@scriptc/compiler 0.2.0 → 0.2.1

package/dist/frontend/lowering/lower-calls.js

@@ -14,20 +14,21 @@ import { lowerClassPrototypeAssign } from "./class-prototypes.js";
 import { BYTES_ELEMENT_NAME, BIGINT_T, BOOL, CAUGHT, DYN, F64, JSVAL, NULL_T, STRING, SYMBOL_T, UNDEFINED_T, VOID, arrayOf, canBoxFuncIntoDyn, canConvertToDyn, canDynCheckTo, canMarshalTypedFuncIntoIsland, ffiClassType, ffiSourceParamTypes, funcOf, isDynTypedRefType, isFfiCallbackParam, isFfiContextParam, isFfiReleaseParam, isUnitType, shapeHasAccessorSlots, typeEquals } from "../../ir/ir.js";
 import { isJsSourceFile, isNodeEsmFile, locOf, requireSpecOf } from "../program.js";
 import { genResultRecord, isGenericCallableMemberType, jsOpenObjectType, typeKey } from "../type-mapper.js";
-import { PoisonError, dynFallbackType, dynUndefinedExpr, importCallHandleType, jsFuncNameOf, newFnCtx, nodeThrowExpr, staticImportNamespaceType } from "./lowerer.js";
-import { enforceLibBoundary } from "./lib-boundary.js";
-import { NARROW_FIRST, STRING_INDEX_METHODS, STR_METHODS, builtinFenceHintOf, builtinModuleFnOf } from "./surfaces.js";
+import { PoisonError, dynFallbackType, dynUndefinedExpr, importCallHandleType, jsFuncNameOf, neverTaintedJsType, newFnCtx, nodeThrowExpr, staticImportNamespaceType } from "./lowerer.js";
+import { enforceLibBoundary, lowerSurplusCalls } from "./lib-boundary.js";
+import { NARROW_FIRST, STRING_INDEX_METHODS, STR_METHODS, builtinFenceHintOf, builtinModuleFnOf, stdlibGlobalNameOf } from "./surfaces.js";
 import { ffiBindingDiag, ffiSignatureDiag, libCallbackDiag, requiresDynamicDiag } from "../../diagnostics/diagnostic.js";
 import { mixinFnShapeOf } from "./lower-mixins.js";
-import { dynStringReceiver, lowerArrayConstructor, lowerArrayFromCall, lowerArrayOfCall, lowerDynArrayFilterCall, lowerDynArrayFlatMapCall, lowerGroupByStaticCall, lowerIteratorHelperCall, lowerObjectAssignIndexShape, lowerObjectFromEntriesCall, lowerObjectIterOverIndexShape, lowerTupleReadMethodCall } from "./lower-containers.js";
+import { dynStringReceiver, lowerArrayConstructor, lowerArrayFromCall, lowerArrayOfCall, lowerDynArrayFilterCall, lowerDynArrayFlatMapCall, lowerGroupByStaticCall, lowerIteratorHelperCall, lowerObjectAssignIndexShape, lowerObjectConstructor, lowerObjectFromEntriesCall, lowerObjectIterOverIndexShape, lowerTupleReadMethodCall } from "./lower-containers.js";
 import { lowerBytesStaticCall } from "./containers/bytes.js";
 import { lowerRegexMethodCall, lowerStringIndexCall, lowerStringMethodCall, lowerStringPaddingCall, lowerStringSplitCall } from "./containers/string-and-regexp.js";
-import { createRequireSpecOf, lowerChildStreamMethodCall, lowerChildWriterMethodCall, lowerCreateRequireCall, lowerCryptoHashMethodCall, lowerDirentMethodCall, lowerFileHandleMethodCall, lowerImportMetaResolveCall, lowerNodeModuleCall, lowerPerfHooksCall, lowerProcStreamMethodCall, lowerReflectApplyCall, lowerRequireResolveCall, lowerWatcherMethodCall } from "./lower-builtins.js";
-import { lowerAbsenceProbe, lowerPromiseAllTupleCall, lowerPromiseRejectCall, stringWrapperToString, templateRawTextOf } from "./lower-exprs.js";
+import { createRequireSpecOf, lowerChildStreamMethodCall, lowerChildWriterMethodCall, lowerCreateRequireCall, lowerCryptoHashMethodCall, lowerDirentMethodCall, lowerFileHandleMethodCall, lowerImportMetaResolveCall, lowerNodeModuleCall, lowerPerfHooksCall, lowerProcStreamMethodCall, lowerReflectCall, lowerRequireResolveCall, lowerWatcherMethodCall } from "./lower-builtins.js";
+import { lowerAbsenceProbe, lowerPromiseAllTupleCall, lowerPromiseRejectCall, stringWrapperToString, symbolFieldInfo, templateRawTextOf } from "./lower-exprs.js";
 import { isSafeToDiscard } from "./expressions/evaluation-safety.js";
 import { tryLowerExpression } from "./expressions/try-lower-expression.js";
+import { hasRuntimeStatics } from "./class-runtime-statics.js";
 import { httpClientFnBindingOf, isStreamUndefCallExpr, lowerCompatReqStreamOptionalCall, lowerHttpClientFnCall } from "./lower-server.js";
-import { EMITTER_API_MEMBERS, exactInstanceClassOf, findGenericMethodOn, lowerClassGenericMethodCall, lowerStaticMethodCall, returnsOnlyThis } from "./lower-classes.js";
+import { EMITTER_API_MEMBERS, exactClassOfReceiver, exactInstanceClassOf, findGenericMethodOn, lowerClassGenericMethodCall, lowerStaticMethodCall, lowerStaticFieldRead, returnsOnlyThis, storedClassValueType } from "./lower-classes.js";
 import { classCallbackCall, isClassCallback } from "./class-callbacks.js";
 import { emitterRooted, lowerEmitterMethodCall } from "./lower-event-emitter.js";
 import { lowerConsoleInspectArg, lowerFormatCall } from "./lower-inspect.js";
@@ -43,6 +44,7 @@ import { defaultAfterUndefined, lowerOptionalArgument, lowerStaticallyUndefinedA
 import { fenceSymbolFieldCopy } from "./symbol-fields.js";
 import { lowerClassDataDescriptor, lowerClassDescriptorRead } from "./class-descriptors.js";
 import { classStaticDataFor } from "./class-static-data.js";
+import { jsBindingHasOpenWrites } from "./lower-stmts.js";
 export { bodyReadsArguments };
 /** The one func-type projection of completed parameter shapes. Typed rest
  * parameters keep their packed array as the trailing native ABI slot and
@@ -123,7 +125,21 @@ export const MAX_GENERIC_INSTANCES = 100;
    * - `...xs: T[]`: the ABI type is the array; call sites pack the surplus.
    */
 export function paramShape(lowerer, param) {
+    if (param.initializer && isJsSourceFile(param.getSourceFile()) && !param.type &&
+        !/@(?:param|type)\b/.test(param.getSourceFile().text.slice(param.parent?.pos ?? param.pos, param.getStart()))) {
+        return { type: DYN, mode: "omittable", bodyType: DYN };
+    }
+    // Inferred JS array patterns describe the bindings, not an exact tuple
+    // contract. Consume the actual iterable, including surplus elements.
+    if (ts.isArrayBindingPattern(param.name) && isJsSourceFile(param.getSourceFile()) && !param.type &&
+        !/@(?:param|type)\b/.test(param.getSourceFile().text.slice(param.parent?.pos ?? param.pos, param.getStart()))) {
+        if (param.dotDotDotToken)
+            return { type: DYN, mode: "dynRest" };
+        return param.initializer ? { type: DYN, mode: "omittable", bodyType: DYN } : { type: DYN, mode: "required" };
+    }
     if (lowerer.checkedCallbackParams.has(param)) {
+        if (param.dotDotDotToken)
+            return { type: DYN, mode: "dynRest" };
         return param.initializer
             ? { type: DYN, mode: "omittable", bodyType: DYN }
             : { type: DYN, mode: "required" };
@@ -207,7 +223,7 @@ export function paramShape(lowerer, param) {
     }
     const type = lowerer.runtimeOptionalBindingType(param.name, lowerer.irTypeOf(param.name));
     if (type.kind === "void") {
-        lowerer.unsupported("SC1090", param, "function parameters with void type");
+        return { type: DYN, mode: param.questionToken ? "omittable" : "required" };
     }
     if (param.questionToken && !lowerer.bareUndefinedArmedUnion(type) && type.kind !== "dyn" && type.kind !== "jsval") {
         // `x?: unknown` where unknown came from an annotation: undefined is
@@ -624,8 +640,7 @@ leading) {
                 lowerer.unsupported("SC1090", a, "spread arguments into fixed parameter positions (a spread can only fill a rest parameter)");
             }
             const v = lowerer.lowerExpr(a);
-            if (v.kind !== "unitLit" && v.kind !== "numLit" && v.kind !== "strLit" &&
-                v.kind !== "boolLit" && v.kind !== "varRef" && v.kind !== "closure") {
+            if (!isSafeToDiscard(v)) {
                 lowerer.unsupported("SC1090", a, "surplus arguments with side effects (JS evaluates surplus arguments to a function without a rest parameter, then drops them; only effect-free surplus arguments compile)");
             }
         }
@@ -856,7 +871,7 @@ export function appendImplicitUndefinedReturn(lowerer, body, bodyReturn, loc) {
 /** A declaration's checker-derived IR return type. The unmappable-type
    * diagnostic points at `blame` (the name for top-level declarations, the
    * whole node for lambda-likes — preserving each caller's historical loc). */
-function hasExplicitJsDocReturn(decl) {
+export function hasExplicitJsDocReturn(decl) {
     const sourceFile = decl.getSourceFile();
     return /@returns?\b/.test(sourceFile.text.slice(decl.pos, decl.getStart(sourceFile)));
 }
@@ -866,6 +881,16 @@ function promiseCarriesDyn(lowerer, type) {
     return type.kind === "union" &&
         (lowerer.unions.get(type.unionId)?.arms.some((arm) => promiseCarriesDyn(lowerer, arm)) ?? false);
 }
+function producesConstructor(lowerer, type) {
+    let result = type;
+    for (let depth = 0; result && depth < 8; depth++) {
+        if (lowerer.checker.getConstructSignatures(result).length > 0)
+            return true;
+        const signatures = lowerer.checker.getCallSignatures(result);
+        result = signatures.length === 1 ? lowerer.checker.getReturnTypeOfSignature(signatures[0]) : undefined;
+    }
+    return false;
+}
 export function declaredReturnType(lowerer, decl, blame) {
     const sig = lowerer.checker.getSignatureFromDeclaration(decl);
     if (!sig)
@@ -882,6 +907,8 @@ export function declaredReturnType(lowerer, decl, blame) {
     if (retTsType.flags & ts.TypeFlags.Never)
         return VOID;
     const mappedReturn = lowerer.mapTypeOf(retTsType);
+    if (isJsSourceFile(decl.getSourceFile()) && mappedReturn?.kind === "array" && mappedReturn.elem.kind === "f64")
+        return DYN;
     if (isJsSourceFile(decl.getSourceFile()) && !decl.type && !hasExplicitJsDocReturn(decl) && mappedReturn?.kind === "date")
         return DYN;
     // JS inference assigns Number to arithmetic over any, although the
@@ -945,9 +972,12 @@ export function declaredReturnType(lowerer, decl, blame) {
     // that boundary; their factories keep the native record ABI.
     const asyncReturn = decl.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.AsyncKeyword) && mappedReturn?.kind === "promise";
     const recordReturn = asyncReturn ? mappedReturn.inner : mappedReturn;
+    const recordArms = recordReturn?.kind === "union" ? lowerer.unions.get(recordReturn.unionId)?.arms : recordReturn ? [recordReturn] : undefined;
+    const inferredRecordReturn = recordArms?.some((arm) => arm.kind === "record" || arm.kind === "object") &&
+        recordArms.every((arm) => isUnitType(arm) || arm.kind === "record" || arm.kind === "object" && !hasExplicitJsDocReturn(decl));
     if (isJsSourceFile(decl.getSourceFile()) &&
         decl.type === undefined &&
-        recordReturn?.kind === "record" &&
+        recordReturn !== null && recordReturn !== undefined && inferredRecordReturn &&
         lowerer.dynConvertible(recordReturn) &&
         decl.parameters.every((p) => {
             const mt = lowerer.mapTypeOf(lowerer.typeOf(p));
@@ -1565,6 +1595,7 @@ export function lowerGenericInstance(lowerer, info, inst) {
             body.push(...lowerer.lowerStmts(bodyBlock.statements));
             if (fnCtx.inferReturn) {
                 bodyReturn = resolveInferredReturn(lowerer, inst, fnCtx.inferReturn, body, decl);
+                inst.returnType = bodyReturn;
             }
             appendImplicitUndefinedReturn(lowerer, body, bodyReturn, locOf(decl));
         }
@@ -1578,6 +1609,7 @@ export function lowerGenericInstance(lowerer, info, inst) {
                 if (value.type.kind === "void") {
                     body.push({ kind: "exprStmt", expr: value, loc: locOf(decl.body) });
                     bodyReturn = resolveInferredReturn(lowerer, inst, fnCtx.inferReturn, body, decl);
+                    inst.returnType = bodyReturn;
                     appendImplicitUndefinedReturn(lowerer, body, bodyReturn, locOf(decl));
                 }
                 else {
@@ -1585,6 +1617,7 @@ export function lowerGenericInstance(lowerer, info, inst) {
                     fnCtx.inferReturn.entries.push({ stmt, node: decl.body });
                     body.push(stmt);
                     bodyReturn = resolveInferredReturn(lowerer, inst, fnCtx.inferReturn, body, decl);
+                    inst.returnType = bodyReturn;
                 }
             }
             else {
@@ -1639,7 +1672,9 @@ export function lowerGenericInstance(lowerer, info, inst) {
    * adds JS's undefined; DYN when returns disagree (the checked-dynamic
    * result slot — today's shape). Same-key recursion PINNED the fallback
    * type mid-lowering (callers already hold it), so a pinned instance
-   * keeps it and the wrap pass coerces every return to the pin. */
+   * keeps it and the wrap pass coerces every return to the pin. Callers
+   * store the settled type on their full instance; this narrower view
+   * can be a structural copy in native builds. */
 function resolveInferredReturn(lowerer, inst, infer, body, decl) {
     // The conservative completion test appendImplicitUndefinedReturn uses:
     // a body whose last statement isn't a terminator may complete without
@@ -1670,14 +1705,13 @@ function resolveInferredReturn(lowerer, inst, infer, body, decl) {
         else {
             final = DYN; // disagreeing returns: the checked-dynamic join
         }
-        inst.returnType = final;
     }
     // The wrap pass: settle every recorded return onto `final`, in place.
+    // Write through the stored union arm: optional-field widening on a
+    // local alias can otherwise introduce a record copy in native builds.
     for (const e of infer.entries) {
         if (e.stmt.kind !== "return")
             continue;
-        // Write through the recorded statement. A narrowed local can acquire a
-        // different record layout and copy it in the native compiler.
         const diagsBefore = lowerer.diags.length;
         try {
             if (e.stmt.value === null || e.stmt.value === undefined) {
@@ -2076,6 +2110,33 @@ function implicitDeclaredReturn(lowerer, info) {
                 return null;
         }
         const mapped = lowerer.mapTypeOf(retTs);
+        if (mapped?.kind === "symbol" && !hasExplicitJsDocReturn(info.decl))
+            return null;
+        if (mapped?.kind === "date" && !hasExplicitJsDocReturn(info.decl))
+            return DYN;
+        if (!hasExplicitJsDocReturn(info.decl) && info.decl.body) {
+            let openReturn = false;
+            ts.walkPreorder(info.decl.body, (node) => {
+                if (node !== info.decl.body && ts.isFunctionLike(node))
+                    return "skip";
+                if (!ts.isReturnStatement(node) || !node.expression || !ts.isIdentifier(node.expression))
+                    return undefined;
+                const symbol = lowerer.resolveValueSymbol(node.expression);
+                if (symbol && lowerer.checker.declarationsOf(symbol).some((decl) => ts.isVariableDeclaration(decl) && jsBindingHasOpenWrites(lowerer, decl)))
+                    openReturn = true;
+                return undefined;
+            });
+            if (openReturn)
+                return null;
+        }
+        // A JavaScript result inferred from an initial record can later
+        // carry additional fields. Settle its representation from the
+        // lowered returns instead of copying it back into that initial shape.
+        const resultArms = mapped?.kind === "union" ? lowerer.unions.get(mapped.unionId)?.arms : mapped ? [mapped] : [];
+        if (resultArms?.some((arm) => arm.kind === "record" || arm.kind === "object" || arm.kind === "classval") &&
+            resultArms.every((arm) => isUnitType(arm) || arm.kind === "record" || arm.kind === "object" || arm.kind === "classval") &&
+            !hasExplicitJsDocReturn(info.decl))
+            return null;
         // Inferred variadic results carry runtime argument packs. Their
         // factory must retain the lowered callable rather than extracting a
         // fixed native signature from a checked value.
@@ -2117,16 +2178,40 @@ function bindableImplicitIr(t) {
 function storedImplicitArgumentType(lowerer, arg) {
     while (ts.isParenthesizedExpression(arg))
         arg = arg.expression;
+    if (isJsSourceFile(arg.getSourceFile()) && (ts.isArrowFunction(arg) || ts.isFunctionExpression(arg))) {
+        const saved = lowerer.diagSink;
+        const diagnostics = [];
+        lowerer.diagSink = diagnostics;
+        let value;
+        try {
+            value = tryLowerExpression(lowerer, arg);
+        }
+        finally {
+            lowerer.diagSink = saved;
+        }
+        // Direct inferred helpers can receive native callbacks even when their
+        // result is an opaque handle that cannot cross checked storage.
+        if (diagnostics.length === 0 && value?.type.kind === "func")
+            return value.type;
+    }
+    if (arg.kind === ts.SyntaxKind.ThisKeyword)
+        return lowerer.resolveThis()?.type ?? null;
     if (ts.isAwaitExpression(arg)) {
         const awaited = storedImplicitArgumentType(lowerer, arg.expression);
         return awaited?.kind === "promise" ? awaited.inner : awaited;
     }
-    if (ts.isObjectLiteralExpression(arg) && isJsSourceFile(arg.getSourceFile()) && arg.properties.some((property) => !ts.isSpreadAssignment(property) && property.name !== undefined && ts.isComputedPropertyName(property.name) &&
-        lowerer.foldedStringKeyOf(property.name.expression) === null))
+    if (ts.isObjectLiteralExpression(arg) && isJsSourceFile(arg.getSourceFile()) &&
+        (arg.properties.length === 0 || arg.properties.some((property) => ts.isMethodDeclaration(property) || ts.isAccessor(property) ||
+            !ts.isSpreadAssignment(property) && property.name !== undefined && ts.isComputedPropertyName(property.name))))
         return DYN;
     if (ts.isIdentifier(arg))
         return lowerer.peekLocal(arg)?.type ?? lowerer.globalOf(arg)?.type ?? null;
     if (ts.isCallExpression(arg) && ts.isIdentifier(arg.expression)) {
+        if (isJsSourceFile(arg.getSourceFile())) {
+            const represented = tryLowerExpression(lowerer, arg);
+            if (represented?.type.kind === "dyn" || represented?.type.kind === "func")
+                return represented.type;
+        }
         const callee = storedImplicitArgumentType(lowerer, arg.expression);
         if (callee?.kind === "dyn")
             return DYN;
@@ -2173,12 +2258,29 @@ export function implicitCallInstance(lowerer, call, info) {
                 shapes.push({ type: stored, mode: "required" });
                 return;
             }
+            if (stored?.kind === "func") {
+                // The lowered closure may have an inferred JS destructuring
+                // parameter widened from the checker's exact tuple to dyn.
+                // Preserve that signature throughout the specialization.
+                const checkerType = lowerer.mapTypeOf(lowerer.typeOf(arg));
+                argTypes.set(sym, checkerType && typeEquals(checkerType, stored)
+                    ? lowerer.typeOf(arg) : lowerer.checker.getUnknownType());
+                shapes.push({ type: stored, mode: "required" });
+                return;
+            }
             // The argument's own checker type, literal-widened ('add' binds
             // string) — typeOf consults the ACTIVE instance's bindings, so a
             // bound param forwarded into another implicit call transitively
             // instantiates it (this._initCommandGroup(command)).
             const t = lowerer.checker.getBaseTypeOfLiteralType(lowerer.typeOf(arg));
-            const mapped = lowerer.mapTypeOf(t) ?? dynFallbackType(lowerer, arg, t);
+            const mapped = (neverTaintedJsType(lowerer, arg, t) ? null : lowerer.mapTypeOf(t)) ?? dynFallbackType(lowerer, arg, t);
+            if (isJsSourceFile(arg.getSourceFile()) && ts.isArrayLiteralExpression(arg) && mapped?.kind === "array" &&
+                (mapped.elem.kind === "classval" || mapped.elem.kind === "union" &&
+                    lowerer.unions.get(mapped.elem.unionId)?.arms.every((arm) => arm.kind === "classval"))) {
+                argTypes.set(sym, lowerer.checker.getUnknownType());
+                shapes.push({ type: DYN, mode: "required" });
+                return;
+            }
             // JavaScript arguments-based callables travel as checked functions.
             // Specializing a parameter to the inferred rest signature would
             // require extracting a native variadic ABI that the value does not
@@ -2192,6 +2294,11 @@ export function implicitCallInstance(lowerer, call, info) {
             // That checker supertype is not an empty-record runtime layout:
             // preserve represented arms through the checked boundary instead
             // of specializing a call to a union that would discard them.
+            if (isJsSourceFile(arg.getSourceFile()) && mapped?.kind === "func" && !lowerer.dynConvertible(mapped)) {
+                argTypes.set(sym, lowerer.checker.getUnknownType());
+                shapes.push({ type: DYN, mode: "required" });
+                return;
+            }
             const mappedArms = mapped?.kind === "union" ? lowerer.unions.get(mapped.unionId)?.arms ?? [] : mapped ? [mapped] : [];
             const hasTopObject = mappedArms.some((arm) => {
                 const shape = arm.kind === "record" ? lowerer.shapes.get(arm.shapeId) : undefined;
@@ -2737,7 +2844,15 @@ export function lowerTimersMemberCall(lowerer, expr, member, loc) {
         if (expr.arguments.length !== 1) {
             lowerer.noLowering(`clearTimeout with ${expr.arguments.length} arguments`, expr);
         }
-        const handle = lowerer.lowerExpr(expr.arguments[0]);
+        let handle = lowerer.lowerExpr(expr.arguments[0]);
+        if (handle.type.kind === "dyn" && isJsSourceFile(expr.getSourceFile())) {
+            const stored = lowerer.declareHiddenLocal("%timer.clear", DYN);
+            const ref = varRef(stored.id, DYN, loc);
+            handle = { kind: "seqExpr", stmts: [{ kind: "varDecl", localId: stored.id, init: handle, loc }], result: {
+                    kind: "ternary", cond: { kind: "dynTest", test: "number", value: ref, type: BOOL, loc },
+                    then: lowerer.coerceInto(expr.arguments[0], ref, F64), else_: numLit(0, loc), type: F64, loc,
+                }, type: F64, loc };
+        }
         if (handle.type.kind !== "f64") {
             lowerer.noLowering(`clearTimeout of '${lowerer.fmt(handle.type)}' handles`, expr.arguments[0], "the handle is the Timeout setTimeout returned (narrow 'Timeout | null' first)");
         }
@@ -3264,6 +3379,14 @@ function lowerProjectedBuiltinCall(lowerer, expr, bi, loc) {
 }
 export function lowerCall(lowerer, expr) {
     const loc = locOf(expr);
+    // Object's checker return type is `any`. Claim known object inputs
+    // before generic checked-dynamic dispatch tries to load the constructor.
+    if (ts.isIdentifier(expr.expression) && expr.expression.text === "Object" &&
+        lowerer.isStdlibGlobal(expr.expression, "Object")) {
+        const object = lowerObjectConstructor(lowerer, expr.arguments, loc);
+        if (object)
+            return object;
+    }
     // A call whose chain ROOTS at an ambient-undefined name (`declare
     // const value: Y | undefined; value?.foo("a")`, `declare function
     // chain...; chain(o).mapValues(f).value()`, a trap binding's read):
@@ -3373,7 +3496,7 @@ export function lowerCall(lowerer, expr) {
     // `a?.m()` (the token on the member access). The handled markers keep
     // the chain lowering's re-entrant dispatch from looping.
     if ((expr.questionDotToken && !lowerer.chainHandled.has(expr)) ||
-        (ts.isPropertyAccessExpression(expr.expression) &&
+        ((ts.isPropertyAccessExpression(expr.expression) || ts.isElementAccessExpression(expr.expression)) &&
             expr.expression.questionDotToken &&
             !lowerer.chainHandled.has(expr.expression))) {
         return lowerer.lowerOptionalChain(expr);
@@ -3382,6 +3505,9 @@ export function lowerCall(lowerer, expr) {
     // top-level statement (its field-initializer ordering lives there);
     // any other position would misorder initialization — rejected.
     if (expr.expression.kind === ts.SyntaxKind.SuperKeyword) {
+        const superCall = lowerer.ctx.superCall;
+        if (superCall)
+            return superCall(expr);
         lowerer.unsupported("SC1090", expr, "super() calls anywhere but as a top-level constructor statement");
     }
     // super.method(...): a DIRECT (never virtual) call of the base chain's
@@ -3500,6 +3626,13 @@ export function lowerCall(lowerer, expr) {
             loc,
         });
     }
+    if (ts.isPropertyAccessExpression(expr.expression) &&
+        TIMER_MODULE_MEMBERS.has(expr.expression.name.text) &&
+        lowerer.stdlibGlobalMember(expr.expression, "globalThis") === expr.expression.name.text) {
+        const served = lowerTimersMemberCall(lowerer, expr, expr.expression.name.text, loc);
+        if (served)
+            return served;
+    }
     // The timer globals — setTimeout/clearTimeout, setInterval/
     // clearInterval, setImmediate/clearImmediate. Provenance-checked (a
     // user function shadowing the name has a different, non-ambient
@@ -3642,9 +3775,7 @@ export function lowerCall(lowerer, expr) {
     // Provenance-checked like setTimeout; zero-arg forms are the JS
     // constants ("", false, 0). Wrapper objects stay fenced except where
     // the receiver is immediately converted by a direct String method call.
-    if (ts.isIdentifier(expr.expression) &&
-        expr.expression.text === "BigInt" &&
-        lowerer.isStdlibSymbol(lowerer.resolveValueSymbol(expr.expression) ?? undefined)) {
+    if (lowerer.isStdlibGlobal(expr.expression, "BigInt")) {
         if (expr.arguments.length !== 1) {
             lowerer.noLowering(`BigInt with ${expr.arguments.length} arguments`, expr);
         }
@@ -3657,12 +3788,11 @@ export function lowerCall(lowerer, expr) {
             return converted;
         lowerer.noLowering(`BigInt of ${lowerer.fmt(arg.type)} values`, argNode, "string, number, boolean, and bigint arguments are supported");
     }
-    if (ts.isIdentifier(expr.expression) &&
-        (expr.expression.text === "String" ||
-            expr.expression.text === "Boolean" ||
-            expr.expression.text === "Number") &&
-        lowerer.isStdlibSymbol(lowerer.resolveValueSymbol(expr.expression) ?? undefined)) {
-        const name = expr.expression.text;
+    if (lowerer.isStdlibGlobal(expr.expression, "String") ||
+        lowerer.isStdlibGlobal(expr.expression, "Boolean") ||
+        lowerer.isStdlibGlobal(expr.expression, "Number")) {
+        const name = lowerer.isStdlibGlobal(expr.expression, "String") ? "String" :
+            lowerer.isStdlibGlobal(expr.expression, "Boolean") ? "Boolean" : "Number";
         if (expr.arguments.length > 1) {
             lowerer.noLowering(`${name} with ${expr.arguments.length} arguments`, expr);
         }
@@ -3692,8 +3822,9 @@ export function lowerCall(lowerer, expr) {
         if (name === "Number")
             return lowerNumberConstructorValue(lowerer, argNode, loc);
         const arg = lowerer.lowerExpr(argNode);
-        if (name === "String" && arg.type.kind === "dyn") {
-            return { kind: "libCall", fn: "dyn.stringConstructor", args: [arg], type: STRING, loc };
+        if (name === "String" && (arg.type.kind === "dyn" || arg.type.kind === "union" &&
+            lowerer.unions.get(arg.type.unionId)?.arms.some((arm) => arm.kind === "symbol") && lowerer.dynConvertible(arg.type))) {
+            return { kind: "libCall", fn: "dyn.stringConstructor", args: [lowerer.coerceToExpected(arg, DYN)], type: STRING, loc };
         }
         if (name === "String")
             return lowerer.ensureString(arg, argNode);
@@ -3720,7 +3851,8 @@ export function lowerCall(lowerer, expr) {
         lowerer.fenceStaticHeadersMember(access, "call");
         lowerer.fenceStaticReadableStreamMember(access, "call");
         const source = tryLowerExpression(lowerer, access.expression);
-        if (source && (source.type.kind === "dyn" || isDynTypedRefType(source.type) &&
+        if (source && (source.type.kind === "dyn" || source.type.kind === "func" ||
+            (source.type.kind === "map" || source.type.kind === "set") && lowerer.dynConvertible(source.type) || isDynTypedRefType(source.type) &&
             lowerer.foldedStringKeyOf(access.argumentExpression) === null &&
             lowerer.mapTypeOf(lowerer.typeOf(access.argumentExpression))?.kind !== "symbol")) {
             const local = lowerer.declareHiddenLocal("%computedReceiver", DYN);
@@ -4123,6 +4255,7 @@ export function lowerCall(lowerer, expr) {
         // string-only argument rule.
         if ((expr.expression.text === "encodeURIComponent" ||
             expr.expression.text === "encodeURI" ||
+            expr.expression.text === "decodeURI" ||
             expr.expression.text === "decodeURIComponent") &&
             lowerer.isStdlibSymbol(lowerer.resolveValueSymbol(expr.expression) ?? undefined)) {
             const name = expr.expression.text;
@@ -4131,10 +4264,10 @@ export function lowerCall(lowerer, expr) {
             }
             const loc = locOf(expr);
             const argNode = expr.arguments[0];
-            if (name === "decodeURIComponent") {
+            if (name === "decodeURIComponent" || name === "decodeURI") {
                 const d = optionalCallValue(lowerer, argNode) ?? lowerer.lowerExpr(argNode);
                 const s = lowerer.ensureString(d, argNode);
-                return { kind: "libCall", fn: "str.decodeUriComponent", args: [s], type: STRING, loc };
+                return { kind: "libCall", fn: name === "decodeURI" ? "str.decodeUri" : "str.decodeUriComponent", args: [s], type: STRING, loc };
             }
             const value = optionalCallValue(lowerer, argNode) ?? lowerer.lowerExpr(argNode);
             const s = lowerer.ensureString(value, argNode);
@@ -4415,7 +4548,8 @@ export function lowerCall(lowerer, expr) {
             lowerer.lowerJsonMethodCall(expr, expr.expression) ??
             // Reflect.apply of a builtin rest-parameter fn (fixtures.js's
             // fixturesPath idiom) — before the stdlib member fence claims it.
-            lowerReflectApplyCall(lowerer, expr, expr.expression) ??
+            lowerReflectCall(lowerer, expr, expr.expression) ??
+            lowerBigIntStaticCall(lowerer, expr, expr.expression) ??
             lowerer.lowerNumberStaticCall(expr, expr.expression) ??
             lowerer.lowerDateCall(expr, expr.expression) ??
             lowerer.lowerTextCodecCall(expr, expr.expression) ??
@@ -4487,8 +4621,8 @@ export function lowerCall(lowerer, expr) {
             // Readable.from — the stream classes' one static (before the
             // stdlib chokepoint claims the member).
             lowerStreamStaticCall(lowerer, expr, expr.expression) ??
-            // Radix-free n.toString() is the STATIC number formatter (identical
-            // to `${n}` / String(n)); the explicit-radix form stays island.
+            // Primitive toString calls, including numeric radices, use the
+            // native formatters before the island method path.
             lowerNumberToStringCall(lowerer, expr, expr.expression) ??
             // Union receivers whose every arm has a text — the ngrok
             // `(chunk: Buffer | string) => chunk.toString()` idiom.
@@ -4528,7 +4662,6 @@ export function lowerCall(lowerer, expr) {
             // by the receiver's own element.
             lowerer.lowerFilterNarrowCall(expr, expr.expression) ??
             lowerArrayIsArrayCall(lowerer, expr, expr.expression) ??
-            lowerBigIntStaticCall(lowerer, expr, expr.expression) ??
             lowerBigIntMethodCall(lowerer, expr, expr.expression) ??
             lowerSymbolStaticCall(lowerer, expr, expr.expression) ??
             lowerSymbolMethodCall(lowerer, expr, expr.expression) ??
@@ -4563,6 +4696,13 @@ export function lowerCall(lowerer, expr) {
             lowerObjLitGenericMethodCall(lowerer, expr, expr.expression);
         if (intrinsic)
             return intrinsic;
+        if (isJsSourceFile(expr.getSourceFile())) {
+            const staticField = lowerStaticFieldRead(lowerer, expr.expression);
+            if (staticField?.type.kind === "dyn" && !expr.arguments.some(ts.isSpreadElement)) {
+                return { kind: "dynCall", callee: staticField, receiver: lowerer.lowerExprExpecting(expr.expression.expression, DYN), calleeName: expr.expression.getText(),
+                    args: expr.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc: locOf(expr) };
+            }
+        }
         const accessorTarget = lowerer.fieldTarget(expr.expression);
         if (accessorTarget?.container === "accessor") {
             const callee = lowerer.fieldGetExpr(accessorTarget, locOf(expr.expression), expr.expression);
@@ -4635,6 +4775,30 @@ export function lowerCall(lowerer, expr) {
         lowerer.fenceStaticHeadersMember(expr.expression, "call");
         lowerer.fenceStaticReadableStreamMember(expr.expression, "call");
     }
+    // Computed native members retain their original receiver and resolve
+    // the function before argument effects, just like dotted calls.
+    if (ts.isElementAccessExpression(expr.expression) && !expr.expression.questionDotToken && !expr.questionDotToken &&
+        !symbolFieldInfo(lowerer, expr.expression)) {
+        const access = expr.expression;
+        const value = tryLowerExpression(lowerer, access.expression);
+        if (value?.type.kind === "dyn" || value?.type.kind === "generator" ||
+            value && ["array", "bytes", "map", "set"].includes(value.type.kind) && lowerer.dynConvertible(value.type) ||
+            value?.type.kind === "string" && !ts.isStringLiteralLike(access.argumentExpression) && lowerer.dynConvertible(value.type) ||
+            value?.type.kind === "object" && !lowerer.classes.get(value.type.className)?.def.runtime) {
+            const local = lowerer.declareHiddenLocal("%computedReceiver", value.type);
+            const reference = { kind: "varRef", localId: local.id, type: value.type, loc };
+            const receiver = lowerer.coerceToExpected(reference, DYN);
+            const raw = lowerer.lowerExpr(access.argumentExpression);
+            const key = raw.type.kind === "string" ? raw : lowerer.coerceInto(access.argumentExpression, raw, DYN);
+            const callee = { kind: "dynKeyGet", value: receiver, key, type: DYN, loc };
+            const spread = expr.arguments.some(ts.isSpreadElement) ? lowerSpreadArgsCall(lowerer, expr, callee, loc) : null;
+            if (spread && spread.kind !== "dynCall")
+                lowerer.unsupported("SC1090", expr, "computed native method spread arguments");
+            const result = spread !== null ? { ...spread, receiver } : { kind: "dynCall", callee, receiver,
+                calleeName: access.getText(), args: expr.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc };
+            return { kind: "seqExpr", stmts: [{ kind: "varDecl", localId: local.id, init: value, loc }], result, type: DYN, loc };
+        }
+    }
     // The ELEMENT spelling of a primitive method call — `x['toString']()`,
     // `s['charAt'](0)`: JS resolves it exactly like the dot form, so the
     // literal-keyed shapes with a static lowering route there before the
@@ -4720,6 +4884,11 @@ export function lowerCall(lowerer, expr) {
                 : "value";
         return { kind: "dynCall", callee, calleeName, args, type: DYN, loc };
     }
+    if (callee.type.kind === "union" && lowerer.dynConvertible(callee.type) &&
+        lowerer.unions.get(callee.type.unionId)?.arms.some((arm) => arm.kind === "func")) {
+        return { kind: "dynCall", callee: lowerer.coerceToExpected(callee, DYN), calleeName: expr.expression.getText(),
+            args: expr.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc };
+    }
     if (callee.type.kind !== "func") {
         lowerer.badType(expr.expression, lowerer.typeOf(expr.expression));
     }
@@ -4959,6 +5128,10 @@ function lowerNumberConstructorValue(lowerer, argNode, loc) {
         return { kind: "libCall", fn: "num.fromString", args: [arg], type: F64, loc };
     if (arg.type.kind === "dyn")
         return { kind: "libCall", fn: "dyn.numberConstructor", args: [arg], type: F64, loc };
+    if (arg.type.kind === "union" && lowerer.dynConvertible(arg.type))
+        return {
+            kind: "libCall", fn: "dyn.numberConstructor", args: [lowerer.coerceToExpected(arg, DYN)], type: F64, loc,
+        };
     const optionalNumber = lowerOptionalStringNumber(lowerer, arg, loc);
     if (optionalNumber)
         return optionalNumber;
@@ -4973,6 +5146,8 @@ function lowerNumberConstructorValue(lowerer, argNode, loc) {
  * checker guard. Dispatch BigInt by the actual value, including nullish
  * TypeErrors, rather than interpreting that storage as the narrowed arm. */
 function lowerBigIntConstructorValue(lowerer, arg, loc) {
+    if (arg.type.kind === "dyn")
+        return { kind: "libCall", fn: "dyn.bigintConstructor", args: [arg], type: BIGINT_T, loc };
     if (arg.type.kind === "bigint")
         return arg;
     if (arg.type.kind === "string")
@@ -5244,8 +5419,9 @@ function lowerObjectOwnCall(lowerer, call, receiverNode, keyNode, extraNodes, me
             stmts.push({ kind: "exprStmt", expr: effect, loc: locOf(extra) });
     }
     let key = keyRef;
-    if (receiverRef.type.kind === "dyn" && keyRef && (keyRef.type.kind === "symbol" || keyRef.type.kind === "dyn")) {
-        const result = { kind: "libCall", fn: enumerable ? "dyn.propertyIsEnumerableComputed" : "dyn.hasOwnComputed", args: [receiverRef, lowerer.coerceToExpected(keyRef, DYN)], type: BOOL, loc };
+    if (lowerer.dynConvertible(receiverRef.type) && keyRef && (receiverRef.type.kind === "object" || keyRef.type.kind === "symbol" || keyRef.type.kind === "dyn" ||
+        keyRef.type.kind === "union" && lowerer.dynConvertible(keyRef.type))) {
+        const result = { kind: "libCall", fn: enumerable ? "dyn.propertyIsEnumerableComputed" : "dyn.hasOwnComputed", args: [lowerer.coerceToExpected(receiverRef, DYN), lowerer.coerceToExpected(keyRef, DYN)], type: BOOL, loc };
         return { kind: "seqExpr", stmts, result, type: BOOL, loc };
     }
     if (!keyNode || rawKey?.type.kind === "undefinedT" || rawKey?.type.kind === "void") {
@@ -5441,6 +5617,9 @@ function lowerStringPrototypeCall(lowerer, call, access) {
     // padding uses a helper that delays conversion until every argument is ready.
     const objectWithoutMethodArgs = entry?.maxArgs === 0 && call.arguments.length === 1 &&
         (receiverType.kind === "record" || receiverType.kind === "array" || receiverType.kind === "object");
+    if (padding && !scalar && lowerer.dynConvertible(receiverType)) {
+        return lowerStringPaddingCall(lowerer, call, entry.method, lowerer.coerceToExpected(receiverValue, DYN), receiverNode, call.arguments.slice(1));
+    }
     if (!scalar && !objectWithoutMethodArgs) {
         lowerer.noLowering(`String.prototype.${methodAccess.name.text}.call with ${lowerer.fmt(receiverType)} receivers`, call);
     }
@@ -5677,7 +5856,7 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
         // tsc types the return by the evolved shape, the binding lowered
         // dyn): probe the lowering and claim exactly the dyn results.
         const probed = tryLowerExpression(lowerer, access.expression);
-        if (isJsSourceFile(call.getSourceFile()) && probed?.type.kind === "func" &&
+        if (probed?.type.kind === "func" && stdlibGlobalNameOf(lowerer, access.expression) === null &&
             !["call", "apply", "bind", "toString", "valueOf", "constructor"].includes(access.name.text) &&
             canBoxFuncIntoDyn(probed.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
             const loc = locOf(call);
@@ -5698,10 +5877,22 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
                     args: call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc }, type: DYN, loc,
             };
         }
+        if (probed?.type.kind === "classval") {
+            const info = lowerer.classes.get(probed.type.className);
+            if (info && (info.callableBase || hasRuntimeStatics(info)))
+                return lowerStaticMethodCall(lowerer, call, access);
+        }
         if (probed?.type.kind !== "dyn")
             return null;
         recv = probed;
     }
+    // A factory may return a constructor more precise than its inferred
+    // checker result. Runtime static members live on that constructor.
+    if (recv.type.kind === "classval") {
+        const info = lowerer.classes.get(recv.type.className);
+        if (info && (info.callableBase || hasRuntimeStatics(info)))
+            return lowerStaticMethodCall(lowerer, call, access);
+    }
     // A checker-`any` receiver that already lowered to a real STRING (the
     // chained form — `cfg.host.trim().toLowerCase()`, where the first step
     // extracted): no validation needed, ride the string tables directly.
@@ -5770,7 +5961,13 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
     // unimplemented methods throw a LOUD not-supported Error; names the
     // kind's prototype lacks throw Node's "x.y is not a function"; OBJ
     // receivers call the own member.
-    const dispatched = lowerDynDispatchMethodCall(lowerer, call, access, recv, arrayReceiver);
+    // A stored callback must be read before argument effects, and called
+    // with the original receiver rather than a materialized property view.
+    const callbackProperty = (() => {
+        const prop = lowerer.checker.getPropertyOfType(recvTs, access.name.text);
+        return prop !== undefined && lowerer.checker.declarationsOf(prop).some((decl) => ts.isPropertyDeclaration(decl) || ts.isPropertySignature(decl));
+    })();
+    const dispatched = callbackProperty ? null : lowerDynDispatchMethodCall(lowerer, call, access, recv, arrayReceiver);
     if (dispatched)
         return dispatched;
     // Names NO dyn-representable prototype declares: the member can only
@@ -5796,9 +5993,6 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
     if (call.questionDotToken || access.questionDotToken)
         return null;
     const loc = locOf(call);
-    if (call.arguments.some((a) => ts.isSpreadElement(a))) {
-        lowerer.unsupported("SC1090", call, "spread arguments in calls through 'unknown' values");
-    }
     const receiverLocal = lowerer.declareHiddenLocal("%dynCallReceiver", DYN);
     const receiver = { kind: "varRef", localId: receiverLocal.id, type: DYN, loc };
     const member = {
@@ -5808,6 +6002,14 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
         type: DYN,
         loc: locOf(access),
     };
+    if (call.arguments.some(ts.isSpreadElement)) {
+        const spread = lowerSpreadArgsCall(lowerer, call, member, loc);
+        if (spread?.kind === "dynCall")
+            return { kind: "seqExpr",
+                stmts: [{ kind: "varDecl", localId: receiverLocal.id, init: recv, loc }],
+                result: { ...spread, receiver }, type: DYN, loc };
+        lowerer.unsupported("SC1090", call, "spread arguments in calls through 'unknown' values");
+    }
     const args = call.arguments.map((a) => lowerer.lowerExprExpecting(a, DYN));
     return {
         kind: "seqExpr", stmts: [{ kind: "varDecl", localId: receiverLocal.id, init: recv, loc }],
@@ -5858,7 +6060,7 @@ const DYN_DISPATCH_METHODS = new Set([
     "setEncoding", "setDefaultEncoding", "setTimeout", "read", "isPaused",
     "writeHead", "setHeader", "getHeader", "hasHeader", "removeHeader",
     "getHeaders", "getHeaderNames", "appendHeader", "flushHeaders",
-    "add", "append", "delete", "get", "getSetCookie", "has", "set",
+    "add", "append", "delete", "get", "getSetCookie", "has", "set", "clear", "keys", "values", "entries", "next",
     "writeContinue", "writeEarlyHints", "cork", "uncork", "addTrailers",
     "ref", "unref", "address", "setNoDelay", "setKeepAlive", "connect",
     "resetAndDestroy", "destroySoon",
@@ -5879,7 +6081,7 @@ const DYN_DISPATCH_METHODS = new Set([
     "dispatchEvent",
     "preventDefault", "stopPropagation", "stopImmediatePropagation",
     "composedPath",
-    "json", "text", "bytes",
+    "json", "text", "bytes", "arrayBuffer",
     // Promise.prototype (SCR_DYN_PROMISE receivers): the reaction trio
     // rides the fiber machinery (scr_dyn_promise_then); on every other dyn
     // kind then/catch/finally answer the stored-member path (OBJ own
@@ -5899,6 +6101,17 @@ export function lowerDynDispatchMethodCall(lowerer, call, access, recv, arrayRec
     if ((!DYN_DISPATCH_METHODS.has(method) && !isJsSourceFile(call.getSourceFile())) || lowerer.chainBlocked(call, access))
         return null;
     if (call.arguments.some((arg) => ts.isSpreadElement(arg))) {
+        const loc = locOf(call);
+        const local = lowerer.declareHiddenLocal("%spreadReceiver", DYN);
+        const receiver = varRef(local.id, DYN, loc);
+        const callee = { kind: "dynKeyGet", value: receiver,
+            key: { kind: "strLit", value: method, type: STRING, loc }, type: DYN, loc };
+        const spread = lowerSpreadArgsCall(lowerer, call, callee, loc);
+        if (spread?.kind === "dynCall")
+            return { kind: "seqExpr",
+                stmts: [{ kind: "varDecl", localId: local.id, init: recv, loc },
+                    { kind: "exprStmt", expr: { kind: "libCall", fn: "dyn.arrayPrototype", args: [], type: DYN, loc }, loc }],
+                result: { ...spread, receiver }, type: DYN, loc };
         lowerer.unsupported("SC1090", call, "spread arguments in calls through 'unknown' values");
     }
     const predicate = method === "filter" && call.arguments[0]
@@ -5972,7 +6185,12 @@ export function lowerDynDispatchMethodCall(lowerer, call, access, recv, arrayRec
             }
         }
     }
-    const args = call.arguments.map((arg, i) => i === 0 && predicate ? lowerer.coerceInto(arg, predicate, DYN) : lowerer.lowerExprExpecting(arg, DYN));
+    const args = call.arguments.map((arg, i) => {
+        if (i === 0 && predicate)
+            return lowerer.coerceInto(arg, predicate, DYN);
+        const undefinedArg = lowerStaticallyUndefinedArgument(lowerer, arg);
+        return undefinedArg ? defaultAfterUndefined(undefinedArg, dynUndefinedExpr(locOf(arg))) : lowerer.lowerExprExpecting(arg, DYN);
+    });
     return {
         kind: "dynInvoke",
         recv,
@@ -6098,13 +6316,13 @@ function lowerCaughtPredicateCall(lowerer, call, caughtLocal) {
    * and String(n) lower to (Number::toString with radix 10 IS that
    * conversion, per spec) — booleans the "true"/"false" texts, and strings
    * the identity read (String.prototype.toString returns `this`). The
-   * explicit-radix number form keeps its island lowering (ISLAND_SURFACE);
+   * explicit-radix number form uses the native radix formatter;
    * null for other receivers, argument shapes, or non-lib members (a
    * user's own `.toString` takes the ordinary paths). */
 function lowerNumberToStringCall(lowerer, call, access) {
     if (lowerer.chainBlocked(call, access))
         return null;
-    if (access.name.text !== "toString" || call.arguments.length !== 0)
+    if (access.name.text !== "toString" || call.arguments.length > 1 || call.arguments.some(ts.isSpreadElement))
         return null;
     const recvKind = lowerer.mapTypeOf(lowerer.typeOf(access.expression))?.kind;
     if (recvKind !== "f64" && recvKind !== "bool" && recvKind !== "string")
@@ -6112,6 +6330,22 @@ function lowerNumberToStringCall(lowerer, call, access) {
     if (!lowerer.isStdlibMember(access))
         return null;
     const operand = lowerer.lowerExpr(access.expression);
+    // JavaScript array and typed-array reads can still be undefined even
+    // when the checker declares a number. Preserve that runtime value and
+    // let native method dispatch format numbers or throw for missing data.
+    if (operand.type.kind === "dyn") {
+        return {
+            kind: "libCall", fn: "dyn.toString", args: [operand,
+                call.arguments[0] ? lowerer.lowerExprExpecting(call.arguments[0], DYN) : dynUndefinedExpr(locOf(call)),
+                { kind: "strLit", value: access.getText(), type: STRING, loc: locOf(call) },
+            ], type: STRING, loc: locOf(call),
+        };
+    }
+    if (call.arguments.length === 1) {
+        if (operand.type.kind !== "f64")
+            return null;
+        return { kind: "libCall", fn: "num.toStringRadix", args: [operand, lowerer.lowerExprExpecting(call.arguments[0], DYN)], type: STRING, loc: locOf(call) };
+    }
     if (operand.type.kind === "string")
         return operand; // identity, receiver evaluated
     if (operand.type.kind !== "f64" && operand.type.kind !== "bool")
@@ -6574,15 +6808,14 @@ function templateEscapesValid(raw) {
    * maps to string[] (type-mapper.ts), so the array rides the ordinary
    * slot-directed coercion into whatever the tag's first parameter wants
    * — string[] exactly, an `any` slot through the dyn boundary, a rest
-   * pack's first element. `.raw` does not exist on the lowered object:
-   * reads fence per member, and String.raw itself lowered above (the raw
-   * spans splice directly, no array materializes).
+   * pack's first element. Checked tags receive frozen cooked and raw
+   * arrays with the standard nonenumerable `.raw` descriptor. Typed direct
+   * tags retain the string-array representation.
    *
    * Tag forms: a top-level declared function (the direct-call fast path —
    * overload sets reconcile through the resolved signature exactly like
    * plain calls), an island value under --dynamic (engine method/function
-   * call: the engine side sees a plain marshaled array — a tag reading
-   * `.raw` there answers undefined where Node carries the raw spans), and
+   * call with the engine's cooked/raw template object), and
    * a checked-dynamic value (the dynCall boundary — a non-function tag
    * throws Node's catchable TypeError). Everything else — generic tags,
    * method tags, function-value bindings — fences by name. */
@@ -6642,10 +6875,11 @@ export function lowerTaggedTemplate(lowerer, expr) {
     if (ts.isIdentifier(expr.tag) && !lowerer.isSelfReference(expr.tag)) {
         if (lowerer.isTopLevelFnSymbol(expr.tag) && !lowerer.peekLocal(expr.tag)) {
             fenceEarlyAliasUse(lowerer, expr.tag, expr);
-            if (lowerer.genericFnOf(expr.tag)) {
+            const genericTag = lowerer.genericFnOf(expr.tag);
+            if (genericTag && !genericTag.implicitParams) {
                 lowerer.unsupported("SC1090", expr, "tagged templates with generic tag functions");
             }
-            const sig = lowerer.fnSigOf(expr.tag);
+            const sig = genericTag ? null : lowerer.fnSigOf(expr.tag);
             if (sig) {
                 lowerer.noteEdge(sig.name);
                 const args = completeArgs(lowerer, values, sig.params, loc, expr, [strings()]);
@@ -6672,10 +6906,13 @@ export function lowerTaggedTemplate(lowerer, expr) {
     // Checked-dynamic tags (`var f: any; f\`abc\``, dyn property chains):
     // the dynCall boundary — arguments convert into dyn, a non-function
     // tag throws Node's catchable "<name> is not a function" TypeError.
-    const callee = lowerer.lowerExpr(expr.tag);
+    let callee = lowerer.lowerExpr(expr.tag);
+    if (callee.type.kind === "func" && isJsSourceFile(expr.getSourceFile()) && lowerer.dynConvertible(callee.type)) {
+        callee = { kind: "dynFrom", value: callee, type: DYN, loc };
+    }
     if (callee.type.kind === "dyn") {
         const args = [
-            lowerer.coerceInto(expr.template, strings(), DYN),
+            loweredTemplateStrings(lowerer, expr, pieces.map((piece) => piece.text), loc, pieces.map(templateRawTextOf)),
             ...values.map((a) => lowerer.lowerExprExpecting(a, DYN)),
         ];
         const calleeName = ts.isPropertyAccessExpression(expr.tag) || ts.isElementAccessExpression(expr.tag)
@@ -6687,12 +6924,15 @@ export function lowerTaggedTemplate(lowerer, expr) {
     }
     lowerer.unsupported("SC1090", expr, "tagged templates with this tag form (top-level functions and dynamic values tag; call the function directly otherwise)");
 }
-function loweredTemplateStrings(lowerer, expr, cooked, loc) {
+function loweredTemplateStrings(lowerer, expr, cooked, loc, raw) {
     // Normal runtime construction keeps this array aligned with the current
     // ScrArr layout in the backend. The old static-header IR node encoded the
     // pre-sparse layout in LLVM and crashed as soon as a tag read its strings.
-    const type = arrayOf(STRING);
-    const key = `templateStringsGlobal:${loc.file}:${expr.template.getStart()}`;
+    const type = raw ? DYN : arrayOf(STRING);
+    const array = (values) => ({ kind: "dynArrLit", elems: values.map((value) => ({ kind: "dynFrom", value: { kind: "strLit", value, type: STRING, loc }, type: DYN, loc })), type: DYN, loc });
+    const freeze = (value) => ({ kind: "libCall", fn: "dyn.freeze", args: [value], type: DYN, loc });
+    const checked = raw ? freeze({ kind: "libCall", fn: "dyn.defineProperty", args: [array(cooked), { kind: "dynFrom", value: { kind: "strLit", value: "raw", type: STRING, loc }, type: DYN, loc }, { kind: "dynObjLit", fields: [{ key: { kind: "strLit", value: "value", type: STRING, loc }, value: freeze(array(raw)) }], type: DYN, loc }], type: DYN, loc }) : null;
+    const key = `templateStringsGlobal:${loc.file}:${expr.template.getStart()}:${raw ? "checked" : "typed"}`;
     let getter = lowerer.widthHelpers.get(key);
     if (!getter) {
         const site = lowerer.globalsList.length;
@@ -6714,7 +6954,7 @@ function loweredTemplateStrings(lowerer, expr, cooked, loc) {
                         {
                             kind: "assign",
                             localId: globalId,
-                            value: {
+                            value: checked ?? {
                                 kind: "arrayLit",
                                 elems: cooked.map((value) => ({ kind: "strLit", value, type: STRING, loc })),
                                 type,
@@ -6819,6 +7059,23 @@ export function lambdaSignature(lowerer, node) {
                 : "generic arrow/function expressions outside a never-reassigned module-scope binding (only `const f = <T>(x: T) => ...` bindings and top-level generic function declarations monomorphize)");
     }
     const shapes = lowerer.paramShapes(node.parameters);
+    // Error-first callbacks captured by native filesystem adapters receive
+    // the selected runtime overload. Ambient contextual inference can pick
+    // the string overload even when options request a Buffer.
+    if ((ts.isArrowFunction(node) || ts.isFunctionExpression(node)) && ts.isCallExpression(node.parent) &&
+        node.parent.arguments.at(-1) === node) {
+        const builtin = ts.isPropertyAccessExpression(node.parent.expression) ? lowerer.builtinMemberOf(node.parent.expression)
+            : ts.isIdentifier(node.parent.expression) ? lowerer.builtinImportOf(node.parent.expression) : null;
+        if (builtin?.module === "fs" && builtin.member !== "rename" && builtinModuleFnOf(lowerer, builtin.module, builtin.member)?.fn === "fs.callbackCall") {
+            for (let index = 0; index < shapes.length; index++) {
+                if (!node.parameters[index]?.type) {
+                    shapes[index].type = DYN;
+                    if (shapes[index].bodyType)
+                        shapes[index].bodyType = DYN;
+                }
+            }
+        }
+    }
     // A concise arrow over an h2-only stream/session call (`() =>
     // req.stream.destroy()`): the call ALWAYS throws on this lowering
     // (stream is undefined — the streamUndefCall precedent), so the body
@@ -6919,14 +7176,21 @@ export function lambdaSignature(lowerer, node) {
    * object-literal shorthand method to a module-level function and yields
    * the `closure` expression creating it. */
 export function lowerLambda(lowerer, node) {
+    const prepared = (ts.isArrowFunction(node) || ts.isFunctionExpression(node)) ? lowerer.preparedClassFactories.get(node) : undefined;
+    if (prepared)
+        return prepared;
     const loc = locOf(node);
-    const { shapes, funcType } = lowerer.lambdaSignature(node);
+    const signature = lowerer.lambdaSignature(node);
+    const { shapes } = signature;
+    let { funcType } = signature;
     // A lambda IS a value: the completed-ABI rule applies at birth. The
     // contextual (target) type decides — `(x?: number) => void` may flow
     // into a slot annotated `(x: number | undefined) => void` (same ABI
     // signature), anything else is fenced. Nested function declarations and
     // object-literal shorthand methods aren't expressions — always fenced.
-    lowerer.requireExactArityValue(node, ts.isArrowFunction(node) || ts.isFunctionExpression(node) ? node : null, shapes, funcType);
+    if (!(ts.isMethodDeclaration(node) && isJsSourceFile(node.getSourceFile()) &&
+        canBoxFuncIntoDyn(funcType, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))))
+        lowerer.requireExactArityValue(node, ts.isArrowFunction(node) || ts.isFunctionExpression(node) ? node : null, shapes, funcType);
     const nameIdent = !ts.isArrowFunction(node) && node.name && ts.isIdentifier(node.name) ? node.name : null;
     const baseName = nameIdent ? nameIdent.text : "";
     const fnName = `%fn${lowerer.lambdaCounter++}${baseName ? `_${baseName}` : ""}`;
@@ -6950,10 +7214,18 @@ export function lowerLambda(lowerer, node) {
     if (isGenerator &&
         (funcType.ret.kind !== "generator" || (funcType.ret.async === true) !== isAsync))
         lowerer.badType(node, lowerer.typeOf(node));
-    const bodyReturn = isGenerator
+    let bodyReturn = isGenerator
         ? lowerer.genBodyReturnType(funcType.ret)
         : lowerer.bodyReturnType(isAsync, funcType.ret);
     const fnCtx = newFnCtx(true, selfSymbol, funcType, bodyReturn);
+    const inferredSignature = isJsSourceFile(node.getSourceFile()) && !node.type ? lowerer.checker.getSignatureFromDeclaration(node) : undefined;
+    const returnsConstructor = inferredSignature && producesConstructor(lowerer, lowerer.checker.getReturnTypeOfSignature(inferredSignature));
+    if (isJsSourceFile(node.getSourceFile()) && !node.type && !isAsync && !isGenerator &&
+        (bodyReturn.kind === "classval" || bodyReturn.kind === "date" || bodyReturn.kind === "symbol" || bodyReturn.kind === "record" ||
+            (bodyReturn.kind === "dyn" || bodyReturn.kind === "func") && returnsConstructor)) {
+        fnCtx.inferReturn = { entries: [] };
+    }
+    fnCtx.inheritsArguments = ts.isArrowFunction(node);
     fnCtx.isAsync = isAsync;
     if (isGenerator && funcType.ret.kind === "generator") {
         fnCtx.generator = generatorMeta(lowerer, funcType.ret);
@@ -6967,7 +7239,7 @@ export function lowerLambda(lowerer, node) {
         // and a method nested inside another method never captures its owner.
         if (isJsSourceFile(node.getSourceFile()) && !ts.isArrowFunction(node)) {
             const receiver = lowerer.declareThis(DYN);
-            prologue.unshift({ kind: "varDecl", localId: receiver.id, init: { kind: "libCall", fn: "dyn.this", args: [], type: DYN, loc }, loc });
+            prologue.unshift({ kind: "varDecl", localId: receiver.id, init: { kind: "libCall", fn: isGenerator ? "dyn.generatorThis" : "dyn.this", args: [], type: DYN, loc }, loc });
         }
         // The synthetic trailing dyn-array param carries `arguments`.
         // Parameterized functions receive all actual arguments; zero-param
@@ -6977,6 +7249,15 @@ export function lowerLambda(lowerer, node) {
             params.push({ localId: argsLocal.id, name: "%arguments", type: DYN });
             fnCtx.argumentsLocal = argsLocal;
         }
+        if (isJsSourceFile(node.getSourceFile()) && !ts.isArrowFunction(node) &&
+            shapes.length === 1 && shapes[0]?.mode === "dynRest" && bodyReadsArguments(node)) {
+            const argsLocal = lowerer.declareHiddenLocal("%arguments", DYN);
+            prologue.push({ kind: "varDecl", localId: argsLocal.id, init: {
+                    kind: "dynInvoke", recv: varRef(params[0].localId, DYN, loc), method: "slice",
+                    calleeName: "Array.prototype.slice", args: [], type: DYN, loc,
+                }, loc });
+            fnCtx.argumentsLocal = argsLocal;
+        }
         let body;
         if (ts.isBlock(node.body)) {
             body = lowerer.lowerStmts(node.body.statements);
@@ -7011,7 +7292,7 @@ export function lowerLambda(lowerer, node) {
             else {
                 // Concise and block bodies use the same destination layout for
                 // fresh literals. Async bodies must inspect promises first.
-                let value = isAsync ? lowerer.lowerExpr(bodyExpr) : lowerer.lowerExprExpecting(bodyExpr, bodyReturn);
+                let value = isAsync || fnCtx.inferReturn ? lowerer.lowerExpr(bodyExpr) : lowerer.lowerExprExpecting(bodyExpr, bodyReturn);
                 // An async concise body whose value is itself a promise
                 // (`async () => p`): the async machinery RESOLVES the returned
                 // thenable into the function's own promise — lowerReturnValue's
@@ -7025,17 +7306,25 @@ export function lowerLambda(lowerer, node) {
                         : [
                             {
                                 kind: "return",
-                                value: lowerer.coerceInto(bodyExpr, value, bodyReturn),
+                                value: fnCtx.inferReturn ? value : lowerer.coerceInto(bodyExpr, value, bodyReturn),
                                 loc: locOf(node.body),
                             },
                         ];
+                if (fnCtx.inferReturn && body[0]?.kind === "return")
+                    fnCtx.inferReturn.entries.push({ stmt: body[0], node: bodyExpr });
             }
         }
+        if (fnCtx.inferReturn) {
+            bodyReturn = resolveInferredReturn(lowerer, { returnType: bodyReturn }, fnCtx.inferReturn, body, node);
+            funcType = { ...funcType, ret: bodyReturn };
+            fnCtx.returnType = bodyReturn;
+        }
         body = [...prologue, ...body];
         // Bare-expression bodies never pass through lowerStmts, so the
         // lib-boundary chokepoint runs here (idempotent for block bodies,
         // whose statements were already walked). A fence poisons the
         // enclosing statement — the lambda IS part of it.
+        body = lowerSurplusCalls(lowerer, body);
         enforceLibBoundary(lowerer, body);
         appendImplicitUndefinedReturn(lowerer, body, bodyReturn, loc);
         const ctx = lowerer.ctx;
@@ -7189,7 +7478,7 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
     const member = access.name.text;
     if (member !== "then" && member !== "catch" && member !== "finally")
         return null;
-    let recvT = lowerer.mapTypeOf(lowerer.typeOf(access.expression));
+    let recvT = lowerer.mapTypeOf(lowerer.typeOf(access.expression)) ?? dynFallbackType(lowerer, access.expression, lowerer.typeOf(access.expression));
     // A dynamic-import promise under an unmappable checker type
     // (`Promise<typeof import("./m")>` — module-namespace types have no
     // static mapping): the BINDING holds the island promise
@@ -7242,6 +7531,8 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
             loc,
         };
     }
+    if (receiver.type.kind === "dyn" && lowerer.dynConvertible(recvT))
+        receiver = lowerer.coerceInto(access.expression, receiver, recvT);
     if (receiver.type.kind !== "promise") {
         // mapTypeOf said promise but the value lowered as something else —
         // a lowering gap, named rather than ICEd on.
@@ -7534,7 +7825,7 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
             lowerer.unsupported("SC1090", call.arguments[0], "then handlers with more than one parameter (the two-argument onRejected form has no lowering — chain .catch(...) instead)");
         }
         const param = cb.type.params[0];
-        if (param !== undefined && !typeEquals(param, inner)) {
+        if (param !== undefined && !typeEquals(param, inner) && !(inner.kind === "void" && param.kind === "dyn")) {
             lowerer.unsupported("SC1090", call.arguments[0], `then handlers whose parameter is not the settled value's type (expected '${lowerer.fmt(inner)}', got '${lowerer.fmt(param)}')`);
         }
         const resultT = lowerer.mapTypeOf(lowerer.typeOf(call));
@@ -7568,6 +7859,8 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
             }
             else {
                 body.push({ kind: "exprStmt", expr: awaitE, loc });
+                if (param !== undefined)
+                    handlerArgs = [dynUndefinedExpr(loc)];
             }
             const handlerCall = {
                 kind: "callValue",
@@ -8544,6 +8837,8 @@ function lowerObjectStaticCall(lowerer, call, access) {
             object = { kind: "dynFrom", value: object, type: DYN, loc: locOf(call),
                 ...(fnName !== null ? { fnName } : {}) };
         }
+        if (object.type.kind !== "dyn" && canConvertToDyn(object.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id)))
+            object = lowerer.coerceInto(call.arguments[0], object, DYN);
         if (object.type.kind === "dyn") {
             const loc = locOf(call);
             if (member === "getPrototypeOf")
@@ -8600,7 +8895,7 @@ function lowerObjectStaticCall(lowerer, call, access) {
         if (unitTest)
             return unitTest;
         if (lk === "dyn" || rk === "dyn" || lk === "jsval" || rk === "jsval") {
-            lowerer.noLowering("Object.is over a dynamic operand", call, "validate/narrow the value first (strict equality's rule) — SameValue only differs from === on numbers (NaN, ±0)");
+            return { kind: "libCall", fn: "dyn.sameValue", args: [lowerer.coerceInto(leftNode, left, DYN), lowerer.coerceInto(rightNode, right, DYN)], type: BOOL, loc };
         }
         if (left.type.kind === "union" || right.type.kind === "union") {
             const ut = left.type.kind === "union" ? left.type : right.type;
@@ -8728,7 +9023,8 @@ function lowerObjectStaticCall(lowerer, call, access) {
             return prototype;
         if (isJsSourceFile(call.getSourceFile()) && call.arguments.length > 0 && !call.arguments.some(ts.isSpreadElement)) {
             const target = tryLowerExpression(lowerer, call.arguments[0]);
-            if (target?.type.kind === "func" && lowerer.dynConvertible(target.type)) {
+            if (target && ((target.type.kind === "func" && lowerer.dynConvertible(target.type)) ||
+                (target.type.kind === "object" && lowerer.errorHierarchyClassOf(target.type.className)))) {
                 const loc = locOf(call);
                 return { kind: "libCall", fn: "dyn.assignAll", args: [lowerer.coerceToExpected(target, DYN),
                         { kind: "dynArrLit", elems: call.arguments.slice(1).map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc },
@@ -8904,6 +9200,14 @@ function lowerObjectStaticCall(lowerer, call, access) {
         if (call.arguments.some((a) => ts.isSpreadElement(a)))
             return null;
         let target = tryLowerExpression(lowerer, call.arguments[0]);
+        const targetNode = call.arguments[0];
+        // The checker gives C.prototype the instance type, but its lowered
+        // value is the shared prototype table, not an instance to unbox.
+        const prototypeTarget = ts.isPropertyAccessExpression(targetNode) && targetNode.name.text === "prototype" &&
+            (exactClassOfReceiver(lowerer, targetNode.expression) !== null || storedClassValueType(lowerer, targetNode.expression)?.kind === "classval");
+        const declaredTarget = target?.type.kind === "dyn" && !prototypeTarget && !isJsSourceFile(targetNode.getSourceFile()) ? lowerer.mapTypeOf(lowerer.typeOf(targetNode)) : null;
+        if (target && declaredTarget && isDynTypedRefType(declaredTarget))
+            target = lowerer.coerceToExpected(target, declaredTarget);
         if (target && member === "defineProperty") {
             const native = lowerClassDataDescriptor(lowerer, call, member, target);
             if (native)
@@ -8915,11 +9219,10 @@ function lowerObjectStaticCall(lowerer, call, access) {
                 return descriptor;
             target = lowerer.coerceToExpected(target, DYN);
         }
-        // Error.cause owns a live data-property slot shared with its checked
-        // view. Other native fields do not yet synchronize descriptor edits.
+        // Error instances share a live property table with their checked view.
         const keyNode = call.arguments[1];
         if (target?.type.kind === "object" && target.type.className !== "%DOMException" && lowerer.errorHierarchyClassOf(target.type.className) &&
-            ts.isStringLiteral(keyNode) && keyNode.text === "cause") {
+            ((ts.isStringLiteral(keyNode) && (keyNode.text === "cause" || keyNode.text === "message")) || lowerer.mapTypeOf(lowerer.typeOf(keyNode))?.kind === "symbol")) {
             target = lowerer.coerceToExpected(target, DYN);
         }
         if (target?.type.kind === "func" && lowerer.dynConvertible(target.type)) {
@@ -9048,14 +9351,19 @@ function lowerObjectStaticCall(lowerer, call, access) {
         const recvNode = call.arguments[0];
         const keyNode = call.arguments[1];
         const probed = tryLowerExpression(lowerer, recvNode);
+        const constructor = probed?.type.kind === "classval" ? lowerer.classes.get(probed.type.className) : undefined;
         // A CHECKED-DYNAMIC receiver (the JS file-scope object-literal
         // identity story): the runtime dyn probe — OBJ member presence, ARR
         // index bounds, Node's ToObject TypeError on nullish.
-        if (probed?.type.kind === "dyn" || (probed && isDynTypedRefType(probed.type)) || (probed?.type.kind === "func" && lowerer.dynConvertible(probed.type))) {
+        if (probed?.type.kind === "dyn" || (probed && isDynTypedRefType(probed.type)) ||
+            (probed?.type.kind === "object" && lowerer.errorHierarchyClassOf(probed.type.className)) ||
+            (probed && constructor && (constructor.callableBase || hasRuntimeStatics(constructor))) ||
+            (probed?.type.kind === "func" && lowerer.dynConvertible(probed.type))) {
             const loc = locOf(call);
             const receiver = lowerer.coerceToExpected(probed, DYN);
             const rawKey = lowerer.lowerExpr(keyNode);
-            if (rawKey.type.kind === "dyn" || rawKey.type.kind === "symbol")
+            if (rawKey.type.kind === "dyn" || rawKey.type.kind === "symbol" ||
+                rawKey.type.kind === "union" && lowerer.dynConvertible(rawKey.type))
                 return {
                     kind: "libCall", fn: "dyn.hasOwnComputed", args: [receiver, lowerer.coerceToExpected(rawKey, DYN)], type: BOOL, loc,
                 };
@@ -9140,7 +9448,8 @@ function lowerObjectStaticCall(lowerer, call, access) {
         const isPrimitive = probed !== null && probed !== undefined &&
             (isUnitType(probed.type) || probed.type.kind === "string" ||
                 probed.type.kind === "f64" || probed.type.kind === "bool");
-        if (isDyn || isPrimitive || isFunction || (probed && isDynTypedRefType(probed.type))) {
+        const isJsUnion = probed?.type.kind === "union" && isJsSourceFile(call.getSourceFile()) && lowerer.dynConvertible(probed.type);
+        if (isDyn || isPrimitive || isFunction || isJsUnion || (probed && isDynTypedRefType(probed.type))) {
             const fn = member === "keys" ? "dyn.objKeys" : member === "values" ? "dyn.objValues" : "dyn.objEntries";
             let v = lowerer.lowerExpr(argNode);
             if (v.type.kind !== "dyn")
@@ -9221,7 +9530,6 @@ function lowerObjectStaticCall(lowerer, call, access) {
         const recT = argIr;
         const ref = { kind: "varRef", localId: "r.0", type: recT, loc };
         const outRef = { kind: "varRef", localId: "out.0", type: resultT, loc };
-        lowerer.arrHofHelpers.set(key, helper);
         const fn = {
             name: helper,
             params: [{ localId: "r.0", name: "r", type: recT }],
@@ -9250,6 +9558,8 @@ function lowerObjectStaticCall(lowerer, call, access) {
                         return null;
                     if (typeEquals(vt, valueT))
                         return value;
+                    if (valueT.kind === "dyn" && lowerer.dynConvertible(vt))
+                        return lowerer.coerceToExpected(value, DYN);
                     if (valueT.kind === "union" && vt.kind !== "union") {
                         const tag = lowerer.armTag(valueT.unionId, vt);
                         if (tag >= 0) {
@@ -9269,7 +9579,7 @@ function lowerObjectStaticCall(lowerer, call, access) {
                         guardUndefTag = undefTag;
                         const arms = lowerer.unions.get(f.type.unionId)?.arms ?? [];
                         const others = arms.filter((a) => a.kind !== "undefinedT");
-                        if (typeEquals(f.type, valueT ?? f.type)) {
+                        if (valueT?.kind === "dyn" || typeEquals(f.type, valueT ?? f.type)) {
                             // The field union IS the result union (single-field shapes):
                             // push the raw box — but then the undefined skip must NOT
                             // narrow. Handled below via vt === valueT.
@@ -9293,7 +9603,7 @@ function lowerObjectStaticCall(lowerer, call, access) {
                                 "cannot re-tag into the result element type — read the fields directly)");
                         }
                     }
-                    else if (!typeEquals(f.type, valueT ?? f.type)) {
+                    else if (valueT?.kind !== "dyn" && !typeEquals(f.type, valueT ?? f.type)) {
                         lowerer.unsupported("SC1090", call, `Object.${member} over '${lowerer.fmt(argIr)}' (field '${f.name}' is a union that cannot ` +
                             "re-tag into the result element type — read the fields directly)");
                     }
@@ -9333,6 +9643,7 @@ function lowerObjectStaticCall(lowerer, call, access) {
             fn.body = body;
         };
         finalize();
+        lowerer.arrHofHelpers.set(key, helper);
         lowerer.shapeOrderHelperFinalizers.push(finalize);
         lowerer.liftedFns.push(fn);
     }
@@ -9381,6 +9692,15 @@ export function lowerFunction(lowerer, decl) {
             params.push({ localId: argsLocal.id, name: "%arguments", type: DYN });
             ctx.argumentsLocal = argsLocal;
         }
+        if (isJsSourceFile(decl.getSourceFile()) && sig.params.length === 1 &&
+            sig.params[0]?.mode === "dynRest" && bodyReadsArguments(decl)) {
+            const argsLocal = lowerer.declareHiddenLocal("%arguments", DYN);
+            prologue.push({ kind: "varDecl", localId: argsLocal.id, init: {
+                    kind: "dynInvoke", recv: varRef(params[0].localId, DYN, locOf(decl)), method: "slice",
+                    calleeName: "Array.prototype.slice", args: [], type: DYN, loc: locOf(decl),
+                }, loc: locOf(decl) });
+            ctx.argumentsLocal = argsLocal;
+        }
         const bodyBlock = blockBodyOf(decl);
         if (!bodyBlock) {
             lowerer.unsupported("SC1090", decl, "function declarations whose block body the frontend cannot locate");
@@ -10404,6 +10724,14 @@ function lowerObjLitGenericMethodCall(lowerer, call, access) {
     const propSym = lowerer.checker.getPropertyOfType(recvT, name);
     if (!propSym)
         return null;
+    const propertyDecl = lowerer.checker.valueDeclarationOf(propSym);
+    if (propertyDecl && ts.isShorthandPropertyAssignment(propertyDecl) && ts.isIdentifier(propertyDecl.name) && ts.isObjectLiteralExpression(propertyDecl.parent)) {
+        requireObjLitGenericReceiver(lowerer, call, access.expression, propertyDecl.parent, name);
+        const targetSymbol = lowerer.checker.getShorthandAssignmentValueSymbol(propertyDecl);
+        const target = targetSymbol ? lowerer.genericFnsBySymbol.get((targetSymbol.flags & ts.SymbolFlags.Alias ? lowerer.checker.getAliasedSymbol(targetSymbol) : targetSymbol)) : undefined;
+        if (target)
+            return lowerer.lowerGenericCall(call, target);
+    }
     if (!isGenericCallableMemberType(lowerer.checker.getTypeOfSymbol(propSym), lowerer.checker))
         return null;
     // CLASS members belong to the class path (lowerClassGenericMethodCall
@@ -10502,6 +10830,12 @@ export function lowerObjectMethodCall(lowerer, call, access) {
             lowerUnionObjectDynFieldCall(lowerer, call, access, mappedReceiver);
         if (dispatched)
             return dispatched;
+        const arms = lowerer.unions.get(mappedReceiver.unionId)?.arms;
+        if (isJsSourceFile(call.getSourceFile()) && arms?.every((arm) => arm.kind === "object" &&
+            !lowerer.classes.get(arm.className)?.def.runtime) && lowerer.dynConvertible(mappedReceiver)) {
+            const receiver = lowerer.coerceInto(access.expression, lowerer.lowerExpr(access.expression), DYN);
+            return lowerDynDispatchMethodCall(lowerer, call, access, receiver, false);
+        }
     }
     const receiverIr = mappedReceiver?.kind === "object"
         ? mappedReceiver
@@ -10614,6 +10948,21 @@ export function lowerObjectMethodCall(lowerer, call, access) {
                 return finish({ kind: "dynCall", callee, receiver, calleeName: access.getText(), args, type: DYN, loc });
             }
         }
+        if (!fieldType && isJsSourceFile(call.getSourceFile()) && !info.def.runtime && !info.builtinError && !info.builtinEmitter && !info.builtinStream) {
+            const loc = locOf(call);
+            const value = lowerReceiver();
+            const local = lowerer.declareHiddenLocal("%callReceiver", value.type);
+            const reference = { kind: "varRef", localId: local.id, type: value.type, loc };
+            const receiver = lowerer.coerceToExpected(reference, DYN);
+            const callee = { kind: "dynKeyGet", value: receiver,
+                key: { kind: "strLit", value: access.name.text, type: STRING, loc }, type: DYN, loc };
+            const spread = call.arguments.some(ts.isSpreadElement) ? lowerSpreadArgsCall(lowerer, call, callee, loc) : null;
+            if (spread && spread.kind !== "dynCall")
+                lowerer.unsupported("SC1090", call, "native property call spread arguments");
+            const result = spread !== null ? { ...spread, receiver } : { kind: "dynCall", callee, receiver,
+                calleeName: access.getText(), args: call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc };
+            return { kind: "seqExpr", stmts: [{ kind: "varDecl", localId: local.id, init: value, loc }], result, type: DYN, loc };
+        }
         return null;
     }
     if (!info || !found)
@@ -10696,6 +11045,22 @@ function lowerUnionObjectMethodCall(lowerer, call, access, receiverT) {
         plans.push({ arm, info, found });
     }
     const shapes = plans[0].found.sig.params;
+    if (plans.some((plan) => isClassCallback(lowerer, plan.info, method))) {
+        const loc = locOf(call);
+        const local = lowerer.declareHiddenLocal("%unionMethodReceiver", DYN);
+        const receiver = varRef(local.id, DYN, loc);
+        const callee = { kind: "dynKeyGet", value: receiver,
+            key: { kind: "strLit", value: method, type: STRING, loc }, type: DYN, loc };
+        const spread = call.arguments.some(ts.isSpreadElement) ? lowerSpreadArgsCall(lowerer, call, callee, loc) : null;
+        if (spread && spread.kind !== "dynCall")
+            lowerer.unsupported("SC1090", call, "union method spread arguments");
+        const value = spread !== null ? { ...spread, receiver } : { kind: "dynCall", callee, receiver,
+            calleeName: access.getText(), args: call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc };
+        const resultT = lowerer.mapTypeOf(lowerer.typeOf(call));
+        const result = resultT && !isUnitType(resultT) ? lowerer.coerceToExpected(value, resultT) : value;
+        return { kind: "seqExpr", stmts: [{ kind: "varDecl", localId: local.id,
+                    init: lowerer.coerceInto(access.expression, lowerer.lowerExpr(access.expression), DYN), loc }], result, type: result.type, loc };
+    }
     if (!plans.every((plan) => paramAbisEqual(shapes, plan.found.sig.params)))
         return null;
     const resultT = lowerer.mapTypeOf(lowerer.typeOf(call));