@scriptc/compiler 0.2.0 → 0.2.2

package/dist/frontend/lowering/lower-calls.js

@@ -10,24 +10,25 @@ import { bodyReadsArguments } from "../arguments-usage.js";
 import { lowerGenMethodCall } from "./lower-generators.js";
 import { lowerClassSymbolMethodCall } from "./symbol-methods.js";
 import { errorToStringCall } from "./error-methods.js";
-import { lowerClassPrototypeAssign } from "./class-prototypes.js";
+import { lowerClassPrototypeAssign, lowerClassPrototypeDescriptors } from "./class-prototypes.js";
 import { BYTES_ELEMENT_NAME, BIGINT_T, BOOL, CAUGHT, DYN, F64, JSVAL, NULL_T, STRING, SYMBOL_T, UNDEFINED_T, VOID, arrayOf, canBoxFuncIntoDyn, canConvertToDyn, canDynCheckTo, canMarshalTypedFuncIntoIsland, ffiClassType, ffiSourceParamTypes, funcOf, isDynTypedRefType, isFfiCallbackParam, isFfiContextParam, isFfiReleaseParam, isUnitType, shapeHasAccessorSlots, typeEquals } from "../../ir/ir.js";
 import { isJsSourceFile, isNodeEsmFile, locOf, requireSpecOf } from "../program.js";
 import { genResultRecord, isGenericCallableMemberType, jsOpenObjectType, typeKey } from "../type-mapper.js";
-import { PoisonError, dynFallbackType, dynUndefinedExpr, importCallHandleType, jsFuncNameOf, newFnCtx, nodeThrowExpr, staticImportNamespaceType } from "./lowerer.js";
-import { enforceLibBoundary } from "./lib-boundary.js";
-import { NARROW_FIRST, STRING_INDEX_METHODS, STR_METHODS, builtinFenceHintOf, builtinModuleFnOf } from "./surfaces.js";
+import { PoisonError, dynFallbackType, dynUndefinedExpr, importCallHandleType, jsFuncNameOf, neverTaintedJsType, newFnCtx, nodeThrowExpr, staticImportNamespaceType } from "./lowerer.js";
+import { enforceLibBoundary, lowerSurplusCalls } from "./lib-boundary.js";
+import { NARROW_FIRST, STRING_INDEX_METHODS, STR_METHODS, builtinFenceHintOf, builtinModuleFnOf, stdlibGlobalNameOf } from "./surfaces.js";
 import { ffiBindingDiag, ffiSignatureDiag, libCallbackDiag, requiresDynamicDiag } from "../../diagnostics/diagnostic.js";
 import { mixinFnShapeOf } from "./lower-mixins.js";
-import { dynStringReceiver, lowerArrayConstructor, lowerArrayFromCall, lowerArrayOfCall, lowerDynArrayFilterCall, lowerDynArrayFlatMapCall, lowerGroupByStaticCall, lowerIteratorHelperCall, lowerObjectAssignIndexShape, lowerObjectFromEntriesCall, lowerObjectIterOverIndexShape, lowerTupleReadMethodCall } from "./lower-containers.js";
+import { dynStringReceiver, lowerArrayConstructor, lowerArrayFromCall, lowerArrayOfCall, lowerDynArrayFilterCall, lowerDynArrayFlatMapCall, lowerGroupByStaticCall, lowerIteratorHelperCall, lowerObjectAssignIndexShape, lowerObjectConstructor, lowerObjectFromEntriesCall, lowerObjectIterOverIndexShape, lowerTupleReadMethodCall } from "./lower-containers.js";
 import { lowerBytesStaticCall } from "./containers/bytes.js";
 import { lowerRegexMethodCall, lowerStringIndexCall, lowerStringMethodCall, lowerStringPaddingCall, lowerStringSplitCall } from "./containers/string-and-regexp.js";
-import { createRequireSpecOf, lowerChildStreamMethodCall, lowerChildWriterMethodCall, lowerCreateRequireCall, lowerCryptoHashMethodCall, lowerDirentMethodCall, lowerFileHandleMethodCall, lowerImportMetaResolveCall, lowerNodeModuleCall, lowerPerfHooksCall, lowerProcStreamMethodCall, lowerReflectApplyCall, lowerRequireResolveCall, lowerWatcherMethodCall } from "./lower-builtins.js";
-import { lowerAbsenceProbe, lowerPromiseAllTupleCall, lowerPromiseRejectCall, stringWrapperToString, templateRawTextOf } from "./lower-exprs.js";
+import { createRequireSpecOf, lowerChildStreamMethodCall, lowerChildWriterMethodCall, lowerCreateRequireCall, lowerCryptoHashMethodCall, lowerDirentMethodCall, lowerFileHandleMethodCall, lowerImportMetaResolveCall, lowerNodeModuleCall, lowerPerfHooksCall, lowerProcStreamMethodCall, lowerReflectCall, lowerRequireResolveCall, lowerWatcherMethodCall } from "./lower-builtins.js";
+import { lowerAbsenceProbe, lowerPromiseAllTupleCall, lowerPromiseRejectCall, stringWrapperToString, symbolFieldInfo, templateRawTextOf } from "./lower-exprs.js";
 import { isSafeToDiscard } from "./expressions/evaluation-safety.js";
 import { tryLowerExpression } from "./expressions/try-lower-expression.js";
+import { hasRuntimeStatics } from "./class-runtime-statics.js";
 import { httpClientFnBindingOf, isStreamUndefCallExpr, lowerCompatReqStreamOptionalCall, lowerHttpClientFnCall } from "./lower-server.js";
-import { EMITTER_API_MEMBERS, exactInstanceClassOf, findGenericMethodOn, lowerClassGenericMethodCall, lowerStaticMethodCall, returnsOnlyThis } from "./lower-classes.js";
+import { EMITTER_API_MEMBERS, exactClassOfReceiver, exactInstanceClassOf, findGenericMethodOn, lowerClassGenericMethodCall, lowerStaticMethodCall, lowerStaticFieldRead, returnsOnlyThis, storedClassValueType } from "./lower-classes.js";
 import { classCallbackCall, isClassCallback } from "./class-callbacks.js";
 import { emitterRooted, lowerEmitterMethodCall } from "./lower-event-emitter.js";
 import { lowerConsoleInspectArg, lowerFormatCall } from "./lower-inspect.js";
@@ -43,6 +44,10 @@ import { defaultAfterUndefined, lowerOptionalArgument, lowerStaticallyUndefinedA
 import { fenceSymbolFieldCopy } from "./symbol-fields.js";
 import { lowerClassDataDescriptor, lowerClassDescriptorRead } from "./class-descriptors.js";
 import { classStaticDataFor } from "./class-static-data.js";
+import { jsBindingHasOpenWrites } from "./lower-stmts.js";
+import { functionCanReturnUndefined } from "../function-completion.js";
+import { checkedIterableSpread } from "./checked-iterable-spread.js";
+import { lowerUrlFactory } from "./lower-url.js";
 export { bodyReadsArguments };
 /** The one func-type projection of completed parameter shapes. Typed rest
  * parameters keep their packed array as the trailing native ABI slot and
@@ -123,7 +128,38 @@ export const MAX_GENERIC_INSTANCES = 100;
    * - `...xs: T[]`: the ABI type is the array; call sites pack the surplus.
    */
 export function paramShape(lowerer, param) {
+    if (isJsSourceFile(param.getSourceFile()) && ts.isSetAccessorDeclaration(param.parent))
+        return { type: DYN, mode: "required" };
+    if (isJsSourceFile(param.getSourceFile()) && ts.isConstructorDeclaration(param.parent) && !param.dotDotDotToken) {
+        // Reflective JavaScript construction can supply values outside the
+        // constructor's documented usual types. Retain the actual arguments
+        // and apply checked conversions only at operations that need them.
+        return param.initializer ? { type: DYN, mode: "omittable", bodyType: DYN }
+            : { type: DYN, mode: param.questionToken ? "omittable" : "required" };
+    }
+    const executor = param.parent;
+    const construction = executor?.parent;
+    const nativeExecutor = executor && (ts.isArrowFunction(executor) || ts.isFunctionExpression(executor)) && ts.isNewExpression(construction) &&
+        construction.arguments?.[0] === executor && lowerer.isStdlibGlobal(construction.expression, "Promise");
+    if (!nativeExecutor && isJsSourceFile(param.getSourceFile()) && !param.type && !param.dotDotDotToken && !ts.isSetAccessorDeclaration(param.parent) &&
+        !/@(?:param|type)\b/.test(param.getSourceFile().text.slice(param.parent?.pos ?? param.pos, param.getStart()))) {
+        return param.initializer ? { type: DYN, mode: "omittable", bodyType: DYN } : { type: DYN, mode: "required" };
+    }
+    if (param.initializer && isJsSourceFile(param.getSourceFile()) && !param.type &&
+        !/@(?:param|type)\b/.test(param.getSourceFile().text.slice(param.parent?.pos ?? param.pos, param.getStart()))) {
+        return { type: DYN, mode: "omittable", bodyType: DYN };
+    }
+    // Inferred JS array patterns describe the bindings, not an exact tuple
+    // contract. Consume the actual iterable, including surplus elements.
+    if (ts.isArrayBindingPattern(param.name) && isJsSourceFile(param.getSourceFile()) && !param.type &&
+        !/@(?:param|type)\b/.test(param.getSourceFile().text.slice(param.parent?.pos ?? param.pos, param.getStart()))) {
+        if (param.dotDotDotToken)
+            return { type: DYN, mode: "dynRest" };
+        return param.initializer ? { type: DYN, mode: "omittable", bodyType: DYN } : { type: DYN, mode: "required" };
+    }
     if (lowerer.checkedCallbackParams.has(param)) {
+        if (param.dotDotDotToken)
+            return { type: DYN, mode: "dynRest" };
         return param.initializer
             ? { type: DYN, mode: "omittable", bodyType: DYN }
             : { type: DYN, mode: "required" };
@@ -203,11 +239,41 @@ export function paramShape(lowerer, param) {
     }
     if (param.initializer) {
         const raw = lowerer.irTypeOf(param.name);
+        // An optional JS array parameter is a live caller-owned buffer,
+        // including typed arrays passed through checked callbacks. Extracting
+        // a native array here would copy it and discard element writes.
+        if (isJsSourceFile(param.getSourceFile()) && !param.type &&
+            (raw.kind === "array" || raw.kind === "union" && lowerer.unions.get(raw.unionId)?.arms.some((arm) => arm.kind === "array"))) {
+            return { type: DYN, mode: "omittable", bodyType: DYN };
+        }
         return defaultParameterShape(lowerer, param, raw);
     }
-    const type = lowerer.runtimeOptionalBindingType(param.name, lowerer.irTypeOf(param.name));
+    let type = lowerer.runtimeOptionalBindingType(param.name, lowerer.irTypeOf(param.name));
+    const body = param.parent?.body;
+    if (isJsSourceFile(param.getSourceFile()) && body &&
+        type.kind !== "dyn" && type.kind !== "jsval") {
+        const symbol = lowerer.checker.getSymbolAtLocation(param.name);
+        let acceptsUndefined = false;
+        ts.walkPreorder(body, (node) => {
+            if (acceptsUndefined || !ts.isBinaryExpression(node))
+                return;
+            const op = node.operatorToken.kind;
+            if (op !== ts.SyntaxKind.EqualsEqualsEqualsToken && op !== ts.SyntaxKind.ExclamationEqualsEqualsToken &&
+                op !== ts.SyntaxKind.EqualsEqualsToken && op !== ts.SyntaxKind.ExclamationEqualsToken)
+                return;
+            const checks = (value, absent) => ts.isIdentifier(value) && ts.isIdentifier(absent) && absent.text === "undefined" &&
+                (lowerer.typeOf(absent).flags & ts.TypeFlags.Undefined) !== 0 &&
+                lowerer.checker.getSymbolAtLocation(value) === symbol;
+            acceptsUndefined = checks(node.left, node.right) || checks(node.right, node.left);
+        });
+        // A JavaScript body that handles an absent argument defines a wider
+        // contract than its JSDoc's usual value. Checked callers must deliver
+        // undefined to that branch rather than reject it at the ABI boundary.
+        if (acceptsUndefined)
+            type = lowerer.promoteRuntimeOptionalParameter(param.name, type);
+    }
     if (type.kind === "void") {
-        lowerer.unsupported("SC1090", param, "function parameters with void type");
+        return { type: DYN, mode: param.questionToken ? "omittable" : "required" };
     }
     if (param.questionToken && !lowerer.bareUndefinedArmedUnion(type) && type.kind !== "dyn" && type.kind !== "jsval") {
         // `x?: unknown` where unknown came from an annotation: undefined is
@@ -352,7 +418,7 @@ leading) {
                 // before conversion to the dense checked-dynamic argument pack.
                 value = { kind: "arrayLit", elems: [value], spreads: [0], type: value.type, loc: value.loc };
             }
-            value = lowerer.coerceInto(arg.expression, value, DYN);
+            value = checkedIterableSpread(lowerer, value, arg.expression.getText(), loc);
             if (spreads === 1 && index === argNodes.length - 1) {
                 stmts.push({ kind: "exprStmt", expr: {
                         kind: "libCall", fn: "dyn.packPushSpread", args: [ref(), value, { kind: "strLit", value: arg.expression.getText(), type: STRING, loc }], type: VOID, loc,
@@ -624,8 +690,7 @@ leading) {
                 lowerer.unsupported("SC1090", a, "spread arguments into fixed parameter positions (a spread can only fill a rest parameter)");
             }
             const v = lowerer.lowerExpr(a);
-            if (v.kind !== "unitLit" && v.kind !== "numLit" && v.kind !== "strLit" &&
-                v.kind !== "boolLit" && v.kind !== "varRef" && v.kind !== "closure") {
+            if (!isSafeToDiscard(v)) {
                 lowerer.unsupported("SC1090", a, "surplus arguments with side effects (JS evaluates surplus arguments to a function without a rest parameter, then drops them; only effect-free surplus arguments compile)");
             }
         }
@@ -856,7 +921,7 @@ export function appendImplicitUndefinedReturn(lowerer, body, bodyReturn, loc) {
 /** A declaration's checker-derived IR return type. The unmappable-type
    * diagnostic points at `blame` (the name for top-level declarations, the
    * whole node for lambda-likes — preserving each caller's historical loc). */
-function hasExplicitJsDocReturn(decl) {
+export function hasExplicitJsDocReturn(decl) {
     const sourceFile = decl.getSourceFile();
     return /@returns?\b/.test(sourceFile.text.slice(decl.pos, decl.getStart(sourceFile)));
 }
@@ -866,7 +931,19 @@ function promiseCarriesDyn(lowerer, type) {
     return type.kind === "union" &&
         (lowerer.unions.get(type.unionId)?.arms.some((arm) => promiseCarriesDyn(lowerer, arm)) ?? false);
 }
+function producesConstructor(lowerer, type) {
+    let result = type;
+    for (let depth = 0; result && depth < 8; depth++) {
+        if (lowerer.checker.getConstructSignatures(result).length > 0)
+            return true;
+        const signatures = lowerer.checker.getCallSignatures(result);
+        result = signatures.length === 1 ? lowerer.checker.getReturnTypeOfSignature(signatures[0]) : undefined;
+    }
+    return false;
+}
 export function declaredReturnType(lowerer, decl, blame) {
+    if (isJsSourceFile(decl.getSourceFile()) && ts.isGetAccessorDeclaration(decl))
+        return DYN;
     const sig = lowerer.checker.getSignatureFromDeclaration(decl);
     if (!sig)
         lowerer.unsupported("SC1090", decl, "this function form");
@@ -881,9 +958,36 @@ export function declaredReturnType(lowerer, decl, blame) {
     // (`.action(() => { throw ... })`). `never` VALUES stay unmapped.
     if (retTsType.flags & ts.TypeFlags.Never)
         return VOID;
-    const mappedReturn = lowerer.mapTypeOf(retTsType);
+    let mappedReturn = lowerer.mapTypeOf(retTsType);
+    if (isJsSourceFile(decl.getSourceFile()) && decl.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.AsyncKeyword) &&
+        !decl.asteriskToken && mappedReturn?.kind !== "promise") {
+        const fallback = dynFallbackType(lowerer, decl, retTsType);
+        return fallback?.kind === "promise" ? fallback : { kind: "promise", inner: DYN };
+    }
+    if (mappedReturn && isJsSourceFile(decl.getSourceFile()) && functionCanReturnUndefined(decl))
+        mappedReturn = lowerer.withUndefinedArmOf(mappedReturn) ?? mappedReturn;
+    if (isJsSourceFile(decl.getSourceFile()) && mappedReturn?.kind === "void") {
+        let returnsValue = false;
+        const scan = (node) => {
+            if (node !== decl && ts.isFunctionLike(node))
+                return;
+            if (ts.isReturnStatement(node) && node.expression)
+                returnsValue = true;
+            node.forEachChild(scan);
+        };
+        scan(decl);
+        if (returnsValue)
+            return DYN;
+    }
+    if (isJsSourceFile(decl.getSourceFile()) && mappedReturn?.kind === "array")
+        return DYN;
+    if (isJsSourceFile(decl.getSourceFile()) && !decl.type && !hasExplicitJsDocReturn(decl) && mappedReturn?.kind === "record")
+        return DYN;
     if (isJsSourceFile(decl.getSourceFile()) && !decl.type && !hasExplicitJsDocReturn(decl) && mappedReturn?.kind === "date")
         return DYN;
+    if (isJsSourceFile(decl.getSourceFile()) && !decl.type && !hasExplicitJsDocReturn(decl) &&
+        mappedReturn?.kind === "union" && lowerer.unions.get(mappedReturn.unionId)?.arms.some((arm) => arm.kind === "func"))
+        return DYN;
     // JS inference assigns Number to arithmetic over any, although the
     // runtime operands can both be BigInts. Preserve that native result.
     if (isJsSourceFile(decl.getSourceFile()) && !decl.type && !hasExplicitJsDocReturn(decl) &&
@@ -944,10 +1048,13 @@ export function declaredReturnType(lowerer, decl, blame) {
     // Native-only members (such as Int32Array layout offsets) cannot cross
     // that boundary; their factories keep the native record ABI.
     const asyncReturn = decl.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.AsyncKeyword) && mappedReturn?.kind === "promise";
-    const recordReturn = asyncReturn ? mappedReturn.inner : mappedReturn;
+    const recordReturn = asyncReturn && mappedReturn?.kind === "promise" ? mappedReturn.inner : mappedReturn;
+    const recordArms = recordReturn?.kind === "union" ? lowerer.unions.get(recordReturn.unionId)?.arms : recordReturn ? [recordReturn] : undefined;
+    const inferredRecordReturn = recordArms?.some((arm) => arm.kind === "record" || arm.kind === "object") &&
+        recordArms.every((arm) => isUnitType(arm) || arm.kind === "record" || arm.kind === "object" && !hasExplicitJsDocReturn(decl));
     if (isJsSourceFile(decl.getSourceFile()) &&
         decl.type === undefined &&
-        recordReturn?.kind === "record" &&
+        recordReturn !== null && recordReturn !== undefined && inferredRecordReturn &&
         lowerer.dynConvertible(recordReturn) &&
         decl.parameters.every((p) => {
             const mt = lowerer.mapTypeOf(lowerer.typeOf(p));
@@ -955,7 +1062,7 @@ export function declaredReturnType(lowerer, decl, blame) {
         })) {
         return asyncReturn ? { kind: "promise", inner: DYN } : DYN;
     }
-    const returnType = lowerer.mapTypeOf(retTsType);
+    const returnType = mappedReturn;
     if (!returnType) {
         // JS inference residue (an `any` return, an unmappable union): the
         // checked-dynamic fallback, exactly the declaration story in
@@ -1565,6 +1672,7 @@ export function lowerGenericInstance(lowerer, info, inst) {
             body.push(...lowerer.lowerStmts(bodyBlock.statements));
             if (fnCtx.inferReturn) {
                 bodyReturn = resolveInferredReturn(lowerer, inst, fnCtx.inferReturn, body, decl);
+                inst.returnType = bodyReturn;
             }
             appendImplicitUndefinedReturn(lowerer, body, bodyReturn, locOf(decl));
         }
@@ -1578,6 +1686,7 @@ export function lowerGenericInstance(lowerer, info, inst) {
                 if (value.type.kind === "void") {
                     body.push({ kind: "exprStmt", expr: value, loc: locOf(decl.body) });
                     bodyReturn = resolveInferredReturn(lowerer, inst, fnCtx.inferReturn, body, decl);
+                    inst.returnType = bodyReturn;
                     appendImplicitUndefinedReturn(lowerer, body, bodyReturn, locOf(decl));
                 }
                 else {
@@ -1585,6 +1694,7 @@ export function lowerGenericInstance(lowerer, info, inst) {
                     fnCtx.inferReturn.entries.push({ stmt, node: decl.body });
                     body.push(stmt);
                     bodyReturn = resolveInferredReturn(lowerer, inst, fnCtx.inferReturn, body, decl);
+                    inst.returnType = bodyReturn;
                 }
             }
             else {
@@ -1639,7 +1749,9 @@ export function lowerGenericInstance(lowerer, info, inst) {
    * adds JS's undefined; DYN when returns disagree (the checked-dynamic
    * result slot — today's shape). Same-key recursion PINNED the fallback
    * type mid-lowering (callers already hold it), so a pinned instance
-   * keeps it and the wrap pass coerces every return to the pin. */
+   * keeps it and the wrap pass coerces every return to the pin. Callers
+   * store the settled type on their full instance; this narrower view
+   * can be a structural copy in native builds. */
 function resolveInferredReturn(lowerer, inst, infer, body, decl) {
     // The conservative completion test appendImplicitUndefinedReturn uses:
     // a body whose last statement isn't a terminator may complete without
@@ -1670,14 +1782,13 @@ function resolveInferredReturn(lowerer, inst, infer, body, decl) {
         else {
             final = DYN; // disagreeing returns: the checked-dynamic join
         }
-        inst.returnType = final;
     }
     // The wrap pass: settle every recorded return onto `final`, in place.
+    // Write through the stored union arm: optional-field widening on a
+    // local alias can otherwise introduce a record copy in native builds.
     for (const e of infer.entries) {
         if (e.stmt.kind !== "return")
             continue;
-        // Write through the recorded statement. A narrowed local can acquire a
-        // different record layout and copy it in the native compiler.
         const diagsBefore = lowerer.diags.length;
         try {
             if (e.stmt.value === null || e.stmt.value === undefined) {
@@ -2063,6 +2174,12 @@ function implicitDeclaredReturn(lowerer, info) {
         if (retTs.flags & (ts.TypeFlags.Null | ts.TypeFlags.Undefined))
             return DYN;
         if (lowerer.checker.isArrayType(retTs)) {
+            // Inferred JavaScript arrays can hold values selected through a
+            // mutable constructor registry. The checker may retain only one
+            // constructor's element type; settle the result from the lowered
+            // container instead of checking every element against that guess.
+            if (!hasExplicitJsDocReturn(info.decl))
+                return null;
             if (info.decl.parameters.some((param, index) => info.implicitParams?.[index] &&
                 lowerer.mapTypeOf(lowerer.typeOf(param.name))?.kind === "array"))
                 return null;
@@ -2076,6 +2193,39 @@ function implicitDeclaredReturn(lowerer, info) {
                 return null;
         }
         const mapped = lowerer.mapTypeOf(retTs);
+        // Mixed inferred results can select a closure or a class instance.
+        // Their callable ABI is settled by the lowered body, including native
+        // classes whose reflected calls return checked values.
+        if (mapped?.kind === "union" && !hasExplicitJsDocReturn(info.decl) &&
+            lowerer.unions.get(mapped.unionId)?.arms.some((arm) => arm.kind === "func"))
+            return null;
+        if (mapped?.kind === "symbol" && !hasExplicitJsDocReturn(info.decl))
+            return null;
+        if (mapped?.kind === "date" && !hasExplicitJsDocReturn(info.decl))
+            return DYN;
+        if (!hasExplicitJsDocReturn(info.decl) && info.decl.body) {
+            let openReturn = false;
+            ts.walkPreorder(info.decl.body, (node) => {
+                if (node !== info.decl.body && ts.isFunctionLike(node))
+                    return "skip";
+                if (!ts.isReturnStatement(node) || !node.expression || !ts.isIdentifier(node.expression))
+                    return undefined;
+                const symbol = lowerer.resolveValueSymbol(node.expression);
+                if (symbol && lowerer.checker.declarationsOf(symbol).some((decl) => ts.isVariableDeclaration(decl) && jsBindingHasOpenWrites(lowerer, decl)))
+                    openReturn = true;
+                return undefined;
+            });
+            if (openReturn)
+                return null;
+        }
+        // A JavaScript result inferred from an initial record can later
+        // carry additional fields. Settle its representation from the
+        // lowered returns instead of copying it back into that initial shape.
+        const resultArms = mapped?.kind === "union" ? lowerer.unions.get(mapped.unionId)?.arms : mapped ? [mapped] : [];
+        if (resultArms?.some((arm) => arm.kind === "record" || arm.kind === "object" || arm.kind === "classval") &&
+            resultArms.every((arm) => isUnitType(arm) || arm.kind === "record" || arm.kind === "object" || arm.kind === "classval") &&
+            !hasExplicitJsDocReturn(info.decl))
+            return null;
         // Inferred variadic results carry runtime argument packs. Their
         // factory must retain the lowered callable rather than extracting a
         // fixed native signature from a checked value.
@@ -2117,15 +2267,52 @@ function bindableImplicitIr(t) {
 function storedImplicitArgumentType(lowerer, arg) {
     while (ts.isParenthesizedExpression(arg))
         arg = arg.expression;
+    if (isJsSourceFile(arg.getSourceFile()) && (ts.isArrowFunction(arg) || ts.isFunctionExpression(arg))) {
+        const saved = lowerer.diagSink;
+        const diagnostics = [];
+        lowerer.diagSink = diagnostics;
+        let value;
+        try {
+            value = tryLowerExpression(lowerer, arg);
+        }
+        finally {
+            lowerer.diagSink = saved;
+        }
+        // Direct inferred helpers can receive native callbacks even when their
+        // result is an opaque handle that cannot cross checked storage.
+        if (diagnostics.length === 0 && value?.type.kind === "func")
+            return value.type;
+    }
+    if (arg.kind === ts.SyntaxKind.ThisKeyword)
+        return lowerer.resolveThis()?.type ?? null;
     if (ts.isAwaitExpression(arg)) {
         const awaited = storedImplicitArgumentType(lowerer, arg.expression);
         return awaited?.kind === "promise" ? awaited.inner : awaited;
     }
-    if (ts.isObjectLiteralExpression(arg) && isJsSourceFile(arg.getSourceFile()) && arg.properties.some((property) => !ts.isSpreadAssignment(property) && property.name !== undefined && ts.isComputedPropertyName(property.name) &&
-        lowerer.foldedStringKeyOf(property.name.expression) === null))
+    if (ts.isObjectLiteralExpression(arg) && isJsSourceFile(arg.getSourceFile()) &&
+        (arg.properties.length === 0 || arg.properties.some((property) => ts.isMethodDeclaration(property) || ts.isAccessor(property) ||
+            !ts.isSpreadAssignment(property) && property.name !== undefined && ts.isComputedPropertyName(property.name))))
         return DYN;
     if (ts.isIdentifier(arg))
         return lowerer.peekLocal(arg)?.type ?? lowerer.globalOf(arg)?.type ?? null;
+    if (isJsSourceFile(arg.getSourceFile()) &&
+        (ts.isPropertyAccessExpression(arg) || ts.isElementAccessExpression(arg))) {
+        // Mutable JS members can retain an initializer-only checker type (for
+        // example a linked-list slot initially null). Specialize to the value
+        // we actually represent, rather than checking it back into that type.
+        const represented = tryLowerExpression(lowerer, arg);
+        if (represented)
+            return represented.type;
+    }
+    if (isJsSourceFile(arg.getSourceFile()) && (ts.isCallExpression(arg) || ts.isConditionalExpression(arg) ||
+        ts.isBinaryExpression(arg) && (arg.operatorToken.kind === ts.SyntaxKind.BarBarToken ||
+            arg.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken || arg.operatorToken.kind === ts.SyntaxKind.QuestionQuestionToken))) {
+        // Calls and fallback expressions can retain checked storage wider than
+        // the checker's inference (for example Object.assign on a JS instance).
+        const represented = tryLowerExpression(lowerer, arg);
+        if (represented?.type.kind === "dyn" || represented?.type.kind === "func")
+            return represented.type;
+    }
     if (ts.isCallExpression(arg) && ts.isIdentifier(arg.expression)) {
         const callee = storedImplicitArgumentType(lowerer, arg.expression);
         if (callee?.kind === "dyn")
@@ -2173,12 +2360,29 @@ export function implicitCallInstance(lowerer, call, info) {
                 shapes.push({ type: stored, mode: "required" });
                 return;
             }
+            if (stored?.kind === "func") {
+                // The lowered closure may have an inferred JS destructuring
+                // parameter widened from the checker's exact tuple to dyn.
+                // Preserve that signature throughout the specialization.
+                const checkerType = lowerer.mapTypeOf(lowerer.typeOf(arg));
+                argTypes.set(sym, checkerType && typeEquals(checkerType, stored)
+                    ? lowerer.typeOf(arg) : lowerer.checker.getUnknownType());
+                shapes.push({ type: stored, mode: "required" });
+                return;
+            }
             // The argument's own checker type, literal-widened ('add' binds
             // string) — typeOf consults the ACTIVE instance's bindings, so a
             // bound param forwarded into another implicit call transitively
             // instantiates it (this._initCommandGroup(command)).
             const t = lowerer.checker.getBaseTypeOfLiteralType(lowerer.typeOf(arg));
-            const mapped = lowerer.mapTypeOf(t) ?? dynFallbackType(lowerer, arg, t);
+            const mapped = (neverTaintedJsType(lowerer, arg, t) ? null : lowerer.mapTypeOf(t)) ?? dynFallbackType(lowerer, arg, t);
+            if (isJsSourceFile(arg.getSourceFile()) && ts.isArrayLiteralExpression(arg) && mapped?.kind === "array" &&
+                (mapped.elem.kind === "classval" || mapped.elem.kind === "union" &&
+                    lowerer.unions.get(mapped.elem.unionId)?.arms.every((arm) => arm.kind === "classval"))) {
+                argTypes.set(sym, lowerer.checker.getUnknownType());
+                shapes.push({ type: DYN, mode: "required" });
+                return;
+            }
             // JavaScript arguments-based callables travel as checked functions.
             // Specializing a parameter to the inferred rest signature would
             // require extracting a native variadic ABI that the value does not
@@ -2192,6 +2396,11 @@ export function implicitCallInstance(lowerer, call, info) {
             // That checker supertype is not an empty-record runtime layout:
             // preserve represented arms through the checked boundary instead
             // of specializing a call to a union that would discard them.
+            if (isJsSourceFile(arg.getSourceFile()) && mapped?.kind === "func" && !lowerer.dynConvertible(mapped)) {
+                argTypes.set(sym, lowerer.checker.getUnknownType());
+                shapes.push({ type: DYN, mode: "required" });
+                return;
+            }
             const mappedArms = mapped?.kind === "union" ? lowerer.unions.get(mapped.unionId)?.arms ?? [] : mapped ? [mapped] : [];
             const hasTopObject = mappedArms.some((arm) => {
                 const shape = arm.kind === "record" ? lowerer.shapes.get(arm.shapeId) : undefined;
@@ -2737,7 +2946,15 @@ export function lowerTimersMemberCall(lowerer, expr, member, loc) {
         if (expr.arguments.length !== 1) {
             lowerer.noLowering(`clearTimeout with ${expr.arguments.length} arguments`, expr);
         }
-        const handle = lowerer.lowerExpr(expr.arguments[0]);
+        let handle = lowerer.lowerExpr(expr.arguments[0]);
+        if (handle.type.kind === "dyn" && isJsSourceFile(expr.getSourceFile())) {
+            const stored = lowerer.declareHiddenLocal("%timer.clear", DYN);
+            const ref = varRef(stored.id, DYN, loc);
+            handle = { kind: "seqExpr", stmts: [{ kind: "varDecl", localId: stored.id, init: handle, loc }], result: {
+                    kind: "ternary", cond: { kind: "dynTest", test: "number", value: ref, type: BOOL, loc },
+                    then: lowerer.coerceInto(expr.arguments[0], ref, F64), else_: numLit(0, loc), type: F64, loc,
+                }, type: F64, loc };
+        }
         if (handle.type.kind !== "f64") {
             lowerer.noLowering(`clearTimeout of '${lowerer.fmt(handle.type)}' handles`, expr.arguments[0], "the handle is the Timeout setTimeout returned (narrow 'Timeout | null' first)");
         }
@@ -3264,6 +3481,14 @@ function lowerProjectedBuiltinCall(lowerer, expr, bi, loc) {
 }
 export function lowerCall(lowerer, expr) {
     const loc = locOf(expr);
+    // Object's checker return type is `any`. Claim known object inputs
+    // before generic checked-dynamic dispatch tries to load the constructor.
+    if (ts.isIdentifier(expr.expression) && expr.expression.text === "Object" &&
+        lowerer.isStdlibGlobal(expr.expression, "Object")) {
+        const object = lowerObjectConstructor(lowerer, expr.arguments, loc);
+        if (object)
+            return object;
+    }
     // A call whose chain ROOTS at an ambient-undefined name (`declare
     // const value: Y | undefined; value?.foo("a")`, `declare function
     // chain...; chain(o).mapValues(f).value()`, a trap binding's read):
@@ -3373,7 +3598,7 @@ export function lowerCall(lowerer, expr) {
     // `a?.m()` (the token on the member access). The handled markers keep
     // the chain lowering's re-entrant dispatch from looping.
     if ((expr.questionDotToken && !lowerer.chainHandled.has(expr)) ||
-        (ts.isPropertyAccessExpression(expr.expression) &&
+        ((ts.isPropertyAccessExpression(expr.expression) || ts.isElementAccessExpression(expr.expression)) &&
             expr.expression.questionDotToken &&
             !lowerer.chainHandled.has(expr.expression))) {
         return lowerer.lowerOptionalChain(expr);
@@ -3382,6 +3607,9 @@ export function lowerCall(lowerer, expr) {
     // top-level statement (its field-initializer ordering lives there);
     // any other position would misorder initialization — rejected.
     if (expr.expression.kind === ts.SyntaxKind.SuperKeyword) {
+        const superCall = lowerer.ctx.superCall;
+        if (superCall)
+            return superCall(expr);
         lowerer.unsupported("SC1090", expr, "super() calls anywhere but as a top-level constructor statement");
     }
     // super.method(...): a DIRECT (never virtual) call of the base chain's
@@ -3500,6 +3728,13 @@ export function lowerCall(lowerer, expr) {
             loc,
         });
     }
+    if (ts.isPropertyAccessExpression(expr.expression) &&
+        TIMER_MODULE_MEMBERS.has(expr.expression.name.text) &&
+        lowerer.stdlibGlobalMember(expr.expression, "globalThis") === expr.expression.name.text) {
+        const served = lowerTimersMemberCall(lowerer, expr, expr.expression.name.text, loc);
+        if (served)
+            return served;
+    }
     // The timer globals — setTimeout/clearTimeout, setInterval/
     // clearInterval, setImmediate/clearImmediate. Provenance-checked (a
     // user function shadowing the name has a different, non-ambient
@@ -3642,9 +3877,7 @@ export function lowerCall(lowerer, expr) {
     // Provenance-checked like setTimeout; zero-arg forms are the JS
     // constants ("", false, 0). Wrapper objects stay fenced except where
     // the receiver is immediately converted by a direct String method call.
-    if (ts.isIdentifier(expr.expression) &&
-        expr.expression.text === "BigInt" &&
-        lowerer.isStdlibSymbol(lowerer.resolveValueSymbol(expr.expression) ?? undefined)) {
+    if (lowerer.isStdlibGlobal(expr.expression, "BigInt")) {
         if (expr.arguments.length !== 1) {
             lowerer.noLowering(`BigInt with ${expr.arguments.length} arguments`, expr);
         }
@@ -3657,12 +3890,11 @@ export function lowerCall(lowerer, expr) {
             return converted;
         lowerer.noLowering(`BigInt of ${lowerer.fmt(arg.type)} values`, argNode, "string, number, boolean, and bigint arguments are supported");
     }
-    if (ts.isIdentifier(expr.expression) &&
-        (expr.expression.text === "String" ||
-            expr.expression.text === "Boolean" ||
-            expr.expression.text === "Number") &&
-        lowerer.isStdlibSymbol(lowerer.resolveValueSymbol(expr.expression) ?? undefined)) {
-        const name = expr.expression.text;
+    if (lowerer.isStdlibGlobal(expr.expression, "String") ||
+        lowerer.isStdlibGlobal(expr.expression, "Boolean") ||
+        lowerer.isStdlibGlobal(expr.expression, "Number")) {
+        const name = lowerer.isStdlibGlobal(expr.expression, "String") ? "String" :
+            lowerer.isStdlibGlobal(expr.expression, "Boolean") ? "Boolean" : "Number";
         if (expr.arguments.length > 1) {
             lowerer.noLowering(`${name} with ${expr.arguments.length} arguments`, expr);
         }
@@ -3692,8 +3924,9 @@ export function lowerCall(lowerer, expr) {
         if (name === "Number")
             return lowerNumberConstructorValue(lowerer, argNode, loc);
         const arg = lowerer.lowerExpr(argNode);
-        if (name === "String" && arg.type.kind === "dyn") {
-            return { kind: "libCall", fn: "dyn.stringConstructor", args: [arg], type: STRING, loc };
+        if (name === "String" && (arg.type.kind === "dyn" || arg.type.kind === "union" &&
+            lowerer.unions.get(arg.type.unionId)?.arms.some((arm) => arm.kind === "symbol") && lowerer.dynConvertible(arg.type))) {
+            return { kind: "libCall", fn: "dyn.stringConstructor", args: [lowerer.coerceToExpected(arg, DYN)], type: STRING, loc };
         }
         if (name === "String")
             return lowerer.ensureString(arg, argNode);
@@ -3720,7 +3953,9 @@ export function lowerCall(lowerer, expr) {
         lowerer.fenceStaticHeadersMember(access, "call");
         lowerer.fenceStaticReadableStreamMember(access, "call");
         const source = tryLowerExpression(lowerer, access.expression);
-        if (source && (source.type.kind === "dyn" || isDynTypedRefType(source.type) &&
+        if (source && (source.type.kind === "dyn" || source.type.kind === "func" ||
+            source.type.kind === "union" && isJsSourceFile(expr.getSourceFile()) && lowerer.dynConvertible(source.type) ||
+            (source.type.kind === "map" || source.type.kind === "set") && lowerer.dynConvertible(source.type) || isDynTypedRefType(source.type) &&
             lowerer.foldedStringKeyOf(access.argumentExpression) === null &&
             lowerer.mapTypeOf(lowerer.typeOf(access.argumentExpression))?.kind !== "symbol")) {
             const local = lowerer.declareHiddenLocal("%computedReceiver", DYN);
@@ -4106,6 +4341,9 @@ export function lowerCall(lowerer, expr) {
             if (name === "parseFloat" && probed?.type.kind === "string") {
                 return { kind: "libCall", fn: "num.parseFloat", args: [probed], type: F64, loc };
             }
+            if (name === "parseFloat" && probed?.type.kind === "dyn") {
+                return { kind: "libCall", fn: "num.parseFloat", args: [{ kind: "libCall", fn: "dyn.toStringCoerce", args: [probed], type: STRING, loc }], type: F64, loc };
+            }
             if (name === "isFinite" && probed?.type.kind === "f64") {
                 return { kind: "libCall", fn: "number.isFinite", args: [probed], type: BOOL, loc };
             }
@@ -4123,6 +4361,7 @@ export function lowerCall(lowerer, expr) {
         // string-only argument rule.
         if ((expr.expression.text === "encodeURIComponent" ||
             expr.expression.text === "encodeURI" ||
+            expr.expression.text === "decodeURI" ||
             expr.expression.text === "decodeURIComponent") &&
             lowerer.isStdlibSymbol(lowerer.resolveValueSymbol(expr.expression) ?? undefined)) {
             const name = expr.expression.text;
@@ -4131,10 +4370,10 @@ export function lowerCall(lowerer, expr) {
             }
             const loc = locOf(expr);
             const argNode = expr.arguments[0];
-            if (name === "decodeURIComponent") {
+            if (name === "decodeURIComponent" || name === "decodeURI") {
                 const d = optionalCallValue(lowerer, argNode) ?? lowerer.lowerExpr(argNode);
                 const s = lowerer.ensureString(d, argNode);
-                return { kind: "libCall", fn: "str.decodeUriComponent", args: [s], type: STRING, loc };
+                return { kind: "libCall", fn: name === "decodeURI" ? "str.decodeUri" : "str.decodeUriComponent", args: [s], type: STRING, loc };
             }
             const value = optionalCallValue(lowerer, argNode) ?? lowerer.lowerExpr(argNode);
             const s = lowerer.ensureString(value, argNode);
@@ -4415,7 +4654,8 @@ export function lowerCall(lowerer, expr) {
             lowerer.lowerJsonMethodCall(expr, expr.expression) ??
             // Reflect.apply of a builtin rest-parameter fn (fixtures.js's
             // fixturesPath idiom) — before the stdlib member fence claims it.
-            lowerReflectApplyCall(lowerer, expr, expr.expression) ??
+            lowerReflectCall(lowerer, expr, expr.expression) ??
+            lowerBigIntStaticCall(lowerer, expr, expr.expression) ??
             lowerer.lowerNumberStaticCall(expr, expr.expression) ??
             lowerer.lowerDateCall(expr, expr.expression) ??
             lowerer.lowerTextCodecCall(expr, expr.expression) ??
@@ -4431,6 +4671,7 @@ export function lowerCall(lowerer, expr) {
             // Before the island path: regex-argument replace/replaceAll/split
             // lower STATICALLY; only the string-pattern overloads are island.
             lowerRegexMethodCallWithOptionalArg(lowerer, expr, expr.expression) ??
+            lowerUrlStaticCall(lowerer, expr, expr.expression) ??
             lowerer.lowerUrlMethodCall(expr, expr.expression) ??
             lowerer.lowerSearchParamsMethodCall(expr, expr.expression) ??
             lowerer.lowerStatsMethodCall(expr, expr.expression) ??
@@ -4481,14 +4722,11 @@ export function lowerCall(lowerer, expr) {
             lowerer.lowerBytesMethodCall(expr, expr.expression) ??
             lowerBytesStaticCall(lowerer, expr, expr.expression) ??
             lowerBufferStaticCallWithNarrowedArg(lowerer, expr, expr.expression) ??
-            // URL.revokeObjectURL's zero-argument contract (the one-argument
-            // form keeps the fence — createObjectURL does too).
-            lowerUrlStaticCall(lowerer, expr, expr.expression) ??
             // Readable.from — the stream classes' one static (before the
             // stdlib chokepoint claims the member).
             lowerStreamStaticCall(lowerer, expr, expr.expression) ??
-            // Radix-free n.toString() is the STATIC number formatter (identical
-            // to `${n}` / String(n)); the explicit-radix form stays island.
+            // Primitive toString calls, including numeric radices, use the
+            // native formatters before the island method path.
             lowerNumberToStringCall(lowerer, expr, expr.expression) ??
             // Union receivers whose every arm has a text — the ngrok
             // `(chunk: Buffer | string) => chunk.toString()` idiom.
@@ -4528,7 +4766,6 @@ export function lowerCall(lowerer, expr) {
             // by the receiver's own element.
             lowerer.lowerFilterNarrowCall(expr, expr.expression) ??
             lowerArrayIsArrayCall(lowerer, expr, expr.expression) ??
-            lowerBigIntStaticCall(lowerer, expr, expr.expression) ??
             lowerBigIntMethodCall(lowerer, expr, expr.expression) ??
             lowerSymbolStaticCall(lowerer, expr, expr.expression) ??
             lowerSymbolMethodCall(lowerer, expr, expr.expression) ??
@@ -4563,6 +4800,13 @@ export function lowerCall(lowerer, expr) {
             lowerObjLitGenericMethodCall(lowerer, expr, expr.expression);
         if (intrinsic)
             return intrinsic;
+        if (isJsSourceFile(expr.getSourceFile())) {
+            const staticField = lowerStaticFieldRead(lowerer, expr.expression);
+            if (staticField?.type.kind === "dyn" && !expr.arguments.some(ts.isSpreadElement)) {
+                return { kind: "dynCall", callee: staticField, receiver: lowerer.lowerExprExpecting(expr.expression.expression, DYN), calleeName: expr.expression.getText(),
+                    args: expr.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc: locOf(expr) };
+            }
+        }
         const accessorTarget = lowerer.fieldTarget(expr.expression);
         if (accessorTarget?.container === "accessor") {
             const callee = lowerer.fieldGetExpr(accessorTarget, locOf(expr.expression), expr.expression);
@@ -4635,6 +4879,30 @@ export function lowerCall(lowerer, expr) {
         lowerer.fenceStaticHeadersMember(expr.expression, "call");
         lowerer.fenceStaticReadableStreamMember(expr.expression, "call");
     }
+    // Computed native members retain their original receiver and resolve
+    // the function before argument effects, just like dotted calls.
+    if (ts.isElementAccessExpression(expr.expression) && !expr.expression.questionDotToken && !expr.questionDotToken &&
+        !symbolFieldInfo(lowerer, expr.expression)) {
+        const access = expr.expression;
+        const value = tryLowerExpression(lowerer, access.expression);
+        if (value?.type.kind === "dyn" || value?.type.kind === "generator" ||
+            value && ["array", "bytes", "map", "set"].includes(value.type.kind) && lowerer.dynConvertible(value.type) ||
+            value?.type.kind === "string" && !ts.isStringLiteralLike(access.argumentExpression) && lowerer.dynConvertible(value.type) ||
+            value?.type.kind === "object" && !lowerer.classes.get(value.type.className)?.def.runtime) {
+            const local = lowerer.declareHiddenLocal("%computedReceiver", value.type);
+            const reference = { kind: "varRef", localId: local.id, type: value.type, loc };
+            const receiver = lowerer.coerceToExpected(reference, DYN);
+            const raw = lowerer.lowerExpr(access.argumentExpression);
+            const key = raw.type.kind === "string" ? raw : lowerer.coerceInto(access.argumentExpression, raw, DYN);
+            const callee = { kind: "dynKeyGet", value: receiver, key, type: DYN, loc };
+            const spread = expr.arguments.some(ts.isSpreadElement) ? lowerSpreadArgsCall(lowerer, expr, callee, loc) : null;
+            if (spread && spread.kind !== "dynCall")
+                lowerer.unsupported("SC1090", expr, "computed native method spread arguments");
+            const result = spread !== null ? { ...spread, receiver } : { kind: "dynCall", callee, receiver,
+                calleeName: access.getText(), args: expr.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc };
+            return { kind: "seqExpr", stmts: [{ kind: "varDecl", localId: local.id, init: value, loc }], result, type: DYN, loc };
+        }
+    }
     // The ELEMENT spelling of a primitive method call — `x['toString']()`,
     // `s['charAt'](0)`: JS resolves it exactly like the dot form, so the
     // literal-keyed shapes with a static lowering route there before the
@@ -4720,6 +4988,11 @@ export function lowerCall(lowerer, expr) {
                 : "value";
         return { kind: "dynCall", callee, calleeName, args, type: DYN, loc };
     }
+    if (callee.type.kind === "union" && lowerer.dynConvertible(callee.type) &&
+        lowerer.unions.get(callee.type.unionId)?.arms.some((arm) => arm.kind === "func")) {
+        return { kind: "dynCall", callee: lowerer.coerceToExpected(callee, DYN), calleeName: expr.expression.getText(),
+            args: expr.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc };
+    }
     if (callee.type.kind !== "func") {
         lowerer.badType(expr.expression, lowerer.typeOf(expr.expression));
     }
@@ -4959,6 +5232,10 @@ function lowerNumberConstructorValue(lowerer, argNode, loc) {
         return { kind: "libCall", fn: "num.fromString", args: [arg], type: F64, loc };
     if (arg.type.kind === "dyn")
         return { kind: "libCall", fn: "dyn.numberConstructor", args: [arg], type: F64, loc };
+    if (arg.type.kind === "union" && lowerer.dynConvertible(arg.type))
+        return {
+            kind: "libCall", fn: "dyn.numberConstructor", args: [lowerer.coerceToExpected(arg, DYN)], type: F64, loc,
+        };
     const optionalNumber = lowerOptionalStringNumber(lowerer, arg, loc);
     if (optionalNumber)
         return optionalNumber;
@@ -4973,6 +5250,8 @@ function lowerNumberConstructorValue(lowerer, argNode, loc) {
  * checker guard. Dispatch BigInt by the actual value, including nullish
  * TypeErrors, rather than interpreting that storage as the narrowed arm. */
 function lowerBigIntConstructorValue(lowerer, arg, loc) {
+    if (arg.type.kind === "dyn")
+        return { kind: "libCall", fn: "dyn.bigintConstructor", args: [arg], type: BIGINT_T, loc };
     if (arg.type.kind === "bigint")
         return arg;
     if (arg.type.kind === "string")
@@ -5244,8 +5523,9 @@ function lowerObjectOwnCall(lowerer, call, receiverNode, keyNode, extraNodes, me
             stmts.push({ kind: "exprStmt", expr: effect, loc: locOf(extra) });
     }
     let key = keyRef;
-    if (receiverRef.type.kind === "dyn" && keyRef && (keyRef.type.kind === "symbol" || keyRef.type.kind === "dyn")) {
-        const result = { kind: "libCall", fn: enumerable ? "dyn.propertyIsEnumerableComputed" : "dyn.hasOwnComputed", args: [receiverRef, lowerer.coerceToExpected(keyRef, DYN)], type: BOOL, loc };
+    if (lowerer.dynConvertible(receiverRef.type) && keyRef && (receiverRef.type.kind === "object" || keyRef.type.kind === "symbol" || keyRef.type.kind === "dyn" ||
+        keyRef.type.kind === "union" && lowerer.dynConvertible(keyRef.type))) {
+        const result = { kind: "libCall", fn: enumerable ? "dyn.propertyIsEnumerableComputed" : "dyn.hasOwnComputed", args: [lowerer.coerceToExpected(receiverRef, DYN), lowerer.coerceToExpected(keyRef, DYN)], type: BOOL, loc };
         return { kind: "seqExpr", stmts, result, type: BOOL, loc };
     }
     if (!keyNode || rawKey?.type.kind === "undefinedT" || rawKey?.type.kind === "void") {
@@ -5441,6 +5721,9 @@ function lowerStringPrototypeCall(lowerer, call, access) {
     // padding uses a helper that delays conversion until every argument is ready.
     const objectWithoutMethodArgs = entry?.maxArgs === 0 && call.arguments.length === 1 &&
         (receiverType.kind === "record" || receiverType.kind === "array" || receiverType.kind === "object");
+    if (padding && !scalar && lowerer.dynConvertible(receiverType)) {
+        return lowerStringPaddingCall(lowerer, call, entry.method, lowerer.coerceToExpected(receiverValue, DYN), receiverNode, call.arguments.slice(1));
+    }
     if (!scalar && !objectWithoutMethodArgs) {
         lowerer.noLowering(`String.prototype.${methodAccess.name.text}.call with ${lowerer.fmt(receiverType)} receivers`, call);
     }
@@ -5581,7 +5864,7 @@ function lowerSpreadArgsCall(lowerer, expr, callee, loc) {
                 // The spelling rides along for V8's nullish spread-call
                 // TypeError ("v is not iterable (cannot read property ...)").
                 spreads.push({ arg: args.length, what: p.spreadOf.getText() });
-                args.push(lowerer.coerceInto(p.spreadOf, p.v, DYN));
+                args.push(checkedIterableSpread(lowerer, p.v, p.spreadOf.getText(), loc));
             }
             else {
                 args.push(lowerer.coerceInto(p.node, p.v, DYN));
@@ -5591,7 +5874,7 @@ function lowerSpreadArgsCall(lowerer, expr, callee, loc) {
         return { kind: "dynCall", callee: boxed, calleeName, args, spreads, type: DYN, loc };
     }
     if (spreadParts.length > 0 &&
-        spreadParts.every((p) => p.v.type.kind === "jsval") &&
+        (spreadParts.every((p) => p.v.type.kind === "jsval") || callee.type.kind === "func" && callee.type.restAbi === "jsval") &&
         (callee.type.kind === "jsval" || callee.type.kind === "func")) {
         if (spreadParts.length !== 1 || parts[parts.length - 1].spreadOf === null) {
             lowerer.unsupported("SC1090", expr, "spread arguments before positional arguments in island calls (one trailing spread after the fixed arguments is the supported form)");
@@ -5604,7 +5887,7 @@ function lowerSpreadArgsCall(lowerer, expr, callee, loc) {
         const last = parts[parts.length - 1];
         // The spelling rides in `name` for V8's nullish spread-call
         // TypeError ("v is not iterable (cannot read property ...)").
-        return { kind: "jsOp", op: "callSpread", name: last.spreadOf.getText(), args: [f, preArr, last.v], type: JSVAL, loc };
+        return { kind: "jsOp", op: "callSpread", name: last.spreadOf.getText(), args: [f, preArr, lowerer.coerceInto(last.spreadOf, last.v, JSVAL)], type: JSVAL, loc };
     }
     // No lane fits (a spread source outside both tiers, a callee neither
     // boxable nor marshalable, mixed dyn/jsval spreads): fence HERE — the
@@ -5656,12 +5939,21 @@ function canCompleteRuntimeSpread(lowerer, shapes) {
 function lowerDynReceiverMethodCall(lowerer, call, access) {
     if (lowerer.chainBlocked(call, access))
         return null;
+    if (stdlibGlobalNameOf(lowerer, access.expression) !== null)
+        return null;
     // Only checker-untyped receivers: `any`/`unknown`, or the `any[]` an
     // Array.isArray guard narrows them to (the value is STILL the checked-dynamic tree
     // array — scalar narrowings bridge through maybeNarrow's dynCheck and
     // take the ordinary typed paths, but there is no static home for an
     // any-elemented array). Typed receivers keep their own lowerings.
     const recvTs = lowerer.typeOf(access.expression);
+    const recvSymbol = recvTs.getSymbol();
+    if (recvSymbol && ["MapIterator", "SetIterator"].includes(recvSymbol.name) &&
+        lowerer.isStdlibSymbol(recvSymbol) &&
+        ["map", "filter", "take", "drop", "flatMap", "toArray", "forEach", "reduce", "some", "every", "find"].includes(access.name.text) &&
+        lowerer.isStdlibMember(access)) {
+        lowerer.noLowering(`collection iterator .${access.name.text}()`, call, "stored Map/Set iterators support .next() and iteration; iterator helper methods have no lowering");
+    }
     const arrayReceiver = lowerer.checker.isArrayType(recvTs);
     const anyArray = arrayReceiver &&
         ((lowerer.checker.getTypeArguments(recvTs)[0]?.flags ?? 0) &
@@ -5677,11 +5969,11 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
         // tsc types the return by the evolved shape, the binding lowered
         // dyn): probe the lowering and claim exactly the dyn results.
         const probed = tryLowerExpression(lowerer, access.expression);
-        if (isJsSourceFile(call.getSourceFile()) && probed?.type.kind === "func" &&
+        if (probed?.type.kind === "func" && stdlibGlobalNameOf(lowerer, access.expression) === null &&
             !["call", "apply", "bind", "toString", "valueOf", "constructor"].includes(access.name.text) &&
             canBoxFuncIntoDyn(probed.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
             const loc = locOf(call);
-            const fnName = jsFuncNameOf(access.expression);
+            const fnName = jsFuncNameOf(access.expression, lowerer);
             const boxed = { kind: "dynFrom", value: probed, type: DYN, loc, ...(fnName !== null ? { fnName } : {}) };
             const local = lowerer.declareHiddenLocal("%callableReceiver", DYN);
             const receiver = { kind: "varRef", localId: local.id, type: DYN, loc };
@@ -5698,9 +5990,27 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
                     args: call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc }, type: DYN, loc,
             };
         }
-        if (probed?.type.kind !== "dyn")
-            return null;
-        recv = probed;
+        if (probed?.type.kind === "classval") {
+            const info = lowerer.classes.get(probed.type.className);
+            if (info)
+                return lowerStaticMethodCall(lowerer, call, access);
+        }
+        if (probed?.type.kind === "union" && isJsSourceFile(call.getSourceFile()) &&
+            lowerer.unions.get(probed.type.unionId)?.arms.every((arm) => isUnitType(arm) || arm.kind === "object" || arm.kind === "record" || arm.kind === "func") && lowerer.dynConvertible(probed.type)) {
+            recv = lowerer.coerceToExpected(probed, DYN);
+        }
+        else {
+            if (probed?.type.kind !== "dyn")
+                return null;
+            recv = probed;
+        }
+    }
+    // A factory may return a constructor more precise than its inferred
+    // checker result. Runtime static members live on that constructor.
+    if (recv.type.kind === "classval") {
+        const info = lowerer.classes.get(recv.type.className);
+        if (info)
+            return lowerStaticMethodCall(lowerer, call, access);
     }
     // A checker-`any` receiver that already lowered to a real STRING (the
     // chained form — `cfg.host.trim().toLowerCase()`, where the first step
@@ -5715,6 +6025,25 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
     }
     if (recv.type.kind !== "dyn")
         return null;
+    if (access.name.text === "normalize" && call.arguments.length <= 1 && !call.arguments.some(ts.isSpreadElement)) {
+        const loc = locOf(call);
+        const hasArgument = call.arguments.length === 1;
+        const name = `%dyn.string.normalize:${hasArgument ? 1 : 0}`;
+        if (!lowerer.liftedFns.some((fn) => fn.name === name)) {
+            const value = varRef("receiver", DYN, loc);
+            const argument = varRef("form", DYN, loc);
+            const form = { kind: "ternary", cond: { kind: "dynTest", value: argument, test: "undefined", type: BOOL, loc },
+                then: { kind: "strLit", value: "NFC", type: STRING, loc },
+                else_: { kind: "libCall", fn: "dyn.toStringCoerce", args: [argument], type: STRING, loc }, type: STRING, loc };
+            const result = { kind: "strIntrinsic", method: "normalize", receiver: { kind: "dynCheck", value, type: STRING, loc }, args: [form], type: STRING, loc };
+            lowerer.liftedFns.push({ name, params: [{ localId: "receiver", name: "receiver", type: DYN }, { localId: "form", name: "form", type: DYN }],
+                locals: [{ id: "receiver", name: "receiver", type: DYN, mutable: false }, { id: "form", name: "form", type: DYN, mutable: false }], returnType: DYN, loc,
+                body: [{ kind: "if", cond: { kind: "dynTest", value, test: "string", type: BOOL, loc }, then: [
+                            { kind: "return", value: { kind: "dynFrom", value: result, type: DYN, loc }, loc },
+                        ], else_: null, loc }, { kind: "return", value: { kind: "dynInvoke", recv: value, method: "normalize", calleeName: access.getText(), args: hasArgument ? [argument] : [], type: DYN, loc }, loc }] });
+        }
+        return { kind: "call", callee: name, args: [recv, call.arguments[0] ? lowerer.lowerExprExpecting(call.arguments[0], DYN) : dynUndefinedExpr(loc)], type: DYN, loc };
+    }
     if (lowerer.mapTypeOf(recvTs)?.kind === "classval") {
         return lowerStaticMethodCall(lowerer, call, access);
     }
@@ -5770,7 +6099,16 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
     // unimplemented methods throw a LOUD not-supported Error; names the
     // kind's prototype lacks throw Node's "x.y is not a function"; OBJ
     // receivers call the own member.
-    const dispatched = lowerDynDispatchMethodCall(lowerer, call, access, recv, arrayReceiver);
+    // A stored callback must be read before argument effects, and called
+    // with the original receiver rather than a materialized property view.
+    const callbackProperty = (() => {
+        const prop = lowerer.checker.getPropertyOfType(recvTs, access.name.text);
+        const mapped = lowerer.mapTypeOf(recvTs);
+        if (mapped?.kind === "union" && lowerer.unions.get(mapped.unionId)?.arms.every((arm) => arm.kind === "object" && lowerer.classes.get(arm.className)?.fields.has(access.name.text)))
+            return true;
+        return prop !== undefined && lowerer.checker.declarationsOf(prop).some((decl) => ts.isPropertyDeclaration(decl) || ts.isPropertySignature(decl));
+    })();
+    const dispatched = callbackProperty ? null : lowerDynDispatchMethodCall(lowerer, call, access, recv, arrayReceiver);
     if (dispatched)
         return dispatched;
     // Names NO dyn-representable prototype declares: the member can only
@@ -5796,9 +6134,6 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
     if (call.questionDotToken || access.questionDotToken)
         return null;
     const loc = locOf(call);
-    if (call.arguments.some((a) => ts.isSpreadElement(a))) {
-        lowerer.unsupported("SC1090", call, "spread arguments in calls through 'unknown' values");
-    }
     const receiverLocal = lowerer.declareHiddenLocal("%dynCallReceiver", DYN);
     const receiver = { kind: "varRef", localId: receiverLocal.id, type: DYN, loc };
     const member = {
@@ -5808,10 +6143,24 @@ function lowerDynReceiverMethodCall(lowerer, call, access) {
         type: DYN,
         loc: locOf(access),
     };
+    const calleeLocal = lowerer.declareHiddenLocal("%dynCallCallee", DYN);
+    const callee = varRef(calleeLocal.id, DYN, loc);
+    const stmts = [
+        { kind: "varDecl", localId: receiverLocal.id, init: recv, loc },
+        { kind: "varDecl", localId: calleeLocal.id, init: member, loc },
+    ];
+    if (call.arguments.some(ts.isSpreadElement)) {
+        const spread = lowerSpreadArgsCall(lowerer, call, callee, loc);
+        if (spread?.kind === "dynCall")
+            return { kind: "seqExpr",
+                stmts,
+                result: { ...spread, receiver }, type: DYN, loc };
+        lowerer.unsupported("SC1090", call, "spread arguments in calls through 'unknown' values");
+    }
     const args = call.arguments.map((a) => lowerer.lowerExprExpecting(a, DYN));
     return {
-        kind: "seqExpr", stmts: [{ kind: "varDecl", localId: receiverLocal.id, init: recv, loc }],
-        result: { kind: "dynCall", callee: member, receiver, calleeName: access.getText(), args, type: DYN, loc }, type: DYN, loc,
+        kind: "seqExpr", stmts,
+        result: { kind: "dynCall", callee, receiver, calleeName: access.getText(), args, type: DYN, loc }, type: DYN, loc,
     };
 }
 /** Prototype method names of the checked-dynamic tree-representable kinds (String, Array,
@@ -5839,6 +6188,7 @@ const DYN_PROTO_METHOD_NAMES = new Set([
  * is-not-a-function where the kind's prototype lacks the name, and
  * fences LOUDLY on real-but-unimplemented pairs. */
 const DYN_DISPATCH_METHODS = new Set([
+    "toFixed", "toExponential",
     "segment", "containing", "resolvedOptions", "test", "exec",
     "apply", "bind", "call",
     "push", "pop", "shift", "unshift", "slice", "at",
@@ -5858,7 +6208,7 @@ const DYN_DISPATCH_METHODS = new Set([
     "setEncoding", "setDefaultEncoding", "setTimeout", "read", "isPaused",
     "writeHead", "setHeader", "getHeader", "hasHeader", "removeHeader",
     "getHeaders", "getHeaderNames", "appendHeader", "flushHeaders",
-    "add", "append", "delete", "get", "getSetCookie", "has", "set",
+    "add", "append", "delete", "get", "getSetCookie", "has", "set", "clear", "keys", "values", "entries", "next",
     "writeContinue", "writeEarlyHints", "cork", "uncork", "addTrailers",
     "ref", "unref", "address", "setNoDelay", "setKeepAlive", "connect",
     "resetAndDestroy", "destroySoon",
@@ -5879,7 +6229,7 @@ const DYN_DISPATCH_METHODS = new Set([
     "dispatchEvent",
     "preventDefault", "stopPropagation", "stopImmediatePropagation",
     "composedPath",
-    "json", "text", "bytes",
+    "json", "text", "bytes", "arrayBuffer",
     // Promise.prototype (SCR_DYN_PROMISE receivers): the reaction trio
     // rides the fiber machinery (scr_dyn_promise_then); on every other dyn
     // kind then/catch/finally answer the stored-member path (OBJ own
@@ -5899,6 +6249,17 @@ export function lowerDynDispatchMethodCall(lowerer, call, access, recv, arrayRec
     if ((!DYN_DISPATCH_METHODS.has(method) && !isJsSourceFile(call.getSourceFile())) || lowerer.chainBlocked(call, access))
         return null;
     if (call.arguments.some((arg) => ts.isSpreadElement(arg))) {
+        const loc = locOf(call);
+        const local = lowerer.declareHiddenLocal("%spreadReceiver", DYN);
+        const receiver = varRef(local.id, DYN, loc);
+        const callee = { kind: "dynKeyGet", value: receiver,
+            key: { kind: "strLit", value: method, type: STRING, loc }, type: DYN, loc };
+        const spread = lowerSpreadArgsCall(lowerer, call, callee, loc);
+        if (spread?.kind === "dynCall")
+            return { kind: "seqExpr",
+                stmts: [{ kind: "varDecl", localId: local.id, init: recv, loc },
+                    { kind: "exprStmt", expr: { kind: "libCall", fn: "dyn.arrayPrototype", args: [], type: DYN, loc }, loc }],
+                result: { ...spread, receiver }, type: DYN, loc };
         lowerer.unsupported("SC1090", call, "spread arguments in calls through 'unknown' values");
     }
     const predicate = method === "filter" && call.arguments[0]
@@ -5972,7 +6333,12 @@ export function lowerDynDispatchMethodCall(lowerer, call, access, recv, arrayRec
             }
         }
     }
-    const args = call.arguments.map((arg, i) => i === 0 && predicate ? lowerer.coerceInto(arg, predicate, DYN) : lowerer.lowerExprExpecting(arg, DYN));
+    const args = call.arguments.map((arg, i) => {
+        if (i === 0 && predicate)
+            return lowerer.coerceInto(arg, predicate, DYN);
+        const undefinedArg = lowerStaticallyUndefinedArgument(lowerer, arg);
+        return undefinedArg ? defaultAfterUndefined(undefinedArg, dynUndefinedExpr(locOf(arg))) : lowerer.lowerExprExpecting(arg, DYN);
+    });
     return {
         kind: "dynInvoke",
         recv,
@@ -6098,13 +6464,13 @@ function lowerCaughtPredicateCall(lowerer, call, caughtLocal) {
    * and String(n) lower to (Number::toString with radix 10 IS that
    * conversion, per spec) — booleans the "true"/"false" texts, and strings
    * the identity read (String.prototype.toString returns `this`). The
-   * explicit-radix number form keeps its island lowering (ISLAND_SURFACE);
+   * explicit-radix number form uses the native radix formatter;
    * null for other receivers, argument shapes, or non-lib members (a
    * user's own `.toString` takes the ordinary paths). */
 function lowerNumberToStringCall(lowerer, call, access) {
     if (lowerer.chainBlocked(call, access))
         return null;
-    if (access.name.text !== "toString" || call.arguments.length !== 0)
+    if (access.name.text !== "toString" || call.arguments.length > 1 || call.arguments.some(ts.isSpreadElement))
         return null;
     const recvKind = lowerer.mapTypeOf(lowerer.typeOf(access.expression))?.kind;
     if (recvKind !== "f64" && recvKind !== "bool" && recvKind !== "string")
@@ -6112,6 +6478,22 @@ function lowerNumberToStringCall(lowerer, call, access) {
     if (!lowerer.isStdlibMember(access))
         return null;
     const operand = lowerer.lowerExpr(access.expression);
+    // JavaScript array and typed-array reads can still be undefined even
+    // when the checker declares a number. Preserve that runtime value and
+    // let native method dispatch format numbers or throw for missing data.
+    if (operand.type.kind === "dyn") {
+        return {
+            kind: "libCall", fn: "dyn.toString", args: [operand,
+                call.arguments[0] ? lowerer.lowerExprExpecting(call.arguments[0], DYN) : dynUndefinedExpr(locOf(call)),
+                { kind: "strLit", value: access.getText(), type: STRING, loc: locOf(call) },
+            ], type: STRING, loc: locOf(call),
+        };
+    }
+    if (call.arguments.length === 1) {
+        if (operand.type.kind !== "f64")
+            return null;
+        return { kind: "libCall", fn: "num.toStringRadix", args: [operand, lowerer.lowerExprExpecting(call.arguments[0], DYN)], type: STRING, loc: locOf(call) };
+    }
     if (operand.type.kind === "string")
         return operand; // identity, receiver evaluated
     if (operand.type.kind !== "f64" && operand.type.kind !== "bool")
@@ -6305,6 +6687,15 @@ function lowerPrimitiveProtoCall(lowerer, call, recv, name, memberSym) {
     if (!lowerer.isStdlibSymbol(memberSym))
         return null;
     const recvKind = lowerer.mapTypeOf(lowerer.typeOf(recv))?.kind;
+    if ((name === "toFixed" || name === "toExponential") && call.arguments.length <= 1 &&
+        !call.arguments.some(ts.isSpreadElement) && isJsSourceFile(call.getSourceFile())) {
+        const operand = lowerer.lowerExpr(recv);
+        if (operand.type.kind === "dyn" || operand.type.kind === "union" && lowerer.dynConvertible(operand.type))
+            return {
+                kind: "dynInvoke", recv: lowerer.coerceToExpected(operand, DYN), method: name, calleeName: `${recv.getText()}.${name}`,
+                args: call.arguments.map((argument) => lowerer.lowerExprExpecting(argument, DYN)), type: DYN, loc: locOf(call),
+            };
+    }
     if (recvKind !== "f64" && recvKind !== "bool" && recvKind !== "string")
         return null;
     const loc = locOf(call);
@@ -6574,15 +6965,14 @@ function templateEscapesValid(raw) {
    * maps to string[] (type-mapper.ts), so the array rides the ordinary
    * slot-directed coercion into whatever the tag's first parameter wants
    * — string[] exactly, an `any` slot through the dyn boundary, a rest
-   * pack's first element. `.raw` does not exist on the lowered object:
-   * reads fence per member, and String.raw itself lowered above (the raw
-   * spans splice directly, no array materializes).
+   * pack's first element. Checked tags receive frozen cooked and raw
+   * arrays with the standard nonenumerable `.raw` descriptor. Typed direct
+   * tags retain the string-array representation.
    *
    * Tag forms: a top-level declared function (the direct-call fast path —
    * overload sets reconcile through the resolved signature exactly like
    * plain calls), an island value under --dynamic (engine method/function
-   * call: the engine side sees a plain marshaled array — a tag reading
-   * `.raw` there answers undefined where Node carries the raw spans), and
+   * call with the engine's cooked/raw template object), and
    * a checked-dynamic value (the dynCall boundary — a non-function tag
    * throws Node's catchable TypeError). Everything else — generic tags,
    * method tags, function-value bindings — fences by name. */
@@ -6642,10 +7032,11 @@ export function lowerTaggedTemplate(lowerer, expr) {
     if (ts.isIdentifier(expr.tag) && !lowerer.isSelfReference(expr.tag)) {
         if (lowerer.isTopLevelFnSymbol(expr.tag) && !lowerer.peekLocal(expr.tag)) {
             fenceEarlyAliasUse(lowerer, expr.tag, expr);
-            if (lowerer.genericFnOf(expr.tag)) {
+            const genericTag = lowerer.genericFnOf(expr.tag);
+            if (genericTag && !genericTag.implicitParams) {
                 lowerer.unsupported("SC1090", expr, "tagged templates with generic tag functions");
             }
-            const sig = lowerer.fnSigOf(expr.tag);
+            const sig = genericTag ? null : lowerer.fnSigOf(expr.tag);
             if (sig) {
                 lowerer.noteEdge(sig.name);
                 const args = completeArgs(lowerer, values, sig.params, loc, expr, [strings()]);
@@ -6672,10 +7063,13 @@ export function lowerTaggedTemplate(lowerer, expr) {
     // Checked-dynamic tags (`var f: any; f\`abc\``, dyn property chains):
     // the dynCall boundary — arguments convert into dyn, a non-function
     // tag throws Node's catchable "<name> is not a function" TypeError.
-    const callee = lowerer.lowerExpr(expr.tag);
+    let callee = lowerer.lowerExpr(expr.tag);
+    if (callee.type.kind === "func" && isJsSourceFile(expr.getSourceFile()) && lowerer.dynConvertible(callee.type)) {
+        callee = { kind: "dynFrom", value: callee, type: DYN, loc };
+    }
     if (callee.type.kind === "dyn") {
         const args = [
-            lowerer.coerceInto(expr.template, strings(), DYN),
+            loweredTemplateStrings(lowerer, expr, pieces.map((piece) => piece.text), loc, pieces.map(templateRawTextOf)),
             ...values.map((a) => lowerer.lowerExprExpecting(a, DYN)),
         ];
         const calleeName = ts.isPropertyAccessExpression(expr.tag) || ts.isElementAccessExpression(expr.tag)
@@ -6687,12 +7081,15 @@ export function lowerTaggedTemplate(lowerer, expr) {
     }
     lowerer.unsupported("SC1090", expr, "tagged templates with this tag form (top-level functions and dynamic values tag; call the function directly otherwise)");
 }
-function loweredTemplateStrings(lowerer, expr, cooked, loc) {
+function loweredTemplateStrings(lowerer, expr, cooked, loc, raw) {
     // Normal runtime construction keeps this array aligned with the current
     // ScrArr layout in the backend. The old static-header IR node encoded the
     // pre-sparse layout in LLVM and crashed as soon as a tag read its strings.
-    const type = arrayOf(STRING);
-    const key = `templateStringsGlobal:${loc.file}:${expr.template.getStart()}`;
+    const type = raw ? DYN : arrayOf(STRING);
+    const array = (values) => ({ kind: "dynArrLit", elems: values.map((value) => ({ kind: "dynFrom", value: { kind: "strLit", value, type: STRING, loc }, type: DYN, loc })), type: DYN, loc });
+    const freeze = (value) => ({ kind: "libCall", fn: "dyn.freeze", args: [value], type: DYN, loc });
+    const checked = raw ? freeze({ kind: "libCall", fn: "dyn.defineProperty", args: [array(cooked), { kind: "dynFrom", value: { kind: "strLit", value: "raw", type: STRING, loc }, type: DYN, loc }, { kind: "dynObjLit", fields: [{ key: { kind: "strLit", value: "value", type: STRING, loc }, value: freeze(array(raw)) }], type: DYN, loc }], type: DYN, loc }) : null;
+    const key = `templateStringsGlobal:${loc.file}:${expr.template.getStart()}:${raw ? "checked" : "typed"}`;
     let getter = lowerer.widthHelpers.get(key);
     if (!getter) {
         const site = lowerer.globalsList.length;
@@ -6714,7 +7111,7 @@ function loweredTemplateStrings(lowerer, expr, cooked, loc) {
                         {
                             kind: "assign",
                             localId: globalId,
-                            value: {
+                            value: checked ?? {
                                 kind: "arrayLit",
                                 elems: cooked.map((value) => ({ kind: "strLit", value, type: STRING, loc })),
                                 type,
@@ -6779,6 +7176,17 @@ export function lowerNestedFunctionDecl(lowerer, stmt) {
         throw new InternalCompilerError("lowerer bug: nested function declaration has no active statement list");
     }
     const init = lowerer.lowerLambda(stmt);
+    // Body inference may settle a JS return differently from the initial
+    // checker signature. Publish that same ABI on the hoisted binding and
+    // every mutable capture of it before callers are lowered.
+    if (init.type.kind === "func" && !typeEquals(local.type, init.type)) {
+        local.type = init.type;
+        for (const fn of lowerer.liftedFns)
+            for (const capture of fn.captures ?? []) {
+                if (capture.localId === local.id)
+                    capture.type = init.type;
+            }
+    }
     return { kind: "assign", localId: local.id, value: init, loc: locOf(stmt) };
 }
 /** Signature checks + param shapes + IR func type for any lambda-like
@@ -6819,6 +7227,23 @@ export function lambdaSignature(lowerer, node) {
                 : "generic arrow/function expressions outside a never-reassigned module-scope binding (only `const f = <T>(x: T) => ...` bindings and top-level generic function declarations monomorphize)");
     }
     const shapes = lowerer.paramShapes(node.parameters);
+    // Error-first callbacks captured by native filesystem adapters receive
+    // the selected runtime overload. Ambient contextual inference can pick
+    // the string overload even when options request a Buffer.
+    if ((ts.isArrowFunction(node) || ts.isFunctionExpression(node)) && ts.isCallExpression(node.parent) &&
+        node.parent.arguments.at(-1) === node) {
+        const builtin = ts.isPropertyAccessExpression(node.parent.expression) ? lowerer.builtinMemberOf(node.parent.expression)
+            : ts.isIdentifier(node.parent.expression) ? lowerer.builtinImportOf(node.parent.expression) : null;
+        if (builtin?.module === "fs" && builtin.member !== "rename" && builtinModuleFnOf(lowerer, builtin.module, builtin.member)?.fn === "fs.callbackCall") {
+            for (let index = 0; index < shapes.length; index++) {
+                if (!node.parameters[index]?.type) {
+                    shapes[index].type = DYN;
+                    if (shapes[index].bodyType)
+                        shapes[index].bodyType = DYN;
+                }
+            }
+        }
+    }
     // A concise arrow over an h2-only stream/session call (`() =>
     // req.stream.destroy()`): the call ALWAYS throws on this lowering
     // (stream is undefined — the streamUndefCall precedent), so the body
@@ -6919,14 +7344,28 @@ export function lambdaSignature(lowerer, node) {
    * object-literal shorthand method to a module-level function and yields
    * the `closure` expression creating it. */
 export function lowerLambda(lowerer, node) {
+    const prepared = (ts.isArrowFunction(node) || ts.isFunctionExpression(node)) ? lowerer.preparedClassFactories.get(node) : undefined;
+    if (prepared)
+        return prepared;
     const loc = locOf(node);
-    const { shapes, funcType } = lowerer.lambdaSignature(node);
+    const signature = lowerer.lambdaSignature(node);
+    const { shapes } = signature;
+    let { funcType } = signature;
+    // Reflected JS methods receive the caller's actual `this`, which may
+    // be a Proxy or a descriptor-created object rather than the class.
+    // Fluent methods must return that receiver without a class cast.
+    if (ts.isMethodDeclaration(node) && isJsSourceFile(node.getSourceFile()) &&
+        !node.type && !node.asteriskToken && !hasExplicitJsDocReturn(node) && returnsOnlyThis(node)) {
+        funcType = { ...funcType, ret: funcType.ret.kind === "promise" ? { ...funcType.ret, inner: DYN } : DYN };
+    }
     // A lambda IS a value: the completed-ABI rule applies at birth. The
     // contextual (target) type decides — `(x?: number) => void` may flow
     // into a slot annotated `(x: number | undefined) => void` (same ABI
     // signature), anything else is fenced. Nested function declarations and
     // object-literal shorthand methods aren't expressions — always fenced.
-    lowerer.requireExactArityValue(node, ts.isArrowFunction(node) || ts.isFunctionExpression(node) ? node : null, shapes, funcType);
+    if (!(ts.isMethodDeclaration(node) && isJsSourceFile(node.getSourceFile()) &&
+        canBoxFuncIntoDyn(funcType, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))))
+        lowerer.requireExactArityValue(node, ts.isArrowFunction(node) || ts.isFunctionExpression(node) ? node : null, shapes, funcType);
     const nameIdent = !ts.isArrowFunction(node) && node.name && ts.isIdentifier(node.name) ? node.name : null;
     const baseName = nameIdent ? nameIdent.text : "";
     const fnName = `%fn${lowerer.lambdaCounter++}${baseName ? `_${baseName}` : ""}`;
@@ -6950,10 +7389,18 @@ export function lowerLambda(lowerer, node) {
     if (isGenerator &&
         (funcType.ret.kind !== "generator" || (funcType.ret.async === true) !== isAsync))
         lowerer.badType(node, lowerer.typeOf(node));
-    const bodyReturn = isGenerator
+    let bodyReturn = isGenerator
         ? lowerer.genBodyReturnType(funcType.ret)
         : lowerer.bodyReturnType(isAsync, funcType.ret);
     const fnCtx = newFnCtx(true, selfSymbol, funcType, bodyReturn);
+    const inferredSignature = isJsSourceFile(node.getSourceFile()) && !node.type ? lowerer.checker.getSignatureFromDeclaration(node) : undefined;
+    const returnsConstructor = inferredSignature && producesConstructor(lowerer, lowerer.checker.getReturnTypeOfSignature(inferredSignature));
+    if (isJsSourceFile(node.getSourceFile()) && !node.type && !isAsync && !isGenerator &&
+        (bodyReturn.kind === "classval" || bodyReturn.kind === "date" || bodyReturn.kind === "symbol" || bodyReturn.kind === "record" ||
+            (bodyReturn.kind === "dyn" || bodyReturn.kind === "func") && returnsConstructor)) {
+        fnCtx.inferReturn = { entries: [] };
+    }
+    fnCtx.inheritsArguments = ts.isArrowFunction(node);
     fnCtx.isAsync = isAsync;
     if (isGenerator && funcType.ret.kind === "generator") {
         fnCtx.generator = generatorMeta(lowerer, funcType.ret);
@@ -6967,7 +7414,7 @@ export function lowerLambda(lowerer, node) {
         // and a method nested inside another method never captures its owner.
         if (isJsSourceFile(node.getSourceFile()) && !ts.isArrowFunction(node)) {
             const receiver = lowerer.declareThis(DYN);
-            prologue.unshift({ kind: "varDecl", localId: receiver.id, init: { kind: "libCall", fn: "dyn.this", args: [], type: DYN, loc }, loc });
+            prologue.unshift({ kind: "varDecl", localId: receiver.id, init: { kind: "libCall", fn: isGenerator ? "dyn.generatorThis" : "dyn.this", args: [], type: DYN, loc }, loc });
         }
         // The synthetic trailing dyn-array param carries `arguments`.
         // Parameterized functions receive all actual arguments; zero-param
@@ -6977,6 +7424,15 @@ export function lowerLambda(lowerer, node) {
             params.push({ localId: argsLocal.id, name: "%arguments", type: DYN });
             fnCtx.argumentsLocal = argsLocal;
         }
+        if (isJsSourceFile(node.getSourceFile()) && !ts.isArrowFunction(node) &&
+            shapes.length === 1 && shapes[0]?.mode === "dynRest" && bodyReadsArguments(node)) {
+            const argsLocal = lowerer.declareHiddenLocal("%arguments", DYN);
+            prologue.push({ kind: "varDecl", localId: argsLocal.id, init: {
+                    kind: "dynInvoke", recv: varRef(params[0].localId, DYN, loc), method: "slice",
+                    calleeName: "Array.prototype.slice", args: [], type: DYN, loc,
+                }, loc });
+            fnCtx.argumentsLocal = argsLocal;
+        }
         let body;
         if (ts.isBlock(node.body)) {
             body = lowerer.lowerStmts(node.body.statements);
@@ -7011,7 +7467,7 @@ export function lowerLambda(lowerer, node) {
             else {
                 // Concise and block bodies use the same destination layout for
                 // fresh literals. Async bodies must inspect promises first.
-                let value = isAsync ? lowerer.lowerExpr(bodyExpr) : lowerer.lowerExprExpecting(bodyExpr, bodyReturn);
+                let value = isAsync || fnCtx.inferReturn ? lowerer.lowerExpr(bodyExpr) : lowerer.lowerExprExpecting(bodyExpr, bodyReturn);
                 // An async concise body whose value is itself a promise
                 // (`async () => p`): the async machinery RESOLVES the returned
                 // thenable into the function's own promise — lowerReturnValue's
@@ -7025,17 +7481,25 @@ export function lowerLambda(lowerer, node) {
                         : [
                             {
                                 kind: "return",
-                                value: lowerer.coerceInto(bodyExpr, value, bodyReturn),
+                                value: fnCtx.inferReturn ? value : lowerer.coerceInto(bodyExpr, value, bodyReturn),
                                 loc: locOf(node.body),
                             },
                         ];
+                if (fnCtx.inferReturn && body[0]?.kind === "return")
+                    fnCtx.inferReturn.entries.push({ stmt: body[0], node: bodyExpr });
             }
         }
+        if (fnCtx.inferReturn) {
+            bodyReturn = resolveInferredReturn(lowerer, { returnType: bodyReturn }, fnCtx.inferReturn, body, node);
+            funcType = { ...funcType, ret: bodyReturn };
+            fnCtx.returnType = bodyReturn;
+        }
         body = [...prologue, ...body];
         // Bare-expression bodies never pass through lowerStmts, so the
         // lib-boundary chokepoint runs here (idempotent for block bodies,
         // whose statements were already walked). A fence poisons the
         // enclosing statement — the lambda IS part of it.
+        body = lowerSurplusCalls(lowerer, body);
         enforceLibBoundary(lowerer, body);
         appendImplicitUndefinedReturn(lowerer, body, bodyReturn, loc);
         const ctx = lowerer.ctx;
@@ -7189,7 +7653,7 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
     const member = access.name.text;
     if (member !== "then" && member !== "catch" && member !== "finally")
         return null;
-    let recvT = lowerer.mapTypeOf(lowerer.typeOf(access.expression));
+    let recvT = lowerer.mapTypeOf(lowerer.typeOf(access.expression)) ?? dynFallbackType(lowerer, access.expression, lowerer.typeOf(access.expression));
     // A dynamic-import promise under an unmappable checker type
     // (`Promise<typeof import("./m")>` — module-namespace types have no
     // static mapping): the BINDING holds the island promise
@@ -7242,6 +7706,8 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
             loc,
         };
     }
+    if (receiver.type.kind === "dyn" && lowerer.dynConvertible(recvT))
+        receiver = lowerer.coerceInto(access.expression, receiver, recvT);
     if (receiver.type.kind !== "promise") {
         // mapTypeOf said promise but the value lowered as something else —
         // a lowering gap, named rather than ICEd on.
@@ -7501,7 +7967,7 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
                     value: {
                         kind: "dynCall",
                         callee: { kind: "varRef", localId: cbLocal.id, type: DYN, loc },
-                        calleeName: jsFuncNameOf(call.arguments[0]) ?? "onFulfilled",
+                        calleeName: jsFuncNameOf(call.arguments[0], lowerer) ?? "onFulfilled",
                         args: handlerArgs,
                         type: DYN,
                         loc,
@@ -7534,7 +8000,8 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
             lowerer.unsupported("SC1090", call.arguments[0], "then handlers with more than one parameter (the two-argument onRejected form has no lowering — chain .catch(...) instead)");
         }
         const param = cb.type.params[0];
-        if (param !== undefined && !typeEquals(param, inner)) {
+        if (param !== undefined && !typeEquals(param, inner) &&
+            !(param.kind === "dyn" && (inner.kind === "void" || lowerer.dynConvertible(inner)))) {
             lowerer.unsupported("SC1090", call.arguments[0], `then handlers whose parameter is not the settled value's type (expected '${lowerer.fmt(inner)}', got '${lowerer.fmt(param)}')`);
         }
         const resultT = lowerer.mapTypeOf(lowerer.typeOf(call));
@@ -7564,10 +8031,12 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
             if (param !== undefined && inner.kind !== "void") {
                 const vLocal = lowerer.declareHiddenLocal("v", inner);
                 body.push({ kind: "varDecl", localId: vLocal.id, init: awaitE, loc });
-                handlerArgs = [{ kind: "varRef", localId: vLocal.id, type: inner, loc }];
+                handlerArgs = [lowerer.coerceToExpected({ kind: "varRef", localId: vLocal.id, type: inner, loc }, param)];
             }
             else {
                 body.push({ kind: "exprStmt", expr: awaitE, loc });
+                if (param !== undefined)
+                    handlerArgs = [dynUndefinedExpr(loc)];
             }
             const handlerCall = {
                 kind: "callValue",
@@ -7623,6 +8092,14 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
     }
     if (member === "finally") {
         const cb = lowerer.lowerExpr(call.arguments[0]);
+        if (lowerer.dynConvertible(promT) && lowerer.dynConvertible(cb.type)) {
+            const result = {
+                kind: "dynInvoke", recv: lowerer.coerceToExpected(receiver, DYN),
+                method: "finally", calleeName: access.getText(),
+                args: [lowerer.coerceToExpected(cb, DYN)], type: DYN, loc,
+            };
+            return lowerer.coerceToExpected(result, promT);
+        }
         if (cb.type.kind !== "func" || cb.type.params.length !== 0 || cb.type.ret.kind !== "void") {
             lowerer.unsupported("SC1090", call.arguments[0], "finally callbacks with parameters or a return value (use () => { ... })");
         }
@@ -7699,7 +8176,8 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
     // receiver, passes fulfillments through as dyn, and on rejection
     // calls the boxed handler with caughtToDyn's identity-preserving
     // snapshot (the dyn-then desugar's catch twin).
-    if (member === "catch" && inner.kind === "dyn") {
+    if (member === "catch" && (inner.kind === "dyn" || isJsSourceFile(call.getSourceFile()) &&
+        (inner.kind === "void" || lowerer.dynConvertible(inner)))) {
         let cb = lowerer.lowerExpr(call.arguments[0]);
         if (cb.type.kind === "func" &&
             canBoxFuncIntoDyn(cb.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
@@ -7716,20 +8194,11 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
                 const pLocal = lowerer.declareHiddenLocal("p", promT);
                 const cbLocal = lowerer.declareHiddenLocal("cb", DYN);
                 const eLocal = lowerer.declareHiddenLocal("e", CAUGHT);
-                const vLocal = lowerer.declareHiddenLocal("v", DYN);
+                const vLocal = inner.kind === "void" ? null : lowerer.declareHiddenLocal("v", inner);
+                const awaited = { kind: "awaitExpr", value: { kind: "varRef", localId: pLocal.id, type: promT, loc }, type: inner, loc };
                 const tryBody = [
-                    {
-                        kind: "varDecl",
-                        localId: vLocal.id,
-                        init: {
-                            kind: "awaitExpr",
-                            value: { kind: "varRef", localId: pLocal.id, type: promT, loc },
-                            type: DYN,
-                            loc,
-                        },
-                        loc,
-                    },
-                    { kind: "return", value: { kind: "varRef", localId: vLocal.id, type: DYN, loc }, loc },
+                    vLocal ? { kind: "varDecl", localId: vLocal.id, init: awaited, loc } : { kind: "exprStmt", expr: awaited, loc },
+                    { kind: "return", value: vLocal ? lowerer.coerceToExpected(varRef(vLocal.id, inner, loc), DYN) : dynUndefinedExpr(loc), loc },
                 ];
                 const catchBody = [
                     {
@@ -7737,7 +8206,7 @@ export function lowerPromiseMethodCall(lowerer, call, access) {
                         value: {
                             kind: "dynCall",
                             callee: { kind: "varRef", localId: cbLocal.id, type: DYN, loc },
-                            calleeName: jsFuncNameOf(call.arguments[0]) ?? "onRejected",
+                            calleeName: jsFuncNameOf(call.arguments[0], lowerer) ?? "onRejected",
                             args: [
                                 {
                                     kind: "caughtToDyn",
@@ -8540,14 +9009,23 @@ function lowerObjectStaticCall(lowerer, call, access) {
         !call.arguments.some(ts.isSpreadElement) && !lowerer.dynamic) {
         let object = lowerer.lowerExpr(call.arguments[0]);
         if (object.type.kind === "func") {
-            const fnName = jsFuncNameOf(call.arguments[0]);
+            const fnName = jsFuncNameOf(call.arguments[0], lowerer);
             object = { kind: "dynFrom", value: object, type: DYN, loc: locOf(call),
                 ...(fnName !== null ? { fnName } : {}) };
         }
+        if (object.type.kind !== "dyn" && canConvertToDyn(object.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id)))
+            object = lowerer.coerceInto(call.arguments[0], object, DYN);
         if (object.type.kind === "dyn") {
             const loc = locOf(call);
-            if (member === "getPrototypeOf")
-                return { kind: "libCall", fn: "dyn.getPrototype", args: [object], type: DYN, loc };
+            if (member === "getPrototypeOf") {
+                let parent = call.parent;
+                while (parent && ts.isParenthesizedExpression(parent))
+                    parent = parent.parent;
+                const identityOnly = !!parent && ts.isBinaryExpression(parent) &&
+                    [ts.SyntaxKind.EqualsEqualsEqualsToken, ts.SyntaxKind.ExclamationEqualsEqualsToken].includes(parent.operatorToken.kind);
+                return { kind: "libCall", fn: "dyn.getPrototype", args: [object], type: DYN, loc,
+                    ...(identityOnly ? { prototypeIdentityOnly: true } : {}) };
+            }
             const prototype = lowerer.lowerExprExpecting(call.arguments[1], DYN);
             if (prototype.type.kind === "dyn")
                 return { kind: "libCall", fn: "dyn.setPrototype", args: [object, prototype], type: DYN, loc };
@@ -8600,7 +9078,7 @@ function lowerObjectStaticCall(lowerer, call, access) {
         if (unitTest)
             return unitTest;
         if (lk === "dyn" || rk === "dyn" || lk === "jsval" || rk === "jsval") {
-            lowerer.noLowering("Object.is over a dynamic operand", call, "validate/narrow the value first (strict equality's rule) — SameValue only differs from === on numbers (NaN, ±0)");
+            return { kind: "libCall", fn: "dyn.sameValue", args: [lowerer.coerceInto(leftNode, left, DYN), lowerer.coerceInto(rightNode, right, DYN)], type: BOOL, loc };
         }
         if (left.type.kind === "union" || right.type.kind === "union") {
             const ut = left.type.kind === "union" ? left.type : right.type;
@@ -8728,7 +9206,8 @@ function lowerObjectStaticCall(lowerer, call, access) {
             return prototype;
         if (isJsSourceFile(call.getSourceFile()) && call.arguments.length > 0 && !call.arguments.some(ts.isSpreadElement)) {
             const target = tryLowerExpression(lowerer, call.arguments[0]);
-            if (target?.type.kind === "func" && lowerer.dynConvertible(target.type)) {
+            if (target && ((target.type.kind === "func" && lowerer.dynConvertible(target.type)) ||
+                (target.type.kind === "object" && lowerer.dynConvertible(target.type)))) {
                 const loc = locOf(call);
                 return { kind: "libCall", fn: "dyn.assignAll", args: [lowerer.coerceToExpected(target, DYN),
                         { kind: "dynArrLit", elems: call.arguments.slice(1).map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc },
@@ -8904,6 +9383,14 @@ function lowerObjectStaticCall(lowerer, call, access) {
         if (call.arguments.some((a) => ts.isSpreadElement(a)))
             return null;
         let target = tryLowerExpression(lowerer, call.arguments[0]);
+        const targetNode = call.arguments[0];
+        // The checker gives C.prototype the instance type, but its lowered
+        // value is the shared prototype table, not an instance to unbox.
+        const prototypeTarget = ts.isPropertyAccessExpression(targetNode) && targetNode.name.text === "prototype" &&
+            (exactClassOfReceiver(lowerer, targetNode.expression) !== null || storedClassValueType(lowerer, targetNode.expression)?.kind === "classval");
+        const declaredTarget = target?.type.kind === "dyn" && !prototypeTarget && !isJsSourceFile(targetNode.getSourceFile()) ? lowerer.mapTypeOf(lowerer.typeOf(targetNode)) : null;
+        if (target && declaredTarget && isDynTypedRefType(declaredTarget))
+            target = lowerer.coerceToExpected(target, declaredTarget);
         if (target && member === "defineProperty") {
             const native = lowerClassDataDescriptor(lowerer, call, member, target);
             if (native)
@@ -8915,15 +9402,14 @@ function lowerObjectStaticCall(lowerer, call, access) {
                 return descriptor;
             target = lowerer.coerceToExpected(target, DYN);
         }
-        // Error.cause owns a live data-property slot shared with its checked
-        // view. Other native fields do not yet synchronize descriptor edits.
+        // Error instances share a live property table with their checked view.
         const keyNode = call.arguments[1];
         if (target?.type.kind === "object" && target.type.className !== "%DOMException" && lowerer.errorHierarchyClassOf(target.type.className) &&
-            ts.isStringLiteral(keyNode) && keyNode.text === "cause") {
+            ((ts.isStringLiteral(keyNode) && (keyNode.text === "cause" || keyNode.text === "message")) || lowerer.mapTypeOf(lowerer.typeOf(keyNode))?.kind === "symbol")) {
             target = lowerer.coerceToExpected(target, DYN);
         }
         if (target?.type.kind === "func" && lowerer.dynConvertible(target.type)) {
-            const fnName = jsFuncNameOf(call.arguments[0]);
+            const fnName = jsFuncNameOf(call.arguments[0], lowerer);
             target = { kind: "dynFrom", value: target, type: DYN, loc: locOf(call.arguments[0]), ...(fnName !== null ? { fnName } : {}) };
         }
         const descriptorPrimitive = member === "getOwnPropertyDescriptor" && target &&
@@ -8952,6 +9438,9 @@ function lowerObjectStaticCall(lowerer, call, access) {
     // static shapes have no property table to extend.
     if (member === "defineProperties" && call.arguments.length === 2 &&
         !call.arguments.some((a) => ts.isSpreadElement(a))) {
+        const prototype = lowerClassPrototypeDescriptors(lowerer, call, member);
+        if (prototype)
+            return prototype;
         let target = tryLowerExpression(lowerer, call.arguments[0]);
         if (target) {
             const native = lowerClassDataDescriptor(lowerer, call, member, target);
@@ -8964,7 +9453,7 @@ function lowerObjectStaticCall(lowerer, call, access) {
         // wrapper returned later reads the same table.
         if (target && target.type.kind === "func" &&
             canBoxFuncIntoDyn(target.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
-            const fnName = jsFuncNameOf(call.arguments[0]);
+            const fnName = jsFuncNameOf(call.arguments[0], lowerer);
             target = { kind: "dynFrom", value: target, type: DYN, loc: locOf(call.arguments[0]), ...(fnName !== null ? { fnName } : {}) };
         }
         if (target && isUnitType(target.type)) {
@@ -9019,7 +9508,8 @@ function lowerObjectStaticCall(lowerer, call, access) {
         let inner = argNode;
         while (ts.isParenthesizedExpression(inner) || ts.isAsExpression(inner))
             inner = inner.expression;
-        const value = lowerer.lowerExpr(argNode);
+        const value = isJsSourceFile(call.getSourceFile()) && (ts.isObjectLiteralExpression(inner) || ts.isArrayLiteralExpression(inner))
+            ? lowerer.lowerExprExpecting(argNode, DYN) : lowerer.lowerExpr(argNode);
         if (value.type.kind === "dyn")
             return { kind: "libCall", fn: "dyn.freeze", args: [value], type: DYN, loc: locOf(call) };
         if (ts.isObjectLiteralExpression(inner) || ts.isArrayLiteralExpression(inner)) {
@@ -9048,14 +9538,19 @@ function lowerObjectStaticCall(lowerer, call, access) {
         const recvNode = call.arguments[0];
         const keyNode = call.arguments[1];
         const probed = tryLowerExpression(lowerer, recvNode);
+        const constructor = probed?.type.kind === "classval" ? lowerer.classes.get(probed.type.className) : undefined;
         // A CHECKED-DYNAMIC receiver (the JS file-scope object-literal
         // identity story): the runtime dyn probe — OBJ member presence, ARR
         // index bounds, Node's ToObject TypeError on nullish.
-        if (probed?.type.kind === "dyn" || (probed && isDynTypedRefType(probed.type)) || (probed?.type.kind === "func" && lowerer.dynConvertible(probed.type))) {
+        if (probed?.type.kind === "dyn" || (probed && isDynTypedRefType(probed.type)) ||
+            (probed?.type.kind === "object" && lowerer.errorHierarchyClassOf(probed.type.className)) ||
+            (probed && constructor && (constructor.callableBase || hasRuntimeStatics(constructor))) ||
+            (probed?.type.kind === "func" && lowerer.dynConvertible(probed.type))) {
             const loc = locOf(call);
             const receiver = lowerer.coerceToExpected(probed, DYN);
             const rawKey = lowerer.lowerExpr(keyNode);
-            if (rawKey.type.kind === "dyn" || rawKey.type.kind === "symbol")
+            if (rawKey.type.kind === "dyn" || rawKey.type.kind === "symbol" ||
+                rawKey.type.kind === "union" && lowerer.dynConvertible(rawKey.type))
                 return {
                     kind: "libCall", fn: "dyn.hasOwnComputed", args: [receiver, lowerer.coerceToExpected(rawKey, DYN)], type: BOOL, loc,
                 };
@@ -9140,7 +9635,8 @@ function lowerObjectStaticCall(lowerer, call, access) {
         const isPrimitive = probed !== null && probed !== undefined &&
             (isUnitType(probed.type) || probed.type.kind === "string" ||
                 probed.type.kind === "f64" || probed.type.kind === "bool");
-        if (isDyn || isPrimitive || isFunction || (probed && isDynTypedRefType(probed.type))) {
+        const isJsUnion = probed?.type.kind === "union" && isJsSourceFile(call.getSourceFile()) && lowerer.dynConvertible(probed.type);
+        if (isDyn || isPrimitive || isFunction || isJsUnion || (probed && isDynTypedRefType(probed.type))) {
             const fn = member === "keys" ? "dyn.objKeys" : member === "values" ? "dyn.objValues" : "dyn.objEntries";
             let v = lowerer.lowerExpr(argNode);
             if (v.type.kind !== "dyn")
@@ -9149,14 +9645,11 @@ function lowerObjectStaticCall(lowerer, call, access) {
         }
     }
     let argIr = lowerer.mapTypeOf(lowerer.typeOf(argNode));
-    // JS: an unmappable CHECKER type over a value that lowered to a real
-    // record (the narrowed export-table literal) — the lowered value's
-    // shape is the honest dispatch key, exactly the identity-Set stance.
-    if (argIr === null && isJsSourceFile(argNode.getSourceFile())) {
-        const probed = tryLowerExpression(lowerer, argNode);
-        if (probed?.type.kind === "record")
-            argIr = probed.type;
-    }
+    // Inferred records can carry runtime-optional index values that the
+    // checker omits (named regex captures). Enumerate the represented shape.
+    const represented = tryLowerExpression(lowerer, argNode);
+    if (represented?.type.kind === "record")
+        argIr = represented.type;
     if (argIr?.kind !== "record")
         return null; // Maps, classes, arrays → the SC2020 fence
     const shape = lowerer.shapes.get(argIr.shapeId);
@@ -9221,7 +9714,6 @@ function lowerObjectStaticCall(lowerer, call, access) {
         const recT = argIr;
         const ref = { kind: "varRef", localId: "r.0", type: recT, loc };
         const outRef = { kind: "varRef", localId: "out.0", type: resultT, loc };
-        lowerer.arrHofHelpers.set(key, helper);
         const fn = {
             name: helper,
             params: [{ localId: "r.0", name: "r", type: recT }],
@@ -9250,6 +9742,8 @@ function lowerObjectStaticCall(lowerer, call, access) {
                         return null;
                     if (typeEquals(vt, valueT))
                         return value;
+                    if (valueT.kind === "dyn" && lowerer.dynConvertible(vt))
+                        return lowerer.coerceToExpected(value, DYN);
                     if (valueT.kind === "union" && vt.kind !== "union") {
                         const tag = lowerer.armTag(valueT.unionId, vt);
                         if (tag >= 0) {
@@ -9269,7 +9763,7 @@ function lowerObjectStaticCall(lowerer, call, access) {
                         guardUndefTag = undefTag;
                         const arms = lowerer.unions.get(f.type.unionId)?.arms ?? [];
                         const others = arms.filter((a) => a.kind !== "undefinedT");
-                        if (typeEquals(f.type, valueT ?? f.type)) {
+                        if (valueT?.kind === "dyn" || typeEquals(f.type, valueT ?? f.type)) {
                             // The field union IS the result union (single-field shapes):
                             // push the raw box — but then the undefined skip must NOT
                             // narrow. Handled below via vt === valueT.
@@ -9293,7 +9787,7 @@ function lowerObjectStaticCall(lowerer, call, access) {
                                 "cannot re-tag into the result element type — read the fields directly)");
                         }
                     }
-                    else if (!typeEquals(f.type, valueT ?? f.type)) {
+                    else if (valueT?.kind !== "dyn" && !typeEquals(f.type, valueT ?? f.type)) {
                         lowerer.unsupported("SC1090", call, `Object.${member} over '${lowerer.fmt(argIr)}' (field '${f.name}' is a union that cannot ` +
                             "re-tag into the result element type — read the fields directly)");
                     }
@@ -9333,6 +9827,7 @@ function lowerObjectStaticCall(lowerer, call, access) {
             fn.body = body;
         };
         finalize();
+        lowerer.arrHofHelpers.set(key, helper);
         lowerer.shapeOrderHelperFinalizers.push(finalize);
         lowerer.liftedFns.push(fn);
     }
@@ -9381,6 +9876,15 @@ export function lowerFunction(lowerer, decl) {
             params.push({ localId: argsLocal.id, name: "%arguments", type: DYN });
             ctx.argumentsLocal = argsLocal;
         }
+        if (isJsSourceFile(decl.getSourceFile()) && sig.params.length === 1 &&
+            sig.params[0]?.mode === "dynRest" && bodyReadsArguments(decl)) {
+            const argsLocal = lowerer.declareHiddenLocal("%arguments", DYN);
+            prologue.push({ kind: "varDecl", localId: argsLocal.id, init: {
+                    kind: "dynInvoke", recv: varRef(params[0].localId, DYN, locOf(decl)), method: "slice",
+                    calleeName: "Array.prototype.slice", args: [], type: DYN, loc: locOf(decl),
+                }, loc: locOf(decl) });
+            ctx.argumentsLocal = argsLocal;
+        }
         const bodyBlock = blockBodyOf(decl);
         if (!bodyBlock) {
             lowerer.unsupported("SC1090", decl, "function declarations whose block body the frontend cannot locate");
@@ -9537,6 +10041,13 @@ export function lowerRecordFieldCall(lowerer, call, access) {
         return { kind: "callValue", callee, args, type: callee.type.ret, loc: locOf(call) };
     }
     const target = lowerer.fieldTarget(access);
+    const loc = locOf(call);
+    const receiverLocal = target && isJsSourceFile(call.getSourceFile())
+        ? lowerer.declareHiddenLocal("%callReceiver", target.obj.type) : null;
+    const init = target && receiverLocal
+        ? { kind: "varDecl", localId: receiverLocal.id, init: target.obj, loc } : null;
+    if (target && receiverLocal)
+        target.obj = varRef(receiverLocal.id, receiverLocal.type, loc);
     let callee = target ? lowerer.fieldGetExpr(target, locOf(access), access) : null;
     if (!callee)
         return null;
@@ -9545,10 +10056,24 @@ export function lowerRecordFieldCall(lowerer, call, access) {
     // `.bold` (the chalk shape).
     if (callee.type.kind === "record")
         callee = lowerer.hybridCallUnwrap(callee);
+    // Inferred JavaScript option records can retain checked callables in
+    // fields even when the checker only describes those members as any.
+    if (callee.type.kind === "dyn" && isJsSourceFile(call.getSourceFile())) {
+        const receiver = target && receiverLocal ? lowerer.coerceToExpected(target.obj, DYN) : undefined;
+        const spread = call.arguments.some(ts.isSpreadElement) ? lowerSpreadArgsCall(lowerer, call, callee, loc) : null;
+        if (spread && spread.kind !== "dynCall")
+            lowerer.unsupported("SC1090", call, "checked record property call spread arguments");
+        const result = spread ? (receiver ? { ...spread, receiver } : spread) : {
+            kind: "dynCall", callee, ...(receiver ? { receiver } : {}), calleeName: access.getText(),
+            args: call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc,
+        };
+        return init ? { kind: "seqExpr", stmts: [init], result, type: result.type, loc } : result;
+    }
     if (callee.type.kind !== "func")
         lowerer.badType(access, lowerer.typeOf(access));
     const args = completeFuncValueArgs(lowerer, call, callee.type, locOf(call));
-    return { kind: "callValue", callee, args, type: callee.type.ret, loc: locOf(call) };
+    const result = { kind: "callValue", callee, ...(target && receiverLocal ? { receiver: lowerer.coerceToExpected(target.obj, DYN) } : {}), args, type: callee.type.ret, loc };
+    return init ? { kind: "seqExpr", stmts: [init], result, type: result.type, loc } : result;
 }
 /** The function-like node behind an object-literal generic-method member:
    * the MethodDeclaration itself (`{ m<T>(x: T) {...} }`) or a generic
@@ -10206,7 +10731,8 @@ export function requireObjLitGenericReceiver(lowerer, blame, recvExpr, literal,
    * direct `call` of the instance with the receiver unevaluated. Claims
    * every call whose member is generic-callable — lowering it or fencing
    * with a named message. */
-/** URL.revokeObjectURL() with NO argument: Node's ERR_MISSING_ARGS
+/** The URL factories use the constructor's conversion order and parser.
+ * URL.revokeObjectURL() with NO argument: Node's ERR_MISSING_ARGS
  * throws before the registry lookup, so the zero-argument contract is
  * exact without any blob machinery. The one-argument form (Node's
  * silent no-op for unregistered ids) and createObjectURL keep their
@@ -10214,12 +10740,15 @@ export function requireObjLitGenericReceiver(lowerer, blame, recvExpr, literal,
 function lowerUrlStaticCall(lowerer, call, callee) {
     if (!ts.isPropertyAccessExpression(callee) || callee.questionDotToken !== undefined)
         return null;
-    if (!ts.isIdentifier(callee.expression) || callee.expression.text !== "URL")
-        return null;
-    if (callee.name.text !== "revokeObjectURL" || call.arguments.length !== 0)
+    if (!ts.isIdentifier(callee.expression))
         return null;
     const sym = lowerer.resolveValueSymbol(callee.expression);
-    if (!sym || !lowerer.isStdlibSymbol(sym))
+    if (!sym || !lowerer.isStdlibSymbol(sym) || sym.name !== "URL")
+        return null;
+    if (callee.name.text === "canParse" || callee.name.text === "parse") {
+        return lowerUrlFactory(lowerer, call, callee.name.text);
+    }
+    if (callee.name.text !== "revokeObjectURL" || call.arguments.length !== 0)
         return null;
     return nodeThrowExpr(1, "ERR_MISSING_ARGS", 'The "url" argument must be specified', VOID, locOf(call));
 }
@@ -10404,6 +10933,14 @@ function lowerObjLitGenericMethodCall(lowerer, call, access) {
     const propSym = lowerer.checker.getPropertyOfType(recvT, name);
     if (!propSym)
         return null;
+    const propertyDecl = lowerer.checker.valueDeclarationOf(propSym);
+    if (propertyDecl && ts.isShorthandPropertyAssignment(propertyDecl) && ts.isIdentifier(propertyDecl.name) && ts.isObjectLiteralExpression(propertyDecl.parent)) {
+        requireObjLitGenericReceiver(lowerer, call, access.expression, propertyDecl.parent, name);
+        const targetSymbol = lowerer.checker.getShorthandAssignmentValueSymbol(propertyDecl);
+        const target = targetSymbol ? lowerer.genericFnsBySymbol.get((targetSymbol.flags & ts.SymbolFlags.Alias ? lowerer.checker.getAliasedSymbol(targetSymbol) : targetSymbol)) : undefined;
+        if (target)
+            return lowerer.lowerGenericCall(call, target);
+    }
     if (!isGenericCallableMemberType(lowerer.checker.getTypeOfSymbol(propSym), lowerer.checker))
         return null;
     // CLASS members belong to the class path (lowerClassGenericMethodCall
@@ -10492,9 +11029,11 @@ export function lowerObjectMethodCall(lowerer, call, access) {
     // type still belongs to the unspecialized body (plane.normal.dot()).
     // Use the lowered receiver's representation and retain its evaluation.
     const probe = mappedReceiver?.kind !== "object" && (lowerer.implicitParamTypes !== null || ts.isNewExpression(access.expression) ||
-        isJsSourceFile(call.getSourceFile()) && ts.isCallExpression(access.expression))
-        ? tryLowerExpression(lowerer, access.expression) : null;
-    const specializedReceiver = probe?.type.kind === "object" ? probe : null;
+        isJsSourceFile(call.getSourceFile()))
+        ? ts.isNewExpression(access.expression) ? lowerer.lowerExpr(access.expression) : tryLowerExpression(lowerer, access.expression)
+        : null;
+    const specializedReceiver = probe?.type.kind === "object" || probe?.type.kind === "union" &&
+        lowerer.unions.get(probe.type.unionId)?.arms.some((arm) => arm.kind === "object") ? probe : null;
     if (specializedReceiver)
         mappedReceiver = specializedReceiver.type;
     if (mappedReceiver?.kind === "union") {
@@ -10502,6 +11041,11 @@ export function lowerObjectMethodCall(lowerer, call, access) {
             lowerUnionObjectDynFieldCall(lowerer, call, access, mappedReceiver);
         if (dispatched)
             return dispatched;
+        const arms = lowerer.unions.get(mappedReceiver.unionId)?.arms;
+        if (isJsSourceFile(call.getSourceFile()) && arms?.every((arm) => arm.kind === "object" &&
+            !lowerer.classes.get(arm.className)?.def.runtime) && lowerer.dynConvertible(mappedReceiver)) {
+            return lowerDynReceiverMethodCall(lowerer, call, access);
+        }
     }
     const receiverIr = mappedReceiver?.kind === "object"
         ? mappedReceiver
@@ -10614,6 +11158,21 @@ export function lowerObjectMethodCall(lowerer, call, access) {
                 return finish({ kind: "dynCall", callee, receiver, calleeName: access.getText(), args, type: DYN, loc });
             }
         }
+        if (!fieldType && isJsSourceFile(call.getSourceFile()) && !info.def.runtime && !info.builtinError && !info.builtinEmitter && !info.builtinStream) {
+            const loc = locOf(call);
+            const value = lowerReceiver();
+            const local = lowerer.declareHiddenLocal("%callReceiver", value.type);
+            const reference = { kind: "varRef", localId: local.id, type: value.type, loc };
+            const receiver = lowerer.coerceToExpected(reference, DYN);
+            const callee = { kind: "dynKeyGet", value: receiver,
+                key: { kind: "strLit", value: access.name.text, type: STRING, loc }, type: DYN, loc };
+            const spread = call.arguments.some(ts.isSpreadElement) ? lowerSpreadArgsCall(lowerer, call, callee, loc) : null;
+            if (spread && spread.kind !== "dynCall")
+                lowerer.unsupported("SC1090", call, "native property call spread arguments");
+            const result = spread !== null ? { ...spread, receiver } : { kind: "dynCall", callee, receiver,
+                calleeName: access.getText(), args: call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc };
+            return { kind: "seqExpr", stmts: [{ kind: "varDecl", localId: local.id, init: value, loc }], result, type: DYN, loc };
+        }
         return null;
     }
     if (!info || !found)
@@ -10633,7 +11192,7 @@ export function lowerObjectMethodCall(lowerer, call, access) {
         const fallback = virtual
             ? { kind: "virtualCall", className: info.def.name, method, args: [lowerer.upcastTo(value, info.def.name), ...args], type: found.sig.ret, loc }
             : { kind: "call", callee: `%${found.declarer.def.name}.${method}`, args: [lowerer.upcastTo(value, found.declarer.def.name), ...args], type: found.sig.ret, loc };
-        const result = classCallbackCall(lowerer, value, method, call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), fallback, loc);
+        const result = classCallbackCall(lowerer, value, method, call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), fallback, loc, access.getText());
         return { kind: "seqExpr", stmts: [{ kind: "varDecl", localId: local.id, init: receiver, loc }], result, type: result.type, loc };
     }
     if (found.declarer.builtinError) {
@@ -10696,6 +11255,22 @@ function lowerUnionObjectMethodCall(lowerer, call, access, receiverT) {
         plans.push({ arm, info, found });
     }
     const shapes = plans[0].found.sig.params;
+    if (plans.some((plan) => isClassCallback(lowerer, plan.info, method))) {
+        const loc = locOf(call);
+        const local = lowerer.declareHiddenLocal("%unionMethodReceiver", DYN);
+        const receiver = varRef(local.id, DYN, loc);
+        const callee = { kind: "dynKeyGet", value: receiver,
+            key: { kind: "strLit", value: method, type: STRING, loc }, type: DYN, loc };
+        const spread = call.arguments.some(ts.isSpreadElement) ? lowerSpreadArgsCall(lowerer, call, callee, loc) : null;
+        if (spread && spread.kind !== "dynCall")
+            lowerer.unsupported("SC1090", call, "union method spread arguments");
+        const value = spread !== null ? { ...spread, receiver } : { kind: "dynCall", callee, receiver,
+            calleeName: access.getText(), args: call.arguments.map((arg) => lowerer.lowerExprExpecting(arg, DYN)), type: DYN, loc };
+        const resultT = lowerer.mapTypeOf(lowerer.typeOf(call));
+        const result = resultT && !isUnitType(resultT) ? lowerer.coerceToExpected(value, resultT) : value;
+        return { kind: "seqExpr", stmts: [{ kind: "varDecl", localId: local.id,
+                    init: lowerer.coerceInto(access.expression, lowerer.lowerExpr(access.expression), DYN), loc }], result, type: result.type, loc };
+    }
     if (!plans.every((plan) => paramAbisEqual(shapes, plan.found.sig.params)))
         return null;
     const resultT = lowerer.mapTypeOf(lowerer.typeOf(call));