !(callee.type.rest === true && callee.type.restAbi === undefined ||
+                isJsSourceFile(call.getSourceFile()) && call.arguments.length > callee.type.params.length) ||
+            !lowerer.dynConvertible(callee.type))
+            return null;
+        callee = { kind: "dynFrom", value: callee, type: DYN, loc };
+    }
+    if (call.arguments.some(ts.isSpreadElement)) {
+        const spread = lowerSpreadArgsCall(lowerer, call, callee, loc);
+        if (spread)
+            return spread;
+        lowerer.unsupported("SC1090", call, "spread arguments in calls through 'unknown' values");
+    }
+    return {
+        kind: "dynCall", callee, calleeName: call.expression.getText(),
+        args: call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc,
+    };
+}
 function lowerRegexMethodCallWithOptionalArg(lowerer, call, access) {
     const lowered = lowerer.lowerRegexMethodCall(call, access);
     if (lowered?.kind !== "regexIntrinsic" || lowered.method !== "test" || call.arguments.length !== 1)
@@ -4478,9 +4829,13 @@ function optionalCallValue(lowerer, node) {
     return lowerer.runtimeOptionalIdentifierValue(node)?.value ?? lowerAbsenceProbe(lowerer, node);
 }
 function lowerBufferStaticCallWithNarrowedArg(lowerer, call, access) {
-    const lowered = lowerer.lowerBufferStaticCall(call, access);
+    const result = lowerer.lowerBufferStaticCall(call, access);
+    // The Buffer brand wraps the constructor result. Normalize its source
+    // before restoring that wrapper so narrowed unions never reach bytesNew.
+    const branded = result?.kind === "libCall" && result.fn === "buffer.brand" ? result : null;
+    const lowered = branded ? branded.args[0] : result;
     if (lowered?.kind !== "bytesNew" || !lowered.source || lowered.source.type.kind !== "union")
-        return lowered;
+        return result;
     // A callback can store a wider union than the checker sees at this use
     // (including an added undefined arm). Extract the exact arm proven by
     // control-flow narrowing, not merely the union with undefined removed.
@@ -4496,10 +4851,11 @@ function lowerBufferStaticCallWithNarrowedArg(lowerer, call, access) {
     if (!helper) {
         lowerer.unsupported("SC1090", call.arguments[0], "a Buffer constructor argument whose narrowed type is not a stored source arm");
     }
-    return {
+    const narrowedValue = {
         ...lowered,
         source: { kind: "call", callee: helper, args: [lowered.source], type: narrowed, loc: lowered.source.loc },
     };
+    return branded ? { ...branded, args: [narrowedValue] } : narrowedValue;
 }
 function lowerOptionalNumberDefault(lowerer, value, dflt, loc) {
     const widened = lowerer.runtimeOptionalWidening(value.type, F64);
@@ -4554,6 +4910,8 @@ function lowerStringMethodCallWithOptionalArgs(lowerer, call, access, receiver,
                 ? [1]
                 : [];
     for (const index of zeroDefaultArgs) {
+        if (index === undefined)
+            continue;
         const value = args[index];
         if (!value)
             continue;
@@ -4599,6 +4957,8 @@ function lowerNumberConstructorValue(lowerer, argNode, loc) {
     }
     if (arg.type.kind === "string")
         return { kind: "libCall", fn: "num.fromString", args: [arg], type: F64, loc };
+    if (arg.type.kind === "dyn")
+        return { kind: "libCall", fn: "dyn.numberConstructor", args: [arg], type: F64, loc };
     const optionalNumber = lowerOptionalStringNumber(lowerer, arg, loc);
     if (optionalNumber)
         return optionalNumber;
@@ -4609,6 +4969,61 @@ function lowerNumberConstructorValue(lowerer, argNode, loc) {
         ? "unions of numbers, booleans, strings, null, and undefined lower — narrow other arms first"
         : undefined);
 }
+/** A runtime-optional local retains its full tagged storage even after a
+ * checker guard. Dispatch BigInt by the actual value, including nullish
+ * TypeErrors, rather than interpreting that storage as the narrowed arm. */
+function lowerBigIntConstructorValue(lowerer, arg, loc) {
+    if (arg.type.kind === "bigint")
+        return arg;
+    if (arg.type.kind === "string")
+        return { kind: "libCall", fn: "bigint.parse", args: [arg], type: BIGINT_T, loc };
+    if (arg.type.kind === "f64")
+        return { kind: "libCall", fn: "bigint.fromF64", args: [arg], type: BIGINT_T, loc };
+    if (arg.type.kind === "bool") {
+        return {
+            kind: "ternary", cond: arg,
+            then: { kind: "libCall", fn: "bigint.parse", args: [{ kind: "strLit", value: "1", type: STRING, loc }], type: BIGINT_T, loc },
+            else_: { kind: "libCall", fn: "bigint.parse", args: [{ kind: "strLit", value: "0", type: STRING, loc }], type: BIGINT_T, loc },
+            type: BIGINT_T, loc,
+        };
+    }
+    if (isUnitType(arg.type)) {
+        const name = arg.type.kind === "nullT" ? "null" : "undefined";
+        return defaultAfterUndefined(arg, nodeThrowExpr(1, "", `Cannot convert ${name} to a BigInt`, BIGINT_T, loc));
+    }
+    if (arg.type.kind !== "union")
+        return null;
+    const unionId = arg.type.unionId;
+    const arms = lowerer.unions.get(unionId)?.arms;
+    if (!arms || !arms.every((arm) => arm.kind === "bigint" || arm.kind === "string" || arm.kind === "f64" || arm.kind === "bool" || isUnitType(arm)))
+        return null;
+    const key = `bigint.scalar:${unionId}`;
+    let helper = lowerer.widthHelpers.get(key);
+    if (!helper) {
+        helper = `%bigint.scalar.${lowerer.widthHelpers.size}`;
+        lowerer.widthHelpers.set(key, helper);
+        const value = varRef("value.0", arg.type, loc);
+        const body = [];
+        arms.forEach((arm, tag) => {
+            const narrowed = isUnitType(arm)
+                ? { kind: "unitLit", unit: arm.kind === "nullT" ? "null" : "undefined", type: arm, loc }
+                : { kind: "unionNarrow", unionId, tag, value, type: arm, loc };
+            const converted = lowerBigIntConstructorValue(lowerer, narrowed, loc);
+            if (!converted)
+                throw new InternalCompilerError("BigInt scalar union has an unsupported arm");
+            const ret = { kind: "return", value: converted, loc };
+            body.push(tag === arms.length - 1 ? ret : {
+                kind: "if", cond: { kind: "unionIsTag", unionId, tag, negated: false, value, type: BOOL, loc },
+                then: [ret], else_: null, loc,
+            });
+        });
+        lowerer.liftedFns.push({
+            name: helper, params: [{ localId: "value.0", name: "value", type: arg.type }],
+            returnType: BIGINT_T, locals: [{ id: "value.0", name: "value", type: arg.type, mutable: false }], body, loc,
+        });
+    }
+    return { kind: "call", callee: helper, args: [arg], type: BIGINT_T, loc };
+}
 function immediatePrimitiveWrapperToString(lowerer, node) {
     const stringValue = stringWrapperToString(lowerer, node);
     if (stringValue)
@@ -4631,24 +5046,6 @@ function immediatePrimitiveWrapperToString(lowerer, node) {
         : args.length ? lowerNumberConstructorValue(lowerer, args[0], loc) : { kind: "numLit", value: 0, type: F64, loc };
     return lowerer.ensureString(primitive, wrapped);
 }
-function plainObjectCoercionReceiver(lowerer, node) {
-    const plainLiteral = (literal) => literal.properties.every((prop) => ts.isPropertyAssignment(prop) &&
-        (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name) || ts.isNumericLiteral(prop.name)) &&
-        prop.name.text !== "__proto__");
-    let value = node;
-    while (ts.isParenthesizedExpression(value))
-        value = value.expression;
-    if (ts.isObjectLiteralExpression(value))
-        return plainLiteral(value);
-    if (!ts.isIdentifier(value))
-        return false;
-    const symbol = lowerer.resolveValueSymbol(value);
-    const decl = symbol ? lowerer.checker.valueDeclarationOf(symbol) : undefined;
-    if (!symbol || !decl || !ts.isVariableDeclaration(decl) || !decl.initializer ||
-        !ts.isObjectLiteralExpression(decl.initializer) || !plainLiteral(decl.initializer))
-        return false;
-    return bindingNeverReassigned(lowerer, symbol, decl);
-}
 function objectToStringTag(lowerer, type) {
     switch (type.kind) {
         case "undefinedT":
@@ -4669,7 +5066,7 @@ function objectToStringTag(lowerer, type) {
         case "set": return "Set";
         case "promise": return "Promise";
         case "bytes":
-            return ({ u8: "Uint8Array", u32: "Uint32Array", i32: "Int32Array", f32: "Float32Array", f64: "Float64Array" })[type.elem];
+            return BYTES_ELEMENT_NAME[type.elem];
         case "object":
             return type.className === "%Error" || lowerer.isSubclassOf(type.className, "%Error") ? "Error" : null;
         default: return null;
@@ -4691,6 +5088,10 @@ function immediateObjectTagReceiver(lowerer, node) {
         lowerer.isStdlibSymbol(lowerer.resolveValueSymbol(value.expression) ?? undefined)) {
         const name = value.expression.text;
         const args = value.arguments ?? [];
+        // JavaScript dates use checked native handles, so their IR type alone
+        // cannot recover the tag through an immediate Object(...) wrapper.
+        if (name === "Date")
+            return { tag: "Date", effect: lowerer.lowerExpr(value) };
         if (args.length <= 1 && !args.some(ts.isSpreadElement)) {
             if (name === "String") {
                 const effect = stringWrapperToString(lowerer, value);
@@ -4738,6 +5139,36 @@ function immediateObjectTagReceiver(lowerer, node) {
     }
     return null;
 }
+const ARRAY_BORROW_METHODS = new Set([
+    "at", "every", "filter", "find", "findIndex", "findLast", "findLastIndex", "forEach", "includes",
+    "indexOf", "lastIndexOf", "map", "reduce", "reduceRight", "slice", "some",
+]);
+function lowerArrayPrototypeBorrowCall(lowerer, call, access) {
+    if (lowerer.dynamic || !isJsSourceFile(call.getSourceFile()) || call.questionDotToken ||
+        access.questionDotToken || access.name.text !== "call" ||
+        !ts.isPropertyAccessExpression(access.expression) ||
+        call.arguments.some(ts.isSpreadElement))
+        return null;
+    const method = access.expression;
+    if (method.questionDotToken || !ARRAY_BORROW_METHODS.has(method.name.text) ||
+        !ts.isPropertyAccessExpression(method.expression) ||
+        method.expression.questionDotToken || method.expression.name.text !== "prototype" ||
+        !lowerer.isStdlibGlobal(method.expression.expression, "Array") ||
+        !lowerer.isStdlibMember(method))
+        return null;
+    const loc = locOf(call);
+    const receiver = call.arguments[0]
+        ? lowerer.lowerExprExpecting(call.arguments[0], DYN)
+        : { kind: "dynFrom", value: { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc }, type: DYN, loc };
+    const args = call.arguments.slice(1).map((arg) => lowerer.lowerExprExpecting(arg, DYN));
+    return {
+        kind: "libCall", fn: "dyn.arrayProtoCall", args: [
+            receiver,
+            { kind: "strLit", value: method.name.text, type: STRING, loc },
+            { kind: "dynArrLit", elems: args, type: DYN, loc },
+        ], type: DYN, loc,
+    };
+}
 function lowerObjectOwnPrototypeCall(lowerer, call, access) {
     if (lowerer.dynamic || access.name.text !== "call" || !ts.isPropertyAccessExpression(access.expression))
         return null;
@@ -4756,10 +5187,31 @@ function lowerObjectOwnMethodCall(lowerer, call, access) {
     const method = access.name.text;
     if (lowerer.dynamic || call.questionDotToken || access.questionDotToken ||
         (method !== "hasOwnProperty" && method !== "propertyIsEnumerable") ||
-        !lowerer.isStdlibMember(access) || call.arguments.some(ts.isSpreadElement))
+        call.arguments.some(ts.isSpreadElement))
         return null;
+    if (!lowerer.isStdlibMember(access)) {
+        const receiver = tryLowerExpression(lowerer, access.expression);
+        if (receiver?.type.kind !== "dyn")
+            return null;
+    }
     return lowerObjectOwnCall(lowerer, call, access.expression, call.arguments[0], call.arguments.slice(1), method);
 }
+/** ToPropertyKey for the scalar keys represented by native own-key
+ * probes. A lowered array-loop key may carry an undefined arm even when
+ * its checker type is string; that arm spells "undefined" at runtime. */
+function ownPropertyKey(lowerer, key) {
+    if (key.type.kind === "string")
+        return key;
+    if (key.type.kind === "bigint") {
+        return { kind: "libCall", fn: "bigint.toString", args: [key, numLit(10, key.loc)], type: STRING, loc: key.loc };
+    }
+    const scalar = (type) => type.kind === "string" || type.kind === "f64" || type.kind === "bool" || isUnitType(type);
+    if (key.type.kind === "f64" || key.type.kind === "bool" || key.type.kind === "dyn" ||
+        (key.type.kind === "union" && lowerer.unions.get(key.type.unionId)?.arms.every(scalar))) {
+        return { kind: "toString", operand: key, type: STRING, loc: key.loc };
+    }
+    return null;
+}
 function lowerObjectOwnCall(lowerer, call, receiverNode, keyNode, extraNodes, method) {
     const enumerable = method === "propertyIsEnumerable";
     const loc = locOf(call);
@@ -4792,14 +5244,18 @@ function lowerObjectOwnCall(lowerer, call, receiverNode, keyNode, extraNodes, me
             stmts.push({ kind: "exprStmt", expr: effect, loc: locOf(extra) });
     }
     let key = keyRef;
+    if (receiverRef.type.kind === "dyn" && keyRef && (keyRef.type.kind === "symbol" || keyRef.type.kind === "dyn")) {
+        const result = { kind: "libCall", fn: enumerable ? "dyn.propertyIsEnumerableComputed" : "dyn.hasOwnComputed", args: [receiverRef, lowerer.coerceToExpected(keyRef, DYN)], type: BOOL, loc };
+        return { kind: "seqExpr", stmts, result, type: BOOL, loc };
+    }
     if (!keyNode || rawKey?.type.kind === "undefinedT" || rawKey?.type.kind === "void") {
         key = { kind: "strLit", value: "undefined", type: STRING, loc };
     }
     else if (rawKey?.type.kind === "nullT") {
         key = { kind: "strLit", value: "null", type: STRING, loc };
     }
-    else if (key && (key.type.kind === "f64" || key.type.kind === "bool" || key.type.kind === "bigint")) {
-        key = { kind: "toString", operand: key, type: STRING, loc };
+    else if (key) {
+        key = ownPropertyKey(lowerer, key);
     }
     if (!key || key.type.kind !== "string") {
         lowerer.noLowering("Object.prototype." + method + " with this property key", keyNode ?? call);
@@ -4811,13 +5267,13 @@ function lowerObjectOwnCall(lowerer, call, receiverNode, keyNode, extraNodes, me
     }
     else if (type.kind === "record") {
         const shape = lowerer.shapes.get(type.shapeId);
-        if (!shape || shape.tuple || shape.indexValue || shapeHasAccessorSlots(shape)) {
+        if (!shape || shape.tuple || shapeHasAccessorSlots(shape)) {
             lowerer.noLowering("Object.prototype." + method + " over this record shape", receiverNode ?? call);
         }
         result = { kind: "call", callee: recordHasOwnHelper(lowerer, type.shapeId, loc), args: [receiverRef, key], type: BOOL, loc };
     }
-    else if (type.kind === "dyn" && !enumerable) {
-        result = { kind: "libCall", fn: "dyn.hasOwn", args: [receiverRef, key], type: BOOL, loc };
+    else if (type.kind === "dyn") {
+        result = { kind: "libCall", fn: enumerable ? "dyn.propertyIsEnumerable" : "dyn.hasOwn", args: [receiverRef, key], type: BOOL, loc };
     }
     else if (type.kind === "string" || type.kind === "array") {
         const needleLocal = lowerer.declareHiddenLocal("%ownIndex", F64);
@@ -4886,6 +5342,52 @@ function lowerObjectPrototypeCall(lowerer, call, access) {
         : { kind: "strLit", value: "[object " + tag + "]", type: STRING, loc };
     return { kind: "seqExpr", stmts, result, type: STRING, loc };
 }
+/** Function.call evaluates all arguments before RequireObjectCoercible and
+ * ToString. Stabilize them before reusing the ordinary string method lowering,
+ * so a boxed nullish receiver or a coercion hook cannot reorder effects. */
+function lowerDynamicStringPrototypeCall(lowerer, call, methodAccess, receiver, method) {
+    const loc = locOf(call);
+    const receiverLocal = lowerer.declareHiddenLocal("%stringCallReceiver", receiver.type);
+    const stmts = [{ kind: "varDecl", localId: receiverLocal.id, init: receiver, loc }];
+    const receiverRef = varRef(receiverLocal.id, receiver.type, loc);
+    const converted = {
+        kind: "ternary",
+        cond: { kind: "dynTest", test: "nullish", value: receiverRef, type: BOOL, loc },
+        then: nodeThrowExpr(1, "", `String.prototype.${method} called on null or undefined`, STRING, loc),
+        else_: { kind: "libCall", fn: "dyn.toStringCoerce", args: [receiverRef], type: STRING, loc },
+        type: STRING, loc,
+    };
+    const overrides = [];
+    try {
+        for (const node of call.arguments.slice(1)) {
+            const undefinedValue = lowerStaticallyUndefinedArgument(lowerer, node);
+            const value = undefinedValue ?? lowerer.lowerExpr(node);
+            let ref;
+            if (undefinedValue || isUnitType(value.type) || value.type.kind === "void") {
+                stmts.push({ kind: "exprStmt", expr: value, loc: value.loc });
+                const nullUnit = !undefinedValue && value.type.kind === "nullT";
+                ref = { kind: "unitLit", unit: nullUnit ? "null" : "undefined", type: nullUnit ? value.type : UNDEFINED_T, loc: value.loc };
+            }
+            else {
+                const local = lowerer.declareHiddenLocal("%stringCallArg", value.type);
+                stmts.push({ kind: "varDecl", localId: local.id, init: value, loc: value.loc });
+                ref = varRef(local.id, value.type, value.loc);
+            }
+            overrides.push({ node, previous: lowerer.chainRecvByNode.get(node) });
+            lowerer.chainRecvByNode.set(node, ref);
+        }
+        const result = lowerStringMethodCallWithOptionalArgs(lowerer, call, methodAccess, () => converted, call.arguments.slice(1));
+        return result ? { kind: "seqExpr", stmts, result, type: result.type, loc } : null;
+    }
+    finally {
+        for (const override of overrides) {
+            if (override.previous)
+                lowerer.chainRecvByNode.set(override.node, override.previous);
+            else
+                lowerer.chainRecvByNode.delete(override.node);
+        }
+    }
+}
 function lowerStringPrototypeCall(lowerer, call, access) {
     if (access.name.text !== "call" || !ts.isPropertyAccessExpression(access.expression))
         return null;
@@ -4928,6 +5430,9 @@ function lowerStringPrototypeCall(lowerer, call, access) {
             loc,
         };
     }
+    if (receiverType.kind === "dyn") {
+        return lowerDynamicStringPrototypeCall(lowerer, call, methodAccess, receiverValue, method);
+    }
     const padding = entry?.method === "padStart" || entry?.method === "padEnd";
     const scalar = receiverType.kind === "string" || receiverType.kind === "f64" ||
         receiverType.kind === "bool" || receiverType.kind === "bigint" ||
@@ -4936,10 +5441,8 @@ function lowerStringPrototypeCall(lowerer, call, access) {
     // padding uses a helper that delays conversion until every argument is ready.
     const objectWithoutMethodArgs = entry?.maxArgs === 0 && call.arguments.length === 1 &&
         (receiverType.kind === "record" || receiverType.kind === "array" || receiverType.kind === "object");
-    const dynObjectWithoutMethodArgs = entry?.maxArgs === 0 && call.arguments.length === 1 &&
-        receiverType.kind === "dyn" && plainObjectCoercionReceiver(lowerer, receiverNode);
-    if (!scalar && !objectWithoutMethodArgs && !dynObjectWithoutMethodArgs && !(padding && receiverType.kind === "dyn")) {
-        return lowerer.noLowering(`String.prototype.${methodAccess.name.text}.call with ${lowerer.fmt(receiverType)} receivers`, call);
+    if (!scalar && !objectWithoutMethodArgs) {
+        lowerer.noLowering(`String.prototype.${methodAccess.name.text}.call with ${lowerer.fmt(receiverType)} receivers`, call);
     }
     if (indexMethod)
         return lowerStringIndexCall(lowerer, call, indexMethod, receiverValue, receiverNode, call.arguments.slice(1));
@@ -4951,9 +5454,7 @@ function lowerStringPrototypeCall(lowerer, call, access) {
     if (entry.method === "split") {
         return lowerStringSplitCall(lowerer, call, receiverValue, receiverNode, call.arguments.slice(1));
     }
-    const receiver = dynObjectWithoutMethodArgs
-        ? { kind: "libCall", fn: "dyn.toStringCoerce", args: [receiverValue], type: STRING, loc }
-        : lowerer.ensureString(receiverValue, receiverNode);
+    const receiver = lowerer.ensureString(receiverValue, receiverNode);
     return lowerStringMethodCallWithOptionalArgs(lowerer, call, methodAccess, () => receiver, call.arguments.slice(1));
 }
 function lowerScalarUnionNumber(lowerer, arg, node, loc) {
@@ -5127,13 +5628,18 @@ function spreadNeedsRuntimeArity(lowerer, shapes, argNodes) {
                 position += tuple.fields.length;
                 continue;
             }
-            if (restAt < 0 || position < restAt || shapes[restAt].mode !== "rest")
-                return true;
+            if (restAt < 0 || position < restAt || shapes[restAt].mode !== "rest") {
+                return !canCompleteRuntimeSpread(lowerer, shapes);
+            }
         }
         position++;
     }
     return false;
 }
+function canCompleteRuntimeSpread(lowerer, shapes) {
+    return shapes.length > 0 && shapes.every((shape) => shape.mode !== "islandRest" && shape.callDefault === undefined &&
+        canDynCheckTo(shape.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id)));
+}
 /** METHOD calls on dyn receivers (`pkg.name.replace(...)`, `rawName.split`,
  * `ws.packages.filter(...)` — JSON.parse-derived values): validate the
  * receiver's dyn kind, extract, and ride the STATIC method machinery — the
@@ -5171,6 +5677,27 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
         // tsc types the return by the evolved shape, the binding lowered
         // dyn): probe the lowering and claim exactly the dyn results.
         const probed = tryLowerExpression(lowerer, access.expression);
+        if (isJsSourceFile(call.getSourceFile()) && probed?.type.kind === "func" &&
+            !["call", "apply", "bind", "toString", "valueOf", "constructor"].includes(access.name.text) &&
+            canBoxFuncIntoDyn(probed.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
+            const loc = locOf(call);
+            const fnName = jsFuncNameOf(access.expression);
+            const boxed = { kind: "dynFrom", value: probed, type: DYN, loc, ...(fnName !== null ? { fnName } : {}) };
+            const local = lowerer.declareHiddenLocal("%callableReceiver", DYN);
+            const receiver = { kind: "varRef", localId: local.id, type: DYN, loc };
+            const member = {
+                kind: "dynKeyGet", value: receiver,
+                key: { kind: "strLit", value: access.name.text, type: STRING, loc }, type: DYN, loc,
+            };
+            if (call.arguments.some(ts.isSpreadElement)) {
+                lowerer.unsupported("SC1090", call, "spread arguments in callable property calls");
+            }
+            return {
+                kind: "seqExpr", stmts: [{ kind: "varDecl", localId: local.id, init: boxed, loc }],
+                result: { kind: "dynCall", callee: member, receiver, calleeName: access.getText(),
+                    args: call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc }, type: DYN, loc,
+            };
+        }
         if (probed?.type.kind !== "dyn")
             return null;
         recv = probed;
@@ -5178,11 +5705,30 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
     // A checker-`any` receiver that already lowered to a real STRING (the
     // chained form — `cfg.host.trim().toLowerCase()`, where the first step
     // extracted): no validation needed, ride the string tables directly.
+    if (recv.type.kind === "union" && lowerer.stripUndefinedArm(recv.type).kind === "string") {
+        const present = lowerer.runtimeOptionalPropertyReceiver(access.expression, recv, STRING, access.name.text);
+        if (present)
+            recv = present;
+    }
     if (recv.type.kind === "string") {
         return lowerRegexMethodCall(lowerer, call, access, () => recv) ?? lowerStringMethodCall(lowerer, call, access, () => recv);
     }
     if (recv.type.kind !== "dyn")
         return null;
+    if (lowerer.mapTypeOf(recvTs)?.kind === "classval") {
+        return lowerStaticMethodCall(lowerer, call, access);
+    }
+    const ownCallable = !checkerUntyped && (() => {
+        const prop = lowerer.checker.getPropertyOfType(recvTs, access.name.text);
+        if (prop === undefined)
+            return false;
+        // getPropertyOfType includes inherited Object.prototype members.
+        // Those are not stored members of a checked-dynamic object, so
+        // dynKeyGet cannot stand in for JavaScript's prototype lookup. Only
+        // an authored declaration can justify the own-member path.
+        const authored = lowerer.checker.declarationsOf(prop).some((decl) => !lowerer.isStdlibFile(decl.getSourceFile()));
+        return authored && lowerer.checker.getCallSignatures(lowerer.checker.getTypeOfSymbol(prop)).length > 0;
+    })();
     // Typed-destination filter first (validated extraction into a real
     // T[]); an untyped destination falls through to the runtime dispatch
     // below (the survivors stay dyn values).
@@ -5198,34 +5744,21 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
     // these, "the receiver is a string, or the call throws V8's TypeError"
     // IS Node's semantics for every possible dyn value. Shared names would
     // need a receiver-kind dispatch — they keep the fence.
-    if (DYN_STRING_ONLY_METHODS.has(access.name.text)) {
+    if (DYN_STRING_ONLY_METHODS.has(access.name.text) && !ownCallable) {
         const checked = () => dynStringReceiver(lowerer, recv, access);
         return lowerRegexMethodCall(lowerer, call, access, checked) ?? lowerStringMethodCall(lowerer, call, access, checked);
     }
-    // toString() is a shared prototype name with its OWN receiver-kind
-    // dispatched runtime lowering (dyn.toString: Buffer-flavored bytes
-    // decode per the encoding — a stream chunk's common consumption —
-    // and strings/numbers/booleans/arrays/objects answer JS-exactly).
-    // The optional argument is a literal encoding (meaningful for bytes;
-    // JS ignores extra toString arguments on the other kinds, and so
-    // does the runtime dispatch).
+    // The argument is a radix for bigint and an encoding for Buffer.
+    // Preserve its runtime value so receiver dispatch can choose correctly.
     if (access.name.text === "toString" && call.arguments.length <= 1) {
-        const enc = call.arguments[0]
-            ? bufEncoding(lowerer, "toString", call.arguments[0])
-            : "utf8";
-        // The source spelling rides along for the ONE receiver whose
-        // prototype lacks toString: a null-prototype dictionary throws
-        // Node's "<spelling> is not a function" at runtime.
+        const argument = call.arguments[0];
         return {
-            kind: "libCall",
-            fn: "dyn.toString",
-            args: [
+            kind: "libCall", fn: "dyn.toString", args: [
                 recv,
-                { kind: "strLit", value: enc, type: STRING, loc: locOf(call) },
+                argument ? lowerer.lowerExprExpecting(argument, DYN)
+                    : dynUndefinedExpr(locOf(call)),
                 { kind: "strLit", value: access.getText(), type: STRING, loc: locOf(call) },
-            ],
-            type: STRING,
-            loc: locOf(call),
+            ], type: STRING, loc: locOf(call),
         };
     }
     // SHARED prototype names with a runtime dispatch (scr_dyn_invoke):
@@ -5256,17 +5789,6 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
     // its name overlaps a primitive prototype (`colors.bold(...)`): the
     // source value was compiled from that object shape, while genuinely
     // untyped/any receivers retain the runtime-kind ambiguity and fence.
-    const ownCallable = !checkerUntyped && (() => {
-        const prop = lowerer.checker.getPropertyOfType(recvTs, access.name.text);
-        if (prop === undefined)
-            return false;
-        // getPropertyOfType includes inherited Object.prototype members.
-        // Those are not stored members of a checked-dynamic object, so
-        // dynKeyGet cannot stand in for JavaScript's prototype lookup. Only
-        // an authored declaration can justify the own-member path.
-        const authored = lowerer.checker.declarationsOf(prop).some((decl) => !lowerer.isStdlibFile(decl.getSourceFile()));
-        return authored && lowerer.checker.getCallSignatures(lowerer.checker.getTypeOfSymbol(prop)).length > 0;
-    })();
     if (DYN_PROTO_METHOD_NAMES.has(access.name.text) && !ownCallable)
         return null;
     // Optional forms (`obj.cb?.()`, `obj?.cb()`) belong to the chain
@@ -5277,15 +5799,20 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
     if (call.arguments.some((a) => ts.isSpreadElement(a))) {
         lowerer.unsupported("SC1090", call, "spread arguments in calls through 'unknown' values");
     }
+    const receiverLocal = lowerer.declareHiddenLocal("%dynCallReceiver", DYN);
+    const receiver = { kind: "varRef", localId: receiverLocal.id, type: DYN, loc };
     const member = {
         kind: "dynKeyGet",
         key: { kind: "strLit", value: access.name.text, type: STRING, loc: locOf(access) },
-        value: recv,
+        value: receiver,
         type: DYN,
         loc: locOf(access),
     };
     const args = call.arguments.map((a) => lowerer.lowerExprExpecting(a, DYN));
-    return { kind: "dynCall", callee: member, calleeName: access.getText(), args, type: DYN, loc };
+    return {
+        kind: "seqExpr", stmts: [{ kind: "varDecl", localId: receiverLocal.id, init: recv, loc }],
+        result: { kind: "dynCall", callee: member, receiver, calleeName: access.getText(), args, type: DYN, loc }, type: DYN, loc,
+    };
 }
 /** Prototype method names of the checked-dynamic tree-representable kinds (String, Array,
  * Object, Function, Number prototypes): a dyn receiver call on one of
@@ -5312,7 +5839,8 @@ const DYN_PROTO_METHOD_NAMES = new Set([
  * is-not-a-function where the kind's prototype lacks the name, and
  * fences LOUDLY on real-but-unimplemented pairs. */
 const DYN_DISPATCH_METHODS = new Set([
-    "apply", "call",
+    "segment", "containing", "resolvedOptions", "test", "exec",
+    "apply", "bind", "call",
     "push", "pop", "shift", "unshift", "slice", "at",
     "indexOf", "lastIndexOf", "includes", "join", "concat", "reverse", "sort",
     "forEach", "map", "filter", "some", "every", "find", "findIndex",
@@ -5330,7 +5858,7 @@ const DYN_DISPATCH_METHODS = new Set([
     "setEncoding", "setDefaultEncoding", "setTimeout", "read", "isPaused",
     "writeHead", "setHeader", "getHeader", "hasHeader", "removeHeader",
     "getHeaders", "getHeaderNames", "appendHeader", "flushHeaders",
-    "append", "delete", "get", "getSetCookie", "has", "set",
+    "add", "append", "delete", "get", "getSetCookie", "has", "set",
     "writeContinue", "writeEarlyHints", "cork", "uncork", "addTrailers",
     "ref", "unref", "address", "setNoDelay", "setKeepAlive", "connect",
     "resetAndDestroy", "destroySoon",
@@ -5368,7 +5896,7 @@ const DYN_DISPATCH_METHODS = new Set([
 ]);
 export function lowerDynDispatchMethodCall(lowerer, call, access, recv, arrayReceiver) {
     const method = access.name.text;
-    if (!DYN_DISPATCH_METHODS.has(method) || call.questionDotToken || access.questionDotToken)
+    if ((!DYN_DISPATCH_METHODS.has(method) && !isJsSourceFile(call.getSourceFile())) || lowerer.chainBlocked(call, access))
         return null;
     if (call.arguments.some((arg) => ts.isSpreadElement(arg))) {
         lowerer.unsupported("SC1090", call, "spread arguments in calls through 'unknown' values");
@@ -5494,7 +6022,8 @@ function lowerArrayIsArrayCall(lowerer, call, access) {
         // over side-effect-free reads (the operand re-evaluates/drops, the
         // `in`-operator fold discipline). dyn/caught/jsval arms have no
         // static tag answer and keep the narrow-first fence.
-        const def = lowerer.unions.get(arg.type.unionId);
+        const unionId = arg.type.unionId;
+        const def = lowerer.unions.get(unionId);
         const opaque = !def || def.arms.some((a) => a.kind === "dyn" || a.kind === "caught" || a.kind === "jsval");
         const arrayTags = lowerer.arrayValueTags(arg.type.unionId);
         const freeRead = arg.kind === "varRef" || arg.kind === "recordGet" || arg.kind === "fieldGet";
@@ -5506,7 +6035,7 @@ function lowerArrayIsArrayCall(lowerer, call, access) {
         }
         if (!opaque && freeRead && arrayTags.length > 1) {
             return arrayTags
-                .map((tag) => ({ kind: "unionIsTag", unionId: arg.type.unionId, tag, negated: false, value: arg, type: BOOL, loc }))
+                .map((tag) => ({ kind: "unionIsTag", unionId: unionId, tag, negated: false, value: arg, type: BOOL, loc }))
                 .reduce((left, right) => ({ kind: "logical", op: "||", left, right, type: BOOL, loc }));
         }
         lowerer.unsupported("SC1090", argNode, `Array.isArray on '${lowerer.fmt(arg.type)}' values (narrow first: check a discriminant field, or compare with '!== undefined'/'!== null' for unit arms)`);
@@ -5727,6 +6256,13 @@ function lowerClassHasOwnPropertyCall(lowerer, call, access) {
         else
             return null; // computed static names — the answer isn't static
     }
+    if (!own.has(key)) {
+        const loc = locOf(call);
+        const data = classStaticDataFor(lowerer, info, key, loc);
+        if (data)
+            return { kind: "libCall", fn: "dyn.hasOwn", args: [data,
+                    { kind: "strLit", value: key, type: STRING, loc }], type: BOOL, loc };
+    }
     return { kind: "boolLit", value: own.has(key), type: BOOL, loc: locOf(call) };
 }
 /** Side-effect-free receiver test for the CONSTANT primitive-prototype
@@ -5941,6 +6477,12 @@ function implicitReceiverOverloadReturn(lowerer, expr) {
 function reconcileOverloadReturn(lowerer, expr, call) {
     const rsig = lowerer.checker.getResolvedSignature(expr);
     const rdecl = rsig ? lowerer.checker.signatureDeclaration(rsig) : undefined;
+    // Fluent JS overrides share the base's return ABI, but their result
+    // still has the receiver's subclass layout at the call site.
+    if (call.type.kind === "object" && rdecl && ts.isMethodDeclaration(rdecl) &&
+        isJsSourceFile(rdecl.getSourceFile()) && returnsOnlyThis(rdecl)) {
+        call = lowerer.maybeNarrow(call, expr);
+    }
     const resolvedOverload = rsig && rdecl &&
         (ts.isFunctionDeclaration(rdecl) || ts.isMethodDeclaration(rdecl)) &&
         !rdecl.body
@@ -6147,7 +6689,7 @@ export function lowerTaggedTemplate(lowerer, expr) {
 }
 function loweredTemplateStrings(lowerer, expr, cooked, loc) {
     // Normal runtime construction keeps this array aligned with the current
-    // ScrArr layout in both backends. The old static-header IR node encoded the
+    // ScrArr layout in the backend. The old static-header IR node encoded the
     // pre-sparse layout in LLVM and crashed as soon as a tag read its strings.
     const type = arrayOf(STRING);
     const key = `templateStringsGlobal:${loc.file}:${expr.template.getStart()}`;
@@ -6204,7 +6746,7 @@ export function isTopLevelFnSymbol(lowerer, ident) {
     const decl = symbol ? lowerer.checker.declarationsOf(symbol)[0] : undefined;
     return (!!decl &&
         ts.isFunctionDeclaration(decl) &&
-        (ts.isSourceFile(decl.parent) || lowerer.nsBlocks.get(decl.parent) === "flattened"));
+        (ts.isSourceFile(decl.parent) || (decl.parent !== undefined && lowerer.nsBlocks.get(decl.parent) === "flattened")));
 }
 /** Nested `function name(...) {...}`: declare the mutable function binding
    * before lowering its body, then initialize it with the lifted closure.
@@ -6246,6 +6788,22 @@ export function lowerNestedFunctionDecl(lowerer, stmt) {
 export function lambdaSignature(lowerer, node) {
     if (!node.body)
         lowerer.unsupported("SC1090", node, "function overload signatures");
+    // A JS replacement of a native stream's write method receives the
+    // actual call tuple, including overloads and omitted arguments. Node's
+    // contextual overload signature cannot define this closure's ABI.
+    if (isJsSourceFile(node.getSourceFile()) && !node.type &&
+        (ts.isFunctionExpression(node) || ts.isArrowFunction(node)) &&
+        node.parameters.every((param) => !param.type && !param.dotDotDotToken && !param.initializer) &&
+        ts.isBinaryExpression(node.parent) && node.parent.right === node &&
+        node.parent.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
+        ts.isPropertyAccessExpression(node.parent.left) && node.parent.left.name.text === "write" &&
+        lowerer.isStdlibMember(node.parent.left)) {
+        const receiver = lowerer.lowerExpr(node.parent.left.expression);
+        if (receiver.type.kind === "dyn") {
+            const shapes = node.parameters.map(() => ({ type: DYN, mode: "required" }));
+            return { shapes, funcType: funcTypeFromParamShapes(shapes, DYN) };
+        }
+    }
     if (node.typeParameters) {
         // Generic function-like forms monomorphize only where a static home
         // exists: top-level generic function declarations, generic methods
@@ -6271,8 +6829,8 @@ export function lambdaSignature(lowerer, node) {
         : lowerer.declaredReturnType(node, node);
     ret = lowerer.runtimeOptionalFunctionReturnType(node, ret);
     // A contextually-typed arrow/function EXPRESSION whose slot signature
-    // returns a UNION the inferred return doesn't spell adopts the slot's
-    // return as its ABI: `(n) => work()` (inferring Promise<void>) against
+    // returns a composite type the inferred return doesn't spell adopts
+    // the slot's return as its ABI: `(n) => work()` (inferring Promise<void>) against
     // an `(n) => Promise<void> | void` field must RETURN that union — the
     // body's returns coerce into it per return site (arm values wrap;
     // width-coercible records rebuild into their arm — the runJobs
@@ -6286,6 +6844,9 @@ export function lambdaSignature(lowerer, node) {
     // returns coerce; the spawn-wrapper ABI still returns a promise).
     // jsval-returning bodies stay out (adoption would force validated
     // exits the writer never asked for).
+    // Array and record returns also need the destination during literal
+    // construction: a callback building IrStmt[] must wrap each element at
+    // that recursive layout instead of first inferring narrower arrays.
     const isAsyncLike = !ts.isMethodDeclaration(node) &&
         node.modifiers?.some((m) => m.kind === ts.SyntaxKind.AsyncKeyword) === true;
     const innerRet = isAsyncLike && ret.kind === "promise" ? ret.inner : ret;
@@ -6310,8 +6871,8 @@ export function lambdaSignature(lowerer, node) {
             ? lowerer.mapTypeOf(lowerer.checker.getReturnTypeOfSignature(ctxSigs[0]))
             : null;
         const ctxRet = isAsyncLike && ctxRetRaw?.kind === "promise" ? ctxRetRaw.inner : ctxRetRaw;
-        if (ctxRet?.kind === "union" &&
-            (innerRet.kind === "void" ? lowerer.armTag(ctxRet.unionId, UNDEFINED_T) >= 0 : true)) {
+        if ((ctxRet?.kind === "union" || ctxRet?.kind === "array" || ctxRet?.kind === "record") &&
+            (innerRet.kind !== "void" || (ctxRet.kind === "union" && lowerer.armTag(ctxRet.unionId, UNDEFINED_T) >= 0))) {
             ret = isAsyncLike ? { kind: "promise", inner: ctxRet } : ctxRet;
         }
         // A VOID slot discards the callback's result (TS's void-returning
@@ -6331,24 +6892,27 @@ export function lambdaSignature(lowerer, node) {
             ret = VOID;
         }
     }
+    ret = lowerer.contextualFunctionReturns.get(node) ?? ret;
     // A plain JS function reading `arguments` receives one hidden dyn
     // array. With named parameters, the array contains every actual
     // argument and only ES modules are admitted: sloppy-mode arguments
     // alias named parameters. Arrows inherit the enclosing `arguments`.
     const hasRest = shapes.some((s) => s.mode === "rest" || s.mode === "dynRest" || s.mode === "islandRest");
     const usesArguments = !hasRest &&
-        (ts.isFunctionExpression(node) || ts.isFunctionDeclaration(node)) &&
+        (ts.isFunctionExpression(node) || ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node)) &&
         isJsSourceFile(node.getSourceFile()) &&
         bodyReadsArguments(node);
-    if (usesArguments && node.parameters.length > 0) {
-        if (!isNodeEsmFile(node.getSourceFile())) {
-            lowerer.unsupported("SC1090", node, "parameterized 'arguments' outside an ES module (sloppy-mode parameter aliases)");
+    if (usesArguments) {
+        if (node.parameters.length > 0 || ts.isMethodDeclaration(node)) {
+            const classMethod = ts.isMethodDeclaration(node) &&
+                (ts.isClassDeclaration(node.parent) || ts.isClassExpression(node.parent));
+            if (!classMethod && !isNodeEsmFile(node.getSourceFile(), lowerer.program)) {
+                lowerer.unsupported("SC1090", node, "parameterized 'arguments' outside an ES module (sloppy-mode parameter aliases)");
+            }
         }
         shapes.push({ type: DYN, mode: "arguments" });
     }
     const funcType = funcTypeFromParamShapes(shapes, ret);
-    if (usesArguments)
-        funcType.rest = true;
     return { shapes, funcType };
 }
 /** Lifts an arrow function / function expression / nested declaration /
@@ -6398,10 +6962,17 @@ export function lowerLambda(lowerer, node) {
     lowerer.fnStack.push(fnCtx);
     try {
         const { params, prologue } = lowerer.declareParams(node.parameters, shapes);
+        // Checked JavaScript functions take their receiver from the call site.
+        // Store it as this function's binding so escaping arrows capture it,
+        // and a method nested inside another method never captures its owner.
+        if (isJsSourceFile(node.getSourceFile()) && !ts.isArrowFunction(node)) {
+            const receiver = lowerer.declareThis(DYN);
+            prologue.unshift({ kind: "varDecl", localId: receiver.id, init: { kind: "libCall", fn: "dyn.this", args: [], type: DYN, loc }, loc });
+        }
         // The synthetic trailing dyn-array param carries `arguments`.
         // Parameterized functions receive all actual arguments; zero-param
         // functions receive the same array through their rest ABI.
-        if (funcType.rest && !shapes.some((s) => s.mode === "dynRest" || s.mode === "islandRest")) {
+        if (funcType.rest && funcType.restAbi === undefined && !shapes.some((s) => s.mode === "dynRest" || s.mode === "islandRest")) {
             const argsLocal = lowerer.declareHiddenLocal("%arguments", DYN);
             params.push({ localId: argsLocal.id, name: "%arguments", type: DYN });
             fnCtx.argumentsLocal = argsLocal;
@@ -6438,7 +7009,9 @@ export function lowerLambda(lowerer, node) {
                 }
             }
             else {
-                let value = lowerer.lowerExpr(bodyExpr);
+                // Concise and block bodies use the same destination layout for
+                // fresh literals. Async bodies must inspect promises first.
+                let value = isAsync ? lowerer.lowerExpr(bodyExpr) : lowerer.lowerExprExpecting(bodyExpr, bodyReturn);
                 // An async concise body whose value is itself a promise
                 // (`async () => p`): the async machinery RESOLVES the returned
                 // thenable into the function's own promise — lowerReturnValue's
@@ -6468,6 +7041,8 @@ export function lowerLambda(lowerer, node) {
         const ctx = lowerer.ctx;
         const lifted = {
             name: fnName,
+            sourceName: jsFuncNameOf(node) ?? "<anonymous>",
+            ...(!isAsync && !isGenerator && (ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node)) ? { ownsPrototype: true } : {}),
             params,
             returnType: bodyReturn,
             locals: ctx.locals,
@@ -6810,10 +7385,12 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
                         }));
                     }
                     else {
+                        if (settled.type.kind !== "dyn" &&
+                            !canConvertToDyn(settled.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
+                            lowerer.unsupported("SC1090", fulfilledNode, "then fulfillment values that cannot cross the checked-dynamic boundary");
+                        }
                         const arg = settled.type.kind === "dyn" ? settled
-                            : canConvertToDyn(settled.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))
-                                ? { kind: "dynFrom", value: settled, type: DYN, loc }
-                                : lowerer.unsupported("SC1090", fulfilledNode, "then fulfillment values that cannot cross the checked-dynamic boundary");
+                            : { kind: "dynFrom", value: settled, type: DYN, loc };
                         body.push(...resultOf({
                             kind: "dynCall",
                             callee: { kind: "varRef", localId: fLocal.id, type: DYN, loc },
@@ -7677,7 +8254,8 @@ export function recordKeysArrayCall(lowerer, receiver, argIr, shape, loc) {
             loc,
         };
         const finalize = () => {
-            const current = lowerer.shapes.get(argIr.shapeId) ?? shape;
+            const latest = lowerer.shapes.get(argIr.shapeId);
+            const current = latest !== undefined ? latest : shape;
             const body = [
                 { kind: "varDecl", localId: "out.0", init: { kind: "arrayLit", elems: [], type: resultT, loc }, loc },
             ];
@@ -7727,10 +8305,11 @@ export function recordKeysArrayCall(lowerer, receiver, argIr, shape, loc) {
     return { kind: "call", callee: helper, args: [receiver], type: resultT, loc };
 }
 /** Interned `%obj.hasOwn.<n>(r, k)` — Object.hasOwn's membership walk
- * over a signature-free record shape: the key compares against each
+ * over a record shape: the key compares against each
  * declared field name, undefined-armed fields answering by their tag
  * (a key is own exactly when Object.keys would list it — the two share
- * the guard), everything else true, no match false. */
+ * the guard), everything else true. Unmatched keys probe the overflow
+ * map when present, so explicit undefined values remain own keys. */
 function recordHasOwnHelper(lowerer, shapeId, loc) {
     const key = `obj.hasOwn:${shapeId}`;
     const existing = lowerer.arrHofHelpers.get(key);
@@ -7764,7 +8343,10 @@ function recordHasOwnHelper(lowerer, shapeId, loc) {
             loc,
         });
     }
-    body.push({ kind: "return", value: { kind: "boolLit", value: false, type: BOOL, loc }, loc });
+    const fallback = shape.indexValue
+        ? { kind: "recordOvfHas", obj: rRef, shapeId, key: kRef, type: BOOL, loc }
+        : { kind: "boolLit", value: false, type: BOOL, loc };
+    body.push({ kind: "return", value: fallback, loc });
     lowerer.liftedFns.push({
         name: helper,
         params: [
@@ -7944,6 +8526,42 @@ function lowerObjectStaticCall(lowerer, call, access) {
     if (!lowerer.isStdlibGlobal(access.expression, "Object"))
         return null;
     const member = access.name.text;
+    if ((member === "getOwnPropertyNames" || member === "getOwnPropertySymbols" || member === "getOwnPropertyDescriptors") && call.arguments.length === 1 &&
+        !call.arguments.some(ts.isSpreadElement) && !lowerer.dynamic) {
+        let object = lowerer.lowerExpr(call.arguments[0]);
+        if (object.type.kind === "string" || object.type.kind === "f64" ||
+            object.type.kind === "bool" || isUnitType(object.type))
+            object = { kind: "dynFrom", value: object, type: DYN, loc: locOf(call) };
+        if (object.type.kind === "dyn")
+            return { kind: "libCall", fn: member === "getOwnPropertyNames" ? "dyn.getOwnPropertyNames" : member === "getOwnPropertySymbols" ? "dyn.getOwnPropertySymbols" : "dyn.getOwnPropertyDescriptors", args: [object], type: DYN, loc: locOf(call) };
+    }
+    if ((member === "getPrototypeOf" || member === "setPrototypeOf") &&
+        call.arguments.length === (member === "getPrototypeOf" ? 1 : 2) &&
+        !call.arguments.some(ts.isSpreadElement) && !lowerer.dynamic) {
+        let object = lowerer.lowerExpr(call.arguments[0]);
+        if (object.type.kind === "func") {
+            const fnName = jsFuncNameOf(call.arguments[0]);
+            object = { kind: "dynFrom", value: object, type: DYN, loc: locOf(call),
+                ...(fnName !== null ? { fnName } : {}) };
+        }
+        if (object.type.kind === "dyn") {
+            const loc = locOf(call);
+            if (member === "getPrototypeOf")
+                return { kind: "libCall", fn: "dyn.getPrototype", args: [object], type: DYN, loc };
+            const prototype = lowerer.lowerExprExpecting(call.arguments[1], DYN);
+            if (prototype.type.kind === "dyn")
+                return { kind: "libCall", fn: "dyn.setPrototype", args: [object, prototype], type: DYN, loc };
+        }
+    }
+    if (member === "getOwnPropertyDescriptor" && call.arguments.length === 2) {
+        const [receiver, key] = call.arguments;
+        if (receiver && key && ts.isPropertyAccessExpression(receiver) && receiver.name.text === "prototype" &&
+            lowerer.isStdlibGlobal(receiver.expression, "ArrayBuffer") && ts.isStringLiteral(key) && key.text === "byteLength") {
+            const loc = locOf(call);
+            const getter = lowerer.lowerNativeCallableValue({ fn: "arrayBuffer.byteLengthGetter", params: [], result: F64, valueParams: [] }, "get ArrayBuffer.prototype.byteLength", loc);
+            return { kind: "libCall", fn: "arrayBuffer.byteLengthDescriptor", args: [lowerer.coerceToExpected(getter, DYN)], type: DYN, loc };
+        }
+    }
     const cacheKeys = lowerRequireCacheKeys(lowerer, call, member);
     if (cacheKeys)
         return cacheKeys;
@@ -8045,23 +8663,14 @@ function lowerObjectStaticCall(lowerer, call, access) {
         }
         lowerer.noLowering(`Object.is over '${lowerer.fmt(left.type)}' and '${lowerer.fmt(right.type)}' operands`, call, "the operands must share one comparable kind (numbers, strings, booleans, units, one union shape, or one reference type)");
     }
-    // Object.create — the null-prototype DICTIONARY (`Object.create(null)`
-    // then keyed assignment, the memo-table idiom prettier's index/
-    // group-mode maps spell) and, under --dynamic, the engine's own
-    // Object.create for engine-held prototypes. Everything else is a
-    // NAMED fence: the compiled representations have no prototype chain,
-    // and the own-copy stand-in would answer WRONG observably — Node's
-    // Object.keys/inspect/JSON of the created object list NO own keys,
-    // and mutating the prototype afterwards is visible through the
-    // created object (live delegation), which no copy can honor.
+    // Native checked objects retain a live prototype and can install an
+    // own-property descriptor table during creation. Engine-held values
+    // use the engine's Object.create path below.
     if (member === "create") {
         if (call.arguments.some((a) => ts.isSpreadElement(a))) {
             lowerer.noLowering("Object.create with spread arguments", call);
         }
-        if (call.arguments.length >= 2) {
-            lowerer.noLowering("Object.create with a properties-descriptor argument", call, "create first, then assign: const o = Object.create(null); o.k = v");
-        }
-        if (call.arguments.length !== 1) {
+        if (call.arguments.length < 1 || call.arguments.length > 2) {
             lowerer.noLowering(`Object.create with ${call.arguments.length} arguments`, call);
         }
         const loc = locOf(call);
@@ -8070,6 +8679,8 @@ function lowerObjectStaticCall(lowerer, call, access) {
             protoNode = protoNode.expression;
         const nullProto = protoNode.kind === ts.SyntaxKind.NullKeyword;
         if (lowerer.dynamic) {
+            if (call.arguments.length === 2)
+                lowerer.noLowering("Object.create with properties under --dynamic", call);
             // The checker types the result `any` — an ENGINE value under
             // --dynamic — and the engine's own Object.create answers with
             // REAL prototype semantics: reads delegate LIVE, writes shadow,
@@ -8090,15 +8701,40 @@ function lowerObjectStaticCall(lowerer, call, access) {
             }
             lowerer.noLowering(`Object.create over '${lowerer.fmt(proto.type)}' prototypes`, call, "prototype reads delegate LIVE in Node (mutating the prototype shows through the created object), which the boundary's deep copy cannot honor — only null and engine-held ('any') prototypes lower");
         }
-        if (nullProto) {
+        if (nullProto && call.arguments.length === 1) {
             return { kind: "libCall", fn: "dyn.objCreateNullProto", args: [], type: DYN, loc };
         }
-        const proto = lowerer.lowerExpr(protoNode);
-        lowerer.noLowering(`Object.create over '${lowerer.fmt(proto.type)}' prototypes`, call, "the compiled representations have no prototype chain, and an own-copy would answer wrong observably (Node lists NO own keys on the created object, and prototype mutations show through it live) — only Object.create(null) lowers");
+        let proto = nullProto
+            ? { kind: "dynFrom", value: { kind: "unitLit", unit: "null", type: NULL_T, loc }, type: DYN, loc }
+            : ts.isObjectLiteralExpression(protoNode)
+                ? lowerer.lowerExprExpecting(protoNode, DYN)
+                : lowerer.lowerExpr(protoNode);
+        if (isUnitType(proto.type) || proto.type.kind === "f64" || proto.type.kind === "bool" || proto.type.kind === "string")
+            proto = { kind: "dynFrom", value: proto, type: DYN, loc };
+        if (proto.type.kind === "dyn") {
+            if (call.arguments.length === 1)
+                return { kind: "libCall", fn: "dyn.objCreate", args: [proto], type: DYN, loc };
+            const descriptors = lowerer.lowerExprExpecting(call.arguments[1], DYN);
+            if (descriptors.type.kind === "dyn")
+                return { kind: "libCall", fn: "dyn.objCreateWithProperties", args: [proto, descriptors], type: DYN, loc };
+        }
+        lowerer.noLowering(`Object.create over '${lowerer.fmt(proto.type)}' prototypes`, call);
     }
     // `Object.assign(fn, { props })` whose RESULT type maps to the hybrid
     // (function-with-properties) record: the chalk-shape CONSTRUCTOR.
     if (member === "assign") {
+        const prototype = lowerClassPrototypeAssign(lowerer, call);
+        if (prototype)
+            return prototype;
+        if (isJsSourceFile(call.getSourceFile()) && call.arguments.length > 0 && !call.arguments.some(ts.isSpreadElement)) {
+            const target = tryLowerExpression(lowerer, call.arguments[0]);
+            if (target?.type.kind === "func" && lowerer.dynConvertible(target.type)) {
+                const loc = locOf(call);
+                return { kind: "libCall", fn: "dyn.assignAll", args: [lowerer.coerceToExpected(target, DYN),
+                        { kind: "dynArrLit", elems: call.arguments.slice(1).map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc },
+                    ], type: DYN, loc };
+            }
+        }
         const hybrid = lowerObjectAssignHybrid(lowerer, call);
         if (hybrid)
             return hybrid;
@@ -8145,7 +8781,9 @@ function lowerObjectStaticCall(lowerer, call, access) {
             if (tProbe?.type.kind === "dyn") {
                 const loc = locOf(call);
                 const target = lowerer.lowerExpr(call.arguments[0]);
-                const source = lowerer.coerceToExpected(lowerer.lowerExpr(call.arguments[1]), DYN);
+                const rawSource = lowerer.lowerExpr(call.arguments[1]);
+                fenceSymbolFieldCopy(lowerer, call.arguments[1], rawSource.type);
+                const source = lowerer.coerceToExpected(rawSource, DYN);
                 if (target.type.kind === "dyn" && source.type.kind === "dyn") {
                     return { kind: "libCall", fn: "dyn.assign", args: [target, source], type: DYN, loc };
                 }
@@ -8222,7 +8860,9 @@ function lowerObjectStaticCall(lowerer, call, access) {
                         const argNode = sources[i];
                         const spread = ts.isSpreadElement(argNode);
                         const srcNode = spread ? argNode.expression : argNode;
-                        const src = lowerer.coerceToExpected(lowerer.lowerExpr(srcNode), DYN);
+                        const rawSource = lowerer.lowerExpr(srcNode);
+                        fenceSymbolFieldCopy(lowerer, srcNode, rawSource.type, spread);
+                        const src = lowerer.coerceToExpected(rawSource, DYN);
                         if (src.type.kind !== "dyn") {
                             ok = false;
                             break;
@@ -8259,22 +8899,75 @@ function lowerObjectStaticCall(lowerer, call, access) {
         }
         return null;
     }
+    if ((member === "defineProperty" && call.arguments.length === 3) ||
+        (member === "getOwnPropertyDescriptor" && call.arguments.length === 2)) {
+        if (call.arguments.some((a) => ts.isSpreadElement(a)))
+            return null;
+        let target = tryLowerExpression(lowerer, call.arguments[0]);
+        if (target && member === "defineProperty") {
+            const native = lowerClassDataDescriptor(lowerer, call, member, target);
+            if (native)
+                return native;
+        }
+        if (target && member === "getOwnPropertyDescriptor" && isDynTypedRefType(target.type)) {
+            const descriptor = lowerClassDescriptorRead(lowerer, call, target);
+            if (descriptor)
+                return descriptor;
+            target = lowerer.coerceToExpected(target, DYN);
+        }
+        // Error.cause owns a live data-property slot shared with its checked
+        // view. Other native fields do not yet synchronize descriptor edits.
+        const keyNode = call.arguments[1];
+        if (target?.type.kind === "object" && target.type.className !== "%DOMException" && lowerer.errorHierarchyClassOf(target.type.className) &&
+            ts.isStringLiteral(keyNode) && keyNode.text === "cause") {
+            target = lowerer.coerceToExpected(target, DYN);
+        }
+        if (target?.type.kind === "func" && lowerer.dynConvertible(target.type)) {
+            const fnName = jsFuncNameOf(call.arguments[0]);
+            target = { kind: "dynFrom", value: target, type: DYN, loc: locOf(call.arguments[0]), ...(fnName !== null ? { fnName } : {}) };
+        }
+        const descriptorPrimitive = member === "getOwnPropertyDescriptor" && target &&
+            (target.type.kind === "bool" || target.type.kind === "f64" || target.type.kind === "string");
+        if (!target || (target.type.kind !== "dyn" && !isUnitType(target.type) && !descriptorPrimitive))
+            return null;
+        if (target.type.kind !== "dyn")
+            target = { kind: "dynFrom", value: target, type: DYN, loc: locOf(call.arguments[0]) };
+        const key = lowerer.lowerExprExpecting(call.arguments[1], DYN);
+        if (key.type.kind !== "dyn")
+            return null;
+        if (member === "getOwnPropertyDescriptor") {
+            return { kind: "libCall", fn: "dyn.getOwnPropertyDescriptor", args: [target, key], type: DYN, loc: locOf(call) };
+        }
+        const descriptor = lowerer.lowerExprExpecting(call.arguments[2], DYN);
+        if (descriptor.type.kind !== "dyn")
+            return null;
+        return { kind: "libCall", fn: "dyn.defineProperty", args: [target, key, descriptor], type: DYN, loc: locOf(call) };
+    }
     // Object.defineProperties over a CHECKED-DYNAMIC target (test/common's
     // _mustCallInner copying name/length onto the mustCall wrapper): the
-    // runtime turns each descriptor's `value` into a plain own property on
-    // the dyn node (OBJ members; FUNC nodes carry an own-property table) —
-    // flags accepted and ignored, accessors throw loudly (SEMANTICS.md).
+    // runtime turns each descriptor's `value` into an own property on
+    // the dyn node (OBJ members preserve attributes; FUNC nodes carry an
+    // own-property table). Accessors use the target as their receiver.
     // The result is the target, like JS. Typed targets keep the fence:
     // static shapes have no property table to extend.
     if (member === "defineProperties" && call.arguments.length === 2 &&
         !call.arguments.some((a) => ts.isSpreadElement(a))) {
         let target = tryLowerExpression(lowerer, call.arguments[0]);
+        if (target) {
+            const native = lowerClassDataDescriptor(lowerer, call, member, target);
+            if (native)
+                return native;
+        }
         // A FUNCTION-typed target boxes through the dyn boundary: the
         // property table lives on the CLOSURE (shared by every box of this
         // function value), so defining through a fresh box sticks — the
         // wrapper returned later reads the same table.
         if (target && target.type.kind === "func" &&
             canBoxFuncIntoDyn(target.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
+            const fnName = jsFuncNameOf(call.arguments[0]);
+            target = { kind: "dynFrom", value: target, type: DYN, loc: locOf(call.arguments[0]), ...(fnName !== null ? { fnName } : {}) };
+        }
+        if (target && isUnitType(target.type)) {
             target = { kind: "dynFrom", value: target, type: DYN, loc: locOf(call.arguments[0]) };
         }
         if (target?.type.kind === "dyn") {
@@ -8285,12 +8978,39 @@ function lowerObjectStaticCall(lowerer, call, access) {
         }
         return null;
     }
+    if (["preventExtensions", "isExtensible", "seal", "isSealed"].includes(member) &&
+        call.arguments.length === 1 && !ts.isSpreadElement(call.arguments[0])) {
+        const value = lowerer.lowerExpr(call.arguments[0]);
+        if (value.type.kind === "string" || value.type.kind === "f64" ||
+            value.type.kind === "bool" || value.type.kind === "symbol" || isUnitType(value.type)) {
+            if (member === "preventExtensions" || member === "seal")
+                return value;
+            const loc = locOf(call);
+            const answer = { kind: "boolLit", value: member !== "isExtensible", type: BOOL, loc };
+            return isSafeToDiscard(value) ? answer : {
+                kind: "seqExpr", stmts: [{ kind: "exprStmt", expr: value, loc: value.loc }],
+                result: answer, type: BOOL, loc,
+            };
+        }
+        if (value.type.kind === "dyn") {
+            const operation = {
+                preventExtensions: "dyn.preventExtensions", isExtensible: "dyn.isExtensible",
+                seal: "dyn.seal", isSealed: "dyn.isSealed",
+            };
+            const fn = operation[member];
+            return { kind: "libCall", fn, args: [value], type: member.startsWith("is") ? BOOL : DYN, loc: locOf(call) };
+        }
+    }
     // Object.freeze: on a FRESH literal (object or array) the result IS
     // the argument — no alias exists, so the frozen bit is unobservable
     // (writes through the Readonly<T> result are compile errors, and no
     // other reference can write). Primitives pass through per ES2015.
     // Aliased objects keep a fence: a later write through the original
     // reference would need the runtime frozen bit (strict mode throws).
+    if (member === "isFrozen" && call.arguments.length === 1) {
+        const value = lowerer.lowerExprExpecting(call.arguments[0], DYN);
+        return { kind: "libCall", fn: "dyn.isFrozen", args: [value], type: BOOL, loc: locOf(call) };
+    }
     if (member === "freeze") {
         if (call.arguments.length !== 1 || ts.isSpreadElement(call.arguments[0])) {
             lowerer.noLowering(`Object.freeze with ${call.arguments.length} arguments`, call);
@@ -8300,14 +9020,18 @@ function lowerObjectStaticCall(lowerer, call, access) {
         while (ts.isParenthesizedExpression(inner) || ts.isAsExpression(inner))
             inner = inner.expression;
         const value = lowerer.lowerExpr(argNode);
+        if (value.type.kind === "dyn")
+            return { kind: "libCall", fn: "dyn.freeze", args: [value], type: DYN, loc: locOf(call) };
         if (ts.isObjectLiteralExpression(inner) || ts.isArrayLiteralExpression(inner)) {
             return value; // fresh — freeze is identity here, honestly
         }
         if (value.type.kind === "string" || value.type.kind === "f64" ||
-            value.type.kind === "bool" || value.type.kind === "symbol" ||
+            value.type.kind === "bool" || value.type.kind === "symbol" || value.type.kind === "bigint" ||
             isUnitType(value.type)) {
             return value; // ES2015: freeze of a primitive is the primitive
         }
+        if (value.type.kind === "union" && lowerer.unions.get(value.type.unionId)?.arms.every((arm) => isUnitType(arm) || arm.kind === "f64" || arm.kind === "bigint" || arm.kind === "bool" || arm.kind === "string" || arm.kind === "symbol"))
+            return value;
         lowerer.noLowering("Object.freeze of a possibly-aliased value", call, "freeze of a FRESH object/array literal (and of primitives) compiles — frozen-ness is unobservable there; an aliased target's later writes would need the runtime frozen bit");
     }
     // `Object.hasOwn(r, k)` over a RECORD receiver: a record's own-key set
@@ -8316,9 +9040,9 @@ function lowerObjectStaticCall(lowerer, call, access) {
     // fields answer by their runtime tag — the explicit-undefined-is-absent
     // stance: an omitted optional field holds the undefined arm and reads
     // as NOT own, exactly Node's absent key (an EXPLICIT `k: undefined`
-    // diverges — documented next to the child-env/JSON rule). Tuple,
-    // index-signature (overflow membership lives in the runtime map), and
-    // accessor-carrying shapes keep the SC2020 fence; non-record receivers
+    // diverges — documented next to the child-env/JSON rule). Tuple
+    // and accessor-carrying shapes keep the SC2020 fence. Index-signature
+    // records additionally probe the overflow map; non-record receivers
     // do too.
     if (member === "hasOwn" && call.arguments.length === 2 && !call.arguments.some((a) => ts.isSpreadElement(a))) {
         const recvNode = call.arguments[0];
@@ -8327,33 +9051,30 @@ function lowerObjectStaticCall(lowerer, call, access) {
         // A CHECKED-DYNAMIC receiver (the JS file-scope object-literal
         // identity story): the runtime dyn probe — OBJ member presence, ARR
         // index bounds, Node's ToObject TypeError on nullish.
-        if (probed?.type.kind === "dyn") {
+        if (probed?.type.kind === "dyn" || (probed && isDynTypedRefType(probed.type)) || (probed?.type.kind === "func" && lowerer.dynConvertible(probed.type))) {
             const loc = locOf(call);
-            const receiver = lowerer.lowerExpr(recvNode);
-            let key = lowerer.lowerExpr(keyNode);
-            if (key.type.kind === "f64" || key.type.kind === "bool" || key.type.kind === "dyn") {
-                key = { kind: "toString", operand: key, type: STRING, loc: locOf(keyNode) };
-            }
-            if (key.type.kind !== "string")
+            const receiver = lowerer.coerceToExpected(probed, DYN);
+            const rawKey = lowerer.lowerExpr(keyNode);
+            if (rawKey.type.kind === "dyn" || rawKey.type.kind === "symbol")
+                return {
+                    kind: "libCall", fn: "dyn.hasOwnComputed", args: [receiver, lowerer.coerceToExpected(rawKey, DYN)], type: BOOL, loc,
+                };
+            const key = ownPropertyKey(lowerer, rawKey);
+            if (!key)
                 return null;
             return { kind: "libCall", fn: "dyn.hasOwn", args: [receiver, key], type: BOOL, loc };
         }
         if (probed?.type.kind !== "record")
             return null;
         const shape = lowerer.shapes.get(probed.type.shapeId);
-        if (!shape || shape.tuple || shape.indexValue || shapeHasAccessorSlots(shape))
+        if (!shape || shape.tuple || shapeHasAccessorSlots(shape))
             return null;
         const loc = locOf(call);
         const receiver = lowerer.lowerExpr(recvNode);
         if (receiver.type.kind !== "record")
             return null; // probe/lower drift: keep the fence
-        let key = lowerer.lowerExpr(keyNode);
-        // Number/boolean/dyn keys stringify — ToPropertyKey, the keyed-write
-        // path's rule; symbol and composite keys keep the fence.
-        if (key.type.kind === "f64" || key.type.kind === "bool" || key.type.kind === "dyn") {
-            key = { kind: "toString", operand: key, type: STRING, loc: locOf(keyNode) };
-        }
-        if (key.type.kind !== "string")
+        const key = ownPropertyKey(lowerer, lowerer.lowerExpr(keyNode));
+        if (!key)
             return null;
         const helper = recordHasOwnHelper(lowerer, receiver.type.shapeId, loc);
         return { kind: "call", callee: helper, args: [receiver, key], type: BOOL, loc };
@@ -8415,8 +9136,11 @@ function lowerObjectStaticCall(lowerer, call, access) {
         const isDyn = probed?.type.kind === "dyn";
         // Unit-typed arguments (Object.keys(null)) ride the same runtime
         // walk: it throws Node's catchable TypeError.
-        const isUnit = probed !== null && probed !== undefined && isUnitType(probed.type);
-        if (isDyn || isUnit) {
+        const isFunction = probed?.type.kind === "func" && lowerer.dynConvertible(probed.type);
+        const isPrimitive = probed !== null && probed !== undefined &&
+            (isUnitType(probed.type) || probed.type.kind === "string" ||
+                probed.type.kind === "f64" || probed.type.kind === "bool");
+        if (isDyn || isPrimitive || isFunction || (probed && isDynTypedRefType(probed.type))) {
             const fn = member === "keys" ? "dyn.objKeys" : member === "values" ? "dyn.objValues" : "dyn.objEntries";
             let v = lowerer.lowerExpr(argNode);
             if (v.type.kind !== "dyn")
@@ -8445,6 +9169,19 @@ function lowerObjectStaticCall(lowerer, call, access) {
     if (shapeHasAccessorSlots(shape)) {
         lowerer.unsupported("SC1090", call, `Object.${member} over a shape carrying get/set accessor properties (Node lists the accessor names${member === "keys" ? "" : " and invokes the getters"} — the static key walk cannot; read the properties explicitly)`);
     }
+    // unknown[] uses the checked-dynamic array representation. Enumerate
+    // a live view of the record so values retain their identities and the
+    // result never pretends to be a native vector or an island array.
+    const enumerationType = lowerer.mapTypeOf(lowerer.typeOf(call));
+    if ((member === "values" || member === "entries") &&
+        (enumerationType?.kind === "dyn" || enumerationType === null && isJsSourceFile(call.getSourceFile()))) {
+        let receiver = lowerer.coerceToExpected(lowerer.lowerExpr(argNode), DYN);
+        if (receiver.type.kind !== "dyn")
+            lowerer.badType(argNode, lowerer.typeOf(argNode));
+        if (receiver.kind === "dynFrom" && receiver.value.type.kind === "record")
+            receiver = { ...receiver, liveRef: true };
+        return { kind: "libCall", fn: member === "values" ? "dyn.objValues" : "dyn.objEntries", args: [receiver], type: DYN, loc: locOf(call) };
+    }
     if (shape.indexValue) {
         // Index-signature (overflow-carrying) shapes: the runtime walk —
         // declared fields first, then the overflow in JS own-key order
@@ -8455,7 +9192,7 @@ function lowerObjectStaticCall(lowerer, call, access) {
     const resultT = lowerer.irTypeOf(call);
     if (resultT.kind !== "array")
         lowerer.badType(call, lowerer.typeOf(call)); // defensive
-    const receiver = lowerer.lowerExpr(argNode);
+    const receiver = objectEnumerationReceiver(lowerer, lowerer.lowerExpr(argNode), argIr, loc);
     if (member === "keys") {
         // The keys walk is shared with for-in (which iterates exactly the
         // keys Object.keys answers — one construction, one intern key).
@@ -8497,7 +9234,8 @@ function lowerObjectStaticCall(lowerer, call, access) {
             loc,
         };
         const finalize = () => {
-            const current = lowerer.shapes.get(argIr.shapeId) ?? shape;
+            const latest = lowerer.shapes.get(argIr.shapeId);
+            const current = latest !== undefined ? latest : shape;
             const body = [
                 { kind: "varDecl", localId: "out.0", init: { kind: "arrayLit", elems: [], type: resultT, loc }, loc },
             ];
@@ -8651,6 +9389,8 @@ export function lowerFunction(lowerer, decl) {
         appendImplicitUndefinedReturn(lowerer, body, bodyReturn, locOf(decl));
         const fn = {
             name: sig.name,
+            sourceName: decl.name?.text ?? "<anonymous>",
+            ...(!sig.isAsync && !sig.generator ? { ownsPrototype: true } : {}),
             params,
             returnType: bodyReturn,
             locals: lowerer.ctx.locals,
@@ -8775,8 +9515,27 @@ function lowerObjectAssignHybrid(lowerer, call) {
 export function lowerRecordFieldCall(lowerer, call, access) {
     if (lowerer.chainBlocked(call))
         return null;
-    if (lowerer.mapTypeOf(lowerer.typeOf(access.expression))?.kind !== "record")
-        return null;
+    const stored = ts.isIdentifier(access.expression)
+        ? lowerer.peekLocal(access.expression)?.type ?? lowerer.globalOf(access.expression)?.type : undefined;
+    const receiverType = stored?.kind === "record" ? stored : lowerer.mapTypeOf(lowerer.typeOf(access.expression));
+    if (receiverType?.kind !== "record" && receiverType?.kind !== "union")
+        return null;
+    // A union of records can share a closure-valued field. Its normal
+    // property read performs the tag dispatch before arguments evaluate.
+    // Class methods retain their vtable path and must not lose `this`.
+    if (receiverType.kind === "union") {
+        const arms = lowerer.unions.get(receiverType.unionId)?.arms;
+        if (!arms?.every((arm) => arm.kind === "record"))
+            return null;
+        if (!arms.every((arm) => arm.kind === "record" &&
+            lowerer.shapes.get(arm.shapeId)?.fields.some((field) => field.name === access.name.text && field.type.kind === "func")))
+            return null;
+        const callee = lowerer.lowerUnionProperty(access);
+        if (callee?.type.kind !== "func")
+            return null;
+        const args = completeFuncValueArgs(lowerer, call, callee.type, locOf(call));
+        return { kind: "callValue", callee, args, type: callee.type.ret, loc: locOf(call) };
+    }
     const target = lowerer.fieldTarget(access);
     let callee = target ? lowerer.fieldGetExpr(target, locOf(access), access) : null;
     if (!callee)
@@ -8975,7 +9734,7 @@ function nullishValueUnitOf(lowerer, sym) {
     // the no-storage family never claims it.
     if (!decl || !ts.isVariableDeclaration(decl) || !ts.isIdentifier(decl.name) ||
         decl.getSourceFile().isDeclarationFile || decl.initializer === undefined ||
-        !ts.isVariableStatement(decl.parent.parent)) {
+        !ts.isVariableStatement(decl.parent?.parent)) {
         return null;
     }
     const unit = nullishExprUnitOf(lowerer, decl.initializer);
@@ -9161,7 +9920,7 @@ export function deadUnmappableBinding(lowerer, sym, decl) {
     // lowerVarDeclList's contract requires a lowered statement for it, so
     // the no-storage family never claims it (catch bindings sit outside a
     // variable statement too and stay out the same way).
-    if (!ts.isVariableStatement(decl.parent.parent))
+    if (!ts.isVariableStatement(decl.parent?.parent))
         return false;
     const sf = decl.getSourceFile();
     if (sf.isDeclarationFile || isJsSourceFile(sf))
@@ -9339,11 +10098,11 @@ export function bindingGenericFnInfoOf(lowerer, decl, fnNode) {
             lowerer.unsupported("SC1031", param);
         }
     }
-    const stmt = decl.parent.parent; // declarator → list → statement (nsPathPrefix wants the statement)
+    const stmt = decl.parent?.parent; // declarator → list → statement (nsPathPrefix wants the statement)
     const info = {
         decl: fnNode,
         baseName: name,
-        qualifiedName: lowerer.qualify(decl.getSourceFile(), nsPathPrefix(stmt, decl) + name),
+        qualifiedName: lowerer.qualify(decl.getSourceFile(), nsPathPrefix(stmt ?? decl, decl) + name),
         typeParams,
         instances: new Map(),
     };
@@ -9475,6 +10234,88 @@ function arrowSignatureOf(lowerer, node) {
     const declaration = lowerer.checker.signatureDeclaration(signatures[0]);
     return declaration !== undefined && ts.isArrowFunction(declaration) ? signatures[0] : null;
 }
+/** An inline arrow has lexical `this` and no observable own properties
+ * before binding. With no preset arguments, a fresh forwarding closure
+ * preserves its completed ABI, defaults and captured environment. Keep
+ * other receivers and rest/preset-argument forms on the named fence. */
+function lowerInlineArrowBind(lowerer, call, access) {
+    if (access.name.text !== "bind" || call.arguments.length > 1 || call.arguments.some(ts.isSpreadElement))
+        return null;
+    let arrow = access.expression;
+    while (ts.isParenthesizedExpression(arrow))
+        arrow = arrow.expression;
+    if (!ts.isArrowFunction(arrow))
+        return null;
+    const callee = lowerer.lowerExpr(access.expression);
+    if (callee.type.kind !== "func" || callee.type.rest ||
+        !canBoxFuncIntoDyn(callee.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id)))
+        return null;
+    const type = callee.type;
+    const loc = locOf(call);
+    const firstDefault = arrow.parameters.findIndex((p) => p.initializer !== undefined);
+    const length = firstDefault < 0 ? arrow.parameters.length : firstDefault;
+    const key = `arrow.bind:${typeKey(type)}:${length}`;
+    const existing = lowerer.arrHofHelpers.get(key);
+    const name = existing ?? `%arrow.bind.${lowerer.arrHofHelpers.size}`;
+    if (!existing) {
+        lowerer.arrHofHelpers.set(key, name);
+        lowerer.freshClosureAdapters.add(name);
+        const impl = `${name}.impl`;
+        const captured = { id: "f.0", name: "f", type, mutable: false, boxed: true };
+        const params = type.params.map((type, i) => ({ localId: `p.${i}`, name: `p${i}`, type }));
+        const invoked = {
+            kind: "callValue",
+            callee: { kind: "varRef", localId: captured.id, type, loc },
+            args: params.map((p) => ({ kind: "varRef", localId: p.localId, type: p.type, loc })),
+            type: type.ret,
+            loc,
+        };
+        lowerer.liftedFns.push({
+            name: impl,
+            params,
+            returnType: type.ret,
+            captures: [{ localId: captured.id, name: captured.name, type }],
+            locals: [captured, ...params.map((p) => ({ id: p.localId, name: p.name, type: p.type, mutable: false }))],
+            body: [type.ret.kind === "void" ? { kind: "exprStmt", expr: invoked, loc } : { kind: "return", value: invoked, loc }],
+            loc,
+        });
+        const bound = { kind: "varRef", localId: "bound.0", type, loc };
+        const str = (value) => ({ kind: "strLit", value, type: STRING, loc });
+        const descriptor = (value) => ({
+            kind: "dynObjLit", fields: [{ key: str("value"), value: { kind: "dynFrom", value, type: DYN, loc } }], type: DYN, loc,
+        });
+        lowerer.liftedFns.push({
+            name,
+            params: [{ localId: captured.id, name: captured.name, type }],
+            returnType: type,
+            locals: [captured, { id: "bound.0", name: "bound", type, mutable: false }],
+            body: [
+                { kind: "varDecl", localId: "bound.0", init: { kind: "closure", fnName: impl, captures: [captured.id], type, loc }, loc },
+                // Store metadata on the closure so aliases and repeated dyn boxes
+                // observe the bound name and source arity, including defaults.
+                { kind: "exprStmt", expr: {
+                        kind: "libCall", fn: "dyn.defineProps", args: [
+                            { kind: "dynFrom", value: bound, type: DYN, loc },
+                            { kind: "dynObjLit", fields: [
+                                    { key: str("name"), value: descriptor(str("bound ")) },
+                                    { key: str("length"), value: descriptor({ kind: "numLit", value: length, type: F64, loc }) },
+                                ], type: DYN, loc },
+                        ], type: DYN, loc,
+                    }, loc },
+                { kind: "return", value: bound, loc },
+            ],
+            loc,
+        });
+    }
+    const saved = lowerer.declareHiddenLocal("%bindFn", type);
+    const stmts = [{ kind: "varDecl", localId: saved.id, init: callee, loc }];
+    // The receiver is ignored by the arrow, but its effects and throws
+    // happen after creating the arrow and before returning the bound value.
+    if (call.arguments[0])
+        stmts.push(lowerer.lowerExprStatement(call.arguments[0]));
+    const result = { kind: "call", callee: name, args: [{ kind: "varRef", localId: saved.id, type, loc }], type, loc };
+    return { kind: "seqExpr", stmts, result, type, loc };
+}
 /** `arrow.apply(thisArg, dynArgs)` for a fixed-arity compiled arrow. Arrows
  * ignore `thisArg` and surplus arguments by language definition; declared
  * parameters validate from the dynamic array in order. */
@@ -9553,7 +10394,6 @@ function lowerObjLitGenericMethodCall(lowerer, call, access) {
             thisT.kind !== "dyn" &&
             thisT.kind !== "jsval" &&
             (!thisArg || ts.isIdentifier(thisArg) || ts.isLiteralExpression(thisArg) ||
-                thisArg.kind === ts.SyntaxKind.UndefinedKeyword ||
                 thisArg.kind === ts.SyntaxKind.NullKeyword ||
                 isUnitType(thisT));
         if (provablyNot) {
@@ -9592,19 +10432,25 @@ function lowerObjLitGenericMethodCall(lowerer, call, access) {
     }
     const found = objLitGenericFnNodeOf(lowerer, propSym);
     if (!found) {
+        const arrowBind = lowerInlineArrowBind(lowerer, call, access);
+        if (arrowBind !== null)
+            return arrowBind;
         const arrowApply = lowerArrowFunctionApply(lowerer, call, access);
         if (arrowApply !== null)
             return arrowApply;
-        // Function.prototype.apply/call/bind spelled through a FUNCTION
-        // receiver: compiled functions are direct calls with no runtime
-        // `this`/arguments object to re-route — name the working spelling
-        // instead of a class-receiver hint (or an SC2020 recitation) no
-        // function value can follow. Before the stdlib decline: these ARE
-        // stdlib members (CallableFunction), but the pointed message is
-        // the honest one.
+        // Convertible native callables use the checked invocation boundary
+        // for Function.prototype methods, including their call-time receiver.
         if ((name === "apply" || name === "call" || name === "bind") &&
             lowerer.checker.getCallSignatures(recvT).length > 0) {
-            lowerer.unsupported("SC1090", call, `Function.prototype.${name} on a compiled function value (compiled calls are direct — no runtime 'this' or arguments object exists to re-route; spell the call directly: '${access.expression.getText()}(...)')`);
+            const value = tryLowerExpression(lowerer, access.expression);
+            if (value?.type.kind === "func" && lowerer.dynConvertible(value.type) && !call.arguments.some(ts.isSpreadElement)) {
+                const loc = locOf(call);
+                return {
+                    kind: "dynInvoke", recv: { kind: "dynFrom", value, type: DYN, loc }, method: name,
+                    calleeName: access.getText(), args: call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc,
+                };
+            }
+            lowerer.unsupported("SC1090", call, `Function.prototype.${name} on a function whose signature cannot cross the checked-value boundary (call '${access.expression.getText()}(...)' directly)`);
         }
         // STANDARD-LIBRARY generic members (Promise.then, Object.
         // defineProperty, Array-augmentation methods) are the lib fence's
@@ -9641,7 +10487,16 @@ function lowerObjLitGenericMethodCall(lowerer, call, access) {
 export function lowerObjectMethodCall(lowerer, call, access) {
     if (lowerer.chainBlocked(access, call))
         return null;
-    const mappedReceiver = lowerer.mapTypeOf(lowerer.typeOf(access.expression));
+    let mappedReceiver = lowerer.mapTypeOf(lowerer.typeOf(access.expression));
+    // A specialized JS parameter can expose a native field whose checker
+    // type still belongs to the unspecialized body (plane.normal.dot()).
+    // Use the lowered receiver's representation and retain its evaluation.
+    const probe = mappedReceiver?.kind !== "object" && (lowerer.implicitParamTypes !== null || ts.isNewExpression(access.expression) ||
+        isJsSourceFile(call.getSourceFile()) && ts.isCallExpression(access.expression))
+        ? tryLowerExpression(lowerer, access.expression) : null;
+    const specializedReceiver = probe?.type.kind === "object" ? probe : null;
+    if (specializedReceiver)
+        mappedReceiver = specializedReceiver.type;
     if (mappedReceiver?.kind === "union") {
         const dispatched = lowerUnionObjectMethodCall(lowerer, call, access, mappedReceiver) ??
             lowerUnionObjectDynFieldCall(lowerer, call, access, mappedReceiver);
@@ -9654,15 +10509,16 @@ export function lowerObjectMethodCall(lowerer, call, access) {
             ? (() => {
                 const arms = lowerer.unions.get(mappedReceiver.unionId)?.arms ?? [];
                 const objects = arms.filter((arm) => arm.kind === "object");
-                return objects.length === 1 && arms.every((arm) => arm.kind === "object" || isUnitType(arm))
-                    ? objects[0]
+                const object = objects[0];
+                return objects.length === 1 && object?.kind === "object" && arms.every((arm) => arm.kind === "object" || isUnitType(arm))
+                    ? object
                     : null;
             })()
             : null;
     if (receiverIr === null)
         return null;
     const lowerReceiver = () => {
-        const receiver = lowerer.lowerExpr(access.expression);
+        const receiver = specializedReceiver ?? lowerer.lowerExpr(access.expression);
         const optional = lowerer.runtimeOptionalPropertyReceiver(access.expression, receiver, receiverIr, access.name.text);
         if (optional !== null)
             return optional;
@@ -9671,7 +10527,7 @@ export function lowerObjectMethodCall(lowerer, call, access) {
             if (helper !== null)
                 return { kind: "call", callee: helper, args: [receiver], type: receiverIr, loc: locOf(access.expression) };
         }
-        return receiver;
+        return receiver.type.kind === "dyn" ? lowerer.coerceInto(access.expression, receiver, receiverIr) : receiver;
     };
     const info = lowerer.classes.get(receiverIr.className);
     if (!info)
@@ -9698,7 +10554,7 @@ export function lowerObjectMethodCall(lowerer, call, access) {
     if (info && !found) {
         const gfound = findGenericMethodOn(lowerer, info, access.name.text);
         if (gfound)
-            return lowerClassGenericMethodCall(lowerer, call, access, info, gfound);
+            return lowerClassGenericMethodCall(lowerer, call, access, info, gfound, lowerReceiver());
     }
     // A FUNC-, nullable-FUNC-, or DYN-typed FIELD in call position:
     // `this.cb()` — the ctor-assigned callback field (countdown.js's
@@ -9714,13 +10570,22 @@ export function lowerObjectMethodCall(lowerer, call, access) {
                 ? (() => {
                     const arms = lowerer.unions.get(fieldType.unionId)?.arms ?? [];
                     const funcs = arms.filter((arm) => arm.kind === "func");
-                    return funcs.length === 1 && arms.every((arm) => arm.kind === "func" || isUnitType(arm))
-                        ? funcs[0]
+                    const func = funcs[0];
+                    return funcs.length === 1 && func?.kind === "func" && arms.every((arm) => arm.kind === "func" || isUnitType(arm))
+                        ? func
                         : null;
                 })()
                 : null;
         if (fieldType && (callableType !== null || fieldType.kind === "dyn")) {
             const target = lowerer.fieldTarget(access);
+            if (!target)
+                return null;
+            const loc = locOf(call);
+            const receiverLocal = lowerer.declareHiddenLocal("%callReceiver", target.obj.type);
+            const init = { kind: "varDecl", localId: receiverLocal.id, init: target.obj, loc };
+            target.obj = { kind: "varRef", localId: receiverLocal.id, type: receiverLocal.type, loc };
+            const receiver = lowerer.coerceToExpected(target.obj, DYN);
+            const finish = (result) => ({ kind: "seqExpr", stmts: [init], result, type: result.type, loc });
             let callee = target ? lowerer.fieldGetExpr(target, locOf(access), access) : null;
             if (callee?.type.kind === "union" && callableType !== null) {
                 const helper = lowerer.narrowedArmHelper(callee.type.unionId, callableType, locOf(access));
@@ -9729,15 +10594,24 @@ export function lowerObjectMethodCall(lowerer, call, access) {
                 }
             }
             if (callee?.type.kind === "func") {
+                if ((callee.type.rest === true && callee.type.restAbi === undefined || call.arguments.length > callee.type.params.length) &&
+                    isJsSourceFile(call.getSourceFile()) && lowerer.dynConvertible(callee.type)) {
+                    const boxed = { kind: "dynFrom", value: callee, type: DYN, loc };
+                    const spread = lowerSpreadArgsCall(lowerer, call, boxed, loc);
+                    if (spread?.kind === "dynCall")
+                        return finish({ ...spread, receiver });
+                    const args = call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN));
+                    return finish({ kind: "dynCall", callee: boxed, receiver, calleeName: access.getText(), args, type: DYN, loc });
+                }
                 const args = completeFuncValueArgs(lowerer, call, callee.type, locOf(call));
-                return { kind: "callValue", callee, args, type: callee.type.ret, loc: locOf(call) };
+                return finish({ kind: "callValue", callee, receiver, args, type: callee.type.ret, loc });
             }
             if (callee?.type.kind === "dyn") {
                 if (call.arguments.some((a) => ts.isSpreadElement(a))) {
                     lowerer.unsupported("SC1090", call, "spread arguments in calls through 'unknown' values");
                 }
                 const args = call.arguments.map((a) => lowerer.lowerExprExpecting(a, DYN));
-                return { kind: "dynCall", callee, calleeName: access.getText(), args, type: DYN, loc: locOf(call) };
+                return finish({ kind: "dynCall", callee, receiver, calleeName: access.getText(), args, type: DYN, loc });
             }
         }
         return null;
@@ -9745,18 +10619,25 @@ export function lowerObjectMethodCall(lowerer, call, access) {
     if (!info || !found)
         return null;
     const method = access.name.text;
-    if (found.declarer.builtinError) {
-        // The one builtin method: Error.prototype.toString, a runtime
-        // implementation called directly (overriding it is fenced, so no
-        // dispatch can ever be needed). Receiver BORROWED by the libCall.
+    if (isClassCallback(lowerer, info, method)) {
+        const loc = locOf(call);
         const receiver = lowerReceiver();
-        return {
-            kind: "libCall",
-            fn: "error.toString",
-            args: [lowerer.upcastTo(receiver, found.declarer.def.name)],
-            type: STRING,
-            loc: locOf(call),
-        };
+        const local = lowerer.declareHiddenLocal("%callbackReceiver", receiver.type);
+        const value = { kind: "varRef", localId: local.id, type: receiver.type, loc };
+        const args = lowerer.completeArgs(call.arguments, found.sig.params, loc, call);
+        const virtual = lowerer.overrideBelow(info, method);
+        if (virtual)
+            lowerer.noteVirtualEdge(info, method);
+        else
+            lowerer.noteEdge(`%${found.declarer.def.name}.${method}`);
+        const fallback = virtual
+            ? { kind: "virtualCall", className: info.def.name, method, args: [lowerer.upcastTo(value, info.def.name), ...args], type: found.sig.ret, loc }
+            : { kind: "call", callee: `%${found.declarer.def.name}.${method}`, args: [lowerer.upcastTo(value, found.declarer.def.name), ...args], type: found.sig.ret, loc };
+        const result = classCallbackCall(lowerer, value, method, call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), fallback, loc);
+        return { kind: "seqExpr", stmts: [{ kind: "varDecl", localId: local.id, init: receiver, loc }], result, type: result.type, loc };
+    }
+    if (found.declarer.builtinError) {
+        return errorToStringCall(lowerer, lowerReceiver());
     }
     // An ABSTRACT nearest declaration with no concrete override below the
     // static class: no implementation exists for a direct call to target.
@@ -9829,7 +10710,10 @@ function lowerUnionObjectMethodCall(lowerer, call, access, receiverT) {
 function paramAbisEqual(left, right) {
     return left.length === right.length && left.every((shape, i) => {
         const other = right[i];
-        return other !== undefined && shape.mode === other.mode && typeEquals(shape.type, other.type);
+        return other !== undefined && typeEquals(shape.type, other.type) &&
+            (shape.mode === other.mode || shape.type.kind === "dyn" &&
+                (shape.mode === "required" || shape.mode === "omittable") &&
+                (other.mode === "required" || other.mode === "omittable"));
     });
 }
 /** The JS-class sibling of union method dispatch: every arm stores the
@@ -9854,6 +10738,8 @@ function lowerUnionObjectDynFieldCall(lowerer, call, access, receiverT) {
     const loc = locOf(call);
     const receiver = lowerer.coerceInto(access.expression, lowerer.lowerExpr(access.expression), receiverT);
     const key = `${receiverT.unionId}:dyn-field:${field}`;
+    const receiverLocal = lowerer.declareHiddenLocal("%unionCallReceiver", receiverT);
+    const receiverRef = varRef(receiverLocal.id, receiverT, loc);
     let helper = lowerer.unionCallHelpers.get(key);
     if (!helper) {
         helper = `%union.call.${lowerer.unionCallHelpers.size}`;
@@ -9906,9 +10792,12 @@ function lowerUnionObjectDynFieldCall(lowerer, call, access, receiverT) {
         const locals = params.map((param) => ({ id: param.localId, name: param.name, type: param.type, mutable: false }));
         lowerer.liftedFns.push({ name: helper, params, returnType: DYN, locals, body, loc });
     }
-    const callee = { kind: "call", callee: helper, args: [receiver], type: DYN, loc };
+    const callee = { kind: "call", callee: helper, args: [receiverRef], type: DYN, loc };
     const args = call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN));
-    return { kind: "dynCall", callee, calleeName: access.getText(), args, type: DYN, loc };
+    return {
+        kind: "seqExpr", stmts: [{ kind: "varDecl", localId: receiverLocal.id, init: receiver, loc }],
+        result: { kind: "dynCall", callee, receiver: lowerer.coerceToExpected(receiverRef, DYN), calleeName: access.getText(), args, type: DYN, loc }, type: DYN, loc,
+    };
 }
 function unionObjectMethodHelper(lowerer, sourceCall, receiverT, method, plans, shapes, resultT, loc) {
     const key = `${receiverT.unionId}:${method}:${shapes.map((shape) => `${shape.mode}:${typeKey(shape.type)}`).join(",")}:${typeKey(resultT)}`;
@@ -9930,13 +10819,7 @@ function unionObjectMethodHelper(lowerer, sourceCall, receiverT, method, plans,
         };
         let invoke;
         if (plan.found.declarer.builtinError) {
-            invoke = {
-                kind: "libCall",
-                fn: "error.toString",
-                args: [lowerer.upcastTo(concrete, plan.found.declarer.def.name)],
-                type: STRING,
-                loc,
-            };
+            invoke = errorToStringCall(lowerer, concrete);
         }
         else if (lowerer.overrideBelow(plan.info, method)) {
             lowerer.noteVirtualEdge(plan.info, method);