@scriptc/compiler 0.2.5 → 0.2.7

package/dist/frontend/lowering/lower-exprs.js

@@ -1,4 +1,8 @@
-import { dynUndefinedExpr, nodeThrowExpr, countedFor, numLit, strLit, varRef, } from "../../ir/build.js";
+import { generatorDrain } from "./iterator-adapters.js";
+import { lowerUnionEquality, tagEqualityMayMissAlias } from "./strict-equality.js";
+import { isOptionalProcessStreamProperty } from "./builtins/process.js";
+import { lowerWorkerMetadata } from "./builtins/workers.js";
+import { dynUndefinedExpr, nodeThrowExpr, numLit, strLit, varRef } from "../../ir/build.js";
 import { InternalCompilerError } from "../../errors.js";
 import { SYMBOL_T } from "../../ir/ir.js";
 import { literalValues } from "../literal-values.js";
@@ -10,8 +14,12 @@ import { literalUnionArm } from "../union-discriminants.js";
  * ToBoolean/ToString coercion helpers, and field/element reads and writes
  * (FieldTarget). */
 import * as ts from "../ts7/adapter.js";
+import { constituentTypes } from "../ts7/checker.js";
 import { dirname } from "node:path";
 import * as posix from "node:path/posix";
+import { checkedClassAssertion } from "./class-assertions.js";
+import { narrowClassUnion, narrowStoredClassValue } from "./class-unions.js";
+import { lowerUnionFieldWrite } from "./expressions/union-field-write.js";
 import { captureContextArguments } from "./function-context.js";
 import { OBJECT_CALLABLE_VALUES } from "./surfaces.js";
 import { wasiGuestPath } from "../../wasi-paths.js";
@@ -21,9 +29,8 @@ import { ARRAY_METHODS, builtinConstLit, builtinFenceHintOf, builtinModuleConstO
 import { UNSUPPORTED, blockedBindingUseDiag, requiresDynamicPackageDiag, unsupportedDiag, } from "../../diagnostics/diagnostic.js";
 import { PoisonError, dynFallbackType, jsFuncNameOf, neverTaintedJsType, own } from "./lowerer.js";
 import { lowerCollectionSpread } from "./containers/collection-methods.js";
-import { lowerNpmStaticSafeIndexRead, lowerSafeIndexRead, tryLowerNumericIndexRead, } from "./containers/array-methods.js";
+import { arrayValueRead, arrayValueStore, arrayValueType, lowerSafeIndexRead, tryLowerIndexTruthiness, tryLowerNumericIndexRead, } from "./array-values.js";
 import { strCharsCall } from "./containers/array-construction.js";
-import { arrayValueRead, arrayValueStore, arrayValueType } from "./array-values.js";
 import { lowerOptionalStringIndex } from "./string-index.js";
 import { tryLowerIndexedComparison } from "./indexed-comparison.js";
 import { npmStaticPackageOfPath } from "../npm-static.js";
@@ -96,8 +103,8 @@ export function templateRawTextOf(node) {
 const LOWER_EXPR_MAX_DEPTH = 200;
 let lowerExprDepth = 0;
 /** True when a property access names an ABSTRACT property declaration
- * (`abstract p: number` — a PropertyDeclaration, not an accessor): the
- * named-fence test for reads/writes through abstract-typed receivers. */
+ * (`abstract p: number` — a PropertyDeclaration, not an accessor).
+ * These uses need concrete property dispatch because the base has no slot. */
 export function abstractPropertyDeclOf(lowerer, expr) {
     const sym = lowerer.checker.getSymbolAtLocation(expr.name);
     if (!sym)
@@ -159,7 +166,10 @@ export function lowerExpr(lowerer, expr) {
     }
     lowerExprDepth++;
     try {
-        return lowerExprInner(lowerer, expr);
+        const lowered = lowerExprInner(lowerer, expr);
+        if (lowered.type.kind === "void" && (lowerer.typeOf(expr).flags & ts.TypeFlags.Never) !== 0)
+            lowerer.neverValued.add(lowered);
+        return lowered;
     }
     finally {
         lowerExprDepth--;
@@ -286,6 +296,11 @@ function lowerExprInner(lowerer, expr) {
     if (ts.isNonNullExpression(expr)) {
         const inner = lowerer.lowerExpr(expr.expression);
         if (inner.type.kind === "union") {
+            // `!` performs no runtime check: a missing array element stays
+            // undefined where its destination can hold it.
+            if (ts.isElementAccessExpression(expr.expression) &&
+                assertedElementKeepsUndefined(lowerer, expr))
+                return inner;
             const use = runtimeOptionalUseOf(expr);
             if (runtimeOptionalAssertionErases(lowerer, expr, inner, use))
                 return inner;
@@ -1112,6 +1127,11 @@ function lowerExprInner(lowerer, expr) {
         {
             const bi = lowerer.builtinImportOf(expr);
             if (bi) {
+                if (bi.module === "worker_threads") {
+                    const value = lowerWorkerMetadata(bi.member, loc);
+                    if (value)
+                        return value;
+                }
                 const c = builtinModuleConstOf(lowerer, bi.module, bi.member);
                 if (c !== undefined)
                     return builtinConstLit(c, loc);
@@ -1323,7 +1343,7 @@ function lowerExprInner(lowerer, expr) {
                     Proxy: "Proxy constructor values have no native lowering; use a direct new Proxy with checked-native plain objects",
                     Reflect: "reflective property access has no static lowering — read and call members directly",
                     Intl: 'native Intl supports default Unicode grapheme segmentation and the composed new Intl.NumberFormat("en-US").format(x); locale negotiation and other ICU-backed operations remain unsupported',
-                    SharedArrayBuffer: "no shared-memory threads exist in a compiled program — Uint8Array is the byte storage",
+                    SharedArrayBuffer: "use direct new SharedArrayBuffer(length) for fixed shared storage",
                     ArrayBuffer: "ArrayBuffer constructor values have no native lowering; use new ArrayBuffer(length) for fixed-length shared storage",
                     WeakRef: "deref()-after-collect exposes GC timing — genuinely dynamic; hold a strong reference instead",
                     FinalizationRegistry: "finalization callbacks expose GC timing — genuinely dynamic; release resources explicitly instead",
@@ -3068,6 +3088,11 @@ export function maybeNarrow(lowerer, expr, node) {
     // same trust-the-checker contract as the union bridge below.
     if (expr.type.kind === "object") {
         const narrowed = lowerer.mapTypeOf(lowerer.typeOf(node));
+        if (narrowed?.kind === "union") {
+            const union = narrowClassUnion(lowerer, expr, narrowed);
+            if (union)
+                return union;
+        }
         if (narrowed?.kind === "object" &&
             narrowed.className !== expr.type.className &&
             lowerer.isSubclassOf(narrowed.className, expr.type.className)) {
@@ -3077,6 +3102,8 @@ export function maybeNarrow(lowerer, expr, node) {
     }
     if (expr.type.kind !== "union")
         return expr;
+    if (ts.isPropertyAccessExpression(node) && isOptionalProcessStreamProperty(lowerer, node))
+        return expr;
     // Represented fields and index values can include undefined even when
     // checker inference or lib.d.ts declares strings (RegExp captures).
     // Only a declaration that represents the optional arm can provide a
@@ -3221,6 +3248,9 @@ function runtimeOptionalReceiverRead(lowerer, expr, local, property, loc) {
         lowerer.unsupported("SC1090", expr, "a runtime-optional capture whose narrowed value type is not representable");
     }
     if (narrowed.kind === "union") {
+        const classView = narrowStoredClassValue(lowerer, varRef(local.id, local.type, loc), narrowed);
+        if (classView)
+            return classView;
         // The checker may keep the receiver at the storage union unchanged
         // (`string | undefined` on a JS `.match()` call). There is no
         // sub-union to re-tag: preserve the value for the downstream
@@ -3235,7 +3265,7 @@ function runtimeOptionalReceiverRead(lowerer, expr, local, property, loc) {
         // undefined arm; re-tag it to the checker-narrowed value union with a
         // checked trap for that arm, then let union property lowering inspect
         // the surviving record arms.
-        const helper = lowerer.narrowedRetagHelper(expr, local.type.unionId, narrowed.unionId, loc);
+        const helper = lowerer.narrowedRetagHelper(narrowedNode, local.type.unionId, narrowed.unionId, loc);
         if (!helper) {
             lowerer.unsupported("SC1090", expr, "a runtime-optional capture whose narrowed union is not representable");
         }
@@ -3247,6 +3277,13 @@ function runtimeOptionalReceiverRead(lowerer, expr, local, property, loc) {
             loc,
         };
     }
+    if (narrowed.kind === "object") {
+        const view = checkedClassAssertion(lowerer, varRef(local.id, local.type, loc), narrowed, loc);
+        // Preserve the member-specific missing-value error on the two-arm
+        // path below; mixed storage also needs to validate its concrete class.
+        if (view && (lowerer.unions.get(local.type.unionId)?.arms.length ?? 0) > 2)
+            return view;
+    }
     const undefTag = lowerer.armTag(local.type.unionId, UNDEFINED_T);
     const def = lowerer.unions.get(local.type.unionId);
     if (!def || undefTag < 0)
@@ -3401,6 +3438,45 @@ function runtimeOptionalElementKey(expr) {
         return expr.text;
     return null;
 }
+/** Whether `xs[i]!` lands where an absent element's undefined is
+ * representable: array storage (a literal element, a push/unshift
+ * argument, an element assignment — arrays record the undefined state),
+ * an equality operand, or a slot whose contextual type admits undefined.
+ * TypeScript's `!` has no runtime effect, so such reads stay optional. */
+function assertedElementKeepsUndefined(lowerer, node) {
+    let outer = node;
+    while (ts.isParenthesizedExpression(outer.parent))
+        outer = outer.parent;
+    const parent = outer.parent;
+    if (ts.isArrayLiteralExpression(parent))
+        return true;
+    // An equality test observes the missing element itself.
+    if (ts.isBinaryExpression(parent) &&
+        (parent.operatorToken.kind === ts.SyntaxKind.EqualsEqualsEqualsToken ||
+            parent.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken ||
+            parent.operatorToken.kind === ts.SyntaxKind.EqualsEqualsToken ||
+            parent.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsToken))
+        return true;
+    const isArray = (receiver) => lowerer.checker.isArrayType(lowerer.typeOf(receiver));
+    if (ts.isCallExpression(parent) &&
+        parent.arguments.includes(outer) &&
+        ts.isPropertyAccessExpression(parent.expression) &&
+        (parent.expression.name.text === "push" || parent.expression.name.text === "unshift") &&
+        isArray(parent.expression.expression))
+        return true;
+    if (ts.isBinaryExpression(parent) &&
+        parent.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
+        parent.right === outer &&
+        ts.isElementAccessExpression(parent.left) &&
+        isArray(parent.left.expression))
+        return true;
+    const contextual = lowerer.checker.getContextualType(outer);
+    if (!contextual)
+        return false;
+    const admits = (type) => (type.flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown | ts.TypeFlags.Undefined)) !== 0;
+    return (admits(contextual) ||
+        ((contextual.flags & ts.TypeFlags.Union) !== 0 && constituentTypes(contextual).some(admits)));
+}
 function runtimeOptionalAssertionErases(lowerer, expr, inner, use) {
     if (inner.type.kind !== "union" ||
         !use?.optional ||
@@ -3648,6 +3724,32 @@ export function lowerNullishCoalesce(lowerer, expr, loc) {
     }
     return result;
 }
+/** A plain value read that may be runtime-optional: an unchecked element
+ * read, or a binding, member or call that carries one. Lowering these
+ * without a destination type is the same as lowering them into one. */
+function isPlainValueRead(node) {
+    while (ts.isParenthesizedExpression(node))
+        node = node.expression;
+    return (ts.isElementAccessExpression(node) ||
+        ts.isIdentifier(node) ||
+        ts.isPropertyAccessExpression(node) ||
+        ts.isCallExpression(node));
+}
+/** A member access or call receiver needs the present value itself (JS
+ * throws a TypeError reading a member of undefined). */
+function isMemberReceiver(node) {
+    let child = node;
+    let parent = node.parent;
+    while (ts.isParenthesizedExpression(parent)) {
+        child = parent;
+        parent = parent.parent;
+    }
+    return (((ts.isPropertyAccessExpression(parent) ||
+        ts.isElementAccessExpression(parent) ||
+        ts.isCallExpression(parent)) &&
+        parent.expression === child) ||
+        (ts.isTaggedTemplateExpression(parent) && parent.tag === child));
+}
 function lowerNullishPair(lowerer, expr, loc, left) {
     if (left.type.kind === "dyn") {
         // `a ?? b` on a CHECKED-DYNAMIC left: the deciding test is the
@@ -3684,7 +3786,24 @@ function lowerNullishPair(lowerer, expr, loc, left) {
     const fresh = rest.length === 1 ? lowerer.emptyCollectionFor(expr.right, rest[0]) : null;
     if (fresh)
         return { kind: "nullish", left, right: fresh, type: fresh.type, loc };
-    const type = lowerer.irTypeOf(expr);
+    let type = lowerer.irTypeOf(expr);
+    // A runtime-optional read can reach the default even when declarations
+    // call the left side present. Preserve a differently typed primitive
+    // fallback rather than checking it against that incomplete result type.
+    const rightType = lowerer.mapTypeOf(lowerer.typeOf(expr.right));
+    const primitive = (t) => t.kind === "f64" || t.kind === "string" || t.kind === "bool";
+    if (rightType &&
+        primitive(type) &&
+        primitive(rightType) &&
+        !typeEquals(type, rightType) &&
+        rest.every(primitive)) {
+        const arms = [...rest];
+        if (!arms.some((arm) => typeEquals(arm, rightType)))
+            arms.push(rightType);
+        arms.sort((a, b) => (typeKey(a) < typeKey(b) ? -1 : 1));
+        type = { kind: "union", unionId: lowerer.unions.intern(arms) };
+        lowerer.runtimeOptionalArithmeticTypes.set(expr, type);
+    }
     if (type.kind === "dyn" && lowerer.dynConvertible(left.type)) {
         return {
             kind: "nullish",
@@ -3694,6 +3813,27 @@ function lowerNullishPair(lowerer, expr, loc, left) {
             loc,
         };
     }
+    // A runtime-optional default (`name ?? names[0]`): the checker types an
+    // unchecked element read as the bare element type, but an out-of-range
+    // read is undefined at runtime. When the default shares the left's
+    // optional union, that union is the result, so the undefined state
+    // reaches the consumer (an optional return or parameter takes it as its
+    // undefined arm; a plain slot still extracts the element with its
+    // checked narrow).
+    if (rest.length === 1 &&
+        typeEquals(type, rest[0]) &&
+        isPlainValueRead(expr.right) &&
+        !isMemberReceiver(expr)) {
+        const raw = lowerer.lowerExpr(expr.right);
+        if (typeEquals(raw.type, left.type))
+            return { kind: "nullish", left, right: raw, type: left.type, loc };
+        // `names[0] ?? undefined`: an explicit unit default stays the left's arm.
+        if (isUnitType(raw.type) && lowerer.armTag(left.type.unionId, raw.type) >= 0) {
+            const right = lowerer.coerceInto(expr.right, raw, left.type);
+            return { kind: "nullish", left, right, type: left.type, loc };
+        }
+        return { kind: "nullish", left, right: lowerer.coerceInto(expr.right, raw, type), type, loc };
+    }
     if (typeEquals(type, left.type) || (rest.length === 1 && typeEquals(type, rest[0]))) {
         const right = lowerer.lowerExprExpecting(expr.right, type);
         return { kind: "nullish", left, right, type, loc };
@@ -3817,7 +3957,8 @@ export function lowerCondition(lowerer, expr) {
             };
         }
     }
-    return lowerer.ensureBool(lowerAbsenceProbe(lowerer, expr) ?? lowerer.lowerExpr(expr), expr);
+    const value = lowerAbsenceProbe(lowerer, expr) ?? lowerer.lowerExpr(expr);
+    return (tryLowerIndexTruthiness(lowerer, value, expr, locOf(expr)) ?? lowerer.ensureBool(value, expr));
 }
 function lowerPromiseThenPresence(lowerer, access, result) {
     if (access.name.text !== "then")
@@ -5024,6 +5165,13 @@ export function lowerArrayLiteral(lowerer, expr, expected) {
                     loc: locOf(el),
                 };
             }
+            // `[...it]` over a generator (or an iterator adapted into one):
+            // drain it once, in order, into a fresh element array.
+            if (src.type.kind === "generator") {
+                const drained = generatorDrain(lowerer, src, type.elem, locOf(el));
+                if (drained)
+                    src = drained;
+            }
             // A native checked iterable can supply scalar elements even when
             // the checker inferred a typed array from its producer. Drain once
             // and validate the elements before the ordinary spread copy.
@@ -5547,7 +5695,7 @@ export function lowerElementAccess(lowerer, expr) {
         // declared number type.
         if (recv.type.kind === "jsval")
             return islandElementRead(lowerer, expr, recv);
-        const index = lowerer.lowerExpr(expr.argumentExpression);
+        const index = lowerOptionalNumber(lowerer, lowerer.lowerExpr(expr.argumentExpression), locOf(expr.argumentExpression), expr.argumentExpression);
         if (isJsSourceFile(expr.getSourceFile()) && recv.type.kind === "bytes") {
             return {
                 kind: "dynKeyGet",
@@ -5804,36 +5952,12 @@ export function lowerElementAccess(lowerer, expr) {
             }
         }
         if (receiverIr?.kind === "string") {
-            // `s[i]` with a number index reads a UTF-16 code unit — charAt's
-            // exact job (the UTF-16-exact runtime). Without
-            // noUncheckedIndexedAccess the checker types the read `string`,
-            // and charAt's "" is the only string-typed answer for an
-            // out-of-range or fractional index where JS reads `undefined` —
-            // SEMANTICS.md documents the divergence; in-range integer reads
-            // (the loop pattern) are JS-exact. Optional results instead retain
-            // undefined for missing string properties.
+            // An indexed string property is absent for non-integer and missing
+            // indexes. charAt has different coercion and out-of-range semantics.
             const recv = lowerer.lowerExpr(expr.expression);
-            const index = lowerer.lowerExpr(expr.argumentExpression);
-            const resultType = lowerer.mapTypeOf(lowerer.typeOf(expr));
+            const index = lowerOptionalNumber(lowerer, lowerer.lowerExpr(expr.argumentExpression), locOf(expr.argumentExpression), expr.argumentExpression);
             if (index.type.kind === "f64" && recv.type.kind === "string") {
-                if (resultType?.kind === "string") {
-                    return {
-                        kind: "strIntrinsic",
-                        method: "charAt",
-                        receiver: recv,
-                        args: [index],
-                        type: STRING,
-                        loc: locOf(expr),
-                    };
-                }
-                if (resultType?.kind === "union") {
-                    const arms = lowerer.unions.get(resultType.unionId)?.arms;
-                    if (arms?.length === 2 &&
-                        lowerer.armTag(resultType.unionId, STRING) >= 0 &&
-                        lowerer.armTag(resultType.unionId, UNDEFINED_T) >= 0) {
-                        return lowerOptionalStringIndex(lowerer, recv, index, resultType, locOf(expr));
-                    }
-                }
+                return lowerOptionalStringIndex(lowerer, recv, index, lowerer.withUndefinedArm(STRING), locOf(expr));
             }
             lowerer.unsupported("SC1090", expr, "string indexing with this index/result shape (expected a number index and a string or string | undefined result)");
         }
@@ -5955,10 +6079,13 @@ export function lowerElementAccess(lowerer, expr) {
     // change the storage representation or the low-level getter itself.
     if (arr.type.kind === "array") {
         // A non-null assertion is the explicit proven-present form. Preserve
-        // the dense getter's established bounds trap here; turning `xs[i]!`
-        // into an optional union would change library ABI checks and the
-        // existing catchable RangeError contract for an out-of-bounds assert.
-        const provenPresent = ts.isNonNullExpression(expr.parent) && expr.parent.expression === expr;
+        // the dense getter's established bounds trap where the asserted value
+        // must be the element type (library ABI checks and the catchable
+        // RangeError contract for an out-of-bounds assert). Where undefined is
+        // representable, the assertion keeps JavaScript's unchecked read.
+        const provenPresent = ts.isNonNullExpression(expr.parent) &&
+            expr.parent.expression === expr &&
+            !assertedElementKeepsUndefined(lowerer, expr.parent);
         if (provenPresent) {
             return lowerer.maybeNarrow({ kind: "arrayGet", arr, index, type: elemT, loc: locOf(expr) }, expr);
         }
@@ -5972,7 +6099,7 @@ export function lowerElementAccess(lowerer, expr) {
         arr.kind === "arrIntrinsic" &&
         arr.method === "slice" &&
         npmStaticPackageOfPath(expr.getSourceFile().fileName) !== null) {
-        const safe = lowerNpmStaticSafeIndexRead(lowerer, arr, index, locOf(expr));
+        const safe = lowerSafeIndexRead(lowerer, arr, index, locOf(expr));
         if (safe)
             return safe;
     }
@@ -6218,6 +6345,10 @@ export function lowerAbsenceProbe(lowerer, node) {
         expr = expr.expression;
     }
     if (ts.isPropertyAccessExpression(expr)) {
+        // Namespace members are bindings, not fields of a runtime namespace
+        // object. Their ordinary read already preserves optional storage.
+        if (!expr.questionDotToken && nsMemberIdentOf(lowerer, expr))
+            return null;
         const target = lowerer.fieldTarget(expr);
         if (target?.container === "class" &&
             target.fieldType.kind === "union" &&
@@ -7180,6 +7311,19 @@ export function ensureString(lowerer, e, node) {
                 return ensureString(lowerer, { kind: "call", callee: helper, args: [e], type: narrowed, loc: e.loc }, node);
             }
         }
+        if (narrowed?.kind === "union" &&
+            !typeEquals(narrowed, e.type) &&
+            lowerer.unions
+                .get(narrowed.unionId)
+                ?.arms.every((arm) => isUnitType(arm) ||
+                arm.kind === "string" ||
+                arm.kind === "f64" ||
+                arm.kind === "bool" ||
+                arm.kind === "bigint")) {
+            const helper = lowerer.narrowedRetagHelper(node, e.type.unionId, narrowed.unionId, e.loc);
+            if (helper)
+                return ensureString(lowerer, { kind: "call", callee: helper, args: [e], type: narrowed, loc: e.loc }, node);
+        }
         lowerer.unsupported("SC1090", node, `string conversions of unions with object arms (${NARROW_FIRST})`);
     }
     if (e.type.kind === "symbol") {
@@ -7353,20 +7497,16 @@ export function lowerAsExpression(lowerer, expr) {
                 };
             }
         }
-        // Narrowed reads (`err instanceof Error` proven) still pass below;
-        // other targets keep the narrowness fence with the checked-cast fix.
-        // In a JS FILE the AsExpression is tsgo's spelling of a JSDoc cast
-        // (`/** @type {T} */ (e)` — JS has no `as`); 5.9.3 parsed that as a
-        // plain parenthesized read, which lowered caught→dyn and met the
-        // target through the ordinary checked-cast coercion — so the dyn
-        // bridge stays open here exactly for that shape.
+        // Structural assertions use the ordinary checked dynamic bridge. It
+        // retains primitive values and native class identity before validating
+        // the requested shape; an assertion does not bypass runtime checks.
         const narrowed = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
         const bridged = narrowed &&
             (narrowed.kind === "f64" ||
                 narrowed.kind === "bool" ||
                 narrowed.kind === "string" ||
                 narrowed.kind === "object" ||
-                (narrowed.kind === "dyn" && isJsSourceFile(expr.getSourceFile())));
+                narrowed.kind === "dyn");
         if (!bridged)
             lowerer.unsupported("SC1063", expr);
     }
@@ -7381,6 +7521,11 @@ export function lowerAsExpression(lowerer, expr) {
             return lowerer.jsvalIn(inner, expr.expression);
         }
         const target = lowerer.mapTypeOf(targetTs0);
+        if (target?.kind === "object") {
+            const asserted = checkedClassAssertion(lowerer, inner, target, locOf(expr));
+            if (asserted)
+                return asserted;
+        }
         // Unknown-only record views use the checked-dynamic representation.
         // A native record asserted to such a view still denotes the original
         // object. Box a live reference instead of erasing the assertion and
@@ -7613,11 +7758,11 @@ export function lowerIncDec(lowerer, expr, prefix) {
         }
         fenceNodeModuleMutation(lowerer, access, "assignment");
         if (ts.isPropertyAccessExpression(access)) {
-            const target = staticFieldWriteTarget(lowerer, access);
+            const target = staticFieldWriteTarget(lowerer, access) ??
+                expandoWritableTarget(lowerer, access) ??
+                nsWritableTarget(lowerer, access);
             if (target) {
-                if (target.type.kind !== "f64")
-                    lowerer.unsupported("SC1043", expr);
-                return { kind: "incDec", op, prefix, localId: target.id, type: F64, loc };
+                return lowerIncDecTarget(lowerer, expr, target, prefix);
             }
         }
         const stmts = [];
@@ -7729,10 +7874,18 @@ export function lowerIncDec(lowerer, expr, prefix) {
     if (!target) {
         lowerer.rejectUnresolved(expr.operand, `increment/decrement of '${expr.operand.text}' (not a writable local or module global)`);
     }
+    return lowerIncDecTarget(lowerer, expr, target, prefix);
+}
+/** Numeric updates read the represented slot once and write the computed
+ * value back in that same representation. In particular, an unchecked
+ * indexed initializer can leave undefined in an otherwise numeric binding. */
+export function lowerIncDecTarget(lowerer, expr, target, prefix) {
+    const loc = locOf(expr);
+    const op = expr.operator === ts.SyntaxKind.PlusPlusToken ? "+" : "-";
     if (target.type.kind === "dyn") {
         const old = lowerer.declareHiddenLocal("%numericOld", DYN);
         const next = lowerer.declareHiddenLocal("%numericNext", DYN);
-        const read = lowerer.lowerExpr(expr.operand);
+        const read = varRef(target.id, target.type, loc);
         return {
             kind: "seqExpr",
             stmts: [
@@ -7764,6 +7917,42 @@ export function lowerIncDec(lowerer, expr, prefix) {
             loc,
         };
     }
+    if (target.type.kind === "union") {
+        const read = lowerOptionalNumber(lowerer, varRef(target.id, target.type, loc), loc, expr.operand);
+        if (read.type.kind === "f64") {
+            const old = lowerer.declareHiddenLocal("%numericOld", F64);
+            const next = lowerer.declareHiddenLocal("%numericNext", F64);
+            const result = varRef(prefix ? next.id : old.id, F64, loc);
+            return {
+                kind: "seqExpr",
+                stmts: [
+                    { kind: "varDecl", localId: old.id, init: read, loc },
+                    {
+                        kind: "varDecl",
+                        localId: next.id,
+                        init: {
+                            kind: "bin",
+                            op,
+                            left: varRef(old.id, F64, loc),
+                            right: numLit(1, loc),
+                            type: F64,
+                            loc,
+                        },
+                        loc,
+                    },
+                    {
+                        kind: "assign",
+                        localId: target.id,
+                        value: lowerer.coerceInto(expr.operand, varRef(next.id, F64, loc), target.type),
+                        loc,
+                    },
+                ],
+                result,
+                type: F64,
+                loc,
+            };
+        }
+    }
     if (target.type.kind !== "f64")
         lowerer.unsupported("SC1043", expr);
     return { kind: "incDec", op, prefix, localId: target.id, type: F64, loc };
@@ -7858,14 +8047,18 @@ export function lowerCompoundValueToTarget(lowerer, expr, compound, target) {
         };
         return lowerer.coerceInto(expr, wrapped, target.type);
     }
-    if (compound === "+" && target.type.kind === "string") {
-        return {
+    if (compound === "+" &&
+        (target.type.kind === "string" ||
+            (target.type.kind === "union" &&
+                lowerer.stripUndefinedArm(target.type).kind === "string" &&
+                rhs.type.kind === "string"))) {
+        return lowerer.coerceInto(expr, {
             kind: "strConcat",
-            left: read,
+            left: lowerer.ensureString(read, expr.left),
             right: lowerer.ensureString(rhs, expr.right),
             type: STRING,
             loc,
-        };
+        }, target.type);
     }
     if (numericRead.type.kind === "f64" && numericRhs.type.kind === "f64") {
         return lowerer.coerceInto(expr, { kind: "bin", op: compound, left: numericRead, right: numericRhs, type: F64, loc }, target.type);
@@ -8120,6 +8313,9 @@ export function lowerBinary(lowerer, expr) {
                 const recv = tryLowerExpression(lowerer, expr.left.expression);
                 if (recv && recv.type.kind === "dyn")
                     return lowerDynMemberAssignment(lowerer, expr, recv);
+                const unionWrite = lowerUnionFieldWrite(lowerer, expr.left, expr.right);
+                if (unionWrite)
+                    return unionWrite;
                 const field = lowerer.fieldTarget(expr.left);
                 if (field) {
                     const recvTmp = lowerer.declareHiddenLocal("%setReceiver", field.obj.type);
@@ -8705,7 +8901,7 @@ export function lowerBinary(lowerer, expr) {
             const optionalStringPlus = lowerOptionalStringPlus();
             if (optionalStringPlus)
                 return optionalStringPlus;
-            if (isJsSourceFile(expr.getSourceFile())) {
+            {
                 const primitive = (type) => type.kind === "f64" ||
                     type.kind === "string" ||
                     type.kind === "bool" ||
@@ -8811,6 +9007,13 @@ export function lowerBinary(lowerer, expr) {
             if (unitTest)
                 return unitTest;
             if (left.type.kind === "union" || right.type.kind === "union") {
+                const compared = lowerUnionEquality(lowerer, left, right, negated, false, loc);
+                if (compared)
+                    return compared;
+                const aliasRefusal = (type) => {
+                    if (tagEqualityMayMissAlias(lowerer, type))
+                        lowerer.unsupported("SC1090", expr, `comparisons of related class values beside structural union members (${NARROW_FIRST})`);
+                };
                 // JS strict equality of the ARM values, per union tag (a
                 // per-union helper): equal tags compare payloads (f64 ==, string
                 // bytes, bool ==, ref-arm POINTER identity), different tags are
@@ -8846,6 +9049,7 @@ export function lowerBinary(lowerer, expr) {
                     };
                 }
                 if ((sameUnion || !bothUnion) && lowerer.eqComparableUnion(ut.unionId)) {
+                    aliasRefusal(ut);
                     return {
                         kind: "unionEq",
                         unionId: ut.unionId,
@@ -8876,6 +9080,7 @@ export function lowerBinary(lowerer, expr) {
                                 kind: "union",
                                 unionId: lowerer.unions.intern(arms),
                             };
+                            aliasRefusal(common);
                             return {
                                 kind: "unionEq",
                                 unionId: common.unionId,
@@ -10021,17 +10226,30 @@ export function caughtRead(lowerer, node, local, loc) {
     }
     if (narrowed?.kind === "object") {
         const info = lowerer.classes.get(narrowed.className);
-        if (info && lowerer.inHierarchy(info)) {
-            return { kind: "caughtNarrow", value: ref, type: narrowed, loc };
+        if (info) {
+            const value = { kind: "caughtNarrow", value: ref, type: narrowed, loc };
+            if (lowerer.inHierarchy(info))
+                return value;
+            return {
+                kind: "ternary",
+                cond: {
+                    kind: "caughtTest",
+                    value: ref,
+                    test: "instanceof",
+                    className: info.def.name,
+                    type: BOOL,
+                    loc,
+                },
+                then: value,
+                else_: lowerer.coerceInto(node, { kind: "caughtToDyn", value: ref, type: DYN, loc }, narrowed),
+                type: narrowed,
+                loc,
+            };
         }
     }
-    // An UN-narrowed use — the occurrence still types `unknown` — converts
-    // to a dyn value (`options.onError?.(error)` — the caught snapshot
-    // flowing into an unknown slot): the typed→unknown deep-copy stance
-    // extended to exception payloads. Error payloads keep their
-    // observability (instanceof Error / .message / String() — the checked-dynamic tree's
-    // error encoding); other object payloads are type-erased at runtime and
-    // convert to the "[object Object]" approximation — SEMANTICS.md 67.
+    // Unnarrowed reads cross into unknown. The caught-value dispatch pass
+    // retains known native class payloads through live identity capsules;
+    // other payload kinds use the runtime's ordinary conversion.
     if (narrowed?.kind === "dyn") {
         return { kind: "caughtToDyn", value: ref, type: DYN, loc };
     }
@@ -10097,6 +10315,38 @@ export function lowerInstanceOf(lowerer, expr, loc) {
         (lowerer.isStdlibGlobal(expr.right, "Set") || lowerer.isStdlibGlobal(expr.right, "Map"))) {
         const collection = lowerer.isStdlibGlobal(expr.right, "Map") ? "map" : "set";
         const value = lowerer.lowerExpr(expr.left);
+        if (value.type.kind === "union") {
+            const union = lowerer.unions.get(value.type.unionId);
+            if (union) {
+                const local = lowerer.declareHiddenLocal("%collectionTest", value.type);
+                const reference = varRef(local.id, value.type, loc);
+                let result = { kind: "boolLit", value: false, type: BOOL, loc };
+                union.arms.forEach((arm, tag) => {
+                    if (arm.kind !== collection)
+                        return;
+                    const test = {
+                        kind: "unionIsTag",
+                        unionId: union.id,
+                        value: reference,
+                        tag,
+                        negated: false,
+                        type: BOOL,
+                        loc,
+                    };
+                    result =
+                        result.kind === "boolLit"
+                            ? test
+                            : { kind: "logical", op: "||", left: result, right: test, type: BOOL, loc };
+                });
+                return {
+                    kind: "seqExpr",
+                    stmts: [{ kind: "varDecl", localId: local.id, init: value, loc }],
+                    result,
+                    type: BOOL,
+                    loc,
+                };
+            }
+        }
         if (value.type.kind === "dyn")
             return {
                 kind: "libCall",
@@ -10158,6 +10408,10 @@ export function lowerInstanceOf(lowerer, expr, loc) {
         const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
         return { kind: "libCall", fn: "dyn.dataViewIs", args: [value], type: BOOL, loc };
     }
+    if (lowerer.isStdlibGlobal(expr.right, "SharedArrayBuffer")) {
+        const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
+        return { kind: "libCall", fn: "sharedArrayBuffer.is", args: [value], type: BOOL, loc };
+    }
     if (lowerer.isStdlibGlobal(expr.right, "ArrayBuffer")) {
         const value = lowerer.coerceInto(expr.left, lowerer.lowerExpr(expr.left), DYN);
         return { kind: "libCall", fn: "arrayBuffer.is", args: [value], type: BOOL, loc };
@@ -10370,8 +10624,22 @@ export function lowerInstanceOf(lowerer, expr, loc) {
     const caughtLocal = lowerer.caughtLocalOf(expr.left);
     if (caughtLocal) {
         if (!lowerer.inHierarchy(target)) {
-            lowerer.unsupported("SC1090", expr, `'instanceof' on a catch binding against the standalone class '${target.def.name}' ` +
-                `(only classes in extends hierarchies carry the vtable the payload test needs)`);
+            const value = varRef(caughtLocal.id, CAUGHT, loc);
+            return {
+                kind: "ternary",
+                cond: {
+                    kind: "caughtTest",
+                    value,
+                    test: "instanceof",
+                    className: target.def.name,
+                    type: BOOL,
+                    loc,
+                },
+                then: { kind: "boolLit", value: true, type: BOOL, loc },
+                else_: classInstanceOf(lowerer, { kind: "caughtToDyn", value, type: DYN, loc }, target, loc),
+                type: BOOL,
+                loc,
+            };
         }
         return {
             kind: "caughtTest",
@@ -10669,11 +10937,10 @@ function lowerPrivateIn(lowerer, expr, priv, loc) {
  * type-directed: a declared non-optional field is a compile-time `true`,
  * a missing field (no index signature) a compile-time `false` — both
  * folds limited to side-effect-free receivers, the lowerInstanceOf rule —
- * and an OPTIONAL field (undefined-armed union) is a runtime tag test on
- * the slot: present iff the arm is not undefined. That last case is the
- * representation's honest answer — a field explicitly assigned
- * `undefined` reads as absent (`"a" in {a: undefined}` is true in JS,
- * false here; SEMANTICS.md 55). Union receivers (the `in`-narrowing
+ * and an OPTIONAL field (undefined-armed union) is a runtime presence
+ * test on the slot: an omitted or deleted property is absent, while a
+ * property explicitly holding `undefined` is present, as in JS
+ * (`"a" in {a: undefined}` is true). Union receivers (the `in`-narrowing
  * idiom over multiple shapes), index-signature keys, class instances,
  * and dyn/unknown stay fenced. Keys are literal strings — a computed key
  * over a shape would need the runtime key table. */
@@ -10717,13 +10984,42 @@ function lowerInExpression(lowerer, expr, loc) {
             }
         }
     }
+    // A RUNTIME numeric key over an ARRAY receiver (`if (i in arr)` in a
+    // loop) asks the same slot/property presence query as the literal fold
+    // above and `Object.hasOwn`. The checked-dynamic fallback below would
+    // box the receiver and materialize every element on each evaluation,
+    // which makes such loops quadratic. A Number key never names an
+    // inherited property: neither Array.prototype nor Object.prototype has
+    // index-like or numeric-string keys. JS evaluates the key before the
+    // receiver, so the key is stabilized in a hidden local first.
+    if (lowerer.mapTypeOf(lowerer.typeOf(expr.left))?.kind === "f64" &&
+        lowerer.mapTypeOf(lowerer.typeOf(expr.right))?.kind === "array") {
+        const k = lowerer.lowerExpr(expr.left);
+        const recvArr = lowerer.lowerExpr(expr.right);
+        if (k.type.kind === "f64" && recvArr.type.kind === "array") {
+            const keyLocal = lowerer.declareHiddenLocal("%inIndex", F64);
+            return {
+                kind: "seqExpr",
+                stmts: [{ kind: "varDecl", localId: keyLocal.id, init: k, loc }],
+                result: {
+                    kind: "arrayHas",
+                    arr: recvArr,
+                    index: varRef(keyLocal.id, F64, loc),
+                    type: BOOL,
+                    loc,
+                },
+                type: BOOL,
+                loc,
+            };
+        }
+    }
     const key = foldedStringKeyOf(lowerer, expr.left);
     if (key === null) {
         // A RUNTIME string key over an INDEX-SIGNATURE record receiver (the
         // `names.filter((k) => k in config)` idiom): the interned key-
         // presence helper — declared fields answer statically per name
-        // (optional slots per value: the undefined arm reads absent, stance
-        // 55), then the overflow map's live keys. Other receivers keep the
+        // (optional slots by their runtime presence), then the overflow
+        // map's live keys. Other receivers keep the
         // fence: fixed shapes want the literal folds above, and there is no
         // runtime key table to ask.
         const rIn = lowerRuntimeKeyIn(lowerer, expr, loc);
@@ -10966,24 +11262,9 @@ function lowerInExpression(lowerer, expr, loc) {
     const field = shape.fields.find((f) => f.name === key);
     if (field) {
         if (field.type.kind === "union" && lowerer.armTag(field.type.unionId, UNDEFINED_T) >= 0) {
-            // Optional slot: the key is present iff the arm is not undefined.
-            const read = {
-                kind: "recordGet",
-                obj: recv,
-                shapeId: recv.type.shapeId,
-                field: key,
-                type: field.type,
-                loc,
-            };
-            return {
-                kind: "unionIsTag",
-                unionId: field.type.unionId,
-                tag: lowerer.armTag(field.type.unionId, UNDEFINED_T),
-                negated: true,
-                value: read,
-                type: BOOL,
-                loc,
-            };
+            // Optional slot: the key is present unless the field is absent
+            // (omitted or deleted); an explicit undefined is present.
+            return lowerer.recordFieldPresent(recv, recv.type.shapeId, key, loc);
         }
         // A declared non-optional field always exists on every value of the
         // shape — statically true, but folding may only drop a
@@ -11023,9 +11304,9 @@ function lowerInExpression(lowerer, expr, loc) {
  * runtime string and r an index-signature record — an interned
  * `%rec.haskey.<n>(k, r)` walks the declared names (a string-equality
  * chain: non-optional fields and accessor slots answer true, optional
- * slots answer their per-value tag test) and then the overflow map's
- * live keys. Null when the pair is outside that shape (the caller keeps
- * its fence). */
+ * slots answer their per-value tag test) and then probes the overflow
+ * map's hashed key set. Null when the pair is outside that shape (the
+ * caller keeps its fence). */
 function lowerRuntimeKeyIn(lowerer, expr, loc) {
     if (lowerer.mapTypeOf(lowerer.typeOf(expr.left))?.kind !== "string")
         return null;
@@ -11060,62 +11341,15 @@ function lowerRuntimeKeyIn(lowerer, expr, loc) {
                 type: BOOL,
                 loc,
             };
-            const utag = !accessor && f.type.kind === "union" ? lowerer.armTag(f.type.unionId, UNDEFINED_T) : -1;
-            const answer = utag >= 0 && f.type.kind === "union"
-                ? {
-                    kind: "unionIsTag",
-                    unionId: f.type.unionId,
-                    tag: utag,
-                    negated: true,
-                    value: {
-                        kind: "recordGet",
-                        obj: r,
-                        shapeId: recvT.shapeId,
-                        field: f.name,
-                        type: f.type,
-                        loc,
-                    },
-                    type: BOOL,
-                    loc,
-                }
-                : { kind: "boolLit", value: true, type: BOOL, loc };
+            const answer = accessor
+                ? { kind: "boolLit", value: true, type: BOOL, loc }
+                : lowerer.recordFieldPresent(r, recvT.shapeId, f.name, loc);
             body.push({ kind: "if", cond: eq, then: [ret(answer)], else_: null, loc });
         }
-        const ksT = arrayOf(STRING);
-        body.push({
-            kind: "varDecl",
-            localId: "ks.0",
-            init: { kind: "recordOvfKeys", obj: r, shapeId: recvT.shapeId, type: ksT, loc },
-            loc,
-        }, countedFor(loc, {
-            kind: "arrIntrinsic",
-            method: "length",
-            receiver: varRef("ks.0", ksT, loc),
-            args: [],
-            type: F64,
-            loc,
-        }, () => [
-            {
-                kind: "if",
-                cond: {
-                    kind: "strEq",
-                    negated: false,
-                    left: k,
-                    right: {
-                        kind: "arrayGet",
-                        arr: varRef("ks.0", ksT, loc),
-                        index: varRef("i.0", F64, loc),
-                        type: STRING,
-                        loc,
-                    },
-                    type: BOOL,
-                    loc,
-                },
-                then: [ret({ kind: "boolLit", value: true, type: BOOL, loc })],
-                else_: null,
-                loc,
-            },
-        ]), ret({ kind: "boolLit", value: false, type: BOOL, loc }));
+        // Overflow keys answer through the map's hashed presence probe (a
+        // stored undefined value is still present), not a scan over a fresh
+        // key snapshot, which made `k in dict` loops quadratic.
+        body.push(ret({ kind: "recordOvfHas", obj: r, shapeId: recvT.shapeId, key: k, type: BOOL, loc }));
         lowerer.liftedFns.push({
             name: helper,
             params: [
@@ -11126,8 +11360,6 @@ function lowerRuntimeKeyIn(lowerer, expr, loc) {
             locals: [
                 { id: "k.0", name: "k", type: STRING, mutable: true },
                 { id: "r.0", name: "r", type: recT, mutable: true },
-                { id: "ks.0", name: "ks", type: ksT, mutable: false },
-                { id: "i.0", name: "i", type: F64, mutable: true },
             ],
             body,
             loc,
@@ -11815,7 +12047,7 @@ export function lowerUnionProperty(lowerer, expr) {
         return null;
     }
     if (value.type.kind !== "union") {
-        throw new InternalCompilerError("lowerer bug: union-typed receiver lowered to a non-union");
+        lowerer.unsupported("SC1090", expr, "shared property access without a represented union receiver");
     }
     const def = lowerer.unions.get(value.type.unionId);
     if (!def)
@@ -12192,11 +12424,32 @@ export function fieldTarget(lowerer, access) {
     const stored = ts.isIdentifier(access.expression)
         ? (lowerer.peekLocal(access.expression)?.type ?? lowerer.globalOf(access.expression)?.type)
         : undefined;
-    const receiverIr = stored?.kind === "record" || stored?.kind === "object"
+    const narrowed = lowerer.mapTypeOf(lowerer.typeOf(access.expression));
+    // Structural record views retain their storage layout, while a nominal
+    // subclass guard proves a more specific layout of the same object.
+    const receiverIr = stored?.kind === "record"
         ? stored
-        : lowerer.mapTypeOf(lowerer.typeOf(access.expression));
+        : stored?.kind === "object" &&
+            !(narrowed?.kind === "object" &&
+                lowerer.isSubclassOf(narrowed.className, stored.className))
+            ? stored
+            : narrowed;
     if (receiverIr?.kind === "object") {
-        return classFieldTarget(lowerer, access.expression, receiverIr, access.name.text);
+        const target = classFieldTarget(lowerer, access.expression, receiverIr, access.name.text);
+        if (target)
+            return target;
+        // Abstract properties declare no base storage. Resolve the concrete
+        // instance's live field or accessor through the existing class bridge;
+        // inventing a shared field offset would misread subclass layouts.
+        if (abstractPropertyDeclOf(lowerer, access)) {
+            return {
+                container: "dynamic",
+                obj: lowerer.coerceInto(access.expression, lowerer.lowerExpr(access.expression), DYN),
+                field: access.name.text,
+                fieldType: lowerer.irTypeOf(access),
+            };
+        }
+        return null;
     }
     if (receiverIr?.kind === "union" && hasClassPayload(lowerer, receiverIr)) {
         return representedClassFieldTarget(lowerer, access.expression, access.name.text, lowerer.lowerExpr(access.expression));
@@ -12437,13 +12690,13 @@ function symbolFieldTarget(lowerer, expr) {
  * undefined, which these property types cannot represent. */
 export function fieldGetExpr(lowerer, target, loc, blame) {
     if (target.container === "dynamic")
-        return {
+        return lowerer.coerceInto(blame, {
             kind: "dynKeyGet",
             value: target.obj,
             key: { kind: "strLit", value: target.field, type: STRING, loc },
             type: DYN,
             loc,
-        };
+        }, target.fieldType);
     if (target.container === "class" &&
         (target.field === "message" || target.field === "name") &&
         (target.className === "%Error" || lowerer.isSubclassOf(target.className, "%Error")))
@@ -12904,7 +13157,8 @@ function lowerFieldCompoundValue(lowerer, access, op, rhsNode, loc) {
         ? { kind: "dynCheck", value: rhs, type: F64, loc: rhs.loc }
         : lowerOptionalNumber(lowerer, rhs, loc);
     let value;
-    if (op === "+" && target.fieldType.kind === "string") {
+    const numericRead = lowerOptionalNumber(lowerer, read, loc, access);
+    if (op === "+" && read.type.kind === "string") {
         value = {
             kind: "strConcat",
             left: read,
@@ -12913,8 +13167,8 @@ function lowerFieldCompoundValue(lowerer, access, op, rhsNode, loc) {
             loc,
         };
     }
-    else if (target.fieldType.kind === "f64" && numericRhs.type.kind === "f64") {
-        value = { kind: "bin", op, left: read, right: numericRhs, type: F64, loc };
+    else if (numericRead.type.kind === "f64" && numericRhs.type.kind === "f64") {
+        value = { kind: "bin", op, left: numericRead, right: numericRhs, type: F64, loc };
     }
     else if (target.fieldType.kind === "dyn" && isJsSourceFile(access.getSourceFile())) {
         const numeric = ["-", "*", "/", "%", "**"].includes(op);
@@ -12934,7 +13188,7 @@ function lowerFieldCompoundValue(lowerer, access, op, rhsNode, loc) {
         lowerer.unsupported("SC1043", access);
     }
     const result = save(value, "%compoundResult");
-    body.push(lowerer.fieldSetStmt(target, result, loc, access));
+    body.push(lowerer.fieldSetStmt(target, lowerer.coerceInto(access, result, target.fieldType), loc, access));
     return { kind: "seqExpr", stmts: body, result, type: result.type, loc };
 }
 /** Stream-rooted receivers' property surface (readableEnded, destroyed,