@scriptc/compiler 0.2.6 → 0.2.8

package/dist/backend/llvm/emitter.js

@@ -1,4 +1,5 @@
 import { emitLlvmLayouts } from "./layouts.js";
+import { inlineAllocSupported } from "./alloc.js";
 import { llvmBytes as llBytes } from "../literals.js";
 import { InternalCompilerError } from "../../errors.js";
 /** Lower typed IR to LLVM, using the runtime's C ABI.
@@ -18,10 +19,11 @@ import { InternalCompilerError } from "../../errors.js";
  * Dynamic values and islands share the runtime ABI; embedded npm modules use
  * compressed source tables that the runtime inflates on demand.
  */
+import { createHash } from "node:crypto";
 import { deflateRawSync } from "node:zlib";
-import { endsWithJump, matchStringSelfConcat, streamTypedRefEligible } from "../../ir/analysis.js";
+import { endsWithJump, matchStringSelfConcat, streamTypedRefEligible, undefinedArmTag, } from "../../ir/analysis.js";
 import { emitLibraryIdentityLines } from "../library-identity-markers.js";
-import { CAUGHT, ffiCallbackType, isDynTypedRefType, isFfiContextParam, isRefCounted, isUnitType, POINTER_KINDS, RUNTIME_EMITTER_CLASS, RUNTIME_ERROR_CLASSES, RUNTIME_STREAM_CLASSES, typeKey, STRING, VOID, } from "../../ir/ir.js";
+import { CAUGHT, ffiCallbackType, isDynTypedRefType, isFfiContextParam, isRefCounted, isUnitType, POINTER_KINDS, RUNTIME_EMITTER_CLASS, RUNTIME_ERROR_CLASSES, RUNTIME_STREAM_CLASSES, typeEquals, typeKey, STRING, VOID, } from "../../ir/ir.js";
 import { moduleRuntimeFeatures, moduleEmbedsBuiltin, moduleEmbedsCompressedNpm, NPM_COMPRESS_MIN, } from "../../ir/runtime-features.js";
 import { matchIntegerArrayForLoop, matchIntegerBytesForLoop, matchIntegerCountedForLoop, } from "../../ir/integer-loops.js";
 import { emitCountedLoopLimit } from "./counted-loops.js";
@@ -31,8 +33,9 @@ import { emitByteWindowGuard, findInitializedByteLoopBindings, matchByteWindow,
 import { canDeferSplitPiece, emitSplitSpanNext, materializeSplitPiece, emitSplitCursor, emitSplitNext, emitSplitScratch, emitSplitSnapshot, findPrivateSplitLocals, loadSplitSnapshot, storeSplitSnapshot, stringSplit, } from "./split-loops.js";
 import { scalarizeNumericRecords } from "../../ir/scalar-records.js";
 import { specializeNumericCalls } from "../../ir/numeric-call-specialization.js";
-import { everyStmtList } from "../../ir/traverse.js";
-import { analyzeIntegerRanges } from "../../ir/integer-ranges.js";
+import { everyExprChild, everyStmtChild, everyStmtList } from "../../ir/traverse.js";
+import { analyzeIntegerRanges, INT32_RANGE } from "../../ir/integer-ranges.js";
+import { analyzeInt32Slots } from "../../ir/int32-slots.js";
 import { findIntegerViews } from "./integer-views.js";
 import { findInitializerBindings, withInitializerBindings } from "../../ir/initializer-bindings.js";
 import { findConstantNumericTables } from "../../ir/constant-tables.js";
@@ -44,29 +47,37 @@ import { analyzeCallLifetimes } from "./call-lifetimes.js";
 import { canStackUnion, emitStackUnion, findLocalStackUnions } from "./stack-unions.js";
 import { allocateLocalUnion, findLocalUnionStorage, storeLocalUnion, } from "./local-union-storage.js";
 import { BlockBuilder } from "./blocks.js";
-import { emitLocalArrayRead, emitBorrowedArrayRead, findLocalArrayReads, findCallArrayReads, OptionalArrayReads, } from "./local-array-reads.js";
+import { NullableRefFields } from "./nullable-fields.js";
+import { emitLocalArrayRead, emitProjectedArrayRead, emitBorrowedArrayRead, findLocalArrayReads, findCallArrayReads, OptionalArrayReads, } from "./local-array-reads.js";
+import { CheckedNarrows, emitCheckedNarrowReceiver } from "./checked-narrows.js";
+import { emitDenseArrayGet, emitDenseArraySet } from "./dense-array-access.js";
 import { emitStackMapRead, findMapReadLifetimes, matchMapRead, } from "./map-read-lifetimes.js";
-import { emitBorrowedFieldSequence } from "./borrowed-receivers.js";
+import { emitBorrowedFieldSequence, guardedValue } from "./borrowed-receivers.js";
 import { emitBorrowedInput } from "./borrowed-inputs.js";
+import { analyzeWalks, findWalkBorrows } from "./walk-borrows.js";
+import { findReboundParameters } from "./rebound-parameters.js";
 import { ReferenceEffects } from "./reference-effects.js";
 import { LlvmDebugInfo } from "./debug-info.js";
 import { StackCallbacks } from "./stack-callbacks.js";
 import { findLoopArrayBorrows } from "./loop-array-borrows.js";
-import { findConstantCallbacks } from "./constant-callbacks.js";
+import { AmbientReceiverReaders, findConstantCallbacks } from "./constant-callbacks.js";
 import { findScalarStringSlices, emitStringSliceSnapshot, } from "./string-slices.js";
+import { LazyCaptures } from "./lazy-captures.js";
 import { StackCaptures } from "./stack-captures.js";
-import { f64Lit, ffiNativeTypeLl, ffiNativeParamLl, ffiNativeReturnLl, llvmCommentText, } from "./common.js";
+import { ABSENT_FIELD_PAYLOAD, emitFieldAbsentTest, f64Lit, ffiNativeTypeLl, ffiNativeParamLl, ffiNativeReturnLl, llvmCommentText, } from "./common.js";
 import { ffiExtendsNarrowIntegers } from "../targets.js";
 import { emitLiteralExpr, emitOperatorExpr, emitStringExpr, emitContainerExpr, emitRecordExpr, } from "./expr-primitives.js";
 import { emitControlExpr } from "./expr-control.js";
-import { emitCallExpr } from "./expr-calls.js";
+import { emitBorrowedResultCall, emitCallExpr } from "./expr-calls.js";
 import { emitDynamicExpr } from "./expr-dynamic.js";
 import { emitIntrinsicExpr, emitSerializationExpr, emitAsyncExpr } from "./expr-async.js";
+import { PublishWalkers } from "./publish.js";
+import { computePublishedTypes } from "../publication.js";
 import { emitJsInteropExpr, emitExpr } from "./expr-dispatch.js";
 import { emitJsMarshal, emitJsOp, emitJsExit, islandAdapter, islandTypedAdapter, } from "./expr-island.js";
 import { dynKind, raceAdapterFor, genResultThunkFor, childExitThunkFor, childExitSignalThunkFor, childDataThunkFor, execFileThunkFor, ipcMessageThunkFor, ipcSendThunkFor, emitterFixedAdapter, wrapEmitterListener, unwrapNullableClosure, closeBindThunkFor, closeOverrideWrapFor, } from "./expr-callbacks.js";
 import { streamDataAdapter, streamDoneFnFor, cryptoBytesThunkFor, fsRenameThunkFor, streamCbThunkFor, zlibBytesThunkFor, } from "./expr-stream-callbacks.js";
-import { emitStableReceiver, resolveThunkFor, tagInSet, arrPush, emitArrayCopyLoop, emitStrIntrinsic, emitArrIntrinsic, wrapNullable, emitMapNew, mapSet, emitMapLikeIntrinsic, emitSetNew, } from "./expr-containers.js";
+import { emitStableReceiver, resolveThunkFor, tagInSet, arrPush, emitArrayCopyLoop, emitStrIntrinsic, emitArrIntrinsic, emitDiscardedSplice, wrapNullable, emitMapNew, mapSet, emitMapLikeIntrinsic, emitSetNew, } from "./expr-containers.js";
 import { emitIntegerLoopIndex, emitBytesIndex, emitBytesData, emitBytesLength, emitBytesGet, emitToUint32, emitBytesSet, emitBytesIntrinsic, } from "./expr-bytes.js";
 import { emitRegexIntrinsic, emitRecordKeyGet, keyedRecordReadInto } from "./expr-records.js";
 import { dynPromiseAdapter, streamTypedRefCommitAdapter, liveDynUnionRefAdapter, streamTypedRefBoxValue, streamTypedRefMaterializeAdapter, streamFromArrayAdapter, } from "./expr-stream-bridges.js";
@@ -77,9 +88,16 @@ import { emitNetworkHttpLibCall } from "./lib-network.js";
 import { emitAssertInspectLibCall, emitIoLibCall, emitGenericLibCall, emitLibCall, } from "./lib-dispatch.js";
 import { buildClassGraph, classMembershipIntervals, emitClassMembershipHelper, classEnvironmentIndex, classFieldIndex, classStructSym, } from "./classes.js";
 import { LlDyn } from "./dyn.js";
+import { VirtualBorrows } from "./virtual-borrows.js";
 import { LlvmUnsupportedError } from "./unsupported.js";
 import { LlWalkers } from "./walkers.js";
-import { arrNewCall, boxAccess, boxNewCall, computeTraced, elemAccess, FN_ATTRS, llFieldType, releaseSym, retainSym, traceArg, typedRefConstructor, vAdapters, } from "./shapes.js";
+import { isObjectArm, NULLABLE_ABSENT, NULLABLE_NULL, NullableUnions } from "./nullable-unions.js";
+import { emitNullablePresent, emitUnionPeek, emitUnionTag } from "./union-repr.js";
+import { literalCapWord, literalCapWord32 } from "./string-key-hash.js";
+import { NUMBER_MAP_ENTRY_DECL } from "./map-number-lookup.js";
+import { STRING_READ_HELPERS } from "./string-reads.js";
+import { emitConcatInputs, emitMixedConcat, numberPart, stringParts, } from "./string-construction.js";
+import { arrNewCall, boxAccess, boxNewCall, boxReleaseSym, computeTraced, elemAccess, emitInlineRcHelpers, emitNullableRetainWrappers, FN_ATTRS, inlineRcDecls, llFieldType, releaseSym, retainSym, traceArg, typedRefConstructor, vAdapters, } from "./shapes.js";
 export { LlvmUnsupportedError } from "./unsupported.js";
 function ffiCallbackDummyLl(callback) {
     switch (callback.returns) {
@@ -125,6 +143,41 @@ export function emitLlvmModuleSource(mod, options = {}) {
 function llStrBytes(text) {
     return llBytes(Buffer.from(text, "utf8"));
 }
+const NO_BORROWED = new Set();
+/** Whether any node of `e` names the local (reads, writes, declarations,
+ * captures). */
+function mentionsLocal(e, localId) {
+    const exprNames = (node) => {
+        if (node.kind === "varRef" || node.kind === "incDec" || node.kind === "assignExpr")
+            return node.localId === localId;
+        if (node.kind === "closure")
+            return node.captures.includes(localId);
+        if (node.kind === "classRef")
+            return node.captures?.includes(localId) === true;
+        return false;
+    };
+    const stmtNames = (node) => {
+        if (node.kind === "varDecl" ||
+            node.kind === "assign" ||
+            node.kind === "forOf" ||
+            node.kind === "rethrow")
+            return node.localId === localId;
+        return false;
+    };
+    let found = false;
+    const expr = (node) => {
+        if (found || exprNames(node))
+            return !(found = true);
+        return everyExprChild(node, expr, stmt);
+    };
+    const stmt = (node) => {
+        if (found || stmtNames(node))
+            return !(found = true);
+        return everyStmtChild(node, expr, stmt);
+    };
+    expr(e);
+    return found;
+}
 export class LlEmitter {
     mod;
     localArrayReads = new Map();
@@ -173,15 +226,23 @@ export class LlEmitter {
     ffiExtendNarrowIntegers;
     cycleColorOffset;
     wasi;
+    /** ELF worker executables give thread-locals the executable TLS models. */
+    executableTls;
     emitLibraryIdentity;
     runtimeAbiMarker;
     /** Interned string literals: UTF-8 text → { symbol, byte length } —
      * first-use order, the runtime ABI’s determinism discipline. */
     literals = new Map();
+    /** Symbols of interned constant data, named by content (contentSymbol). */
+    contentSymbols = new Set();
     /** Interned unit-armed union instances: "unionId:tag" → symbol — one
      * immortal (rc == SIZE_MAX) static per (union, unit tag).
      * RC entry points and the collector skip immortals. */
     unitInstances = new Map();
+    /** unionId → symbol of the union's immortal ABSENT field-slot instance. */
+    absentInstances = new Map();
+    /** The nullable-union ABSENT sentinel was referenced (absentInstanceRef). */
+    needsNullableAbsent = false;
     immortalValues = new Set();
     /** Regex literal templates: "<flags>/<pattern>" → { symbol, interned
      * source/flags literal refs } — one immortal ScrRegex template per distinct
@@ -215,18 +276,45 @@ export class LlEmitter {
     needsBadTag = false;
     needsBadKey = false;
     needsRetainBox = false;
+    /** Inline RC fast-path helpers requested by call sites (shapes.ts); null
+     * when inline RC is off. */
+    rcHelpers;
     fnByName = new Map();
+    /** Emitted LLVM text of every IR function body, by function name: the
+     * fiberless-async analysis scans it for suspension entry points. */
+    fnDefText = new Map();
     referenceEffects;
     optionalArrayReads;
+    checkedNarrows;
     callArrayReads = new Map();
     mapReadLifetimes = { locals: new Map(), arguments: new Map() };
     callLifetimes;
     constantCallbacks;
     currentConstantCallbacks = new Map();
     stackCallbacks;
+    receiverReaders;
     stackCaptures;
+    lazyCaptures;
+    /** Unchanged captured parameters of the current function: each maps to
+     * the slot caching its box, NULL until the first closure needs it. */
+    lazyCaptureBoxes = new Map();
+    lazyStackBoxes = new Map();
     borrowedParameters = new Set();
+    /** Parameters proven projection-only: callers may pass stack boxes. */
+    projectedParameters = new Set();
     stableCallBindings = new Set();
+    /** Locals and rebound parameters holding borrowed pointers for their
+     * whole lifetime (walk-borrows.ts), per function and for the current one. */
+    walkBorrowsByFunction = new Map();
+    walkBorrows = new Set();
+    /** Functions whose borrowing body returns its result without a reference
+     * (analyzeBorrowedReturns), and whether the current body is one. */
+    borrowedReturns = new Set();
+    /** Rebound parameters that keep the borrowed convention with an owner
+     * slot (rebound-parameters.ts), per function, and the current owner slots. */
+    reboundByFunction = new Map();
+    reboundOwnerSlots = new Map();
+    currentBorrowedReturn = false;
     /** Manifest-bound native imports, used by ffiCall emission. */
     ffiByName = new Map();
     /** C-ABI callback trampolines and (for raw/no-userdata callbacks) their
@@ -245,6 +333,15 @@ export class LlEmitter {
      * checks are emitted only after calls that can actually raise. */
     mayThrow;
     indirectMayThrow;
+    /** Worker programs: the functions that poll for termination on entry
+     * (workerTerminationPolls); null outside worker programs. */
+    workerEntryPolls;
+    /** Functions that check the native stack guard on entry
+     * (stackCheckedFunctions); null where the runtime has no guard. */
+    stackChecks;
+    /** Static types whose values can be published (@scriptc/threads): their
+     * stores carry the frozen-object guard. Null without publish calls. */
+    publishedTypes;
     /** Method names with at least one may-throw implementation — the
      * virtualCall pending check's key. */
     mayThrowMethods = new Set();
@@ -265,6 +362,11 @@ export class LlEmitter {
     liveDynUnionRefAdapters = new Map();
     dynPromiseAdapters = new Map();
     unionsById = new Map();
+    nullableFields;
+    /** Unions whose values are nullable arm pointers (nullable-unions.ts). */
+    nullableUnions;
+    /** The union table without nullable unions: the stack-box analyses. */
+    boxedUnionsById;
     recordsById = new Map();
     recordCloneShapes = new Set();
     tracedShapes;
@@ -272,6 +374,8 @@ export class LlEmitter {
     /** The class graph (buildClassGraph): preorder numbering, hierarchy
      * membership, virtual slot lists. */
     classMeta;
+    /** Which vtable slots borrow which parameters (virtual-borrows.ts). */
+    virtualBorrows;
     /** Class objects (classes as first-class values): className → the
      * interned .name literal ref — registered during body emission, the
      * statics and construct thunks assemble around the bodies. */
@@ -312,6 +416,8 @@ export class LlEmitter {
     storedSplits = new Map();
     streamingSplitsEnabled = false;
     initializerBindings;
+    /** Whole-program int32 storage and parameter/result facts. */
+    int32Slots;
     numericLocals = new Map();
     captureIds = new Set();
     /** Active induction bindings retain their width independently of size_t. */
@@ -358,18 +464,26 @@ export class LlEmitter {
             stmt: () => true,
             expr: (expr) => !(expr.kind === "libCall" && expr.fn === "error.stack"),
         }));
+        this.nullableUnions = new NullableUnions(mod);
         this.debug =
             options.debugSources === undefined
                 ? null
-                : new LlvmDebugInfo(mod.sourceFile, options.debugSources, options.pointerBits, mod.unions);
+                : new LlvmDebugInfo(mod.sourceFile, options.debugSources, options.pointerBits, mod.unions, this.nullableUnions.armTypes());
         this.constantNumericTables = findConstantNumericTables(mod);
         this.initializerBindings = findInitializerBindings(mod);
+        this.int32Slots = analyzeInt32Slots(mod);
         this.sizeType = options.pointerBits === 32 ? "i32" : "i64";
         this.ffiExtendNarrowIntegers =
             options.wasi === true || ffiExtendsNarrowIntegers(options.targetTriple);
         this.wasi = options.wasi === true;
+        this.executableTls =
+            mod.workers === true &&
+                mod.lib === undefined &&
+                !this.wasi &&
+                !/apple|darwin|windows|mingw|cygwin|win32/.test(options.targetTriple || process.platform);
         this.emitLibraryIdentity = options.emitLibraryIdentity !== false;
         this.runtimeAbiMarker = options.runtimeAbiMarker === true;
+        this.rcHelpers = options.inlineRc === true ? new Set() : null;
         // ScrCycHdr.color stays 12 bytes behind a wasm32 object and 16 bytes
         // behind a 64-bit object. The wasm32 header pads before color so its
         // payload remains double-aligned without changing this ABI offset.
@@ -382,11 +496,17 @@ export class LlEmitter {
         for (const entry of mod.ffiImports ?? []) {
             this.ffiByName.set(entry.name, entry);
         }
-        const mt = computeMayThrow(mod);
+        // Executables on Linux and macOS install a native stack guard per thread
+        // and per async fiber; WASI, Windows and library builds have none.
+        const triple = (options.targetTriple ?? "").toLowerCase();
+        const windows = triple === "" ? process.platform === "win32" : triple.includes("windows");
+        const mt = computeMayThrow(mod, {
+            stackChecks: !this.wasi && mod.lib === undefined && !windows,
+        });
         this.mayThrow = mt.fns;
-        if (mod.workers)
-            for (const fn of mod.functions)
-                this.mayThrow.add(fn.name);
+        this.workerEntryPolls = mt.workerEntryPolls ?? null;
+        this.stackChecks = mt.stackChecks ?? null;
+        this.publishedTypes = computePublishedTypes(mod);
         this.indirectMayThrow = mt.indirect || mod.workers === true;
         for (const cls of mod.classes ?? []) {
             for (const m of cls.methods ?? []) {
@@ -396,12 +516,61 @@ export class LlEmitter {
         }
         for (const u of mod.unions ?? [])
             this.unionsById.set(u.id, u);
+        this.boxedUnionsById = this.nullableUnions.boxedUnions(this.unionsById);
+        this.immortalValues.add("null");
+        this.immortalValues.add(NULLABLE_NULL);
+        this.nullableFields = new NullableRefFields(mod.classes ?? [], this.boxedUnionsById);
+        // Optional array reads also cover nullable unions: emitLocalArrayRead
+        // then yields the (borrowed or owned) element pointer, not a stack box.
         this.optionalArrayReads = new OptionalArrayReads(this.fnByName, this.unionsById);
-        this.referenceEffects = new ReferenceEffects(this.fnByName, (call) => this.optionalArrayReads.get(call) !== null);
-        this.callLifetimes = analyzeCallLifetimes(this.fnByName);
+        this.checkedNarrows = new CheckedNarrows(this.fnByName);
+        this.referenceEffects = new ReferenceEffects(this.fnByName, (call) => this.optionalArrayReads.get(call) !== null, mod.classes ?? []);
+        const walkParameters = new Map();
+        if (this.debug === null) {
+            const host = {
+                pointerLocal: (local) => this.plainReference(local.type),
+                borrowsWithoutOwning: (e) => this.borrowsWithoutOwning(e),
+            };
+            for (const fn of this.fnByName.values()) {
+                if (!this.referenceEffects.functions.has(fn.name))
+                    continue;
+                const walks = findWalkBorrows(fn, host);
+                if (walks.size === 0)
+                    continue;
+                this.walkBorrowsByFunction.set(fn.name, walks);
+                const indexes = new Set();
+                fn.params.forEach((param, index) => {
+                    if (walks.has(param.localId))
+                        indexes.add(index);
+                });
+                if (indexes.size > 0)
+                    walkParameters.set(fn.name, indexes);
+            }
+        }
+        if (this.debug === null) {
+            for (const fn of this.fnByName.values()) {
+                // Strings keep the owned parameter: their in-place append
+                // (`s = s + x`) needs a uniquely owned binding.
+                const rebound = findReboundParameters(fn, (type) => this.plainReference(type) &&
+                    type.kind !== "string" &&
+                    (type.kind !== "union" || this.nullableUnions.get(type.unionId)?.arm.kind !== "string"), this.walkBorrowsByFunction.get(fn.name) ?? new Set());
+                if (rebound.size === 0)
+                    continue;
+                this.reboundByFunction.set(fn.name, rebound);
+                const indexes = walkParameters.get(fn.name) ?? new Set();
+                fn.params.forEach((param, index) => {
+                    if (rebound.has(param.localId))
+                        indexes.add(index);
+                });
+                walkParameters.set(fn.name, indexes);
+            }
+        }
+        this.callLifetimes = analyzeCallLifetimes(this.fnByName, (className, field) => this.nullableFields.get(className, field) !== null, walkParameters);
         this.constantCallbacks = findConstantCallbacks(mod, this.callLifetimes);
         this.stackCallbacks = new StackCallbacks(this.fnByName);
+        this.receiverReaders = new AmbientReceiverReaders(this.fnByName);
         this.stackCaptures = new StackCaptures(this.fnByName, this.callLifetimes, this.stackCallbacks);
+        this.lazyCaptures = new LazyCaptures(this.fnByName);
         for (const r of mod.records ?? [])
             this.recordsById.set(r.id, r);
         const traced = computeTraced(mod);
@@ -412,8 +581,20 @@ export class LlEmitter {
             cycleColorOffset: this.cycleColorOffset,
             tracedShapes: this.tracedShapes,
             tracedUnions: this.tracedUnions,
+            nullableUnions: this.nullableUnions,
             recordsById: this.recordsById,
             recordCloneShapes: this.recordCloneShapes,
+            objectAudit: options.objectAudit !== false,
+            inlineAlloc: inlineAllocSupported({
+                pointerBits: options.pointerBits,
+                wasi: options.wasi,
+                targetTriple: options.targetTriple,
+                threadInstances: mod.lib?.threadInstances === true,
+            }),
+            // Worker programs keep one allocator per script thread: the inline
+            // paths address its thread-local state.
+            threadLocalAlloc: mod.workers === true,
+            rcHelpers: this.rcHelpers,
             unionsById: this.unionsById,
             declare: (decl) => this.declare(decl),
             needOom: () => this.needOom(),
@@ -421,6 +602,8 @@ export class LlEmitter {
             internLiteral: (text) => this.internLiteral(text),
             cstr: (text) => this.cstr(text),
             unitInstanceRef: (unionId, tag) => this.unitInstanceRef(unionId, tag),
+            fieldAbsentTestIn: (B, value, unionId) => this.fieldAbsentTestIn(B, value, unionId),
+            absentInstanceRef: (unionId) => this.absentInstanceRef(unionId),
             liveDynRefAdapter: (type) => this.liveDynRefAdapter(type),
             liveDynUnionRefAdapter: (type) => this.liveDynUnionRefAdapter(type),
             dynPromiseAdapter: (type) => this.dynPromiseAdapter(type),
@@ -432,6 +615,8 @@ export class LlEmitter {
                     .filter((meta) => intervals.some((range) => range.pre <= meta.pre && meta.pre <= range.post))
                     .map((meta) => meta.def.name);
             },
+            pendingTestLines: (dest) => this.pendingTestLines(dest),
+            virtualEntry: (implFn) => this.virtualEntry(implFn),
         };
         this.walkers = new LlWalkers(this.shapeHost);
         this.dyn = new LlDyn(this.shapeHost);
@@ -488,6 +673,21 @@ export class LlEmitter {
                 lib: rec.lib,
             });
         }
+        this.virtualBorrows = new VirtualBorrows(mod, this.classMeta, this.fnByName, this.callLifetimes.borrowed);
+        // After the vtable slots: borrowing slots exclude their implementations.
+        if (this.debug === null)
+            this.analyzeBorrowedReturns();
+    }
+    /** The borrowed parameters of a hierarchy's vtable slot (empty: owned). */
+    virtualSlotBorrowed(rootName, slotIndex) {
+        return this.virtualBorrows.slot(rootName, slotIndex);
+    }
+    /** The vtable entry for one implementation (VirtualBorrows.entry). */
+    virtualEntry(implFn) {
+        return this.virtualBorrows.entry(implFn);
+    }
+    implSlotBorrowed(implFn) {
+        return this.virtualBorrows.implSlotBorrowed(implFn);
     }
     abiOffset(native64, wasm32) {
         return this.sizeType === "i32" ? wasm32 : native64;
@@ -528,7 +728,6 @@ export class LlEmitter {
         const defs = [];
         if (this.ffiCallbackAdapters.size === 0)
             return { globals, defs };
-        this.declare(`declare zeroext i1 @scr_exc_pending()`);
         this.declare(`declare void @scr_trap(ptr)`);
         const expired = this.cstr("scriptc: native callback invoked outside its call-scoped lifetime\n");
         const released = this.cstr("scriptc: native callback invoked outside its retained lifetime\n");
@@ -646,7 +845,7 @@ export class LlEmitter {
                 ? `  %cb = load ptr, ptr @${adapter.tls}`
                 : adapter.global !== null
                     ? `  %cb = load ptr, ptr @${adapter.global}`
-                    : `  %cb = getelementptr inbounds i8, ptr %ctx, i64 0`, `  %missing = icmp eq ptr %cb, null`, `  br i1 %missing, label %expired, label %ready`, `expired:`, `  call void @scr_trap(ptr ${adapter.callback.lifetime === "call" ? expired : released})`, `  unreachable`, `ready:`, `  %pending = call zeroext i1 @scr_exc_pending()`, `  br i1 %pending, label %skip, label %invoke`, `skip:`, `  ret ${ffiCallbackDummyLl(cb)}`, `invoke:`);
+                    : `  %cb = getelementptr inbounds i8, ptr %ctx, i64 0`, `  %missing = icmp eq ptr %cb, null`, `  br i1 %missing, label %expired, label %ready`, `expired:`, `  call void @scr_trap(ptr ${adapter.callback.lifetime === "call" ? expired : released})`, `  unreachable`, `ready:`, ...this.pendingTestLines("%pending"), `  br i1 %pending, label %skip, label %invoke`, `skip:`, `  ret ${ffiCallbackDummyLl(cb)}`, `invoke:`);
             // Validate every native pointer before allocating any copy-in value.
             // A later bad slot therefore cannot leak an earlier materialization.
             for (let i = 0; i < cb.params.length; i++) {
@@ -794,11 +993,28 @@ export class LlEmitter {
         return this.emitParts().join("\n");
     }
     emitParts() {
+        const parts = this.emitModuleParts();
+        if (!this.executableTls)
+            return parts;
+        // A worker executable's thread-locals all live in the executable's own
+        // TLS block (the program's internal ones, the runtime's external ones),
+        // so on ELF they can use the executable models: LLVM's default
+        // general-dynamic sequence (relaxed by the linker to `mov %fs:0` plus
+        // an add) becomes one %fs-relative access LLVM can fold into loads.
+        // Darwin's thread-local variables have a single model.
+        return parts.map((part) => part
+            .replace(/^(@[-$._A-Za-z0-9]+ = internal )thread_local global /gm, "$1thread_local(localexec) global ")
+            .replace(/^(@[-$._A-Za-z0-9]+ = external )thread_local global /gm, "$1thread_local(initialexec) global "));
+    }
+    emitModuleParts() {
         // Function bodies first (the literal/unit/fn-value tables fill as they
         // emit), then the file assembles around them — the runtime ABI’s order.
         const fnDefs = [];
-        for (const fn of this.mod.functions)
-            fnDefs.push(this.emitFunction(fn));
+        for (const fn of this.mod.functions) {
+            const def = this.emitFunction(fn);
+            fnDefs.push(def);
+            this.fnDefText.set(fn.name, def);
+        }
         const errorViews = [];
         for (const property of ["name", "message"])
             if (this.mod.functions.some((fn) => fn.name === `%error.${property}.read`)) {
@@ -817,7 +1033,7 @@ export class LlEmitter {
             this.declare(`declare void @scr_error_register_dyn(ptr, ptr)`);
             errorViews.push(`  call void @scr_error_register_dyn(ptr @${mangleVtInstance(meta.def.name)}, ptr @${name})`);
         }
-        const layouts = emitLlvmLayouts(this.shapeHost, this.mod, this.classMeta, this.classObjs, this.fnByName, (t) => this.llType(t));
+        const layouts = emitLlvmLayouts(this.shapeHost, this.mod, this.classMeta, this.classObjs, this.fnByName, (t) => this.llType(t), this.nullableFields, this.int32Slots);
         const shapes = layouts.records;
         const classShapes = layouts.classes;
         const classObjDefs = layouts.classObjects;
@@ -1020,12 +1236,15 @@ export class LlEmitter {
         const topPendingReleases = asyncEntry ? globalReleaseLines("gp") : [];
         const loopReportedReleases = runsLoop ? globalReleaseLines("gq") : [];
         // main's epilogues read the flag / the loop entry points — declared
-        // HERE, before the extern block flushes (a pending check usually
-        // declared the flag already; the Set dedupes).
+        // HERE, before the extern block flushes. They run once, so they keep
+        // the out-of-line scr_exc_pending call; per-call checks inline the
+        // test (pendingTestLines).
         if (entryMayThrow || runsLoop)
             this.declare(`declare zeroext i1 @scr_exc_pending()`);
         if (runsLoop) {
             this.declare(`declare zeroext i1 @scr_loop_run(ptr)`);
+            if (this.mod.commonJsEntry === true)
+                this.declare(`declare void @scr_loop_commonjs_entry()`);
             this.declare(`declare zeroext i1 @scr_report_unhandled_rejections()`);
             this.declare(`declare void @scr_discard_unhandled_rejections()`);
         }
@@ -1116,6 +1335,8 @@ export class LlEmitter {
         const helpers = [
             ...this.helperDefs(),
             ...emitClassMembershipHelper(this.classMeta, this.sizeType),
+            ...(this.publishWalkersCache?.defs() ?? []),
+            ...this.publishedClassNamesDefs(),
         ];
         if (this.constantNumericTables.size > 0)
             this.declare(`declare double @scr_arr_get_number(ptr, double)`);
@@ -1132,13 +1353,28 @@ export class LlEmitter {
             `%ScrLogArg = type { i32, i64 }`,
             `%ScrVt = type { ${this.sizeType}, ${this.sizeType}, ptr }`,
             `%ScrUnion = type { ${this.sizeType}, i32, ptr, ptr, ptr, i64 }`,
-            `%ScrClosure = type { ${this.sizeType}, ptr, ${this.sizeType}, ptr, i32 }`,
+            `%ScrClosure = type { ${this.sizeType}, ptr, ${this.sizeType}, ptr, i32, i32, ptr }`,
             `%ScrFfiTable = type { ptr, ${this.sizeType}, ${this.sizeType}, ptr, i8, ptr, ptr, ${this.sizeType}, ${this.sizeType}, ${this.sizeType}, ptr, ptr }`,
-            `%ScrRegex = type { ${this.sizeType}, ptr, ptr, ptr, double, ptr }`,
+            `%ScrRegex = type { ${this.sizeType}, ptr, ptr, ptr, double, ptr, ptr }`,
             // ScrArr mirrors scr_runtime.h field-for-field. Live dynamic stream
             // commits swap its mutable dense, sparse, presence, and property
             // storage while preserving the target object's identity.
             `%ScrArr = type { ${this.sizeType}, ${this.sizeType}, ${this.sizeType}, i32, ptr, ptr, ptr, ptr, ptr, ptr, ${this.sizeType}, ${this.sizeType}, ptr, ${this.sizeType}, ${this.sizeType}, ptr }`,
+            // The ScrMap prefix { rc, key_kind, val_kind, val_retain, val_release,
+            // val_trace, key_retain, key_release, key_trace } — the inline RC
+            // fast paths test the two trace slots (shapes.ts).
+            ...(this.rcHelpers === null
+                ? []
+                : [`%ScrMapRc = type { ${this.sizeType}, i32, i32, ptr, ptr, ptr, ptr, ptr, ptr }`]),
+            // The complete ScrMap and its { key, val, hash } entry, read by the
+            // inline number-key lookup (sc_map_entry_f64): entries is field 12,
+            // the direct index and its length fields 18 and 19.
+            ...(this.decls.has(NUMBER_MAP_ENTRY_DECL)
+                ? [
+                    `%ScrMapIx = type { ${this.sizeType}, i32, i32, ptr, ptr, ptr, ptr, ptr, ptr, ${this.sizeType}, ${this.sizeType}, ${this.sizeType}, ptr, ${this.sizeType}, ptr, ${this.sizeType}, ptr, ptr, ptr, ${this.sizeType} }`,
+                    `%ScrMapEntry = type { i64, i64, i64 }`,
+                ]
+                : []),
             // The runtime error prefix { rc, vt, name, message, code, cause } and the
             // class-object shape { rc, pre, post, ctor, name } — field reads on
             // builtin errors and classval loads GEP through these.
@@ -1184,12 +1420,13 @@ export class LlEmitter {
         // data (string literals, unit arms, template arrays, vtables) stays
         // shared.
         const tl = this.mod.workers === true || this.mod.lib?.threadInstances === true ? "thread_local " : "";
-        out.push(``, `@scr_error_vts = external ${tl}global [${RUNTIME_ERROR_CLASSES.size} x %ScrVt]`, `declare void @scr_init()`, `declare void @scr_lib_init(i32, ptr)`, ...(this.mod.workers ? [`declare void @scr_runtime_workers_v7()`] : []), ...(this.runtimeAbiMarker && this.mod.lib === undefined
+        out.push(``, `@scr_error_vts = external ${tl}global [${RUNTIME_ERROR_CLASSES.size} x %ScrVt]`, `declare void @scr_init()`, `declare void @scr_lib_init(i32, ptr)`, ...(this.mod.workers ? [`declare void @scr_runtime_workers_v8()`] : []), ...(this.stackChecks?.size ? [`declare void @scr_stack_guard_init()`] : []), ...(this.runtimeAbiMarker && this.mod.lib === undefined
             ? [`declare void @${RUNTIME_ABI_MARKER}()`]
             : []));
         for (const d of this.decls)
             out.push(d);
         out.push(``);
+        const flushedDecls = new Set(this.decls);
         for (const table of this.constantNumericTables.values()) {
             const n = table.values.length;
             out.push(`@${table.symbol} = private constant [${n} x double] [${table.values.map((v) => `double ${f64Lit(v)}`).join(", ")}]`, `define internal double @${table.symbol}_get(ptr %a, double %i) alwaysinline #0 {`, `entry:`, `  %initialized = icmp ne ptr %a, null`, `  %nonnegative = fcmp oge double %i, ${f64Lit(0)}`, `  %below = fcmp olt double %i, ${f64Lit(n)}`, `  %range = and i1 %nonnegative, %below`, `  %safe = and i1 %initialized, %range`, `  br i1 %safe, label %convert, label %fallback`, `convert:`, 
@@ -1200,8 +1437,14 @@ export class LlEmitter {
         for (const [text, lit] of this.literals) {
             // Immortal interned ScrStr: { rc = SIZE_MAX, len, cap = len, bytes\0 } —
             // the runtime ABI’s static table, retain/release skip rc == SIZE_MAX.
+            // 64-bit (little-endian) targets split the capacity word: the high
+            // half carries the precomputed Map key hash (SCR_STR_HASH_CACHE).
+            // Bit 31 marks all-ASCII literals (SCR_STR_ASCII_BIT) on every target.
+            const capWord = this.sizeType === "i64"
+                ? literalCapWord(Buffer.from(text, "utf8"))
+                : literalCapWord32(Buffer.from(text, "utf8"));
             out.push(`@${lit.sym} = internal global { ${this.sizeType}, ${this.sizeType}, ${this.sizeType}, [${lit.len + 1} x i8] } ` +
-                `{ ${this.sizeType} -1, ${this.sizeType} ${lit.len}, ${this.sizeType} ${lit.len}, [${lit.len + 1} x i8] c"${llStrBytes(text)}" }`);
+                `{ ${this.sizeType} -1, ${this.sizeType} ${lit.len}, ${this.sizeType} ${capWord}, [${lit.len + 1} x i8] c"${llStrBytes(text)}" }`);
         }
         if (this.literals.size > 0)
             out.push(``);
@@ -1214,11 +1457,37 @@ export class LlEmitter {
         }
         if (this.unitInstances.size > 0)
             out.push(``);
+        for (const [unionId, sym] of this.absentInstances) {
+            // One immortal ABSENT field-slot instance per undefined-armed union:
+            // the undefined arm's tag with payload 1 (ordinary unit instances
+            // carry 0). Every tag reader sees undefined; recordHas and the
+            // field reads compare tag and payload, never the address, so the
+            // per-object copies of separately compiled units agree.
+            const tag = undefinedArmTag({ kind: "union", unionId }, this.unionsById);
+            out.push(`@${sym} = internal global %ScrUnion { ${this.sizeType} -1, i32 ${tag}, ptr null, ptr null, ptr null, i64 ${ABSENT_FIELD_PAYLOAD} } ; ${unionId} absent field`);
+        }
+        if (this.absentInstances.size > 0)
+            out.push(``);
+        if (this.nullableUnions.usesNullSentinel) {
+            // `null` in every `C | null | undefined` union (NULL is undefined):
+            // one module-scope immortal object like the ABSENT sentinel.
+            const S = this.sizeType;
+            out.push(`${NULLABLE_NULL} = internal global { ${S}, ${S}, ${S}, ${S} } { ${S} -1, ${S} 0, ${S} 0, ${S} 0 } ; nullable null arm`, ``);
+        }
+        if (this.needsNullableAbsent) {
+            // The ABSENT field-slot state of every nullable-pointer union: one
+            // module-scope immortal object (rc == SIZE_MAX), distinct from NULL
+            // (undefined) and from every instance. RC entry points and the
+            // collector skip it like any immortal; field reads compare its address.
+            const S = this.sizeType;
+            out.push(`${NULLABLE_ABSENT} = internal global { ${S}, ${S}, ${S}, ${S} } { ${S} -1, ${S} 0, ${S} 0, ${S} 0 } ; nullable absent field`, ``);
+        }
         for (const [key, re] of this.regexInstances) {
             // One immortal ScrRegex per (pattern, flags) literal, pointing at
-            // the interned source/flags strings. The bc slot starts null (lazy
-            // compile, cached by the runtime) — a mutable global, not constant.
-            out.push(`@${re.sym} = internal ${tl}global %ScrRegex { ${this.sizeType} -1, ptr ${re.src}, ptr ${re.fl}, ptr null, double 0.0, ptr null } ; ${key.replace(/\n/g, "\\n")}`);
+            // the interned source/flags strings. The bc and native-matcher slots
+            // start null (lazy compile, cached by the runtime) — a mutable
+            // global, not constant.
+            out.push(`@${re.sym} = internal ${tl}global %ScrRegex { ${this.sizeType} -1, ptr ${re.src}, ptr ${re.fl}, ptr null, double 0.0, ptr null, ptr null } ; ${key.replace(/\n/g, "\\n")}`);
         }
         if (this.regexInstances.size > 0)
             out.push(``);
@@ -1367,6 +1636,7 @@ export class LlEmitter {
             // symbols specified by the library IR instead.
             for (const line of this.emitLibDefs(globals, globalReleaseLines, stamps))
                 out.push(line);
+            out.push(...this.inlineRcTail(flushedDecls));
             out.push(`attributes #0 = { sanitize_address }`);
             if (this.wasi)
                 out.push(`attributes #1 = { sanitize_address presplitcoroutine }`);
@@ -1378,7 +1648,10 @@ export class LlEmitter {
                 out.push(this.debug.render());
             return out;
         }
-        out.push(`define i32 @${this.mod.workers ? "sc_context_entry" : this.wasi ? "__main_argc_argv" : "main"}(i32 %argc, ptr %argv) ${FN_ATTRS} {`, `entry:`, ...(this.runtimeAbiMarker ? [`  call void @${RUNTIME_ABI_MARKER}()`] : []), ...(this.mod.workers ? [`  call void @scr_runtime_workers_v7()`] : []), `  call void @scr_init()`, ...stamps, 
+        out.push(`define i32 @${this.mod.workers ? "sc_context_entry" : this.wasi ? "__main_argc_argv" : "main"}(i32 %argc, ptr %argv) ${FN_ATTRS} {`, `entry:`, ...(this.runtimeAbiMarker ? [`  call void @${RUNTIME_ABI_MARKER}()`] : []), ...(this.mod.workers ? [`  call void @scr_runtime_workers_v8()`] : []), `  call void @scr_init()`, 
+        // Each context (the main thread, every worker) installs its stack
+        // guard before running compiled code that checks it.
+        ...(this.stackChecks?.size ? [`  call void @scr_stack_guard_init()`] : []), ...stamps, 
         // Event-surface programs (signal/exit listeners) fill the loop's
         // nullable event hooks before %main — scr_events.c links only when
         // this line is emitted (native/executable.ts gates on the same predicate).
@@ -1423,6 +1696,7 @@ export class LlEmitter {
         // both exit 1, like Node — the C main's loop block exactly.
         ...(runsLoop
             ? [
+                ...(this.mod.commonJsEntry === true ? [`  call void @scr_loop_commonjs_entry()`] : []),
                 `  %loop_rejection = call zeroext i1 @scr_loop_run(ptr ${asyncEntry ? "%top" : "null"})`,
                 `  %lexc = call zeroext i1 @scr_exc_pending()`,
                 `  br i1 %lexc, label %luncaught, label %lok`,
@@ -1486,7 +1760,7 @@ export class LlEmitter {
             ? [`  %test_exit = call i32 @scr_test_exit_code()`, `  ret i32 %test_exit`]
             : usesIsland
                 ? [`  %island_exit = call i32 @scr_island_exit_code()`, `  ret i32 %island_exit`]
-                : [`  %native_exit = call i32 @scr_exit_code_hint_get()`, `  ret i32 %native_exit`]), `}`, ``, 
+                : [`  %native_exit = call i32 @scr_exit_code_hint_get()`, `  ret i32 %native_exit`]), `}`, ``, ...this.inlineRcTail(flushedDecls), 
         // sanitize_address is inert under the plain pipeline; the sanitized
         // lane's -fsanitize=address link activates instrumentation over the
         // emitted functions too (the runtime TUs get theirs from clang).
@@ -1738,15 +2012,96 @@ export class LlEmitter {
             msgHelper("sc_bad_key", "sc_bad_key_msg", "scriptc: TypeError: record has no key (typed slot — no undefined is representable)\n");
         }
         if (this.needsRetainBox) {
-            // scr_box_retain is a static inline (increment-unless-immortal, then
-            // mark the cycle header live — every box is collector-headered);
+            // scr_box_retain is a static inline (increment-unless-immortal);
             // emitted once with internal linkage, like the record retains.
-            defs.push(`define internal ptr @sc_retain_box(ptr %b) ${FN_ATTRS} {`, `entry:`, `  %rc = load ${this.sizeType}, ptr %b`, `  %imm = icmp eq ${this.sizeType} %rc, -1`, `  br i1 %imm, label %done, label %inc`, `inc:`, `  %n = add ${this.sizeType} %rc, 1`, `  store ${this.sizeType} %n, ptr %b`, `  %colorp = getelementptr i8, ptr %b, ${this.sizeType} -${this.cycleColorOffset}`, `  store i32 0, ptr %colorp ; mark live`, `  br label %done`, `done:`, `  ret ptr %b`, `}`, ``);
+            defs.push(`define internal ptr @sc_retain_box(ptr %b) ${FN_ATTRS} {`, `entry:`, `  %rc = load ${this.sizeType}, ptr %b`, `  %imm = icmp eq ${this.sizeType} %rc, -1`, `  br i1 %imm, label %done, label %inc`, `inc:`, `  %n = add ${this.sizeType} %rc, 1`, `  store ${this.sizeType} %n, ptr %b`, `  br label %done`, `done:`, `  ret ptr %b`, `}`, ``);
+        }
+        // Number-key Map/Set lookups probe the runtime's direct index inline:
+        // while ndense is nonzero every live key is an integer below it, so an
+        // in-range integral key reads its slot (entry index + 1, 0 = absent) and
+        // any other key is absent. Maps without the index (ndense 0) and every
+        // non-integral probe outside the table take the runtime lookup, which
+        // keeps the complete SameValueZero semantics.
+        if (this.decls.has(NUMBER_MAP_ENTRY_DECL)) {
+            const sz = this.sizeType;
+            defs.push(`define internal ptr @sc_map_entry_f64(ptr %m, double %k) ${FN_ATTRS} {`, `entry:`, `  %ndp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 19`, `  %nd = load ${sz}, ptr %ndp`, `  %ndf = uitofp ${sz} %nd to double`, `  %lo = fcmp oge double %k, 0.0`, `  %hi = fcmp olt double %k, %ndf`, `  %in = and i1 %lo, %hi`, `  br i1 %in, label %direct, label %outside`, `direct:`, `  %i = fptoui double %k to ${sz}`, `  %back = uitofp ${sz} %i to double`, `  %int = fcmp oeq double %back, %k`, `  br i1 %int, label %slot, label %miss`, `slot:`, `  %dp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 18`, `  %dense = load ptr, ptr %dp`, `  %sp = getelementptr inbounds i32, ptr %dense, ${sz} %i`, `  %s = load i32, ptr %sp`, `  %empty = icmp eq i32 %s, 0`, `  br i1 %empty, label %miss, label %hit`, `hit:`, `  %e32 = sub i32 %s, 1`, sz === "i32" ? `  %e = add i32 %e32, 0` : `  %e = zext i32 %e32 to ${sz}`, `  %ep = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 12`, `  %entries = load ptr, ptr %ep`, `  %found = getelementptr inbounds %ScrMapEntry, ptr %entries, ${sz} %e`, `  ret ptr %found`, `miss:`, `  ret ptr null`, `outside:`, `  %dense.any = icmp ne ${sz} %nd, 0`, `  br i1 %dense.any, label %miss, label %slow`, `slow:`, `  %r = call ptr @scr_map_entry_f64(ptr %m, double %k)`, `  ret ptr %r`, `}`, ``);
+        }
+        // String comparisons enter through small internal wrappers that LLVM
+        // inlines at each site: interned literals and shared values compare by
+        // identity, and equality rejects different byte lengths, before any
+        // runtime call (scr_str_eq/scr_str_cmp keep the complete semantics).
+        if (this.decls.has(`declare zeroext i1 @scr_str_eq(ptr, ptr)`)) {
+            defs.push(`define internal zeroext i1 @sc_str_eq(ptr %a, ptr %b) ${FN_ATTRS} {`, `entry:`, `  %same = icmp eq ptr %a, %b`, `  br i1 %same, label %yes, label %lengths`, `lengths:`, `  %alen.p = getelementptr inbounds %ScrStr, ptr %a, i32 0, i32 1`, `  %blen.p = getelementptr inbounds %ScrStr, ptr %b, i32 0, i32 1`, `  %alen = load ${this.sizeType}, ptr %alen.p`, `  %blen = load ${this.sizeType}, ptr %blen.p`, `  %samelen = icmp eq ${this.sizeType} %alen, %blen`, `  br i1 %samelen, label %bytes, label %no`, `bytes:`, `  %eq = call zeroext i1 @scr_str_eq(ptr %a, ptr %b)`, `  ret i1 %eq`, `yes:`, `  ret i1 true`, `no:`, `  ret i1 false`, `}`, ``);
+        }
+        // String length and charCodeAt read proven-ASCII strings inline: bit 31
+        // of the capacity word (SCR_STR_ASCII_BIT, the low half's sign bit on
+        // little-endian targets) makes UTF-16 units bytes. Unproven strings and
+        // anything but an in-range index take the runtime's UTF-16 mapping.
+        for (const helper of STRING_READ_HELPERS) {
+            if (!this.decls.has(helper.decl))
+                continue;
+            defs.push(...helper.define(this.sizeType, FN_ATTRS), ``);
+        }
+        // Ordering also decides inline when the first bytes differ: byte order
+        // is the plain comparison's order, and the UTF-16 order whenever both
+        // bytes are ASCII. Callers only test the sign of the result.
+        for (const fn of ["scr_str_cmp", "scr_str_cmp_u16"]) {
+            if (!this.decls.has(`declare i32 @${fn}(ptr, ptr)`))
+                continue;
+            this.declare("declare i64 @llvm.bswap.i64(i64)");
+            const utf16 = fn === "scr_str_cmp_u16";
+            defs.push(`define internal i32 @${fn.replace(/^scr_/, "sc_")}(ptr %a, ptr %b) ${FN_ATTRS} {`, `entry:`, `  %same = icmp eq ptr %a, %b`, `  br i1 %same, label %equal, label %lengths`, `lengths:`, `  %alen.p = getelementptr inbounds %ScrStr, ptr %a, i32 0, i32 1`, `  %blen.p = getelementptr inbounds %ScrStr, ptr %b, i32 0, i32 1`, `  %alen = load ${this.sizeType}, ptr %alen.p`, `  %blen = load ${this.sizeType}, ptr %blen.p`, `  %aempty = icmp eq ${this.sizeType} %alen, 0`, `  %bempty = icmp eq ${this.sizeType} %blen, 0`, `  %empty = or i1 %aempty, %bempty`, `  br i1 %empty, label %order, label %words`, 
+            // Both at least 8 bytes: the first differing byte of one word pair.
+            // Byte-swapped little-endian words compare in byte order.
+            `words:`, `  %along = icmp uge ${this.sizeType} %alen, 8`, `  %blong = icmp uge ${this.sizeType} %blen, 8`, `  %long = and i1 %along, %blong`, `  br i1 %long, label %word, label %first`, `word:`, `  %awp = getelementptr inbounds %ScrStr, ptr %a, i32 1`, `  %bwp = getelementptr inbounds %ScrStr, ptr %b, i32 1`, `  %aw = load i64, ptr %awp, align 1`, `  %bw = load i64, ptr %bwp, align 1`, `  %wdiffer = icmp ne i64 %aw, %bw`, `  br i1 %wdiffer, label %wdiff, label %wsame`, `wdiff:`, ...(utf16
+                ? [
+                    `  %wbits = or i64 %aw, %bw`,
+                    `  %whigh = and i64 %wbits, -9187201950435737472`,
+                    `  %wascii = icmp eq i64 %whigh, 0`,
+                    `  br i1 %wascii, label %wordorder, label %order`,
+                ]
+                : [`  br label %wordorder`]), `wordorder:`, `  %asw = call i64 @llvm.bswap.i64(i64 %aw)`, `  %bsw = call i64 @llvm.bswap.i64(i64 %bw)`, `  %wbelow = icmp ult i64 %asw, %bsw`, `  %wsign = select i1 %wbelow, i32 -1, i32 1`, `  ret i32 %wsign`, 
+            // Equal first words and one length of at most 16 bytes: the word
+            // ending at that length covers the rest, and any difference lies
+            // past the equal first word.
+            `wsame:`, `  %samelen = icmp eq ${this.sizeType} %alen, %blen`, `  %short = icmp ule ${this.sizeType} %alen, 16`, `  %tailable = and i1 %samelen, %short`, `  br i1 %tailable, label %tail, label %order`, `tail:`, `  %toff = sub ${this.sizeType} %alen, 8`, `  %atp = getelementptr inbounds i8, ptr %awp, ${this.sizeType} %toff`, `  %btp = getelementptr inbounds i8, ptr %bwp, ${this.sizeType} %toff`, `  %at = load i64, ptr %atp, align 1`, `  %bt = load i64, ptr %btp, align 1`, `  %tdiffer = icmp ne i64 %at, %bt`, `  br i1 %tdiffer, label %tdiff, label %equal`, `tdiff:`, ...(utf16
+                ? [
+                    `  %tbits = or i64 %at, %bt`,
+                    `  %thigh = and i64 %tbits, -9187201950435737472`,
+                    `  %tascii = icmp eq i64 %thigh, 0`,
+                    `  br i1 %tascii, label %tailorder, label %order`,
+                ]
+                : [`  br label %tailorder`]), `tailorder:`, `  %ats = call i64 @llvm.bswap.i64(i64 %at)`, `  %bts = call i64 @llvm.bswap.i64(i64 %bt)`, `  %tbelow = icmp ult i64 %ats, %bts`, `  %tsign = select i1 %tbelow, i32 -1, i32 1`, `  ret i32 %tsign`, `first:`, `  %adata = getelementptr inbounds %ScrStr, ptr %a, i32 1`, `  %bdata = getelementptr inbounds %ScrStr, ptr %b, i32 1`, `  %x = load i8, ptr %adata`, `  %y = load i8, ptr %bdata`, `  %differ = icmp ne i8 %x, %y`, ...(utf16
+                ? [
+                    `  %bits = or i8 %x, %y`,
+                    `  %ascii = icmp sge i8 %bits, 0`,
+                    `  %decide = and i1 %differ, %ascii`,
+                ]
+                : [`  %decide = and i1 %differ, true`]), `  br i1 %decide, label %byte, label %order`, `byte:`, `  %below = icmp ult i8 %x, %y`, `  %sign = select i1 %below, i32 -1, i32 1`, `  ret i32 %sign`, `order:`, `  %c = call i32 @${fn}(ptr %a, ptr %b)`, `  ret i32 %c`, `equal:`, `  ret i32 0`, `}`, ``);
         }
         // The declarations these helpers added must land in the extern block,
         // which already flushed — append here instead (LLVM is order-free).
         return defs.length > 0 ? [...defs] : defs;
     }
+    /** The inline RC helpers every call site requested, emitted last so
+     * requests from main/library epilogues are included. Slow-path
+     * declarations a late request added after the extern block flushed land
+     * here too. */
+    inlineRcTail(flushedDecls) {
+        const late = inlineRcDecls(this.shapeHost).filter((d) => !flushedDecls.has(d));
+        // NULL-skipping retain wrappers of nullable unions; a runtime inner
+        // retain requested after the extern block flushed is declared here.
+        for (const inner of this.nullableUnions.retainWrappers.values()) {
+            const decl = `declare ptr ${inner}(ptr)`;
+            if (inner.startsWith("@scr_") && !flushedDecls.has(decl) && !late.includes(decl))
+                late.push(decl);
+        }
+        return [
+            ...late,
+            ...emitNullableRetainWrappers(this.shapeHost),
+            ...emitInlineRcHelpers(this.shapeHost),
+        ];
+    }
     /** Env-signature wrappers + interned immortal closures for declared
      * functions used as values (the runtime ABI’s sc_w_/sc_fc_ pair): every
      * mention of `f` yields the same pointer, so `f === f` holds. */
@@ -1761,7 +2116,7 @@ export class LlEmitter {
             // never the inner return type.
             const ret = fn.async === true || fn.generator !== undefined ? "ptr" : this.llType(fn.returnType);
             const call = `call ${ret} @${this.callTarget(name)}(${args})`;
-            out.push(`define internal ${ret} @${mangleWrapper(name)}(ptr %env${params.length ? ", " + params.join(", ") : ""}) ${FN_ATTRS} { ; ${name} as a value`, `entry:`, ret === "void" ? `  ${call}` : `  %r = ${call}`, ret === "void" ? `  ret void` : `  ret ${ret} %r`, `}`, `@${mangleFnClosure(name)} = internal ${this.mod.workers === true || this.mod.lib?.threadInstances === true ? "thread_local " : ""}global %ScrClosure { ${this.sizeType} -1, ptr @${mangleWrapper(name)}, ${this.sizeType} 0, ptr null, i32 ${(fn.generator ? 1 : 0) + (fn.async ? 2 : 0) + (fn.ownsPrototype ? 4 : 0)} }`, ``);
+            out.push(`define internal ${ret} @${mangleWrapper(name)}(ptr %env${params.length ? ", " + params.join(", ") : ""}) ${FN_ATTRS} { ; ${name} as a value`, `entry:`, ret === "void" ? `  ${call}` : `  %r = ${call}`, ret === "void" ? `  ret void` : `  ret ${ret} %r`, `}`, `@${mangleFnClosure(name)} = internal ${this.mod.workers === true || this.mod.lib?.threadInstances === true ? "thread_local " : ""}global %ScrClosure { ${this.sizeType} -1, ptr @${mangleWrapper(name)}, ${this.sizeType} 0, ptr null, i32 ${(fn.generator ? 1 : 0) + (fn.async ? 2 : 0) + (fn.ownsPrototype ? 4 : 0)}, i32 0, ptr null }`, ``);
         }
         return out;
     }
@@ -1776,7 +2131,6 @@ export class LlEmitter {
         const sizeOf = `ptrtoint (ptr getelementptr (%${pack}, ptr null, i32 1) to ${this.sizeType})`;
         this.declare(`declare void @free(ptr)`);
         this.declare(`declare ptr @malloc(${this.sizeType})`);
-        this.declare(`declare zeroext i1 @scr_exc_pending()`);
         const tr = [
             `define internal void @${mangleTrampoline(fn.name)}(ptr %self, ptr %ap) ${FN_ATTRS} {`,
             `entry:`,
@@ -1815,6 +2169,153 @@ export class LlEmitter {
         });
         return { definitions, pack, lifted, fieldTys, ret, tr, spawnParams, argPackLines };
     }
+    /** Settles `promise` from a clean async body result `%r` (moved in). */
+    asyncFulfillLines(ret, promise) {
+        switch (ret.kind) {
+            case "void":
+                this.declare(`declare void @scr_promise_fulfill_void(ptr)`);
+                return [`  call void @scr_promise_fulfill_void(ptr ${promise})`];
+            case "f64":
+            case "date":
+                this.declare(`declare void @scr_promise_fulfill_f64(ptr, double)`);
+                return [`  call void @scr_promise_fulfill_f64(ptr ${promise}, double %r)`];
+            case "bool":
+                this.declare(`declare void @scr_promise_fulfill_bool(ptr, i1 zeroext)`);
+                return [`  call void @scr_promise_fulfill_bool(ptr ${promise}, i1 %r)`];
+            case "string":
+                this.declare(`declare void @scr_promise_fulfill_str(ptr, ptr)`);
+                return [`  call void @scr_promise_fulfill_str(ptr ${promise}, ptr %r) ; moves in`];
+            case "dyn":
+                this.declare(`declare void @scr_promise_resolve_dyn(ptr, ptr)`);
+                return [`  call void @scr_promise_resolve_dyn(ptr ${promise}, ptr %r) ; moves in`];
+            default: {
+                const v = vAdapters(this.shapeHost, ret);
+                this.declare(`declare void @scr_promise_fulfill_ref(ptr, ptr, ptr, ptr, ptr)`);
+                return [
+                    `  call void @scr_promise_fulfill_ref(ptr ${promise}, ptr %r, ptr ${v.retain}, ptr ${v.release}, ptr ${traceArg(this.shapeHost, ret)})`,
+                ];
+            }
+        }
+    }
+    /** Async functions whose calls can skip the fiber (scr_async_inline_*).
+     * A body qualifies only when nothing it runs can park its execution
+     * context: its emitted text, and the text of every module function it
+     * mentions (transitively), contains no suspension entry point. Such a
+     * body always completes before the call returns, which is exactly the
+     * behavior of a fiber that never suspends. Excluded conservatively:
+     * wasm32 (its coroutine lowering owns async bodies), programs embedding
+     * the dynamic engine, module-evaluation bodies (their promise caches),
+     * `dyn` results (resolution may adopt a thenable), and every program
+     * that uses node:test subtests — `t.test()` runs a subtest inline and
+     * awaits it on the CURRENT fiber even from synchronous code. Worker
+     * programs keep fibers too: their fiber epilogue owns context
+     * termination (a stopping worker rejects and observes the promise), which
+     * the fiberless wrapper does not reproduce. A missed suspension still
+     * cannot reorder silently: the runtime traps when a context parks while a
+     * fiberless body is on its stack. */
+    fiberlessAsyncFunctions() {
+        const eligible = new Set();
+        if (this.wasi || this.mod.workers === true)
+            return eligible;
+        const embedded = this.mod.embedded;
+        if (embedded !== undefined && embedded.modules.length > 0)
+            return eligible;
+        const suspends = /@scr_(?:await_|module_await\b|promise_await_settled\b|test_sub\b|gen_yield_|async_gen_|fiber_)/;
+        for (const decl of this.decls)
+            if (/@scr_test_sub\b/.test(decl))
+                return eligible;
+        for (const text of this.fnDefText.values())
+            if (/@scr_test_sub\b/.test(text))
+                return eligible;
+        const byMangled = new Map();
+        for (const fn of this.mod.functions) {
+            byMangled.set(mangleFunction(fn.name), fn.name);
+            byMangled.set(mangleBorrowedFunction(fn.name), fn.name);
+        }
+        // Reverse mention edges, then propagate "may park" to every mentioner.
+        const mentionedBy = new Map();
+        const parks = new Set();
+        const work = [];
+        for (const [name, text] of this.fnDefText) {
+            if (suspends.test(text)) {
+                parks.add(name);
+                work.push(name);
+            }
+            for (const match of text.matchAll(/@(sc_b?f_[A-Za-z0-9_]+)/g)) {
+                const callee = byMangled.get(match[1]);
+                if (callee === undefined || callee === name)
+                    continue;
+                let callers = mentionedBy.get(callee);
+                if (callers === undefined)
+                    mentionedBy.set(callee, (callers = new Set()));
+                callers.add(name);
+            }
+        }
+        while (work.length > 0) {
+            const callers = mentionedBy.get(work.pop());
+            if (callers === undefined)
+                continue;
+            for (const caller of callers) {
+                if (parks.has(caller))
+                    continue;
+                parks.add(caller);
+                work.push(caller);
+            }
+        }
+        for (const fn of this.mod.functions) {
+            if (fn.async !== true || fn.generator !== undefined)
+                continue;
+            if (fn.asyncCacheGlobal !== undefined || fn.asyncCycleCacheGlobal !== undefined)
+                continue;
+            if (fn.returnType.kind === "dyn" || parks.has(fn.name))
+                continue;
+            if (!this.fnDefText.has(fn.name))
+                continue;
+            eligible.add(fn.name);
+        }
+        return eligible;
+    }
+    /** The spawn wrapper of a fiberless async function: runs the body on the
+     * caller's stack between scr_async_inline_enter/leave and settles the
+     * fresh promise from its outcome — the fiber trampoline's epilogue,
+     * without the fiber. */
+    emitFiberlessAsyncSpawn(fn, spawnParams) {
+        const ret = fn.returnType;
+        const retTy = this.llType(ret);
+        const lifted = fn.captures !== undefined;
+        this.declare(`declare void @scr_async_inline_enter(ptr)`);
+        this.declare(`declare ptr @scr_async_inline_leave(ptr)`);
+        this.declare(`declare void @scr_promise_reject_pending(ptr)`);
+        if (lifted) {
+            this.declare(`declare ptr @scr_closure_retain_v(ptr)`);
+            this.declare(`declare void @scr_closure_release(ptr)`);
+        }
+        const bodyCall = `call ${retTy} @${mangleFunction(fn.name)}(${spawnParams.join(", ")})`;
+        const out = [
+            `define internal ptr @${mangleAsyncSpawn(fn.name)}(${spawnParams.join(", ")}) ${FN_ATTRS} { ; fiberless ${fn.name}`,
+            `entry:`,
+            `  %frame = alloca { ptr, ptr }`,
+            // The fiber path holds +1 on a lifted environment for the body's
+            // duration (packed, released by the trampoline); keep that lifetime.
+            ...(lifted ? [`  %env = call ptr @scr_closure_retain_v(ptr %a0)`] : []),
+            `  call void @scr_async_inline_enter(ptr %frame)`,
+            retTy === "void" ? `  ${bodyCall}` : `  %r = ${bodyCall}`,
+            ...(lifted ? [`  call void @scr_closure_release(ptr %a0)`] : []),
+            ...this.pendingTestLines("%pend"),
+            `  %p = call ptr @scr_async_inline_leave(ptr %frame)`,
+            `  br i1 %pend, label %thrown, label %clean`,
+            `clean:`,
+            ...this.asyncFulfillLines(ret, "%p"),
+            `  ret ptr %p`,
+            `thrown:`,
+        ];
+        if (ret.kind !== "void" && isRefCounted(ret)) {
+            // An escaping throw means %r is the never-read dummy (NULL).
+            out.push(`  call void ${releaseSym(this.shapeHost, ret)}(ptr %r)`);
+        }
+        out.push(`  call void @scr_promise_reject_pending(ptr %p)`, `  ret ptr %p`, `}`, ``);
+        return out;
+    }
     /** Per-async-function machinery — async.ts's scaffolding, .ll
      * flavored: an argument-pack struct type, a fiber trampoline (unpacks,
      * frees the pack, runs the ordinary compiled body, settles the
@@ -1829,9 +2330,20 @@ export class LlEmitter {
             this.declare(`declare void @llvm.coro.destroy(ptr)`);
             out.push(`define void @scr_wasi_coro_resume(ptr %handle) ${FN_ATTRS} {`, `entry:`, `  call void @llvm.coro.resume(ptr %handle)`, `  ret void`, `}`, `define void @scr_wasi_coro_destroy(ptr %handle) ${FN_ATTRS} {`, `entry:`, `  call void @llvm.coro.destroy(ptr %handle)`, `  ret void`, `}`, ``);
         }
+        const fiberless = this.fiberlessAsyncFunctions();
         for (const fn of this.mod.functions) {
             if (fn.async !== true || fn.generator !== undefined)
                 continue;
+            if (fiberless.has(fn.name)) {
+                const fieldTys = [
+                    ...(fn.captures !== undefined ? ["ptr"] : []),
+                    ...fn.params.map((p) => this.llType(p.type)),
+                ];
+                const params = fieldTys.map((ty, i) => `${ty} %a${i}`);
+                for (const line of this.emitFiberlessAsyncSpawn(fn, params))
+                    out.push(line);
+                continue;
+            }
             const { definitions, ret, tr, spawnParams, argPackLines } = this.emitArgPackAndTrampolinePrologue(fn);
             for (const line of definitions)
                 out.push(line);
@@ -1848,35 +2360,9 @@ export class LlEmitter {
                 if (fn.captures !== undefined) {
                     this.declare(`declare void @scr_closure_release(ptr)`);
                 }
-                tr.push(`  %pend = call zeroext i1 @scr_exc_pending()`, `  br i1 %pend, label %thrown, label %clean`, `clean:`, `  %pr = call ptr @scr_fiber_promise(ptr %self)`);
-                switch (ret.kind) {
-                    case "void":
-                        this.declare(`declare void @scr_promise_fulfill_void(ptr)`);
-                        tr.push(`  call void @scr_promise_fulfill_void(ptr %pr)`);
-                        break;
-                    case "f64":
-                    case "date":
-                        this.declare(`declare void @scr_promise_fulfill_f64(ptr, double)`);
-                        tr.push(`  call void @scr_promise_fulfill_f64(ptr %pr, double %r)`);
-                        break;
-                    case "bool":
-                        this.declare(`declare void @scr_promise_fulfill_bool(ptr, i1 zeroext)`);
-                        tr.push(`  call void @scr_promise_fulfill_bool(ptr %pr, i1 %r)`);
-                        break;
-                    case "string":
-                        this.declare(`declare void @scr_promise_fulfill_str(ptr, ptr)`);
-                        tr.push(`  call void @scr_promise_fulfill_str(ptr %pr, ptr %r) ; moves in`);
-                        break;
-                    case "dyn":
-                        this.declare(`declare void @scr_promise_resolve_dyn(ptr, ptr)`);
-                        tr.push(`  call void @scr_promise_resolve_dyn(ptr %pr, ptr %r) ; moves in`);
-                        break;
-                    default: {
-                        const v = vAdapters(this.shapeHost, ret);
-                        this.declare(`declare void @scr_promise_fulfill_ref(ptr, ptr, ptr, ptr, ptr)`);
-                        tr.push(`  call void @scr_promise_fulfill_ref(ptr %pr, ptr %r, ptr ${v.retain}, ptr ${v.release}, ptr ${traceArg(this.shapeHost, ret)})`);
-                    }
-                }
+                tr.push(...this.pendingTestLines("%pend"), `  br i1 %pend, label %thrown, label %clean`, `clean:`, `  %pr = call ptr @scr_fiber_promise(ptr %self)`);
+                for (const line of this.asyncFulfillLines(ret, "%pr"))
+                    tr.push(line);
                 tr.push(`  ret void`, `thrown:`);
                 if (ret.kind !== "void" && isRefCounted(ret)) {
                     // An escaping throw means %r is the never-read dummy (NULL).
@@ -1983,7 +2469,7 @@ export class LlEmitter {
                 tr.push(`  ret void`, `}`, ``);
             }
             else {
-                tr.push(`  %g = call ptr @scr_gen_of_fiber(ptr %self)`, `  %pend = call zeroext i1 @scr_exc_pending()`, `  br i1 %pend, label %thrown, label %clean`, `clean:`);
+                tr.push(`  %g = call ptr @scr_gen_of_fiber(ptr %self)`, ...this.pendingTestLines("%pend"), `  br i1 %pend, label %thrown, label %clean`, `clean:`);
                 switch (ret.kind) {
                     case "void":
                         tr.push(`  br label %done ; void body: the done value is undefined (NONE)`);
@@ -2073,10 +2559,30 @@ export class LlEmitter {
         return out;
     }
     // ── plumbing (frame and scope ownership) ──────
+    /** A symbol derived from the constant's text rather than its first-use
+     * index, so an edit that interns one more string leaves every other
+     * constant's symbol, and the code referencing it, unchanged. This lets
+     * native builds reuse the compiled partitions an edit does not touch. A
+     * collision retries with a counter, still in first-use order. */
+    contentSymbol(prefix, text) {
+        for (let attempt = 0;; attempt++) {
+            const digest = createHash("sha256")
+                .update(attempt === 0 ? text : `${attempt}\0${text}`)
+                .digest("hex");
+            const symbol = `${prefix}${parseInt(digest.slice(0, 13), 16)}`;
+            if (!this.contentSymbols.has(symbol)) {
+                this.contentSymbols.add(symbol);
+                return symbol;
+            }
+        }
+    }
     internLiteral(text) {
         let lit = this.literals.get(text);
         if (!lit) {
-            lit = { sym: `sc_lit_${this.literals.size}`, len: Buffer.byteLength(text, "utf8") };
+            lit = {
+                sym: this.contentSymbol("sc_lit_", text),
+                len: Buffer.byteLength(text, "utf8"),
+            };
             this.literals.set(text, lit);
         }
         const name = `@${lit.sym}`;
@@ -2088,7 +2594,7 @@ export class LlEmitter {
     cstr(text) {
         let c = this.cstrs.get(text);
         if (!c) {
-            c = { sym: `sc_cs_${this.cstrs.size}`, len: Buffer.byteLength(text, "utf8") };
+            c = { sym: this.contentSymbol("sc_cs_", text), len: Buffer.byteLength(text, "utf8") };
             this.cstrs.set(text, c);
         }
         return `@${c.sym}`;
@@ -2105,6 +2611,12 @@ export class LlEmitter {
         if (!arm || !isUnitType(arm)) {
             throw new InternalCompilerError(`llvm emitter bug: unit instance for non-unit arm ${tag} of ${unionId}`);
         }
+        const nullable = this.nullableUnions.get(unionId);
+        if (nullable) {
+            // NULL is the unit arm of a nullable union (`undefined` when it has
+            // both); the `null` sentinel is immortal. Neither owns anything.
+            return tag === nullable.nullTag ? NULLABLE_NULL : "null";
+        }
         const key = `${unionId}:${tag}`;
         let sym = this.unitInstances.get(key);
         if (!sym) {
@@ -2115,6 +2627,56 @@ export class LlEmitter {
         this.immortalValues.add(name);
         return name;
     }
+    /** The immortal ABSENT state of an undefined-armed record field slot
+     * (IR fieldAbsent). */
+    absentInstanceRef(unionId) {
+        if (undefinedArmTag({ kind: "union", unionId }, this.unionsById) < 0) {
+            throw new InternalCompilerError(`llvm emitter bug: absent state of ${unionId} without undefined`);
+        }
+        if (this.nullableUnions.has(unionId)) {
+            this.needsNullableAbsent = true;
+            this.immortalValues.add(NULLABLE_ABSENT);
+            return NULLABLE_ABSENT;
+        }
+        let sym = this.absentInstances.get(unionId);
+        if (!sym) {
+            sym = `sc_absent_${this.absentInstances.size}`;
+            this.absentInstances.set(unionId, sym);
+        }
+        const name = `@${sym}`;
+        this.immortalValues.add(name);
+        return name;
+    }
+    /** i1: a union value loaded from a field slot is the ABSENT state — the
+     * undefined arm's tag with the absent payload marker. */
+    fieldAbsentTest(value, unionId) {
+        return this.fieldAbsentTestIn(this.B, value, unionId);
+    }
+    /** fieldAbsentTest in another block builder (helper generators). A
+     * nullable union's ABSENT state is the module's immortal sentinel. */
+    fieldAbsentTestIn(B, value, unionId) {
+        if (this.nullableUnions.has(unionId)) {
+            this.needsNullableAbsent = true;
+            const t = B.tmp();
+            B.line(`${t} = icmp eq ptr ${value}, ${NULLABLE_ABSENT}`);
+            return t;
+        }
+        return emitFieldAbsentTest(B, value, undefinedArmTag({ kind: "union", unionId }, this.unionsById));
+    }
+    /** Loads a record field slot as a VALUE: an undefined-armed union slot
+     * holding the ABSENT state surfaces as the ordinary undefined arm, so
+     * absence never travels beyond its slot (a later `{ f: r.f }` is an
+     * explicit, present property). */
+    loadRecordField(ptr, t) {
+        const v = this.loadField(ptr, t);
+        if (t.kind !== "union" || undefinedArmTag(t, this.unionsById) < 0)
+            return v;
+        const absent = this.fieldAbsentTest(v, t.unionId);
+        const unit = this.unitInstanceRef(t.unionId, undefinedArmTag(t, this.unionsById));
+        const out = this.B.tmp();
+        this.B.line(`${out} = select i1 ${absent}, ptr ${unit}, ptr ${v}`);
+        return out;
+    }
     declare(decl) {
         this.decls.add(decl);
     }
@@ -2127,9 +2689,20 @@ export class LlEmitter {
             throw new InternalCompilerError("llvm emitter bug: no active statement frame");
         return frame;
     }
+    /** Whether a value is immortal: an interned constant, or a temp marked by
+     * markImmortal. */
+    isImmortal(name) {
+        return this.immortalValues.has(name) || this.B.immortalTemps.has(name);
+    }
+    /** Record that a temp holds an immortal value (a choice between interned
+     * literals): nothing owns it, and retains, releases and moves skip it. */
+    markImmortal(v) {
+        this.B.immortalTemps.add(v.name);
+        return v;
+    }
     /** Registers an owned refcounted value on the current statement frame. */
     own(v) {
-        if (isRefCounted(v.type) && !this.immortalValues.has(v.name))
+        if (isRefCounted(v.type) && !this.isImmortal(v.name))
             this.currentFrame().push(v);
         return v;
     }
@@ -2141,7 +2714,7 @@ export class LlEmitter {
     }
     /** Strike a refcounted temp from its frame: ownership is being moved. */
     moveTemp(v) {
-        if (!isRefCounted(v.type) || this.immortalValues.has(v.name))
+        if (!isRefCounted(v.type) || this.isImmortal(v.name))
             return;
         for (let i = this.frames.length - 1; i >= 0; i--) {
             const idx = this.frames[i].findIndex((e) => e.name === v.name);
@@ -2155,7 +2728,7 @@ export class LlEmitter {
     /** The retained (+1) read of a refcounted value — type-directed through
      * the `_v` table (immortals skip, exactly the C retain calls). */
     retainValue(name, type) {
-        if (this.immortalValues.has(name))
+        if (this.isImmortal(name))
             return name;
         const t = this.B.tmp();
         this.B.line(`${t} = call ptr ${retainSym(this.shapeHost, type)}(ptr ${name})`);
@@ -2164,7 +2737,7 @@ export class LlEmitter {
     /** The release call for one owned refcounted value — type-directed like
      * releaseCallC (all runtime releases are NULL-tolerant). */
     releaseValue(name, type) {
-        if (this.immortalValues.has(name))
+        if (this.isImmortal(name))
             return;
         this.B.line(`call void ${releaseSym(this.shapeHost, type)}(ptr ${name})`);
     }
@@ -2174,8 +2747,7 @@ export class LlEmitter {
                 const t = this.B.tmp();
                 this.B.line(`${t} = load ptr, ptr ${v.name}`);
                 if (v.boxed) {
-                    this.declare(`declare void @scr_box_release(ptr)`);
-                    this.B.line(`call void @scr_box_release(ptr ${t})`);
+                    this.B.line(`call void ${boxReleaseSym(this.shapeHost)}(ptr ${t})`);
                 }
                 else {
                     this.releaseValue(t, v.type);
@@ -2190,9 +2762,22 @@ export class LlEmitter {
         for (const e of scope) {
             const t = this.B.tmp();
             this.B.line(`${t} = load ptr, ptr ${e.slot}`);
-            if (e.boxed) {
-                this.declare(`declare void @scr_box_release(ptr)`);
-                this.B.line(`call void @scr_box_release(ptr ${t})`);
+            if (e.boxed && e.lazy) {
+                // Unreachable code after a terminator emits nothing; a new block
+                // here would revive it.
+                if (this.B.isTerminated())
+                    continue;
+                const created = this.B.tmp();
+                this.B.line(`${created} = icmp ne ptr ${t}, null`);
+                const release = this.B.newLabel("lazy.release"), join = this.B.newLabel("lazy.release.j");
+                this.B.condBr(created, release, join);
+                this.B.startBlock(release);
+                this.B.line(`call void ${boxReleaseSym(this.shapeHost)}(ptr ${t})`);
+                this.B.br(join);
+                this.B.startBlock(join);
+            }
+            else if (e.boxed) {
+                this.B.line(`call void ${boxReleaseSym(this.shapeHost)}(ptr ${t})`);
             }
             else {
                 this.releaseValue(t, e.type); // runtime releases are NULL-tolerant
@@ -2242,8 +2827,11 @@ export class LlEmitter {
      * function — and branch to the handler / return a dummy value (never
      * read: callers of a may-throw function test the pending flag before
      * using the result). Callers own the surrounding pending branch; a
-     * `throw` unwinds unconditionally. */
-    emitUnwind() {
+     * `throw` unwinds unconditionally. `passThrough` names a scalar call
+     * result of the function's own return type: with nothing to release, the
+     * unwind returns it as the dummy, so a call in tail position keeps a single
+     * return and stays eligible for tail-call and recursion elimination. */
+    emitUnwind(passThrough) {
         if (this.mod.workers && this.tryStack.length > 0) {
             this.declare(`declare zeroext i1 @scr_context_stopping()`);
             const stopped = this.B.tmp();
@@ -2272,13 +2860,13 @@ export class LlEmitter {
             terminator = `br label %${this.currentWasiCoro.finalLabel}`;
         }
         else {
-            const t = this.currentReturnType;
+            const t = this.llType(this.currentReturnType);
             terminator =
-                t.kind === "void"
+                t === "void"
                     ? "ret void"
-                    : t.kind === "f64" || t.kind === "date"
+                    : t === "double"
                         ? `ret double ${f64Lit(0)}`
-                        : t.kind === "bool"
+                        : t === "i1"
                             ? "ret i1 false"
                             : "ret ptr null";
         }
@@ -2293,6 +2881,11 @@ export class LlEmitter {
             }
         }
         if (entries.length === 0) {
+            if (passThrough !== undefined && !target && this.currentWasiCoro === null) {
+                const t = this.llType(this.currentReturnType);
+                if (t === "double" || t === "i1")
+                    terminator = `ret ${t} ${passThrough}`;
+            }
             this.B.terminate(terminator);
             return;
         }
@@ -2303,24 +2896,147 @@ export class LlEmitter {
         }
         this.B.br(cleanup.label);
     }
+    /** Instructions (two-space indented) that set the i1 `dest` to "an
+     * exception is pending in the active context" — scr_exc_pending()'s
+     * meaning — for the helper and adapter bodies that test it outside
+     * emitPendingCheck. Executables read the runtime's exported active-cell
+     * pointer and compare its i32 kind (offset 0) against SCR_EXC_NONE inline,
+     * as emitPendingCheck does; the out-of-line call would be opaque to LLVM
+     * because the runtime links as prebuilt objects. Libraries and worker
+     * programs keep the runtime call, which is emitPendingCheck's path there
+     * too (workers also observe cross-thread termination in it). */
+    pendingTestLines(dest) {
+        if (this.mod.lib !== undefined || this.mod.workers === true) {
+            this.declare(`declare zeroext i1 @scr_exc_pending()`);
+            return [`  ${dest} = call zeroext i1 @scr_exc_pending()`];
+        }
+        this.declare(`@scr_exc_active = external global ptr`);
+        return [
+            `  ${dest}.cell = load ptr, ptr @scr_exc_active`,
+            `  ${dest}.kind = load i32, ptr ${dest}.cell`,
+            `  ${dest} = icmp ne i32 ${dest}.kind, 0`,
+        ];
+    }
     /** The emitter contract for exceptions: after EVERY call that can throw
      * (per the may-throw analysis), test the pending flag and unwind. The
      * call's result temp must join its frame BEFORE this runs so the unwind
-     * releases the dummy (NULL for refcounted kinds) harmlessly. */
-    emitPendingCheck() {
+     * releases the dummy (NULL for refcounted kinds) harmlessly. A scalar
+     * call result of the function's return type may be passed as the unwind's
+     * dummy value (see emitUnwind). */
+    emitPendingCheck(passThrough) {
+        const through = passThrough !== undefined &&
+            this.llType(passThrough.type) === this.llType(this.currentReturnType) &&
+            (passThrough.type.kind === "f64" || passThrough.type.kind === "bool")
+            ? passThrough.name
+            : undefined;
         const B = this.B;
         if (B.isTerminated())
             return;
-        this.declare(`declare zeroext i1 @scr_exc_pending()`);
-        const p = B.tmp();
-        B.line(`${p} = call zeroext i1 @scr_exc_pending()`);
+        if (this.mod.lib !== undefined) {
+            this.declare(`declare zeroext i1 @scr_exc_pending()`);
+            const p = B.tmp();
+            B.line(`${p} = call zeroext i1 @scr_exc_pending()`);
+            const lu = B.newLabel("exc.u");
+            const lk = B.newLabel("exc.k");
+            B.condBr(p, lu, lk);
+            B.startBlock(lu);
+            this.emitUnwind(through);
+            B.startBlock(lk);
+            return;
+        }
+        // Executables test the active exception cell's kind inline (its first
+        // field). Worker programs test the process-wide alert word instead: it
+        // is nonzero while any script thread may have an exception pending in
+        // its active cell or has been asked to stop, so the common case is one
+        // ordinary global load (a thread-local access is a call on Darwin) and
+        // the out-of-line scr_exc_pending answers for this thread, observing
+        // cancellation and reinstalling the termination sentinel.
+        this.declare(`declare i1 @llvm.expect.i1(i1, i1)`);
+        let word;
+        if (this.mod.workers === true) {
+            this.declare(`@scr_exc_alert = external global i32, align 64`);
+            word = B.tmp();
+            B.line(`${word} = load atomic i32, ptr @scr_exc_alert monotonic, align 64`);
+        }
+        else {
+            this.declare(`@scr_exc_active = external global ptr`);
+            let cell;
+            if (B.excCellInvariant) {
+                // Fiber switches restore the active cell before control returns to a
+                // synchronous frame, so its pointer is one value for the whole call:
+                // load it once in the entry block and test only the kind here.
+                if (B.excCell === null) {
+                    B.excCell = "%exc.cell";
+                    B.entryAllocas.push(`${B.excCell} = load ptr, ptr @scr_exc_active`);
+                }
+                cell = B.excCell;
+            }
+            else {
+                cell = B.tmp();
+                B.line(`${cell} = load ptr, ptr @scr_exc_active`);
+            }
+            word = B.tmp();
+            B.line(`${word} = load i32, ptr ${cell}`);
+        }
+        const hit = B.tmp();
+        const cold = B.tmp();
+        B.line(`${hit} = icmp ne i32 ${word}, 0`);
+        B.line(`${cold} = call i1 @llvm.expect.i1(i1 ${hit}, i1 false)`);
         const lu = B.newLabel("exc.u");
         const lk = B.newLabel("exc.k");
-        B.condBr(p, lu, lk);
+        if (this.mod.workers === true) {
+            this.declare(`declare zeroext i1 @scr_exc_pending()`);
+            const slow = B.newLabel("exc.s");
+            B.condBr(cold, slow, lk);
+            B.startBlock(slow);
+            const p = B.tmp();
+            B.line(`${p} = call zeroext i1 @scr_exc_pending()`);
+            B.condBr(p, lu, lk);
+        }
+        else {
+            B.condBr(cold, lu, lk);
+        }
         B.startBlock(lu);
-        this.emitUnwind();
+        this.emitUnwind(through);
         B.startBlock(lk);
     }
+    /** After a runtime call that ALWAYS leaves an exception pending (the
+     * compiler-resolved Node throws): the pending test would always answer
+     * true, so unwind unconditionally. Emission continues in a block with no
+     * predecessors so the caller's remaining instructions stay well-formed;
+     * LLVM deletes it. */
+    emitAlwaysPendingUnwind() {
+        const B = this.B;
+        if (B.isTerminated())
+            return;
+        this.emitUnwind();
+        B.startBlock(B.newLabel("exc.dead"));
+    }
+    /** A recursive function's entry check: below the running stack's guard,
+     * throw Node's RangeError and unwind like any other pending exception. */
+    emitStackCheck() {
+        const B = this.B;
+        const tl = this.mod.workers === true ? "thread_local " : "";
+        this.declare(`@scr_stack_guard = external ${tl}global ptr`);
+        this.declare(`declare ptr @llvm.stacksave.p0()`);
+        this.declare(`declare i1 @llvm.expect.i1(i1, i1)`);
+        this.declare(`declare void @scr_stack_overflow()`);
+        const sp = B.tmp();
+        const guard = B.tmp();
+        const low = B.tmp();
+        const cold = B.tmp();
+        B.line(`${sp} = call ptr @llvm.stacksave.p0()`);
+        B.line(`${guard} = load ptr, ptr @scr_stack_guard`);
+        B.line(`${low} = icmp ult ptr ${sp}, ${guard}`);
+        B.line(`${cold} = call i1 @llvm.expect.i1(i1 ${low}, i1 false)`);
+        const over = B.newLabel("stack.over");
+        const ok = B.newLabel("stack.ok");
+        B.condBr(cold, over, ok);
+        B.startBlock(over);
+        B.line(`call void @scr_stack_overflow()`);
+        this.emitUnwind();
+        B.startBlock(ok);
+    }
     workerLoopBudget() {
         if (!this.mod.workers)
             return null;
@@ -2418,26 +3134,27 @@ export class LlEmitter {
             const def = this.unionsById.get(v.type.unionId);
             if (!def)
                 throw new InternalCompilerError(`llvm emitter bug: truthiness of unknown union ${v.type.unionId}`);
+            const nullable = this.nullableUnions.get(def.id);
+            // Object arms are always truthy: present iff neither unit encoding.
+            if (nullable && isObjectArm(nullable))
+                return emitNullablePresent(B, nullable, v.name);
+            const unionId = def.id;
             const slot = B.slot();
             B.entryAllocas.push(`${slot} = alloca i1`);
             const join = B.newLabel("ut.j");
             this.unionTagSwitch(v.name, def, (arm) => {
                 let valueName = "false";
                 if (arm.kind === "f64" || arm.kind === "procStream") {
-                    valueName = B.tmp();
-                    this.declare(`declare double @scr_union_get_f64(ptr)`);
-                    B.line(`${valueName} = call double @scr_union_get_f64(ptr ${v.name})`);
+                    valueName = this.unionGetF64(v.name);
                 }
                 else if (arm.kind === "bool") {
-                    valueName = B.tmp();
-                    this.declare(`declare zeroext i1 @scr_union_get_bool(ptr)`);
-                    B.line(`${valueName} = call zeroext i1 @scr_union_get_bool(ptr ${v.name})`);
+                    valueName = this.unionGetBool(v.name);
                 }
                 else if (arm.kind === "string") {
-                    valueName = this.unionPeek(v.name);
+                    valueName = this.unionPeek(v.name, unionId);
                 }
                 else if (arm.kind === "bigint" || arm.kind === "dyn" || arm.kind === "jsval") {
-                    valueName = this.unionPeek(v.name);
+                    valueName = this.unionPeek(v.name, unionId);
                 }
                 const truthy = this.truthyOf(arm.kind, valueName, true);
                 B.line(`store i1 ${truthy}, ptr ${slot}`);
@@ -2543,22 +3260,22 @@ export class LlEmitter {
         }
     }
     // ── union plumbing ──────────────────────────────────────────────────────
-    /** Loads a union box's tag (i32). */
-    unionTag(uName) {
-        const p = this.B.tmp();
-        const t = this.B.tmp();
-        this.B.line(`${p} = getelementptr inbounds %ScrUnion, ptr ${uName}, i64 0, i32 1`);
-        this.B.line(`${t} = load i32, ptr ${p}`);
-        return t;
+    /** A union value's tag (i32): the box's tag word, or the NULL test of a
+     * nullable union's pointer. */
+    unionTag(uName, unionId) {
+        return emitUnionTag(this.B, this.nullableUnions.get(unionId), uName);
+    }
+    /** Guard for helpers that build or read a union's `%ScrUnion` box
+     * directly (library-shaped unions with fixed arms): a nullable union
+     * reaching one is an emitter bug, never a silent miscompile. */
+    requireBoxedUnion(unionId) {
+        if (this.nullableUnions.has(unionId))
+            throw new InternalCompilerError(`llvm emitter bug: nullable union ${unionId} reached a tagged-box helper`);
     }
     /** The BORROWED payload pointer of a ref arm (scr_union_peek inlined —
-     * the runtime's is a static inline). */
-    unionPeek(uName) {
-        const p = this.B.tmp();
-        const t = this.B.tmp();
-        this.B.line(`${p} = getelementptr inbounds %ScrUnion, ptr ${uName}, i64 0, i32 5`);
-        this.B.line(`${t} = load ptr, ptr ${p}`);
-        return t;
+     * the runtime's is a static inline); a nullable union is its payload. */
+    unionPeek(uName, unionId) {
+        return emitUnionPeek(this.B, this.nullableUnions.get(unionId), uName);
     }
     /** Emits `switch` over a union's tag with one block per arm; each arm
      * body must TERMINATE its block (the callers branch to a join). The
@@ -2566,7 +3283,7 @@ export class LlEmitter {
      * reads can group equivalent storage prefixes and emit one representative. */
     unionTagSwitch(uName, def, arm, fieldGroups) {
         const B = this.B;
-        const tag = this.unionTag(uName);
+        const tag = this.unionTag(uName, def.id);
         const bad = B.newLabel("u.bad");
         const labels = [];
         if (fieldGroups) {
@@ -2610,29 +3327,46 @@ export class LlEmitter {
         B.terminate(`unreachable`);
     }
     /** The +1 extraction of a union's single narrowed arm (unionNarrow /
-     * the nullish-family reads): scalars via the runtime getters, ref arms
+     * the nullish-family reads): scalars via inline payload loads, ref arms
      * a retained peek. */
-    unionExtract(uName, arm) {
-        const B = this.B;
-        if (arm.kind === "f64" || arm.kind === "procStream") {
-            const t = B.tmp();
-            this.declare(`declare double @scr_union_get_f64(ptr)`);
-            B.line(`${t} = call double @scr_union_get_f64(ptr ${uName})`);
-            return t;
-        }
-        if (arm.kind === "bool") {
-            const t = B.tmp();
-            this.declare(`declare zeroext i1 @scr_union_get_bool(ptr)`);
-            B.line(`${t} = call zeroext i1 @scr_union_get_bool(ptr ${uName})`);
-            return t;
-        }
-        return this.retainValue(this.unionPeek(uName), arm);
+    unionExtract(uName, unionId, arm) {
+        if (arm.kind === "f64" || arm.kind === "procStream")
+            return this.unionGetF64(uName);
+        if (arm.kind === "bool")
+            return this.unionGetBool(uName);
+        return this.retainValue(this.unionPeek(uName, unionId), arm);
+    }
+    /** A scalar f64 arm's payload (scr_union_get_f64 inlined). Inline loads
+     * keep stack boxes free of escaping calls, so LLVM can scalarize them. */
+    unionGetF64(uName) {
+        const p = this.B.tmp();
+        const t = this.B.tmp();
+        this.B.line(`${p} = getelementptr inbounds %ScrUnion, ptr ${uName}, i64 0, i32 5`);
+        this.B.line(`${t} = load double, ptr ${p}`);
+        return t;
+    }
+    /** A bool arm's payload (scr_union_get_bool inlined: nonzero slot). */
+    unionGetBool(uName) {
+        const p = this.B.tmp();
+        const bits = this.B.tmp();
+        const t = this.B.tmp();
+        this.B.line(`${p} = getelementptr inbounds %ScrUnion, ptr ${uName}, i64 0, i32 5`);
+        this.B.line(`${bits} = load i64, ptr ${p}`);
+        this.B.line(`${t} = icmp ne i64 ${bits}, 0`);
+        return t;
     }
     /** Constructs a union box around an OWNED (+1, already moved) value —
      * the scr_union_new_* dispatch of unionWrap and the wrap-into-join
      * sites (shift). */
-    unionNewOwned(tag, v) {
+    unionNewOwned(unionId, tag, v) {
         const B = this.B;
+        const nullable = this.nullableUnions.get(unionId);
+        if (nullable) {
+            // The owned payload IS the nullable union's value.
+            if (tag !== nullable.refTag)
+                throw new InternalCompilerError(`llvm emitter bug: payload wrap into unit arm ${tag} of ${unionId}`);
+            return v.name;
+        }
         const t = B.tmp();
         if (v.type.kind === "f64" || v.type.kind === "procStream") {
             this.declare(`declare ptr @scr_union_new_f64(i32, double)`);
@@ -2775,6 +3509,42 @@ export class LlEmitter {
         B.line(`${z} = zext i1 ${value} to i8`);
         B.line(`store i8 ${z}, ptr ${ptr}${this.fieldAliasAttachment(ptr)}`);
     }
+    /** Reads an int32-specialized class field: the i32 slot is the value,
+     * and its widening is the exact double every program observation sees. */
+    loadInt32Field(ptr, type) {
+        const B = this.B;
+        const raw = B.tmp();
+        const number = B.tmp();
+        B.line(`${raw} = load i32, ptr ${ptr}${this.fieldAliasAttachment(ptr)}`);
+        B.line(`${number} = sitofp i32 ${raw} to double`);
+        return {
+            name: number,
+            type,
+            uint32: raw,
+            integer: { name: raw, type: "i32", signed: true, range: INT32_RANGE },
+        };
+    }
+    /** Stores a value the whole-program analysis proved to be an int32 (never
+     * -0, NaN or fractional) into an int32-specialized class field. */
+    storeInt32Field(ptr, value, expr) {
+        if (!this.int32Slots.provenWrites.has(expr))
+            throw new InternalCompilerError("llvm emitter bug: unproven int32 field write");
+        const B = this.B;
+        let bits;
+        if (value.integer?.type === "i32")
+            bits = value.integer.name;
+        else if (value.integer) {
+            bits = B.tmp();
+            B.line(`${bits} = trunc i64 ${value.integer.name} to i32`);
+        }
+        else if (value.uint32 !== undefined)
+            bits = value.uint32;
+        else {
+            bits = B.tmp();
+            B.line(`${bits} = fptosi double ${value.name} to i32`);
+        }
+        B.line(`store i32 ${bits}, ptr ${ptr}${this.fieldAliasAttachment(ptr)}`);
+    }
     // ── bindings ────────────────────────────────────────────────────────────
     /** A binding's storage: a module global, a plain local slot, or a boxed
      * local (the slot holds the capture BOX; access goes through it). */
@@ -2806,17 +3576,26 @@ export class LlEmitter {
         this.B.line(`${b} = load ptr, ptr ${slot}`);
         return b;
     }
+    /** The payload slot of a capture box (ScrBox.slot, field 5). */
+    boxSlot(box) {
+        const slot = this.B.tmp();
+        this.B.line(`${slot} = getelementptr inbounds %ScrBox, ptr ${box}, i32 0, i32 5`);
+        return slot;
+    }
     boxGet(box, t) {
         const B = this.B;
         const acc = boxAccess(t);
         const r = B.tmp();
+        // Scalar payloads are read in place (scr_box_get_f64/bool are a
+        // memcpy and a nonzero test of the same slot), so LLVM can keep a
+        // captured number in a register across a loop of calls.
         if (acc === "f64") {
-            this.declare(`declare double @scr_box_get_f64(ptr)`);
-            B.line(`${r} = call double @scr_box_get_f64(ptr ${box})`);
+            B.line(`${r} = load double, ptr ${this.boxSlot(box)}`);
         }
         else if (acc === "bool") {
-            this.declare(`declare zeroext i1 @scr_box_get_bool(ptr)`);
-            B.line(`${r} = call zeroext i1 @scr_box_get_bool(ptr ${box})`);
+            const raw = B.tmp();
+            B.line(`${raw} = load i64, ptr ${this.boxSlot(box)}`);
+            B.line(`${r} = icmp ne i64 ${raw}, 0`);
         }
         else {
             this.declare(`declare ptr @scr_box_get_ref(ptr)`);
@@ -2829,18 +3608,45 @@ export class LlEmitter {
         const B = this.B;
         const acc = boxAccess(t);
         if (acc === "f64") {
-            this.declare(`declare void @scr_box_set_f64(ptr, double)`);
-            B.line(`call void @scr_box_set_f64(ptr ${box}, double ${value})`);
+            B.line(`store double ${value}, ptr ${this.boxSlot(box)}`);
         }
         else if (acc === "bool") {
-            this.declare(`declare void @scr_box_set_bool(ptr, i1 zeroext)`);
-            B.line(`call void @scr_box_set_bool(ptr ${box}, i1 ${value})`);
+            const raw = B.tmp();
+            B.line(`${raw} = zext i1 ${value} to i64`);
+            B.line(`store i64 ${raw}, ptr ${this.boxSlot(box)}`);
         }
         else {
             this.declare(`declare void @scr_box_set_ref(ptr, ptr)`);
             B.line(`call void @scr_box_set_ref(ptr ${box}, ptr ${value})`);
         }
     }
+    /** The box a new environment captures for `localId` (borrowed). An
+     * unchanged parameter gets one box on first capture, holding its own
+     * reference to the value; the function scope releases the cached box. */
+    captureBox(localId) {
+        const cache = this.lazyCaptureBoxes.get(localId);
+        if (cache === undefined)
+            return this.loadBox(`%${mangleLocal(localId)}`);
+        const B = this.B;
+        const type = this.currentLocals.get(localId).type;
+        const current = this.loadBox(cache);
+        const missing = B.tmp();
+        B.line(`${missing} = icmp eq ptr ${current}, null`);
+        const create = B.newLabel("lazy.box"), join = B.newLabel("lazy.box.j");
+        B.condBr(missing, create, join);
+        B.startBlock(create);
+        const stack = this.lazyStackBoxes.get(localId);
+        const box = stack ?? B.tmp();
+        if (!stack)
+            B.line(`${box} = ${boxNewCall(this.shapeHost, type)}`);
+        const value = B.tmp();
+        B.line(`${value} = load ${this.llType(type)}, ptr %${mangleLocal(localId)}`);
+        this.boxSet(box, type, isRefCounted(type) ? this.retainValue(value, type) : value);
+        B.line(`store ptr ${box}, ptr ${cache}`);
+        B.br(join);
+        B.startBlock(join);
+        return this.loadBox(cache);
+    }
     retainBox(box) {
         this.needsRetainBox = true;
         const t = this.B.tmp();
@@ -2885,6 +3691,12 @@ export class LlEmitter {
         B.line(`${empty} = icmp eq ptr ${value}, null`);
         this.throwIfUninitialized(empty, name);
     }
+    /** Throws the TDZ ReferenceError for `name` unless the i1 `flag` is set. */
+    checkInitializedFlag(flag, name) {
+        const empty = this.B.tmp();
+        this.B.line(`${empty} = xor i1 ${flag}, true`);
+        this.throwIfUninitialized(empty, name);
+    }
     throwIfUninitialized(empty, name) {
         const B = this.B;
         const lt = B.newLabel("tdz.t");
@@ -3046,6 +3858,9 @@ export class LlEmitter {
     emitFunction(fn) {
         const B = new BlockBuilder();
         this.B = B;
+        // Fiber switches restore the active exception cell before control
+        // returns to a synchronous frame (emitPendingCheck).
+        B.excCellInvariant = fn.async !== true && fn.generator === undefined;
         this.debugScope = this.debug?.function(fn) ?? null;
         B.debugLocation = this.debug?.location(fn.loc, this.debugScope) ?? null;
         this.frames = [];
@@ -3053,13 +3868,23 @@ export class LlEmitter {
         this.unwindCleanups.clear();
         this.jumpTargets = [];
         this.currentLocals = new Map(fn.locals.map((l) => [l.id, l]));
+        this.lazyCaptureBoxes.clear();
+        this.lazyStackBoxes.clear();
+        // An unchanged captured parameter keeps its value in a plain slot; the
+        // binding is boxed only for closures (captureBox).
+        const lazyParameters = this.lazyCaptures.parameters(fn);
+        for (const id of lazyParameters) {
+            const { boxed: _boxed, ...plain } = this.currentLocals.get(id);
+            this.currentLocals.set(id, plain);
+            this.lazyCaptureBoxes.set(id, "");
+        }
         this.currentConstantCallbacks =
             this.debug === null ? (this.constantCallbacks.get(fn.name) ?? new Map()) : new Map();
         // Preserve concrete source bindings for debugger inspection. Suspended
         // functions keep the established array lifetime across continuations.
         this.streamingSplitsEnabled = this.debug === null && !fn.async && !fn.generator;
         this.stackCallbacks.reset(this.streamingSplitsEnabled);
-        this.stackCaptures.reset(fn, this.streamingSplitsEnabled);
+        this.stackCaptures.reset(fn, this.streamingSplitsEnabled, lazyParameters);
         this.privateSplitLocals = this.streamingSplitsEnabled ? findPrivateSplitLocals(fn) : new Map();
         this.storedSplits.clear();
         this.splitSpans.clear();
@@ -3068,11 +3893,21 @@ export class LlEmitter {
         const numericFn = withInitializerBindings(fn, initializerBindings);
         this.numericLocals = new Map(numericFn.locals.map((l) => [l.id, l]));
         this.borrowedParameters.clear();
+        this.reboundOwnerSlots.clear();
+        this.projectedParameters.clear();
+        const projectedParameterIndexes = this.callLifetimes.parameters.get(fn.name);
+        if (projectedParameterIndexes)
+            for (const index of projectedParameterIndexes)
+                this.projectedParameters.add(fn.params[index].localId);
         this.stableCallBindings = this.callLifetimes.bindings.get(fn.name) ?? new Set();
         const borrowedParameterIndexes = this.callLifetimes.borrowed.get(fn.name);
         if (borrowedParameterIndexes) {
+            // Rebound walk parameters borrow too, but only unchanged ones may
+            // serve as stable owners for call arguments and aliases.
             for (const index of borrowedParameterIndexes)
-                this.borrowedParameters.add(fn.params[index].localId);
+                if (!this.walkBorrowsByFunction.get(fn.name)?.has(fn.params[index].localId) &&
+                    !this.reboundByFunction.get(fn.name)?.has(fn.params[index].localId))
+                    this.borrowedParameters.add(fn.params[index].localId);
         }
         this.captureIds = new Set([...(fn.captures ?? []), ...(fn.classCaptures ?? [])].map((c) => c.localId));
         this.integerLoopBindings.clear();
@@ -3093,17 +3928,19 @@ export class LlEmitter {
         this.callArrayReads = findCallArrayReads(fn, this.optionalArrayReads, this.referenceEffects.functions, this.callLifetimes);
         this.scalarStringSlices =
             this.debug === null ? findScalarStringSlices(fn, this.callLifetimes) : new Map();
-        this.mapReadLifetimes = findMapReadLifetimes(fn, this.unionsById, this.callLifetimes);
-        this.localStackUnions = findLocalStackUnions(fn, this.callLifetimes, this.unionsById);
-        this.localUnionStorageProofs = findLocalUnionStorage(fn, this.callLifetimes, this.unionsById);
+        this.mapReadLifetimes = findMapReadLifetimes(fn, this.boxedUnionsById, this.callLifetimes);
+        this.localStackUnions = findLocalStackUnions(fn, this.callLifetimes, this.boxedUnionsById);
+        this.localUnionStorageProofs = findLocalUnionStorage(fn, this.callLifetimes, this.boxedUnionsById, (e) => this.nullableFieldGet(e) !== null);
         this.localUnionStorage = new Map();
-        this.integerRanges = analyzeIntegerRanges(numericFn);
+        this.walkBorrows = this.walkBorrowsByFunction.get(fn.name) ?? new Set();
+        this.integerRanges = analyzeIntegerRanges(numericFn, this.int32Slots.facts(fn.name));
         this.bytesBounds = findBytesBounds(numericFn, this.integerRanges);
         this.chainSlots.clear();
         this.finallyStack = [];
         this.tryStack = [];
         this.currentReturnType = fn.returnType;
         this.currentGenerator = fn.generator ?? null;
+        this.currentBorrowedReturn = this.borrowedReturns.has(fn.name);
         this.currentWasiCoro = null;
         this.logArgSlots = 0;
         if (this.wasi && (fn.async === true || fn.generator !== undefined)) {
@@ -3154,7 +3991,7 @@ export class LlEmitter {
             B.line(`${value} = load double, ptr @${mangleGlobal(global.id)}`);
             this.storeIntegerView(global.id, { name: value, type: global.type });
         }
-        for (const local of fn.locals) {
+        for (const local of this.currentLocals.values()) {
             // Boxed locals' slots hold their capture BOX (a ptr); captured
             // (env-borrowed) locals bind the incoming box below. A caught-typed
             // local is a catch binding: its slot holds the ScrCaught snapshot
@@ -3203,6 +4040,26 @@ export class LlEmitter {
         // params (callees own their params — callers passed +1). Boxed params
         // allocate the shared binding and move the raw value in.
         const fnScope = [];
+        for (const id of this.lazyCaptureBoxes.keys()) {
+            const cache = B.slot();
+            B.entryAllocas.push(`${cache} = alloca ptr ; lazy box ${this.currentLocals.get(id).name}`);
+            B.line(`store ptr null, ptr ${cache}`);
+            fnScope.push({
+                slot: cache,
+                type: this.currentLocals.get(id).type,
+                boxed: true,
+                lazy: true,
+            });
+            this.lazyCaptureBoxes.set(id, cache);
+            // Environments that finish during the call can share an immortal
+            // frame box. Its payload owner is released with the function scope.
+            const stack = this.stackCaptures.emit(this, id, this.currentLocals.get(id).type);
+            if (stack) {
+                this.lazyStackBoxes.set(id, stack.box);
+                if (stack.owner)
+                    fnScope.push(stack.owner);
+            }
+        }
         const borrowed = this.callLifetimes.borrowed.get(fn.name);
         for (const [index, p] of fn.params.entries()) {
             const local = this.currentLocals.get(p.localId);
@@ -3219,6 +4076,15 @@ export class LlEmitter {
             this.storeIntegerView(p.localId, { name: `%p_${mangleLocal(p.localId)}`, type: p.type });
             if (isRefCounted(p.type) && !borrowed?.has(index))
                 fnScope.push({ slot, type: p.type });
+            if (this.reboundByFunction.get(fn.name)?.has(p.localId) && borrowed?.has(index)) {
+                // The caller's borrow stays in the parameter slot; values the body
+                // assigns are owned here until rebinding or exit releases them.
+                const owner = `${slot}.owner`;
+                B.entryAllocas.push(`${owner} = alloca ptr`);
+                B.line(`store ptr null, ptr ${owner}`);
+                fnScope.push({ slot: owner, type: p.type });
+                this.reboundOwnerSlots.set(p.localId, owner);
+            }
         }
         this.scopes.push(fnScope);
         // Stackful native fibers retain these frames while suspended. The
@@ -3231,7 +4097,9 @@ export class LlEmitter {
             B.line(`call void @scr_stack_enter(ptr %source_frame, ptr ${this.cstr(frame)})`);
             B.returnEpilogue = `call void @scr_stack_leave(ptr %source_frame)`;
         }
-        if (this.mod.workers)
+        if (this.stackChecks?.has(fn.name))
+            this.emitStackCheck();
+        if (this.workerEntryPolls?.has(fn.name))
             this.emitPendingCheck();
         this.emitStmts(fn.body);
         // Implicit exit of a void function: release the function scope unless
@@ -3303,24 +4171,55 @@ export class LlEmitter {
         const debug = this.debugScope === null ? "" : ` !dbg ${this.debugScope}`;
         const symbol = borrowed ? mangleBorrowedFunction(fn.name) : mangleFunction(fn.name);
         const body = `define internal ${ret} @${symbol}(${params.join(", ")}) ${attrs}${debug} { ; ${fn.name}\n${B.render()}\n}`;
-        return borrowed ? body + "\n" + this.emitOwnedCallAdapter(fn, borrowed) : body;
+        if (!borrowed)
+            return body;
+        const slot = this.implSlotBorrowed(fn.name);
+        const virtual = slot.size > 0 && slot.size !== borrowed.size
+            ? "\n" + this.emitOwnedCallAdapter(fn, borrowed, slot)
+            : "";
+        return body + "\n" + this.emitOwnedCallAdapter(fn, borrowed) + virtual;
     }
     /** Keep the ordinary owned ABI for closures, virtual dispatch, generated
      * runtime adapters and library exports. Only direct IR calls select the
      * borrowing body. Ownership of other parameters moves into that body;
      * borrowed parameters are released here on normal and exceptional exits.
      * The pending exception remains for the adapter's caller to handle. */
-    emitOwnedCallAdapter(fn, borrowed) {
+    /** With `kept`, the virtual adapter of a borrowing slot instead: the
+     * slot's parameters stay borrowed, the body's other borrowed ones are
+     * released here. */
+    emitOwnedCallAdapter(fn, borrowed, kept = NO_BORROWED) {
         const B = new BlockBuilder();
         this.B = B;
         const params = fn.params.map((param, index) => `${this.llType(param.type)} %p${index}`);
         const ret = this.llType(fn.returnType);
         const call = `call ${ret} @${mangleBorrowedFunction(fn.name)}(${params.join(", ")})`;
         B.line(ret === "void" ? call : `%result = ${call}`);
+        // A borrowed result is reachable from the parameters: own it first. A
+        // throwing body returns a null dummy, which needs no owner (and string
+        // or array retains do not accept NULL).
+        let result = "%result";
+        if (this.borrowedReturns.has(fn.name)) {
+            const slot = B.slot();
+            B.entryAllocas.push(`${slot} = alloca ptr`);
+            B.line(`store ptr null, ptr ${slot}`);
+            const present = B.tmp();
+            const own = B.newLabel("result.own");
+            const done = B.newLabel("result.done");
+            B.line(`${present} = icmp ne ptr %result, null`);
+            B.condBr(present, own, done);
+            B.startBlock(own);
+            B.line(`store ptr ${this.retainValue("%result", fn.returnType)}, ptr ${slot}`);
+            B.br(done);
+            B.startBlock(done);
+            result = B.tmp();
+            B.line(`${result} = load ptr, ptr ${slot}`);
+        }
         for (const index of borrowed)
-            this.releaseValue(`%p${index}`, fn.params[index].type);
-        B.terminate(ret === "void" ? "ret void" : `ret ${ret} %result`);
-        return `define internal ${ret} @${mangleFunction(fn.name)}(${params.join(", ")}) ${FN_ATTRS} {\n${B.render()}\n}`;
+            if (!kept.has(index))
+                this.releaseValue(`%p${index}`, fn.params[index].type);
+        B.terminate(ret === "void" ? "ret void" : `ret ${ret} ${result}`);
+        const symbol = kept.size > 0 ? `${mangleBorrowedFunction(fn.name)}.virtual` : mangleFunction(fn.name);
+        return `define internal ${ret} @${symbol}(${params.join(", ")}) ${FN_ATTRS} {\n${B.render()}\n}`;
     }
     /** A local stable binding keeps its value alive while later arguments
      * and the callee execute. A proven local union box cannot escape or be
@@ -3329,6 +4228,33 @@ export class LlEmitter {
     canBorrowCallArgument(value) {
         if (value.kind === "strLit")
             return true;
+        // Class casts reinterpret the same pointer (prefix layouts).
+        if ((value.kind === "upcast" || value.kind === "downcast") &&
+            value.value.type.kind === "object")
+            return this.canBorrowCallArgument(value.value);
+        if (value.kind === "seqExpr") {
+            const guarded = guardedValue(value);
+            return guarded !== null && this.canBorrowCallArgument(guarded);
+        }
+        // A nullable-union wrap reinterprets its payload pointer; an immortal
+        // unit constant needs no owner at all.
+        const wrap = this.borrowableNullableWrap(value);
+        if (wrap === "unit")
+            return true;
+        if (wrap === "ref" && value.kind === "unionWrap")
+            return this.canBorrowCallArgument(value.value);
+        // Checked casts (`x as C`, `x!` on a nullable) lower to a ternary whose
+        // failing arm always throws; the successful arm projects the same
+        // stable owner. The throwing arm's typed dummy owns nothing.
+        if (value.kind === "unionNarrow")
+            return this.canBorrowCallArgument(value.value);
+        if (value.kind === "libCall")
+            return value.fn === "error.nodeThrow";
+        if (value.kind === "ternary")
+            return (this.canBorrowReceiver(value.then) &&
+                this.canBorrowReceiver(value.else_) &&
+                this.canBorrowCallArgument(value.then) &&
+                this.canBorrowCallArgument(value.else_));
         if (value.kind !== "varRef")
             return false;
         const binding = this.binding(value.localId);
@@ -3383,6 +4309,12 @@ export class LlEmitter {
         switch (s.kind) {
             case "varDecl": {
                 const b = this.binding(s.localId);
+                if (this.walkBorrows.has(s.localId) && b.kind === "local") {
+                    // A borrowed walk pointer: no retain now, no release at scope exit.
+                    const v = s.init === null ? "null" : this.emitReadReceiver(s.init).name;
+                    B.line(`store ptr ${v}, ptr ${b.slot}`);
+                    break;
+                }
                 const slice = this.scalarStringSlices.get(s.localId);
                 if (slice) {
                     const snapshot = emitStringSliceSnapshot(this, slice);
@@ -3515,6 +4447,23 @@ export class LlEmitter {
                 break;
             }
             case "assign": {
+                const owner = this.reboundOwnerSlots.get(s.localId);
+                if (owner !== undefined && !this.walkBorrows.has(s.localId)) {
+                    // A rebound borrowed parameter: the new value moves into the owner
+                    // slot, replacing (and releasing) the previous owned value. This
+                    // precedes the in-place string append, which would release the
+                    // caller's borrow.
+                    const param = this.binding(s.localId);
+                    const slot = param.slot;
+                    const v = this.emitExpr(s.value);
+                    this.moveTemp(v);
+                    const old = B.tmp();
+                    B.line(`${old} = load ptr, ptr ${owner}`);
+                    this.releaseValue(old, param.type);
+                    B.line(`store ptr ${v.name}, ptr ${slot}`);
+                    B.line(`store ptr ${v.name}, ptr ${owner}`);
+                    break;
+                }
                 const localStorage = this.localUnionStorage.get(s.localId);
                 if (localStorage) {
                     storeLocalUnion(this, localStorage, s.value);
@@ -3527,6 +4476,11 @@ export class LlEmitter {
                     break;
                 }
                 const b = this.binding(s.localId);
+                if (this.walkBorrows.has(s.localId) && b.kind === "local") {
+                    // Rebinding a borrowed walk pointer releases nothing.
+                    B.line(`store ptr ${this.emitReadReceiver(s.value).name}, ptr ${b.slot}`);
+                    break;
+                }
                 const v = this.emitExpr(s.value);
                 if (b.kind === "global" && !s.initializes)
                     this.checkGlobalTdz(s.localId);
@@ -3548,7 +4502,9 @@ export class LlEmitter {
                 break;
             }
             case "exprStmt":
-                this.emitExpr(s.expr);
+                // A statement-position splice never observes its removed elements.
+                if (!emitDiscardedSplice(this, s.expr))
+                    this.emitDiscarded(s.expr);
                 break;
             case "arraySet": {
                 // Evaluation order matches JS: array, index, then value. Ownership
@@ -3560,21 +4516,43 @@ export class LlEmitter {
                 if (s.arr.type.kind !== "array")
                     throw new InternalCompilerError("llvm emitter bug: arraySet on non-array");
                 const acc = elemAccess(s.arr.type.elem);
+                this.emitPublishedArrayGuard(arr.name, s.arr.type, 0, idx.name);
                 if (acc === "ref")
                     this.moveTemp(v);
-                const argTy = acc === "f64" ? "double" : acc === "bool" ? "i1" : "ptr";
-                this.declare(`declare void @scr_arr_set_${acc}(ptr, double, ${argTy === "i1" ? "i1 zeroext" : argTy})`);
-                B.line(`call void @scr_arr_set_${acc}(ptr ${arr.name}, double ${idx.name}, ${argTy} ${v.name})`);
+                emitDenseArraySet(this, arr.name, idx, s.index, acc, s.arr.type.elem, v.name);
                 break;
             }
             case "arraySetLength": {
+                // Pop's `length = 0` store on an empty array only matters when the
+                // array can be frozen (published); its operand is a local.
+                if (s.pop === true &&
+                    s.length.kind === "numLit" &&
+                    s.length.value === 0 &&
+                    this.publishedTypes?.containerGuarded(s.arr.type) !== true)
+                    break;
                 const arr = emitBorrowedInput(this, s.arr);
                 const length = this.emitExpr(s.length);
                 if (s.arr.type.kind !== "array")
                     throw new InternalCompilerError("llvm emitter bug: arraySetLength on non-array");
+                this.emitPublishedArrayGuard(arr.name, s.arr.type, s.pop === true ? 2 : 3);
                 this.declare(`declare void @scr_arr_set_len(ptr, double)`);
+                // Assigning the current length (a reused work array reset to where
+                // it already is) changes nothing: the runtime's validation accepts
+                // exactly the value equal to the length (-0 included, NaN never),
+                // and no element is released. Everything else keeps the call.
+                const lenPtr = B.tmp(), len = B.tmp(), lenNumber = B.tmp(), same = B.tmp();
+                const resize = B.newLabel("arr.len.set"), done = B.newLabel("arr.len.done");
+                B.line(`${lenPtr} = getelementptr inbounds %ScrArr, ptr ${arr.name}, i32 0, i32 1`);
+                this.markMemoryPointer(lenPtr, "array:header");
+                B.line(`${len} = load ${this.sizeType}, ptr ${lenPtr}${this.fieldAliasAttachment(lenPtr)}`);
+                B.line(`${lenNumber} = uitofp ${this.sizeType} ${len} to double`);
+                B.line(`${same} = fcmp oeq double ${length.name}, ${lenNumber}`);
+                B.condBr(same, done, resize);
+                B.startBlock(resize);
                 B.line(`call void @scr_arr_set_len(ptr ${arr.name}, double ${length.name})`);
                 this.emitPendingCheck();
+                B.br(done);
+                B.startBlock(done);
                 break;
             }
             case "arraySetUndefined":
@@ -3583,6 +4561,7 @@ export class LlEmitter {
                 const idx = this.emitExpr(s.index);
                 if (s.arr.type.kind !== "array")
                     throw new InternalCompilerError(`llvm emitter bug: ${s.kind} on non-array`);
+                this.emitPublishedArrayGuard(arr.name, s.arr.type, s.kind === "arrayDelete" ? 5 : 0, idx.name);
                 const fn = s.kind === "arraySetUndefined" ? "scr_arr_set_undefined" : "scr_arr_delete";
                 this.declare(`declare ${s.kind === "arrayDelete" ? "zeroext i1" : "void"} @${fn}(ptr, double)`);
                 if (s.kind === "arrayDelete")
@@ -3612,10 +4591,29 @@ export class LlEmitter {
                 // release — a release can trigger a cycle collection, which must
                 // never see a heap edge whose count was already given up).
                 // Classes and records share the struct layout, so one emission.
-                const obj = isRefCounted(s.value.type)
-                    ? this.emitExpr(s.obj)
-                    : this.emitStableReceiver(s.obj, [s.value]);
+                const nullable = s.kind === "fieldSet" ? this.nullableFields.get(s.className, s.field) : null;
+                if (nullable && s.kind === "fieldSet") {
+                    const obj = this.emitStableReceiver(s.obj, [s.value]);
+                    // (The guard precedes the value here: the nullable store
+                    // evaluates it itself.)
+                    this.emitPublishedFieldGuard(obj.name, s.className, s.field);
+                    this.emitNullableFieldStore(obj.name, s.className, s.field, nullable, s.value);
+                    break;
+                }
+                if (s.kind === "fieldSet" && this.int32Slots.isField(s.className, s.field)) {
+                    const obj = this.emitStableReceiver(s.obj, [s.value]);
+                    const v = this.emitExpr(s.value);
+                    this.emitPublishedFieldGuard(obj.name, s.className, s.field);
+                    const { ptr } = this.classFieldPtr(obj.name, s.className, s.field);
+                    this.storeInt32Field(ptr, v, s.value);
+                    break;
+                }
+                const obj = this.emitStableReceiver(s.obj, [s.value]);
                 const v = this.emitExpr(s.value);
+                if (s.kind === "fieldSet")
+                    this.emitPublishedFieldGuard(obj.name, s.className, s.field);
+                else if (this.publishedTypes?.recordGuarded(s.shapeId) === true)
+                    this.emitPublishedFieldGuard(obj.name, null, s.field);
                 const { ptr, type } = s.kind === "fieldSet"
                     ? this.classFieldPtr(obj.name, s.className, s.field)
                     : this.recordFieldPtr(obj.name, s.shapeId, s.field);
@@ -3649,6 +4647,11 @@ export class LlEmitter {
                 // the overflow (key and value released; absent keys no-op).
                 const obj = this.emitExpr(s.obj);
                 const key = this.emitExpr(s.key);
+                if (this.publishedTypes?.recordGuarded(s.shapeId) === true) {
+                    // Node: "Cannot delete property 'k' of #<Object>" (key known at
+                    // run time only; the guard reports the frozen record generically).
+                    this.emitPublishedFieldGuard(obj.name, null, "[key]");
+                }
                 const ovf = this.recordOvfPtr(obj.name, s.shapeId);
                 this.declare(`declare zeroext i1 @scr_map_delete_str(ptr, ptr)`);
                 const t = B.tmp();
@@ -3664,6 +4667,8 @@ export class LlEmitter {
                 const obj = this.emitExpr(s.obj);
                 const key = this.emitExpr(s.key);
                 const v = this.emitExpr(s.value);
+                if (this.publishedTypes?.recordGuarded(s.shapeId) === true)
+                    this.emitPublishedFieldGuard(obj.name, null, "[key]");
                 if (isRefCounted(v.type))
                     this.moveTemp(v);
                 const shape = this.recordShape(s.shapeId);
@@ -3695,7 +4700,7 @@ export class LlEmitter {
                     for (const f of shape.fields) {
                         const lit = this.internLiteral(f.name);
                         const hit = B.tmp();
-                        B.line(`${hit} = call zeroext i1 @scr_str_eq(ptr ${key.name}, ptr ${lit}) ; ${llvmCommentText(f.name)}`);
+                        B.line(`${hit} = call zeroext i1 @sc_str_eq(ptr ${key.name}, ptr ${lit}) ; ${llvmCommentText(f.name)}`);
                         const lh = B.newLabel("rks.h");
                         const ln = B.newLabel("rks.n");
                         B.condBr(hit, lh, ln);
@@ -3718,9 +4723,9 @@ export class LlEmitter {
                         B.line(`call void @scr_dyn_release(ptr ${v.name})`);
                         // Mismatched write: TypeError pending, field untouched — the
                         // statement-level check below unwinds.
-                        this.declare(`declare zeroext i1 @scr_exc_pending()`);
                         const pend = B.tmp();
-                        B.line(`${pend} = call zeroext i1 @scr_exc_pending()`);
+                        for (const line of this.pendingTestLines(pend))
+                            B.line(line.trimStart());
                         const lw = B.newLabel("rks.w");
                         B.condBr(pend, join, lw);
                         B.startBlock(lw);
@@ -3751,7 +4756,7 @@ export class LlEmitter {
                     // typeEquals(f.type, iv) — the frontend fences everything else.
                     const lit = this.internLiteral(f.name);
                     const hit = B.tmp();
-                    B.line(`${hit} = call zeroext i1 @scr_str_eq(ptr ${key.name}, ptr ${lit}) ; ${llvmCommentText(f.name)}`);
+                    B.line(`${hit} = call zeroext i1 @sc_str_eq(ptr ${key.name}, ptr ${lit}) ; ${llvmCommentText(f.name)}`);
                     const lh = B.newLabel("rks.h");
                     const ln = B.newLabel("rks.n");
                     B.condBr(hit, lh, ln);
@@ -4125,10 +5130,13 @@ export class LlEmitter {
                     B.line(`${inBounds} = icmp ne ptr ${cur}, null`);
                 }
                 else {
-                    const i = B.tmp(), len = B.tmp();
-                    this.declare(`declare double @scr_arr_len(ptr)`);
+                    const i = B.tmp(), lenPtr = B.tmp(), rawLen = B.tmp(), len = B.tmp();
                     B.line(`${i} = load double, ptr ${idxSlot}`);
-                    B.line(`${len} = call double @scr_arr_len(ptr ${arr.name})`);
+                    // The inline form of scr_arr_len, like the `length` intrinsic.
+                    B.line(`${lenPtr} = getelementptr inbounds %ScrArr, ptr ${arr.name}, i32 0, i32 1`);
+                    this.markMemoryPointer(lenPtr, "array:header");
+                    B.line(`${rawLen} = load ${this.sizeType}, ptr ${lenPtr}${this.fieldAliasAttachment(lenPtr)}`);
+                    B.line(`${len} = uitofp ${this.sizeType} ${rawLen} to double`);
                     B.line(`${inBounds} = fcmp olt double ${i}, ${len}`);
                     cur = i;
                 }
@@ -4152,12 +5160,8 @@ export class LlEmitter {
                 const borrowedElement = !snapshot && this.loopArrayBorrows.has(s);
                 if (!snapshot) {
                     const acc = elemAccess(elem);
-                    const accTy = acc === "f64" ? "double" : acc === "bool" ? "i1" : "ptr";
                     const getter = borrowedElement ? "scr_arr_borrow_ref" : `scr_arr_get_${acc}`;
-                    this.declare(`declare ${acc === "bool" ? "zeroext i1" : accTy} @${getter}(ptr, double)`);
-                    const value = B.tmp();
-                    B.line(`${value} = call ${accTy} @${getter}(ptr ${arr.name}, double ${cur})`);
-                    cur = value;
+                    cur = emitDenseArrayGet(this, arr.name, { name: cur, type: { kind: "f64" } }, undefined, acc, elem, getter, !borrowedElement);
                 }
                 if (spanLength) {
                     const length = B.tmp();
@@ -4249,7 +5253,12 @@ export class LlEmitter {
                 // the actual ret. The parked value owns a synthetic slot-backed
                 // scope entry during each copy so a throwing finally releases it.
                 let v = null;
-                if (s.value !== null) {
+                if (s.value !== null && this.currentBorrowedReturn) {
+                    // A borrowed-return body hands back its walk without a reference
+                    // (it has no try statements, so no finally can intervene).
+                    v = this.emitReadReceiver(s.value);
+                }
+                else if (s.value !== null) {
                     v = this.emitExpr(s.value);
                     this.moveTemp(v);
                 }
@@ -4553,7 +5562,7 @@ export class LlEmitter {
                 const hit = B.tmp();
                 if (c.test.type.kind === "string") {
                     this.declare(`declare zeroext i1 @scr_str_eq(ptr, ptr)`);
-                    B.line(`${hit} = call zeroext i1 @scr_str_eq(ptr ${disc.name}, ptr ${t.name})`);
+                    B.line(`${hit} = call zeroext i1 @sc_str_eq(ptr ${disc.name}, ptr ${t.name})`);
                 }
                 else if (c.test.type.kind === "bool") {
                     B.line(`${hit} = icmp eq i1 ${disc.name}, ${t.name}`);
@@ -4624,24 +5633,62 @@ export class LlEmitter {
         return emitLiteralExpr(this, e);
     }
     emitOperatorExpr(e) {
-        if (e.kind === "seqExpr") {
-            // Saved operands can feed later call arguments. Transfer ownership
-            // to this expression's frame so they survive those reads and still
-            // die on the path that created them, including inside lazy branches.
-            this.scopes.push([]);
-            const result = emitBorrowedFieldSequence(this, e) ?? emitOperatorExpr(this, e);
-            for (const local of this.scopes.pop()) {
-                this.currentFrame().push({
-                    name: local.slot,
-                    type: local.type,
-                    slot: true,
-                    ...(local.boxed ? { boxed: true } : {}),
-                });
-            }
-            return result;
-        }
+        if (e.kind === "seqExpr")
+            return this.emitSequence(() => emitBorrowedFieldSequence(this, e) ?? emitOperatorExpr(this, e));
         return emitOperatorExpr(this, e);
     }
+    /** Saved operands can feed later call arguments. Transfer ownership of a
+     * sequence's locals to this expression's frame so they survive those
+     * reads and still die on the path that created them, including inside
+     * lazy branches. */
+    emitSequence(body) {
+        this.scopes.push([]);
+        const result = body();
+        for (const local of this.scopes.pop()) {
+            this.currentFrame().push({
+                name: local.slot,
+                type: local.type,
+                slot: true,
+                ...(local.boxed ? { boxed: true } : {}),
+            });
+        }
+        return result;
+    }
+    /** A statement-position expression whose value is dropped. When a
+     * sequence's result only reads an unchanged local (a derived
+     * constructor's `super()` evaluates to `this`), its statements still run
+     * in place, but the result is neither retained nor released. */
+    /** Whether a discarded value can be skipped entirely: a borrowable read
+     * with no effect of its own. canBorrowCallArgument also accepts checked
+     * projections (a ternary or narrow whose failing arm throws, and the
+     * throwing call itself) because a borrowed use still evaluates them;
+     * skipping those would drop the throw. */
+    discardableRead(value) {
+        if (value.kind === "libCall" || value.kind === "ternary" || value.kind === "unionNarrow")
+            return false;
+        if ((value.kind === "upcast" || value.kind === "downcast" || value.kind === "unionWrap") &&
+            !this.discardableRead(value.value))
+            return false;
+        if (value.kind === "seqExpr") {
+            const guarded = guardedValue(value);
+            if (guarded === null || !this.discardableRead(guarded))
+                return false;
+        }
+        return this.canBorrowCallArgument(value);
+    }
+    emitDiscarded(e) {
+        if (e.kind === "seqExpr" &&
+            isRefCounted(e.result.type) &&
+            e.result.kind !== "strLit" &&
+            this.discardableRead(e.result)) {
+            this.emitSequence(() => {
+                for (const s of e.stmts)
+                    this.emitStmt(s);
+            });
+            return;
+        }
+        this.emitExpr(e);
+    }
     emitControlExpr(e) {
         return emitControlExpr(this, e);
     }
@@ -4655,8 +5702,17 @@ export class LlEmitter {
      * value, making the snapshot unique unless a real observable alias exists.
      */
     emitStringSelfConcatAssign(localId, left, suffix, retainForYield) {
+        const moved = this.emitMovedSelfConcat(localId, left, suffix, retainForYield);
+        if (moved)
+            return moved;
         const snapshot = this.emitExpr(left);
-        const right = this.emitExpr(suffix);
+        // A suffix of several parts, or a number, appends each operand to the
+        // snapshot directly (in place once the binding lets go of it) instead
+        // of first building the suffix as a separate string.
+        const parts = stringParts(suffix);
+        const mixed = parts.length > 1 || numberPart(parts[0]) !== null;
+        const inputs = mixed ? emitConcatInputs(this, parts) : [];
+        const right = mixed ? null : this.emitExpr(suffix);
         const b = this.binding(localId);
         const B = this.B;
         if (b.kind === "boxed") {
@@ -4669,9 +5725,15 @@ export class LlEmitter {
             B.line(`store ptr null, ptr ${b.slot}`);
             this.releaseValue(old, b.type);
         }
-        this.declare(`declare ptr @scr_str_concat(ptr, ptr)`);
-        const raw = B.tmp();
-        B.line(`${raw} = call ptr @scr_str_concat(ptr ${snapshot.name}, ptr ${right.name})`);
+        let raw;
+        if (right === null) {
+            raw = emitMixedConcat(this, snapshot.name, inputs);
+        }
+        else {
+            this.declare(`declare ptr @scr_str_concat(ptr, ptr)`);
+            raw = B.tmp();
+            B.line(`${raw} = call ptr @scr_str_concat(ptr ${snapshot.name}, ptr ${right.name})`);
+        }
         const result = this.own({ name: raw, type: left.type });
         if (retainForYield) {
             const stored = this.retainValue(result.name, result.type);
@@ -4689,6 +5751,43 @@ export class LlEmitter {
         }
         return result;
     }
+    /** `local = local + suffix` when the suffix cannot read or write the
+     * local (an unboxed binding is only reachable through this function's own
+     * expressions): reading the binding after the suffix gives the value the
+     * left side had, so it moves into a consuming concat, and the result takes
+     * its place. Null when the general snapshot path is needed. */
+    emitMovedSelfConcat(localId, left, suffix, retainForYield) {
+        const b = this.binding(localId);
+        if (retainForYield ||
+            b.kind !== "local" ||
+            b.local === undefined ||
+            b.local.boxed ||
+            b.local.tdz ||
+            b.type.kind !== "string" ||
+            left.kind !== "varRef" ||
+            left.localId !== localId ||
+            mentionsLocal(suffix, localId))
+            return null;
+        const parts = stringParts(suffix);
+        const mixed = parts.length > 1 || numberPart(parts[0]) !== null;
+        const inputs = mixed ? emitConcatInputs(this, parts) : [];
+        const right = mixed ? null : this.emitExpr(suffix);
+        this.materializeSplitLocal(localId);
+        const B = this.B;
+        const head = B.tmp();
+        B.line(`${head} = load ptr, ptr ${b.slot}`);
+        let raw;
+        if (right === null) {
+            raw = emitMixedConcat(this, head, inputs, true);
+        }
+        else {
+            this.declare(`declare ptr @scr_str_concat_move(ptr, ptr)`);
+            raw = B.tmp();
+            B.line(`${raw} = call ptr @scr_str_concat_move(ptr ${head}, ptr ${right.name})`);
+        }
+        B.line(`store ptr ${raw}, ptr ${b.slot}`);
+        return { name: raw, type: left.type }; // moved into the binding
+    }
     emitContainerExpr(e) {
         return emitContainerExpr(this, e);
     }
@@ -4702,8 +5801,152 @@ export class LlEmitter {
         return emitDynamicExpr(this, e);
     }
     emitIntrinsicExpr(e) {
+        if (e.name === "threads.publish")
+            return this.emitPublish(e);
         return emitIntrinsicExpr(this, e);
     }
+    publishWalkersCache = null;
+    /** Per-type publication walkers, created on the first publish. */
+    get publishWalkers() {
+        if (this.publishWalkersCache !== null)
+            return this.publishWalkersCache;
+        const byPre = [...this.classMeta.values()].sort((a, b) => a.pre - b.pre);
+        this.publishWalkersCache = new PublishWalkers({
+            declare: (decl) => this.declare(decl),
+            cstr: (text) => this.cstr(text),
+            sizeType: this.sizeType,
+            tracedShapes: this.tracedShapes,
+            unionsById: this.unionsById,
+            recordsById: this.recordsById,
+            nullableArm: (t) => this.nullableUnions.of(t)?.arm ?? null,
+            classInfo: (className) => {
+                const meta = this.classMetaOf(className);
+                return {
+                    def: meta.def,
+                    hierarchy: meta.hierarchy,
+                    pre: meta.pre,
+                    post: meta.post,
+                    runtimeRooted: meta.root.def.runtime === true,
+                    fields: meta.def.fields.map((f) => ({
+                        name: f.name,
+                        index: classFieldIndex(meta, f.name).index,
+                        type: this.nullableFields.storageType(className, f.name, f.type),
+                    })),
+                };
+            },
+            classesInInterval: (pre, post) => byPre.filter((m) => m.pre >= pre && m.pre <= post).map((m) => m.def.name),
+        });
+        return this.publishWalkersCache;
+    }
+    /** `publish(value)` (@scriptc/threads): makes the graph immortal and
+     * immutable (scr_publish with the static type's walker) and answers the
+     * same value. Throws (pending) when a dyn part is unpublishable. */
+    emitPublish(e) {
+        const value = this.emitExpr(e.args[0]);
+        if (this.B.isTerminated())
+            return value;
+        const lines = this.publishWalkers.emitPublish(value.name, value.type, e.loc);
+        if (lines.length > 0) {
+            for (const line of lines)
+                this.B.line(line.trimStart());
+            // A refusal unwinds while the operand temp still owns its reference.
+            this.emitPendingCheck();
+        }
+        // The result IS the operand: ownership moves to the result temp.
+        if (!isRefCounted(value.type))
+            return { name: value.name, type: e.type };
+        this.moveTemp(value);
+        return this.own({ name: value.name, type: e.type });
+    }
+    /** Branches on "`obj` is published" (rc == SIZE_MAX); leaves the builder
+     * in the cold block and answers the continuation label. */
+    emitPublishedTest(obj) {
+        const B = this.B;
+        const rc = B.tmp(), frozen = B.tmp(), expected = B.tmp();
+        B.line(`${rc} = load ${this.sizeType}, ptr ${obj}`);
+        B.line(`${frozen} = icmp eq ${this.sizeType} ${rc}, -1`);
+        this.declare(`declare i1 @llvm.expect.i1(i1, i1)`);
+        B.line(`${expected} = call i1 @llvm.expect.i1(i1 ${frozen}, i1 false)`);
+        const cold = B.newLabel("pub.frozen"), ok = B.newLabel("pub.ok");
+        B.condBr(expected, cold, ok);
+        B.startBlock(cold);
+        return ok;
+    }
+    publishedNamesSym = null;
+    /** The class-name table the hierarchy field guards index by preorder. */
+    publishedClassNamesDefs() {
+        if (this.publishedNamesSym === null)
+            return [];
+        const metas = [...this.classMeta.values()];
+        const size = metas.reduce((max, m) => Math.max(max, m.pre + 1), 0);
+        const names = new Array(size).fill("ptr null");
+        for (const m of metas)
+            names[m.pre] = `ptr ${this.cstr(m.def.jsName ?? m.def.name)}`;
+        return [
+            `${this.publishedNamesSym} = internal constant [${size} x ptr] [ ${names.join(", ")} ]`,
+            ``,
+        ];
+    }
+    /** The frozen-object guard of a class field or record field store:
+     * Node's "Cannot assign to read only property" TypeError when the target
+     * is published. `className` null means a record (`#<Object>`). */
+    emitPublishedFieldGuard(obj, className, field) {
+        const published = this.publishedTypes;
+        if (published === null)
+            return;
+        if (className !== null && !published.classGuarded(className))
+            return;
+        const B = this.B;
+        const ok = this.emitPublishedTest(obj);
+        let owner;
+        const meta = className === null ? undefined : this.classMeta.get(className);
+        if (meta === undefined)
+            owner = this.cstr("Object");
+        else if (!meta.hierarchy)
+            owner = this.cstr(meta.def.jsName ?? meta.def.name);
+        else {
+            // The DYNAMIC class names the object, as in Node.
+            this.publishedNamesSym ??= "@sc_pub_class_names";
+            const vtp = B.tmp(), vt = B.tmp(), pre = B.tmp(), slot = B.tmp(), name = B.tmp();
+            B.line(`${vtp} = getelementptr inbounds ptr, ptr ${obj}, i64 1`);
+            B.line(`${vt} = load ptr, ptr ${vtp}`);
+            B.line(`${pre} = load ${this.sizeType}, ptr ${vt}`);
+            B.line(`${slot} = getelementptr inbounds ptr, ptr ${this.publishedNamesSym}, ${this.sizeType} ${pre}`);
+            B.line(`${name} = load ptr, ptr ${slot}`);
+            owner = name;
+        }
+        this.declare(`declare void @scr_throw_published_field(ptr, ptr)`);
+        B.line(`call void @scr_throw_published_field(ptr ${this.cstr(field)}, ptr ${owner})`);
+        this.emitUnwind();
+        B.startBlock(ok);
+    }
+    /** The frozen-array guard (scr_throw_published_array's ops): `index` and
+     * `count` are doubles (the written index, the argument count). */
+    emitPublishedArrayGuard(arr, arrType, op, index = f64Lit(0), count = f64Lit(0)) {
+        if (this.publishedTypes?.containerGuarded(arrType) !== true)
+            return;
+        const B = this.B;
+        const ok = this.emitPublishedTest(arr);
+        this.declare(`declare zeroext i1 @scr_throw_published_array(i32, ptr, double, double)`);
+        const threw = B.tmp();
+        B.line(`${threw} = call zeroext i1 @scr_throw_published_array(i32 ${op}, ptr ${arr}, double ${index}, double ${count})`);
+        const unwind = B.newLabel("pub.throw");
+        B.condBr(threw, unwind, ok);
+        B.startBlock(unwind);
+        this.emitUnwind();
+        B.startBlock(ok);
+    }
+    /** The published Map/Set guard: "Cannot modify a published Map/Set". */
+    emitPublishedCollectionGuard(m, t) {
+        if (this.publishedTypes?.containerGuarded(t) !== true)
+            return;
+        const B = this.B;
+        const ok = this.emitPublishedTest(m);
+        this.declare(`declare void @scr_throw_published_collection(i1 zeroext)`);
+        B.line(`call void @scr_throw_published_collection(i1 ${t.kind === "set" ? "true" : "false"})`);
+        this.emitUnwind();
+        B.startBlock(ok);
+    }
     emitSerializationExpr(e) {
         return emitSerializationExpr(this, e);
     }
@@ -4723,6 +5966,13 @@ export class LlEmitter {
             return this.emitExpr(e);
         if (e.kind === "strLit")
             return { name: this.internLiteral(e.value), type: e.type };
+        const guarded = guardedValue(e);
+        if (guarded !== null) {
+            // Throwing guards run in place, exactly as the sequence emits them.
+            for (const s of e.stmts)
+                this.emitStmt(s);
+            return this.emitReadReceiver(guarded);
+        }
         if (e.kind === "varRef") {
             this.materializeSplitLocal(e.localId);
             const binding = this.binding(e.localId);
@@ -4744,24 +5994,58 @@ export class LlEmitter {
             this.B.line(`${value} = load ptr, ptr ${binding.slot}`);
             return { name: value, type: e.type };
         }
-        const read = matchMapRead(e, this.unionsById);
+        if (e.kind === "arrayGet" && this.canBorrowReceiver(e)) {
+            // The array keeps the element alive until the consumer; a missing
+            // element still traps exactly like the owned read.
+            const slot = this.B.slot();
+            this.B.entryAllocas.push(`${slot} = alloca ptr`);
+            emitBorrowedArrayRead(this, e, slot);
+            const value = this.B.tmp();
+            this.B.line(`${value} = load ptr, ptr ${slot}`);
+            return { name: value, type: e.type };
+        }
+        const wrap = this.borrowableNullableWrap(e);
+        if (wrap === "unit" && e.kind === "unionWrap")
+            return { name: this.unitInstanceRef(e.unionId, e.tag), type: e.type };
+        if (wrap === "ref" && e.kind === "unionWrap")
+            return { name: this.emitReadReceiver(e.value).name, type: e.type };
+        const read = matchMapRead(e, this.boxedUnionsById);
         if (read) {
             const result = emitStackMapRead(this, read);
             if (result.owner)
                 this.ownSlot(result.owner.slot, result.owner.type);
             return result.value;
         }
-        if (canStackUnion(e, this.unionsById))
+        const arrayRead = this.optionalArrayReads.get(e);
+        if (arrayRead)
+            return emitProjectedArrayRead(this, arrayRead);
+        const narrow = this.checkedNarrows.get(e);
+        const narrowed = narrow ? emitCheckedNarrowReceiver(this, narrow) : null;
+        if (narrowed)
+            return narrowed;
+        if (canStackUnion(e, this.boxedUnionsById))
             return emitStackUnion(this, e).value;
         if (e.kind === "unionNarrow") {
-            const union = this.emitReadReceiver(e.value);
-            return { name: this.unionPeek(union.name), type: e.type };
+            const union = this.emitUnionProjection(e.value);
+            return { name: this.unionPeek(union.name, e.unionId), type: e.type };
+        }
+        if ((e.kind === "downcast" || e.kind === "upcast") && e.value.type.kind === "object") {
+            // Prefix layouts: a class cast reads the operand's own pointer.
+            return { name: this.emitReadReceiver(e.value).name, type: e.type };
         }
+        // A nullable-pointer field has no box to borrow. Projections use
+        // emitUnionProjection; other borrowers get an owned heap box.
+        if (this.nullableFieldGet(e))
+            return this.emitExpr(e);
         if (e.kind === "recordGet" || e.kind === "fieldGet") {
             const receiver = this.emitReadReceiver(e.obj);
-            const { ptr, type } = e.kind === "recordGet"
-                ? this.recordFieldPtr(receiver.name, e.shapeId, e.field)
-                : this.classFieldPtr(receiver.name, e.className, e.field);
+            if (e.kind === "recordGet") {
+                const { ptr, type } = this.recordFieldPtr(receiver.name, e.shapeId, e.field);
+                return { name: this.loadRecordField(ptr, type), type: e.type };
+            }
+            const { ptr, type } = this.classFieldPtr(receiver.name, e.className, e.field);
+            if (this.int32Slots.isField(e.className, e.field))
+                return this.loadInt32Field(ptr, e.type);
             return { name: this.loadField(ptr, type), type: e.type };
         }
         if (e.kind === "ternary" && this.canBorrowReceiver(e.then) && this.canBorrowReceiver(e.else_)) {
@@ -4789,8 +6073,160 @@ export class LlEmitter {
             B.line(`${value} = load ptr, ptr ${slot}`);
             return { name: value, type: e.type };
         }
+        if (e.kind === "call" && this.canBorrowReceiver(e))
+            return emitBorrowedResultCall(this, e);
         return this.emitExpr(e);
     }
+    /** A private stack union source with an independently owned payload. */
+    canStackReceiver(e) {
+        return this.isStackUnionSource(e);
+    }
+    /** True for union sources that emitReadReceiver can produce as a private
+     * stack box with an independently owned payload (no heap union). */
+    isStackUnionSource(e) {
+        if (e.type.kind !== "union")
+            return false;
+        return (canStackUnion(e, this.boxedUnionsById) ||
+            matchMapRead(e, this.boxedUnionsById) !== null ||
+            this.optionalArrayReads.get(e) !== null);
+    }
+    /** The nullable-pointer representation behind a union-typed class field
+     * read, or null for every other expression. */
+    nullableFieldGet(e) {
+        if (e.kind !== "fieldGet" || e.type.kind !== "union")
+            return null;
+        return this.nullableFields.get(e.className, e.field);
+    }
+    /** A union operand consumed only by a projection (tag test, payload
+     * extraction, arm compare, truthiness). A nullable-pointer field read
+     * becomes a private stack box whose payload is borrowed from the field:
+     * the consumer must finish before any later expression can store to the
+     * field, and must never retain, release, or store the box. Every other
+     * operand takes the ordinary borrowed-receiver path. */
+    emitUnionProjection(e) {
+        const nullable = this.nullableFieldGet(e);
+        if (!nullable || e.kind !== "fieldGet")
+            return this.emitReadReceiver(e);
+        const B = this.B;
+        const receiver = this.emitReadReceiver(e.obj);
+        const { ptr } = this.classFieldPtr(receiver.name, e.className, e.field);
+        const p = B.tmp();
+        B.line(`${p} = load ptr, ptr ${ptr}${this.fieldAliasAttachment(ptr)}`);
+        return { name: this.stackNullableBox(p, nullable), type: e.type };
+    }
+    /** A private stack box over a nullable-pointer field read whose payload
+     * is retained into the current frame: an independent owner, so the box
+     * may outlive later stores to the field (call arguments, local copies).
+     * The box itself must still never reach an RC entry point. */
+    emitOwnedNullableStack(e) {
+        const nullable = this.nullableFieldGet(e);
+        if (!nullable || e.kind !== "fieldGet")
+            throw new InternalCompilerError("llvm emitter bug: owned nullable stack of non-field");
+        const receiver = this.emitReadReceiver(e.obj);
+        const { ptr } = this.classFieldPtr(receiver.name, e.className, e.field);
+        const p = this.B.tmp();
+        this.B.line(`${p} = load ptr, ptr ${ptr}${this.fieldAliasAttachment(ptr)}`);
+        const owner = this.own({ name: this.retainValue(p, nullable.arm), type: nullable.arm });
+        return { box: this.stackNullableBox(owner.name, nullable), owner };
+    }
+    /** A private stack box over a borrowed nullable pointer. */
+    stackNullableBox(p, nullable) {
+        const B = this.B;
+        const box = B.slot();
+        B.entryAllocas.push(`${box} = alloca %ScrUnion`);
+        const isNull = B.tmp(), tag = B.tmp(), tagPtr = B.tmp(), slot = B.tmp();
+        B.line(`${isNull} = icmp eq ptr ${p}, null`);
+        B.line(`${tag} = select i1 ${isNull}, i32 ${nullable.unitTag}, i32 ${nullable.refTag}`);
+        B.line(`${tagPtr} = getelementptr inbounds %ScrUnion, ptr ${box}, i64 0, i32 1`);
+        B.line(`store i32 ${tag}, ptr ${tagPtr}`);
+        B.line(`${slot} = getelementptr inbounds %ScrUnion, ptr ${box}, i64 0, i32 5`);
+        B.line(`store i64 0, ptr ${slot}`);
+        B.line(`store ptr ${p}, ptr ${slot}`);
+        return box;
+    }
+    /** The owned (+1) union value of a nullable-pointer slot: the unit arm's
+     * immortal instance, or a fresh heap box around a retained instance. */
+    nullableToOwnedUnion(p, nullable) {
+        const B = this.B;
+        const slot = B.slot();
+        B.entryAllocas.push(`${slot} = alloca ptr`);
+        const isNull = B.tmp();
+        const unit = B.newLabel("nf.u"), ref = B.newLabel("nf.r"), join = B.newLabel("nf.j");
+        B.line(`${isNull} = icmp eq ptr ${p}, null`);
+        B.condBr(isNull, unit, ref);
+        B.startBlock(unit);
+        B.line(`store ptr ${this.unitInstanceRef(nullable.unionId, nullable.unitTag)}, ptr ${slot}`);
+        B.br(join);
+        B.startBlock(ref);
+        const owned = this.retainValue(p, nullable.arm);
+        const box = this.unionNewOwned(nullable.unionId, nullable.refTag, {
+            name: owned,
+            type: nullable.arm,
+        });
+        B.line(`store ptr ${box}, ptr ${slot}`);
+        B.br(join);
+        B.startBlock(join);
+        const t = B.tmp();
+        B.line(`${t} = load ptr, ptr ${slot}`);
+        return t;
+    }
+    /** The owned (+1) instance pointer (NULL for the unit arm) of a union
+     * box, which stays owned by its existing owner. */
+    unionToNullable(u, nullable) {
+        const B = this.B;
+        const tag = this.unionTag(u, nullable.unionId);
+        const isRef = B.tmp(), sel = B.tmp();
+        B.line(`${isRef} = icmp eq i32 ${tag}, ${nullable.refTag}`);
+        const payload = this.unionPeek(u, nullable.unionId);
+        B.line(`${sel} = select i1 ${isRef}, ptr ${payload}, ptr null`);
+        return this.retainValue(sel, nullable.arm);
+    }
+    /** `obj.f = value` for a nullable-pointer field: the new instance pointer
+     * is produced without a union box where the value is a wrap, and as a
+     * retained payload of a borrowed box otherwise. Unlink-then-release like
+     * every field store. */
+    emitNullableFieldStore(obj, className, field, nullable, value) {
+        const B = this.B;
+        let next;
+        if (value.kind === "unionWrap" &&
+            value.unionId === nullable.unionId &&
+            (value.tag === nullable.refTag
+                ? typeEquals(value.value.type, nullable.arm)
+                : value.tag === nullable.unitTag)) {
+            if (value.tag === nullable.refTag) {
+                const inner = this.emitExpr(value.value);
+                this.moveTemp(inner);
+                next = inner.name;
+            }
+            else {
+                // Unit payloads carry nothing; a void payload runs for effects.
+                if (!isUnitType(value.value.type))
+                    this.emitExpr(value.value);
+                next = "null";
+            }
+        }
+        else if (value.kind === "varRef" && !this.canBorrowReceiver(value)) {
+            next = this.unionToNullable(this.emitExpr(value).name, nullable);
+        }
+        else {
+            next = this.unionToNullable(this.emitUnionProjection(value).name, nullable);
+        }
+        const { ptr } = this.classFieldPtr(obj, className, field);
+        const old = B.tmp();
+        B.line(`${old} = load ptr, ptr ${ptr}`);
+        B.line(`store ptr ${next}, ptr ${ptr}${this.fieldAliasAttachment(ptr)}`);
+        this.releaseValue(old, nullable.arm);
+    }
+    /** A union binding whose slot may hold a private stack box: stack locals
+     * and projection-only parameters (callers may pass stack boxes). Such a
+     * box must only be projected: never retained, released, or stored. */
+    isStackUnionLocal(localId) {
+        return (this.projectedParameters.has(localId) ||
+            this.localStackUnions.has(localId) ||
+            this.localUnionStorage.has(localId) ||
+            this.localArrayReads.has(localId) ||
+            this.mapReadLifetimes.locals.has(localId));
+    }
     canBorrowReceiver(e) {
         switch (e.kind) {
             case "varRef": {
@@ -4802,20 +6238,166 @@ export class LlEmitter {
                         isRefCounted(e.type)));
             }
             case "unionNarrow":
+            // Class casts reinterpret the same pointer (prefix layouts).
+            case "downcast":
+            case "upcast":
                 return this.canBorrowReceiver(e.value);
             case "fieldGet":
             case "recordGet":
                 return this.canBorrowReceiver(e.obj);
             case "ternary":
                 return this.canBorrowReceiver(e.then) && this.canBorrowReceiver(e.else_);
+            case "seqExpr": {
+                const guarded = guardedValue(e);
+                return guarded !== null && this.canBorrowReceiver(guarded);
+            }
             // The runtime always sets a pending exception; its unreachable
             // typed dummy is null and owns no receiver.
             case "libCall":
                 return e.fn === "error.nodeThrow";
+            case "unionWrap": {
+                const wrap = this.borrowableNullableWrap(e);
+                return wrap === "unit" || (wrap === "ref" && this.canBorrowReceiver(e.value));
+            }
+            // A borrowed-return callee preserves edges, so its result stays
+            // reachable from borrowable arguments until the consumer runs.
+            case "call":
+                return (this.borrowedReturns.has(e.callee) &&
+                    e.args.every((arg) => (!isRefCounted(arg.type) || this.canBorrowReceiver(arg)) &&
+                        this.referenceEffects.preserves(arg)));
+            // A required element read: the (borrowed) array owns the element
+            // while an edge-preserving index computes.
+            case "arrayGet":
+                return (e.arr.type.kind === "array" &&
+                    isRefCounted(e.arr.type.elem) &&
+                    this.canBorrowReceiver(e.arr) &&
+                    this.referenceEffects.preserves(e.index));
+            default:
+                return false;
+        }
+    }
+    /** A reference held as one plain pointer that emitReadReceiver can read
+     * without owning: class instances, records, arrays, strings and
+     * nullable-pointer unions. Tagged union boxes, closures and dynamic
+     * values keep ordinary ownership. */
+    plainReference(type) {
+        switch (type.kind) {
+            case "object":
+            case "record":
+            case "array":
+            case "string":
+                return true;
+            case "union":
+                return this.nullableUnions.has(type.unionId);
+            default:
+                return false;
+        }
+    }
+    /** Functions returning a walk of their borrowed parameters return it
+     * without a reference (+0) from their borrowing body; direct callers
+     * either consume it as a receiver/walk or retain it at once, and the owned
+     * adapter retains before releasing its parameters. Candidates preserve
+     * every heap edge (so the result stays reachable from the arguments),
+     * borrow every reference parameter and return plain pointers. The set
+     * grows to a fixpoint because a call to a borrowed-return function with
+     * walk arguments is itself a walk; walk facts are then recomputed with
+     * the final set, admitting only parameters whose convention borrows. */
+    analyzeBorrowedReturns() {
+        const pointer = (type) => this.plainReference(type);
+        const borrowedIds = (fn) => {
+            const indexes = this.callLifetimes.borrowed.get(fn.name);
+            return new Set(fn.params.filter((_, i) => indexes?.has(i)).map((p) => p.localId));
+        };
+        const hostFor = (fn) => {
+            const allowed = borrowedIds(fn);
+            return {
+                pointerLocal: (local) => pointer(local.type),
+                borrowsWithoutOwning: (e) => this.borrowsWithoutOwning(e),
+                borrowedReturn: (callee) => this.borrowedReturns.has(callee),
+                parameterAllowed: (id) => allowed.has(id),
+            };
+        };
+        const preserving = [...this.fnByName.values()].filter((fn) => this.referenceEffects.functions.has(fn.name));
+        const candidates = preserving.filter((fn) => {
+            if (!pointer(fn.returnType) || fn.async || fn.generator || fn.captures)
+                return false;
+            // A borrowing vtable slot dispatches to the borrowing body (or its
+            // virtual adapter) directly, and virtual callers own the result.
+            if (this.implSlotBorrowed(fn.name).size > 0)
+                return false;
+            const indexes = this.callLifetimes.borrowed.get(fn.name);
+            return (indexes !== undefined &&
+                indexes.size > 0 &&
+                fn.params.every((p, i) => !isRefCounted(p.type) || indexes.has(i)));
+        });
+        for (let changed = true; changed;) {
+            changed = false;
+            for (const fn of candidates) {
+                if (this.borrowedReturns.has(fn.name))
+                    continue;
+                if (!analyzeWalks(fn, hostFor(fn)).returnsWalk)
+                    continue;
+                this.borrowedReturns.add(fn.name);
+                changed = true;
+            }
+        }
+        if (this.borrowedReturns.size === 0)
+            return;
+        for (const fn of preserving) {
+            const walks = analyzeWalks(fn, hostFor(fn)).locals;
+            if (walks.size > 0)
+                this.walkBorrowsByFunction.set(fn.name, walks);
+        }
+    }
+    /** emitReadReceiver produces this node's pointer without acquiring a
+     * reference, given operands (and ternary arms) that do the same: plain
+     * class/record field reads, class casts, nullable-pointer narrows and
+     * wraps, and checked ternaries. Stack-boxed, map-read and boxed-field
+     * sources are owned. Depends only on module facts, not the current
+     * function. */
+    borrowsWithoutOwning(e) {
+        if (!isRefCounted(e.type) || this.isStackUnionSource(e))
+            return false;
+        if (matchMapRead(e, this.boxedUnionsById))
+            return false;
+        switch (e.kind) {
+            case "fieldGet":
+                return this.nullableFieldGet(e) === null;
+            case "recordGet":
+                return true;
+            case "unionNarrow":
+                return this.nullableUnions.has(e.unionId);
+            case "downcast":
+            case "upcast":
+                return e.value.type.kind === "object";
+            case "unionWrap":
+                return this.borrowableNullableWrap(e) !== null;
+            // The caller proves each arm separately.
+            case "ternary":
+                return true;
+            // The caller proves the arguments are walks; their evaluation must not
+            // remove an edge before the call reads them.
+            case "call":
+                return (this.borrowedReturns.has(e.callee) &&
+                    e.args.every((arg) => this.referenceEffects.preserves(arg)));
             default:
                 return false;
         }
     }
+    /** A wrap into a nullable-pointer union is the payload pointer itself
+     * (the reference arm) or an immortal constant (a unit arm), so it can
+     * borrow exactly when its payload can. Void payloads run for effects and
+     * keep the ordinary path; tagged unions still construct a box. */
+    borrowableNullableWrap(e) {
+        if (e.kind !== "unionWrap")
+            return null;
+        const nullable = this.nullableUnions.get(e.unionId);
+        if (!nullable)
+            return null;
+        if (isUnitType(e.value.type))
+            return e.value.kind === "unitLit" ? "unit" : null;
+        return e.tag === nullable.refTag && isRefCounted(e.value.type) ? "ref" : null;
+    }
     materializeSplitLocal(localId) {
         const span = this.splitSpans.get(localId);
         if (span)
@@ -4902,8 +6484,8 @@ export class LlEmitter {
     resolveThunkFor(inner) {
         return resolveThunkFor(this, inner);
     }
-    tagInSet(uName, tags) {
-        return tagInSet(this, uName, tags);
+    tagInSet(uName, unionId, tags) {
+        return tagInSet(this, uName, unionId, tags);
     }
     arrPush(arr, acc, value) {
         return arrPush(this, arr, acc, value);
@@ -4947,8 +6529,8 @@ export class LlEmitter {
     emitBytesLength(elem, receiver, bytes) {
         return emitBytesLength(this, elem, receiver, bytes);
     }
-    emitBytesGet(elem, receiver, index, expr, inBounds = false) {
-        return emitBytesGet(this, elem, receiver, index, expr, inBounds);
+    emitBytesGet(elem, receiver, index, expr, inBounds = false, invalidNaN = false) {
+        return emitBytesGet(this, elem, receiver, index, expr, inBounds, invalidNaN);
     }
     emitToUint32(value, expr, uint32) {
         return emitToUint32(this, value, expr, uint32);