@scriptc/compiler 0.2.6 → 0.2.8

package/dist/frontend/lowering/lower-exprs.js

@@ -1,5 +1,9 @@
+import { generatorDrain } from "./iterator-adapters.js";
+import { lowerUnionEquality, tagEqualityMayMissAlias } from "./strict-equality.js";
+import { isOptionalProcessStreamProperty } from "./builtins/process.js";
 import { lowerWorkerMetadata } from "./builtins/workers.js";
-import { dynUndefinedExpr, nodeThrowExpr, countedFor, numLit, strLit, varRef, } from "../../ir/build.js";
+import { threadsImportOf } from "../threads-import.js";
+import { dynUndefinedExpr, nodeThrowExpr, numLit, strLit, varRef } from "../../ir/build.js";
 import { InternalCompilerError } from "../../errors.js";
 import { SYMBOL_T } from "../../ir/ir.js";
 import { literalValues } from "../literal-values.js";
@@ -11,9 +15,12 @@ import { literalUnionArm } from "../union-discriminants.js";
  * ToBoolean/ToString coercion helpers, and field/element reads and writes
  * (FieldTarget). */
 import * as ts from "../ts7/adapter.js";
+import { constituentTypes } from "../ts7/checker.js";
 import { dirname } from "node:path";
 import * as posix from "node:path/posix";
-import { checkedClassAssertion } from "./class-assertions.js";
+import { checkedClassAssertion, checkedClassUnionAssertion } from "./class-assertions.js";
+import { narrowClassUnion, narrowStoredClassValue } from "./class-unions.js";
+import { lowerUnionFieldWrite } from "./expressions/union-field-write.js";
 import { captureContextArguments } from "./function-context.js";
 import { OBJECT_CALLABLE_VALUES } from "./surfaces.js";
 import { wasiGuestPath } from "../../wasi-paths.js";
@@ -23,9 +30,8 @@ import { ARRAY_METHODS, builtinConstLit, builtinFenceHintOf, builtinModuleConstO
 import { UNSUPPORTED, blockedBindingUseDiag, requiresDynamicPackageDiag, unsupportedDiag, } from "../../diagnostics/diagnostic.js";
 import { PoisonError, dynFallbackType, jsFuncNameOf, neverTaintedJsType, own } from "./lowerer.js";
 import { lowerCollectionSpread } from "./containers/collection-methods.js";
-import { lowerNpmStaticSafeIndexRead, lowerSafeIndexRead, tryLowerNumericIndexRead, } from "./containers/array-methods.js";
+import { arrayValueRead, arrayValueStore, arrayValueType, lowerSafeIndexRead, tryLowerIndexTruthiness, tryLowerNumericIndexRead, lowerSafeBytesRead, } from "./array-values.js";
 import { strCharsCall } from "./containers/array-construction.js";
-import { arrayValueRead, arrayValueStore, arrayValueType } from "./array-values.js";
 import { lowerOptionalStringIndex } from "./string-index.js";
 import { tryLowerIndexedComparison } from "./indexed-comparison.js";
 import { npmStaticPackageOfPath } from "../npm-static.js";
@@ -98,8 +104,8 @@ export function templateRawTextOf(node) {
 const LOWER_EXPR_MAX_DEPTH = 200;
 let lowerExprDepth = 0;
 /** True when a property access names an ABSTRACT property declaration
- * (`abstract p: number` — a PropertyDeclaration, not an accessor): the
- * named-fence test for reads/writes through abstract-typed receivers. */
+ * (`abstract p: number` — a PropertyDeclaration, not an accessor).
+ * These uses need concrete property dispatch because the base has no slot. */
 export function abstractPropertyDeclOf(lowerer, expr) {
     const sym = lowerer.checker.getSymbolAtLocation(expr.name);
     if (!sym)
@@ -161,7 +167,10 @@ export function lowerExpr(lowerer, expr) {
     }
     lowerExprDepth++;
     try {
-        return lowerExprInner(lowerer, expr);
+        const lowered = lowerExprInner(lowerer, expr);
+        if (lowered.type.kind === "void" && (lowerer.typeOf(expr).flags & ts.TypeFlags.Never) !== 0)
+            lowerer.neverValued.add(lowered);
+        return lowered;
     }
     finally {
         lowerExprDepth--;
@@ -286,16 +295,35 @@ function lowerExprInner(lowerer, expr) {
     // traps. Sub-union assertions and non-union inners keep their
     // historic erasure (the widening sites re-tag with traps already).
     if (ts.isNonNullExpression(expr)) {
+        // An asserted element read forwarded into a slot that holds undefined
+        // (see analyzeRuntimeOptionalArrayReads) reads without the bounds trap.
+        if (lowerer.runtimeOptionalAssertions.has(expr) &&
+            ts.isElementAccessExpression(expr.expression)) {
+            const probe = lowerAbsenceProbe(lowerer, expr.expression);
+            if (probe?.type.kind === "union")
+                return probe;
+        }
         const inner = lowerer.lowerExpr(expr.expression);
         if (inner.type.kind === "union") {
+            // `!` performs no runtime check: a missing array element stays
+            // undefined where its destination can hold it.
+            if (ts.isElementAccessExpression(expr.expression) &&
+                assertedElementKeepsUndefined(lowerer, expr))
+                return inner;
+            // A forwarded assertion whose destination was promoted to hold
+            // undefined (see analyzeRuntimeOptionalArrayReads), or an equality
+            // operand, keeps the value: `!` performs no runtime check.
+            const target = lowerer.mapTypeOf(lowerer.typeOf(expr));
+            if (lowerer.runtimeOptionalAssertions.has(expr) ||
+                (target?.kind === "object" && isEqualityOperand(expr)))
+                return inner;
             const use = runtimeOptionalUseOf(expr);
             if (runtimeOptionalAssertionErases(lowerer, expr, inner, use))
                 return inner;
-            const target = lowerer.mapTypeOf(lowerer.typeOf(expr));
             if (target && target.kind !== "union" && !typeEquals(target, inner.type)) {
                 const helper = lowerer.narrowedArmHelper(inner.type.unionId, target, loc);
                 if (helper) {
-                    return { kind: "call", callee: helper, args: [inner], type: target, loc };
+                    return lowerer.checkedNarrowCall(helper, inner, target, loc);
                 }
             }
             return inner;
@@ -717,7 +745,7 @@ function lowerExprInner(lowerer, expr) {
         // A known static result type fixes typeof's answer, but its producer
         // still evaluates: calls, getters, and checked reads can have effects
         // or throw. Only trivial operands may disappear.
-        let operand = lowerer.lowerExpr(expr.expression);
+        let operand = deferredSlotOr(lowerer, runtimeOptionalStorageOperand(lowerer, expr.expression) ?? lowerer.lowerExpr(expr.expression));
         if (operand.type.kind === "jsval") {
             return { kind: "jsOp", op: "typeof", args: [operand], type: STRING, loc };
         }
@@ -936,13 +964,7 @@ function lowerExprInner(lowerer, expr) {
                                 ? lowerer.narrowedArmHelper(local.type.unionId, narrowed, loc)
                                 : null;
                         if (helper) {
-                            return {
-                                kind: "call",
-                                callee: helper,
-                                args: [varRef(local.id, local.type, loc)],
-                                type: narrowed,
-                                loc,
-                            };
+                            return lowerer.checkedNarrowCall(helper, varRef(local.id, local.type, loc), narrowed, loc);
                         }
                     }
                 }
@@ -980,7 +1002,10 @@ function lowerExprInner(lowerer, expr) {
             // that does not exist. The blocked-binding cascade names the use;
             // without this the validator's registration check ICEs on the live
             // reference (`@this {T}` inference — signature 07).
-            if (lowerer.typeNamesUnregisteredClass(g.type)) {
+            const unregistered = lowerer.unregisteredClassOf(g.type, new Set());
+            if (unregistered !== null) {
+                // The class's own rejection is the root cause the cascade names.
+                lowerer.flushDeferredClass(unregistered);
                 lowerer.pushDiag(blockedBindingUseDiag(expr.text, loc));
                 throw new PoisonError();
             }
@@ -1013,7 +1038,7 @@ function lowerExprInner(lowerer, expr) {
                     lowerer.armTag(g.type.unionId, narrowed) >= 0) {
                     const helper = lowerer.narrowedArmHelper(g.type.unionId, narrowed, loc);
                     if (helper)
-                        return { kind: "call", callee: helper, args: [ref], type: narrowed, loc };
+                        return lowerer.checkedNarrowCall(helper, ref, narrowed, loc);
                 }
                 const use = runtimeOptionalUseOf(expr);
                 // The enclosing logical/conditional expression consumes the union
@@ -1111,6 +1136,14 @@ function lowerExprInner(lowerer, expr) {
         // as interned string literals; functions have no closure
         // representation (they lower to libCall at call sites only); members
         // with no lowering at all fence with the module-qualified name.
+        {
+            const member = threadsImportOf(lowerer.program, expr);
+            // scriptc delivers published graphs by reference.
+            if (member === "sharesPublishedGraphs")
+                return { kind: "boolLit", value: true, type: BOOL, loc };
+            if (member === "publish")
+                lowerer.noLowering("publish (@scriptc/threads) as a value", expr, "call publish(value) directly");
+        }
         {
             const bi = lowerer.builtinImportOf(expr);
             if (bi) {
@@ -3075,6 +3108,11 @@ export function maybeNarrow(lowerer, expr, node) {
     // same trust-the-checker contract as the union bridge below.
     if (expr.type.kind === "object") {
         const narrowed = lowerer.mapTypeOf(lowerer.typeOf(node));
+        if (narrowed?.kind === "union") {
+            const union = narrowClassUnion(lowerer, expr, narrowed);
+            if (union)
+                return union;
+        }
         if (narrowed?.kind === "object" &&
             narrowed.className !== expr.type.className &&
             lowerer.isSubclassOf(narrowed.className, expr.type.className)) {
@@ -3084,6 +3122,8 @@ export function maybeNarrow(lowerer, expr, node) {
     }
     if (expr.type.kind !== "union")
         return expr;
+    if (ts.isPropertyAccessExpression(node) && isOptionalProcessStreamProperty(lowerer, node))
+        return expr;
     // Represented fields and index values can include undefined even when
     // checker inference or lib.d.ts declares strings (RegExp captures).
     // Only a declaration that represents the optional arm can provide a
@@ -3228,6 +3268,9 @@ function runtimeOptionalReceiverRead(lowerer, expr, local, property, loc) {
         lowerer.unsupported("SC1090", expr, "a runtime-optional capture whose narrowed value type is not representable");
     }
     if (narrowed.kind === "union") {
+        const classView = narrowStoredClassValue(lowerer, varRef(local.id, local.type, loc), narrowed);
+        if (classView)
+            return classView;
         // The checker may keep the receiver at the storage union unchanged
         // (`string | undefined` on a JS `.match()` call). There is no
         // sub-union to re-tag: preserve the value for the downstream
@@ -3254,6 +3297,13 @@ function runtimeOptionalReceiverRead(lowerer, expr, local, property, loc) {
             loc,
         };
     }
+    if (narrowed.kind === "object") {
+        const view = checkedClassAssertion(lowerer, varRef(local.id, local.type, loc), narrowed, loc);
+        // Preserve the member-specific missing-value error on the two-arm
+        // path below; mixed storage also needs to validate its concrete class.
+        if (view && (lowerer.unions.get(local.type.unionId)?.arms.length ?? 0) > 2)
+            return view;
+    }
     const undefTag = lowerer.armTag(local.type.unionId, UNDEFINED_T);
     const def = lowerer.unions.get(local.type.unionId);
     if (!def || undefTag < 0)
@@ -3269,13 +3319,7 @@ function runtimeOptionalReceiverRead(lowerer, expr, local, property, loc) {
         if (!helper) {
             lowerer.unsupported("SC1090", expr, "a direct read from a runtime-optional capture with multiple value arms");
         }
-        return {
-            kind: "call",
-            callee: helper,
-            args: [varRef(local.id, local.type, loc)],
-            type: narrowed,
-            loc,
-        };
+        return lowerer.checkedNarrowCall(helper, varRef(local.id, local.type, loc), narrowed, loc);
     }
     // A predicate can strengthen a record's fields or narrow a base class
     // to a subclass without changing the slot's stored value arm. Extract
@@ -3408,6 +3452,57 @@ function runtimeOptionalElementKey(expr) {
         return expr.text;
     return null;
 }
+/** An operand of `===`, `!==`, `==` or `!=` (through parentheses). */
+function isEqualityOperand(node) {
+    let outer = node;
+    while (ts.isParenthesizedExpression(outer.parent))
+        outer = outer.parent;
+    const parent = outer.parent;
+    return (ts.isBinaryExpression(parent) &&
+        (parent.operatorToken.kind === ts.SyntaxKind.EqualsEqualsEqualsToken ||
+            parent.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken ||
+            parent.operatorToken.kind === ts.SyntaxKind.EqualsEqualsToken ||
+            parent.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsToken));
+}
+/** Whether `xs[i]!` lands where an absent element's undefined is
+ * representable: array storage (a literal element, a push/unshift
+ * argument, an element assignment — arrays record the undefined state),
+ * an equality operand, or a slot whose contextual type admits undefined.
+ * TypeScript's `!` has no runtime effect, so such reads stay optional. */
+function assertedElementKeepsUndefined(lowerer, node) {
+    let outer = node;
+    while (ts.isParenthesizedExpression(outer.parent))
+        outer = outer.parent;
+    const parent = outer.parent;
+    if (ts.isArrayLiteralExpression(parent))
+        return true;
+    // An equality test observes the missing element itself.
+    if (ts.isBinaryExpression(parent) &&
+        (parent.operatorToken.kind === ts.SyntaxKind.EqualsEqualsEqualsToken ||
+            parent.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken ||
+            parent.operatorToken.kind === ts.SyntaxKind.EqualsEqualsToken ||
+            parent.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsToken))
+        return true;
+    const isArray = (receiver) => lowerer.checker.isArrayType(lowerer.typeOf(receiver));
+    if (ts.isCallExpression(parent) &&
+        parent.arguments.includes(outer) &&
+        ts.isPropertyAccessExpression(parent.expression) &&
+        (parent.expression.name.text === "push" || parent.expression.name.text === "unshift") &&
+        isArray(parent.expression.expression))
+        return true;
+    if (ts.isBinaryExpression(parent) &&
+        parent.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
+        parent.right === outer &&
+        ts.isElementAccessExpression(parent.left) &&
+        isArray(parent.left.expression))
+        return true;
+    const contextual = lowerer.checker.getContextualType(outer);
+    if (!contextual)
+        return false;
+    const admits = (type) => (type.flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown | ts.TypeFlags.Undefined)) !== 0;
+    return (admits(contextual) ||
+        ((contextual.flags & ts.TypeFlags.Union) !== 0 && constituentTypes(contextual).some(admits)));
+}
 function runtimeOptionalAssertionErases(lowerer, expr, inner, use) {
     if (inner.type.kind !== "union" ||
         !use?.optional ||
@@ -3436,6 +3531,17 @@ export function lowerUnitComparison(lowerer, left, right, negated, loc) {
         // Two unit literals (`undefined === undefined`): statically decided.
         return { kind: "boolLit", value: (other.unit === unit.unit) !== negated, type: BOOL, loc };
     }
+    const slot = lowerer.deferredFieldSlot(other);
+    if (slot)
+        return lowerUnitComparison(lowerer, slot, unit, negated, loc);
+    // A binding the checker narrowed past the unit can still hold it at
+    // runtime when its value came from an unassigned deferred-init field;
+    // the stored tag answers either way.
+    if (other.kind === "unionNarrow" &&
+        other.value.kind === "varRef" &&
+        other.value.type.kind === "union" &&
+        lowerer.armTag(other.value.type.unionId, unit.type) >= 0)
+        return lowerUnitComparison(lowerer, other.value, unit, negated, loc);
     if (other.type.kind === "union") {
         const tag = lowerer.armTag(other.type.unionId, unit.type);
         if (tag < 0) {
@@ -3543,7 +3649,7 @@ function lowerLooseNullCompare(lowerer, expr, loc) {
     if (!leftIsNull && right.kind !== ts.SyntaxKind.NullKeyword)
         return null;
     const otherNode = leftIsNull ? right : left;
-    const other = lowerer.lowerExpr(otherNode);
+    const other = lowerPresenceOperand(lowerer, otherNode);
     if (isUnitType(other.type)) {
         // `null == null`, `undefined == null`: units are mutually loose-equal.
         return { kind: "boolLit", value: !negated, type: BOOL, loc };
@@ -3648,13 +3754,110 @@ export function lowerNullishCoalesce(lowerer, expr, loc) {
         parents.push(first);
         first = first.left;
     }
-    let result = lowerNullishPair(lowerer, first, first === expr ? loc : locOf(first), lowerAbsenceProbe(lowerer, first.left) ?? lowerer.lowerExpr(first.left));
+    let result = lowerNullishPair(lowerer, first, first === expr ? loc : locOf(first), assertedPresenceOperand(lowerer, first.left));
     for (let i = parents.length - 1; i >= 0; i--) {
         const parent = parents[i];
         result = lowerNullishPair(lowerer, parent, parent === expr ? loc : locOf(parent), result);
     }
     return result;
 }
+/** The left side of `??` (see lowerPresenceOperand). The absence probe
+ * reads optional storage beneath erased assertions; a union assertion that
+ * narrows a stored class arm still applies its checked class view, so
+ * `(node.parent as Sub | undefined) ?? node` sees the asserted arm on both
+ * sides of the default. */
+function assertedPresenceOperand(lowerer, node) {
+    const probe = lowerAbsenceProbe(lowerer, node);
+    if (probe === null)
+        return runtimeOptionalStorageOperand(lowerer, node) ?? lowerer.lowerExpr(node);
+    if (probe.type.kind !== "union" && probe.type.kind !== "object")
+        return probe;
+    let outer = node;
+    while (ts.isParenthesizedExpression(outer))
+        outer = outer.expression;
+    if (!ts.isAsExpression(outer) && !ts.isTypeAssertion(outer))
+        return probe;
+    const target = lowerer.mapTypeOf(lowerer.checker.getTypeFromTypeNode(outer.type));
+    if (target?.kind !== "union" || typeEquals(target, probe.type))
+        return probe;
+    return checkedClassUnionAssertion(lowerer, probe, target, locOf(outer)) ?? probe;
+}
+/** Read-modify-write updates read the member first: an unassigned
+ * deferred-init receiver throws Node's member-read TypeError. */
+function checkDeferredMemberReceiver(lowerer, target, access) {
+    if (target.container !== "class" ||
+        !ts.isPropertyAccessExpression(access) ||
+        target.obj.type.kind !== "object" ||
+        lowerer.deferredFieldSlot(target.obj) === null)
+        return;
+    target.obj =
+        lowerer.runtimeOptionalPropertyReceiver(access.expression, target.obj, target.obj.type, target.field) ?? target.obj;
+}
+/** Whether evaluating `expr` cannot store anything or run other code:
+ * reads, arithmetic, tests and checked extractions (which at most throw). */
+function writeFree(expr) {
+    switch (expr.kind) {
+        case "numLit":
+        case "strLit":
+        case "boolLit":
+        case "unitLit":
+        case "varRef":
+            return true;
+        case "fieldGet":
+        case "recordGet":
+            return writeFree(expr.obj);
+        case "bin":
+        case "logical":
+            return writeFree(expr.left) && writeFree(expr.right);
+        case "unary":
+        case "toBool":
+            return writeFree(expr.operand);
+        case "ternary":
+            return writeFree(expr.cond) && writeFree(expr.then) && writeFree(expr.else_);
+        case "unionIsTag":
+        case "unionNarrow":
+        case "unionWrap":
+            return writeFree(expr.value);
+        case "libCall":
+            return expr.fn === "error.nodeThrow";
+        default:
+            return false;
+    }
+}
+/** The TypeError of a deferred-init field read that finds the field
+ * unassigned where its declared type cannot hold undefined. */
+export const DEFERRED_READ_MESSAGE = "undefined is not representable in the target union (a value narrowed or asserted past it still held it)";
+/** The undefined-armed slot behind a checked deferred-init field read, or
+ * the value itself (Lowerer.deferredFieldSlot). */
+function deferredSlotOr(lowerer, value) {
+    return lowerer.deferredFieldSlot(value) ?? value;
+}
+/** A plain value read that may be runtime-optional: an unchecked element
+ * read, or a binding, member or call that carries one. Lowering these
+ * without a destination type is the same as lowering them into one. */
+function isPlainValueRead(node) {
+    while (ts.isParenthesizedExpression(node))
+        node = node.expression;
+    return (ts.isElementAccessExpression(node) ||
+        ts.isIdentifier(node) ||
+        ts.isPropertyAccessExpression(node) ||
+        ts.isCallExpression(node));
+}
+/** A member access or call receiver needs the present value itself (JS
+ * throws a TypeError reading a member of undefined). */
+function isMemberReceiver(node) {
+    let child = node;
+    let parent = node.parent;
+    while (ts.isParenthesizedExpression(parent)) {
+        child = parent;
+        parent = parent.parent;
+    }
+    return (((ts.isPropertyAccessExpression(parent) ||
+        ts.isElementAccessExpression(parent) ||
+        ts.isCallExpression(parent)) &&
+        parent.expression === child) ||
+        (ts.isTaggedTemplateExpression(parent) && parent.tag === child));
+}
 function lowerNullishPair(lowerer, expr, loc, left) {
     if (left.type.kind === "dyn") {
         // `a ?? b` on a CHECKED-DYNAMIC left: the deciding test is the
@@ -3691,7 +3894,24 @@ function lowerNullishPair(lowerer, expr, loc, left) {
     const fresh = rest.length === 1 ? lowerer.emptyCollectionFor(expr.right, rest[0]) : null;
     if (fresh)
         return { kind: "nullish", left, right: fresh, type: fresh.type, loc };
-    const type = lowerer.irTypeOf(expr);
+    let type = lowerer.irTypeOf(expr);
+    // A runtime-optional read can reach the default even when declarations
+    // call the left side present. Preserve a differently typed primitive
+    // fallback rather than checking it against that incomplete result type.
+    const rightType = lowerer.mapTypeOf(lowerer.typeOf(expr.right));
+    const primitive = (t) => t.kind === "f64" || t.kind === "string" || t.kind === "bool";
+    if (rightType &&
+        primitive(type) &&
+        primitive(rightType) &&
+        !typeEquals(type, rightType) &&
+        rest.every(primitive)) {
+        const arms = [...rest];
+        if (!arms.some((arm) => typeEquals(arm, rightType)))
+            arms.push(rightType);
+        arms.sort((a, b) => (typeKey(a) < typeKey(b) ? -1 : 1));
+        type = { kind: "union", unionId: lowerer.unions.intern(arms) };
+        lowerer.runtimeOptionalArithmeticTypes.set(expr, type);
+    }
     if (type.kind === "dyn" && lowerer.dynConvertible(left.type)) {
         return {
             kind: "nullish",
@@ -3701,6 +3921,27 @@ function lowerNullishPair(lowerer, expr, loc, left) {
             loc,
         };
     }
+    // A runtime-optional default (`name ?? names[0]`): the checker types an
+    // unchecked element read as the bare element type, but an out-of-range
+    // read is undefined at runtime. When the default shares the left's
+    // optional union, that union is the result, so the undefined state
+    // reaches the consumer (an optional return or parameter takes it as its
+    // undefined arm; a plain slot still extracts the element with its
+    // checked narrow).
+    if (rest.length === 1 &&
+        typeEquals(type, rest[0]) &&
+        isPlainValueRead(expr.right) &&
+        !isMemberReceiver(expr)) {
+        const raw = lowerer.lowerExpr(expr.right);
+        if (typeEquals(raw.type, left.type))
+            return { kind: "nullish", left, right: raw, type: left.type, loc };
+        // `names[0] ?? undefined`: an explicit unit default stays the left's arm.
+        if (isUnitType(raw.type) && lowerer.armTag(left.type.unionId, raw.type) >= 0) {
+            const right = lowerer.coerceInto(expr.right, raw, left.type);
+            return { kind: "nullish", left, right, type: left.type, loc };
+        }
+        return { kind: "nullish", left, right: lowerer.coerceInto(expr.right, raw, type), type, loc };
+    }
     if (typeEquals(type, left.type) || (rest.length === 1 && typeEquals(type, rest[0]))) {
         const right = lowerer.lowerExprExpecting(expr.right, type);
         return { kind: "nullish", left, right, type, loc };
@@ -3711,6 +3952,24 @@ function lowerNullishPair(lowerer, expr, loc, left) {
             return nullishBranches(lowerer, left, left.type, def.arms, type, loc, () => lowerer.lowerExprExpecting(expr.right, type), (stable) => ({ kind: "call", callee: helper, args: [stable], type, loc }));
         }
     }
+    // A subclass value defaulted to a base-class value (`circle ?? shape`):
+    // the present arm upcasts after the original nullish test, and the
+    // default lowers lazily into the base-class result.
+    const present = rest.length === 1 ? rest[0] : null;
+    if (present?.kind === "object" &&
+        type.kind === "object" &&
+        present.className !== type.className &&
+        lowerer.isSubclassOf(present.className, type.className)) {
+        const helper = lowerer.narrowedArmHelper(left.type.unionId, present, loc);
+        if (helper !== null) {
+            return nullishBranches(lowerer, left, left.type, def.arms, type, loc, () => lowerer.lowerExprExpecting(expr.right, type), (stable) => ({
+                kind: "upcast",
+                value: { kind: "call", callee: helper, args: [stable], type: present, loc },
+                type,
+                loc,
+            }));
+        }
+    }
     // A default may change the union or widen its records. Test the
     // original tag before coercing: converting the whole left first can
     // lose nullish arms, and evaluating the default eagerly loses laziness.
@@ -3824,7 +4083,8 @@ export function lowerCondition(lowerer, expr) {
             };
         }
     }
-    return lowerer.ensureBool(lowerAbsenceProbe(lowerer, expr) ?? lowerer.lowerExpr(expr), expr);
+    const value = lowerPresenceOperand(lowerer, expr);
+    return (tryLowerIndexTruthiness(lowerer, value, expr, locOf(expr)) ?? lowerer.ensureBool(value, expr));
 }
 function lowerPromiseThenPresence(lowerer, access, result) {
     if (access.name.text !== "then")
@@ -3863,13 +4123,7 @@ function lowerPromiseThenPresence(lowerer, access, result) {
             const helper = lowerer.narrowedArmHelper(receiver.type.unionId, promiseType, receiver.loc);
             if (helper === null)
                 return null;
-            receiver = {
-                kind: "call",
-                callee: helper,
-                args: [receiver],
-                type: promiseType,
-                loc: receiver.loc,
-            };
+            receiver = lowerer.checkedNarrowCall(helper, receiver, promiseType, receiver.loc);
         }
     }
     if (receiver.type.kind === "dyn") {
@@ -4557,13 +4811,7 @@ export function lowerIntrinsicProperty(lowerer, expr) {
                     ? lowerer.narrowedArmHelper(receiver.type.unionId, present, locOf(expr.expression))
                     : null;
                 receiver = helper
-                    ? {
-                        kind: "call",
-                        callee: helper,
-                        args: [receiver],
-                        type: present,
-                        loc: locOf(expr.expression),
-                    }
+                    ? lowerer.checkedNarrowCall(helper, receiver, present, locOf(expr.expression))
                     : lowerer.maybeNarrow(receiver, expr.expression);
             }
             // An island handle behind a typed-array .d.ts surface: the engine
@@ -4657,13 +4905,7 @@ export function lowerIntrinsicProperty(lowerer, expr) {
                 ? lowerer.narrowedArmHelper(receiver.type.unionId, present, locOf(expr.expression))
                 : null;
             receiver = helper
-                ? {
-                    kind: "call",
-                    callee: helper,
-                    args: [receiver],
-                    type: present,
-                    loc: locOf(expr.expression),
-                }
+                ? lowerer.checkedNarrowCall(helper, receiver, present, locOf(expr.expression))
                 : lowerer.maybeNarrow(receiver, expr.expression);
         }
         // An island handle behind an array-typed .d.ts surface
@@ -4963,7 +5205,30 @@ export function lowerArrayLiteral(lowerer, expr, expected) {
         }
         lowerer.badType(expr, tsType);
     }
-    const type = mapped;
+    let type = mapped;
+    // An inferred array of records takes the layout of an element literal
+    // whose fields widened for missing-element reads; the other elements
+    // build that layout directly. An explicit destination keeps its own.
+    if (!expected && type.elem.kind === "record") {
+        let variant = null;
+        for (const candidate of expr.elements) {
+            let x = candidate;
+            while (ts.isParenthesizedExpression(x))
+                x = x.expression;
+            if (!ts.isObjectLiteralExpression(x))
+                continue;
+            const probe = tryLowerExpression(lowerer, x);
+            if (!probe || !lowerer.isRuntimeOptionalRecordVariant(probe.type, type.elem))
+                continue;
+            if (variant !== null && !typeEquals(variant, probe.type)) {
+                variant = null;
+                break;
+            }
+            variant = probe.type;
+        }
+        if (variant !== null)
+            type = arrayOf(variant);
+    }
     // Keep the array payload type fixed. Optional reads are stored through
     // arrayValueStore, which records UNDEFINED in the state byte while the
     // payload remains number/string/etc.; widening the array element here
@@ -5031,6 +5296,13 @@ export function lowerArrayLiteral(lowerer, expr, expected) {
                     loc: locOf(el),
                 };
             }
+            // `[...it]` over a generator (or an iterator adapted into one):
+            // drain it once, in order, into a fresh element array.
+            if (src.type.kind === "generator") {
+                const drained = generatorDrain(lowerer, src, type.elem, locOf(el));
+                if (drained)
+                    src = drained;
+            }
             // A native checked iterable can supply scalar elements even when
             // the checker inferred a typed array from its producer. Drain once
             // and validate the elements before the ordinary spread copy.
@@ -5121,8 +5393,21 @@ export function lowerArrayLiteral(lowerer, expr, expected) {
     }
     const out = lowerer.declareHiddenLocal("%arrayLit", type);
     const outRef = varRef(out.id, type, loc);
+    // Dense capacity for the elements the statements below store.
+    const capacity = Math.min(elems.length - spreads.length, 1024);
     const body = [
-        { kind: "varDecl", localId: out.id, init: { kind: "arrayLit", elems: [], type, loc }, loc },
+        {
+            kind: "varDecl",
+            localId: out.id,
+            init: {
+                kind: "arrayLit",
+                elems: [],
+                ...(capacity > 0 ? { capacity } : {}),
+                type,
+                loc,
+            },
+            loc,
+        },
     ];
     const spreadSet = new Set(spreads);
     const currentLength = () => ({
@@ -5545,7 +5830,7 @@ export function lowerElementAccess(lowerer, expr) {
                 ? lowerer.narrowedArmHelper(recv.type.unionId, present, locOf(expr.expression))
                 : null;
             recv = helper
-                ? { kind: "call", callee: helper, args: [recv], type: present, loc: locOf(expr.expression) }
+                ? lowerer.checkedNarrowCall(helper, recv, present, locOf(expr.expression))
                 : lowerer.maybeNarrow(recv, expr.expression);
         }
         // A typed-array .d.ts surface whose VALUE is an island handle
@@ -5554,7 +5839,7 @@ export function lowerElementAccess(lowerer, expr) {
         // declared number type.
         if (recv.type.kind === "jsval")
             return islandElementRead(lowerer, expr, recv);
-        const index = lowerer.lowerExpr(expr.argumentExpression);
+        const index = lowerOptionalNumber(lowerer, lowerer.lowerExpr(expr.argumentExpression), locOf(expr.argumentExpression), expr.argumentExpression);
         if (isJsSourceFile(expr.getSourceFile()) && recv.type.kind === "bytes") {
             return {
                 kind: "dynKeyGet",
@@ -5578,14 +5863,21 @@ export function lowerElementAccess(lowerer, expr) {
         if (index.type.kind !== "f64") {
             lowerer.unsupported("SC1090", expr.argumentExpression, "indexing with non-number keys");
         }
-        return {
-            kind: "bytesIntrinsic",
-            method: "get",
-            receiver: recv,
-            args: [index],
-            type: F64,
-            loc: locOf(expr),
-        };
+        // `t[i]!` asserts presence: the numeric element read (NaN when
+        // invalid). Every other read answers undefined for an invalid index,
+        // like Node.
+        if (ts.isNonNullExpression(expr.parent) && expr.parent.expression === expr) {
+            return {
+                kind: "bytesIntrinsic",
+                method: "get",
+                receiver: recv,
+                args: [index],
+                type: F64,
+                loc: locOf(expr),
+                invalidNaN: true,
+            };
+        }
+        return lowerSafeBytesRead(lowerer, recv, index, locOf(expr));
     }
     // Tuple element read `t[0]`: a positional-field read of the tuple's
     // record shape — LITERAL indices only (the checker's per-index types
@@ -5628,13 +5920,7 @@ export function lowerElementAccess(lowerer, expr) {
                     ? lowerer.narrowedArmHelper(obj.type.unionId, present, locOf(expr.expression))
                     : null;
                 obj = helper
-                    ? {
-                        kind: "call",
-                        callee: helper,
-                        args: [obj],
-                        type: present,
-                        loc: locOf(expr.expression),
-                    }
+                    ? lowerer.checkedNarrowCall(helper, obj, present, locOf(expr.expression))
                     : lowerer.maybeNarrow(obj, expr.expression);
             }
             const idx = tupleLiteralIndex(expr.argumentExpression);
@@ -5811,19 +6097,14 @@ export function lowerElementAccess(lowerer, expr) {
             }
         }
         if (receiverIr?.kind === "string") {
-            // `s[i]` with a number index reads a UTF-16 code unit — charAt's
-            // exact job (the UTF-16-exact runtime). Without
-            // noUncheckedIndexedAccess the checker types the read `string`,
-            // and charAt's "" is the only string-typed answer for an
-            // out-of-range or fractional index where JS reads `undefined` —
-            // SEMANTICS.md documents the divergence; in-range integer reads
-            // (the loop pattern) are JS-exact. Optional results instead retain
-            // undefined for missing string properties.
+            // An indexed string property is absent for non-integer and missing
+            // indexes. charAt has different coercion and out-of-range semantics.
             const recv = lowerer.lowerExpr(expr.expression);
-            const index = lowerer.lowerExpr(expr.argumentExpression);
-            const resultType = lowerer.mapTypeOf(lowerer.typeOf(expr));
+            const index = lowerOptionalNumber(lowerer, lowerer.lowerExpr(expr.argumentExpression), locOf(expr.argumentExpression), expr.argumentExpression);
             if (index.type.kind === "f64" && recv.type.kind === "string") {
-                if (resultType?.kind === "string") {
+                // A proven in-bounds integer index always names a code unit, where
+                // charAt and the property read agree.
+                if (lowerer.stringIndexBounds.inBounds(expr))
                     return {
                         kind: "strIntrinsic",
                         method: "charAt",
@@ -5832,15 +6113,7 @@ export function lowerElementAccess(lowerer, expr) {
                         type: STRING,
                         loc: locOf(expr),
                     };
-                }
-                if (resultType?.kind === "union") {
-                    const arms = lowerer.unions.get(resultType.unionId)?.arms;
-                    if (arms?.length === 2 &&
-                        lowerer.armTag(resultType.unionId, STRING) >= 0 &&
-                        lowerer.armTag(resultType.unionId, UNDEFINED_T) >= 0) {
-                        return lowerOptionalStringIndex(lowerer, recv, index, resultType, locOf(expr));
-                    }
-                }
+                return lowerOptionalStringIndex(lowerer, recv, index, lowerer.withUndefinedArm(STRING), locOf(expr));
             }
             lowerer.unsupported("SC1090", expr, "string indexing with this index/result shape (expected a number index and a string or string | undefined result)");
         }
@@ -5903,7 +6176,7 @@ export function lowerElementAccess(lowerer, expr) {
             ? lowerer.narrowedArmHelper(arr.type.unionId, present, locOf(expr.expression))
             : null;
         arr = helper
-            ? { kind: "call", callee: helper, args: [arr], type: present, loc: locOf(expr.expression) }
+            ? lowerer.checkedNarrowCall(helper, arr, present, locOf(expr.expression))
             : lowerer.maybeNarrow(arr, expr.expression);
     }
     // The checker sees an array but the VALUE is an island handle (an
@@ -5962,10 +6235,13 @@ export function lowerElementAccess(lowerer, expr) {
     // change the storage representation or the low-level getter itself.
     if (arr.type.kind === "array") {
         // A non-null assertion is the explicit proven-present form. Preserve
-        // the dense getter's established bounds trap here; turning `xs[i]!`
-        // into an optional union would change library ABI checks and the
-        // existing catchable RangeError contract for an out-of-bounds assert.
-        const provenPresent = ts.isNonNullExpression(expr.parent) && expr.parent.expression === expr;
+        // the dense getter's established bounds trap where the asserted value
+        // must be the element type (library ABI checks and the catchable
+        // RangeError contract for an out-of-bounds assert). Where undefined is
+        // representable, the assertion keeps JavaScript's unchecked read.
+        const provenPresent = ts.isNonNullExpression(expr.parent) &&
+            expr.parent.expression === expr &&
+            !assertedElementKeepsUndefined(lowerer, expr.parent);
         if (provenPresent) {
             return lowerer.maybeNarrow({ kind: "arrayGet", arr, index, type: elemT, loc: locOf(expr) }, expr);
         }
@@ -5979,7 +6255,7 @@ export function lowerElementAccess(lowerer, expr) {
         arr.kind === "arrIntrinsic" &&
         arr.method === "slice" &&
         npmStaticPackageOfPath(expr.getSourceFile().fileName) !== null) {
-        const safe = lowerNpmStaticSafeIndexRead(lowerer, arr, index, locOf(expr));
+        const safe = lowerSafeIndexRead(lowerer, arr, index, locOf(expr));
         if (safe)
             return safe;
     }
@@ -6210,6 +6486,57 @@ function lowerRecordPropertyKey(lowerer, key, node) {
     }
     return key;
 }
+/** The stored value of an identifier whose storage holds an undefined arm
+ * that the checker's type at this use has dropped. An assignment from an
+ * unchecked indexed read narrows the declared type even though the value
+ * can be absent at runtime, so presence tests (`=== undefined`, `== null`,
+ * truthiness, `??`, `typeof`) read the storage tag instead of trusting
+ * that narrowing. A guard-proven use answers the same way at runtime. */
+export function runtimeOptionalStorageOperand(lowerer, node) {
+    let expr = node;
+    while (ts.isParenthesizedExpression(expr))
+        expr = expr.expression;
+    if (!ts.isIdentifier(expr))
+        return null;
+    // Only storage that can actually receive an absent value without the
+    // checker seeing it qualifies; other declared-optional bindings keep the
+    // checker's assignment and guard narrowing.
+    const symbol = lowerer.resolveValueSymbol(expr);
+    const local = lowerer.resolveLocal(expr);
+    const global = local ? undefined : lowerer.globalOf(expr);
+    const root = local ? lowerer.runtimeOptionalRootOf(local) : null;
+    if (root && lowerer.runtimeOptionalStorageLocals.has(root)) {
+        // These locals track guards: a branch that proved presence removes
+        // the binding from the active set, and its reads stay narrowed. A
+        // captured binding can be reassigned between calls, so a capture
+        // never inherits a guard (the identifier read's own rule).
+        const captured = local.boxed === true ||
+            (!!symbol && lowerer.ctx.captureBySymbol.get(symbol) === local) ||
+            root !== local;
+        if (!captured && !lowerer.runtimeOptionalLocals.has(root))
+            return null;
+    }
+    else if (!(symbol && lowerer.runtimeOptionalAssignedSymbols.has(symbol)) &&
+        !(symbol && lowerer.runtimeOptionalBindingTypes.has(symbol)) &&
+        !(global && lowerer.isRuntimeOptionalGlobal(global)))
+        return null;
+    const optional = lowerer.runtimeOptionalIdentifierValue(expr);
+    if (optional === null)
+        return null;
+    const checked = lowerer.mapTypeOf(lowerer.typeOf(expr));
+    if (checked === null ||
+        (checked.kind === "union" && lowerer.armTag(checked.unionId, UNDEFINED_T) >= 0))
+        return null;
+    return optional.value;
+}
+/** A presence-test operand: an absence-aware element or field read, an
+ * identifier's runtime-optional storage, or the ordinary lowering. */
+export function lowerPresenceOperand(lowerer, node) {
+    // An unassigned deferred-init field observes its undefined slot too.
+    return deferredSlotOr(lowerer, lowerAbsenceProbe(lowerer, node) ??
+        runtimeOptionalStorageOperand(lowerer, node) ??
+        lowerer.lowerExpr(node));
+}
 /** A keyed read used only to observe absence (`if (map[k])`, or the left
  * side of `||`/`??`). JavaScript answers undefined for missing record keys
  * and array indices even when noUncheckedIndexedAccess is disabled. Keep
@@ -6225,6 +6552,10 @@ export function lowerAbsenceProbe(lowerer, node) {
         expr = expr.expression;
     }
     if (ts.isPropertyAccessExpression(expr)) {
+        // Namespace members are bindings, not fields of a runtime namespace
+        // object. Their ordinary read already preserves optional storage.
+        if (!expr.questionDotToken && nsMemberIdentOf(lowerer, expr))
+            return null;
         const target = lowerer.fieldTarget(expr);
         if (target?.container === "class" &&
             target.fieldType.kind === "union" &&
@@ -6418,13 +6749,7 @@ export function lowerElementCompound(lowerer, expr, op) {
             ? lowerer.narrowedArmHelper(receiver.type.unionId, present, locOf(target.expression))
             : null;
         if (helper)
-            receiver = {
-                kind: "call",
-                callee: helper,
-                args: [receiver],
-                type: present,
-                loc: locOf(target.expression),
-            };
+            receiver = lowerer.checkedNarrowCall(helper, receiver, present, locOf(target.expression));
     }
     if (receiver.type.kind !== receiverType.kind) {
         lowerer.unsupported("SC1090", target.expression, "compound assignment through a non-native array or byte view");
@@ -6439,12 +6764,15 @@ export function lowerElementCompound(lowerer, expr, op) {
     const oldValue = receiver.type.kind === "array"
         ? arrayValueRead(lowerer, receiverRef(), indexRef(), receiver.type.elem, locOf(target))
         : {
+            // An invalid index reads undefined in Node, which every numeric
+            // compound operator turns into NaN; the write is then ignored.
             kind: "bytesIntrinsic",
             method: "get",
             receiver: receiverRef(),
             args: [indexRef()],
             type: F64,
             loc: locOf(target),
+            invalidNaN: true,
         };
     const oldLocal = lowerer.declareHiddenLocal("%compoundOld", oldValue.type);
     const oldRef = () => varRef(oldLocal.id, oldValue.type, loc);
@@ -7060,13 +7388,7 @@ export function lowerElementWrite(lowerer, expr) {
             ? lowerer.narrowedArmHelper(arr.type.unionId, present, locOf(target.expression))
             : null;
         if (helper) {
-            arr = {
-                kind: "call",
-                callee: helper,
-                args: [arr],
-                type: present,
-                loc: locOf(target.expression),
-            };
+            arr = lowerer.checkedNarrowCall(helper, arr, present, locOf(target.expression));
         }
     }
     if (arr.type.kind !== "array") {
@@ -7184,8 +7506,21 @@ export function ensureString(lowerer, e, node) {
                 narrowed.kind === "bigint")) {
             const helper = lowerer.narrowedArmHelper(e.type.unionId, narrowed, e.loc);
             if (helper) {
+                return ensureString(lowerer, lowerer.checkedNarrowCall(helper, e, narrowed, e.loc), node);
+            }
+        }
+        if (narrowed?.kind === "union" &&
+            !typeEquals(narrowed, e.type) &&
+            lowerer.unions
+                .get(narrowed.unionId)
+                ?.arms.every((arm) => isUnitType(arm) ||
+                arm.kind === "string" ||
+                arm.kind === "f64" ||
+                arm.kind === "bool" ||
+                arm.kind === "bigint")) {
+            const helper = lowerer.narrowedRetagHelper(node, e.type.unionId, narrowed.unionId, e.loc);
+            if (helper)
                 return ensureString(lowerer, { kind: "call", callee: helper, args: [e], type: narrowed, loc: e.loc }, node);
-            }
         }
         lowerer.unsupported("SC1090", node, `string conversions of unions with object arms (${NARROW_FIRST})`);
     }
@@ -7360,20 +7695,16 @@ export function lowerAsExpression(lowerer, expr) {
                 };
             }
         }
-        // Narrowed reads (`err instanceof Error` proven) still pass below;
-        // other targets keep the narrowness fence with the checked-cast fix.
-        // In a JS FILE the AsExpression is tsgo's spelling of a JSDoc cast
-        // (`/** @type {T} */ (e)` — JS has no `as`); 5.9.3 parsed that as a
-        // plain parenthesized read, which lowered caught→dyn and met the
-        // target through the ordinary checked-cast coercion — so the dyn
-        // bridge stays open here exactly for that shape.
+        // Structural assertions use the ordinary checked dynamic bridge. It
+        // retains primitive values and native class identity before validating
+        // the requested shape; an assertion does not bypass runtime checks.
         const narrowed = lowerer.mapTypeOf(lowerer.typeOf(expr.expression));
         const bridged = narrowed &&
             (narrowed.kind === "f64" ||
                 narrowed.kind === "bool" ||
                 narrowed.kind === "string" ||
                 narrowed.kind === "object" ||
-                (narrowed.kind === "dyn" && isJsSourceFile(expr.getSourceFile())));
+                narrowed.kind === "dyn");
         if (!bridged)
             lowerer.unsupported("SC1063", expr);
     }
@@ -7448,10 +7779,20 @@ export function lowerAsExpression(lowerer, expr) {
             if (target && target.kind !== "union" && !typeEquals(target, inner.type)) {
                 const helper = lowerer.narrowedArmHelper(inner.type.unionId, target, locOf(expr));
                 if (helper) {
-                    return { kind: "call", callee: helper, args: [inner], type: target, loc: locOf(expr) };
+                    return lowerer.checkedNarrowCall(helper, inner, target, locOf(expr));
                 }
             }
         }
+        // `node.parent as Sub | undefined`: a union target whose class arm is
+        // narrower than the stored class gets the same checked class view as
+        // `node.parent as Sub`; the other arms keep their identical tags.
+        if (target?.kind === "union" &&
+            (inner.type.kind === "union" || inner.type.kind === "object") &&
+            !typeEquals(target, inner.type)) {
+            const asserted = checkedClassUnionAssertion(lowerer, inner, target, locOf(expr));
+            if (asserted)
+                return asserted;
+        }
         return inner; // erasure, unchanged
     }
     if (inner.type.kind === "jsval") {
@@ -7578,7 +7919,7 @@ export function lowerPrefixUnary(lowerer, expr) {
         }
         case ts.SyntaxKind.ExclamationToken: {
             // `!x` is ToBoolean-then-negate: f64/string operands go through toBool.
-            const operand = lowerer.ensureBool(lowerer.lowerExpr(expr.operand), expr.operand);
+            const operand = lowerer.ensureBool(deferredSlotOr(lowerer, runtimeOptionalStorageOperand(lowerer, expr.operand) ?? lowerer.lowerExpr(expr.operand)), expr.operand);
             return { kind: "unary", op: "!", operand, type: BOOL, loc };
         }
         case ts.SyntaxKind.TildeToken: {
@@ -7625,11 +7966,11 @@ export function lowerIncDec(lowerer, expr, prefix) {
         }
         fenceNodeModuleMutation(lowerer, access, "assignment");
         if (ts.isPropertyAccessExpression(access)) {
-            const target = staticFieldWriteTarget(lowerer, access);
+            const target = staticFieldWriteTarget(lowerer, access) ??
+                expandoWritableTarget(lowerer, access) ??
+                nsWritableTarget(lowerer, access);
             if (target) {
-                if (target.type.kind !== "f64")
-                    lowerer.unsupported("SC1043", expr);
-                return { kind: "incDec", op, prefix, localId: target.id, type: F64, loc };
+                return lowerIncDecTarget(lowerer, expr, target, prefix);
             }
         }
         const stmts = [];
@@ -7683,7 +8024,15 @@ export function lowerIncDec(lowerer, expr, prefix) {
             const type = raw.type;
             const read = type.kind === "array"
                 ? arrayValueRead(lowerer, receiver, index, type.elem, loc)
-                : { kind: "bytesIntrinsic", method: "get", receiver, args: [index], type: F64, loc };
+                : {
+                    kind: "bytesIntrinsic",
+                    method: "get",
+                    receiver,
+                    args: [index],
+                    type: F64,
+                    loc,
+                    invalidNaN: true,
+                };
             return finish(read, (value) => type.kind === "array"
                 ? arrayValueStore(lowerer, receiver, index, lowerer.coerceInto(access, value, type.elem), type.elem, loc)
                 : {
@@ -7715,6 +8064,7 @@ export function lowerIncDec(lowerer, expr, prefix) {
             ? lowerer.fieldTarget(access)
             : symbolFieldTarget(lowerer, access);
         if (target && lowerer.dynConvertible(target.fieldType)) {
+            checkDeferredMemberReceiver(lowerer, target, access);
             target.obj = save(target.obj, "%incrementReceiver");
             return finish(lowerer.fieldGetExpr(target, loc, access), (value) => lowerer.fieldSetStmt(target, lowerer.coerceInto(access, value, target.fieldType), loc, access));
         }
@@ -7741,10 +8091,18 @@ export function lowerIncDec(lowerer, expr, prefix) {
     if (!target) {
         lowerer.rejectUnresolved(expr.operand, `increment/decrement of '${expr.operand.text}' (not a writable local or module global)`);
     }
+    return lowerIncDecTarget(lowerer, expr, target, prefix);
+}
+/** Numeric updates read the represented slot once and write the computed
+ * value back in that same representation. In particular, an unchecked
+ * indexed initializer can leave undefined in an otherwise numeric binding. */
+export function lowerIncDecTarget(lowerer, expr, target, prefix) {
+    const loc = locOf(expr);
+    const op = expr.operator === ts.SyntaxKind.PlusPlusToken ? "+" : "-";
     if (target.type.kind === "dyn") {
         const old = lowerer.declareHiddenLocal("%numericOld", DYN);
         const next = lowerer.declareHiddenLocal("%numericNext", DYN);
-        const read = lowerer.lowerExpr(expr.operand);
+        const read = varRef(target.id, target.type, loc);
         return {
             kind: "seqExpr",
             stmts: [
@@ -7776,6 +8134,42 @@ export function lowerIncDec(lowerer, expr, prefix) {
             loc,
         };
     }
+    if (target.type.kind === "union") {
+        const read = lowerOptionalNumber(lowerer, varRef(target.id, target.type, loc), loc, expr.operand);
+        if (read.type.kind === "f64") {
+            const old = lowerer.declareHiddenLocal("%numericOld", F64);
+            const next = lowerer.declareHiddenLocal("%numericNext", F64);
+            const result = varRef(prefix ? next.id : old.id, F64, loc);
+            return {
+                kind: "seqExpr",
+                stmts: [
+                    { kind: "varDecl", localId: old.id, init: read, loc },
+                    {
+                        kind: "varDecl",
+                        localId: next.id,
+                        init: {
+                            kind: "bin",
+                            op,
+                            left: varRef(old.id, F64, loc),
+                            right: numLit(1, loc),
+                            type: F64,
+                            loc,
+                        },
+                        loc,
+                    },
+                    {
+                        kind: "assign",
+                        localId: target.id,
+                        value: lowerer.coerceInto(expr.operand, varRef(next.id, F64, loc), target.type),
+                        loc,
+                    },
+                ],
+                result,
+                type: F64,
+                loc,
+            };
+        }
+    }
     if (target.type.kind !== "f64")
         lowerer.unsupported("SC1043", expr);
     return { kind: "incDec", op, prefix, localId: target.id, type: F64, loc };
@@ -8136,6 +8530,9 @@ export function lowerBinary(lowerer, expr) {
                 const recv = tryLowerExpression(lowerer, expr.left.expression);
                 if (recv && recv.type.kind === "dyn")
                     return lowerDynMemberAssignment(lowerer, expr, recv);
+                const unionWrite = lowerUnionFieldWrite(lowerer, expr.left, expr.right);
+                if (unionWrite)
+                    return unionWrite;
                 const field = lowerer.fieldTarget(expr.left);
                 if (field) {
                     const recvTmp = lowerer.declareHiddenLocal("%setReceiver", field.obj.type);
@@ -8182,7 +8579,7 @@ export function lowerBinary(lowerer, expr) {
         const nullTest = lowerLooseNullCompare(lowerer, expr, loc);
         if (nullTest)
             return nullTest;
-        const loose = lowerAbstractEquality(lowerer, lowerer.lowerExpr(expr.left), lowerer.lowerExpr(expr.right), op === ts.SyntaxKind.ExclamationEqualsToken, loc);
+        const loose = lowerAbstractEquality(lowerer, deferredSlotOr(lowerer, lowerer.lowerExpr(expr.left)), deferredSlotOr(lowerer, lowerer.lowerExpr(expr.right)), op === ts.SyntaxKind.ExclamationEqualsToken, loc);
         if (loose)
             return loose;
         lowerer.unsupported("SC1040", expr, undefined, "object-to-primitive loose equality can call user-defined valueOf/toString methods — compare explicit primitive conversions instead");
@@ -8229,12 +8626,26 @@ export function lowerBinary(lowerer, expr) {
     }
     const strictEquality = op === ts.SyntaxKind.EqualsEqualsEqualsToken ||
         op === ts.SyntaxKind.ExclamationEqualsEqualsToken;
+    // An identifier whose storage is runtime-optional is compared by its
+    // stored value: the checker's narrowing to the present arm is not a
+    // runtime proof. Identifier reads are pure, so taking the stored value
+    // after both operands lowered keeps the evaluation order. A union on
+    // the other side keeps the narrowed read (union-to-union comparison
+    // has no lowering).
     let left = strictEquality
         ? (lowerAbsenceProbe(lowerer, expr.left) ?? lowerer.lowerExpr(expr.left))
         : lowerer.lowerExpr(expr.left);
     let right = strictEquality
         ? (lowerAbsenceProbe(lowerer, expr.right) ?? lowerer.lowerExpr(expr.right))
         : lowerer.lowerExpr(expr.right);
+    if (strictEquality) {
+        const storedLeft = runtimeOptionalStorageOperand(lowerer, expr.left);
+        const storedRight = runtimeOptionalStorageOperand(lowerer, expr.right);
+        if (storedLeft !== null && right.type.kind !== "union")
+            left = storedLeft;
+        if (storedRight !== null && left.type.kind !== "union")
+            right = storedRight;
+    }
     if (strictEquality && (left.type.kind === "caught" || right.type.kind === "caught")) {
         if (left.type.kind === "caught")
             left = { kind: "caughtToDyn", value: left, type: DYN, loc: left.loc };
@@ -8721,7 +9132,7 @@ export function lowerBinary(lowerer, expr) {
             const optionalStringPlus = lowerOptionalStringPlus();
             if (optionalStringPlus)
                 return optionalStringPlus;
-            if (isJsSourceFile(expr.getSourceFile())) {
+            {
                 const primitive = (type) => type.kind === "f64" ||
                     type.kind === "string" ||
                     type.kind === "bool" ||
@@ -8827,6 +9238,13 @@ export function lowerBinary(lowerer, expr) {
             if (unitTest)
                 return unitTest;
             if (left.type.kind === "union" || right.type.kind === "union") {
+                const compared = lowerUnionEquality(lowerer, left, right, negated, false, loc);
+                if (compared)
+                    return compared;
+                const aliasRefusal = (type) => {
+                    if (tagEqualityMayMissAlias(lowerer, type))
+                        lowerer.unsupported("SC1090", expr, `comparisons of related class values beside structural union members (${NARROW_FIRST})`);
+                };
                 // JS strict equality of the ARM values, per union tag (a
                 // per-union helper): equal tags compare payloads (f64 ==, string
                 // bytes, bool ==, ref-arm POINTER identity), different tags are
@@ -8862,6 +9280,7 @@ export function lowerBinary(lowerer, expr) {
                     };
                 }
                 if ((sameUnion || !bothUnion) && lowerer.eqComparableUnion(ut.unionId)) {
+                    aliasRefusal(ut);
                     return {
                         kind: "unionEq",
                         unionId: ut.unionId,
@@ -8892,6 +9311,7 @@ export function lowerBinary(lowerer, expr) {
                                 kind: "union",
                                 unionId: lowerer.unions.intern(arms),
                             };
+                            aliasRefusal(common);
                             return {
                                 kind: "unionEq",
                                 unionId: common.unionId,
@@ -9077,7 +9497,9 @@ function lowerLogicalChain(lowerer, expr) {
             current = left;
             continue;
         }
-        result = lowerLogicalPair(lowerer, current, lowerAbsenceProbe(lowerer, left) ?? lowerer.lowerExpr(left));
+        result = lowerLogicalPair(lowerer, current, current.operatorToken.kind === ts.SyntaxKind.BarBarToken
+            ? lowerPresenceOperand(lowerer, left)
+            : (lowerAbsenceProbe(lowerer, left) ?? lowerer.lowerExpr(left)));
         break;
     }
     for (let i = parents.length - 1; i >= 0; i--) {
@@ -9732,11 +10154,12 @@ function lowerUnionTypeofTest(lowerer, expr, loc) {
     for (const [a, b] of operandPairs(expr)) {
         if (!ts.isTypeOfExpression(a))
             continue;
-        if (lowerer.mapTypeOf(lowerer.typeOf(a.expression))?.kind !== "union")
+        const stored = runtimeOptionalStorageOperand(lowerer, a.expression);
+        if (stored === null && lowerer.mapTypeOf(lowerer.typeOf(a.expression))?.kind !== "union")
             continue;
         if (!ts.isStringLiteral(b))
             continue; // bare-typeof + strEq handles pure operands
-        const value = lowerer.lowerExpr(a.expression);
+        const value = stored ?? lowerer.lowerExpr(a.expression);
         if (value.type.kind !== "union")
             continue; // defensive: an already-narrowed use
         const unionId = value.type.unionId;
@@ -10037,17 +10460,30 @@ export function caughtRead(lowerer, node, local, loc) {
     }
     if (narrowed?.kind === "object") {
         const info = lowerer.classes.get(narrowed.className);
-        if (info && lowerer.inHierarchy(info)) {
-            return { kind: "caughtNarrow", value: ref, type: narrowed, loc };
+        if (info) {
+            const value = { kind: "caughtNarrow", value: ref, type: narrowed, loc };
+            if (lowerer.inHierarchy(info))
+                return value;
+            return {
+                kind: "ternary",
+                cond: {
+                    kind: "caughtTest",
+                    value: ref,
+                    test: "instanceof",
+                    className: info.def.name,
+                    type: BOOL,
+                    loc,
+                },
+                then: value,
+                else_: lowerer.coerceInto(node, { kind: "caughtToDyn", value: ref, type: DYN, loc }, narrowed),
+                type: narrowed,
+                loc,
+            };
         }
     }
-    // An UN-narrowed use — the occurrence still types `unknown` — converts
-    // to a dyn value (`options.onError?.(error)` — the caught snapshot
-    // flowing into an unknown slot): the typed→unknown deep-copy stance
-    // extended to exception payloads. Error payloads keep their
-    // observability (instanceof Error / .message / String() — the checked-dynamic tree's
-    // error encoding); other object payloads are type-erased at runtime and
-    // convert to the "[object Object]" approximation — SEMANTICS.md 67.
+    // Unnarrowed reads cross into unknown. The caught-value dispatch pass
+    // retains known native class payloads through live identity capsules;
+    // other payload kinds use the runtime's ordinary conversion.
     if (narrowed?.kind === "dyn") {
         return { kind: "caughtToDyn", value: ref, type: DYN, loc };
     }
@@ -10113,6 +10549,38 @@ export function lowerInstanceOf(lowerer, expr, loc) {
         (lowerer.isStdlibGlobal(expr.right, "Set") || lowerer.isStdlibGlobal(expr.right, "Map"))) {
         const collection = lowerer.isStdlibGlobal(expr.right, "Map") ? "map" : "set";
         const value = lowerer.lowerExpr(expr.left);
+        if (value.type.kind === "union") {
+            const union = lowerer.unions.get(value.type.unionId);
+            if (union) {
+                const local = lowerer.declareHiddenLocal("%collectionTest", value.type);
+                const reference = varRef(local.id, value.type, loc);
+                let result = { kind: "boolLit", value: false, type: BOOL, loc };
+                union.arms.forEach((arm, tag) => {
+                    if (arm.kind !== collection)
+                        return;
+                    const test = {
+                        kind: "unionIsTag",
+                        unionId: union.id,
+                        value: reference,
+                        tag,
+                        negated: false,
+                        type: BOOL,
+                        loc,
+                    };
+                    result =
+                        result.kind === "boolLit"
+                            ? test
+                            : { kind: "logical", op: "||", left: result, right: test, type: BOOL, loc };
+                });
+                return {
+                    kind: "seqExpr",
+                    stmts: [{ kind: "varDecl", localId: local.id, init: value, loc }],
+                    result,
+                    type: BOOL,
+                    loc,
+                };
+            }
+        }
         if (value.type.kind === "dyn")
             return {
                 kind: "libCall",
@@ -10390,8 +10858,22 @@ export function lowerInstanceOf(lowerer, expr, loc) {
     const caughtLocal = lowerer.caughtLocalOf(expr.left);
     if (caughtLocal) {
         if (!lowerer.inHierarchy(target)) {
-            lowerer.unsupported("SC1090", expr, `'instanceof' on a catch binding against the standalone class '${target.def.name}' ` +
-                `(only classes in extends hierarchies carry the vtable the payload test needs)`);
+            const value = varRef(caughtLocal.id, CAUGHT, loc);
+            return {
+                kind: "ternary",
+                cond: {
+                    kind: "caughtTest",
+                    value,
+                    test: "instanceof",
+                    className: target.def.name,
+                    type: BOOL,
+                    loc,
+                },
+                then: { kind: "boolLit", value: true, type: BOOL, loc },
+                else_: classInstanceOf(lowerer, { kind: "caughtToDyn", value, type: DYN, loc }, target, loc),
+                type: BOOL,
+                loc,
+            };
         }
         return {
             kind: "caughtTest",
@@ -10689,11 +11171,10 @@ function lowerPrivateIn(lowerer, expr, priv, loc) {
  * type-directed: a declared non-optional field is a compile-time `true`,
  * a missing field (no index signature) a compile-time `false` — both
  * folds limited to side-effect-free receivers, the lowerInstanceOf rule —
- * and an OPTIONAL field (undefined-armed union) is a runtime tag test on
- * the slot: present iff the arm is not undefined. That last case is the
- * representation's honest answer — a field explicitly assigned
- * `undefined` reads as absent (`"a" in {a: undefined}` is true in JS,
- * false here; SEMANTICS.md 55). Union receivers (the `in`-narrowing
+ * and an OPTIONAL field (undefined-armed union) is a runtime presence
+ * test on the slot: an omitted or deleted property is absent, while a
+ * property explicitly holding `undefined` is present, as in JS
+ * (`"a" in {a: undefined}` is true). Union receivers (the `in`-narrowing
  * idiom over multiple shapes), index-signature keys, class instances,
  * and dyn/unknown stay fenced. Keys are literal strings — a computed key
  * over a shape would need the runtime key table. */
@@ -10737,13 +11218,42 @@ function lowerInExpression(lowerer, expr, loc) {
             }
         }
     }
+    // A RUNTIME numeric key over an ARRAY receiver (`if (i in arr)` in a
+    // loop) asks the same slot/property presence query as the literal fold
+    // above and `Object.hasOwn`. The checked-dynamic fallback below would
+    // box the receiver and materialize every element on each evaluation,
+    // which makes such loops quadratic. A Number key never names an
+    // inherited property: neither Array.prototype nor Object.prototype has
+    // index-like or numeric-string keys. JS evaluates the key before the
+    // receiver, so the key is stabilized in a hidden local first.
+    if (lowerer.mapTypeOf(lowerer.typeOf(expr.left))?.kind === "f64" &&
+        lowerer.mapTypeOf(lowerer.typeOf(expr.right))?.kind === "array") {
+        const k = lowerer.lowerExpr(expr.left);
+        const recvArr = lowerer.lowerExpr(expr.right);
+        if (k.type.kind === "f64" && recvArr.type.kind === "array") {
+            const keyLocal = lowerer.declareHiddenLocal("%inIndex", F64);
+            return {
+                kind: "seqExpr",
+                stmts: [{ kind: "varDecl", localId: keyLocal.id, init: k, loc }],
+                result: {
+                    kind: "arrayHas",
+                    arr: recvArr,
+                    index: varRef(keyLocal.id, F64, loc),
+                    type: BOOL,
+                    loc,
+                },
+                type: BOOL,
+                loc,
+            };
+        }
+    }
     const key = foldedStringKeyOf(lowerer, expr.left);
     if (key === null) {
         // A RUNTIME string key over an INDEX-SIGNATURE record receiver (the
         // `names.filter((k) => k in config)` idiom): the interned key-
         // presence helper — declared fields answer statically per name
-        // (optional slots per value: the undefined arm reads absent, stance
-        // 55), then the overflow map's live keys. Other receivers keep the
+        // (optional slots by their runtime presence), then the overflow
+        // map's live keys. Other receivers keep the
         // fence: fixed shapes want the literal folds above, and there is no
         // runtime key table to ask.
         const rIn = lowerRuntimeKeyIn(lowerer, expr, loc);
@@ -10986,24 +11496,9 @@ function lowerInExpression(lowerer, expr, loc) {
     const field = shape.fields.find((f) => f.name === key);
     if (field) {
         if (field.type.kind === "union" && lowerer.armTag(field.type.unionId, UNDEFINED_T) >= 0) {
-            // Optional slot: the key is present iff the arm is not undefined.
-            const read = {
-                kind: "recordGet",
-                obj: recv,
-                shapeId: recv.type.shapeId,
-                field: key,
-                type: field.type,
-                loc,
-            };
-            return {
-                kind: "unionIsTag",
-                unionId: field.type.unionId,
-                tag: lowerer.armTag(field.type.unionId, UNDEFINED_T),
-                negated: true,
-                value: read,
-                type: BOOL,
-                loc,
-            };
+            // Optional slot: the key is present unless the field is absent
+            // (omitted or deleted); an explicit undefined is present.
+            return lowerer.recordFieldPresent(recv, recv.type.shapeId, key, loc);
         }
         // A declared non-optional field always exists on every value of the
         // shape — statically true, but folding may only drop a
@@ -11043,9 +11538,9 @@ function lowerInExpression(lowerer, expr, loc) {
  * runtime string and r an index-signature record — an interned
  * `%rec.haskey.<n>(k, r)` walks the declared names (a string-equality
  * chain: non-optional fields and accessor slots answer true, optional
- * slots answer their per-value tag test) and then the overflow map's
- * live keys. Null when the pair is outside that shape (the caller keeps
- * its fence). */
+ * slots answer their per-value tag test) and then probes the overflow
+ * map's hashed key set. Null when the pair is outside that shape (the
+ * caller keeps its fence). */
 function lowerRuntimeKeyIn(lowerer, expr, loc) {
     if (lowerer.mapTypeOf(lowerer.typeOf(expr.left))?.kind !== "string")
         return null;
@@ -11080,62 +11575,15 @@ function lowerRuntimeKeyIn(lowerer, expr, loc) {
                 type: BOOL,
                 loc,
             };
-            const utag = !accessor && f.type.kind === "union" ? lowerer.armTag(f.type.unionId, UNDEFINED_T) : -1;
-            const answer = utag >= 0 && f.type.kind === "union"
-                ? {
-                    kind: "unionIsTag",
-                    unionId: f.type.unionId,
-                    tag: utag,
-                    negated: true,
-                    value: {
-                        kind: "recordGet",
-                        obj: r,
-                        shapeId: recvT.shapeId,
-                        field: f.name,
-                        type: f.type,
-                        loc,
-                    },
-                    type: BOOL,
-                    loc,
-                }
-                : { kind: "boolLit", value: true, type: BOOL, loc };
+            const answer = accessor
+                ? { kind: "boolLit", value: true, type: BOOL, loc }
+                : lowerer.recordFieldPresent(r, recvT.shapeId, f.name, loc);
             body.push({ kind: "if", cond: eq, then: [ret(answer)], else_: null, loc });
         }
-        const ksT = arrayOf(STRING);
-        body.push({
-            kind: "varDecl",
-            localId: "ks.0",
-            init: { kind: "recordOvfKeys", obj: r, shapeId: recvT.shapeId, type: ksT, loc },
-            loc,
-        }, countedFor(loc, {
-            kind: "arrIntrinsic",
-            method: "length",
-            receiver: varRef("ks.0", ksT, loc),
-            args: [],
-            type: F64,
-            loc,
-        }, () => [
-            {
-                kind: "if",
-                cond: {
-                    kind: "strEq",
-                    negated: false,
-                    left: k,
-                    right: {
-                        kind: "arrayGet",
-                        arr: varRef("ks.0", ksT, loc),
-                        index: varRef("i.0", F64, loc),
-                        type: STRING,
-                        loc,
-                    },
-                    type: BOOL,
-                    loc,
-                },
-                then: [ret({ kind: "boolLit", value: true, type: BOOL, loc })],
-                else_: null,
-                loc,
-            },
-        ]), ret({ kind: "boolLit", value: false, type: BOOL, loc }));
+        // Overflow keys answer through the map's hashed presence probe (a
+        // stored undefined value is still present), not a scan over a fresh
+        // key snapshot, which made `k in dict` loops quadratic.
+        body.push(ret({ kind: "recordOvfHas", obj: r, shapeId: recvT.shapeId, key: k, type: BOOL, loc }));
         lowerer.liftedFns.push({
             name: helper,
             params: [
@@ -11146,8 +11594,6 @@ function lowerRuntimeKeyIn(lowerer, expr, loc) {
             locals: [
                 { id: "k.0", name: "k", type: STRING, mutable: true },
                 { id: "r.0", name: "r", type: recT, mutable: true },
-                { id: "ks.0", name: "ks", type: ksT, mutable: false },
-                { id: "i.0", name: "i", type: F64, mutable: true },
             ],
             body,
             loc,
@@ -11835,7 +12281,7 @@ export function lowerUnionProperty(lowerer, expr) {
         return null;
     }
     if (value.type.kind !== "union") {
-        throw new InternalCompilerError("lowerer bug: union-typed receiver lowered to a non-union");
+        lowerer.unsupported("SC1090", expr, "shared property access without a represented union receiver");
     }
     const def = lowerer.unions.get(value.type.unionId);
     if (!def)
@@ -11876,13 +12322,7 @@ export function lowerUnionProperty(lowerer, expr) {
             if (receiver === null) {
                 const helper = lowerer.narrowedArmHelper(value.type.unionId, objectType, locOf(expr.expression));
                 if (helper !== null)
-                    receiver = {
-                        kind: "call",
-                        callee: helper,
-                        args: [value],
-                        type: objectType,
-                        loc: locOf(expr.expression),
-                    };
+                    receiver = lowerer.checkedNarrowCall(helper, value, objectType, locOf(expr.expression));
             }
             if (receiver !== null) {
                 return {
@@ -12094,13 +12534,7 @@ function classFieldTarget(lowerer, receiverNode, receiverType, fieldName, saved)
         if (obj.type.kind === "union") {
             const helper = lowerer.narrowedArmHelper(obj.type.unionId, receiverType, locOf(receiverNode));
             obj = helper
-                ? {
-                    kind: "call",
-                    callee: helper,
-                    args: [obj],
-                    type: receiverType,
-                    loc: locOf(receiverNode),
-                }
+                ? lowerer.checkedNarrowCall(helper, obj, receiverType, locOf(receiverNode))
                 : lowerer.maybeNarrow(obj, receiverNode);
         }
         return lowerer.coerceInto(receiverNode, obj, receiverType);
@@ -12212,11 +12646,32 @@ export function fieldTarget(lowerer, access) {
     const stored = ts.isIdentifier(access.expression)
         ? (lowerer.peekLocal(access.expression)?.type ?? lowerer.globalOf(access.expression)?.type)
         : undefined;
-    const receiverIr = stored?.kind === "record" || stored?.kind === "object"
+    const narrowed = lowerer.mapTypeOf(lowerer.typeOf(access.expression));
+    // Structural record views retain their storage layout, while a nominal
+    // subclass guard proves a more specific layout of the same object.
+    const receiverIr = stored?.kind === "record"
         ? stored
-        : lowerer.mapTypeOf(lowerer.typeOf(access.expression));
+        : stored?.kind === "object" &&
+            !(narrowed?.kind === "object" &&
+                lowerer.isSubclassOf(narrowed.className, stored.className))
+            ? stored
+            : narrowed;
     if (receiverIr?.kind === "object") {
-        return classFieldTarget(lowerer, access.expression, receiverIr, access.name.text);
+        const target = classFieldTarget(lowerer, access.expression, receiverIr, access.name.text);
+        if (target)
+            return target;
+        // Abstract properties declare no base storage. Resolve the concrete
+        // instance's live field or accessor through the existing class bridge;
+        // inventing a shared field offset would misread subclass layouts.
+        if (abstractPropertyDeclOf(lowerer, access)) {
+            return {
+                container: "dynamic",
+                obj: lowerer.coerceInto(access.expression, lowerer.lowerExpr(access.expression), DYN),
+                field: access.name.text,
+                fieldType: lowerer.irTypeOf(access),
+            };
+        }
+        return null;
     }
     if (receiverIr?.kind === "union" && hasClassPayload(lowerer, receiverIr)) {
         return representedClassFieldTarget(lowerer, access.expression, access.name.text, lowerer.lowerExpr(access.expression));
@@ -12243,13 +12698,7 @@ export function fieldTarget(lowerer, access) {
                     ? lowerer.narrowedArmHelper(obj.type.unionId, present, locOf(access.expression))
                     : null;
                 obj = helper
-                    ? {
-                        kind: "call",
-                        callee: helper,
-                        args: [obj],
-                        type: present,
-                        loc: locOf(access.expression),
-                    }
+                    ? lowerer.checkedNarrowCall(helper, obj, present, locOf(access.expression))
                     : lowerer.maybeNarrow(obj, access.expression);
             }
             if (obj.type.kind !== "record")
@@ -12456,14 +12905,24 @@ function symbolFieldTarget(lowerer, expr) {
  * tsc-clean (the property types as the setter's param), but Node yields
  * undefined, which these property types cannot represent. */
 export function fieldGetExpr(lowerer, target, loc, blame) {
+    // A member read through an unassigned deferred-init field throws Node's
+    // member-read TypeError instead of the generic checked extraction.
+    if (target.container === "class" &&
+        ts.isPropertyAccessExpression(blame) &&
+        target.obj.type.kind === "object" &&
+        lowerer.deferredFieldSlot(target.obj) !== null) {
+        const checked = lowerer.runtimeOptionalPropertyReceiver(blame.expression, target.obj, target.obj.type, target.field);
+        if (checked)
+            target = { ...target, obj: checked };
+    }
     if (target.container === "dynamic")
-        return {
+        return lowerer.coerceInto(blame, {
             kind: "dynKeyGet",
             value: target.obj,
             key: { kind: "strLit", value: target.field, type: STRING, loc },
             type: DYN,
             loc,
-        };
+        }, target.fieldType);
     if (target.container === "class" &&
         (target.field === "message" || target.field === "name") &&
         (target.className === "%Error" || lowerer.isSubclassOf(target.className, "%Error")))
@@ -12579,6 +13038,34 @@ export function fieldGetExpr(lowerer, target, loc, blame) {
         if (lowerer.classes.get(target.className)?.deferredInitFields?.has(target.field) === true &&
             target.fieldType.kind === "union") {
             const inner = lowerer.stripUndefinedArm(target.fieldType);
+            // Reference arms over a stable receiver check inline: the present
+            // arm is a plain projection of the slot, so ordinary reads keep their
+            // borrowed form and only an unassigned slot reaches the throw.
+            const unionId = target.fieldType.unionId;
+            const presentTag = lowerer.armTag(unionId, inner);
+            const undefTag = lowerer.armTag(unionId, UNDEFINED_T);
+            if (inner.kind === "object" &&
+                presentTag >= 0 &&
+                undefTag >= 0 &&
+                lowerer.unions.get(unionId)?.arms.length === 2 &&
+                isSafeToRepeat(read)) {
+                return {
+                    kind: "ternary",
+                    cond: {
+                        kind: "unionIsTag",
+                        unionId,
+                        tag: undefTag,
+                        negated: false,
+                        value: read,
+                        type: BOOL,
+                        loc,
+                    },
+                    then: nodeThrowExpr(1, "", DEFERRED_READ_MESSAGE, inner, loc),
+                    else_: { kind: "unionNarrow", unionId, tag: presentTag, value: read, type: inner, loc },
+                    type: inner,
+                    loc,
+                };
+            }
             const helper = lowerer.deferredReadHelper(target.fieldType.unionId, inner, loc);
             if (helper)
                 return { kind: "call", callee: helper, args: [read], type: inner, loc };
@@ -12598,6 +13085,75 @@ export function fieldGetExpr(lowerer, target, loc, blame) {
  * call). A write to a getter-only property never gets here in a clean
  * program (tsc's TS2540 is the fence); the rejection is the backstop. */
 export function fieldSetStmt(lowerer, target, value, loc, blame) {
+    // A member write through an unassigned deferred-init field: the value
+    // still evaluates first, then the write throws Node's TypeError.
+    const deferredSlot = target.container === "class" &&
+        !((target.field === "message" || target.field === "name") &&
+            (target.className === "%Error" || lowerer.isSubclassOf(target.className, "%Error")))
+        ? lowerer.deferredFieldSlot(target.obj)
+        : null;
+    if (target.container === "class" && deferredSlot?.type.kind === "union") {
+        const unionId = deferredSlot.type.unionId;
+        const undefTag = lowerer.armTag(unionId, UNDEFINED_T);
+        const presentTag = lowerer.armTag(unionId, target.obj.type);
+        if (undefTag >= 0 && presentTag >= 0) {
+            // A value that cannot write anything leaves the field unchanged, so
+            // the field is read after it (no snapshot of the slot).
+            const late = isSafeToRepeat(deferredSlot) && writeFree(value);
+            const receiver = late
+                ? null
+                : lowerer.declareHiddenLocal("%deferredWriteObject", deferredSlot.type);
+            const stored = lowerer.declareHiddenLocal("%deferredWriteValue", value.type);
+            const receiverRef = receiver ? varRef(receiver.id, receiver.type, loc) : deferredSlot;
+            const result = varRef(stored.id, stored.type, loc);
+            const write = {
+                kind: "fieldSet",
+                obj: {
+                    kind: "unionNarrow",
+                    unionId,
+                    tag: presentTag,
+                    value: receiverRef,
+                    type: target.obj.type,
+                    loc,
+                },
+                className: target.className,
+                field: target.field,
+                value: result,
+                loc,
+            };
+            return {
+                kind: "exprStmt",
+                expr: {
+                    kind: "seqExpr",
+                    stmts: [
+                        ...(receiver
+                            ? [{ kind: "varDecl", localId: receiver.id, init: deferredSlot, loc }]
+                            : []),
+                        { kind: "varDecl", localId: stored.id, init: value, loc },
+                    ],
+                    result: {
+                        kind: "ternary",
+                        cond: {
+                            kind: "unionIsTag",
+                            unionId,
+                            tag: undefTag,
+                            value: receiverRef,
+                            negated: false,
+                            type: BOOL,
+                            loc,
+                        },
+                        then: nodeThrowExpr(1, "", `Cannot set properties of undefined (setting '${target.field}')`, result.type, loc),
+                        else_: { kind: "seqExpr", stmts: [write], result, type: result.type, loc },
+                        type: result.type,
+                        loc,
+                    },
+                    type: result.type,
+                    loc,
+                },
+                loc,
+            };
+        }
+    }
     if (target.container === "dynamic")
         return {
             kind: "exprStmt",
@@ -12915,6 +13471,7 @@ function lowerFieldCompoundValue(lowerer, access, op, rhsNode, loc) {
     const target = targetOf();
     if (!target)
         lowerer.unsupported("SC1090", access, "compound assignment to unsupported field targets");
+    checkDeferredMemberReceiver(lowerer, target, access);
     target.obj = save(target.obj, "%compoundReceiver");
     // Accessors observe getter, RHS side effects, then setter, all through
     // the saved receiver.