@scriptc/compiler 0.1.7 → 0.2.1

package/dist/frontend/lowering/lower-calls.js

@@ -1,28 +1,35 @@
+import { objectEnumerationReceiver } from "./object-enumeration-receiver.js";
 import { InternalCompilerError } from "../../errors.js";
 /* Call lowering: the lowerCall dispatch chain, parameter-shape analysis and
  * argument completion (optional/default/rest, explicit-undefined ≡ omission),
  * function/lambda lowering and signature collection, and monomorphizing
  * generic instantiation (bounded by MAX_GENERIC_INSTANCES). */
 import * as ts from "../ts7/adapter.js";
+import { AstNode } from "../ts7/ast-node.js";
 import { bodyReadsArguments } from "../arguments-usage.js";
 import { lowerGenMethodCall } from "./lower-generators.js";
-import { BIGINT_T, BOOL, CAUGHT, DYN, F64, JSVAL, STRING, SYMBOL_T, UNDEFINED_T, VOID, arrayOf, canBoxFuncIntoDyn, canConvertToDyn, canDynCheckTo, canMarshalTypedFuncIntoIsland, ffiClassType, ffiSourceParamTypes, funcOf, isFfiCallbackParam, isFfiContextParam, isFfiReleaseParam, isUnitType, shapeHasAccessorSlots, typeEquals } from "../../ir/ir.js";
-import { isJsSourceFile, isNodeEsmFile, locOf } from "../program.js";
-import { genResultRecord, isGenericCallableMemberType, typeKey } from "../type-mapper.js";
-import { PoisonError, dynFallbackType, dynUndefinedExpr, importCallHandleType, jsFuncNameOf, newFnCtx, nodeThrowExpr, staticImportNamespaceType } from "./lowerer.js";
-import { enforceLibBoundary } from "./lib-boundary.js";
-import { NARROW_FIRST, STRING_INDEX_METHODS, STR_METHODS, builtinFenceHintOf, builtinModuleFnOf } from "./surfaces.js";
+import { lowerClassSymbolMethodCall } from "./symbol-methods.js";
+import { errorToStringCall } from "./error-methods.js";
+import { lowerClassPrototypeAssign } from "./class-prototypes.js";
+import { BYTES_ELEMENT_NAME, BIGINT_T, BOOL, CAUGHT, DYN, F64, JSVAL, NULL_T, STRING, SYMBOL_T, UNDEFINED_T, VOID, arrayOf, canBoxFuncIntoDyn, canConvertToDyn, canDynCheckTo, canMarshalTypedFuncIntoIsland, ffiClassType, ffiSourceParamTypes, funcOf, isDynTypedRefType, isFfiCallbackParam, isFfiContextParam, isFfiReleaseParam, isUnitType, shapeHasAccessorSlots, typeEquals } from "../../ir/ir.js";
+import { isJsSourceFile, isNodeEsmFile, locOf, requireSpecOf } from "../program.js";
+import { genResultRecord, isGenericCallableMemberType, jsOpenObjectType, typeKey } from "../type-mapper.js";
+import { PoisonError, dynFallbackType, dynUndefinedExpr, importCallHandleType, jsFuncNameOf, neverTaintedJsType, newFnCtx, nodeThrowExpr, staticImportNamespaceType } from "./lowerer.js";
+import { enforceLibBoundary, lowerSurplusCalls } from "./lib-boundary.js";
+import { NARROW_FIRST, STRING_INDEX_METHODS, STR_METHODS, builtinFenceHintOf, builtinModuleFnOf, stdlibGlobalNameOf } from "./surfaces.js";
 import { ffiBindingDiag, ffiSignatureDiag, libCallbackDiag, requiresDynamicDiag } from "../../diagnostics/diagnostic.js";
 import { mixinFnShapeOf } from "./lower-mixins.js";
-import { dynStringReceiver, lowerArrayConstructor, lowerArrayFromCall, lowerArrayOfCall, lowerDynArrayFilterCall, lowerDynArrayFlatMapCall, lowerGroupByStaticCall, lowerIteratorHelperCall, lowerObjectAssignIndexShape, lowerObjectFromEntriesCall, lowerObjectIterOverIndexShape, lowerTupleReadMethodCall } from "./lower-containers.js";
-import { bufEncoding } from "./containers/bytes.js";
+import { dynStringReceiver, lowerArrayConstructor, lowerArrayFromCall, lowerArrayOfCall, lowerDynArrayFilterCall, lowerDynArrayFlatMapCall, lowerGroupByStaticCall, lowerIteratorHelperCall, lowerObjectAssignIndexShape, lowerObjectConstructor, lowerObjectFromEntriesCall, lowerObjectIterOverIndexShape, lowerTupleReadMethodCall } from "./lower-containers.js";
+import { lowerBytesStaticCall } from "./containers/bytes.js";
 import { lowerRegexMethodCall, lowerStringIndexCall, lowerStringMethodCall, lowerStringPaddingCall, lowerStringSplitCall } from "./containers/string-and-regexp.js";
-import { lowerChildStreamMethodCall, lowerChildWriterMethodCall, lowerCreateRequireCall, lowerCryptoHashMethodCall, lowerDirentMethodCall, lowerFileHandleMethodCall, lowerImportMetaResolveCall, lowerNodeModuleCall, lowerPerfHooksCall, lowerProcStreamMethodCall, lowerReflectApplyCall, lowerRequireResolveCall, lowerWatcherMethodCall } from "./lower-builtins.js";
-import { lowerAbsenceProbe, lowerPromiseAllTupleCall, lowerPromiseRejectCall, stringWrapperToString, templateRawTextOf } from "./lower-exprs.js";
+import { createRequireSpecOf, lowerChildStreamMethodCall, lowerChildWriterMethodCall, lowerCreateRequireCall, lowerCryptoHashMethodCall, lowerDirentMethodCall, lowerFileHandleMethodCall, lowerImportMetaResolveCall, lowerNodeModuleCall, lowerPerfHooksCall, lowerProcStreamMethodCall, lowerReflectCall, lowerRequireResolveCall, lowerWatcherMethodCall } from "./lower-builtins.js";
+import { lowerAbsenceProbe, lowerPromiseAllTupleCall, lowerPromiseRejectCall, stringWrapperToString, symbolFieldInfo, templateRawTextOf } from "./lower-exprs.js";
 import { isSafeToDiscard } from "./expressions/evaluation-safety.js";
 import { tryLowerExpression } from "./expressions/try-lower-expression.js";
+import { hasRuntimeStatics } from "./class-runtime-statics.js";
 import { httpClientFnBindingOf, isStreamUndefCallExpr, lowerCompatReqStreamOptionalCall, lowerHttpClientFnCall } from "./lower-server.js";
-import { EMITTER_API_MEMBERS, exactInstanceClassOf, findGenericMethodOn, lowerClassGenericMethodCall, lowerStaticMethodCall } from "./lower-classes.js";
+import { EMITTER_API_MEMBERS, exactClassOfReceiver, exactInstanceClassOf, findGenericMethodOn, lowerClassGenericMethodCall, lowerStaticMethodCall, lowerStaticFieldRead, returnsOnlyThis, storedClassValueType } from "./lower-classes.js";
+import { classCallbackCall, isClassCallback } from "./class-callbacks.js";
 import { emitterRooted, lowerEmitterMethodCall } from "./lower-event-emitter.js";
 import { lowerConsoleInspectArg, lowerFormatCall } from "./lower-inspect.js";
 import { STREAM_API_MEMBERS, lowerStreamMethodCall, lowerStreamModuleCall, lowerStreamStaticCall, streamSidesOf } from "./lower-stream.js";
@@ -30,10 +37,14 @@ import { ambientNsRootOf, ambientUndefReadType, ambientUndefVarRootOf, ambientUn
 import { declSymbolOf } from "./lower-modules.js";
 import { expandoMemberRead } from "./lower-expando.js";
 import { npmStaticPackageOfPath } from "../npm-static.js";
-import { countedFor, varRef } from "../../ir/build.js";
+import { countedFor, numLit, varRef } from "../../ir/build.js";
 import { rejectStaticThis } from "./static-this.js";
 import { fenceNodeModuleMutationCall, lowerRequireCacheKeys } from "./lower-node-module.js";
 import { defaultAfterUndefined, lowerOptionalArgument, lowerStaticallyUndefinedArgument, positionNumber } from "./optional-arguments.js";
+import { fenceSymbolFieldCopy } from "./symbol-fields.js";
+import { lowerClassDataDescriptor, lowerClassDescriptorRead } from "./class-descriptors.js";
+import { classStaticDataFor } from "./class-static-data.js";
+import { jsBindingHasOpenWrites } from "./lower-stmts.js";
 export { bodyReadsArguments };
 /** The one func-type projection of completed parameter shapes. Typed rest
  * parameters keep their packed array as the trailing native ABI slot and
@@ -51,11 +62,7 @@ export function funcTypeFromParamShapes(shapes, ret) {
         ret,
         ...(typedRest || dynRest || islandRest || argumentsAll ? { rest: true } : {}),
         ...(argumentsAll ? { argumentsAll: true } : {}),
-        ...(typedRest
-            ? { restAbi: "typed" }
-            : islandRest
-                ? { restAbi: "jsval" }
-                : {}),
+        ...(typedRest || islandRest ? { restAbi: typedRest ? "typed" : "jsval" } : {}),
     };
 }
 /** Registers `const alias = overloadedDeclaration` as a compile-time
@@ -118,6 +125,25 @@ export const MAX_GENERIC_INSTANCES = 100;
    * - `...xs: T[]`: the ABI type is the array; call sites pack the surplus.
    */
 export function paramShape(lowerer, param) {
+    if (param.initializer && isJsSourceFile(param.getSourceFile()) && !param.type &&
+        !/@(?:param|type)\b/.test(param.getSourceFile().text.slice(param.parent?.pos ?? param.pos, param.getStart()))) {
+        return { type: DYN, mode: "omittable", bodyType: DYN };
+    }
+    // Inferred JS array patterns describe the bindings, not an exact tuple
+    // contract. Consume the actual iterable, including surplus elements.
+    if (ts.isArrayBindingPattern(param.name) && isJsSourceFile(param.getSourceFile()) && !param.type &&
+        !/@(?:param|type)\b/.test(param.getSourceFile().text.slice(param.parent?.pos ?? param.pos, param.getStart()))) {
+        if (param.dotDotDotToken)
+            return { type: DYN, mode: "dynRest" };
+        return param.initializer ? { type: DYN, mode: "omittable", bodyType: DYN } : { type: DYN, mode: "required" };
+    }
+    if (lowerer.checkedCallbackParams.has(param)) {
+        if (param.dotDotDotToken)
+            return { type: DYN, mode: "dynRest" };
+        return param.initializer
+            ? { type: DYN, mode: "omittable", bodyType: DYN }
+            : { type: DYN, mode: "required" };
+    }
     const moduleNs = lowerer.moduleNsParamOverrides.get(param);
     if (moduleNs !== undefined) {
         return { type: moduleNs, mode: param.questionToken ? "omittable" : "required" };
@@ -159,21 +185,7 @@ export function paramShape(lowerer, param) {
             // default when the argument was omitted or undefined, then the
             // pattern destructures the picked value (declareParams).
             const raw = lowerer.irTypeOf(param.name);
-            // A DYNAMIC-TIER pattern source (`function f({} = a)` with
-            // `a: any` — jsval for island values, dyn for the checked-dynamic
-            // dyn): the slot holds its tier's undefined DIRECTLY, so the ABI
-            // is the slot itself — no synthesized union; the prologue tests
-            // undefined at runtime (declareParams).
-            if (raw.kind === "dyn" || raw.kind === "jsval") {
-                return { type: raw, mode: "omittable", bodyType: raw };
-            }
-            const bodyType = lowerer.stripUndefinedArm(raw);
-            lowerer.checkDefaultParamBodyType(param, bodyType);
-            const abi = bodyType.kind === "union" ? lowerer.withUndefinedArmOf(bodyType) : lowerer.withUndefinedArm(bodyType);
-            if (!abi) {
-                lowerer.badType(param.name, lowerer.typeOf(param.name)); // defensive: unknown union id
-            }
-            return { type: abi, mode: "omittable", bodyType };
+            return defaultParameterShape(lowerer, param, raw);
         }
         return { type: lowerer.runtimeOptionalBindingType(param.name, lowerer.irTypeOf(param.name)), mode: "required" };
     }
@@ -207,41 +219,12 @@ export function paramShape(lowerer, param) {
     }
     if (param.initializer) {
         const raw = lowerer.irTypeOf(param.name);
-        // A DYNAMIC-TIER defaulted param (`function f(x = a)` with `a: any`
-        // — tsc types x any; jsval for island values, dyn for the checked-
-        // dynamic dyn): the slot holds its tier's undefined directly, so
-        // the ABI is the slot itself and the prologue's default test is the
-        // runtime undefined test (declareParams).
-        if (raw.kind === "dyn" || raw.kind === "jsval") {
-            return { type: raw, mode: "omittable", bodyType: raw };
-        }
-        // A default that may ITSELF be undefined (`x = process.env.FOO`):
-        // tsc keeps undefined in the body's type, so there is nothing to
-        // narrow — the ABI union IS the body type and the prologue passes a
-        // present argument through unchanged (declareParams's pass-through
-        // branch). The generic strip-and-narrow below would demand a
-        // `string`-typed default and fence on the union re-tag.
-        if (lowerer.bareUndefinedArmedUnion(raw)) {
-            const initT = lowerer.mapTypeOf(lowerer.typeOf(param.initializer));
-            if (initT && (initT.kind === "undefinedT" || lowerer.bareUndefinedArmedUnion(initT))) {
-                return { type: raw, mode: "omittable", bodyType: raw };
-            }
-        }
-        const bodyType = lowerer.stripUndefinedArm(raw);
-        lowerer.checkDefaultParamBodyType(param, bodyType);
-        // A UNION body type (`tlds: string | string[] = "localhost"`) arms
-        // the ABI with undefined ON TOP of the body's arms; the prologue
-        // re-tags a present argument back into the body union (undefined
-        // sorts last among arm typeKeys in practice, so the mapping is
-        // usually the identity prefix — the interned retag helper handles
-        // any order).
-        const abi = bodyType.kind === "union" ? lowerer.withUndefinedArmOf(bodyType) : lowerer.withUndefinedArm(bodyType);
-        if (!abi) {
-            lowerer.badType(param.name, lowerer.typeOf(param.name)); // defensive: unknown union id
-        }
-        return { type: abi, mode: "omittable", bodyType };
+        return defaultParameterShape(lowerer, param, raw);
     }
     const type = lowerer.runtimeOptionalBindingType(param.name, lowerer.irTypeOf(param.name));
+    if (type.kind === "void") {
+        return { type: DYN, mode: param.questionToken ? "omittable" : "required" };
+    }
     if (param.questionToken && !lowerer.bareUndefinedArmedUnion(type) && type.kind !== "dyn" && type.kind !== "jsval") {
         // `x?: unknown` where unknown came from an annotation: undefined is
         // absorbed into the hole type, so no undefined ARM exists — but a
@@ -269,7 +252,7 @@ export function paramShapes(lowerer, params, signature, blameOf) {
     return params.map((declParam, i) => {
         const symbol = signature.getParameters()[i];
         const tsType = symbol ? lowerer.checker.getTypeOfSymbol(symbol) : lowerer.typeOf(declParam.name);
-        const mapped = lowerer.runtimeOptionalBindingType(declParam.name, lowerer.mapTypeOf(tsType) ?? lowerer.irTypeOf(declParam.name));
+        const mapped = jsOpenObjectType(declParam, lowerer.runtimeOptionalBindingType(declParam.name, lowerer.mapTypeOf(tsType) ?? lowerer.irTypeOf(declParam.name)), lowerer.shapes, lowerer.unions);
         if (!mapped || mapped.kind === "void")
             lowerer.badType(blameOf?.(declParam, i) ?? declParam.name, tsType);
         if (declParam.dotDotDotToken) {
@@ -277,30 +260,46 @@ export function paramShapes(lowerer, params, signature, blameOf) {
                 lowerer.badType(blameOf?.(declParam, i) ?? declParam.name, tsType);
             return { type: mapped, mode: "rest" };
         }
-        if (declParam.initializer) {
-            if (mapped.kind === "dyn" || mapped.kind === "jsval") {
-                return { type: mapped, mode: "omittable", bodyType: mapped };
-            }
-            const bodyType = lowerer.stripUndefinedArm(mapped);
-            lowerer.checkDefaultParamBodyType(declParam, bodyType);
-            return { type: lowerer.withUndefinedArm(bodyType), mode: "omittable", bodyType };
-        }
+        if (declParam.initializer)
+            return defaultParameterShape(lowerer, declParam, mapped);
         if (declParam.questionToken && !lowerer.bareUndefinedArmedUnion(mapped)) {
             lowerer.unsupported("SC1090", declParam, `optional parameters of type '${lowerer.fmt(mapped)}'`);
         }
         return { type: mapped, mode: declParam.questionToken ? "omittable" : "required" };
     });
 }
+/** A default expression may itself yield undefined. Keep that arm in the
+ * body and parameter-property storage, including for literal `undefined`
+ * and void expressions: the general type mapper represents those as VOID,
+ * so checking only a mapped undefinedT silently erased a valid value.
+ * Shared by declared and instantiated signatures, including destructuring. */
+function defaultParameterShape(lowerer, param, raw) {
+    if (raw.kind === "dyn" || raw.kind === "jsval") {
+        return { type: raw, mode: "omittable", bodyType: raw };
+    }
+    if (lowerer.bareUndefinedArmedUnion(raw) && param.initializer) {
+        const initializer = lowerer.typeOf(param.initializer);
+        const parts = initializer.isUnionType() ? ts.constituentTypes(initializer) : [initializer];
+        if (parts.some((part) => (part.flags & (ts.TypeFlags.Undefined | ts.TypeFlags.Void)) !== 0)) {
+            return { type: raw, mode: "omittable", bodyType: raw };
+        }
+    }
+    const bodyType = lowerer.stripUndefinedArm(raw);
+    lowerer.checkDefaultParamBodyType(param, bodyType);
+    const abi = bodyType.kind === "union" ? lowerer.withUndefinedArmOf(bodyType) : lowerer.withUndefinedArm(bodyType);
+    if (!abi)
+        lowerer.badType(param.name, lowerer.typeOf(param.name));
+    return { type: abi, mode: "omittable", bodyType };
+}
 /** The fences on a defaulted parameter's body type: it becomes the value
    * arm of the synthesized `T | undefined` ABI union, so it must be a valid
-   * single arm. func and Set ARE valid here: the ABI union's only test is
+   * single arm. Functions, Maps and Sets are valid: the ABI union's test is
    * the prologue's own undefined-tag check (never a user narrowing, which
-   * is what keeps map/set out of general unions), so `runner: Runner =
+   * is what keeps containers out of unions with data siblings), so `runner: Runner =
    * defaultRunner` and `skip: Set<string> = new Set()` arm like any ref
    * kind — the nullable-callback union shape, built by the compiler. */
 export function checkDefaultParamBodyType(lowerer, param, bodyType) {
     if (bodyType.kind === "void" ||
-        bodyType.kind === "map" ||
         bodyType.kind === "regex" ||
         bodyType.kind === "date" ||
         bodyType.kind === "dyn" ||
@@ -336,7 +335,62 @@ export function completeArgs(lowerer, argNodes, shapes, loc, blame,
  * coercion an ordinary argument gets (coerceInto against its shape,
  * DYN conversion in a dyn rest, element coercion in a typed rest). */
 leading) {
-    const isIr = (s) => s !== undefined && !("kind" in s);
+    // Conversion eligibility can traverse the whole recursive parameter
+    // graph. Ordinary calls and fixed tuples never need that analysis.
+    if (argNodes.some((arg) => ts.isSpreadElement(arg) && !fixedTupleSpreadInfo(lowerer, arg.expression)) &&
+        canCompleteRuntimeSpread(lowerer, shapes)) {
+        // Runtime-length spreads determine the complete argument list before
+        // any parameter default runs. Build it once in source order, then
+        // extract the fixed native ABI slots; missing elements are undefined.
+        const pack = lowerer.declareHiddenLocal("%spreadArgs", DYN);
+        const ref = () => ({ kind: "varRef", localId: pack.id, type: DYN, loc });
+        const stmts = [{ kind: "varDecl", localId: pack.id, init: { kind: "dynArrLit", elems: [], type: DYN, loc }, loc }];
+        const push = (value, fn) => {
+            stmts.push({ kind: "exprStmt", expr: { kind: "libCall", fn, args: [ref(), value], type: VOID, loc: value.loc }, loc: value.loc });
+        };
+        for (const value of leading ?? [])
+            push(lowerer.coerceInto(blame, value, DYN), "dyn.packPush");
+        const spreads = argNodes.filter(ts.isSpreadElement).length;
+        argNodes.forEach((arg, index) => {
+            if (!ts.isSpreadElement(arg)) {
+                push(lowerer.lowerExprExpecting(arg, DYN), "dyn.packPush");
+                return;
+            }
+            let value = lowerer.lowerExpr(arg.expression);
+            if (value.type.kind === "set") {
+                value = { kind: "setIntrinsic", method: "toArray", receiver: value, args: [], type: arrayOf(value.type.elem), loc: value.loc };
+            }
+            else if (value.type.kind === "object") {
+                value = lowerer.classIteratorDrainCall(value, locOf(arg)) ?? value;
+            }
+            if (value.type.kind === "array") {
+                // Argument iteration materializes holes as present undefined
+                // before conversion to the dense checked-dynamic argument pack.
+                value = { kind: "arrayLit", elems: [value], spreads: [0], type: value.type, loc: value.loc };
+            }
+            value = lowerer.coerceInto(arg.expression, value, DYN);
+            if (spreads === 1 && index === argNodes.length - 1) {
+                stmts.push({ kind: "exprStmt", expr: {
+                        kind: "libCall", fn: "dyn.packPushSpread", args: [ref(), value, { kind: "strLit", value: arg.expression.getText(), type: STRING, loc }], type: VOID, loc,
+                    }, loc });
+            }
+            else
+                push(value, "dyn.packPushSpreadIter");
+        });
+        const args = shapes.map((shape, index) => {
+            if (shape.mode === "arguments")
+                return ref();
+            const value = shape.mode === "rest" || shape.mode === "dynRest"
+                ? { kind: "dynInvoke", recv: ref(), method: "slice", calleeName: "arguments.slice", args: [{ kind: "dynFrom", value: { kind: "numLit", value: index, type: F64, loc }, type: DYN, loc }], type: DYN, loc }
+                : { kind: "dynKeyGet", value: ref(), key: { kind: "strLit", value: String(index), type: STRING, loc }, type: DYN, loc };
+            return lowerer.coerceInto(blame, value, shape.type);
+        });
+        // Every supported form has at least one native slot to carry the
+        // evaluation prefix, including calls whose only slot is their rest.
+        args[0] = { kind: "seqExpr", stmts, result: args[0], type: args[0].type, loc };
+        return args;
+    }
+    const isIr = (s) => s !== undefined && !(s instanceof AstNode);
     const sources = leading?.map((ir) => ({ ir })) ?? [];
     for (const arg of argNodes) {
         if (!ts.isSpreadElement(arg)) {
@@ -399,9 +453,20 @@ leading) {
                 lowerer.unsupported("SC1090", source, "spread arguments into fixed parameter positions (a spread can only fill a rest parameter)");
             }
             const slotType = i < restAt ? positional[i].type : DYN;
-            const value = isIr(source)
-                ? lowerer.coerceInto(blame, source.ir, slotType)
-                : lowerer.lowerExprExpecting(source, slotType);
+            let value;
+            if (isIr(source)) {
+                let ir = source.ir;
+                // Tuple-spread storage also feeds later arguments. Declare it in
+                // this shared sequence, not inside one argument's initializer,
+                // whose statement frame ends before the next field is read.
+                if (ir.kind === "seqExpr") {
+                    stmts.push(...ir.stmts);
+                    ir = ir.result;
+                }
+                value = lowerer.coerceInto(blame, ir, slotType);
+            }
+            else
+                value = lowerer.lowerExprExpecting(source, slotType);
             const saved = lowerer.declareHiddenLocal("%callArg", slotType);
             stmts.push({ kind: "varDecl", localId: saved.id, init: value, loc: value.loc });
             return { kind: "varRef", localId: saved.id, type: slotType, loc: value.loc };
@@ -409,7 +474,7 @@ leading) {
         const fixed = positional.map((shape, i) => {
             if (i < passed.length)
                 return passed[i];
-            if (shape.mode === "omittable")
+            if (shape.mode === "omittable" || lowerer.bareUndefinedArmedUnion(shape.type))
                 return shape.callDefault ?? lowerer.undefinedArgFor(shape.type, loc, blame);
             if (shape.type.kind === "dyn")
                 return { kind: "dynFrom", value: { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc }, type: DYN, loc };
@@ -434,9 +499,19 @@ leading) {
             // completion has no home for that. Spreads fill REST slots only.
             lowerer.unsupported("SC1090", arg, "spread arguments into fixed parameter positions (a spread can only fill a rest parameter)");
         }
-        if (arg)
+        if (arg) {
+            let operand = arg;
+            while (ts.isParenthesizedExpression(operand))
+                operand = operand.expression;
+            if (ts.isVoidExpression(operand)) {
+                const absent = omittedArgFor(lowerer, shape.type, loc);
+                const effect = lowerStaticallyUndefinedArgument(lowerer, operand);
+                if (absent && effect)
+                    return defaultAfterUndefined(effect, absent);
+            }
             return lowerer.lowerExprExpecting(arg, shape.type);
-        if (shape.mode !== "omittable") {
+        }
+        if (shape.mode !== "omittable" && !lowerer.bareUndefinedArmedUnion(shape.type)) {
             // A missing argument for a CHECKED-DYNAMIC param (an implicit-any
             // JS signature called short — `mustCall(fn)` with `expected`
             // omitted): JS fills undefined, and the dyn slot holds exactly
@@ -565,8 +640,7 @@ leading) {
                 lowerer.unsupported("SC1090", a, "spread arguments into fixed parameter positions (a spread can only fill a rest parameter)");
             }
             const v = lowerer.lowerExpr(a);
-            if (v.kind !== "unitLit" && v.kind !== "numLit" && v.kind !== "strLit" &&
-                v.kind !== "boolLit" && v.kind !== "varRef" && v.kind !== "closure") {
+            if (!isSafeToDiscard(v)) {
                 lowerer.unsupported("SC1090", a, "surplus arguments with side effects (JS evaluates surplus arguments to a function without a rest parameter, then drops them; only effect-free surplus arguments compile)");
             }
         }
@@ -690,7 +764,9 @@ export function requireExactArityValue(lowerer, blame, contextual, shapes, funcT
     // slot): judge by the expression's OWN completed type; the slot's
     // coercion still enforces (or adapts) the flow it lands in.
     if (mappedFn?.kind !== "func" && contextual) {
-        mappedFn = lowerer.mapTypeOf(lowerer.typeOf(contextual));
+        const ownType = lowerer.typeOf(contextual);
+        mappedFn = lowerer.mapTypeOf(ownType) ??
+            (isJsSourceFile(contextual.getSourceFile()) ? dynFallbackType(lowerer, contextual, ownType) : null);
     }
     if (mappedFn && typeEquals(mappedFn, funcType))
         return;
@@ -795,7 +871,7 @@ export function appendImplicitUndefinedReturn(lowerer, body, bodyReturn, loc) {
 /** A declaration's checker-derived IR return type. The unmappable-type
    * diagnostic points at `blame` (the name for top-level declarations, the
    * whole node for lambda-likes — preserving each caller's historical loc). */
-function hasExplicitJsDocReturn(decl) {
+export function hasExplicitJsDocReturn(decl) {
     const sourceFile = decl.getSourceFile();
     return /@returns?\b/.test(sourceFile.text.slice(decl.pos, decl.getStart(sourceFile)));
 }
@@ -805,11 +881,25 @@ function promiseCarriesDyn(lowerer, type) {
     return type.kind === "union" &&
         (lowerer.unions.get(type.unionId)?.arms.some((arm) => promiseCarriesDyn(lowerer, arm)) ?? false);
 }
+function producesConstructor(lowerer, type) {
+    let result = type;
+    for (let depth = 0; result && depth < 8; depth++) {
+        if (lowerer.checker.getConstructSignatures(result).length > 0)
+            return true;
+        const signatures = lowerer.checker.getCallSignatures(result);
+        result = signatures.length === 1 ? lowerer.checker.getReturnTypeOfSignature(signatures[0]) : undefined;
+    }
+    return false;
+}
 export function declaredReturnType(lowerer, decl, blame) {
     const sig = lowerer.checker.getSignatureFromDeclaration(decl);
     if (!sig)
         lowerer.unsupported("SC1090", decl, "this function form");
     const retTsType = lowerer.checker.getReturnTypeOfSignature(sig);
+    // An inferred null/undefined return in JS can read a mutable checked-value
+    // field. Keep the actual value instead of restricting it to the initializer.
+    if (isJsSourceFile(decl.getSourceFile()) && (retTsType.flags & (ts.TypeFlags.Null | ts.TypeFlags.Undefined)) !== 0)
+        return DYN;
     // A body that always throws infers `never` — as a RETURN type that is
     // void with a stronger guarantee (`() => never` is assignable to
     // `() => void`), and throw-only callbacks are ordinary code
@@ -817,10 +907,36 @@ export function declaredReturnType(lowerer, decl, blame) {
     if (retTsType.flags & ts.TypeFlags.Never)
         return VOID;
     const mappedReturn = lowerer.mapTypeOf(retTsType);
+    if (isJsSourceFile(decl.getSourceFile()) && mappedReturn?.kind === "array" && mappedReturn.elem.kind === "f64")
+        return DYN;
+    if (isJsSourceFile(decl.getSourceFile()) && !decl.type && !hasExplicitJsDocReturn(decl) && mappedReturn?.kind === "date")
+        return DYN;
+    // JS inference assigns Number to arithmetic over any, although the
+    // runtime operands can both be BigInts. Preserve that native result.
+    if (isJsSourceFile(decl.getSourceFile()) && !decl.type && !hasExplicitJsDocReturn(decl) &&
+        mappedReturn?.kind === "f64") {
+        let numericAnyReturn = false;
+        const numeric = new Set([ts.SyntaxKind.MinusToken, ts.SyntaxKind.AsteriskToken,
+            ts.SyntaxKind.SlashToken, ts.SyntaxKind.PercentToken, ts.SyntaxKind.AsteriskAsteriskToken]);
+        const check = (node) => {
+            if (node !== decl && ts.isFunctionLike(node))
+                return;
+            const value = ts.isReturnStatement(node) ? node.expression
+                : node === decl && ts.isArrowFunction(decl) && !ts.isBlock(decl.body) ? decl.body : undefined;
+            if (value && ts.isBinaryExpression(value) && numeric.has(value.operatorToken.kind) &&
+                [value.left, value.right].some((operand) => (lowerer.typeOf(operand).flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !== 0))
+                numericAnyReturn = true;
+            node.forEachChild(check);
+        };
+        check(decl);
+        if (numericAnyReturn)
+            return DYN;
+    }
     if (isJsSourceFile(decl.getSourceFile()) &&
         !hasExplicitJsDocReturn(decl) &&
         mappedReturn !== null &&
         promiseCarriesDyn(lowerer, mappedReturn) &&
+        !decl.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.AsyncKeyword) &&
         decl.parameters.some((param) => {
             const mapped = lowerer.mapTypeOf(lowerer.typeOf(param.name));
             return mapped === null || mapped.kind === "dyn";
@@ -852,14 +968,22 @@ export function declaredReturnType(lowerer, decl, blame) {
     // checked-dynamic (or none): a lambda with RECORD-typed parameters
     // (a reduce reducer over a typed array) legitimately returns its
     // parameters' records and keeps the static type.
+    // Native-only members (such as Int32Array layout offsets) cannot cross
+    // that boundary; their factories keep the native record ABI.
+    const asyncReturn = decl.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.AsyncKeyword) && mappedReturn?.kind === "promise";
+    const recordReturn = asyncReturn ? mappedReturn.inner : mappedReturn;
+    const recordArms = recordReturn?.kind === "union" ? lowerer.unions.get(recordReturn.unionId)?.arms : recordReturn ? [recordReturn] : undefined;
+    const inferredRecordReturn = recordArms?.some((arm) => arm.kind === "record" || arm.kind === "object") &&
+        recordArms.every((arm) => isUnitType(arm) || arm.kind === "record" || arm.kind === "object" && !hasExplicitJsDocReturn(decl));
     if (isJsSourceFile(decl.getSourceFile()) &&
         decl.type === undefined &&
-        lowerer.mapTypeOf(retTsType)?.kind === "record" &&
+        recordReturn !== null && recordReturn !== undefined && inferredRecordReturn &&
+        lowerer.dynConvertible(recordReturn) &&
         decl.parameters.every((p) => {
             const mt = lowerer.mapTypeOf(lowerer.typeOf(p));
             return mt === null || mt.kind === "dyn";
         })) {
-        return DYN;
+        return asyncReturn ? { kind: "promise", inner: DYN } : DYN;
     }
     const returnType = lowerer.mapTypeOf(retTsType);
     if (!returnType) {
@@ -884,7 +1008,7 @@ export function declaredReturnType(lowerer, decl, blame) {
    * other unmappable type (the caller's badType reports those). */
 function fenceGenericSignatureResult(lowerer, blame, t) {
     const parts = t.isUnionType() ? ts.constituentTypes(t) : [t];
-    if (!parts.some((p) => lowerer.checker.getCallSignatures(p).some((s) => (s.typeParameters?.length ?? 0) > 0))) {
+    if (!parts.some((p) => lowerer.checker.getCallSignatures(p).some((s) => s.getTypeParameters().length > 0))) {
         return;
     }
     lowerer.unsupported("SC1090", blame, `results that are themselves generic functions ('${lowerer.checker.typeToString(t)}' keeps its type parameters — no call-site instantiation pins them, and the returned value would need the producing call's frame; restructure to one generic function taking all arguments)`);
@@ -961,7 +1085,7 @@ export function collectSignatureInner(lowerer, decl) {
     if (!params.some((sh) => sh.mode === "rest" || sh.mode === "dynRest" || sh.mode === "islandRest") &&
         isJsSourceFile(decl.getSourceFile()) &&
         bodyReadsArguments(decl)) {
-        if (decl.parameters.length > 0 && !isNodeEsmFile(decl.getSourceFile())) {
+        if (decl.parameters.length > 0 && !isNodeEsmFile(decl.getSourceFile(), lowerer.program)) {
             lowerer.unsupported("SC1090", decl, "parameterized 'arguments' outside an ES module (sloppy-mode parameter aliases)");
         }
         params.push({ type: DYN, mode: decl.parameters.length > 0 ? "arguments" : "dynRest" });
@@ -1193,7 +1317,7 @@ export function inferTypeParamBindings(lowerer, expr, info, rsig, tsBindings) {
             return;
         const taT = lowerer.checker.getTypeFromTypeNode(ta);
         const mapped = lowerer.mapTypeOf(taT);
-        if (mapped && mapped.kind !== "void") {
+        if (mapped) {
             bindings.set(tp, mapped);
             tsBindings?.set(tp, taT);
         }
@@ -1213,7 +1337,7 @@ function bindDefaultTypeParams(lowerer, typeParams, typeParamDecls, bindings, ts
             return;
         const defT = lowerer.checker.getTypeFromTypeNode(tpDecl.defaultType);
         const mapped = lowerer.mapTypeOf(defT);
-        if (mapped && mapped.kind !== "void") {
+        if (mapped) {
             bindings.set(tp, mapped);
             tsBindings?.set(tp, defT);
         }
@@ -1255,7 +1379,10 @@ function unifySignatureBindings(lowerer, info, rsig, bindings, tsBindings) {
                 }
                 if (!bindings.has(sym)) {
                     const mapped = lowerer.mapTypeOf(inst);
-                    if (mapped && mapped.kind !== "void")
+                    // A visitor's inferred T can be void. It still binds the
+                    // return convention of `(node) => T`; discarding it leaves
+                    // the callback's return type spuriously uninstantiated.
+                    if (mapped)
                         bindings.set(sym, mapped);
                 }
             }
@@ -1270,10 +1397,20 @@ function unifySignatureBindings(lowerer, info, rsig, bindings, tsBindings) {
         // unbound type parameter surfaces as a mapping diagnostic later).
         if (declared.isUnionType()) {
             const unitFlags = ts.TypeFlags.Undefined | ts.TypeFlags.Null;
-            const dParts = ts.constituentTypes(declared).filter((t) => !(t.flags & unitFlags));
-            const iParts = inst.isUnionType() ? ts.constituentTypes(inst).filter((t) => !(t.flags & unitFlags)) : [inst];
+            const declaredParts = ts.constituentTypes(declared);
+            const declaredUnits = declaredParts.reduce((flags, t) => flags | (t.flags & unitFlags), 0);
+            const dParts = declaredParts.filter((t) => !(t.flags & unitFlags));
+            const iParts = inst.isUnionType() ? ts.constituentTypes(inst).filter((t) => !(t.flags & declaredUnits)) : [inst];
             if (dParts.length === 1 && iParts.length === 1)
                 unify(dParts[0], iParts[0], depth + 1);
+            else if (dParts.length === 1 && iParts.length > 1 &&
+                iParts.every((t) => (t.flags & unitFlags) === 0)) {
+                // T | undefined can receive boolean | undefined: boolean itself
+                // has two literal arms. There is still one declared data slot,
+                // so match it against the whole remaining union. Removing null
+                // too is safe only when no undeclared null arm remains.
+                unify(dParts[0], lowerer.checker.getNonNullableType(inst), depth + 1);
+            }
             return;
         }
         // Instantiations of the SAME generic ALIAS (Partial<T> vs
@@ -1426,16 +1563,21 @@ export function lowerGenericInstance(lowerer, info, inst) {
         fnCtx.generator = generatorMeta(lowerer, inst.returnType);
     }
     lowerer.fnStack.push(fnCtx);
+    lowerer.localClassInstantiations.push({ owner: decl, name: inst.name });
     try {
-        // STATIC generic methods: `this`/`super` name the RECEIVER class (a
-        // dynamic value) — the lowerStaticMethod fence, applied here because
-        // generic statics have no non-generic lowering pass. Arrow functions
-        // are transparent (they inherit the method's `this`); this-binding
-        // function forms are opaque.
+        // Static specializations bind lexical this only when the caller
+        // proved its exact receiver. Other instances retain the fence;
+        // super remains unsupported. Arrows inherit the lexical receiver.
         if (info.member?.kind === "static" && decl.body) {
-            rejectStaticThis(lowerer, decl.body, (keyword) => `'${keyword}' in static methods (it names the RECEIVER class — a dynamic value; reference the class by name instead)`);
+            rejectStaticThis(lowerer, decl.body, (keyword) => `'${keyword}' in static methods (it names the RECEIVER class — a dynamic value; reference the class by name instead)`, false, info.staticReceiver !== undefined);
         }
         const params = [];
+        const receiverInit = [];
+        if (info.staticReceiver) {
+            const value = lowerer.classValueRef(info.staticReceiver, decl);
+            const local = lowerer.declareThis(value.type);
+            receiverInit.push({ kind: "varDecl", localId: local.id, init: value, loc: locOf(decl) });
+        }
         if (cls && info.member.kind === "method") {
             // Instance methods take `this` as param 0, exactly like plain
             // `%C.method` functions (lowerClassMethodMemberInner).
@@ -1447,12 +1589,13 @@ export function lowerGenericInstance(lowerer, info, inst) {
         // threaded — a default mentioning T resolves like any body expression.
         const declared = lowerer.declareParams(decl.parameters, inst.params);
         params.push(...declared.params);
-        const body = [...declared.prologue];
+        const body = [...receiverInit, ...declared.prologue];
         const bodyBlock = blockBodyOf(decl);
         if (bodyBlock) {
             body.push(...lowerer.lowerStmts(bodyBlock.statements));
             if (fnCtx.inferReturn) {
                 bodyReturn = resolveInferredReturn(lowerer, inst, fnCtx.inferReturn, body, decl);
+                inst.returnType = bodyReturn;
             }
             appendImplicitUndefinedReturn(lowerer, body, bodyReturn, locOf(decl));
         }
@@ -1466,6 +1609,7 @@ export function lowerGenericInstance(lowerer, info, inst) {
                 if (value.type.kind === "void") {
                     body.push({ kind: "exprStmt", expr: value, loc: locOf(decl.body) });
                     bodyReturn = resolveInferredReturn(lowerer, inst, fnCtx.inferReturn, body, decl);
+                    inst.returnType = bodyReturn;
                     appendImplicitUndefinedReturn(lowerer, body, bodyReturn, locOf(decl));
                 }
                 else {
@@ -1473,6 +1617,7 @@ export function lowerGenericInstance(lowerer, info, inst) {
                     fnCtx.inferReturn.entries.push({ stmt, node: decl.body });
                     body.push(stmt);
                     bodyReturn = resolveInferredReturn(lowerer, inst, fnCtx.inferReturn, body, decl);
+                    inst.returnType = bodyReturn;
                 }
             }
             else {
@@ -1490,6 +1635,8 @@ export function lowerGenericInstance(lowerer, info, inst) {
         }
         const fn = {
             name: inst.name,
+            sourceName: info.baseName,
+            ...(!isAsync && !decl.asteriskToken && (ts.isFunctionDeclaration(decl) || ts.isFunctionExpression(decl)) ? { ownsPrototype: true } : {}),
             params,
             returnType: bodyReturn,
             locals: lowerer.ctx.locals,
@@ -1509,6 +1656,7 @@ export function lowerGenericInstance(lowerer, info, inst) {
         lowerer.typeParamTsBindings = prevTsBindings;
         lowerer.implicitParamTypes = prevImplicit;
         lowerer.instantiationContext = prevContext;
+        lowerer.localClassInstantiations.pop();
         lowerer.suppressStats = prevSuppress;
     }
 }
@@ -1524,14 +1672,15 @@ export function lowerGenericInstance(lowerer, info, inst) {
    * adds JS's undefined; DYN when returns disagree (the checked-dynamic
    * result slot — today's shape). Same-key recursion PINNED the fallback
    * type mid-lowering (callers already hold it), so a pinned instance
-   * keeps it and the wrap pass coerces every return to the pin. */
+   * keeps it and the wrap pass coerces every return to the pin. Callers
+   * store the settled type on their full instance; this narrower view
+   * can be a structural copy in native builds. */
 function resolveInferredReturn(lowerer, inst, infer, body, decl) {
     // The conservative completion test appendImplicitUndefinedReturn uses:
     // a body whose last statement isn't a terminator may complete without
     // returning — JS answers undefined.
     const last = body[body.length - 1];
     const mayFallThrough = !last || !(last.kind === "return" || last.kind === "throw" || last.kind === "rethrow" || last.kind === "runtimeFence");
-    const valued = infer.entries.filter((e) => e.stmt.kind === "return" && e.stmt.value !== null && e.stmt.value !== undefined);
     const sawBare = mayFallThrough || infer.entries.some((e) => e.stmt.kind === "return" && (e.stmt.value === null || e.stmt.value === undefined));
     let final;
     if (inst.returnPinned) {
@@ -1539,43 +1688,46 @@ function resolveInferredReturn(lowerer, inst, infer, body, decl) {
     }
     else {
         const distinct = [];
-        for (const e of valued) {
-            if (!distinct.some((t) => typeEquals(t, e.stmt.value.type)))
-                distinct.push(e.stmt.value.type);
+        for (const e of infer.entries) {
+            if (e.stmt.kind !== "return" || e.stmt.value === null || e.stmt.value === undefined)
+                continue;
+            const type = e.stmt.value.type;
+            if (!distinct.some((t) => typeEquals(t, type)))
+                distinct.push(type);
         }
         if (distinct.length === 0) {
             final = DYN; // no valued return: JS completes with undefined — the dyn undefined, today's slot
         }
         else if (distinct.length === 1) {
             const t = distinct[0];
-            final = !sawBare ? t : t.kind === "dyn" ? DYN : (lowerer.withUndefinedArmOf(t) ?? DYN);
+            final = isUnitType(t) ? DYN : !sawBare ? t : t.kind === "dyn" ? DYN : (lowerer.withUndefinedArmOf(t) ?? DYN);
         }
         else {
             final = DYN; // disagreeing returns: the checked-dynamic join
         }
-        inst.returnType = final;
     }
     // The wrap pass: settle every recorded return onto `final`, in place.
+    // Write through the stored union arm: optional-field widening on a
+    // local alias can otherwise introduce a record copy in native builds.
     for (const e of infer.entries) {
         if (e.stmt.kind !== "return")
             continue;
-        const st = e.stmt;
         const diagsBefore = lowerer.diags.length;
         try {
-            if (st.value === null || st.value === undefined) {
+            if (e.stmt.value === null || e.stmt.value === undefined) {
                 if (final.kind === "dyn")
-                    st.value = dynUndefinedExpr(st.loc);
+                    e.stmt.value = dynUndefinedExpr(e.stmt.loc);
                 else if (final.kind === "union") {
-                    const wrapped = lowerer.wrappedUndefined(final, st.loc);
+                    const wrapped = lowerer.wrappedUndefined(final, e.stmt.loc);
                     if (!wrapped) {
                         lowerer.unsupported("SC1090", e.node ?? decl, `bare 'return' in a function whose inferred return type is '${lowerer.fmt(final)}'`);
                     }
-                    st.value = wrapped;
+                    e.stmt.value = wrapped;
                 }
                 // void final: bare return stands as-is
             }
-            else if (!typeEquals(st.value.type, final)) {
-                st.value = lowerer.coerceInto(e.node ?? decl, st.value, final);
+            else if (!typeEquals(e.stmt.value.type, final)) {
+                e.stmt.value = lowerer.coerceInto(e.node ?? decl, e.stmt.value, final);
             }
         }
         catch (err) {
@@ -1590,7 +1742,7 @@ function resolveInferredReturn(lowerer, inst, infer, body, decl) {
                 lowerer.diags.push(...ice);
             lowerer.runtimeFences.push(...captured.filter((d) => d.code !== "SC9001"));
             const first = captured.find((d) => d.code !== "SC9001");
-            const mutable = st;
+            const mutable = e.stmt;
             delete mutable["value"];
             mutable["kind"] = "runtimeFence";
             mutable["code"] = first?.code ?? "SC1090";
@@ -1848,10 +2000,12 @@ function broadPromiseParam(lowerer, type) {
 }
 /** The implicit-type-parameter slots of a JS function-like: parallel to
    * decl.parameters, the param SYMBOL where the slot is a bindable
-   * implicit-any param (identifier-named, no annotation/JSDoc type, not
-   * rest/optional/defaulted, never written), null elsewhere. Null overall
-   * when nothing qualifies — the declaration keeps today's path. */
-export function implicitAnyParamSymbolsOf(lowerer, decl) {
+   * implicit param (identifier-named, broad inferred/JSDoc type, not
+   * rest/optional/defaulted, never written), null elsewhere. Package JS
+   * methods may also specialize class parameters: JSDoc names a nominal
+   * class even when the body accepts other objects with the same members.
+   * Null overall when nothing qualifies — the declaration keeps its ABI. */
+export function implicitAnyParamSymbolsOf(lowerer, decl, classParams = false) {
     if (!decl.body)
         return null;
     if (decl.asteriskToken)
@@ -1877,7 +2031,9 @@ export function implicitAnyParamSymbolsOf(lowerer, decl) {
         const broadFunction = lowerer.checker.typeToString(t) === "Function";
         const broadArray = lowerer.checkerAnyArrayType(t);
         const broadPromise = broadPromiseParam(lowerer, t);
-        if ((t.flags & ts.TypeFlags.Any) === 0 && !broadFunction && !broadArray && !broadPromise)
+        const declaredKind = classParams ? lowerer.mapTypeOf(t)?.kind : undefined;
+        const classParam = classParams && (declaredKind === "object" || declaredKind === "array");
+        if ((t.flags & ts.TypeFlags.Any) === 0 && !broadFunction && !broadArray && !broadPromise && !classParam)
             return null;
         const sym = lowerer.checker.getSymbolAtLocation(param.name);
         if (!sym)
@@ -1896,6 +2052,11 @@ export function implicitAnyParamSymbolsOf(lowerer, decl) {
    * selects return INFERENCE with DYN as the recursion pin. */
 function implicitDeclaredReturn(lowerer, info) {
     try {
+        // Static JS helpers can accept a structurally compatible class despite
+        // narrower JSDoc (for example a Vector2 target documented as Vector3).
+        // Infer their result from the specialized body as well.
+        if (info.member?.kind === "static" && info.decl.parameters.some((param, index) => info.implicitParams?.[index] && lowerer.mapTypeOf(lowerer.typeOf(param.name))?.kind === "object"))
+            return null;
         const broadCallbackSymbols = new Set(info.decl.parameters.flatMap((param, index) => {
             const symbol = info.implicitParams?.[index];
             return symbol !== null && symbol !== undefined &&
@@ -1915,7 +2076,10 @@ function implicitDeclaredReturn(lowerer, info) {
                     expression = expression.expression;
                 if (ts.isCallExpression(expression) &&
                     ts.isIdentifier(expression.expression) &&
-                    broadCallbackSymbols.has(lowerer.checker.getSymbolAtLocation(expression.expression) ?? {})) {
+                    (() => {
+                        const symbol = lowerer.checker.getSymbolAtLocation(expression.expression);
+                        return symbol !== undefined && broadCallbackSymbols.has(symbol);
+                    })()) {
                     returnsBroadCallback = true;
                     return "stop";
                 }
@@ -1930,7 +2094,12 @@ function implicitDeclaredReturn(lowerer, info) {
         const retTs = lowerer.checker.getReturnTypeOfSignature(declSig);
         if (retTs.flags & ts.TypeFlags.Any)
             return null;
+        if (retTs.flags & (ts.TypeFlags.Null | ts.TypeFlags.Undefined))
+            return DYN;
         if (lowerer.checker.isArrayType(retTs)) {
+            if (info.decl.parameters.some((param, index) => info.implicitParams?.[index] &&
+                lowerer.mapTypeOf(lowerer.typeOf(param.name))?.kind === "array"))
+                return null;
             const elem = lowerer.checker.getTypeArguments(retTs)[0];
             // An implicit-any parameter poisons an inferred array result to
             // any[] even when this instance's body produces one concrete
@@ -1941,6 +2110,38 @@ function implicitDeclaredReturn(lowerer, info) {
                 return null;
         }
         const mapped = lowerer.mapTypeOf(retTs);
+        if (mapped?.kind === "symbol" && !hasExplicitJsDocReturn(info.decl))
+            return null;
+        if (mapped?.kind === "date" && !hasExplicitJsDocReturn(info.decl))
+            return DYN;
+        if (!hasExplicitJsDocReturn(info.decl) && info.decl.body) {
+            let openReturn = false;
+            ts.walkPreorder(info.decl.body, (node) => {
+                if (node !== info.decl.body && ts.isFunctionLike(node))
+                    return "skip";
+                if (!ts.isReturnStatement(node) || !node.expression || !ts.isIdentifier(node.expression))
+                    return undefined;
+                const symbol = lowerer.resolveValueSymbol(node.expression);
+                if (symbol && lowerer.checker.declarationsOf(symbol).some((decl) => ts.isVariableDeclaration(decl) && jsBindingHasOpenWrites(lowerer, decl)))
+                    openReturn = true;
+                return undefined;
+            });
+            if (openReturn)
+                return null;
+        }
+        // A JavaScript result inferred from an initial record can later
+        // carry additional fields. Settle its representation from the
+        // lowered returns instead of copying it back into that initial shape.
+        const resultArms = mapped?.kind === "union" ? lowerer.unions.get(mapped.unionId)?.arms : mapped ? [mapped] : [];
+        if (resultArms?.some((arm) => arm.kind === "record" || arm.kind === "object" || arm.kind === "classval") &&
+            resultArms.every((arm) => isUnitType(arm) || arm.kind === "record" || arm.kind === "object" || arm.kind === "classval") &&
+            !hasExplicitJsDocReturn(info.decl))
+            return null;
+        // Inferred variadic results carry runtime argument packs. Their
+        // factory must retain the lowered callable rather than extracting a
+        // fixed native signature from a checked value.
+        if (mapped?.kind === "func" && mapped.rest === true && mapped.restAbi === undefined && !hasExplicitJsDocReturn(info.decl))
+            return null;
         if (mapped !== null && promiseCarriesDyn(lowerer, mapped) && !hasExplicitJsDocReturn(info.decl))
             return null;
         return mapped;
@@ -1972,6 +2173,54 @@ function bindableImplicitIr(t) {
         t.kind !== "void" && t.kind !== "dyn" && t.kind !== "jsval" &&
         t.kind !== "caught" && t.kind !== "undefinedT" && t.kind !== "nullT");
 }
+/** A represented binding or direct callable result can be wider than the
+ * checker's inferred shape. Preserve that boundary when specializing JS. */
+function storedImplicitArgumentType(lowerer, arg) {
+    while (ts.isParenthesizedExpression(arg))
+        arg = arg.expression;
+    if (isJsSourceFile(arg.getSourceFile()) && (ts.isArrowFunction(arg) || ts.isFunctionExpression(arg))) {
+        const saved = lowerer.diagSink;
+        const diagnostics = [];
+        lowerer.diagSink = diagnostics;
+        let value;
+        try {
+            value = tryLowerExpression(lowerer, arg);
+        }
+        finally {
+            lowerer.diagSink = saved;
+        }
+        // Direct inferred helpers can receive native callbacks even when their
+        // result is an opaque handle that cannot cross checked storage.
+        if (diagnostics.length === 0 && value?.type.kind === "func")
+            return value.type;
+    }
+    if (arg.kind === ts.SyntaxKind.ThisKeyword)
+        return lowerer.resolveThis()?.type ?? null;
+    if (ts.isAwaitExpression(arg)) {
+        const awaited = storedImplicitArgumentType(lowerer, arg.expression);
+        return awaited?.kind === "promise" ? awaited.inner : awaited;
+    }
+    if (ts.isObjectLiteralExpression(arg) && isJsSourceFile(arg.getSourceFile()) &&
+        (arg.properties.length === 0 || arg.properties.some((property) => ts.isMethodDeclaration(property) || ts.isAccessor(property) ||
+            !ts.isSpreadAssignment(property) && property.name !== undefined && ts.isComputedPropertyName(property.name))))
+        return DYN;
+    if (ts.isIdentifier(arg))
+        return lowerer.peekLocal(arg)?.type ?? lowerer.globalOf(arg)?.type ?? null;
+    if (ts.isCallExpression(arg) && ts.isIdentifier(arg.expression)) {
+        if (isJsSourceFile(arg.getSourceFile())) {
+            const represented = tryLowerExpression(lowerer, arg);
+            if (represented?.type.kind === "dyn" || represented?.type.kind === "func")
+                return represented.type;
+        }
+        const callee = storedImplicitArgumentType(lowerer, arg.expression);
+        if (callee?.kind === "dyn")
+            return DYN;
+        if (callee?.kind === "func")
+            return callee.ret;
+        return lowerer.fnSigOf(arg.expression)?.returnType ?? null;
+    }
+    return null;
+}
 /** The instance a CALL of an implicit-any function-like names: each
    * bindable implicit param takes the call's WIDENED argument checker type
    * when it maps statically (DYN otherwise — today's slot), typed params
@@ -1994,19 +2243,74 @@ export function implicitCallInstance(lowerer, call, info) {
             bound = declared.type;
         const arg = call.arguments[i];
         if (arg && !ts.isSpreadElement(arg)) {
-            const runtimeLocal = ts.isIdentifier(arg) ? lowerer.peekLocal(arg) : null;
-            if (runtimeLocal?.type.kind === "dyn") {
+            const stored = storedImplicitArgumentType(lowerer, arg);
+            if (stored?.kind === "dyn") {
                 bound = DYN;
                 argTypes.set(sym, lowerer.checker.getUnknownType());
                 shapes.push({ type: bound, mode: "required" });
                 return;
             }
+            // A represented native array must keep its storage when a direct
+            // inferred helper receives it. Re-boxing a checker-any array would
+            // copy it, losing writes (and attempting to read unfilled slots).
+            if (stored?.kind === "array") {
+                argTypes.set(sym, lowerer.typeOf(arg));
+                shapes.push({ type: stored, mode: "required" });
+                return;
+            }
+            if (stored?.kind === "func") {
+                // The lowered closure may have an inferred JS destructuring
+                // parameter widened from the checker's exact tuple to dyn.
+                // Preserve that signature throughout the specialization.
+                const checkerType = lowerer.mapTypeOf(lowerer.typeOf(arg));
+                argTypes.set(sym, checkerType && typeEquals(checkerType, stored)
+                    ? lowerer.typeOf(arg) : lowerer.checker.getUnknownType());
+                shapes.push({ type: stored, mode: "required" });
+                return;
+            }
             // The argument's own checker type, literal-widened ('add' binds
             // string) — typeOf consults the ACTIVE instance's bindings, so a
             // bound param forwarded into another implicit call transitively
             // instantiates it (this._initCommandGroup(command)).
             const t = lowerer.checker.getBaseTypeOfLiteralType(lowerer.typeOf(arg));
-            const mapped = lowerer.mapTypeOf(t) ?? dynFallbackType(lowerer, arg, t);
+            const mapped = (neverTaintedJsType(lowerer, arg, t) ? null : lowerer.mapTypeOf(t)) ?? dynFallbackType(lowerer, arg, t);
+            if (isJsSourceFile(arg.getSourceFile()) && ts.isArrayLiteralExpression(arg) && mapped?.kind === "array" &&
+                (mapped.elem.kind === "classval" || mapped.elem.kind === "union" &&
+                    lowerer.unions.get(mapped.elem.unionId)?.arms.every((arm) => arm.kind === "classval"))) {
+                argTypes.set(sym, lowerer.checker.getUnknownType());
+                shapes.push({ type: DYN, mode: "required" });
+                return;
+            }
+            // JavaScript arguments-based callables travel as checked functions.
+            // Specializing a parameter to the inferred rest signature would
+            // require extracting a native variadic ABI that the value does not
+            // expose. Its checked invocation preserves the complete argument pack.
+            if (mapped?.kind === "func" && mapped.rest === true && mapped.restAbi === undefined) {
+                argTypes.set(sym, lowerer.checker.getUnknownType());
+                shapes.push({ type: DYN, mode: "required" });
+                return;
+            }
+            // JS inference can absorb heterogeneous loop values into `{}`.
+            // That checker supertype is not an empty-record runtime layout:
+            // preserve represented arms through the checked boundary instead
+            // of specializing a call to a union that would discard them.
+            if (isJsSourceFile(arg.getSourceFile()) && mapped?.kind === "func" && !lowerer.dynConvertible(mapped)) {
+                argTypes.set(sym, lowerer.checker.getUnknownType());
+                shapes.push({ type: DYN, mode: "required" });
+                return;
+            }
+            const mappedArms = mapped?.kind === "union" ? lowerer.unions.get(mapped.unionId)?.arms ?? [] : mapped ? [mapped] : [];
+            const hasTopObject = mappedArms.some((arm) => {
+                const shape = arm.kind === "record" ? lowerer.shapes.get(arm.shapeId) : undefined;
+                return shape && !shape.tuple && !shape.indexValue && shape.fields.length === 0;
+            });
+            if (stored?.kind === "union" && hasTopObject && lowerer.dynConvertible(stored) &&
+                lowerer.unions.get(stored.unionId)?.arms.some((arm) => !isUnitType(arm) &&
+                    !mappedArms.some((target) => lowerer.widthLiftPlan(arm, target) !== null))) {
+                argTypes.set(sym, lowerer.checker.getUnknownType());
+                shapes.push({ type: DYN, mode: "required" });
+                return;
+            }
             if (ts.isArrowFunction(arg) &&
                 arg.type === undefined &&
                 mapped?.kind === "func" &&
@@ -2031,15 +2335,32 @@ export function implicitCallInstance(lowerer, call, info) {
 /** The all-dyn DEFAULT instance — today's compiled body exactly: what a
    * VALUE reference of an implicit-any function names (indirect calls
    * carry no per-site types to bind). */
-function implicitDefaultInstance(lowerer, blame, info) {
+export function implicitDefaultInstance(lowerer, blame, info) {
     const shapes = info.decl.parameters.map((param, i) => info.implicitParams[i] ? { type: DYN, mode: "required" } : lowerer.paramShape(param));
-    return internImplicitInstance(lowerer, blame, info, shapes, new Map());
+    const argTypes = new Map();
+    // Newly bindable nominal class parameters must not retain their JSDoc
+    // receiver type in the checked fallback. Keep existing broad JS inference.
+    for (let i = 0; i < info.decl.parameters.length; i++) {
+        const symbol = info.implicitParams?.[i];
+        const kind = lowerer.mapTypeOf(lowerer.typeOf(info.decl.parameters[i].name))?.kind;
+        if (symbol && (kind === "object" || kind === "array")) {
+            argTypes.set(symbol, lowerer.checker.getUnknownType());
+        }
+    }
+    return internImplicitInstance(lowerer, blame, info, shapes, argTypes);
 }
 function internImplicitInstance(lowerer, blame, info, shapes, argTypes) {
     const key = shapes.map((s) => typeKey(s.type)).join(",");
     let inst = info.instances.get(key);
-    if (inst)
+    if (inst?.implicitState === "failed")
+        lowerer.unsupported("SC1090", blame, `the failed specialization of '${info.baseName}'`);
+    if (inst) {
+        // A recursive caller has observed this ABI before inference settles.
+        // Keep the promised return slot and coerce the completed body's returns.
+        if (inst.implicitState === "lowering")
+            inst.returnPinned = true;
         return inst;
+    }
     if (info.instances.size >= MAX_GENERIC_INSTANCES) {
         lowerer.unsupported("SC1090", blame, `unbounded implicit-any instantiation ('${info.baseName}' exceeded ` +
             `${MAX_GENERIC_INSTANCES} instances — polymorphic recursion?)`);
@@ -2065,11 +2386,15 @@ function internImplicitInstance(lowerer, blame, info, shapes, argTypes) {
         ...(declared === null ? { implicitInferReturn: true } : {}),
     };
     info.instances.set(key, inst);
-    // EAGER lowering (nested, the lambda discipline): the call site needs
-    // the settled return type NOW. A body-level poison (a fenced parameter
-    // form) skips the function like lowerFunction's rule — calls then meet
-    // the pinned signature over a missing body, which the linker never
-    // sees because the poison also fenced the call statement.
+    // Eager lowering settles the return ABI before callers use it. A failed
+    // JS body must still have a throwing implementation: later references
+    // (including recursive ones) can already hold its cached signature.
+    const diagsBefore = lowerer.diags.length;
+    // The instance is cached even when a receiver probe requested it.
+    // Its body must retain statement fences instead of dropping failures
+    // into that probe's temporary diagnostic sink and caching empty code.
+    const previousSink = lowerer.diagSink;
+    lowerer.diagSink = null;
     try {
         // Implicit-any instances lower EAGERLY at the call site so their
         // inferred return type is available immediately. They therefore do
@@ -2087,8 +2412,20 @@ function internImplicitInstance(lowerer, blame, info, shapes, argTypes) {
     catch (e) {
         if (!(e instanceof PoisonError))
             throw e;
-        inst.implicitState = "done";
-        throw e;
+        inst.implicitState = "failed";
+        const types = shapes.map((shape) => shape.type);
+        if (info.member?.kind === "method")
+            types.unshift({ kind: "object", className: info.member.cls.def.name });
+        const fn = lowerer.deferToRuntimeFence(diagsBefore, info.decl, {
+            kind: "function", name: inst.name, returnType: inst.returnType,
+            params: types.map((type, index) => ({ localId: `p.${index}`, name: `p${index}`, type })),
+        });
+        if (!fn)
+            throw e;
+        lowerer.implicitFns.push(fn);
+    }
+    finally {
+        lowerer.diagSink = previousSink;
     }
     inst.implicitState = "done";
     return inst;
@@ -2194,11 +2531,11 @@ export function implicitLocalFnInfoOf(lowerer, decl, fnNode) {
     const implicit = implicitAnyParamSymbolsOf(lowerer, fnNode);
     if (!implicit)
         lowerer.unsupported("SC1090", fnNode, "this function form"); // defensive: the probe proved it
-    const stmt = decl.parent.parent;
+    const stmt = decl.parent?.parent;
     const info = {
         decl: fnNode,
         baseName: name,
-        qualifiedName: lowerer.qualify(decl.getSourceFile(), nsPathPrefix(stmt, decl) + `${name}%l${decl.getStart()}`),
+        qualifiedName: lowerer.qualify(decl.getSourceFile(), nsPathPrefix(stmt ?? decl, decl) + `${name}%l${decl.getStart()}`),
         typeParams: [],
         instances: new Map(),
         implicitParams: implicit,
@@ -2409,6 +2746,7 @@ function makeTimerArgsThunk(lowerer, cbNode, argNodes, what, loc) {
                         kind: "dynCall",
                         callee: { kind: "varRef", localId: "f.0", type: DYN, loc },
                         calleeName: "callback",
+                        receiver: { kind: "libCall", fn: "dyn.this", args: [], type: DYN, loc },
                         args: args.map((_, i) => ({ kind: "varRef", localId: `a${i}.0`, type: DYN, loc })),
                         type: DYN,
                         loc,
@@ -2506,7 +2844,15 @@ export function lowerTimersMemberCall(lowerer, expr, member, loc) {
         if (expr.arguments.length !== 1) {
             lowerer.noLowering(`clearTimeout with ${expr.arguments.length} arguments`, expr);
         }
-        const handle = lowerer.lowerExpr(expr.arguments[0]);
+        let handle = lowerer.lowerExpr(expr.arguments[0]);
+        if (handle.type.kind === "dyn" && isJsSourceFile(expr.getSourceFile())) {
+            const stored = lowerer.declareHiddenLocal("%timer.clear", DYN);
+            const ref = varRef(stored.id, DYN, loc);
+            handle = { kind: "seqExpr", stmts: [{ kind: "varDecl", localId: stored.id, init: handle, loc }], result: {
+                    kind: "ternary", cond: { kind: "dynTest", test: "number", value: ref, type: BOOL, loc },
+                    then: lowerer.coerceInto(expr.arguments[0], ref, F64), else_: numLit(0, loc), type: F64, loc,
+                }, type: F64, loc };
+        }
         if (handle.type.kind !== "f64") {
             lowerer.noLowering(`clearTimeout of '${lowerer.fmt(handle.type)}' handles`, expr.arguments[0], "the handle is the Timeout setTimeout returned (narrow 'Timeout | null' first)");
         }
@@ -2573,7 +2919,12 @@ export function lowerTimersMemberCall(lowerer, expr, member, loc) {
     return null;
 }
 function ffiSourceParams(binding) {
-    return binding.params.filter((param) => !isFfiContextParam(param));
+    const params = [];
+    for (const param of binding.params) {
+        if (!isFfiContextParam(param))
+            params.push(param);
+    }
+    return params;
 }
 function ffiParamDisplay(param) {
     return isFfiCallbackParam(param)
@@ -2590,7 +2941,11 @@ function ffiCallbackInputDiagnostic(lowerer, descriptor, callbackType) {
     const signatures = lowerer.checker.getCallSignatures(callbackType);
     if (signatures.length !== 1)
         return null;
-    const nativeParams = descriptor.callback.params.filter((param) => !isFfiContextParam(param));
+    const nativeParams = [];
+    for (const param of descriptor.callback.params) {
+        if (!isFfiContextParam(param))
+            nativeParams.push(param);
+    }
     let nativeIndex = 0;
     const params = signatures[0].getParameters();
     for (let i = 0; i < params.length; i++) {
@@ -2608,12 +2963,13 @@ function ffiCallbackInputDiagnostic(lowerer, descriptor, callbackType) {
         }
         if (nativeClass === "bytes")
             continue;
-        const domain = nativeClass === "bool"
+        const wide = nativeClass === "i64" || nativeClass === "u64" || nativeClass === "pointer";
+        const domain = wide ? "bigint" : nativeClass === "bool"
             ? "boolean"
             : nativeClass === "cstring" || nativeClass === "string"
                 ? "string"
                 : "number";
-        const coversDomain = nativeClass === "bool"
+        const coversDomain = wide ? (paramType.flags & ts.TypeFlags.BigInt) !== 0 : nativeClass === "bool"
             ? (paramType.flags & ts.TypeFlags.Boolean) !== 0
             : nativeClass === "cstring" || nativeClass === "string"
                 ? (paramType.flags & ts.TypeFlags.String) !== 0
@@ -2636,8 +2992,9 @@ function ffiCallbackInputDiagnostic(lowerer, descriptor, callbackType) {
 function ffiReturnDomainDiagnostic(lowerer, nativeClass, returnType) {
     if (nativeClass === "void")
         return null;
-    const domain = nativeClass === "bool" ? "boolean" : "number";
-    const coversDomain = nativeClass === "bool"
+    const wide = nativeClass === "i64" || nativeClass === "u64" || nativeClass === "pointer";
+    const domain = wide ? "bigint" : nativeClass === "bool" ? "boolean" : "number";
+    const coversDomain = wide ? (returnType.flags & ts.TypeFlags.BigInt) !== 0 : nativeClass === "bool"
         ? (returnType.flags & ts.TypeFlags.Boolean) !== 0
         : (returnType.flags & ts.TypeFlags.Number) !== 0;
     return coversDomain
@@ -2745,7 +3102,7 @@ function libraryCallbackOwnsFile(lowerer, file) {
 export function validateFfiImports(lowerer) {
     const diagnostics = [];
     const symbolsByName = new Map();
-    const configuredNames = new Set(lowerer.ffiImports.map((binding) => binding.name));
+    const configuredNames = new Set(lowerer.ffiImports.filter(binding => binding.library === undefined).map((binding) => binding.name));
     const candidates = new Map();
     if (configuredNames.size === 0)
         return { diagnostics, symbolsByName };
@@ -2775,6 +3132,8 @@ export function validateFfiImports(lowerer) {
         });
     }
     for (const binding of lowerer.ffiImports) {
+        if (binding.library !== undefined)
+            continue;
         const bySymbol = candidates.get(binding.name);
         if (bySymbol === undefined || bySymbol.size === 0) {
             // A native-manifest binding with no declaration is a broken build
@@ -2822,6 +3181,8 @@ export function lowerFfiCall(lowerer, expr) {
     if (!ts.isIdentifier(expr.expression))
         return null;
     const binding = lowerer.ffiImportsByName.get(expr.expression.text);
+    if (binding?.library !== undefined)
+        return null;
     if (binding === undefined) {
         // LIBRARY mode with a declared callback surface: a CALL of a
         // program-authored signature-only ambient function that names no
@@ -2855,7 +3216,8 @@ export function lowerFfiCall(lowerer, expr) {
         lowerer.pushDiag(signatureFlavor(binding.name, detail, loc));
         throw new PoisonError();
     };
-    const symbol = lowerer.resolveValueSymbol(expr.expression) ??
+    const symbol = lowerer.resolveValueSymbol(expr.expression);
+    if (!symbol)
         bindingError("the call has no resolved TypeScript symbol");
     if (lowerer.ffiBindingSymbols !== null) {
         const validSymbols = lowerer.ffiBindingSymbols.get(binding.name);
@@ -2938,7 +3300,7 @@ export function lowerFfiCall(lowerer, expr) {
             }
             // An inline function value at a RELEASE site can never match:
             // lifted lambdas always carry a captures list (even an empty one),
-            // so both backends mint a fresh closure per evaluation of the
+            // so the backend creates a fresh closure per evaluation of the
             // expression — the release argument is a pointer no registration
             // holds, a guaranteed runtime trap. Declared functions stay valid
             // here — their value is the interned immortal closure (captures
@@ -3017,6 +3379,14 @@ function lowerProjectedBuiltinCall(lowerer, expr, bi, loc) {
 }
 export function lowerCall(lowerer, expr) {
     const loc = locOf(expr);
+    // Object's checker return type is `any`. Claim known object inputs
+    // before generic checked-dynamic dispatch tries to load the constructor.
+    if (ts.isIdentifier(expr.expression) && expr.expression.text === "Object" &&
+        lowerer.isStdlibGlobal(expr.expression, "Object")) {
+        const object = lowerObjectConstructor(lowerer, expr.arguments, loc);
+        if (object)
+            return object;
+    }
     // A call whose chain ROOTS at an ambient-undefined name (`declare
     // const value: Y | undefined; value?.foo("a")`, `declare function
     // chain...; chain(o).mapValues(f).value()`, a trap binding's read):
@@ -3126,7 +3496,7 @@ export function lowerCall(lowerer, expr) {
     // `a?.m()` (the token on the member access). The handled markers keep
     // the chain lowering's re-entrant dispatch from looping.
     if ((expr.questionDotToken && !lowerer.chainHandled.has(expr)) ||
-        (ts.isPropertyAccessExpression(expr.expression) &&
+        ((ts.isPropertyAccessExpression(expr.expression) || ts.isElementAccessExpression(expr.expression)) &&
             expr.expression.questionDotToken &&
             !lowerer.chainHandled.has(expr.expression))) {
         return lowerer.lowerOptionalChain(expr);
@@ -3135,6 +3505,9 @@ export function lowerCall(lowerer, expr) {
     // top-level statement (its field-initializer ordering lives there);
     // any other position would misorder initialization — rejected.
     if (expr.expression.kind === ts.SyntaxKind.SuperKeyword) {
+        const superCall = lowerer.ctx.superCall;
+        if (superCall)
+            return superCall(expr);
         lowerer.unsupported("SC1090", expr, "super() calls anywhere but as a top-level constructor statement");
     }
     // super.method(...): a DIRECT (never virtual) call of the base chain's
@@ -3145,6 +3518,18 @@ export function lowerCall(lowerer, expr) {
     }
     const consoleMember = lowerer.consoleCallMember(expr);
     if (consoleMember !== null) {
+        // A namespace returned by user code must evaluate before the log
+        // arguments. Only the global and literal builtin require plumbing
+        // have no receiver evaluation to preserve.
+        const access = ts.isPropertyAccessExpression(expr.expression) ? expr.expression : null;
+        const created = access && ts.isCallExpression(access.expression) ? createRequireSpecOf(lowerer, access.expression) : null;
+        const receiver = access && !lowerer.isStdlibGlobal(access.expression, "console") &&
+            requireSpecOf(access.expression) === null &&
+            created?.spec !== "node:console" && created?.spec !== "console"
+            ? lowerer.lowerExpr(access.expression) : null;
+        const withReceiver = (result) => receiver === null ? result : {
+            kind: "seqExpr", stmts: [{ kind: "exprStmt", expr: receiver, loc }], result, type: result.type, loc,
+        };
         // console.log/info/debug write stdout; console.error and console.warn
         // are one stream in Node (warn IS error, info and debug ARE log) and
         // write stderr with the exact same formatting. Node's formatter is
@@ -3166,13 +3551,13 @@ export function lowerCall(lowerer, expr) {
             (ts.isStringLiteral(expr.arguments[0]) || ts.isNoSubstitutionTemplateLiteral(expr.arguments[0])) &&
             /%[sdifjoOc%]/.test(expr.arguments[0].text)) {
             const formatted = lowerFormatCall(lowerer, expr, loc, false);
-            return {
+            return withReceiver({
                 kind: "intrinsic",
                 name: stdoutMember ? "console.log" : "console.error",
                 args: [formatted],
                 type: VOID,
                 loc,
-            };
+            });
         }
         const args = expr.arguments.map((a) => {
             const lowered = lowerer.lowerExpr(a);
@@ -3233,13 +3618,20 @@ export function lowerCall(lowerer, expr) {
             // render fence honestly with the reason.
             return lowerConsoleInspectArg(lowerer, a, lowered, surface, loc);
         });
-        return {
+        return withReceiver({
             kind: "intrinsic",
             name: stdoutMember ? "console.log" : "console.error",
             args,
             type: VOID,
             loc,
-        };
+        });
+    }
+    if (ts.isPropertyAccessExpression(expr.expression) &&
+        TIMER_MODULE_MEMBERS.has(expr.expression.name.text) &&
+        lowerer.stdlibGlobalMember(expr.expression, "globalThis") === expr.expression.name.text) {
+        const served = lowerTimersMemberCall(lowerer, expr, expr.expression.name.text, loc);
+        if (served)
+            return served;
     }
     // The timer globals — setTimeout/clearTimeout, setInterval/
     // clearInterval, setImmediate/clearImmediate. Provenance-checked (a
@@ -3383,40 +3775,24 @@ export function lowerCall(lowerer, expr) {
     // Provenance-checked like setTimeout; zero-arg forms are the JS
     // constants ("", false, 0). Wrapper objects stay fenced except where
     // the receiver is immediately converted by a direct String method call.
-    if (ts.isIdentifier(expr.expression) &&
-        expr.expression.text === "BigInt" &&
-        lowerer.isStdlibSymbol(lowerer.resolveValueSymbol(expr.expression) ?? undefined)) {
+    if (lowerer.isStdlibGlobal(expr.expression, "BigInt")) {
         if (expr.arguments.length !== 1) {
             lowerer.noLowering(`BigInt with ${expr.arguments.length} arguments`, expr);
         }
         const argNode = expr.arguments[0];
-        const arg = lowerer.lowerExpr(argNode);
-        if (arg.type.kind === "bigint")
-            return arg;
-        if (arg.type.kind === "string") {
-            return { kind: "libCall", fn: "bigint.parse", args: [arg], type: BIGINT_T, loc };
-        }
-        if (arg.type.kind === "f64") {
-            return { kind: "libCall", fn: "bigint.fromF64", args: [arg], type: BIGINT_T, loc };
-        }
-        if (arg.type.kind === "bool") {
-            return {
-                kind: "ternary",
-                cond: arg,
-                then: { kind: "libCall", fn: "bigint.parse", args: [{ kind: "strLit", value: "1", type: STRING, loc }], type: BIGINT_T, loc },
-                else_: { kind: "libCall", fn: "bigint.parse", args: [{ kind: "strLit", value: "0", type: STRING, loc }], type: BIGINT_T, loc },
-                type: BIGINT_T,
-                loc,
-            };
-        }
+        // Captured optional storage can change after TypeScript's guard.
+        // BigInt consumes the stored value, including its nullish tag.
+        const arg = optionalCallValue(lowerer, argNode) ?? lowerer.lowerExpr(argNode);
+        const converted = lowerBigIntConstructorValue(lowerer, arg, loc);
+        if (converted)
+            return converted;
         lowerer.noLowering(`BigInt of ${lowerer.fmt(arg.type)} values`, argNode, "string, number, boolean, and bigint arguments are supported");
     }
-    if (ts.isIdentifier(expr.expression) &&
-        (expr.expression.text === "String" ||
-            expr.expression.text === "Boolean" ||
-            expr.expression.text === "Number") &&
-        lowerer.isStdlibSymbol(lowerer.resolveValueSymbol(expr.expression) ?? undefined)) {
-        const name = expr.expression.text;
+    if (lowerer.isStdlibGlobal(expr.expression, "String") ||
+        lowerer.isStdlibGlobal(expr.expression, "Boolean") ||
+        lowerer.isStdlibGlobal(expr.expression, "Number")) {
+        const name = lowerer.isStdlibGlobal(expr.expression, "String") ? "String" :
+            lowerer.isStdlibGlobal(expr.expression, "Boolean") ? "Boolean" : "Number";
         if (expr.arguments.length > 1) {
             lowerer.noLowering(`${name} with ${expr.arguments.length} arguments`, expr);
         }
@@ -3446,6 +3822,10 @@ export function lowerCall(lowerer, expr) {
         if (name === "Number")
             return lowerNumberConstructorValue(lowerer, argNode, loc);
         const arg = lowerer.lowerExpr(argNode);
+        if (name === "String" && (arg.type.kind === "dyn" || arg.type.kind === "union" &&
+            lowerer.unions.get(arg.type.unionId)?.arms.some((arm) => arm.kind === "symbol") && lowerer.dynConvertible(arg.type))) {
+            return { kind: "libCall", fn: "dyn.stringConstructor", args: [lowerer.coerceToExpected(arg, DYN)], type: STRING, loc };
+        }
         if (name === "String")
             return lowerer.ensureString(arg, argNode);
     }
@@ -3463,6 +3843,30 @@ export function lowerCall(lowerer, expr) {
         const code = lowerer.lowerExprExpecting(expr.arguments[0], STRING);
         return { kind: "libCall", fn: "island.eval", args: [code], type: STRING, loc };
     }
+    // Computed calls preserve their evaluated receiver just like dotted
+    // calls, including when the property is keyed by a native symbol.
+    if (ts.isElementAccessExpression(expr.expression) && !lowerer.chainBlocked(expr, expr.expression)) {
+        const access = expr.expression;
+        lowerer.fenceStaticResponseMember(access, "call");
+        lowerer.fenceStaticHeadersMember(access, "call");
+        lowerer.fenceStaticReadableStreamMember(access, "call");
+        const source = tryLowerExpression(lowerer, access.expression);
+        if (source && (source.type.kind === "dyn" || source.type.kind === "func" ||
+            (source.type.kind === "map" || source.type.kind === "set") && lowerer.dynConvertible(source.type) || isDynTypedRefType(source.type) &&
+            lowerer.foldedStringKeyOf(access.argumentExpression) === null &&
+            lowerer.mapTypeOf(lowerer.typeOf(access.argumentExpression))?.kind !== "symbol")) {
+            const local = lowerer.declareHiddenLocal("%computedReceiver", DYN);
+            const receiver = varRef(local.id, DYN, loc);
+            const key = lowerer.lowerExprExpecting(access.argumentExpression, DYN);
+            const callee = { kind: "dynKeyGet", value: receiver, key, type: DYN, loc };
+            const args = expr.arguments.map((arg) => lowerer.lowerExprExpecting(ts.isSpreadElement(arg) ? arg.expression : arg, DYN));
+            const spreads = expr.arguments.flatMap((arg, index) => ts.isSpreadElement(arg) ? [{ arg: index, what: arg.expression.getText() }] : []);
+            return { kind: "seqExpr", stmts: [{ kind: "varDecl", localId: local.id, init: lowerer.coerceToExpected(source, DYN), loc }], result: {
+                    kind: "dynCall", callee, receiver, calleeName: access.getText(), args,
+                    ...(spreads.length > 0 ? { spreads } : {}), type: DYN, loc,
+                }, type: DYN, loc };
+        }
+    }
     // Island calls. A property-access callee whose receiver is an 'any'
     // value is an engine method call (this = receiver, JS-exact); any other
     // 'any'-typed callee is an engine function call. Arguments marshal in;
@@ -3851,6 +4255,7 @@ export function lowerCall(lowerer, expr) {
         // string-only argument rule.
         if ((expr.expression.text === "encodeURIComponent" ||
             expr.expression.text === "encodeURI" ||
+            expr.expression.text === "decodeURI" ||
             expr.expression.text === "decodeURIComponent") &&
             lowerer.isStdlibSymbol(lowerer.resolveValueSymbol(expr.expression) ?? undefined)) {
             const name = expr.expression.text;
@@ -3859,10 +4264,10 @@ export function lowerCall(lowerer, expr) {
             }
             const loc = locOf(expr);
             const argNode = expr.arguments[0];
-            if (name === "decodeURIComponent") {
+            if (name === "decodeURIComponent" || name === "decodeURI") {
                 const d = optionalCallValue(lowerer, argNode) ?? lowerer.lowerExpr(argNode);
                 const s = lowerer.ensureString(d, argNode);
-                return { kind: "libCall", fn: "str.decodeUriComponent", args: [s], type: STRING, loc };
+                return { kind: "libCall", fn: name === "decodeURI" ? "str.decodeUri" : "str.decodeUriComponent", args: [s], type: STRING, loc };
             }
             const value = optionalCallValue(lowerer, argNode) ?? lowerer.lowerExpr(argNode);
             const s = lowerer.ensureString(value, argNode);
@@ -4061,6 +4466,9 @@ export function lowerCall(lowerer, expr) {
             let callee = lowerer.lowerExpr(nsMember);
             if (callee.type.kind === "record")
                 callee = lowerer.hybridCallUnwrap(callee);
+            const checked = lowerCheckedCallableValue(lowerer, expr, callee, loc);
+            if (checked)
+                return checked;
             if (callee.type.kind !== "func")
                 lowerer.badType(expr.expression, lowerer.typeOf(expr.expression));
             const args = completeFuncValueArgs(lowerer, expr, callee.type, loc);
@@ -4114,6 +4522,9 @@ export function lowerCall(lowerer, expr) {
         let callee = lowerer.lowerExpr(nameId);
         if (callee.type.kind === "record")
             callee = lowerer.hybridCallUnwrap(callee);
+        const checked = lowerCheckedCallableValue(lowerer, expr, callee, loc);
+        if (checked)
+            return checked;
         if (callee.type.kind !== "func")
             lowerer.badType(expr.expression, lowerer.typeOf(expr.expression));
         const args = completeFuncValueArgs(lowerer, expr, callee.type, loc);
@@ -4137,7 +4548,8 @@ export function lowerCall(lowerer, expr) {
             lowerer.lowerJsonMethodCall(expr, expr.expression) ??
             // Reflect.apply of a builtin rest-parameter fn (fixtures.js's
             // fixturesPath idiom) — before the stdlib member fence claims it.
-            lowerReflectApplyCall(lowerer, expr, expr.expression) ??
+            lowerReflectCall(lowerer, expr, expr.expression) ??
+            lowerBigIntStaticCall(lowerer, expr, expr.expression) ??
             lowerer.lowerNumberStaticCall(expr, expr.expression) ??
             lowerer.lowerDateCall(expr, expr.expression) ??
             lowerer.lowerTextCodecCall(expr, expr.expression) ??
@@ -4193,6 +4605,7 @@ export function lowerCall(lowerer, expr) {
             // TestContext surface (t.test/t.skip/t.diagnostic), t.assert.*.
             lowerer.lowerTestMethodCall(expr, expr.expression) ??
             lowerer.lowerTimeoutMethodCall(expr, expr.expression) ??
+            lowerArrayPrototypeBorrowCall(lowerer, expr, expr.expression) ??
             lowerObjectOwnPrototypeCall(lowerer, expr, expr.expression) ??
             lowerObjectPrototypeCall(lowerer, expr, expr.expression) ??
             lowerStringPrototypeCall(lowerer, expr, expr.expression) ??
@@ -4200,6 +4613,7 @@ export function lowerCall(lowerer, expr) {
             // Typed-array/Buffer receivers and the Buffer statics — before the
             // island path (bytes never cross the boundary).
             lowerer.lowerBytesMethodCall(expr, expr.expression) ??
+            lowerBytesStaticCall(lowerer, expr, expr.expression) ??
             lowerBufferStaticCallWithNarrowedArg(lowerer, expr, expr.expression) ??
             // URL.revokeObjectURL's zero-argument contract (the one-argument
             // form keeps the fence — createObjectURL does too).
@@ -4207,8 +4621,8 @@ export function lowerCall(lowerer, expr) {
             // Readable.from — the stream classes' one static (before the
             // stdlib chokepoint claims the member).
             lowerStreamStaticCall(lowerer, expr, expr.expression) ??
-            // Radix-free n.toString() is the STATIC number formatter (identical
-            // to `${n}` / String(n)); the explicit-radix form stays island.
+            // Primitive toString calls, including numeric radices, use the
+            // native formatters before the island method path.
             lowerNumberToStringCall(lowerer, expr, expr.expression) ??
             // Union receivers whose every arm has a text — the ngrok
             // `(chunk: Buffer | string) => chunk.toString()` idiom.
@@ -4248,7 +4662,6 @@ export function lowerCall(lowerer, expr) {
             // by the receiver's own element.
             lowerer.lowerFilterNarrowCall(expr, expr.expression) ??
             lowerArrayIsArrayCall(lowerer, expr, expr.expression) ??
-            lowerBigIntStaticCall(lowerer, expr, expr.expression) ??
             lowerBigIntMethodCall(lowerer, expr, expr.expression) ??
             lowerSymbolStaticCall(lowerer, expr, expr.expression) ??
             lowerSymbolMethodCall(lowerer, expr, expr.expression) ??
@@ -4267,8 +4680,8 @@ export function lowerCall(lowerer, expr) {
             lowerArrayFromCall(lowerer, expr, expr.expression) ??
             lowerArrayOfCall(lowerer, expr, expr.expression) ??
             lowerer.lowerArrayMethodCall(expr, expr.expression) ??
-            // Read-only array methods (slice/map) on TUPLE receivers — the
-            // positions snapshot into a fresh array (the for-of stance).
+            // Tuple reads preserve the receiver through argument evaluation;
+            // callbacks read each position when visited.
             lowerTupleReadMethodCall(lowerer, expr, expr.expression) ??
             lowerGenMethodCall(lowerer, expr, expr.expression) ??
             lowerer.lowerMapMethodCall(expr, expr.expression) ??
@@ -4283,6 +4696,25 @@ export function lowerCall(lowerer, expr) {
             lowerObjLitGenericMethodCall(lowerer, expr, expr.expression);
         if (intrinsic)
             return intrinsic;
+        if (isJsSourceFile(expr.getSourceFile())) {
+            const staticField = lowerStaticFieldRead(lowerer, expr.expression);
+            if (staticField?.type.kind === "dyn" && !expr.arguments.some(ts.isSpreadElement)) {
+                return { kind: "dynCall", callee: staticField, receiver: lowerer.lowerExprExpecting(expr.expression.expression, DYN), calleeName: expr.expression.getText(),
+                    args: expr.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc: locOf(expr) };
+            }
+        }
+        const accessorTarget = lowerer.fieldTarget(expr.expression);
+        if (accessorTarget?.container === "accessor") {
+            const callee = lowerer.fieldGetExpr(accessorTarget, locOf(expr.expression), expr.expression);
+            if (callee.type.kind === "func") {
+                const args = completeFuncValueArgs(lowerer, expr, callee.type, locOf(expr));
+                return { kind: "callValue", callee, args, type: callee.type.ret, loc: locOf(expr) };
+            }
+            if (callee.type.kind === "dyn" && !expr.arguments.some((arg) => ts.isSpreadElement(arg))) {
+                const args = expr.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN));
+                return { kind: "dynCall", callee, calleeName: expr.expression.getText(), args, type: DYN, loc: locOf(expr) };
+            }
+        }
         // A method call rooted at an initializer-less ambient `declare
         // const/var` whose declared type has no mapping: Node throws the
         // catchable ReferenceError at the ROOT read before the member, the
@@ -4332,6 +4764,9 @@ export function lowerCall(lowerer, expr) {
     // The element spelling of an unsupported native Web method must fence
     // before lowering the callee into a checked-dynamic keyed read.
     if (ts.isElementAccessExpression(expr.expression)) {
+        const symbolMethod = lowerClassSymbolMethodCall(lowerer, expr);
+        if (symbolMethod)
+            return symbolMethod;
         const headersIterator = lowerer.lowerDynamicHeadersIteratorCall(expr, expr.expression);
         if (headersIterator)
             return headersIterator;
@@ -4340,6 +4775,30 @@ export function lowerCall(lowerer, expr) {
         lowerer.fenceStaticHeadersMember(expr.expression, "call");
         lowerer.fenceStaticReadableStreamMember(expr.expression, "call");
     }
+    // Computed native members retain their original receiver and resolve
+    // the function before argument effects, just like dotted calls.
+    if (ts.isElementAccessExpression(expr.expression) && !expr.expression.questionDotToken && !expr.questionDotToken &&
+        !symbolFieldInfo(lowerer, expr.expression)) {
+        const access = expr.expression;
+        const value = tryLowerExpression(lowerer, access.expression);
+        if (value?.type.kind === "dyn" || value?.type.kind === "generator" ||
+            value && ["array", "bytes", "map", "set"].includes(value.type.kind) && lowerer.dynConvertible(value.type) ||
+            value?.type.kind === "string" && !ts.isStringLiteralLike(access.argumentExpression) && lowerer.dynConvertible(value.type) ||
+            value?.type.kind === "object" && !lowerer.classes.get(value.type.className)?.def.runtime) {
+            const local = lowerer.declareHiddenLocal("%computedReceiver", value.type);
+            const reference = { kind: "varRef", localId: local.id, type: value.type, loc };
+            const receiver = lowerer.coerceToExpected(reference, DYN);
+            const raw = lowerer.lowerExpr(access.argumentExpression);
+            const key = raw.type.kind === "string" ? raw : lowerer.coerceInto(access.argumentExpression, raw, DYN);
+            const callee = { kind: "dynKeyGet", value: receiver, key, type: DYN, loc };
+            const spread = expr.arguments.some(ts.isSpreadElement) ? lowerSpreadArgsCall(lowerer, expr, callee, loc) : null;
+            if (spread && spread.kind !== "dynCall")
+                lowerer.unsupported("SC1090", expr, "computed native method spread arguments");
+            const result = spread !== null ? { ...spread, receiver } : { kind: "dynCall", callee, receiver,
+                calleeName: access.getText(), args: expr.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc };
+            return { kind: "seqExpr", stmts: [{ kind: "varDecl", localId: local.id, init: value, loc }], result, type: DYN, loc };
+        }
+    }
     // The ELEMENT spelling of a primitive method call — `x['toString']()`,
     // `s['charAt'](0)`: JS resolves it exactly like the dot form, so the
     // literal-keyed shapes with a static lowering route there before the
@@ -4347,8 +4806,41 @@ export function lowerCall(lowerer, expr) {
     if (ts.isElementAccessExpression(expr.expression) &&
         !expr.expression.questionDotToken &&
         !expr.questionDotToken &&
-        ts.isStringLiteralLike(expr.expression.argumentExpression)) {
-        const memberName = expr.expression.argumentExpression.text;
+        (ts.isStringLiteralLike(expr.expression.argumentExpression) || ts.isNumericLiteral(expr.expression.argumentExpression))) {
+        const memberName = ts.isNumericLiteral(expr.expression.argumentExpression)
+            ? String(Number(expr.expression.argumentExpression.text))
+            : expr.expression.argumentExpression.text;
+        const receiverType = lowerer.mapTypeOf(lowerer.typeOf(expr.expression.expression));
+        if (receiverType?.kind === "object") {
+            const info = lowerer.classes.get(receiverType.className);
+            const found = info ? lowerer.findMethodOn(info, memberName) : null;
+            if (info && found) {
+                if (found.declarer.builtinError)
+                    return errorToStringCall(lowerer, lowerer.lowerExpr(expr.expression.expression));
+                const virtual = lowerer.overrideBelow(info, memberName);
+                if (found.sig.abstract === true && !virtual) {
+                    lowerer.unsupported("SC1090", expr, `calls of the abstract method '${memberName}' with no concrete implementation below the receiver's static class`);
+                }
+                if (virtual)
+                    lowerer.noteVirtualEdge(info, memberName);
+                else
+                    lowerer.noteEdge(`%${found.declarer.def.name}.${memberName}`);
+                const receiver = lowerer.lowerExpr(expr.expression.expression);
+                const args = lowerer.completeArgs(expr.arguments, found.sig.params, locOf(expr), expr);
+                const callArgs = [lowerer.upcastTo(receiver, virtual ? info.def.name : found.declarer.def.name), ...args];
+                const loc = locOf(expr);
+                if (virtual) {
+                    return reconcileOverloadReturn(lowerer, expr, {
+                        kind: "virtualCall", className: info.def.name, method: memberName,
+                        args: callArgs, type: found.sig.ret, loc,
+                    });
+                }
+                return reconcileOverloadReturn(lowerer, expr, {
+                    kind: "call", callee: `%${found.declarer.def.name}.${memberName}`,
+                    args: callArgs, type: found.sig.ret, loc,
+                });
+            }
+        }
         // ts7's getSymbolAtLocation does not resolve element accesses; the
         // member symbol comes from the receiver's (apparent) type instead —
         // same provenance answer as the dot spelling's name symbol.
@@ -4392,6 +4884,11 @@ export function lowerCall(lowerer, expr) {
                 : "value";
         return { kind: "dynCall", callee, calleeName, args, type: DYN, loc };
     }
+    if (callee.type.kind === "union" && lowerer.dynConvertible(callee.type) &&
+        lowerer.unions.get(callee.type.unionId)?.arms.some((arm) => arm.kind === "func")) {
+        return { kind: "dynCall", callee: lowerer.coerceToExpected(callee, DYN), calleeName: expr.expression.getText(),
+            args: expr.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc };
+    }
     if (callee.type.kind !== "func") {
         lowerer.badType(expr.expression, lowerer.typeOf(expr.expression));
     }
@@ -4446,7 +4943,7 @@ export function lowerCall(lowerer, expr) {
     // JS arity exactly (the thunk ignores extras). Result dyn, checked
     // per use like every any-origin value.
     if ((expr.arguments.length > callee.type.params.length || callee.type.rest === true) &&
-        isJsSourceFile(expr.getSourceFile()) &&
+        (isJsSourceFile(expr.getSourceFile()) || callee.type.rest === true && callee.type.restAbi === undefined) &&
         !expr.arguments.some((a) => ts.isSpreadElement(a)) &&
         canBoxFuncIntoDyn(callee.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
         const args = expr.arguments.map((a) => lowerer.lowerExprExpecting(a, DYN));
@@ -4457,6 +4954,29 @@ export function lowerCall(lowerer, expr) {
     const args = completeFuncValueArgs(lowerer, expr, callee.type, loc);
     return { kind: "callValue", callee, args, type: callee.type.ret, loc };
 }
+/** Exported checked and variadic callables use the same runtime-arity ABI
+ * whether the caller spells a bare import or a namespace member. */
+function lowerCheckedCallableValue(lowerer, call, value, loc) {
+    let callee = value;
+    if (callee.type.kind !== "dyn") {
+        if (callee.type.kind !== "func" ||
+            !(callee.type.rest === true && callee.type.restAbi === undefined ||
+                isJsSourceFile(call.getSourceFile()) && call.arguments.length > callee.type.params.length) ||
+            !lowerer.dynConvertible(callee.type))
+            return null;
+        callee = { kind: "dynFrom", value: callee, type: DYN, loc };
+    }
+    if (call.arguments.some(ts.isSpreadElement)) {
+        const spread = lowerSpreadArgsCall(lowerer, call, callee, loc);
+        if (spread)
+            return spread;
+        lowerer.unsupported("SC1090", call, "spread arguments in calls through 'unknown' values");
+    }
+    return {
+        kind: "dynCall", callee, calleeName: call.expression.getText(),
+        args: call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc,
+    };
+}
 function lowerRegexMethodCallWithOptionalArg(lowerer, call, access) {
     const lowered = lowerer.lowerRegexMethodCall(call, access);
     if (lowered?.kind !== "regexIntrinsic" || lowered.method !== "test" || call.arguments.length !== 1)
@@ -4478,9 +4998,13 @@ function optionalCallValue(lowerer, node) {
     return lowerer.runtimeOptionalIdentifierValue(node)?.value ?? lowerAbsenceProbe(lowerer, node);
 }
 function lowerBufferStaticCallWithNarrowedArg(lowerer, call, access) {
-    const lowered = lowerer.lowerBufferStaticCall(call, access);
+    const result = lowerer.lowerBufferStaticCall(call, access);
+    // The Buffer brand wraps the constructor result. Normalize its source
+    // before restoring that wrapper so narrowed unions never reach bytesNew.
+    const branded = result?.kind === "libCall" && result.fn === "buffer.brand" ? result : null;
+    const lowered = branded ? branded.args[0] : result;
     if (lowered?.kind !== "bytesNew" || !lowered.source || lowered.source.type.kind !== "union")
-        return lowered;
+        return result;
     // A callback can store a wider union than the checker sees at this use
     // (including an added undefined arm). Extract the exact arm proven by
     // control-flow narrowing, not merely the union with undefined removed.
@@ -4496,10 +5020,11 @@ function lowerBufferStaticCallWithNarrowedArg(lowerer, call, access) {
     if (!helper) {
         lowerer.unsupported("SC1090", call.arguments[0], "a Buffer constructor argument whose narrowed type is not a stored source arm");
     }
-    return {
+    const narrowedValue = {
         ...lowered,
         source: { kind: "call", callee: helper, args: [lowered.source], type: narrowed, loc: lowered.source.loc },
     };
+    return branded ? { ...branded, args: [narrowedValue] } : narrowedValue;
 }
 function lowerOptionalNumberDefault(lowerer, value, dflt, loc) {
     const widened = lowerer.runtimeOptionalWidening(value.type, F64);
@@ -4554,6 +5079,8 @@ function lowerStringMethodCallWithOptionalArgs(lowerer, call, access, receiver,
                 ? [1]
                 : [];
     for (const index of zeroDefaultArgs) {
+        if (index === undefined)
+            continue;
         const value = args[index];
         if (!value)
             continue;
@@ -4599,6 +5126,12 @@ function lowerNumberConstructorValue(lowerer, argNode, loc) {
     }
     if (arg.type.kind === "string")
         return { kind: "libCall", fn: "num.fromString", args: [arg], type: F64, loc };
+    if (arg.type.kind === "dyn")
+        return { kind: "libCall", fn: "dyn.numberConstructor", args: [arg], type: F64, loc };
+    if (arg.type.kind === "union" && lowerer.dynConvertible(arg.type))
+        return {
+            kind: "libCall", fn: "dyn.numberConstructor", args: [lowerer.coerceToExpected(arg, DYN)], type: F64, loc,
+        };
     const optionalNumber = lowerOptionalStringNumber(lowerer, arg, loc);
     if (optionalNumber)
         return optionalNumber;
@@ -4609,6 +5142,63 @@ function lowerNumberConstructorValue(lowerer, argNode, loc) {
         ? "unions of numbers, booleans, strings, null, and undefined lower — narrow other arms first"
         : undefined);
 }
+/** A runtime-optional local retains its full tagged storage even after a
+ * checker guard. Dispatch BigInt by the actual value, including nullish
+ * TypeErrors, rather than interpreting that storage as the narrowed arm. */
+function lowerBigIntConstructorValue(lowerer, arg, loc) {
+    if (arg.type.kind === "dyn")
+        return { kind: "libCall", fn: "dyn.bigintConstructor", args: [arg], type: BIGINT_T, loc };
+    if (arg.type.kind === "bigint")
+        return arg;
+    if (arg.type.kind === "string")
+        return { kind: "libCall", fn: "bigint.parse", args: [arg], type: BIGINT_T, loc };
+    if (arg.type.kind === "f64")
+        return { kind: "libCall", fn: "bigint.fromF64", args: [arg], type: BIGINT_T, loc };
+    if (arg.type.kind === "bool") {
+        return {
+            kind: "ternary", cond: arg,
+            then: { kind: "libCall", fn: "bigint.parse", args: [{ kind: "strLit", value: "1", type: STRING, loc }], type: BIGINT_T, loc },
+            else_: { kind: "libCall", fn: "bigint.parse", args: [{ kind: "strLit", value: "0", type: STRING, loc }], type: BIGINT_T, loc },
+            type: BIGINT_T, loc,
+        };
+    }
+    if (isUnitType(arg.type)) {
+        const name = arg.type.kind === "nullT" ? "null" : "undefined";
+        return defaultAfterUndefined(arg, nodeThrowExpr(1, "", `Cannot convert ${name} to a BigInt`, BIGINT_T, loc));
+    }
+    if (arg.type.kind !== "union")
+        return null;
+    const unionId = arg.type.unionId;
+    const arms = lowerer.unions.get(unionId)?.arms;
+    if (!arms || !arms.every((arm) => arm.kind === "bigint" || arm.kind === "string" || arm.kind === "f64" || arm.kind === "bool" || isUnitType(arm)))
+        return null;
+    const key = `bigint.scalar:${unionId}`;
+    let helper = lowerer.widthHelpers.get(key);
+    if (!helper) {
+        helper = `%bigint.scalar.${lowerer.widthHelpers.size}`;
+        lowerer.widthHelpers.set(key, helper);
+        const value = varRef("value.0", arg.type, loc);
+        const body = [];
+        arms.forEach((arm, tag) => {
+            const narrowed = isUnitType(arm)
+                ? { kind: "unitLit", unit: arm.kind === "nullT" ? "null" : "undefined", type: arm, loc }
+                : { kind: "unionNarrow", unionId, tag, value, type: arm, loc };
+            const converted = lowerBigIntConstructorValue(lowerer, narrowed, loc);
+            if (!converted)
+                throw new InternalCompilerError("BigInt scalar union has an unsupported arm");
+            const ret = { kind: "return", value: converted, loc };
+            body.push(tag === arms.length - 1 ? ret : {
+                kind: "if", cond: { kind: "unionIsTag", unionId, tag, negated: false, value, type: BOOL, loc },
+                then: [ret], else_: null, loc,
+            });
+        });
+        lowerer.liftedFns.push({
+            name: helper, params: [{ localId: "value.0", name: "value", type: arg.type }],
+            returnType: BIGINT_T, locals: [{ id: "value.0", name: "value", type: arg.type, mutable: false }], body, loc,
+        });
+    }
+    return { kind: "call", callee: helper, args: [arg], type: BIGINT_T, loc };
+}
 function immediatePrimitiveWrapperToString(lowerer, node) {
     const stringValue = stringWrapperToString(lowerer, node);
     if (stringValue)
@@ -4631,24 +5221,6 @@ function immediatePrimitiveWrapperToString(lowerer, node) {
         : args.length ? lowerNumberConstructorValue(lowerer, args[0], loc) : { kind: "numLit", value: 0, type: F64, loc };
     return lowerer.ensureString(primitive, wrapped);
 }
-function plainObjectCoercionReceiver(lowerer, node) {
-    const plainLiteral = (literal) => literal.properties.every((prop) => ts.isPropertyAssignment(prop) &&
-        (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name) || ts.isNumericLiteral(prop.name)) &&
-        prop.name.text !== "__proto__");
-    let value = node;
-    while (ts.isParenthesizedExpression(value))
-        value = value.expression;
-    if (ts.isObjectLiteralExpression(value))
-        return plainLiteral(value);
-    if (!ts.isIdentifier(value))
-        return false;
-    const symbol = lowerer.resolveValueSymbol(value);
-    const decl = symbol ? lowerer.checker.valueDeclarationOf(symbol) : undefined;
-    if (!symbol || !decl || !ts.isVariableDeclaration(decl) || !decl.initializer ||
-        !ts.isObjectLiteralExpression(decl.initializer) || !plainLiteral(decl.initializer))
-        return false;
-    return bindingNeverReassigned(lowerer, symbol, decl);
-}
 function objectToStringTag(lowerer, type) {
     switch (type.kind) {
         case "undefinedT":
@@ -4669,7 +5241,7 @@ function objectToStringTag(lowerer, type) {
         case "set": return "Set";
         case "promise": return "Promise";
         case "bytes":
-            return ({ u8: "Uint8Array", u32: "Uint32Array", i32: "Int32Array", f32: "Float32Array", f64: "Float64Array" })[type.elem];
+            return BYTES_ELEMENT_NAME[type.elem];
         case "object":
             return type.className === "%Error" || lowerer.isSubclassOf(type.className, "%Error") ? "Error" : null;
         default: return null;
@@ -4691,6 +5263,10 @@ function immediateObjectTagReceiver(lowerer, node) {
         lowerer.isStdlibSymbol(lowerer.resolveValueSymbol(value.expression) ?? undefined)) {
         const name = value.expression.text;
         const args = value.arguments ?? [];
+        // JavaScript dates use checked native handles, so their IR type alone
+        // cannot recover the tag through an immediate Object(...) wrapper.
+        if (name === "Date")
+            return { tag: "Date", effect: lowerer.lowerExpr(value) };
         if (args.length <= 1 && !args.some(ts.isSpreadElement)) {
             if (name === "String") {
                 const effect = stringWrapperToString(lowerer, value);
@@ -4738,6 +5314,36 @@ function immediateObjectTagReceiver(lowerer, node) {
     }
     return null;
 }
+const ARRAY_BORROW_METHODS = new Set([
+    "at", "every", "filter", "find", "findIndex", "findLast", "findLastIndex", "forEach", "includes",
+    "indexOf", "lastIndexOf", "map", "reduce", "reduceRight", "slice", "some",
+]);
+function lowerArrayPrototypeBorrowCall(lowerer, call, access) {
+    if (lowerer.dynamic || !isJsSourceFile(call.getSourceFile()) || call.questionDotToken ||
+        access.questionDotToken || access.name.text !== "call" ||
+        !ts.isPropertyAccessExpression(access.expression) ||
+        call.arguments.some(ts.isSpreadElement))
+        return null;
+    const method = access.expression;
+    if (method.questionDotToken || !ARRAY_BORROW_METHODS.has(method.name.text) ||
+        !ts.isPropertyAccessExpression(method.expression) ||
+        method.expression.questionDotToken || method.expression.name.text !== "prototype" ||
+        !lowerer.isStdlibGlobal(method.expression.expression, "Array") ||
+        !lowerer.isStdlibMember(method))
+        return null;
+    const loc = locOf(call);
+    const receiver = call.arguments[0]
+        ? lowerer.lowerExprExpecting(call.arguments[0], DYN)
+        : { kind: "dynFrom", value: { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc }, type: DYN, loc };
+    const args = call.arguments.slice(1).map((arg) => lowerer.lowerExprExpecting(arg, DYN));
+    return {
+        kind: "libCall", fn: "dyn.arrayProtoCall", args: [
+            receiver,
+            { kind: "strLit", value: method.name.text, type: STRING, loc },
+            { kind: "dynArrLit", elems: args, type: DYN, loc },
+        ], type: DYN, loc,
+    };
+}
 function lowerObjectOwnPrototypeCall(lowerer, call, access) {
     if (lowerer.dynamic || access.name.text !== "call" || !ts.isPropertyAccessExpression(access.expression))
         return null;
@@ -4756,10 +5362,31 @@ function lowerObjectOwnMethodCall(lowerer, call, access) {
     const method = access.name.text;
     if (lowerer.dynamic || call.questionDotToken || access.questionDotToken ||
         (method !== "hasOwnProperty" && method !== "propertyIsEnumerable") ||
-        !lowerer.isStdlibMember(access) || call.arguments.some(ts.isSpreadElement))
+        call.arguments.some(ts.isSpreadElement))
         return null;
+    if (!lowerer.isStdlibMember(access)) {
+        const receiver = tryLowerExpression(lowerer, access.expression);
+        if (receiver?.type.kind !== "dyn")
+            return null;
+    }
     return lowerObjectOwnCall(lowerer, call, access.expression, call.arguments[0], call.arguments.slice(1), method);
 }
+/** ToPropertyKey for the scalar keys represented by native own-key
+ * probes. A lowered array-loop key may carry an undefined arm even when
+ * its checker type is string; that arm spells "undefined" at runtime. */
+function ownPropertyKey(lowerer, key) {
+    if (key.type.kind === "string")
+        return key;
+    if (key.type.kind === "bigint") {
+        return { kind: "libCall", fn: "bigint.toString", args: [key, numLit(10, key.loc)], type: STRING, loc: key.loc };
+    }
+    const scalar = (type) => type.kind === "string" || type.kind === "f64" || type.kind === "bool" || isUnitType(type);
+    if (key.type.kind === "f64" || key.type.kind === "bool" || key.type.kind === "dyn" ||
+        (key.type.kind === "union" && lowerer.unions.get(key.type.unionId)?.arms.every(scalar))) {
+        return { kind: "toString", operand: key, type: STRING, loc: key.loc };
+    }
+    return null;
+}
 function lowerObjectOwnCall(lowerer, call, receiverNode, keyNode, extraNodes, method) {
     const enumerable = method === "propertyIsEnumerable";
     const loc = locOf(call);
@@ -4792,14 +5419,19 @@ function lowerObjectOwnCall(lowerer, call, receiverNode, keyNode, extraNodes, me
             stmts.push({ kind: "exprStmt", expr: effect, loc: locOf(extra) });
     }
     let key = keyRef;
+    if (lowerer.dynConvertible(receiverRef.type) && keyRef && (receiverRef.type.kind === "object" || keyRef.type.kind === "symbol" || keyRef.type.kind === "dyn" ||
+        keyRef.type.kind === "union" && lowerer.dynConvertible(keyRef.type))) {
+        const result = { kind: "libCall", fn: enumerable ? "dyn.propertyIsEnumerableComputed" : "dyn.hasOwnComputed", args: [lowerer.coerceToExpected(receiverRef, DYN), lowerer.coerceToExpected(keyRef, DYN)], type: BOOL, loc };
+        return { kind: "seqExpr", stmts, result, type: BOOL, loc };
+    }
     if (!keyNode || rawKey?.type.kind === "undefinedT" || rawKey?.type.kind === "void") {
         key = { kind: "strLit", value: "undefined", type: STRING, loc };
     }
     else if (rawKey?.type.kind === "nullT") {
         key = { kind: "strLit", value: "null", type: STRING, loc };
     }
-    else if (key && (key.type.kind === "f64" || key.type.kind === "bool" || key.type.kind === "bigint")) {
-        key = { kind: "toString", operand: key, type: STRING, loc };
+    else if (key) {
+        key = ownPropertyKey(lowerer, key);
     }
     if (!key || key.type.kind !== "string") {
         lowerer.noLowering("Object.prototype." + method + " with this property key", keyNode ?? call);
@@ -4811,13 +5443,13 @@ function lowerObjectOwnCall(lowerer, call, receiverNode, keyNode, extraNodes, me
     }
     else if (type.kind === "record") {
         const shape = lowerer.shapes.get(type.shapeId);
-        if (!shape || shape.tuple || shape.indexValue || shapeHasAccessorSlots(shape)) {
+        if (!shape || shape.tuple || shapeHasAccessorSlots(shape)) {
             lowerer.noLowering("Object.prototype." + method + " over this record shape", receiverNode ?? call);
         }
         result = { kind: "call", callee: recordHasOwnHelper(lowerer, type.shapeId, loc), args: [receiverRef, key], type: BOOL, loc };
     }
-    else if (type.kind === "dyn" && !enumerable) {
-        result = { kind: "libCall", fn: "dyn.hasOwn", args: [receiverRef, key], type: BOOL, loc };
+    else if (type.kind === "dyn") {
+        result = { kind: "libCall", fn: enumerable ? "dyn.propertyIsEnumerable" : "dyn.hasOwn", args: [receiverRef, key], type: BOOL, loc };
     }
     else if (type.kind === "string" || type.kind === "array") {
         const needleLocal = lowerer.declareHiddenLocal("%ownIndex", F64);
@@ -4886,6 +5518,52 @@ function lowerObjectPrototypeCall(lowerer, call, access) {
         : { kind: "strLit", value: "[object " + tag + "]", type: STRING, loc };
     return { kind: "seqExpr", stmts, result, type: STRING, loc };
 }
+/** Function.call evaluates all arguments before RequireObjectCoercible and
+ * ToString. Stabilize them before reusing the ordinary string method lowering,
+ * so a boxed nullish receiver or a coercion hook cannot reorder effects. */
+function lowerDynamicStringPrototypeCall(lowerer, call, methodAccess, receiver, method) {
+    const loc = locOf(call);
+    const receiverLocal = lowerer.declareHiddenLocal("%stringCallReceiver", receiver.type);
+    const stmts = [{ kind: "varDecl", localId: receiverLocal.id, init: receiver, loc }];
+    const receiverRef = varRef(receiverLocal.id, receiver.type, loc);
+    const converted = {
+        kind: "ternary",
+        cond: { kind: "dynTest", test: "nullish", value: receiverRef, type: BOOL, loc },
+        then: nodeThrowExpr(1, "", `String.prototype.${method} called on null or undefined`, STRING, loc),
+        else_: { kind: "libCall", fn: "dyn.toStringCoerce", args: [receiverRef], type: STRING, loc },
+        type: STRING, loc,
+    };
+    const overrides = [];
+    try {
+        for (const node of call.arguments.slice(1)) {
+            const undefinedValue = lowerStaticallyUndefinedArgument(lowerer, node);
+            const value = undefinedValue ?? lowerer.lowerExpr(node);
+            let ref;
+            if (undefinedValue || isUnitType(value.type) || value.type.kind === "void") {
+                stmts.push({ kind: "exprStmt", expr: value, loc: value.loc });
+                const nullUnit = !undefinedValue && value.type.kind === "nullT";
+                ref = { kind: "unitLit", unit: nullUnit ? "null" : "undefined", type: nullUnit ? value.type : UNDEFINED_T, loc: value.loc };
+            }
+            else {
+                const local = lowerer.declareHiddenLocal("%stringCallArg", value.type);
+                stmts.push({ kind: "varDecl", localId: local.id, init: value, loc: value.loc });
+                ref = varRef(local.id, value.type, value.loc);
+            }
+            overrides.push({ node, previous: lowerer.chainRecvByNode.get(node) });
+            lowerer.chainRecvByNode.set(node, ref);
+        }
+        const result = lowerStringMethodCallWithOptionalArgs(lowerer, call, methodAccess, () => converted, call.arguments.slice(1));
+        return result ? { kind: "seqExpr", stmts, result, type: result.type, loc } : null;
+    }
+    finally {
+        for (const override of overrides) {
+            if (override.previous)
+                lowerer.chainRecvByNode.set(override.node, override.previous);
+            else
+                lowerer.chainRecvByNode.delete(override.node);
+        }
+    }
+}
 function lowerStringPrototypeCall(lowerer, call, access) {
     if (access.name.text !== "call" || !ts.isPropertyAccessExpression(access.expression))
         return null;
@@ -4928,6 +5606,9 @@ function lowerStringPrototypeCall(lowerer, call, access) {
             loc,
         };
     }
+    if (receiverType.kind === "dyn") {
+        return lowerDynamicStringPrototypeCall(lowerer, call, methodAccess, receiverValue, method);
+    }
     const padding = entry?.method === "padStart" || entry?.method === "padEnd";
     const scalar = receiverType.kind === "string" || receiverType.kind === "f64" ||
         receiverType.kind === "bool" || receiverType.kind === "bigint" ||
@@ -4936,10 +5617,11 @@ function lowerStringPrototypeCall(lowerer, call, access) {
     // padding uses a helper that delays conversion until every argument is ready.
     const objectWithoutMethodArgs = entry?.maxArgs === 0 && call.arguments.length === 1 &&
         (receiverType.kind === "record" || receiverType.kind === "array" || receiverType.kind === "object");
-    const dynObjectWithoutMethodArgs = entry?.maxArgs === 0 && call.arguments.length === 1 &&
-        receiverType.kind === "dyn" && plainObjectCoercionReceiver(lowerer, receiverNode);
-    if (!scalar && !objectWithoutMethodArgs && !dynObjectWithoutMethodArgs && !(padding && receiverType.kind === "dyn")) {
-        return lowerer.noLowering(`String.prototype.${methodAccess.name.text}.call with ${lowerer.fmt(receiverType)} receivers`, call);
+    if (padding && !scalar && lowerer.dynConvertible(receiverType)) {
+        return lowerStringPaddingCall(lowerer, call, entry.method, lowerer.coerceToExpected(receiverValue, DYN), receiverNode, call.arguments.slice(1));
+    }
+    if (!scalar && !objectWithoutMethodArgs) {
+        lowerer.noLowering(`String.prototype.${methodAccess.name.text}.call with ${lowerer.fmt(receiverType)} receivers`, call);
     }
     if (indexMethod)
         return lowerStringIndexCall(lowerer, call, indexMethod, receiverValue, receiverNode, call.arguments.slice(1));
@@ -4951,9 +5633,7 @@ function lowerStringPrototypeCall(lowerer, call, access) {
     if (entry.method === "split") {
         return lowerStringSplitCall(lowerer, call, receiverValue, receiverNode, call.arguments.slice(1));
     }
-    const receiver = dynObjectWithoutMethodArgs
-        ? { kind: "libCall", fn: "dyn.toStringCoerce", args: [receiverValue], type: STRING, loc }
-        : lowerer.ensureString(receiverValue, receiverNode);
+    const receiver = lowerer.ensureString(receiverValue, receiverNode);
     return lowerStringMethodCallWithOptionalArgs(lowerer, call, methodAccess, () => receiver, call.arguments.slice(1));
 }
 function lowerScalarUnionNumber(lowerer, arg, node, loc) {
@@ -5127,13 +5807,18 @@ function spreadNeedsRuntimeArity(lowerer, shapes, argNodes) {
                 position += tuple.fields.length;
                 continue;
             }
-            if (restAt < 0 || position < restAt || shapes[restAt].mode !== "rest")
-                return true;
+            if (restAt < 0 || position < restAt || shapes[restAt].mode !== "rest") {
+                return !canCompleteRuntimeSpread(lowerer, shapes);
+            }
         }
         position++;
     }
     return false;
 }
+function canCompleteRuntimeSpread(lowerer, shapes) {
+    return shapes.length > 0 && shapes.every((shape) => shape.mode !== "islandRest" && shape.callDefault === undefined &&
+        canDynCheckTo(shape.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id)));
+}
 /** METHOD calls on dyn receivers (`pkg.name.replace(...)`, `rawName.split`,
  * `ws.packages.filter(...)` — JSON.parse-derived values): validate the
  * receiver's dyn kind, extract, and ride the STATIC method machinery — the
@@ -5171,18 +5856,70 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
         // tsc types the return by the evolved shape, the binding lowered
         // dyn): probe the lowering and claim exactly the dyn results.
         const probed = tryLowerExpression(lowerer, access.expression);
+        if (probed?.type.kind === "func" && stdlibGlobalNameOf(lowerer, access.expression) === null &&
+            !["call", "apply", "bind", "toString", "valueOf", "constructor"].includes(access.name.text) &&
+            canBoxFuncIntoDyn(probed.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
+            const loc = locOf(call);
+            const fnName = jsFuncNameOf(access.expression);
+            const boxed = { kind: "dynFrom", value: probed, type: DYN, loc, ...(fnName !== null ? { fnName } : {}) };
+            const local = lowerer.declareHiddenLocal("%callableReceiver", DYN);
+            const receiver = { kind: "varRef", localId: local.id, type: DYN, loc };
+            const member = {
+                kind: "dynKeyGet", value: receiver,
+                key: { kind: "strLit", value: access.name.text, type: STRING, loc }, type: DYN, loc,
+            };
+            if (call.arguments.some(ts.isSpreadElement)) {
+                lowerer.unsupported("SC1090", call, "spread arguments in callable property calls");
+            }
+            return {
+                kind: "seqExpr", stmts: [{ kind: "varDecl", localId: local.id, init: boxed, loc }],
+                result: { kind: "dynCall", callee: member, receiver, calleeName: access.getText(),
+                    args: call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc }, type: DYN, loc,
+            };
+        }
+        if (probed?.type.kind === "classval") {
+            const info = lowerer.classes.get(probed.type.className);
+            if (info && (info.callableBase || hasRuntimeStatics(info)))
+                return lowerStaticMethodCall(lowerer, call, access);
+        }
         if (probed?.type.kind !== "dyn")
             return null;
         recv = probed;
     }
+    // A factory may return a constructor more precise than its inferred
+    // checker result. Runtime static members live on that constructor.
+    if (recv.type.kind === "classval") {
+        const info = lowerer.classes.get(recv.type.className);
+        if (info && (info.callableBase || hasRuntimeStatics(info)))
+            return lowerStaticMethodCall(lowerer, call, access);
+    }
     // A checker-`any` receiver that already lowered to a real STRING (the
     // chained form — `cfg.host.trim().toLowerCase()`, where the first step
     // extracted): no validation needed, ride the string tables directly.
+    if (recv.type.kind === "union" && lowerer.stripUndefinedArm(recv.type).kind === "string") {
+        const present = lowerer.runtimeOptionalPropertyReceiver(access.expression, recv, STRING, access.name.text);
+        if (present)
+            recv = present;
+    }
     if (recv.type.kind === "string") {
         return lowerRegexMethodCall(lowerer, call, access, () => recv) ?? lowerStringMethodCall(lowerer, call, access, () => recv);
     }
     if (recv.type.kind !== "dyn")
         return null;
+    if (lowerer.mapTypeOf(recvTs)?.kind === "classval") {
+        return lowerStaticMethodCall(lowerer, call, access);
+    }
+    const ownCallable = !checkerUntyped && (() => {
+        const prop = lowerer.checker.getPropertyOfType(recvTs, access.name.text);
+        if (prop === undefined)
+            return false;
+        // getPropertyOfType includes inherited Object.prototype members.
+        // Those are not stored members of a checked-dynamic object, so
+        // dynKeyGet cannot stand in for JavaScript's prototype lookup. Only
+        // an authored declaration can justify the own-member path.
+        const authored = lowerer.checker.declarationsOf(prop).some((decl) => !lowerer.isStdlibFile(decl.getSourceFile()));
+        return authored && lowerer.checker.getCallSignatures(lowerer.checker.getTypeOfSymbol(prop)).length > 0;
+    })();
     // Typed-destination filter first (validated extraction into a real
     // T[]); an untyped destination falls through to the runtime dispatch
     // below (the survivors stay dyn values).
@@ -5198,34 +5935,21 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
     // these, "the receiver is a string, or the call throws V8's TypeError"
     // IS Node's semantics for every possible dyn value. Shared names would
     // need a receiver-kind dispatch — they keep the fence.
-    if (DYN_STRING_ONLY_METHODS.has(access.name.text)) {
+    if (DYN_STRING_ONLY_METHODS.has(access.name.text) && !ownCallable) {
         const checked = () => dynStringReceiver(lowerer, recv, access);
         return lowerRegexMethodCall(lowerer, call, access, checked) ?? lowerStringMethodCall(lowerer, call, access, checked);
     }
-    // toString() is a shared prototype name with its OWN receiver-kind
-    // dispatched runtime lowering (dyn.toString: Buffer-flavored bytes
-    // decode per the encoding — a stream chunk's common consumption —
-    // and strings/numbers/booleans/arrays/objects answer JS-exactly).
-    // The optional argument is a literal encoding (meaningful for bytes;
-    // JS ignores extra toString arguments on the other kinds, and so
-    // does the runtime dispatch).
+    // The argument is a radix for bigint and an encoding for Buffer.
+    // Preserve its runtime value so receiver dispatch can choose correctly.
     if (access.name.text === "toString" && call.arguments.length <= 1) {
-        const enc = call.arguments[0]
-            ? bufEncoding(lowerer, "toString", call.arguments[0])
-            : "utf8";
-        // The source spelling rides along for the ONE receiver whose
-        // prototype lacks toString: a null-prototype dictionary throws
-        // Node's "<spelling> is not a function" at runtime.
+        const argument = call.arguments[0];
         return {
-            kind: "libCall",
-            fn: "dyn.toString",
-            args: [
+            kind: "libCall", fn: "dyn.toString", args: [
                 recv,
-                { kind: "strLit", value: enc, type: STRING, loc: locOf(call) },
+                argument ? lowerer.lowerExprExpecting(argument, DYN)
+                    : dynUndefinedExpr(locOf(call)),
                 { kind: "strLit", value: access.getText(), type: STRING, loc: locOf(call) },
-            ],
-            type: STRING,
-            loc: locOf(call),
+            ], type: STRING, loc: locOf(call),
         };
     }
     // SHARED prototype names with a runtime dispatch (scr_dyn_invoke):
@@ -5237,7 +5961,13 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
     // unimplemented methods throw a LOUD not-supported Error; names the
     // kind's prototype lacks throw Node's "x.y is not a function"; OBJ
     // receivers call the own member.
-    const dispatched = lowerDynDispatchMethodCall(lowerer, call, access, recv, arrayReceiver);
+    // A stored callback must be read before argument effects, and called
+    // with the original receiver rather than a materialized property view.
+    const callbackProperty = (() => {
+        const prop = lowerer.checker.getPropertyOfType(recvTs, access.name.text);
+        return prop !== undefined && lowerer.checker.declarationsOf(prop).some((decl) => ts.isPropertyDeclaration(decl) || ts.isPropertySignature(decl));
+    })();
+    const dispatched = callbackProperty ? null : lowerDynDispatchMethodCall(lowerer, call, access, recv, arrayReceiver);
     if (dispatched)
         return dispatched;
     // Names NO dyn-representable prototype declares: the member can only
@@ -5256,17 +5986,6 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
     // its name overlaps a primitive prototype (`colors.bold(...)`): the
     // source value was compiled from that object shape, while genuinely
     // untyped/any receivers retain the runtime-kind ambiguity and fence.
-    const ownCallable = !checkerUntyped && (() => {
-        const prop = lowerer.checker.getPropertyOfType(recvTs, access.name.text);
-        if (prop === undefined)
-            return false;
-        // getPropertyOfType includes inherited Object.prototype members.
-        // Those are not stored members of a checked-dynamic object, so
-        // dynKeyGet cannot stand in for JavaScript's prototype lookup. Only
-        // an authored declaration can justify the own-member path.
-        const authored = lowerer.checker.declarationsOf(prop).some((decl) => !lowerer.isStdlibFile(decl.getSourceFile()));
-        return authored && lowerer.checker.getCallSignatures(lowerer.checker.getTypeOfSymbol(prop)).length > 0;
-    })();
     if (DYN_PROTO_METHOD_NAMES.has(access.name.text) && !ownCallable)
         return null;
     // Optional forms (`obj.cb?.()`, `obj?.cb()`) belong to the chain
@@ -5274,18 +5993,28 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
     if (call.questionDotToken || access.questionDotToken)
         return null;
     const loc = locOf(call);
-    if (call.arguments.some((a) => ts.isSpreadElement(a))) {
-        lowerer.unsupported("SC1090", call, "spread arguments in calls through 'unknown' values");
-    }
+    const receiverLocal = lowerer.declareHiddenLocal("%dynCallReceiver", DYN);
+    const receiver = { kind: "varRef", localId: receiverLocal.id, type: DYN, loc };
     const member = {
         kind: "dynKeyGet",
         key: { kind: "strLit", value: access.name.text, type: STRING, loc: locOf(access) },
-        value: recv,
+        value: receiver,
         type: DYN,
         loc: locOf(access),
     };
+    if (call.arguments.some(ts.isSpreadElement)) {
+        const spread = lowerSpreadArgsCall(lowerer, call, member, loc);
+        if (spread?.kind === "dynCall")
+            return { kind: "seqExpr",
+                stmts: [{ kind: "varDecl", localId: receiverLocal.id, init: recv, loc }],
+                result: { ...spread, receiver }, type: DYN, loc };
+        lowerer.unsupported("SC1090", call, "spread arguments in calls through 'unknown' values");
+    }
     const args = call.arguments.map((a) => lowerer.lowerExprExpecting(a, DYN));
-    return { kind: "dynCall", callee: member, calleeName: access.getText(), args, type: DYN, loc };
+    return {
+        kind: "seqExpr", stmts: [{ kind: "varDecl", localId: receiverLocal.id, init: recv, loc }],
+        result: { kind: "dynCall", callee: member, receiver, calleeName: access.getText(), args, type: DYN, loc }, type: DYN, loc,
+    };
 }
 /** Prototype method names of the checked-dynamic tree-representable kinds (String, Array,
  * Object, Function, Number prototypes): a dyn receiver call on one of
@@ -5312,7 +6041,8 @@ const DYN_PROTO_METHOD_NAMES = new Set([
  * is-not-a-function where the kind's prototype lacks the name, and
  * fences LOUDLY on real-but-unimplemented pairs. */
 const DYN_DISPATCH_METHODS = new Set([
-    "apply", "call",
+    "segment", "containing", "resolvedOptions", "test", "exec",
+    "apply", "bind", "call",
     "push", "pop", "shift", "unshift", "slice", "at",
     "indexOf", "lastIndexOf", "includes", "join", "concat", "reverse", "sort",
     "forEach", "map", "filter", "some", "every", "find", "findIndex",
@@ -5330,7 +6060,7 @@ const DYN_DISPATCH_METHODS = new Set([
     "setEncoding", "setDefaultEncoding", "setTimeout", "read", "isPaused",
     "writeHead", "setHeader", "getHeader", "hasHeader", "removeHeader",
     "getHeaders", "getHeaderNames", "appendHeader", "flushHeaders",
-    "append", "delete", "get", "getSetCookie", "has", "set",
+    "add", "append", "delete", "get", "getSetCookie", "has", "set", "clear", "keys", "values", "entries", "next",
     "writeContinue", "writeEarlyHints", "cork", "uncork", "addTrailers",
     "ref", "unref", "address", "setNoDelay", "setKeepAlive", "connect",
     "resetAndDestroy", "destroySoon",
@@ -5351,7 +6081,7 @@ const DYN_DISPATCH_METHODS = new Set([
     "dispatchEvent",
     "preventDefault", "stopPropagation", "stopImmediatePropagation",
     "composedPath",
-    "json", "text", "bytes",
+    "json", "text", "bytes", "arrayBuffer",
     // Promise.prototype (SCR_DYN_PROMISE receivers): the reaction trio
     // rides the fiber machinery (scr_dyn_promise_then); on every other dyn
     // kind then/catch/finally answer the stored-member path (OBJ own
@@ -5368,9 +6098,20 @@ const DYN_DISPATCH_METHODS = new Set([
 ]);
 export function lowerDynDispatchMethodCall(lowerer, call, access, recv, arrayReceiver) {
     const method = access.name.text;
-    if (!DYN_DISPATCH_METHODS.has(method) || call.questionDotToken || access.questionDotToken)
+    if ((!DYN_DISPATCH_METHODS.has(method) && !isJsSourceFile(call.getSourceFile())) || lowerer.chainBlocked(call, access))
         return null;
     if (call.arguments.some((arg) => ts.isSpreadElement(arg))) {
+        const loc = locOf(call);
+        const local = lowerer.declareHiddenLocal("%spreadReceiver", DYN);
+        const receiver = varRef(local.id, DYN, loc);
+        const callee = { kind: "dynKeyGet", value: receiver,
+            key: { kind: "strLit", value: method, type: STRING, loc }, type: DYN, loc };
+        const spread = lowerSpreadArgsCall(lowerer, call, callee, loc);
+        if (spread?.kind === "dynCall")
+            return { kind: "seqExpr",
+                stmts: [{ kind: "varDecl", localId: local.id, init: recv, loc },
+                    { kind: "exprStmt", expr: { kind: "libCall", fn: "dyn.arrayPrototype", args: [], type: DYN, loc }, loc }],
+                result: { ...spread, receiver }, type: DYN, loc };
         lowerer.unsupported("SC1090", call, "spread arguments in calls through 'unknown' values");
     }
     const predicate = method === "filter" && call.arguments[0]
@@ -5444,7 +6185,12 @@ export function lowerDynDispatchMethodCall(lowerer, call, access, recv, arrayRec
             }
         }
     }
-    const args = call.arguments.map((arg, i) => i === 0 && predicate ? lowerer.coerceInto(arg, predicate, DYN) : lowerer.lowerExprExpecting(arg, DYN));
+    const args = call.arguments.map((arg, i) => {
+        if (i === 0 && predicate)
+            return lowerer.coerceInto(arg, predicate, DYN);
+        const undefinedArg = lowerStaticallyUndefinedArgument(lowerer, arg);
+        return undefinedArg ? defaultAfterUndefined(undefinedArg, dynUndefinedExpr(locOf(arg))) : lowerer.lowerExprExpecting(arg, DYN);
+    });
     return {
         kind: "dynInvoke",
         recv,
@@ -5494,7 +6240,8 @@ function lowerArrayIsArrayCall(lowerer, call, access) {
         // over side-effect-free reads (the operand re-evaluates/drops, the
         // `in`-operator fold discipline). dyn/caught/jsval arms have no
         // static tag answer and keep the narrow-first fence.
-        const def = lowerer.unions.get(arg.type.unionId);
+        const unionId = arg.type.unionId;
+        const def = lowerer.unions.get(unionId);
         const opaque = !def || def.arms.some((a) => a.kind === "dyn" || a.kind === "caught" || a.kind === "jsval");
         const arrayTags = lowerer.arrayValueTags(arg.type.unionId);
         const freeRead = arg.kind === "varRef" || arg.kind === "recordGet" || arg.kind === "fieldGet";
@@ -5506,7 +6253,7 @@ function lowerArrayIsArrayCall(lowerer, call, access) {
         }
         if (!opaque && freeRead && arrayTags.length > 1) {
             return arrayTags
-                .map((tag) => ({ kind: "unionIsTag", unionId: arg.type.unionId, tag, negated: false, value: arg, type: BOOL, loc }))
+                .map((tag) => ({ kind: "unionIsTag", unionId: unionId, tag, negated: false, value: arg, type: BOOL, loc }))
                 .reduce((left, right) => ({ kind: "logical", op: "||", left, right, type: BOOL, loc }));
         }
         lowerer.unsupported("SC1090", argNode, `Array.isArray on '${lowerer.fmt(arg.type)}' values (narrow first: check a discriminant field, or compare with '!== undefined'/'!== null' for unit arms)`);
@@ -5569,13 +6316,13 @@ function lowerCaughtPredicateCall(lowerer, call, caughtLocal) {
    * and String(n) lower to (Number::toString with radix 10 IS that
    * conversion, per spec) — booleans the "true"/"false" texts, and strings
    * the identity read (String.prototype.toString returns `this`). The
-   * explicit-radix number form keeps its island lowering (ISLAND_SURFACE);
+   * explicit-radix number form uses the native radix formatter;
    * null for other receivers, argument shapes, or non-lib members (a
    * user's own `.toString` takes the ordinary paths). */
 function lowerNumberToStringCall(lowerer, call, access) {
     if (lowerer.chainBlocked(call, access))
         return null;
-    if (access.name.text !== "toString" || call.arguments.length !== 0)
+    if (access.name.text !== "toString" || call.arguments.length > 1 || call.arguments.some(ts.isSpreadElement))
         return null;
     const recvKind = lowerer.mapTypeOf(lowerer.typeOf(access.expression))?.kind;
     if (recvKind !== "f64" && recvKind !== "bool" && recvKind !== "string")
@@ -5583,6 +6330,22 @@ function lowerNumberToStringCall(lowerer, call, access) {
     if (!lowerer.isStdlibMember(access))
         return null;
     const operand = lowerer.lowerExpr(access.expression);
+    // JavaScript array and typed-array reads can still be undefined even
+    // when the checker declares a number. Preserve that runtime value and
+    // let native method dispatch format numbers or throw for missing data.
+    if (operand.type.kind === "dyn") {
+        return {
+            kind: "libCall", fn: "dyn.toString", args: [operand,
+                call.arguments[0] ? lowerer.lowerExprExpecting(call.arguments[0], DYN) : dynUndefinedExpr(locOf(call)),
+                { kind: "strLit", value: access.getText(), type: STRING, loc: locOf(call) },
+            ], type: STRING, loc: locOf(call),
+        };
+    }
+    if (call.arguments.length === 1) {
+        if (operand.type.kind !== "f64")
+            return null;
+        return { kind: "libCall", fn: "num.toStringRadix", args: [operand, lowerer.lowerExprExpecting(call.arguments[0], DYN)], type: STRING, loc: locOf(call) };
+    }
     if (operand.type.kind === "string")
         return operand; // identity, receiver evaluated
     if (operand.type.kind !== "f64" && operand.type.kind !== "bool")
@@ -5727,6 +6490,13 @@ function lowerClassHasOwnPropertyCall(lowerer, call, access) {
         else
             return null; // computed static names — the answer isn't static
     }
+    if (!own.has(key)) {
+        const loc = locOf(call);
+        const data = classStaticDataFor(lowerer, info, key, loc);
+        if (data)
+            return { kind: "libCall", fn: "dyn.hasOwn", args: [data,
+                    { kind: "strLit", value: key, type: STRING, loc }], type: BOOL, loc };
+    }
     return { kind: "boolLit", value: own.has(key), type: BOOL, loc: locOf(call) };
 }
 /** Side-effect-free receiver test for the CONSTANT primitive-prototype
@@ -5941,6 +6711,12 @@ function implicitReceiverOverloadReturn(lowerer, expr) {
 function reconcileOverloadReturn(lowerer, expr, call) {
     const rsig = lowerer.checker.getResolvedSignature(expr);
     const rdecl = rsig ? lowerer.checker.signatureDeclaration(rsig) : undefined;
+    // Fluent JS overrides share the base's return ABI, but their result
+    // still has the receiver's subclass layout at the call site.
+    if (call.type.kind === "object" && rdecl && ts.isMethodDeclaration(rdecl) &&
+        isJsSourceFile(rdecl.getSourceFile()) && returnsOnlyThis(rdecl)) {
+        call = lowerer.maybeNarrow(call, expr);
+    }
     const resolvedOverload = rsig && rdecl &&
         (ts.isFunctionDeclaration(rdecl) || ts.isMethodDeclaration(rdecl)) &&
         !rdecl.body
@@ -6032,15 +6808,14 @@ function templateEscapesValid(raw) {
    * maps to string[] (type-mapper.ts), so the array rides the ordinary
    * slot-directed coercion into whatever the tag's first parameter wants
    * — string[] exactly, an `any` slot through the dyn boundary, a rest
-   * pack's first element. `.raw` does not exist on the lowered object:
-   * reads fence per member, and String.raw itself lowered above (the raw
-   * spans splice directly, no array materializes).
+   * pack's first element. Checked tags receive frozen cooked and raw
+   * arrays with the standard nonenumerable `.raw` descriptor. Typed direct
+   * tags retain the string-array representation.
    *
    * Tag forms: a top-level declared function (the direct-call fast path —
    * overload sets reconcile through the resolved signature exactly like
    * plain calls), an island value under --dynamic (engine method/function
-   * call: the engine side sees a plain marshaled array — a tag reading
-   * `.raw` there answers undefined where Node carries the raw spans), and
+   * call with the engine's cooked/raw template object), and
    * a checked-dynamic value (the dynCall boundary — a non-function tag
    * throws Node's catchable TypeError). Everything else — generic tags,
    * method tags, function-value bindings — fences by name. */
@@ -6100,10 +6875,11 @@ export function lowerTaggedTemplate(lowerer, expr) {
     if (ts.isIdentifier(expr.tag) && !lowerer.isSelfReference(expr.tag)) {
         if (lowerer.isTopLevelFnSymbol(expr.tag) && !lowerer.peekLocal(expr.tag)) {
             fenceEarlyAliasUse(lowerer, expr.tag, expr);
-            if (lowerer.genericFnOf(expr.tag)) {
+            const genericTag = lowerer.genericFnOf(expr.tag);
+            if (genericTag && !genericTag.implicitParams) {
                 lowerer.unsupported("SC1090", expr, "tagged templates with generic tag functions");
             }
-            const sig = lowerer.fnSigOf(expr.tag);
+            const sig = genericTag ? null : lowerer.fnSigOf(expr.tag);
             if (sig) {
                 lowerer.noteEdge(sig.name);
                 const args = completeArgs(lowerer, values, sig.params, loc, expr, [strings()]);
@@ -6130,10 +6906,13 @@ export function lowerTaggedTemplate(lowerer, expr) {
     // Checked-dynamic tags (`var f: any; f\`abc\``, dyn property chains):
     // the dynCall boundary — arguments convert into dyn, a non-function
     // tag throws Node's catchable "<name> is not a function" TypeError.
-    const callee = lowerer.lowerExpr(expr.tag);
+    let callee = lowerer.lowerExpr(expr.tag);
+    if (callee.type.kind === "func" && isJsSourceFile(expr.getSourceFile()) && lowerer.dynConvertible(callee.type)) {
+        callee = { kind: "dynFrom", value: callee, type: DYN, loc };
+    }
     if (callee.type.kind === "dyn") {
         const args = [
-            lowerer.coerceInto(expr.template, strings(), DYN),
+            loweredTemplateStrings(lowerer, expr, pieces.map((piece) => piece.text), loc, pieces.map(templateRawTextOf)),
             ...values.map((a) => lowerer.lowerExprExpecting(a, DYN)),
         ];
         const calleeName = ts.isPropertyAccessExpression(expr.tag) || ts.isElementAccessExpression(expr.tag)
@@ -6145,12 +6924,15 @@ export function lowerTaggedTemplate(lowerer, expr) {
     }
     lowerer.unsupported("SC1090", expr, "tagged templates with this tag form (top-level functions and dynamic values tag; call the function directly otherwise)");
 }
-function loweredTemplateStrings(lowerer, expr, cooked, loc) {
+function loweredTemplateStrings(lowerer, expr, cooked, loc, raw) {
     // Normal runtime construction keeps this array aligned with the current
-    // ScrArr layout in both backends. The old static-header IR node encoded the
+    // ScrArr layout in the backend. The old static-header IR node encoded the
     // pre-sparse layout in LLVM and crashed as soon as a tag read its strings.
-    const type = arrayOf(STRING);
-    const key = `templateStringsGlobal:${loc.file}:${expr.template.getStart()}`;
+    const type = raw ? DYN : arrayOf(STRING);
+    const array = (values) => ({ kind: "dynArrLit", elems: values.map((value) => ({ kind: "dynFrom", value: { kind: "strLit", value, type: STRING, loc }, type: DYN, loc })), type: DYN, loc });
+    const freeze = (value) => ({ kind: "libCall", fn: "dyn.freeze", args: [value], type: DYN, loc });
+    const checked = raw ? freeze({ kind: "libCall", fn: "dyn.defineProperty", args: [array(cooked), { kind: "dynFrom", value: { kind: "strLit", value: "raw", type: STRING, loc }, type: DYN, loc }, { kind: "dynObjLit", fields: [{ key: { kind: "strLit", value: "value", type: STRING, loc }, value: freeze(array(raw)) }], type: DYN, loc }], type: DYN, loc }) : null;
+    const key = `templateStringsGlobal:${loc.file}:${expr.template.getStart()}:${raw ? "checked" : "typed"}`;
     let getter = lowerer.widthHelpers.get(key);
     if (!getter) {
         const site = lowerer.globalsList.length;
@@ -6172,7 +6954,7 @@ function loweredTemplateStrings(lowerer, expr, cooked, loc) {
                         {
                             kind: "assign",
                             localId: globalId,
-                            value: {
+                            value: checked ?? {
                                 kind: "arrayLit",
                                 elems: cooked.map((value) => ({ kind: "strLit", value, type: STRING, loc })),
                                 type,
@@ -6204,7 +6986,7 @@ export function isTopLevelFnSymbol(lowerer, ident) {
     const decl = symbol ? lowerer.checker.declarationsOf(symbol)[0] : undefined;
     return (!!decl &&
         ts.isFunctionDeclaration(decl) &&
-        (ts.isSourceFile(decl.parent) || lowerer.nsBlocks.get(decl.parent) === "flattened"));
+        (ts.isSourceFile(decl.parent) || (decl.parent !== undefined && lowerer.nsBlocks.get(decl.parent) === "flattened")));
 }
 /** Nested `function name(...) {...}`: declare the mutable function binding
    * before lowering its body, then initialize it with the lifted closure.
@@ -6246,6 +7028,22 @@ export function lowerNestedFunctionDecl(lowerer, stmt) {
 export function lambdaSignature(lowerer, node) {
     if (!node.body)
         lowerer.unsupported("SC1090", node, "function overload signatures");
+    // A JS replacement of a native stream's write method receives the
+    // actual call tuple, including overloads and omitted arguments. Node's
+    // contextual overload signature cannot define this closure's ABI.
+    if (isJsSourceFile(node.getSourceFile()) && !node.type &&
+        (ts.isFunctionExpression(node) || ts.isArrowFunction(node)) &&
+        node.parameters.every((param) => !param.type && !param.dotDotDotToken && !param.initializer) &&
+        ts.isBinaryExpression(node.parent) && node.parent.right === node &&
+        node.parent.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
+        ts.isPropertyAccessExpression(node.parent.left) && node.parent.left.name.text === "write" &&
+        lowerer.isStdlibMember(node.parent.left)) {
+        const receiver = lowerer.lowerExpr(node.parent.left.expression);
+        if (receiver.type.kind === "dyn") {
+            const shapes = node.parameters.map(() => ({ type: DYN, mode: "required" }));
+            return { shapes, funcType: funcTypeFromParamShapes(shapes, DYN) };
+        }
+    }
     if (node.typeParameters) {
         // Generic function-like forms monomorphize only where a static home
         // exists: top-level generic function declarations, generic methods
@@ -6261,6 +7059,23 @@ export function lambdaSignature(lowerer, node) {
                 : "generic arrow/function expressions outside a never-reassigned module-scope binding (only `const f = <T>(x: T) => ...` bindings and top-level generic function declarations monomorphize)");
     }
     const shapes = lowerer.paramShapes(node.parameters);
+    // Error-first callbacks captured by native filesystem adapters receive
+    // the selected runtime overload. Ambient contextual inference can pick
+    // the string overload even when options request a Buffer.
+    if ((ts.isArrowFunction(node) || ts.isFunctionExpression(node)) && ts.isCallExpression(node.parent) &&
+        node.parent.arguments.at(-1) === node) {
+        const builtin = ts.isPropertyAccessExpression(node.parent.expression) ? lowerer.builtinMemberOf(node.parent.expression)
+            : ts.isIdentifier(node.parent.expression) ? lowerer.builtinImportOf(node.parent.expression) : null;
+        if (builtin?.module === "fs" && builtin.member !== "rename" && builtinModuleFnOf(lowerer, builtin.module, builtin.member)?.fn === "fs.callbackCall") {
+            for (let index = 0; index < shapes.length; index++) {
+                if (!node.parameters[index]?.type) {
+                    shapes[index].type = DYN;
+                    if (shapes[index].bodyType)
+                        shapes[index].bodyType = DYN;
+                }
+            }
+        }
+    }
     // A concise arrow over an h2-only stream/session call (`() =>
     // req.stream.destroy()`): the call ALWAYS throws on this lowering
     // (stream is undefined — the streamUndefCall precedent), so the body
@@ -6271,8 +7086,8 @@ export function lambdaSignature(lowerer, node) {
         : lowerer.declaredReturnType(node, node);
     ret = lowerer.runtimeOptionalFunctionReturnType(node, ret);
     // A contextually-typed arrow/function EXPRESSION whose slot signature
-    // returns a UNION the inferred return doesn't spell adopts the slot's
-    // return as its ABI: `(n) => work()` (inferring Promise<void>) against
+    // returns a composite type the inferred return doesn't spell adopts
+    // the slot's return as its ABI: `(n) => work()` (inferring Promise<void>) against
     // an `(n) => Promise<void> | void` field must RETURN that union — the
     // body's returns coerce into it per return site (arm values wrap;
     // width-coercible records rebuild into their arm — the runJobs
@@ -6286,6 +7101,9 @@ export function lambdaSignature(lowerer, node) {
     // returns coerce; the spawn-wrapper ABI still returns a promise).
     // jsval-returning bodies stay out (adoption would force validated
     // exits the writer never asked for).
+    // Array and record returns also need the destination during literal
+    // construction: a callback building IrStmt[] must wrap each element at
+    // that recursive layout instead of first inferring narrower arrays.
     const isAsyncLike = !ts.isMethodDeclaration(node) &&
         node.modifiers?.some((m) => m.kind === ts.SyntaxKind.AsyncKeyword) === true;
     const innerRet = isAsyncLike && ret.kind === "promise" ? ret.inner : ret;
@@ -6310,8 +7128,8 @@ export function lambdaSignature(lowerer, node) {
             ? lowerer.mapTypeOf(lowerer.checker.getReturnTypeOfSignature(ctxSigs[0]))
             : null;
         const ctxRet = isAsyncLike && ctxRetRaw?.kind === "promise" ? ctxRetRaw.inner : ctxRetRaw;
-        if (ctxRet?.kind === "union" &&
-            (innerRet.kind === "void" ? lowerer.armTag(ctxRet.unionId, UNDEFINED_T) >= 0 : true)) {
+        if ((ctxRet?.kind === "union" || ctxRet?.kind === "array" || ctxRet?.kind === "record") &&
+            (innerRet.kind !== "void" || (ctxRet.kind === "union" && lowerer.armTag(ctxRet.unionId, UNDEFINED_T) >= 0))) {
             ret = isAsyncLike ? { kind: "promise", inner: ctxRet } : ctxRet;
         }
         // A VOID slot discards the callback's result (TS's void-returning
@@ -6331,38 +7149,48 @@ export function lambdaSignature(lowerer, node) {
             ret = VOID;
         }
     }
+    ret = lowerer.contextualFunctionReturns.get(node) ?? ret;
     // A plain JS function reading `arguments` receives one hidden dyn
     // array. With named parameters, the array contains every actual
     // argument and only ES modules are admitted: sloppy-mode arguments
     // alias named parameters. Arrows inherit the enclosing `arguments`.
     const hasRest = shapes.some((s) => s.mode === "rest" || s.mode === "dynRest" || s.mode === "islandRest");
     const usesArguments = !hasRest &&
-        (ts.isFunctionExpression(node) || ts.isFunctionDeclaration(node)) &&
+        (ts.isFunctionExpression(node) || ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node)) &&
         isJsSourceFile(node.getSourceFile()) &&
         bodyReadsArguments(node);
-    if (usesArguments && node.parameters.length > 0) {
-        if (!isNodeEsmFile(node.getSourceFile())) {
-            lowerer.unsupported("SC1090", node, "parameterized 'arguments' outside an ES module (sloppy-mode parameter aliases)");
+    if (usesArguments) {
+        if (node.parameters.length > 0 || ts.isMethodDeclaration(node)) {
+            const classMethod = ts.isMethodDeclaration(node) &&
+                (ts.isClassDeclaration(node.parent) || ts.isClassExpression(node.parent));
+            if (!classMethod && !isNodeEsmFile(node.getSourceFile(), lowerer.program)) {
+                lowerer.unsupported("SC1090", node, "parameterized 'arguments' outside an ES module (sloppy-mode parameter aliases)");
+            }
         }
         shapes.push({ type: DYN, mode: "arguments" });
     }
     const funcType = funcTypeFromParamShapes(shapes, ret);
-    if (usesArguments)
-        funcType.rest = true;
     return { shapes, funcType };
 }
 /** Lifts an arrow function / function expression / nested declaration /
    * object-literal shorthand method to a module-level function and yields
    * the `closure` expression creating it. */
 export function lowerLambda(lowerer, node) {
+    const prepared = (ts.isArrowFunction(node) || ts.isFunctionExpression(node)) ? lowerer.preparedClassFactories.get(node) : undefined;
+    if (prepared)
+        return prepared;
     const loc = locOf(node);
-    const { shapes, funcType } = lowerer.lambdaSignature(node);
+    const signature = lowerer.lambdaSignature(node);
+    const { shapes } = signature;
+    let { funcType } = signature;
     // A lambda IS a value: the completed-ABI rule applies at birth. The
     // contextual (target) type decides — `(x?: number) => void` may flow
     // into a slot annotated `(x: number | undefined) => void` (same ABI
     // signature), anything else is fenced. Nested function declarations and
     // object-literal shorthand methods aren't expressions — always fenced.
-    lowerer.requireExactArityValue(node, ts.isArrowFunction(node) || ts.isFunctionExpression(node) ? node : null, shapes, funcType);
+    if (!(ts.isMethodDeclaration(node) && isJsSourceFile(node.getSourceFile()) &&
+        canBoxFuncIntoDyn(funcType, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))))
+        lowerer.requireExactArityValue(node, ts.isArrowFunction(node) || ts.isFunctionExpression(node) ? node : null, shapes, funcType);
     const nameIdent = !ts.isArrowFunction(node) && node.name && ts.isIdentifier(node.name) ? node.name : null;
     const baseName = nameIdent ? nameIdent.text : "";
     const fnName = `%fn${lowerer.lambdaCounter++}${baseName ? `_${baseName}` : ""}`;
@@ -6386,10 +7214,18 @@ export function lowerLambda(lowerer, node) {
     if (isGenerator &&
         (funcType.ret.kind !== "generator" || (funcType.ret.async === true) !== isAsync))
         lowerer.badType(node, lowerer.typeOf(node));
-    const bodyReturn = isGenerator
+    let bodyReturn = isGenerator
         ? lowerer.genBodyReturnType(funcType.ret)
         : lowerer.bodyReturnType(isAsync, funcType.ret);
     const fnCtx = newFnCtx(true, selfSymbol, funcType, bodyReturn);
+    const inferredSignature = isJsSourceFile(node.getSourceFile()) && !node.type ? lowerer.checker.getSignatureFromDeclaration(node) : undefined;
+    const returnsConstructor = inferredSignature && producesConstructor(lowerer, lowerer.checker.getReturnTypeOfSignature(inferredSignature));
+    if (isJsSourceFile(node.getSourceFile()) && !node.type && !isAsync && !isGenerator &&
+        (bodyReturn.kind === "classval" || bodyReturn.kind === "date" || bodyReturn.kind === "symbol" || bodyReturn.kind === "record" ||
+            (bodyReturn.kind === "dyn" || bodyReturn.kind === "func") && returnsConstructor)) {
+        fnCtx.inferReturn = { entries: [] };
+    }
+    fnCtx.inheritsArguments = ts.isArrowFunction(node);
     fnCtx.isAsync = isAsync;
     if (isGenerator && funcType.ret.kind === "generator") {
         fnCtx.generator = generatorMeta(lowerer, funcType.ret);
@@ -6398,14 +7234,30 @@ export function lowerLambda(lowerer, node) {
     lowerer.fnStack.push(fnCtx);
     try {
         const { params, prologue } = lowerer.declareParams(node.parameters, shapes);
+        // Checked JavaScript functions take their receiver from the call site.
+        // Store it as this function's binding so escaping arrows capture it,
+        // and a method nested inside another method never captures its owner.
+        if (isJsSourceFile(node.getSourceFile()) && !ts.isArrowFunction(node)) {
+            const receiver = lowerer.declareThis(DYN);
+            prologue.unshift({ kind: "varDecl", localId: receiver.id, init: { kind: "libCall", fn: isGenerator ? "dyn.generatorThis" : "dyn.this", args: [], type: DYN, loc }, loc });
+        }
         // The synthetic trailing dyn-array param carries `arguments`.
         // Parameterized functions receive all actual arguments; zero-param
         // functions receive the same array through their rest ABI.
-        if (funcType.rest && !shapes.some((s) => s.mode === "dynRest" || s.mode === "islandRest")) {
+        if (funcType.rest && funcType.restAbi === undefined && !shapes.some((s) => s.mode === "dynRest" || s.mode === "islandRest")) {
             const argsLocal = lowerer.declareHiddenLocal("%arguments", DYN);
             params.push({ localId: argsLocal.id, name: "%arguments", type: DYN });
             fnCtx.argumentsLocal = argsLocal;
         }
+        if (isJsSourceFile(node.getSourceFile()) && !ts.isArrowFunction(node) &&
+            shapes.length === 1 && shapes[0]?.mode === "dynRest" && bodyReadsArguments(node)) {
+            const argsLocal = lowerer.declareHiddenLocal("%arguments", DYN);
+            prologue.push({ kind: "varDecl", localId: argsLocal.id, init: {
+                    kind: "dynInvoke", recv: varRef(params[0].localId, DYN, loc), method: "slice",
+                    calleeName: "Array.prototype.slice", args: [], type: DYN, loc,
+                }, loc });
+            fnCtx.argumentsLocal = argsLocal;
+        }
         let body;
         if (ts.isBlock(node.body)) {
             body = lowerer.lowerStmts(node.body.statements);
@@ -6438,7 +7290,9 @@ export function lowerLambda(lowerer, node) {
                 }
             }
             else {
-                let value = lowerer.lowerExpr(bodyExpr);
+                // Concise and block bodies use the same destination layout for
+                // fresh literals. Async bodies must inspect promises first.
+                let value = isAsync || fnCtx.inferReturn ? lowerer.lowerExpr(bodyExpr) : lowerer.lowerExprExpecting(bodyExpr, bodyReturn);
                 // An async concise body whose value is itself a promise
                 // (`async () => p`): the async machinery RESOLVES the returned
                 // thenable into the function's own promise — lowerReturnValue's
@@ -6452,22 +7306,32 @@ export function lowerLambda(lowerer, node) {
                         : [
                             {
                                 kind: "return",
-                                value: lowerer.coerceInto(bodyExpr, value, bodyReturn),
+                                value: fnCtx.inferReturn ? value : lowerer.coerceInto(bodyExpr, value, bodyReturn),
                                 loc: locOf(node.body),
                             },
                         ];
+                if (fnCtx.inferReturn && body[0]?.kind === "return")
+                    fnCtx.inferReturn.entries.push({ stmt: body[0], node: bodyExpr });
             }
         }
+        if (fnCtx.inferReturn) {
+            bodyReturn = resolveInferredReturn(lowerer, { returnType: bodyReturn }, fnCtx.inferReturn, body, node);
+            funcType = { ...funcType, ret: bodyReturn };
+            fnCtx.returnType = bodyReturn;
+        }
         body = [...prologue, ...body];
         // Bare-expression bodies never pass through lowerStmts, so the
         // lib-boundary chokepoint runs here (idempotent for block bodies,
         // whose statements were already walked). A fence poisons the
         // enclosing statement — the lambda IS part of it.
+        body = lowerSurplusCalls(lowerer, body);
         enforceLibBoundary(lowerer, body);
         appendImplicitUndefinedReturn(lowerer, body, bodyReturn, loc);
         const ctx = lowerer.ctx;
         const lifted = {
             name: fnName,
+            sourceName: jsFuncNameOf(node) ?? "<anonymous>",
+            ...(!isAsync && !isGenerator && (ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node)) ? { ownsPrototype: true } : {}),
             params,
             returnType: bodyReturn,
             locals: ctx.locals,
@@ -6614,7 +7478,7 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
     const member = access.name.text;
     if (member !== "then" && member !== "catch" && member !== "finally")
         return null;
-    let recvT = lowerer.mapTypeOf(lowerer.typeOf(access.expression));
+    let recvT = lowerer.mapTypeOf(lowerer.typeOf(access.expression)) ?? dynFallbackType(lowerer, access.expression, lowerer.typeOf(access.expression));
     // A dynamic-import promise under an unmappable checker type
     // (`Promise<typeof import("./m")>` — module-namespace types have no
     // static mapping): the BINDING holds the island promise
@@ -6667,6 +7531,8 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
             loc,
         };
     }
+    if (receiver.type.kind === "dyn" && lowerer.dynConvertible(recvT))
+        receiver = lowerer.coerceInto(access.expression, receiver, recvT);
     if (receiver.type.kind !== "promise") {
         // mapTypeOf said promise but the value lowered as something else —
         // a lowering gap, named rather than ICEd on.
@@ -6810,10 +7676,12 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
                         }));
                     }
                     else {
+                        if (settled.type.kind !== "dyn" &&
+                            !canConvertToDyn(settled.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
+                            lowerer.unsupported("SC1090", fulfilledNode, "then fulfillment values that cannot cross the checked-dynamic boundary");
+                        }
                         const arg = settled.type.kind === "dyn" ? settled
-                            : canConvertToDyn(settled.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))
-                                ? { kind: "dynFrom", value: settled, type: DYN, loc }
-                                : lowerer.unsupported("SC1090", fulfilledNode, "then fulfillment values that cannot cross the checked-dynamic boundary");
+                            : { kind: "dynFrom", value: settled, type: DYN, loc };
                         body.push(...resultOf({
                             kind: "dynCall",
                             callee: { kind: "varRef", localId: fLocal.id, type: DYN, loc },
@@ -6957,7 +7825,7 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
             lowerer.unsupported("SC1090", call.arguments[0], "then handlers with more than one parameter (the two-argument onRejected form has no lowering — chain .catch(...) instead)");
         }
         const param = cb.type.params[0];
-        if (param !== undefined && !typeEquals(param, inner)) {
+        if (param !== undefined && !typeEquals(param, inner) && !(inner.kind === "void" && param.kind === "dyn")) {
             lowerer.unsupported("SC1090", call.arguments[0], `then handlers whose parameter is not the settled value's type (expected '${lowerer.fmt(inner)}', got '${lowerer.fmt(param)}')`);
         }
         const resultT = lowerer.mapTypeOf(lowerer.typeOf(call));
@@ -6991,6 +7859,8 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
             }
             else {
                 body.push({ kind: "exprStmt", expr: awaitE, loc });
+                if (param !== undefined)
+                    handlerArgs = [dynUndefinedExpr(loc)];
             }
             const handlerCall = {
                 kind: "callValue",
@@ -7677,7 +8547,8 @@ export function recordKeysArrayCall(lowerer, receiver, argIr, shape, loc) {
             loc,
         };
         const finalize = () => {
-            const current = lowerer.shapes.get(argIr.shapeId) ?? shape;
+            const latest = lowerer.shapes.get(argIr.shapeId);
+            const current = latest !== undefined ? latest : shape;
             const body = [
                 { kind: "varDecl", localId: "out.0", init: { kind: "arrayLit", elems: [], type: resultT, loc }, loc },
             ];
@@ -7727,10 +8598,11 @@ export function recordKeysArrayCall(lowerer, receiver, argIr, shape, loc) {
     return { kind: "call", callee: helper, args: [receiver], type: resultT, loc };
 }
 /** Interned `%obj.hasOwn.<n>(r, k)` — Object.hasOwn's membership walk
- * over a signature-free record shape: the key compares against each
+ * over a record shape: the key compares against each
  * declared field name, undefined-armed fields answering by their tag
  * (a key is own exactly when Object.keys would list it — the two share
- * the guard), everything else true, no match false. */
+ * the guard), everything else true. Unmatched keys probe the overflow
+ * map when present, so explicit undefined values remain own keys. */
 function recordHasOwnHelper(lowerer, shapeId, loc) {
     const key = `obj.hasOwn:${shapeId}`;
     const existing = lowerer.arrHofHelpers.get(key);
@@ -7764,7 +8636,10 @@ function recordHasOwnHelper(lowerer, shapeId, loc) {
             loc,
         });
     }
-    body.push({ kind: "return", value: { kind: "boolLit", value: false, type: BOOL, loc }, loc });
+    const fallback = shape.indexValue
+        ? { kind: "recordOvfHas", obj: rRef, shapeId, key: kRef, type: BOOL, loc }
+        : { kind: "boolLit", value: false, type: BOOL, loc };
+    body.push({ kind: "return", value: fallback, loc });
     lowerer.liftedFns.push({
         name: helper,
         params: [
@@ -7944,6 +8819,44 @@ function lowerObjectStaticCall(lowerer, call, access) {
     if (!lowerer.isStdlibGlobal(access.expression, "Object"))
         return null;
     const member = access.name.text;
+    if ((member === "getOwnPropertyNames" || member === "getOwnPropertySymbols" || member === "getOwnPropertyDescriptors") && call.arguments.length === 1 &&
+        !call.arguments.some(ts.isSpreadElement) && !lowerer.dynamic) {
+        let object = lowerer.lowerExpr(call.arguments[0]);
+        if (object.type.kind === "string" || object.type.kind === "f64" ||
+            object.type.kind === "bool" || isUnitType(object.type))
+            object = { kind: "dynFrom", value: object, type: DYN, loc: locOf(call) };
+        if (object.type.kind === "dyn")
+            return { kind: "libCall", fn: member === "getOwnPropertyNames" ? "dyn.getOwnPropertyNames" : member === "getOwnPropertySymbols" ? "dyn.getOwnPropertySymbols" : "dyn.getOwnPropertyDescriptors", args: [object], type: DYN, loc: locOf(call) };
+    }
+    if ((member === "getPrototypeOf" || member === "setPrototypeOf") &&
+        call.arguments.length === (member === "getPrototypeOf" ? 1 : 2) &&
+        !call.arguments.some(ts.isSpreadElement) && !lowerer.dynamic) {
+        let object = lowerer.lowerExpr(call.arguments[0]);
+        if (object.type.kind === "func") {
+            const fnName = jsFuncNameOf(call.arguments[0]);
+            object = { kind: "dynFrom", value: object, type: DYN, loc: locOf(call),
+                ...(fnName !== null ? { fnName } : {}) };
+        }
+        if (object.type.kind !== "dyn" && canConvertToDyn(object.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id)))
+            object = lowerer.coerceInto(call.arguments[0], object, DYN);
+        if (object.type.kind === "dyn") {
+            const loc = locOf(call);
+            if (member === "getPrototypeOf")
+                return { kind: "libCall", fn: "dyn.getPrototype", args: [object], type: DYN, loc };
+            const prototype = lowerer.lowerExprExpecting(call.arguments[1], DYN);
+            if (prototype.type.kind === "dyn")
+                return { kind: "libCall", fn: "dyn.setPrototype", args: [object, prototype], type: DYN, loc };
+        }
+    }
+    if (member === "getOwnPropertyDescriptor" && call.arguments.length === 2) {
+        const [receiver, key] = call.arguments;
+        if (receiver && key && ts.isPropertyAccessExpression(receiver) && receiver.name.text === "prototype" &&
+            lowerer.isStdlibGlobal(receiver.expression, "ArrayBuffer") && ts.isStringLiteral(key) && key.text === "byteLength") {
+            const loc = locOf(call);
+            const getter = lowerer.lowerNativeCallableValue({ fn: "arrayBuffer.byteLengthGetter", params: [], result: F64, valueParams: [] }, "get ArrayBuffer.prototype.byteLength", loc);
+            return { kind: "libCall", fn: "arrayBuffer.byteLengthDescriptor", args: [lowerer.coerceToExpected(getter, DYN)], type: DYN, loc };
+        }
+    }
     const cacheKeys = lowerRequireCacheKeys(lowerer, call, member);
     if (cacheKeys)
         return cacheKeys;
@@ -7982,7 +8895,7 @@ function lowerObjectStaticCall(lowerer, call, access) {
         if (unitTest)
             return unitTest;
         if (lk === "dyn" || rk === "dyn" || lk === "jsval" || rk === "jsval") {
-            lowerer.noLowering("Object.is over a dynamic operand", call, "validate/narrow the value first (strict equality's rule) — SameValue only differs from === on numbers (NaN, ±0)");
+            return { kind: "libCall", fn: "dyn.sameValue", args: [lowerer.coerceInto(leftNode, left, DYN), lowerer.coerceInto(rightNode, right, DYN)], type: BOOL, loc };
         }
         if (left.type.kind === "union" || right.type.kind === "union") {
             const ut = left.type.kind === "union" ? left.type : right.type;
@@ -8045,23 +8958,14 @@ function lowerObjectStaticCall(lowerer, call, access) {
         }
         lowerer.noLowering(`Object.is over '${lowerer.fmt(left.type)}' and '${lowerer.fmt(right.type)}' operands`, call, "the operands must share one comparable kind (numbers, strings, booleans, units, one union shape, or one reference type)");
     }
-    // Object.create — the null-prototype DICTIONARY (`Object.create(null)`
-    // then keyed assignment, the memo-table idiom prettier's index/
-    // group-mode maps spell) and, under --dynamic, the engine's own
-    // Object.create for engine-held prototypes. Everything else is a
-    // NAMED fence: the compiled representations have no prototype chain,
-    // and the own-copy stand-in would answer WRONG observably — Node's
-    // Object.keys/inspect/JSON of the created object list NO own keys,
-    // and mutating the prototype afterwards is visible through the
-    // created object (live delegation), which no copy can honor.
+    // Native checked objects retain a live prototype and can install an
+    // own-property descriptor table during creation. Engine-held values
+    // use the engine's Object.create path below.
     if (member === "create") {
         if (call.arguments.some((a) => ts.isSpreadElement(a))) {
             lowerer.noLowering("Object.create with spread arguments", call);
         }
-        if (call.arguments.length >= 2) {
-            lowerer.noLowering("Object.create with a properties-descriptor argument", call, "create first, then assign: const o = Object.create(null); o.k = v");
-        }
-        if (call.arguments.length !== 1) {
+        if (call.arguments.length < 1 || call.arguments.length > 2) {
             lowerer.noLowering(`Object.create with ${call.arguments.length} arguments`, call);
         }
         const loc = locOf(call);
@@ -8070,6 +8974,8 @@ function lowerObjectStaticCall(lowerer, call, access) {
             protoNode = protoNode.expression;
         const nullProto = protoNode.kind === ts.SyntaxKind.NullKeyword;
         if (lowerer.dynamic) {
+            if (call.arguments.length === 2)
+                lowerer.noLowering("Object.create with properties under --dynamic", call);
             // The checker types the result `any` — an ENGINE value under
             // --dynamic — and the engine's own Object.create answers with
             // REAL prototype semantics: reads delegate LIVE, writes shadow,
@@ -8090,15 +8996,41 @@ function lowerObjectStaticCall(lowerer, call, access) {
             }
             lowerer.noLowering(`Object.create over '${lowerer.fmt(proto.type)}' prototypes`, call, "prototype reads delegate LIVE in Node (mutating the prototype shows through the created object), which the boundary's deep copy cannot honor — only null and engine-held ('any') prototypes lower");
         }
-        if (nullProto) {
+        if (nullProto && call.arguments.length === 1) {
             return { kind: "libCall", fn: "dyn.objCreateNullProto", args: [], type: DYN, loc };
         }
-        const proto = lowerer.lowerExpr(protoNode);
-        lowerer.noLowering(`Object.create over '${lowerer.fmt(proto.type)}' prototypes`, call, "the compiled representations have no prototype chain, and an own-copy would answer wrong observably (Node lists NO own keys on the created object, and prototype mutations show through it live) — only Object.create(null) lowers");
+        let proto = nullProto
+            ? { kind: "dynFrom", value: { kind: "unitLit", unit: "null", type: NULL_T, loc }, type: DYN, loc }
+            : ts.isObjectLiteralExpression(protoNode)
+                ? lowerer.lowerExprExpecting(protoNode, DYN)
+                : lowerer.lowerExpr(protoNode);
+        if (isUnitType(proto.type) || proto.type.kind === "f64" || proto.type.kind === "bool" || proto.type.kind === "string")
+            proto = { kind: "dynFrom", value: proto, type: DYN, loc };
+        if (proto.type.kind === "dyn") {
+            if (call.arguments.length === 1)
+                return { kind: "libCall", fn: "dyn.objCreate", args: [proto], type: DYN, loc };
+            const descriptors = lowerer.lowerExprExpecting(call.arguments[1], DYN);
+            if (descriptors.type.kind === "dyn")
+                return { kind: "libCall", fn: "dyn.objCreateWithProperties", args: [proto, descriptors], type: DYN, loc };
+        }
+        lowerer.noLowering(`Object.create over '${lowerer.fmt(proto.type)}' prototypes`, call);
     }
     // `Object.assign(fn, { props })` whose RESULT type maps to the hybrid
     // (function-with-properties) record: the chalk-shape CONSTRUCTOR.
     if (member === "assign") {
+        const prototype = lowerClassPrototypeAssign(lowerer, call);
+        if (prototype)
+            return prototype;
+        if (isJsSourceFile(call.getSourceFile()) && call.arguments.length > 0 && !call.arguments.some(ts.isSpreadElement)) {
+            const target = tryLowerExpression(lowerer, call.arguments[0]);
+            if (target && ((target.type.kind === "func" && lowerer.dynConvertible(target.type)) ||
+                (target.type.kind === "object" && lowerer.errorHierarchyClassOf(target.type.className)))) {
+                const loc = locOf(call);
+                return { kind: "libCall", fn: "dyn.assignAll", args: [lowerer.coerceToExpected(target, DYN),
+                        { kind: "dynArrLit", elems: call.arguments.slice(1).map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc },
+                    ], type: DYN, loc };
+            }
+        }
         const hybrid = lowerObjectAssignHybrid(lowerer, call);
         if (hybrid)
             return hybrid;
@@ -8145,7 +9077,9 @@ function lowerObjectStaticCall(lowerer, call, access) {
             if (tProbe?.type.kind === "dyn") {
                 const loc = locOf(call);
                 const target = lowerer.lowerExpr(call.arguments[0]);
-                const source = lowerer.coerceToExpected(lowerer.lowerExpr(call.arguments[1]), DYN);
+                const rawSource = lowerer.lowerExpr(call.arguments[1]);
+                fenceSymbolFieldCopy(lowerer, call.arguments[1], rawSource.type);
+                const source = lowerer.coerceToExpected(rawSource, DYN);
                 if (target.type.kind === "dyn" && source.type.kind === "dyn") {
                     return { kind: "libCall", fn: "dyn.assign", args: [target, source], type: DYN, loc };
                 }
@@ -8222,7 +9156,9 @@ function lowerObjectStaticCall(lowerer, call, access) {
                         const argNode = sources[i];
                         const spread = ts.isSpreadElement(argNode);
                         const srcNode = spread ? argNode.expression : argNode;
-                        const src = lowerer.coerceToExpected(lowerer.lowerExpr(srcNode), DYN);
+                        const rawSource = lowerer.lowerExpr(srcNode);
+                        fenceSymbolFieldCopy(lowerer, srcNode, rawSource.type, spread);
+                        const src = lowerer.coerceToExpected(rawSource, DYN);
                         if (src.type.kind !== "dyn") {
                             ok = false;
                             break;
@@ -8259,22 +9195,82 @@ function lowerObjectStaticCall(lowerer, call, access) {
         }
         return null;
     }
+    if ((member === "defineProperty" && call.arguments.length === 3) ||
+        (member === "getOwnPropertyDescriptor" && call.arguments.length === 2)) {
+        if (call.arguments.some((a) => ts.isSpreadElement(a)))
+            return null;
+        let target = tryLowerExpression(lowerer, call.arguments[0]);
+        const targetNode = call.arguments[0];
+        // The checker gives C.prototype the instance type, but its lowered
+        // value is the shared prototype table, not an instance to unbox.
+        const prototypeTarget = ts.isPropertyAccessExpression(targetNode) && targetNode.name.text === "prototype" &&
+            (exactClassOfReceiver(lowerer, targetNode.expression) !== null || storedClassValueType(lowerer, targetNode.expression)?.kind === "classval");
+        const declaredTarget = target?.type.kind === "dyn" && !prototypeTarget && !isJsSourceFile(targetNode.getSourceFile()) ? lowerer.mapTypeOf(lowerer.typeOf(targetNode)) : null;
+        if (target && declaredTarget && isDynTypedRefType(declaredTarget))
+            target = lowerer.coerceToExpected(target, declaredTarget);
+        if (target && member === "defineProperty") {
+            const native = lowerClassDataDescriptor(lowerer, call, member, target);
+            if (native)
+                return native;
+        }
+        if (target && member === "getOwnPropertyDescriptor" && isDynTypedRefType(target.type)) {
+            const descriptor = lowerClassDescriptorRead(lowerer, call, target);
+            if (descriptor)
+                return descriptor;
+            target = lowerer.coerceToExpected(target, DYN);
+        }
+        // Error instances share a live property table with their checked view.
+        const keyNode = call.arguments[1];
+        if (target?.type.kind === "object" && target.type.className !== "%DOMException" && lowerer.errorHierarchyClassOf(target.type.className) &&
+            ((ts.isStringLiteral(keyNode) && (keyNode.text === "cause" || keyNode.text === "message")) || lowerer.mapTypeOf(lowerer.typeOf(keyNode))?.kind === "symbol")) {
+            target = lowerer.coerceToExpected(target, DYN);
+        }
+        if (target?.type.kind === "func" && lowerer.dynConvertible(target.type)) {
+            const fnName = jsFuncNameOf(call.arguments[0]);
+            target = { kind: "dynFrom", value: target, type: DYN, loc: locOf(call.arguments[0]), ...(fnName !== null ? { fnName } : {}) };
+        }
+        const descriptorPrimitive = member === "getOwnPropertyDescriptor" && target &&
+            (target.type.kind === "bool" || target.type.kind === "f64" || target.type.kind === "string");
+        if (!target || (target.type.kind !== "dyn" && !isUnitType(target.type) && !descriptorPrimitive))
+            return null;
+        if (target.type.kind !== "dyn")
+            target = { kind: "dynFrom", value: target, type: DYN, loc: locOf(call.arguments[0]) };
+        const key = lowerer.lowerExprExpecting(call.arguments[1], DYN);
+        if (key.type.kind !== "dyn")
+            return null;
+        if (member === "getOwnPropertyDescriptor") {
+            return { kind: "libCall", fn: "dyn.getOwnPropertyDescriptor", args: [target, key], type: DYN, loc: locOf(call) };
+        }
+        const descriptor = lowerer.lowerExprExpecting(call.arguments[2], DYN);
+        if (descriptor.type.kind !== "dyn")
+            return null;
+        return { kind: "libCall", fn: "dyn.defineProperty", args: [target, key, descriptor], type: DYN, loc: locOf(call) };
+    }
     // Object.defineProperties over a CHECKED-DYNAMIC target (test/common's
     // _mustCallInner copying name/length onto the mustCall wrapper): the
-    // runtime turns each descriptor's `value` into a plain own property on
-    // the dyn node (OBJ members; FUNC nodes carry an own-property table) —
-    // flags accepted and ignored, accessors throw loudly (SEMANTICS.md).
+    // runtime turns each descriptor's `value` into an own property on
+    // the dyn node (OBJ members preserve attributes; FUNC nodes carry an
+    // own-property table). Accessors use the target as their receiver.
     // The result is the target, like JS. Typed targets keep the fence:
     // static shapes have no property table to extend.
     if (member === "defineProperties" && call.arguments.length === 2 &&
         !call.arguments.some((a) => ts.isSpreadElement(a))) {
         let target = tryLowerExpression(lowerer, call.arguments[0]);
+        if (target) {
+            const native = lowerClassDataDescriptor(lowerer, call, member, target);
+            if (native)
+                return native;
+        }
         // A FUNCTION-typed target boxes through the dyn boundary: the
         // property table lives on the CLOSURE (shared by every box of this
         // function value), so defining through a fresh box sticks — the
         // wrapper returned later reads the same table.
         if (target && target.type.kind === "func" &&
             canBoxFuncIntoDyn(target.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
+            const fnName = jsFuncNameOf(call.arguments[0]);
+            target = { kind: "dynFrom", value: target, type: DYN, loc: locOf(call.arguments[0]), ...(fnName !== null ? { fnName } : {}) };
+        }
+        if (target && isUnitType(target.type)) {
             target = { kind: "dynFrom", value: target, type: DYN, loc: locOf(call.arguments[0]) };
         }
         if (target?.type.kind === "dyn") {
@@ -8285,12 +9281,39 @@ function lowerObjectStaticCall(lowerer, call, access) {
         }
         return null;
     }
+    if (["preventExtensions", "isExtensible", "seal", "isSealed"].includes(member) &&
+        call.arguments.length === 1 && !ts.isSpreadElement(call.arguments[0])) {
+        const value = lowerer.lowerExpr(call.arguments[0]);
+        if (value.type.kind === "string" || value.type.kind === "f64" ||
+            value.type.kind === "bool" || value.type.kind === "symbol" || isUnitType(value.type)) {
+            if (member === "preventExtensions" || member === "seal")
+                return value;
+            const loc = locOf(call);
+            const answer = { kind: "boolLit", value: member !== "isExtensible", type: BOOL, loc };
+            return isSafeToDiscard(value) ? answer : {
+                kind: "seqExpr", stmts: [{ kind: "exprStmt", expr: value, loc: value.loc }],
+                result: answer, type: BOOL, loc,
+            };
+        }
+        if (value.type.kind === "dyn") {
+            const operation = {
+                preventExtensions: "dyn.preventExtensions", isExtensible: "dyn.isExtensible",
+                seal: "dyn.seal", isSealed: "dyn.isSealed",
+            };
+            const fn = operation[member];
+            return { kind: "libCall", fn, args: [value], type: member.startsWith("is") ? BOOL : DYN, loc: locOf(call) };
+        }
+    }
     // Object.freeze: on a FRESH literal (object or array) the result IS
     // the argument — no alias exists, so the frozen bit is unobservable
     // (writes through the Readonly<T> result are compile errors, and no
     // other reference can write). Primitives pass through per ES2015.
     // Aliased objects keep a fence: a later write through the original
     // reference would need the runtime frozen bit (strict mode throws).
+    if (member === "isFrozen" && call.arguments.length === 1) {
+        const value = lowerer.lowerExprExpecting(call.arguments[0], DYN);
+        return { kind: "libCall", fn: "dyn.isFrozen", args: [value], type: BOOL, loc: locOf(call) };
+    }
     if (member === "freeze") {
         if (call.arguments.length !== 1 || ts.isSpreadElement(call.arguments[0])) {
             lowerer.noLowering(`Object.freeze with ${call.arguments.length} arguments`, call);
@@ -8300,14 +9323,18 @@ function lowerObjectStaticCall(lowerer, call, access) {
         while (ts.isParenthesizedExpression(inner) || ts.isAsExpression(inner))
             inner = inner.expression;
         const value = lowerer.lowerExpr(argNode);
+        if (value.type.kind === "dyn")
+            return { kind: "libCall", fn: "dyn.freeze", args: [value], type: DYN, loc: locOf(call) };
         if (ts.isObjectLiteralExpression(inner) || ts.isArrayLiteralExpression(inner)) {
             return value; // fresh — freeze is identity here, honestly
         }
         if (value.type.kind === "string" || value.type.kind === "f64" ||
-            value.type.kind === "bool" || value.type.kind === "symbol" ||
+            value.type.kind === "bool" || value.type.kind === "symbol" || value.type.kind === "bigint" ||
             isUnitType(value.type)) {
             return value; // ES2015: freeze of a primitive is the primitive
         }
+        if (value.type.kind === "union" && lowerer.unions.get(value.type.unionId)?.arms.every((arm) => isUnitType(arm) || arm.kind === "f64" || arm.kind === "bigint" || arm.kind === "bool" || arm.kind === "string" || arm.kind === "symbol"))
+            return value;
         lowerer.noLowering("Object.freeze of a possibly-aliased value", call, "freeze of a FRESH object/array literal (and of primitives) compiles — frozen-ness is unobservable there; an aliased target's later writes would need the runtime frozen bit");
     }
     // `Object.hasOwn(r, k)` over a RECORD receiver: a record's own-key set
@@ -8316,44 +9343,46 @@ function lowerObjectStaticCall(lowerer, call, access) {
     // fields answer by their runtime tag — the explicit-undefined-is-absent
     // stance: an omitted optional field holds the undefined arm and reads
     // as NOT own, exactly Node's absent key (an EXPLICIT `k: undefined`
-    // diverges — documented next to the child-env/JSON rule). Tuple,
-    // index-signature (overflow membership lives in the runtime map), and
-    // accessor-carrying shapes keep the SC2020 fence; non-record receivers
+    // diverges — documented next to the child-env/JSON rule). Tuple
+    // and accessor-carrying shapes keep the SC2020 fence. Index-signature
+    // records additionally probe the overflow map; non-record receivers
     // do too.
     if (member === "hasOwn" && call.arguments.length === 2 && !call.arguments.some((a) => ts.isSpreadElement(a))) {
         const recvNode = call.arguments[0];
         const keyNode = call.arguments[1];
         const probed = tryLowerExpression(lowerer, recvNode);
+        const constructor = probed?.type.kind === "classval" ? lowerer.classes.get(probed.type.className) : undefined;
         // A CHECKED-DYNAMIC receiver (the JS file-scope object-literal
         // identity story): the runtime dyn probe — OBJ member presence, ARR
         // index bounds, Node's ToObject TypeError on nullish.
-        if (probed?.type.kind === "dyn") {
+        if (probed?.type.kind === "dyn" || (probed && isDynTypedRefType(probed.type)) ||
+            (probed?.type.kind === "object" && lowerer.errorHierarchyClassOf(probed.type.className)) ||
+            (probed && constructor && (constructor.callableBase || hasRuntimeStatics(constructor))) ||
+            (probed?.type.kind === "func" && lowerer.dynConvertible(probed.type))) {
             const loc = locOf(call);
-            const receiver = lowerer.lowerExpr(recvNode);
-            let key = lowerer.lowerExpr(keyNode);
-            if (key.type.kind === "f64" || key.type.kind === "bool" || key.type.kind === "dyn") {
-                key = { kind: "toString", operand: key, type: STRING, loc: locOf(keyNode) };
-            }
-            if (key.type.kind !== "string")
+            const receiver = lowerer.coerceToExpected(probed, DYN);
+            const rawKey = lowerer.lowerExpr(keyNode);
+            if (rawKey.type.kind === "dyn" || rawKey.type.kind === "symbol" ||
+                rawKey.type.kind === "union" && lowerer.dynConvertible(rawKey.type))
+                return {
+                    kind: "libCall", fn: "dyn.hasOwnComputed", args: [receiver, lowerer.coerceToExpected(rawKey, DYN)], type: BOOL, loc,
+                };
+            const key = ownPropertyKey(lowerer, rawKey);
+            if (!key)
                 return null;
             return { kind: "libCall", fn: "dyn.hasOwn", args: [receiver, key], type: BOOL, loc };
         }
         if (probed?.type.kind !== "record")
             return null;
         const shape = lowerer.shapes.get(probed.type.shapeId);
-        if (!shape || shape.tuple || shape.indexValue || shapeHasAccessorSlots(shape))
+        if (!shape || shape.tuple || shapeHasAccessorSlots(shape))
             return null;
         const loc = locOf(call);
         const receiver = lowerer.lowerExpr(recvNode);
         if (receiver.type.kind !== "record")
             return null; // probe/lower drift: keep the fence
-        let key = lowerer.lowerExpr(keyNode);
-        // Number/boolean/dyn keys stringify — ToPropertyKey, the keyed-write
-        // path's rule; symbol and composite keys keep the fence.
-        if (key.type.kind === "f64" || key.type.kind === "bool" || key.type.kind === "dyn") {
-            key = { kind: "toString", operand: key, type: STRING, loc: locOf(keyNode) };
-        }
-        if (key.type.kind !== "string")
+        const key = ownPropertyKey(lowerer, lowerer.lowerExpr(keyNode));
+        if (!key)
             return null;
         const helper = recordHasOwnHelper(lowerer, receiver.type.shapeId, loc);
         return { kind: "call", callee: helper, args: [receiver, key], type: BOOL, loc };
@@ -8415,8 +9444,12 @@ function lowerObjectStaticCall(lowerer, call, access) {
         const isDyn = probed?.type.kind === "dyn";
         // Unit-typed arguments (Object.keys(null)) ride the same runtime
         // walk: it throws Node's catchable TypeError.
-        const isUnit = probed !== null && probed !== undefined && isUnitType(probed.type);
-        if (isDyn || isUnit) {
+        const isFunction = probed?.type.kind === "func" && lowerer.dynConvertible(probed.type);
+        const isPrimitive = probed !== null && probed !== undefined &&
+            (isUnitType(probed.type) || probed.type.kind === "string" ||
+                probed.type.kind === "f64" || probed.type.kind === "bool");
+        const isJsUnion = probed?.type.kind === "union" && isJsSourceFile(call.getSourceFile()) && lowerer.dynConvertible(probed.type);
+        if (isDyn || isPrimitive || isFunction || isJsUnion || (probed && isDynTypedRefType(probed.type))) {
             const fn = member === "keys" ? "dyn.objKeys" : member === "values" ? "dyn.objValues" : "dyn.objEntries";
             let v = lowerer.lowerExpr(argNode);
             if (v.type.kind !== "dyn")
@@ -8445,6 +9478,19 @@ function lowerObjectStaticCall(lowerer, call, access) {
     if (shapeHasAccessorSlots(shape)) {
         lowerer.unsupported("SC1090", call, `Object.${member} over a shape carrying get/set accessor properties (Node lists the accessor names${member === "keys" ? "" : " and invokes the getters"} — the static key walk cannot; read the properties explicitly)`);
     }
+    // unknown[] uses the checked-dynamic array representation. Enumerate
+    // a live view of the record so values retain their identities and the
+    // result never pretends to be a native vector or an island array.
+    const enumerationType = lowerer.mapTypeOf(lowerer.typeOf(call));
+    if ((member === "values" || member === "entries") &&
+        (enumerationType?.kind === "dyn" || enumerationType === null && isJsSourceFile(call.getSourceFile()))) {
+        let receiver = lowerer.coerceToExpected(lowerer.lowerExpr(argNode), DYN);
+        if (receiver.type.kind !== "dyn")
+            lowerer.badType(argNode, lowerer.typeOf(argNode));
+        if (receiver.kind === "dynFrom" && receiver.value.type.kind === "record")
+            receiver = { ...receiver, liveRef: true };
+        return { kind: "libCall", fn: member === "values" ? "dyn.objValues" : "dyn.objEntries", args: [receiver], type: DYN, loc: locOf(call) };
+    }
     if (shape.indexValue) {
         // Index-signature (overflow-carrying) shapes: the runtime walk —
         // declared fields first, then the overflow in JS own-key order
@@ -8455,7 +9501,7 @@ function lowerObjectStaticCall(lowerer, call, access) {
     const resultT = lowerer.irTypeOf(call);
     if (resultT.kind !== "array")
         lowerer.badType(call, lowerer.typeOf(call)); // defensive
-    const receiver = lowerer.lowerExpr(argNode);
+    const receiver = objectEnumerationReceiver(lowerer, lowerer.lowerExpr(argNode), argIr, loc);
     if (member === "keys") {
         // The keys walk is shared with for-in (which iterates exactly the
         // keys Object.keys answers — one construction, one intern key).
@@ -8484,7 +9530,6 @@ function lowerObjectStaticCall(lowerer, call, access) {
         const recT = argIr;
         const ref = { kind: "varRef", localId: "r.0", type: recT, loc };
         const outRef = { kind: "varRef", localId: "out.0", type: resultT, loc };
-        lowerer.arrHofHelpers.set(key, helper);
         const fn = {
             name: helper,
             params: [{ localId: "r.0", name: "r", type: recT }],
@@ -8497,7 +9542,8 @@ function lowerObjectStaticCall(lowerer, call, access) {
             loc,
         };
         const finalize = () => {
-            const current = lowerer.shapes.get(argIr.shapeId) ?? shape;
+            const latest = lowerer.shapes.get(argIr.shapeId);
+            const current = latest !== undefined ? latest : shape;
             const body = [
                 { kind: "varDecl", localId: "out.0", init: { kind: "arrayLit", elems: [], type: resultT, loc }, loc },
             ];
@@ -8512,6 +9558,8 @@ function lowerObjectStaticCall(lowerer, call, access) {
                         return null;
                     if (typeEquals(vt, valueT))
                         return value;
+                    if (valueT.kind === "dyn" && lowerer.dynConvertible(vt))
+                        return lowerer.coerceToExpected(value, DYN);
                     if (valueT.kind === "union" && vt.kind !== "union") {
                         const tag = lowerer.armTag(valueT.unionId, vt);
                         if (tag >= 0) {
@@ -8531,7 +9579,7 @@ function lowerObjectStaticCall(lowerer, call, access) {
                         guardUndefTag = undefTag;
                         const arms = lowerer.unions.get(f.type.unionId)?.arms ?? [];
                         const others = arms.filter((a) => a.kind !== "undefinedT");
-                        if (typeEquals(f.type, valueT ?? f.type)) {
+                        if (valueT?.kind === "dyn" || typeEquals(f.type, valueT ?? f.type)) {
                             // The field union IS the result union (single-field shapes):
                             // push the raw box — but then the undefined skip must NOT
                             // narrow. Handled below via vt === valueT.
@@ -8555,7 +9603,7 @@ function lowerObjectStaticCall(lowerer, call, access) {
                                 "cannot re-tag into the result element type — read the fields directly)");
                         }
                     }
-                    else if (!typeEquals(f.type, valueT ?? f.type)) {
+                    else if (valueT?.kind !== "dyn" && !typeEquals(f.type, valueT ?? f.type)) {
                         lowerer.unsupported("SC1090", call, `Object.${member} over '${lowerer.fmt(argIr)}' (field '${f.name}' is a union that cannot ` +
                             "re-tag into the result element type — read the fields directly)");
                     }
@@ -8595,6 +9643,7 @@ function lowerObjectStaticCall(lowerer, call, access) {
             fn.body = body;
         };
         finalize();
+        lowerer.arrHofHelpers.set(key, helper);
         lowerer.shapeOrderHelperFinalizers.push(finalize);
         lowerer.liftedFns.push(fn);
     }
@@ -8643,6 +9692,15 @@ export function lowerFunction(lowerer, decl) {
             params.push({ localId: argsLocal.id, name: "%arguments", type: DYN });
             ctx.argumentsLocal = argsLocal;
         }
+        if (isJsSourceFile(decl.getSourceFile()) && sig.params.length === 1 &&
+            sig.params[0]?.mode === "dynRest" && bodyReadsArguments(decl)) {
+            const argsLocal = lowerer.declareHiddenLocal("%arguments", DYN);
+            prologue.push({ kind: "varDecl", localId: argsLocal.id, init: {
+                    kind: "dynInvoke", recv: varRef(params[0].localId, DYN, locOf(decl)), method: "slice",
+                    calleeName: "Array.prototype.slice", args: [], type: DYN, loc: locOf(decl),
+                }, loc: locOf(decl) });
+            ctx.argumentsLocal = argsLocal;
+        }
         const bodyBlock = blockBodyOf(decl);
         if (!bodyBlock) {
             lowerer.unsupported("SC1090", decl, "function declarations whose block body the frontend cannot locate");
@@ -8651,6 +9709,8 @@ export function lowerFunction(lowerer, decl) {
         appendImplicitUndefinedReturn(lowerer, body, bodyReturn, locOf(decl));
         const fn = {
             name: sig.name,
+            sourceName: decl.name?.text ?? "<anonymous>",
+            ...(!sig.isAsync && !sig.generator ? { ownsPrototype: true } : {}),
             params,
             returnType: bodyReturn,
             locals: lowerer.ctx.locals,
@@ -8775,8 +9835,27 @@ function lowerObjectAssignHybrid(lowerer, call) {
 export function lowerRecordFieldCall(lowerer, call, access) {
     if (lowerer.chainBlocked(call))
         return null;
-    if (lowerer.mapTypeOf(lowerer.typeOf(access.expression))?.kind !== "record")
-        return null;
+    const stored = ts.isIdentifier(access.expression)
+        ? lowerer.peekLocal(access.expression)?.type ?? lowerer.globalOf(access.expression)?.type : undefined;
+    const receiverType = stored?.kind === "record" ? stored : lowerer.mapTypeOf(lowerer.typeOf(access.expression));
+    if (receiverType?.kind !== "record" && receiverType?.kind !== "union")
+        return null;
+    // A union of records can share a closure-valued field. Its normal
+    // property read performs the tag dispatch before arguments evaluate.
+    // Class methods retain their vtable path and must not lose `this`.
+    if (receiverType.kind === "union") {
+        const arms = lowerer.unions.get(receiverType.unionId)?.arms;
+        if (!arms?.every((arm) => arm.kind === "record"))
+            return null;
+        if (!arms.every((arm) => arm.kind === "record" &&
+            lowerer.shapes.get(arm.shapeId)?.fields.some((field) => field.name === access.name.text && field.type.kind === "func")))
+            return null;
+        const callee = lowerer.lowerUnionProperty(access);
+        if (callee?.type.kind !== "func")
+            return null;
+        const args = completeFuncValueArgs(lowerer, call, callee.type, locOf(call));
+        return { kind: "callValue", callee, args, type: callee.type.ret, loc: locOf(call) };
+    }
     const target = lowerer.fieldTarget(access);
     let callee = target ? lowerer.fieldGetExpr(target, locOf(access), access) : null;
     if (!callee)
@@ -8975,7 +10054,7 @@ function nullishValueUnitOf(lowerer, sym) {
     // the no-storage family never claims it.
     if (!decl || !ts.isVariableDeclaration(decl) || !ts.isIdentifier(decl.name) ||
         decl.getSourceFile().isDeclarationFile || decl.initializer === undefined ||
-        !ts.isVariableStatement(decl.parent.parent)) {
+        !ts.isVariableStatement(decl.parent?.parent)) {
         return null;
     }
     const unit = nullishExprUnitOf(lowerer, decl.initializer);
@@ -9161,7 +10240,7 @@ export function deadUnmappableBinding(lowerer, sym, decl) {
     // lowerVarDeclList's contract requires a lowered statement for it, so
     // the no-storage family never claims it (catch bindings sit outside a
     // variable statement too and stay out the same way).
-    if (!ts.isVariableStatement(decl.parent.parent))
+    if (!ts.isVariableStatement(decl.parent?.parent))
         return false;
     const sf = decl.getSourceFile();
     if (sf.isDeclarationFile || isJsSourceFile(sf))
@@ -9339,11 +10418,11 @@ export function bindingGenericFnInfoOf(lowerer, decl, fnNode) {
             lowerer.unsupported("SC1031", param);
         }
     }
-    const stmt = decl.parent.parent; // declarator → list → statement (nsPathPrefix wants the statement)
+    const stmt = decl.parent?.parent; // declarator → list → statement (nsPathPrefix wants the statement)
     const info = {
         decl: fnNode,
         baseName: name,
-        qualifiedName: lowerer.qualify(decl.getSourceFile(), nsPathPrefix(stmt, decl) + name),
+        qualifiedName: lowerer.qualify(decl.getSourceFile(), nsPathPrefix(stmt ?? decl, decl) + name),
         typeParams,
         instances: new Map(),
     };
@@ -9475,6 +10554,88 @@ function arrowSignatureOf(lowerer, node) {
     const declaration = lowerer.checker.signatureDeclaration(signatures[0]);
     return declaration !== undefined && ts.isArrowFunction(declaration) ? signatures[0] : null;
 }
+/** An inline arrow has lexical `this` and no observable own properties
+ * before binding. With no preset arguments, a fresh forwarding closure
+ * preserves its completed ABI, defaults and captured environment. Keep
+ * other receivers and rest/preset-argument forms on the named fence. */
+function lowerInlineArrowBind(lowerer, call, access) {
+    if (access.name.text !== "bind" || call.arguments.length > 1 || call.arguments.some(ts.isSpreadElement))
+        return null;
+    let arrow = access.expression;
+    while (ts.isParenthesizedExpression(arrow))
+        arrow = arrow.expression;
+    if (!ts.isArrowFunction(arrow))
+        return null;
+    const callee = lowerer.lowerExpr(access.expression);
+    if (callee.type.kind !== "func" || callee.type.rest ||
+        !canBoxFuncIntoDyn(callee.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id)))
+        return null;
+    const type = callee.type;
+    const loc = locOf(call);
+    const firstDefault = arrow.parameters.findIndex((p) => p.initializer !== undefined);
+    const length = firstDefault < 0 ? arrow.parameters.length : firstDefault;
+    const key = `arrow.bind:${typeKey(type)}:${length}`;
+    const existing = lowerer.arrHofHelpers.get(key);
+    const name = existing ?? `%arrow.bind.${lowerer.arrHofHelpers.size}`;
+    if (!existing) {
+        lowerer.arrHofHelpers.set(key, name);
+        lowerer.freshClosureAdapters.add(name);
+        const impl = `${name}.impl`;
+        const captured = { id: "f.0", name: "f", type, mutable: false, boxed: true };
+        const params = type.params.map((type, i) => ({ localId: `p.${i}`, name: `p${i}`, type }));
+        const invoked = {
+            kind: "callValue",
+            callee: { kind: "varRef", localId: captured.id, type, loc },
+            args: params.map((p) => ({ kind: "varRef", localId: p.localId, type: p.type, loc })),
+            type: type.ret,
+            loc,
+        };
+        lowerer.liftedFns.push({
+            name: impl,
+            params,
+            returnType: type.ret,
+            captures: [{ localId: captured.id, name: captured.name, type }],
+            locals: [captured, ...params.map((p) => ({ id: p.localId, name: p.name, type: p.type, mutable: false }))],
+            body: [type.ret.kind === "void" ? { kind: "exprStmt", expr: invoked, loc } : { kind: "return", value: invoked, loc }],
+            loc,
+        });
+        const bound = { kind: "varRef", localId: "bound.0", type, loc };
+        const str = (value) => ({ kind: "strLit", value, type: STRING, loc });
+        const descriptor = (value) => ({
+            kind: "dynObjLit", fields: [{ key: str("value"), value: { kind: "dynFrom", value, type: DYN, loc } }], type: DYN, loc,
+        });
+        lowerer.liftedFns.push({
+            name,
+            params: [{ localId: captured.id, name: captured.name, type }],
+            returnType: type,
+            locals: [captured, { id: "bound.0", name: "bound", type, mutable: false }],
+            body: [
+                { kind: "varDecl", localId: "bound.0", init: { kind: "closure", fnName: impl, captures: [captured.id], type, loc }, loc },
+                // Store metadata on the closure so aliases and repeated dyn boxes
+                // observe the bound name and source arity, including defaults.
+                { kind: "exprStmt", expr: {
+                        kind: "libCall", fn: "dyn.defineProps", args: [
+                            { kind: "dynFrom", value: bound, type: DYN, loc },
+                            { kind: "dynObjLit", fields: [
+                                    { key: str("name"), value: descriptor(str("bound ")) },
+                                    { key: str("length"), value: descriptor({ kind: "numLit", value: length, type: F64, loc }) },
+                                ], type: DYN, loc },
+                        ], type: DYN, loc,
+                    }, loc },
+                { kind: "return", value: bound, loc },
+            ],
+            loc,
+        });
+    }
+    const saved = lowerer.declareHiddenLocal("%bindFn", type);
+    const stmts = [{ kind: "varDecl", localId: saved.id, init: callee, loc }];
+    // The receiver is ignored by the arrow, but its effects and throws
+    // happen after creating the arrow and before returning the bound value.
+    if (call.arguments[0])
+        stmts.push(lowerer.lowerExprStatement(call.arguments[0]));
+    const result = { kind: "call", callee: name, args: [{ kind: "varRef", localId: saved.id, type, loc }], type, loc };
+    return { kind: "seqExpr", stmts, result, type, loc };
+}
 /** `arrow.apply(thisArg, dynArgs)` for a fixed-arity compiled arrow. Arrows
  * ignore `thisArg` and surplus arguments by language definition; declared
  * parameters validate from the dynamic array in order. */
@@ -9553,7 +10714,6 @@ function lowerObjLitGenericMethodCall(lowerer, call, access) {
             thisT.kind !== "dyn" &&
             thisT.kind !== "jsval" &&
             (!thisArg || ts.isIdentifier(thisArg) || ts.isLiteralExpression(thisArg) ||
-                thisArg.kind === ts.SyntaxKind.UndefinedKeyword ||
                 thisArg.kind === ts.SyntaxKind.NullKeyword ||
                 isUnitType(thisT));
         if (provablyNot) {
@@ -9564,6 +10724,14 @@ function lowerObjLitGenericMethodCall(lowerer, call, access) {
     const propSym = lowerer.checker.getPropertyOfType(recvT, name);
     if (!propSym)
         return null;
+    const propertyDecl = lowerer.checker.valueDeclarationOf(propSym);
+    if (propertyDecl && ts.isShorthandPropertyAssignment(propertyDecl) && ts.isIdentifier(propertyDecl.name) && ts.isObjectLiteralExpression(propertyDecl.parent)) {
+        requireObjLitGenericReceiver(lowerer, call, access.expression, propertyDecl.parent, name);
+        const targetSymbol = lowerer.checker.getShorthandAssignmentValueSymbol(propertyDecl);
+        const target = targetSymbol ? lowerer.genericFnsBySymbol.get((targetSymbol.flags & ts.SymbolFlags.Alias ? lowerer.checker.getAliasedSymbol(targetSymbol) : targetSymbol)) : undefined;
+        if (target)
+            return lowerer.lowerGenericCall(call, target);
+    }
     if (!isGenericCallableMemberType(lowerer.checker.getTypeOfSymbol(propSym), lowerer.checker))
         return null;
     // CLASS members belong to the class path (lowerClassGenericMethodCall
@@ -9592,19 +10760,25 @@ function lowerObjLitGenericMethodCall(lowerer, call, access) {
     }
     const found = objLitGenericFnNodeOf(lowerer, propSym);
     if (!found) {
+        const arrowBind = lowerInlineArrowBind(lowerer, call, access);
+        if (arrowBind !== null)
+            return arrowBind;
         const arrowApply = lowerArrowFunctionApply(lowerer, call, access);
         if (arrowApply !== null)
             return arrowApply;
-        // Function.prototype.apply/call/bind spelled through a FUNCTION
-        // receiver: compiled functions are direct calls with no runtime
-        // `this`/arguments object to re-route — name the working spelling
-        // instead of a class-receiver hint (or an SC2020 recitation) no
-        // function value can follow. Before the stdlib decline: these ARE
-        // stdlib members (CallableFunction), but the pointed message is
-        // the honest one.
+        // Convertible native callables use the checked invocation boundary
+        // for Function.prototype methods, including their call-time receiver.
         if ((name === "apply" || name === "call" || name === "bind") &&
             lowerer.checker.getCallSignatures(recvT).length > 0) {
-            lowerer.unsupported("SC1090", call, `Function.prototype.${name} on a compiled function value (compiled calls are direct — no runtime 'this' or arguments object exists to re-route; spell the call directly: '${access.expression.getText()}(...)')`);
+            const value = tryLowerExpression(lowerer, access.expression);
+            if (value?.type.kind === "func" && lowerer.dynConvertible(value.type) && !call.arguments.some(ts.isSpreadElement)) {
+                const loc = locOf(call);
+                return {
+                    kind: "dynInvoke", recv: { kind: "dynFrom", value, type: DYN, loc }, method: name,
+                    calleeName: access.getText(), args: call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc,
+                };
+            }
+            lowerer.unsupported("SC1090", call, `Function.prototype.${name} on a function whose signature cannot cross the checked-value boundary (call '${access.expression.getText()}(...)' directly)`);
         }
         // STANDARD-LIBRARY generic members (Promise.then, Object.
         // defineProperty, Array-augmentation methods) are the lib fence's
@@ -9641,12 +10815,27 @@ function lowerObjLitGenericMethodCall(lowerer, call, access) {
 export function lowerObjectMethodCall(lowerer, call, access) {
     if (lowerer.chainBlocked(access, call))
         return null;
-    const mappedReceiver = lowerer.mapTypeOf(lowerer.typeOf(access.expression));
+    let mappedReceiver = lowerer.mapTypeOf(lowerer.typeOf(access.expression));
+    // A specialized JS parameter can expose a native field whose checker
+    // type still belongs to the unspecialized body (plane.normal.dot()).
+    // Use the lowered receiver's representation and retain its evaluation.
+    const probe = mappedReceiver?.kind !== "object" && (lowerer.implicitParamTypes !== null || ts.isNewExpression(access.expression) ||
+        isJsSourceFile(call.getSourceFile()) && ts.isCallExpression(access.expression))
+        ? tryLowerExpression(lowerer, access.expression) : null;
+    const specializedReceiver = probe?.type.kind === "object" ? probe : null;
+    if (specializedReceiver)
+        mappedReceiver = specializedReceiver.type;
     if (mappedReceiver?.kind === "union") {
         const dispatched = lowerUnionObjectMethodCall(lowerer, call, access, mappedReceiver) ??
             lowerUnionObjectDynFieldCall(lowerer, call, access, mappedReceiver);
         if (dispatched)
             return dispatched;
+        const arms = lowerer.unions.get(mappedReceiver.unionId)?.arms;
+        if (isJsSourceFile(call.getSourceFile()) && arms?.every((arm) => arm.kind === "object" &&
+            !lowerer.classes.get(arm.className)?.def.runtime) && lowerer.dynConvertible(mappedReceiver)) {
+            const receiver = lowerer.coerceInto(access.expression, lowerer.lowerExpr(access.expression), DYN);
+            return lowerDynDispatchMethodCall(lowerer, call, access, receiver, false);
+        }
     }
     const receiverIr = mappedReceiver?.kind === "object"
         ? mappedReceiver
@@ -9654,15 +10843,16 @@ export function lowerObjectMethodCall(lowerer, call, access) {
             ? (() => {
                 const arms = lowerer.unions.get(mappedReceiver.unionId)?.arms ?? [];
                 const objects = arms.filter((arm) => arm.kind === "object");
-                return objects.length === 1 && arms.every((arm) => arm.kind === "object" || isUnitType(arm))
-                    ? objects[0]
+                const object = objects[0];
+                return objects.length === 1 && object?.kind === "object" && arms.every((arm) => arm.kind === "object" || isUnitType(arm))
+                    ? object
                     : null;
             })()
             : null;
     if (receiverIr === null)
         return null;
     const lowerReceiver = () => {
-        const receiver = lowerer.lowerExpr(access.expression);
+        const receiver = specializedReceiver ?? lowerer.lowerExpr(access.expression);
         const optional = lowerer.runtimeOptionalPropertyReceiver(access.expression, receiver, receiverIr, access.name.text);
         if (optional !== null)
             return optional;
@@ -9671,7 +10861,7 @@ export function lowerObjectMethodCall(lowerer, call, access) {
             if (helper !== null)
                 return { kind: "call", callee: helper, args: [receiver], type: receiverIr, loc: locOf(access.expression) };
         }
-        return receiver;
+        return receiver.type.kind === "dyn" ? lowerer.coerceInto(access.expression, receiver, receiverIr) : receiver;
     };
     const info = lowerer.classes.get(receiverIr.className);
     if (!info)
@@ -9698,7 +10888,7 @@ export function lowerObjectMethodCall(lowerer, call, access) {
     if (info && !found) {
         const gfound = findGenericMethodOn(lowerer, info, access.name.text);
         if (gfound)
-            return lowerClassGenericMethodCall(lowerer, call, access, info, gfound);
+            return lowerClassGenericMethodCall(lowerer, call, access, info, gfound, lowerReceiver());
     }
     // A FUNC-, nullable-FUNC-, or DYN-typed FIELD in call position:
     // `this.cb()` — the ctor-assigned callback field (countdown.js's
@@ -9714,13 +10904,22 @@ export function lowerObjectMethodCall(lowerer, call, access) {
                 ? (() => {
                     const arms = lowerer.unions.get(fieldType.unionId)?.arms ?? [];
                     const funcs = arms.filter((arm) => arm.kind === "func");
-                    return funcs.length === 1 && arms.every((arm) => arm.kind === "func" || isUnitType(arm))
-                        ? funcs[0]
+                    const func = funcs[0];
+                    return funcs.length === 1 && func?.kind === "func" && arms.every((arm) => arm.kind === "func" || isUnitType(arm))
+                        ? func
                         : null;
                 })()
                 : null;
         if (fieldType && (callableType !== null || fieldType.kind === "dyn")) {
             const target = lowerer.fieldTarget(access);
+            if (!target)
+                return null;
+            const loc = locOf(call);
+            const receiverLocal = lowerer.declareHiddenLocal("%callReceiver", target.obj.type);
+            const init = { kind: "varDecl", localId: receiverLocal.id, init: target.obj, loc };
+            target.obj = { kind: "varRef", localId: receiverLocal.id, type: receiverLocal.type, loc };
+            const receiver = lowerer.coerceToExpected(target.obj, DYN);
+            const finish = (result) => ({ kind: "seqExpr", stmts: [init], result, type: result.type, loc });
             let callee = target ? lowerer.fieldGetExpr(target, locOf(access), access) : null;
             if (callee?.type.kind === "union" && callableType !== null) {
                 const helper = lowerer.narrowedArmHelper(callee.type.unionId, callableType, locOf(access));
@@ -9729,34 +10928,65 @@ export function lowerObjectMethodCall(lowerer, call, access) {
                 }
             }
             if (callee?.type.kind === "func") {
+                if ((callee.type.rest === true && callee.type.restAbi === undefined || call.arguments.length > callee.type.params.length) &&
+                    isJsSourceFile(call.getSourceFile()) && lowerer.dynConvertible(callee.type)) {
+                    const boxed = { kind: "dynFrom", value: callee, type: DYN, loc };
+                    const spread = lowerSpreadArgsCall(lowerer, call, boxed, loc);
+                    if (spread?.kind === "dynCall")
+                        return finish({ ...spread, receiver });
+                    const args = call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN));
+                    return finish({ kind: "dynCall", callee: boxed, receiver, calleeName: access.getText(), args, type: DYN, loc });
+                }
                 const args = completeFuncValueArgs(lowerer, call, callee.type, locOf(call));
-                return { kind: "callValue", callee, args, type: callee.type.ret, loc: locOf(call) };
+                return finish({ kind: "callValue", callee, receiver, args, type: callee.type.ret, loc });
             }
             if (callee?.type.kind === "dyn") {
                 if (call.arguments.some((a) => ts.isSpreadElement(a))) {
                     lowerer.unsupported("SC1090", call, "spread arguments in calls through 'unknown' values");
                 }
                 const args = call.arguments.map((a) => lowerer.lowerExprExpecting(a, DYN));
-                return { kind: "dynCall", callee, calleeName: access.getText(), args, type: DYN, loc: locOf(call) };
+                return finish({ kind: "dynCall", callee, receiver, calleeName: access.getText(), args, type: DYN, loc });
             }
         }
+        if (!fieldType && isJsSourceFile(call.getSourceFile()) && !info.def.runtime && !info.builtinError && !info.builtinEmitter && !info.builtinStream) {
+            const loc = locOf(call);
+            const value = lowerReceiver();
+            const local = lowerer.declareHiddenLocal("%callReceiver", value.type);
+            const reference = { kind: "varRef", localId: local.id, type: value.type, loc };
+            const receiver = lowerer.coerceToExpected(reference, DYN);
+            const callee = { kind: "dynKeyGet", value: receiver,
+                key: { kind: "strLit", value: access.name.text, type: STRING, loc }, type: DYN, loc };
+            const spread = call.arguments.some(ts.isSpreadElement) ? lowerSpreadArgsCall(lowerer, call, callee, loc) : null;
+            if (spread && spread.kind !== "dynCall")
+                lowerer.unsupported("SC1090", call, "native property call spread arguments");
+            const result = spread !== null ? { ...spread, receiver } : { kind: "dynCall", callee, receiver,
+                calleeName: access.getText(), args: call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc };
+            return { kind: "seqExpr", stmts: [{ kind: "varDecl", localId: local.id, init: value, loc }], result, type: DYN, loc };
+        }
         return null;
     }
     if (!info || !found)
         return null;
     const method = access.name.text;
-    if (found.declarer.builtinError) {
-        // The one builtin method: Error.prototype.toString, a runtime
-        // implementation called directly (overriding it is fenced, so no
-        // dispatch can ever be needed). Receiver BORROWED by the libCall.
+    if (isClassCallback(lowerer, info, method)) {
+        const loc = locOf(call);
         const receiver = lowerReceiver();
-        return {
-            kind: "libCall",
-            fn: "error.toString",
-            args: [lowerer.upcastTo(receiver, found.declarer.def.name)],
-            type: STRING,
-            loc: locOf(call),
-        };
+        const local = lowerer.declareHiddenLocal("%callbackReceiver", receiver.type);
+        const value = { kind: "varRef", localId: local.id, type: receiver.type, loc };
+        const args = lowerer.completeArgs(call.arguments, found.sig.params, loc, call);
+        const virtual = lowerer.overrideBelow(info, method);
+        if (virtual)
+            lowerer.noteVirtualEdge(info, method);
+        else
+            lowerer.noteEdge(`%${found.declarer.def.name}.${method}`);
+        const fallback = virtual
+            ? { kind: "virtualCall", className: info.def.name, method, args: [lowerer.upcastTo(value, info.def.name), ...args], type: found.sig.ret, loc }
+            : { kind: "call", callee: `%${found.declarer.def.name}.${method}`, args: [lowerer.upcastTo(value, found.declarer.def.name), ...args], type: found.sig.ret, loc };
+        const result = classCallbackCall(lowerer, value, method, call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), fallback, loc);
+        return { kind: "seqExpr", stmts: [{ kind: "varDecl", localId: local.id, init: receiver, loc }], result, type: result.type, loc };
+    }
+    if (found.declarer.builtinError) {
+        return errorToStringCall(lowerer, lowerReceiver());
     }
     // An ABSTRACT nearest declaration with no concrete override below the
     // static class: no implementation exists for a direct call to target.
@@ -9815,6 +11045,22 @@ function lowerUnionObjectMethodCall(lowerer, call, access, receiverT) {
         plans.push({ arm, info, found });
     }
     const shapes = plans[0].found.sig.params;
+    if (plans.some((plan) => isClassCallback(lowerer, plan.info, method))) {
+        const loc = locOf(call);
+        const local = lowerer.declareHiddenLocal("%unionMethodReceiver", DYN);
+        const receiver = varRef(local.id, DYN, loc);
+        const callee = { kind: "dynKeyGet", value: receiver,
+            key: { kind: "strLit", value: method, type: STRING, loc }, type: DYN, loc };
+        const spread = call.arguments.some(ts.isSpreadElement) ? lowerSpreadArgsCall(lowerer, call, callee, loc) : null;
+        if (spread && spread.kind !== "dynCall")
+            lowerer.unsupported("SC1090", call, "union method spread arguments");
+        const value = spread !== null ? { ...spread, receiver } : { kind: "dynCall", callee, receiver,
+            calleeName: access.getText(), args: call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc };
+        const resultT = lowerer.mapTypeOf(lowerer.typeOf(call));
+        const result = resultT && !isUnitType(resultT) ? lowerer.coerceToExpected(value, resultT) : value;
+        return { kind: "seqExpr", stmts: [{ kind: "varDecl", localId: local.id,
+                    init: lowerer.coerceInto(access.expression, lowerer.lowerExpr(access.expression), DYN), loc }], result, type: result.type, loc };
+    }
     if (!plans.every((plan) => paramAbisEqual(shapes, plan.found.sig.params)))
         return null;
     const resultT = lowerer.mapTypeOf(lowerer.typeOf(call));
@@ -9829,7 +11075,10 @@ function lowerUnionObjectMethodCall(lowerer, call, access, receiverT) {
 function paramAbisEqual(left, right) {
     return left.length === right.length && left.every((shape, i) => {
         const other = right[i];
-        return other !== undefined && shape.mode === other.mode && typeEquals(shape.type, other.type);
+        return other !== undefined && typeEquals(shape.type, other.type) &&
+            (shape.mode === other.mode || shape.type.kind === "dyn" &&
+                (shape.mode === "required" || shape.mode === "omittable") &&
+                (other.mode === "required" || other.mode === "omittable"));
     });
 }
 /** The JS-class sibling of union method dispatch: every arm stores the
@@ -9854,6 +11103,8 @@ function lowerUnionObjectDynFieldCall(lowerer, call, access, receiverT) {
     const loc = locOf(call);
     const receiver = lowerer.coerceInto(access.expression, lowerer.lowerExpr(access.expression), receiverT);
     const key = `${receiverT.unionId}:dyn-field:${field}`;
+    const receiverLocal = lowerer.declareHiddenLocal("%unionCallReceiver", receiverT);
+    const receiverRef = varRef(receiverLocal.id, receiverT, loc);
     let helper = lowerer.unionCallHelpers.get(key);
     if (!helper) {
         helper = `%union.call.${lowerer.unionCallHelpers.size}`;
@@ -9906,9 +11157,12 @@ function lowerUnionObjectDynFieldCall(lowerer, call, access, receiverT) {
         const locals = params.map((param) => ({ id: param.localId, name: param.name, type: param.type, mutable: false }));
         lowerer.liftedFns.push({ name: helper, params, returnType: DYN, locals, body, loc });
     }
-    const callee = { kind: "call", callee: helper, args: [receiver], type: DYN, loc };
+    const callee = { kind: "call", callee: helper, args: [receiverRef], type: DYN, loc };
     const args = call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN));
-    return { kind: "dynCall", callee, calleeName: access.getText(), args, type: DYN, loc };
+    return {
+        kind: "seqExpr", stmts: [{ kind: "varDecl", localId: receiverLocal.id, init: receiver, loc }],
+        result: { kind: "dynCall", callee, receiver: lowerer.coerceToExpected(receiverRef, DYN), calleeName: access.getText(), args, type: DYN, loc }, type: DYN, loc,
+    };
 }
 function unionObjectMethodHelper(lowerer, sourceCall, receiverT, method, plans, shapes, resultT, loc) {
     const key = `${receiverT.unionId}:${method}:${shapes.map((shape) => `${shape.mode}:${typeKey(shape.type)}`).join(",")}:${typeKey(resultT)}`;
@@ -9930,13 +11184,7 @@ function unionObjectMethodHelper(lowerer, sourceCall, receiverT, method, plans,
         };
         let invoke;
         if (plan.found.declarer.builtinError) {
-            invoke = {
-                kind: "libCall",
-                fn: "error.toString",
-                args: [lowerer.upcastTo(concrete, plan.found.declarer.def.name)],
-                type: STRING,
-                loc,
-            };
+            invoke = errorToStringCall(lowerer, concrete);
         }
         else if (lowerer.overrideBelow(plan.info, method)) {
             lowerer.noteVirtualEdge(plan.info, method);