@scriptc/compiler 0.2.7 → 0.2.9

package/dist/backend/llvm/emitter.js

@@ -1,5 +1,5 @@
 import { emitLlvmLayouts } from "./layouts.js";
-import { inlineAllocSupported } from "./alloc.js";
+import { FIRST_EMITTED_CYC_KIND, inlineAllocSupported } from "./alloc.js";
 import { llvmBytes as llBytes } from "../literals.js";
 import { InternalCompilerError } from "../../errors.js";
 /** Lower typed IR to LLVM, using the runtime's C ABI.
@@ -19,9 +19,11 @@ import { InternalCompilerError } from "../../errors.js";
  * Dynamic values and islands share the runtime ABI; embedded npm modules use
  * compressed source tables that the runtime inflates on demand.
  */
+import { createHash } from "node:crypto";
 import { deflateRawSync } from "node:zlib";
 import { endsWithJump, matchStringSelfConcat, streamTypedRefEligible, undefinedArmTag, } from "../../ir/analysis.js";
 import { emitLibraryIdentityLines } from "../library-identity-markers.js";
+import { loopTestsEveryIteration } from "../loop-polls.js";
 import { CAUGHT, ffiCallbackType, isDynTypedRefType, isFfiContextParam, isRefCounted, isUnitType, POINTER_KINDS, RUNTIME_EMITTER_CLASS, RUNTIME_ERROR_CLASSES, RUNTIME_STREAM_CLASSES, typeEquals, typeKey, STRING, VOID, } from "../../ir/ir.js";
 import { moduleRuntimeFeatures, moduleEmbedsBuiltin, moduleEmbedsCompressedNpm, NPM_COMPRESS_MIN, } from "../../ir/runtime-features.js";
 import { matchIntegerArrayForLoop, matchIntegerBytesForLoop, matchIntegerCountedForLoop, } from "../../ir/integer-loops.js";
@@ -32,8 +34,11 @@ import { emitByteWindowGuard, findInitializedByteLoopBindings, matchByteWindow,
 import { canDeferSplitPiece, emitSplitSpanNext, materializeSplitPiece, emitSplitCursor, emitSplitNext, emitSplitScratch, emitSplitSnapshot, findPrivateSplitLocals, loadSplitSnapshot, storeSplitSnapshot, stringSplit, } from "./split-loops.js";
 import { scalarizeNumericRecords } from "../../ir/scalar-records.js";
 import { specializeNumericCalls } from "../../ir/numeric-call-specialization.js";
-import { everyStmtList } from "../../ir/traverse.js";
-import { analyzeIntegerRanges } from "../../ir/integer-ranges.js";
+import { everyExprChild, everyStmtChild, everyStmtList } from "../../ir/traverse.js";
+import { analyzeIntegerRanges, INT32_RANGE } from "../../ir/integer-ranges.js";
+import { analyzeInt32Slots } from "../../ir/int32-slots.js";
+import { analyzeFinalFields, constructorClass } from "../../ir/final-fields.js";
+import { foldConstantGlobals } from "../../ir/constant-globals.js";
 import { findIntegerViews } from "./integer-views.js";
 import { findInitializerBindings, withInitializerBindings } from "../../ir/initializer-bindings.js";
 import { findConstantNumericTables } from "../../ir/constant-tables.js";
@@ -47,10 +52,13 @@ import { allocateLocalUnion, findLocalUnionStorage, storeLocalUnion, } from "./l
 import { BlockBuilder } from "./blocks.js";
 import { NullableRefFields } from "./nullable-fields.js";
 import { emitLocalArrayRead, emitProjectedArrayRead, emitBorrowedArrayRead, findLocalArrayReads, findCallArrayReads, OptionalArrayReads, } from "./local-array-reads.js";
+import { CheckedNarrows, emitCheckedNarrowReceiver } from "./checked-narrows.js";
 import { emitDenseArrayGet, emitDenseArraySet } from "./dense-array-access.js";
 import { emitStackMapRead, findMapReadLifetimes, matchMapRead, } from "./map-read-lifetimes.js";
-import { emitBorrowedFieldSequence } from "./borrowed-receivers.js";
+import { emitBorrowedFieldSequence, guardedValue } from "./borrowed-receivers.js";
 import { emitBorrowedInput } from "./borrowed-inputs.js";
+import { analyzeWalks, findWalkBorrows } from "./walk-borrows.js";
+import { findReboundParameters } from "./rebound-parameters.js";
 import { ReferenceEffects } from "./reference-effects.js";
 import { LlvmDebugInfo } from "./debug-info.js";
 import { StackCallbacks } from "./stack-callbacks.js";
@@ -59,18 +67,20 @@ import { AmbientReceiverReaders, findConstantCallbacks } from "./constant-callba
 import { findScalarStringSlices, emitStringSliceSnapshot, } from "./string-slices.js";
 import { LazyCaptures } from "./lazy-captures.js";
 import { StackCaptures } from "./stack-captures.js";
-import { ABSENT_FIELD_PAYLOAD, emitFieldAbsentTest, f64Lit, ffiNativeTypeLl, ffiNativeParamLl, ffiNativeReturnLl, llvmCommentText, } from "./common.js";
+import { ABSENT_FIELD_PAYLOAD, emitFieldAbsentTest, exactIndexLines, f64Lit, ffiNativeTypeLl, ffiNativeParamLl, ffiNativeReturnLl, llvmCommentText, } from "./common.js";
 import { ffiExtendsNarrowIntegers } from "../targets.js";
 import { emitLiteralExpr, emitOperatorExpr, emitStringExpr, emitContainerExpr, emitRecordExpr, } from "./expr-primitives.js";
 import { emitControlExpr } from "./expr-control.js";
-import { emitCallExpr } from "./expr-calls.js";
+import { emitBorrowedResultCall, emitCallExpr } from "./expr-calls.js";
 import { emitDynamicExpr } from "./expr-dynamic.js";
 import { emitIntrinsicExpr, emitSerializationExpr, emitAsyncExpr } from "./expr-async.js";
+import { PublishWalkers } from "./publish.js";
+import { computePublishedTypes } from "../publication.js";
 import { emitJsInteropExpr, emitExpr } from "./expr-dispatch.js";
 import { emitJsMarshal, emitJsOp, emitJsExit, islandAdapter, islandTypedAdapter, } from "./expr-island.js";
 import { dynKind, raceAdapterFor, genResultThunkFor, childExitThunkFor, childExitSignalThunkFor, childDataThunkFor, execFileThunkFor, ipcMessageThunkFor, ipcSendThunkFor, emitterFixedAdapter, wrapEmitterListener, unwrapNullableClosure, closeBindThunkFor, closeOverrideWrapFor, } from "./expr-callbacks.js";
 import { streamDataAdapter, streamDoneFnFor, cryptoBytesThunkFor, fsRenameThunkFor, streamCbThunkFor, zlibBytesThunkFor, } from "./expr-stream-callbacks.js";
-import { emitStableReceiver, resolveThunkFor, tagInSet, arrPush, emitArrayCopyLoop, emitStrIntrinsic, emitArrIntrinsic, wrapNullable, emitMapNew, mapSet, emitMapLikeIntrinsic, emitSetNew, } from "./expr-containers.js";
+import { emitStableReceiver, resolveThunkFor, tagInSet, arrPush, emitArrayCopyLoop, emitStrIntrinsic, emitArrIntrinsic, emitDiscardedSplice, wrapNullable, emitMapNew, mapSet, emitMapLikeIntrinsic, emitSetNew, } from "./expr-containers.js";
 import { emitIntegerLoopIndex, emitBytesIndex, emitBytesData, emitBytesLength, emitBytesGet, emitToUint32, emitBytesSet, emitBytesIntrinsic, } from "./expr-bytes.js";
 import { emitRegexIntrinsic, emitRecordKeyGet, keyedRecordReadInto } from "./expr-records.js";
 import { dynPromiseAdapter, streamTypedRefCommitAdapter, liveDynUnionRefAdapter, streamTypedRefBoxValue, streamTypedRefMaterializeAdapter, streamFromArrayAdapter, } from "./expr-stream-bridges.js";
@@ -81,10 +91,16 @@ import { emitNetworkHttpLibCall } from "./lib-network.js";
 import { emitAssertInspectLibCall, emitIoLibCall, emitGenericLibCall, emitLibCall, } from "./lib-dispatch.js";
 import { buildClassGraph, classMembershipIntervals, emitClassMembershipHelper, classEnvironmentIndex, classFieldIndex, classStructSym, } from "./classes.js";
 import { LlDyn } from "./dyn.js";
+import { VirtualBorrows } from "./virtual-borrows.js";
 import { LlvmUnsupportedError } from "./unsupported.js";
 import { LlWalkers } from "./walkers.js";
-import { literalCapWord } from "./string-key-hash.js";
-import { arrNewCall, boxAccess, boxNewCall, boxReleaseSym, computeTraced, elemAccess, emitInlineRcHelpers, FN_ATTRS, inlineRcDecls, llFieldType, releaseSym, retainSym, traceArg, typedRefConstructor, vAdapters, } from "./shapes.js";
+import { isObjectArm, NULLABLE_ABSENT, NULLABLE_NULL, NullableUnions } from "./nullable-unions.js";
+import { emitNullablePresent, emitUnionPeek, emitUnionTag } from "./union-repr.js";
+import { literalCapWord, literalCapWord32 } from "./string-key-hash.js";
+import { NUMBER_MAP_ENTRY_DECL } from "./map-number-lookup.js";
+import { STRING_READ_HELPERS } from "./string-reads.js";
+import { emitConcatInputs, emitMixedConcat, numberPart, stringParts, } from "./string-construction.js";
+import { arrNewCall, boxAccess, boxNewCall, boxReleaseSym, computeTraced, elemAccess, emitInlineRcHelpers, emitNullableRetainWrappers, FN_ATTRS, inlineRcDecls, llFieldType, releaseSym, retainSym, traceArg, typedRefConstructor, vAdapters, } from "./shapes.js";
 export { LlvmUnsupportedError } from "./unsupported.js";
 function ffiCallbackDummyLl(callback) {
     switch (callback.returns) {
@@ -114,13 +130,13 @@ function ffiCallbackDummyLl(callback) {
 export function emitLlvmModule(mod, options = {}) {
     // Keep source storage intact for debugger inspection in dev builds.
     return new LlEmitter(options.debugSources === undefined
-        ? scalarizeNumericRecords(specializeNumericCalls(mod, mangleFunction))
+        ? scalarizeNumericRecords(specializeNumericCalls(foldConstantGlobals(mod), mangleFunction))
         : mod, options).emit();
 }
 /** Keep large translation units below the host's single-string limit. */
 export function emitLlvmModuleSource(mod, options = {}) {
     const parts = new LlEmitter(options.debugSources === undefined
-        ? scalarizeNumericRecords(specializeNumericCalls(mod, mangleFunction))
+        ? scalarizeNumericRecords(specializeNumericCalls(foldConstantGlobals(mod), mangleFunction))
         : mod, options).emitParts();
     const length = parts.reduce((total, part) => total + part.length, Math.max(0, parts.length - 1));
     if (length <= 256 * 1024 * 1024)
@@ -130,6 +146,41 @@ export function emitLlvmModuleSource(mod, options = {}) {
 function llStrBytes(text) {
     return llBytes(Buffer.from(text, "utf8"));
 }
+const NO_BORROWED = new Set();
+/** Whether any node of `e` names the local (reads, writes, declarations,
+ * captures). */
+function mentionsLocal(e, localId) {
+    const exprNames = (node) => {
+        if (node.kind === "varRef" || node.kind === "incDec" || node.kind === "assignExpr")
+            return node.localId === localId;
+        if (node.kind === "closure")
+            return node.captures.includes(localId);
+        if (node.kind === "classRef")
+            return node.captures?.includes(localId) === true;
+        return false;
+    };
+    const stmtNames = (node) => {
+        if (node.kind === "varDecl" ||
+            node.kind === "assign" ||
+            node.kind === "forOf" ||
+            node.kind === "rethrow")
+            return node.localId === localId;
+        return false;
+    };
+    let found = false;
+    const expr = (node) => {
+        if (found || exprNames(node))
+            return !(found = true);
+        return everyExprChild(node, expr, stmt);
+    };
+    const stmt = (node) => {
+        if (found || stmtNames(node))
+            return !(found = true);
+        return everyStmtChild(node, expr, stmt);
+    };
+    expr(e);
+    return found;
+}
 export class LlEmitter {
     mod;
     localArrayReads = new Map();
@@ -176,19 +227,40 @@ export class LlEmitter {
     debugScope = null;
     sizeType;
     ffiExtendNarrowIntegers;
-    cycleColorOffset;
+    cycleBufferedOffset;
+    /** Emitted ScrCycType descriptors so far (their collector statistics
+     * indices; see ShapeHost.nextCycKind). */
+    cycKinds = 0;
     wasi;
+    /** The target lacks a rounding instruction at its baseline CPU (x86-64
+     * before SSE4.1), so `llvm.trunc` would lower to a libm call: emit
+     * truncation inline through an integer round trip instead. */
+    inlineTrunc;
+    /** ELF worker executables give thread-locals the executable TLS models. */
+    executableTls;
+    /** Source loops enclosing the statement being emitted in the current
+     * function body. */
+    loopDepth = 0;
+    /** Darwin worker executables read the stack guard from a pthread
+     * thread-specific-data slot off the thread pointer (scr_runtime.h's
+     * SCR_STACK_GUARD_TSD): the architecture names the access sequence. */
+    stackGuardTsd;
     emitLibraryIdentity;
     runtimeAbiMarker;
+    detachedExit;
     /** Interned string literals: UTF-8 text → { symbol, byte length } —
      * first-use order, the runtime ABI’s determinism discipline. */
     literals = new Map();
+    /** Symbols of interned constant data, named by content (contentSymbol). */
+    contentSymbols = new Set();
     /** Interned unit-armed union instances: "unionId:tag" → symbol — one
      * immortal (rc == SIZE_MAX) static per (union, unit tag).
      * RC entry points and the collector skip immortals. */
     unitInstances = new Map();
     /** unionId → symbol of the union's immortal ABSENT field-slot instance. */
     absentInstances = new Map();
+    /** The nullable-union ABSENT sentinel was referenced (absentInstanceRef). */
+    needsNullableAbsent = false;
     immortalValues = new Set();
     /** Regex literal templates: "<flags>/<pattern>" → { symbol, interned
      * source/flags literal refs } — one immortal ScrRegex template per distinct
@@ -231,6 +303,7 @@ export class LlEmitter {
     fnDefText = new Map();
     referenceEffects;
     optionalArrayReads;
+    checkedNarrows;
     callArrayReads = new Map();
     mapReadLifetimes = { locals: new Map(), arguments: new Map() };
     callLifetimes;
@@ -248,6 +321,18 @@ export class LlEmitter {
     /** Parameters proven projection-only: callers may pass stack boxes. */
     projectedParameters = new Set();
     stableCallBindings = new Set();
+    /** Locals and rebound parameters holding borrowed pointers for their
+     * whole lifetime (walk-borrows.ts), per function and for the current one. */
+    walkBorrowsByFunction = new Map();
+    walkBorrows = new Set();
+    /** Functions whose borrowing body returns its result without a reference
+     * (analyzeBorrowedReturns), and whether the current body is one. */
+    borrowedReturns = new Set();
+    /** Rebound parameters that keep the borrowed convention with an owner
+     * slot (rebound-parameters.ts), per function, and the current owner slots. */
+    reboundByFunction = new Map();
+    reboundOwnerSlots = new Map();
+    currentBorrowedReturn = false;
     /** Manifest-bound native imports, used by ffiCall emission. */
     ffiByName = new Map();
     /** C-ABI callback trampolines and (for raw/no-userdata callbacks) their
@@ -266,6 +351,15 @@ export class LlEmitter {
      * checks are emitted only after calls that can actually raise. */
     mayThrow;
     indirectMayThrow;
+    /** Worker programs: the functions that poll for termination on entry
+     * (workerTerminationPolls); null outside worker programs. */
+    workerEntryPolls;
+    /** Functions that check the native stack guard on entry
+     * (stackCheckedFunctions); null where the runtime has no guard. */
+    stackChecks;
+    /** Static types whose values can be published (@scriptc/threads): their
+     * stores carry the frozen-object guard. Null without publish calls. */
+    publishedTypes;
     /** Method names with at least one may-throw implementation — the
      * virtualCall pending check's key. */
     mayThrowMethods = new Set();
@@ -287,6 +381,10 @@ export class LlEmitter {
     dynPromiseAdapters = new Map();
     unionsById = new Map();
     nullableFields;
+    /** Unions whose values are nullable arm pointers (nullable-unions.ts). */
+    nullableUnions;
+    /** The union table without nullable unions: the stack-box analyses. */
+    boxedUnionsById;
     recordsById = new Map();
     recordCloneShapes = new Set();
     tracedShapes;
@@ -294,6 +392,8 @@ export class LlEmitter {
     /** The class graph (buildClassGraph): preorder numbering, hierarchy
      * membership, virtual slot lists. */
     classMeta;
+    /** Which vtable slots borrow which parameters (virtual-borrows.ts). */
+    virtualBorrows;
     /** Class objects (classes as first-class values): className → the
      * interned .name literal ref — registered during body emission, the
      * statics and construct thunks assemble around the bodies. */
@@ -334,11 +434,18 @@ export class LlEmitter {
     storedSplits = new Map();
     streamingSplitsEnabled = false;
     initializerBindings;
+    /** Whole-program int32 storage and parameter/result facts. */
+    int32Slots;
     numericLocals = new Map();
     captureIds = new Set();
     /** Active induction bindings retain their width independently of size_t. */
     integerLoopBindings = new Map();
     countedLoopsEnabled = false;
+    /** Whole-program final reference fields (ir/final-fields.ts). */
+    finalFields;
+    /** The current function may borrow final fields of borrowable objects:
+     * not a constructor (where they change), not async or a generator. */
+    finalFieldBorrows = false;
     integerRanges = new Map();
     byteWindowsEnabled = true;
     byteWindowEntries = new Map();
@@ -380,23 +487,49 @@ export class LlEmitter {
             stmt: () => true,
             expr: (expr) => !(expr.kind === "libCall" && expr.fn === "error.stack"),
         }));
+        this.nullableUnions = new NullableUnions(mod);
         this.debug =
             options.debugSources === undefined
                 ? null
-                : new LlvmDebugInfo(mod.sourceFile, options.debugSources, options.pointerBits, mod.unions);
+                : new LlvmDebugInfo(mod.sourceFile, options.debugSources, options.pointerBits, mod.unions, this.nullableUnions.armTypes());
         this.constantNumericTables = findConstantNumericTables(mod);
         this.initializerBindings = findInitializerBindings(mod);
+        this.int32Slots = analyzeInt32Slots(mod);
+        this.finalFields = analyzeFinalFields(mod);
         this.sizeType = options.pointerBits === 32 ? "i32" : "i64";
         this.ffiExtendNarrowIntegers =
             options.wasi === true || ffiExtendsNarrowIntegers(options.targetTriple);
         this.wasi = options.wasi === true;
+        // An empty triple targets the host, as for executableTls below: the
+        // Node-hosted CLI passes none, the native CLI passes its toolchain's, and
+        // both must emit the same module for the same target.
+        this.inlineTrunc =
+            !this.wasi &&
+                (options.targetTriple
+                    ? /^(x86_64|amd64)\b/i.test(options.targetTriple)
+                    : process.arch === "x64");
+        this.executableTls =
+            mod.workers === true &&
+                mod.lib === undefined &&
+                !this.wasi &&
+                !/apple|darwin|windows|mingw|cygwin|win32/.test(options.targetTriple || process.platform);
+        const host = options.targetTriple || `${process.arch}-${process.platform}`;
+        this.stackGuardTsd =
+            mod.workers === true && mod.lib === undefined && !this.wasi && /apple|darwin/.test(host)
+                ? /^(arm64|aarch64)/.test(host)
+                    ? "aarch64"
+                    : /^(x86_64|amd64|x64)/.test(host)
+                        ? "x86_64"
+                        : null
+                : null;
         this.emitLibraryIdentity = options.emitLibraryIdentity !== false;
         this.runtimeAbiMarker = options.runtimeAbiMarker === true;
+        this.detachedExit = options.detachedExit === true;
         this.rcHelpers = options.inlineRc === true ? new Set() : null;
-        // ScrCycHdr.color stays 12 bytes behind a wasm32 object and 16 bytes
-        // behind a 64-bit object. The wasm32 header pads before color so its
-        // payload remains double-aligned without changing this ABI offset.
-        this.cycleColorOffset = options.pointerBits === 32 ? 12 : 16;
+        // ScrCycHdr.buffered sits 6 bytes behind every object. The wasm32
+        // header pads before its descriptor so its payload remains
+        // double-aligned without changing this ABI offset.
+        this.cycleBufferedOffset = 6;
         this.ffiCallbackAdapters = allocateFfiCallbackAdapters(mod.ffiImports ?? []);
         this.ffiHasRetainedCallback = hasRetainedFfiCallback(mod.ffiImports ?? []);
         this.ffiHasForeignCallback = hasForeignFfiCallback(mod.ffiImports ?? []);
@@ -405,11 +538,17 @@ export class LlEmitter {
         for (const entry of mod.ffiImports ?? []) {
             this.ffiByName.set(entry.name, entry);
         }
-        const mt = computeMayThrow(mod);
+        // Executables on Linux and macOS install a native stack guard per thread
+        // and per async fiber; WASI, Windows and library builds have none.
+        const triple = (options.targetTriple ?? "").toLowerCase();
+        const windows = triple === "" ? process.platform === "win32" : triple.includes("windows");
+        const mt = computeMayThrow(mod, {
+            stackChecks: !this.wasi && mod.lib === undefined && !windows,
+        });
         this.mayThrow = mt.fns;
-        if (mod.workers)
-            for (const fn of mod.functions)
-                this.mayThrow.add(fn.name);
+        this.workerEntryPolls = mt.workerEntryPolls ?? null;
+        this.stackChecks = mt.stackChecks ?? null;
+        this.publishedTypes = computePublishedTypes(mod);
         this.indirectMayThrow = mt.indirect || mod.workers === true;
         for (const cls of mod.classes ?? []) {
             for (const m of cls.methods ?? []) {
@@ -419,10 +558,57 @@ export class LlEmitter {
         }
         for (const u of mod.unions ?? [])
             this.unionsById.set(u.id, u);
-        this.nullableFields = new NullableRefFields(mod.classes ?? [], this.unionsById);
-        this.optionalArrayReads = new OptionalArrayReads(this.fnByName, this.unionsById);
-        this.referenceEffects = new ReferenceEffects(this.fnByName, (call) => this.optionalArrayReads.get(call) !== null);
-        this.callLifetimes = analyzeCallLifetimes(this.fnByName, (className, field) => this.nullableFields.get(className, field) !== null);
+        this.boxedUnionsById = this.nullableUnions.boxedUnions(this.unionsById);
+        this.immortalValues.add("null");
+        this.immortalValues.add(NULLABLE_NULL);
+        this.nullableFields = new NullableRefFields(mod.classes ?? [], this.boxedUnionsById);
+        // Optional array reads also cover nullable unions: emitLocalArrayRead
+        // then yields the (borrowed or owned) element pointer, not a stack box.
+        // Arrays of such a union are read the same way.
+        this.optionalArrayReads = new OptionalArrayReads(this.fnByName, this.unionsById, (id) => this.nullableUnions.has(id));
+        this.checkedNarrows = new CheckedNarrows(this.fnByName);
+        this.referenceEffects = new ReferenceEffects(this.fnByName, (call) => this.optionalArrayReads.get(call) !== null, mod.classes ?? []);
+        const walkParameters = new Map();
+        if (this.debug === null) {
+            const host = {
+                pointerLocal: (local) => this.plainReference(local.type),
+                borrowsWithoutOwning: (e) => this.borrowsWithoutOwning(e),
+            };
+            for (const fn of this.fnByName.values()) {
+                if (!this.referenceEffects.functions.has(fn.name))
+                    continue;
+                const walks = findWalkBorrows(fn, host);
+                if (walks.size === 0)
+                    continue;
+                this.walkBorrowsByFunction.set(fn.name, walks);
+                const indexes = new Set();
+                fn.params.forEach((param, index) => {
+                    if (walks.has(param.localId))
+                        indexes.add(index);
+                });
+                if (indexes.size > 0)
+                    walkParameters.set(fn.name, indexes);
+            }
+        }
+        if (this.debug === null) {
+            for (const fn of this.fnByName.values()) {
+                // Strings keep the owned parameter: their in-place append
+                // (`s = s + x`) needs a uniquely owned binding.
+                const rebound = findReboundParameters(fn, (type) => this.plainReference(type) &&
+                    type.kind !== "string" &&
+                    (type.kind !== "union" || this.nullableUnions.get(type.unionId)?.arm.kind !== "string"), this.walkBorrowsByFunction.get(fn.name) ?? new Set());
+                if (rebound.size === 0)
+                    continue;
+                this.reboundByFunction.set(fn.name, rebound);
+                const indexes = walkParameters.get(fn.name) ?? new Set();
+                fn.params.forEach((param, index) => {
+                    if (rebound.has(param.localId))
+                        indexes.add(index);
+                });
+                walkParameters.set(fn.name, indexes);
+            }
+        }
+        this.callLifetimes = analyzeCallLifetimes(this.fnByName, (className, field) => this.nullableFields.get(className, field) !== null, walkParameters);
         this.constantCallbacks = findConstantCallbacks(mod, this.callLifetimes);
         this.stackCallbacks = new StackCallbacks(this.fnByName);
         this.receiverReaders = new AmbientReceiverReaders(this.fnByName);
@@ -435,9 +621,10 @@ export class LlEmitter {
         this.tracedUnions = traced.unions;
         this.shapeHost = {
             sizeType: this.sizeType,
-            cycleColorOffset: this.cycleColorOffset,
+            cycleBufferedOffset: this.cycleBufferedOffset,
             tracedShapes: this.tracedShapes,
             tracedUnions: this.tracedUnions,
+            nullableUnions: this.nullableUnions,
             recordsById: this.recordsById,
             recordCloneShapes: this.recordCloneShapes,
             objectAudit: options.objectAudit !== false,
@@ -445,12 +632,13 @@ export class LlEmitter {
                 pointerBits: options.pointerBits,
                 wasi: options.wasi,
                 targetTriple: options.targetTriple,
-                // Worker programs (SCR_WORKERS) make scr_cyc_live and
-                // scr_weak_dispose_hook thread-local and compile the allocator out,
-                // exactly like thread-instanced libraries.
-                threadInstances: mod.lib?.threadInstances === true || mod.workers === true,
+                threadInstances: mod.lib?.threadInstances === true,
             }),
+            // Worker programs keep one allocator per script thread: the inline
+            // paths address its thread-local state.
+            threadLocalAlloc: mod.workers === true,
             rcHelpers: this.rcHelpers,
+            nextCycKind: () => FIRST_EMITTED_CYC_KIND + this.cycKinds++,
             unionsById: this.unionsById,
             declare: (decl) => this.declare(decl),
             needOom: () => this.needOom(),
@@ -458,6 +646,7 @@ export class LlEmitter {
             internLiteral: (text) => this.internLiteral(text),
             cstr: (text) => this.cstr(text),
             unitInstanceRef: (unionId, tag) => this.unitInstanceRef(unionId, tag),
+            fieldAbsentTestIn: (B, value, unionId) => this.fieldAbsentTestIn(B, value, unionId),
             absentInstanceRef: (unionId) => this.absentInstanceRef(unionId),
             liveDynRefAdapter: (type) => this.liveDynRefAdapter(type),
             liveDynUnionRefAdapter: (type) => this.liveDynUnionRefAdapter(type),
@@ -470,6 +659,8 @@ export class LlEmitter {
                     .filter((meta) => intervals.some((range) => range.pre <= meta.pre && meta.pre <= range.post))
                     .map((meta) => meta.def.name);
             },
+            pendingTestLines: (dest) => this.pendingTestLines(dest),
+            virtualEntry: (implFn) => this.virtualEntry(implFn),
         };
         this.walkers = new LlWalkers(this.shapeHost);
         this.dyn = new LlDyn(this.shapeHost);
@@ -526,6 +717,21 @@ export class LlEmitter {
                 lib: rec.lib,
             });
         }
+        this.virtualBorrows = new VirtualBorrows(mod, this.classMeta, this.fnByName, this.callLifetimes.borrowed);
+        // After the vtable slots: borrowing slots exclude their implementations.
+        if (this.debug === null)
+            this.analyzeBorrowedReturns();
+    }
+    /** The borrowed parameters of a hierarchy's vtable slot (empty: owned). */
+    virtualSlotBorrowed(rootName, slotIndex) {
+        return this.virtualBorrows.slot(rootName, slotIndex);
+    }
+    /** The vtable entry for one implementation (VirtualBorrows.entry). */
+    virtualEntry(implFn) {
+        return this.virtualBorrows.entry(implFn);
+    }
+    implSlotBorrowed(implFn) {
+        return this.virtualBorrows.implSlotBorrowed(implFn);
     }
     abiOffset(native64, wasm32) {
         return this.sizeType === "i32" ? wasm32 : native64;
@@ -566,7 +772,6 @@ export class LlEmitter {
         const defs = [];
         if (this.ffiCallbackAdapters.size === 0)
             return { globals, defs };
-        this.declare(`declare zeroext i1 @scr_exc_pending()`);
         this.declare(`declare void @scr_trap(ptr)`);
         const expired = this.cstr("scriptc: native callback invoked outside its call-scoped lifetime\n");
         const released = this.cstr("scriptc: native callback invoked outside its retained lifetime\n");
@@ -684,7 +889,7 @@ export class LlEmitter {
                 ? `  %cb = load ptr, ptr @${adapter.tls}`
                 : adapter.global !== null
                     ? `  %cb = load ptr, ptr @${adapter.global}`
-                    : `  %cb = getelementptr inbounds i8, ptr %ctx, i64 0`, `  %missing = icmp eq ptr %cb, null`, `  br i1 %missing, label %expired, label %ready`, `expired:`, `  call void @scr_trap(ptr ${adapter.callback.lifetime === "call" ? expired : released})`, `  unreachable`, `ready:`, `  %pending = call zeroext i1 @scr_exc_pending()`, `  br i1 %pending, label %skip, label %invoke`, `skip:`, `  ret ${ffiCallbackDummyLl(cb)}`, `invoke:`);
+                    : `  %cb = getelementptr inbounds i8, ptr %ctx, i64 0`, `  %missing = icmp eq ptr %cb, null`, `  br i1 %missing, label %expired, label %ready`, `expired:`, `  call void @scr_trap(ptr ${adapter.callback.lifetime === "call" ? expired : released})`, `  unreachable`, `ready:`, ...this.pendingTestLines("%pending"), `  br i1 %pending, label %skip, label %invoke`, `skip:`, `  ret ${ffiCallbackDummyLl(cb)}`, `invoke:`);
             // Validate every native pointer before allocating any copy-in value.
             // A later bad slot therefore cannot leak an earlier materialization.
             for (let i = 0; i < cb.params.length; i++) {
@@ -832,6 +1037,22 @@ export class LlEmitter {
         return this.emitParts().join("\n");
     }
     emitParts() {
+        const parts = this.emitModuleParts();
+        if (!this.executableTls)
+            return parts;
+        // A worker executable's thread-locals all live in the executable's own
+        // TLS block: the program's internal ones, and the runtime's external
+        // ones, because the runtime is always linked statically into the
+        // executable. So on ELF they can all use the local-exec model: LLVM's
+        // default general-dynamic sequence (relaxed by the linker to `mov %fs:0`
+        // plus an add), and even initial-exec (relaxed to `mov $offset` plus an
+        // indexed access), become one %fs-relative operand LLVM can fold into
+        // loads and compares. Darwin's thread-local variables have one model.
+        return parts.map((part) => part
+            .replace(/^(@[-$._A-Za-z0-9]+ = internal )thread_local global /gm, "$1thread_local(localexec) global ")
+            .replace(/^(@[-$._A-Za-z0-9]+ = external )thread_local global /gm, "$1thread_local(localexec) global "));
+    }
+    emitModuleParts() {
         // Function bodies first (the literal/unit/fn-value tables fill as they
         // emit), then the file assembles around them — the runtime ABI’s order.
         const fnDefs = [];
@@ -858,7 +1079,7 @@ export class LlEmitter {
             this.declare(`declare void @scr_error_register_dyn(ptr, ptr)`);
             errorViews.push(`  call void @scr_error_register_dyn(ptr @${mangleVtInstance(meta.def.name)}, ptr @${name})`);
         }
-        const layouts = emitLlvmLayouts(this.shapeHost, this.mod, this.classMeta, this.classObjs, this.fnByName, (t) => this.llType(t), this.nullableFields);
+        const layouts = emitLlvmLayouts(this.shapeHost, this.mod, this.classMeta, this.classObjs, this.fnByName, (t) => this.llType(t), this.nullableFields, this.int32Slots);
         const shapes = layouts.records;
         const classShapes = layouts.classes;
         const classObjDefs = layouts.classObjects;
@@ -1061,12 +1282,15 @@ export class LlEmitter {
         const topPendingReleases = asyncEntry ? globalReleaseLines("gp") : [];
         const loopReportedReleases = runsLoop ? globalReleaseLines("gq") : [];
         // main's epilogues read the flag / the loop entry points — declared
-        // HERE, before the extern block flushes (a pending check usually
-        // declared the flag already; the Set dedupes).
+        // HERE, before the extern block flushes. They run once, so they keep
+        // the out-of-line scr_exc_pending call; per-call checks inline the
+        // test (pendingTestLines).
         if (entryMayThrow || runsLoop)
             this.declare(`declare zeroext i1 @scr_exc_pending()`);
         if (runsLoop) {
             this.declare(`declare zeroext i1 @scr_loop_run(ptr)`);
+            if (this.mod.commonJsEntry === true)
+                this.declare(`declare void @scr_loop_commonjs_entry()`);
             this.declare(`declare zeroext i1 @scr_report_unhandled_rejections()`);
             this.declare(`declare void @scr_discard_unhandled_rejections()`);
         }
@@ -1157,6 +1381,8 @@ export class LlEmitter {
         const helpers = [
             ...this.helperDefs(),
             ...emitClassMembershipHelper(this.classMeta, this.sizeType),
+            ...(this.publishWalkersCache?.defs() ?? []),
+            ...this.publishedClassNamesDefs(),
         ];
         if (this.constantNumericTables.size > 0)
             this.declare(`declare double @scr_arr_get_number(ptr, double)`);
@@ -1176,16 +1402,28 @@ export class LlEmitter {
             `%ScrClosure = type { ${this.sizeType}, ptr, ${this.sizeType}, ptr, i32, i32, ptr }`,
             `%ScrFfiTable = type { ptr, ${this.sizeType}, ${this.sizeType}, ptr, i8, ptr, ptr, ${this.sizeType}, ${this.sizeType}, ${this.sizeType}, ptr, ptr }`,
             `%ScrRegex = type { ${this.sizeType}, ptr, ptr, ptr, double, ptr, ptr }`,
-            // ScrArr mirrors scr_runtime.h field-for-field. Live dynamic stream
-            // commits swap its mutable dense, sparse, presence, and property
-            // storage while preserving the target object's identity.
-            `%ScrArr = type { ${this.sizeType}, ${this.sizeType}, ${this.sizeType}, i32, ptr, ptr, ptr, ptr, ptr, ptr, ${this.sizeType}, ${this.sizeType}, ptr, ${this.sizeType}, ${this.sizeType}, ptr }`,
+            // ScrArr mirrors scr_runtime.h field-for-field: { rc, len, cap, elem,
+            // elem_retain, elem_release, elem_trace, data, present, ext }, where
+            // ext points at the out-of-line sparse, property and metadata storage
+            // (NULL until first used). Live dynamic stream commits swap its dense,
+            // presence and out-of-line storage while preserving the target
+            // object's identity.
+            `%ScrArr = type { ${this.sizeType}, ${this.sizeType}, ${this.sizeType}, i32, ptr, ptr, ptr, ptr, ptr, ptr }`,
             // The ScrMap prefix { rc, key_kind, val_kind, val_retain, val_release,
             // val_trace, key_retain, key_release, key_trace } — the inline RC
             // fast paths test the two trace slots (shapes.ts).
             ...(this.rcHelpers === null
                 ? []
                 : [`%ScrMapRc = type { ${this.sizeType}, i32, i32, ptr, ptr, ptr, ptr, ptr, ptr }`]),
+            // The complete ScrMap and its { key, val, hash } entry, read by the
+            // inline number-key lookup (sc_map_entry_f64): entries is field 12,
+            // the direct index and its length fields 18 and 19.
+            ...(this.decls.has(NUMBER_MAP_ENTRY_DECL)
+                ? [
+                    `%ScrMapIx = type { ${this.sizeType}, i32, i32, ptr, ptr, ptr, ptr, ptr, ptr, ${this.sizeType}, ${this.sizeType}, ${this.sizeType}, ptr, ${this.sizeType}, ptr, ${this.sizeType}, ptr, ptr, ptr, ${this.sizeType} }`,
+                    `%ScrMapEntry = type { i64, i64, i64 }`,
+                ]
+                : []),
             // The runtime error prefix { rc, vt, name, message, code, cause } and the
             // class-object shape { rc, pre, post, ctor, name } — field reads on
             // builtin errors and classval loads GEP through these.
@@ -1231,8 +1469,12 @@ export class LlEmitter {
         // data (string literals, unit arms, template arrays, vtables) stays
         // shared.
         const tl = this.mod.workers === true || this.mod.lib?.threadInstances === true ? "thread_local " : "";
-        out.push(``, `@scr_error_vts = external ${tl}global [${RUNTIME_ERROR_CLASSES.size} x %ScrVt]`, `declare void @scr_init()`, `declare void @scr_lib_init(i32, ptr)`, ...(this.mod.workers ? [`declare void @scr_runtime_workers_v8()`] : []), ...(this.runtimeAbiMarker && this.mod.lib === undefined
+        out.push(``, `@scr_error_vts = external ${tl}global [${RUNTIME_ERROR_CLASSES.size} x %ScrVt]`, `declare void @scr_init()`, `declare void @scr_lib_init(i32, ptr)`, ...(this.mod.workers ? [`declare void @scr_runtime_workers_v8()`] : []), ...(this.stackChecks?.size ? [`declare void @scr_stack_guard_init()`] : []), ...(this.runtimeAbiMarker && this.mod.lib === undefined
             ? [`declare void @${RUNTIME_ABI_MARKER}()`]
+            : []), 
+        // Overrides the runtime's weak default (scr_lib.c).
+        ...(this.detachedExit && this.mod.lib === undefined
+            ? [`@scr_detached_exit = constant i8 1`]
             : []));
         for (const d of this.decls)
             out.push(d);
@@ -1240,17 +1482,19 @@ export class LlEmitter {
         const flushedDecls = new Set(this.decls);
         for (const table of this.constantNumericTables.values()) {
             const n = table.values.length;
-            out.push(`@${table.symbol} = private constant [${n} x double] [${table.values.map((v) => `double ${f64Lit(v)}`).join(", ")}]`, `define internal double @${table.symbol}_get(ptr %a, double %i) alwaysinline #0 {`, `entry:`, `  %initialized = icmp ne ptr %a, null`, `  %nonnegative = fcmp oge double %i, ${f64Lit(0)}`, `  %below = fcmp olt double %i, ${f64Lit(n)}`, `  %range = and i1 %nonnegative, %below`, `  %safe = and i1 %initialized, %range`, `  br i1 %safe, label %convert, label %fallback`, `convert:`, 
-            // The branch must dominate fptoui: NaN/out-of-range conversion
-            // would produce poison. Fractional indices also need a fallback.
-            `  %index = fptoui double %i to ${this.sizeType}`, `  %roundtrip = uitofp ${this.sizeType} %index to double`, `  %integer = fcmp oeq double %roundtrip, %i`, `  br i1 %integer, label %read, label %fallback`, `read:`, `  %slot = getelementptr inbounds [${n} x double], ptr @${table.symbol}, ${this.sizeType} 0, ${this.sizeType} %index`, `  %value = load double, ptr %slot`, `  ret double %value`, `fallback:`, `  %generic = call double @scr_arr_get_number(ptr %a, double %i)`, `  ret double %generic`, `}`, ``);
+            let tableTmp = 0;
+            const tableIndex = exactIndexLines("%i", String(n), "i64", () => `%ix${tableTmp++}`);
+            out.push(`@${table.symbol} = private constant [${n} x double] [${table.values.map((v) => `double ${f64Lit(v)}`).join(", ")}]`, `define internal double @${table.symbol}_get(ptr %a, double %i) alwaysinline #0 {`, `entry:`, `  %initialized = icmp ne ptr %a, null`, ...tableIndex.lines.map((line) => `  ${line}`), `  %safe = and i1 %initialized, ${tableIndex.ok}`, `  br i1 %safe, label %read, label %fallback`, `read:`, `  %slot = getelementptr inbounds [${n} x double], ptr @${table.symbol}, i64 0, i64 ${tableIndex.wide}`, `  %value = load double, ptr %slot`, `  ret double %value`, `fallback:`, `  %generic = call double @scr_arr_get_number(ptr %a, double %i)`, `  ret double %generic`, `}`, ``);
         }
         for (const [text, lit] of this.literals) {
             // Immortal interned ScrStr: { rc = SIZE_MAX, len, cap = len, bytes\0 } —
             // the runtime ABI’s static table, retain/release skip rc == SIZE_MAX.
             // 64-bit (little-endian) targets split the capacity word: the high
             // half carries the precomputed Map key hash (SCR_STR_HASH_CACHE).
-            const capWord = this.sizeType === "i64" ? literalCapWord(Buffer.from(text, "utf8")) : String(lit.len);
+            // Bit 31 marks all-ASCII literals (SCR_STR_ASCII_BIT) on every target.
+            const capWord = this.sizeType === "i64"
+                ? literalCapWord(Buffer.from(text, "utf8"))
+                : literalCapWord32(Buffer.from(text, "utf8"));
             out.push(`@${lit.sym} = internal global { ${this.sizeType}, ${this.sizeType}, ${this.sizeType}, [${lit.len + 1} x i8] } ` +
                 `{ ${this.sizeType} -1, ${this.sizeType} ${lit.len}, ${this.sizeType} ${capWord}, [${lit.len + 1} x i8] c"${llStrBytes(text)}" }`);
         }
@@ -1276,6 +1520,20 @@ export class LlEmitter {
         }
         if (this.absentInstances.size > 0)
             out.push(``);
+        if (this.nullableUnions.usesNullSentinel) {
+            // `null` in every `C | null | undefined` union (NULL is undefined):
+            // one module-scope immortal object like the ABSENT sentinel.
+            const S = this.sizeType;
+            out.push(`${NULLABLE_NULL} = internal global { ${S}, ${S}, ${S}, ${S} } { ${S} -1, ${S} 0, ${S} 0, ${S} 0 } ; nullable null arm`, ``);
+        }
+        if (this.needsNullableAbsent) {
+            // The ABSENT field-slot state of every nullable-pointer union: one
+            // module-scope immortal object (rc == SIZE_MAX), distinct from NULL
+            // (undefined) and from every instance. RC entry points and the
+            // collector skip it like any immortal; field reads compare its address.
+            const S = this.sizeType;
+            out.push(`${NULLABLE_ABSENT} = internal global { ${S}, ${S}, ${S}, ${S} } { ${S} -1, ${S} 0, ${S} 0, ${S} 0 } ; nullable absent field`, ``);
+        }
         for (const [key, re] of this.regexInstances) {
             // One immortal ScrRegex per (pattern, flags) literal, pointing at
             // the interned source/flags strings. The bc and native-matcher slots
@@ -1293,7 +1551,7 @@ export class LlEmitter {
             // strings — a no-op.
             const n = inst.slots.length;
             const present = n === 0 ? "zeroinitializer" : `[ ${inst.slots.map(() => "i8 1").join(", ")} ]`;
-            out.push(`@${inst.sym}_data = internal constant [${n} x ptr] [ ${inst.slots.map((s) => `ptr ${s}`).join(", ")} ]`, `@${inst.sym}_present = internal constant [${n} x i8] ${present}`, `@${inst.sym} = internal global %ScrArr { ${this.sizeType} -1, ${this.sizeType} ${n}, ${this.sizeType} ${n}, i32 2, ptr null, ptr null, ptr null, ptr @${inst.sym}_data, ptr @${inst.sym}_present, ptr null, ${this.sizeType} 0, ${this.sizeType} 0, ptr null, ${this.sizeType} 0, ${this.sizeType} 0, ptr null }`);
+            out.push(`@${inst.sym}_data = internal constant [${n} x ptr] [ ${inst.slots.map((s) => `ptr ${s}`).join(", ")} ]`, `@${inst.sym}_present = internal constant [${n} x i8] ${present}`, `@${inst.sym} = internal global %ScrArr { ${this.sizeType} -1, ${this.sizeType} ${n}, ${this.sizeType} ${n}, i32 2, ptr null, ptr null, ptr null, ptr @${inst.sym}_data, ptr @${inst.sym}_present, ptr null }`);
         }
         if (this.templateStringsInstances.size > 0)
             out.push(``);
@@ -1442,7 +1700,10 @@ export class LlEmitter {
                 out.push(this.debug.render());
             return out;
         }
-        out.push(`define i32 @${this.mod.workers ? "sc_context_entry" : this.wasi ? "__main_argc_argv" : "main"}(i32 %argc, ptr %argv) ${FN_ATTRS} {`, `entry:`, ...(this.runtimeAbiMarker ? [`  call void @${RUNTIME_ABI_MARKER}()`] : []), ...(this.mod.workers ? [`  call void @scr_runtime_workers_v8()`] : []), `  call void @scr_init()`, ...stamps, 
+        out.push(`define i32 @${this.mod.workers ? "sc_context_entry" : this.wasi ? "__main_argc_argv" : "main"}(i32 %argc, ptr %argv) ${FN_ATTRS} {`, `entry:`, ...(this.runtimeAbiMarker ? [`  call void @${RUNTIME_ABI_MARKER}()`] : []), ...(this.mod.workers ? [`  call void @scr_runtime_workers_v8()`] : []), `  call void @scr_init()`, 
+        // Each context (the main thread, every worker) installs its stack
+        // guard before running compiled code that checks it.
+        ...(this.stackChecks?.size ? [`  call void @scr_stack_guard_init()`] : []), ...stamps, 
         // Event-surface programs (signal/exit listeners) fill the loop's
         // nullable event hooks before %main — scr_events.c links only when
         // this line is emitted (native/executable.ts gates on the same predicate).
@@ -1487,6 +1748,7 @@ export class LlEmitter {
         // both exit 1, like Node — the C main's loop block exactly.
         ...(runsLoop
             ? [
+                ...(this.mod.commonJsEntry === true ? [`  call void @scr_loop_commonjs_entry()`] : []),
                 `  %loop_rejection = call zeroext i1 @scr_loop_run(ptr ${asyncEntry ? "%top" : "null"})`,
                 `  %lexc = call zeroext i1 @scr_exc_pending()`,
                 `  br i1 %lexc, label %luncaught, label %lok`,
@@ -1802,10 +2064,25 @@ export class LlEmitter {
             msgHelper("sc_bad_key", "sc_bad_key_msg", "scriptc: TypeError: record has no key (typed slot — no undefined is representable)\n");
         }
         if (this.needsRetainBox) {
-            // scr_box_retain is a static inline (increment-unless-immortal, then
-            // mark the cycle header live — every box is collector-headered);
+            // scr_box_retain is a static inline (increment-unless-immortal);
             // emitted once with internal linkage, like the record retains.
-            defs.push(`define internal ptr @sc_retain_box(ptr %b) ${FN_ATTRS} {`, `entry:`, `  %rc = load ${this.sizeType}, ptr %b`, `  %imm = icmp eq ${this.sizeType} %rc, -1`, `  br i1 %imm, label %done, label %inc`, `inc:`, `  %n = add ${this.sizeType} %rc, 1`, `  store ${this.sizeType} %n, ptr %b`, `  %colorp = getelementptr i8, ptr %b, ${this.sizeType} -${this.cycleColorOffset}`, `  store i32 0, ptr %colorp ; mark live`, `  br label %done`, `done:`, `  ret ptr %b`, `}`, ``);
+            defs.push(`define internal ptr @sc_retain_box(ptr %b) ${FN_ATTRS} {`, `entry:`, `  %rc = load ${this.sizeType}, ptr %b`, `  %imm = icmp eq ${this.sizeType} %rc, -1`, `  br i1 %imm, label %done, label %inc`, `inc:`, `  %n = add ${this.sizeType} %rc, 1`, `  store ${this.sizeType} %n, ptr %b`, `  br label %done`, `done:`, `  ret ptr %b`, `}`, ``);
+        }
+        // Number-key Map/Set lookups probe the runtime's direct index inline:
+        // while ndense is nonzero every live key is an integer below it, so an
+        // in-range integral key reads its slot (entry index + 1, 0 = absent) and
+        // any other key is absent. Maps without the index (ndense 0) and every
+        // non-integral probe outside the table take the runtime lookup, which
+        // keeps the complete SameValueZero semantics.
+        if (this.decls.has(NUMBER_MAP_ENTRY_DECL)) {
+            const sz = this.sizeType;
+            let mapTmp = 0;
+            const mapIndex = exactIndexLines("%k", "%nd", sz, () => `%ix${mapTmp++}`);
+            defs.push(`define internal ptr @sc_map_entry_f64(ptr %m, double %k) ${FN_ATTRS} {`, `entry:`, `  %ndp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 19`, `  %nd = load ${sz}, ptr %ndp`, 
+            // A non-integral key inside the table is as absent as one outside it.
+            ...mapIndex.lines.map((line) => `  ${line}`), `  br i1 ${mapIndex.ok}, label %slot, label %outside`, `slot:`, sz === "i64"
+                ? `  %i = add i64 ${mapIndex.wide}, 0`
+                : `  %i = trunc i64 ${mapIndex.wide} to ${sz}`, `  %dp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 18`, `  %dense = load ptr, ptr %dp`, `  %sp = getelementptr inbounds i32, ptr %dense, ${sz} %i`, `  %s = load i32, ptr %sp`, `  %empty = icmp eq i32 %s, 0`, `  br i1 %empty, label %miss, label %hit`, `hit:`, `  %e32 = sub i32 %s, 1`, sz === "i32" ? `  %e = add i32 %e32, 0` : `  %e = zext i32 %e32 to ${sz}`, `  %ep = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 12`, `  %entries = load ptr, ptr %ep`, `  %found = getelementptr inbounds %ScrMapEntry, ptr %entries, ${sz} %e`, `  ret ptr %found`, `miss:`, `  ret ptr null`, `outside:`, `  %dense.any = icmp ne ${sz} %nd, 0`, `  br i1 %dense.any, label %miss, label %slow`, `slow:`, `  %r = call ptr @scr_map_entry_f64(ptr %m, double %k)`, `  ret ptr %r`, `}`, ``);
         }
         // String comparisons enter through small internal wrappers that LLVM
         // inlines at each site: interned literals and shared values compare by
@@ -1814,6 +2091,15 @@ export class LlEmitter {
         if (this.decls.has(`declare zeroext i1 @scr_str_eq(ptr, ptr)`)) {
             defs.push(`define internal zeroext i1 @sc_str_eq(ptr %a, ptr %b) ${FN_ATTRS} {`, `entry:`, `  %same = icmp eq ptr %a, %b`, `  br i1 %same, label %yes, label %lengths`, `lengths:`, `  %alen.p = getelementptr inbounds %ScrStr, ptr %a, i32 0, i32 1`, `  %blen.p = getelementptr inbounds %ScrStr, ptr %b, i32 0, i32 1`, `  %alen = load ${this.sizeType}, ptr %alen.p`, `  %blen = load ${this.sizeType}, ptr %blen.p`, `  %samelen = icmp eq ${this.sizeType} %alen, %blen`, `  br i1 %samelen, label %bytes, label %no`, `bytes:`, `  %eq = call zeroext i1 @scr_str_eq(ptr %a, ptr %b)`, `  ret i1 %eq`, `yes:`, `  ret i1 true`, `no:`, `  ret i1 false`, `}`, ``);
         }
+        // String length and charCodeAt read proven-ASCII strings inline: bit 31
+        // of the capacity word (SCR_STR_ASCII_BIT, the low half's sign bit on
+        // little-endian targets) makes UTF-16 units bytes. Unproven strings and
+        // anything but an in-range index take the runtime's UTF-16 mapping.
+        for (const helper of STRING_READ_HELPERS) {
+            if (!this.decls.has(helper.decl))
+                continue;
+            defs.push(...helper.define(this.sizeType, FN_ATTRS), ``);
+        }
         // Ordering also decides inline when the first bytes differ: byte order
         // is the plain comparison's order, and the UTF-16 order whenever both
         // bytes are ASCII. Callers only test the sign of the result.
@@ -1861,7 +2147,18 @@ export class LlEmitter {
      * here too. */
     inlineRcTail(flushedDecls) {
         const late = inlineRcDecls(this.shapeHost).filter((d) => !flushedDecls.has(d));
-        return [...late, ...emitInlineRcHelpers(this.shapeHost)];
+        // NULL-skipping retain wrappers of nullable unions; a runtime inner
+        // retain requested after the extern block flushed is declared here.
+        for (const inner of this.nullableUnions.retainWrappers.values()) {
+            const decl = `declare ptr ${inner}(ptr)`;
+            if (inner.startsWith("@scr_") && !flushedDecls.has(decl) && !late.includes(decl))
+                late.push(decl);
+        }
+        return [
+            ...late,
+            ...emitNullableRetainWrappers(this.shapeHost),
+            ...emitInlineRcHelpers(this.shapeHost),
+        ];
     }
     /** Env-signature wrappers + interned immortal closures for declared
      * functions used as values (the runtime ABI’s sc_w_/sc_fc_ pair): every
@@ -1892,7 +2189,6 @@ export class LlEmitter {
         const sizeOf = `ptrtoint (ptr getelementptr (%${pack}, ptr null, i32 1) to ${this.sizeType})`;
         this.declare(`declare void @free(ptr)`);
         this.declare(`declare ptr @malloc(${this.sizeType})`);
-        this.declare(`declare zeroext i1 @scr_exc_pending()`);
         const tr = [
             `define internal void @${mangleTrampoline(fn.name)}(ptr %self, ptr %ap) ${FN_ATTRS} {`,
             `entry:`,
@@ -2048,7 +2344,6 @@ export class LlEmitter {
         this.declare(`declare void @scr_async_inline_enter(ptr)`);
         this.declare(`declare ptr @scr_async_inline_leave(ptr)`);
         this.declare(`declare void @scr_promise_reject_pending(ptr)`);
-        this.declare(`declare zeroext i1 @scr_exc_pending()`);
         if (lifted) {
             this.declare(`declare ptr @scr_closure_retain_v(ptr)`);
             this.declare(`declare void @scr_closure_release(ptr)`);
@@ -2064,7 +2359,7 @@ export class LlEmitter {
             `  call void @scr_async_inline_enter(ptr %frame)`,
             retTy === "void" ? `  ${bodyCall}` : `  %r = ${bodyCall}`,
             ...(lifted ? [`  call void @scr_closure_release(ptr %a0)`] : []),
-            `  %pend = call zeroext i1 @scr_exc_pending()`,
+            ...this.pendingTestLines("%pend"),
             `  %p = call ptr @scr_async_inline_leave(ptr %frame)`,
             `  br i1 %pend, label %thrown, label %clean`,
             `clean:`,
@@ -2123,7 +2418,7 @@ export class LlEmitter {
                 if (fn.captures !== undefined) {
                     this.declare(`declare void @scr_closure_release(ptr)`);
                 }
-                tr.push(`  %pend = call zeroext i1 @scr_exc_pending()`, `  br i1 %pend, label %thrown, label %clean`, `clean:`, `  %pr = call ptr @scr_fiber_promise(ptr %self)`);
+                tr.push(...this.pendingTestLines("%pend"), `  br i1 %pend, label %thrown, label %clean`, `clean:`, `  %pr = call ptr @scr_fiber_promise(ptr %self)`);
                 for (const line of this.asyncFulfillLines(ret, "%pr"))
                     tr.push(line);
                 tr.push(`  ret void`, `thrown:`);
@@ -2232,7 +2527,7 @@ export class LlEmitter {
                 tr.push(`  ret void`, `}`, ``);
             }
             else {
-                tr.push(`  %g = call ptr @scr_gen_of_fiber(ptr %self)`, `  %pend = call zeroext i1 @scr_exc_pending()`, `  br i1 %pend, label %thrown, label %clean`, `clean:`);
+                tr.push(`  %g = call ptr @scr_gen_of_fiber(ptr %self)`, ...this.pendingTestLines("%pend"), `  br i1 %pend, label %thrown, label %clean`, `clean:`);
                 switch (ret.kind) {
                     case "void":
                         tr.push(`  br label %done ; void body: the done value is undefined (NONE)`);
@@ -2322,10 +2617,30 @@ export class LlEmitter {
         return out;
     }
     // ── plumbing (frame and scope ownership) ──────
+    /** A symbol derived from the constant's text rather than its first-use
+     * index, so an edit that interns one more string leaves every other
+     * constant's symbol, and the code referencing it, unchanged. This lets
+     * native builds reuse the compiled partitions an edit does not touch. A
+     * collision retries with a counter, still in first-use order. */
+    contentSymbol(prefix, text) {
+        for (let attempt = 0;; attempt++) {
+            const digest = createHash("sha256")
+                .update(attempt === 0 ? text : `${attempt}\0${text}`)
+                .digest("hex");
+            const symbol = `${prefix}${parseInt(digest.slice(0, 13), 16)}`;
+            if (!this.contentSymbols.has(symbol)) {
+                this.contentSymbols.add(symbol);
+                return symbol;
+            }
+        }
+    }
     internLiteral(text) {
         let lit = this.literals.get(text);
         if (!lit) {
-            lit = { sym: `sc_lit_${this.literals.size}`, len: Buffer.byteLength(text, "utf8") };
+            lit = {
+                sym: this.contentSymbol("sc_lit_", text),
+                len: Buffer.byteLength(text, "utf8"),
+            };
             this.literals.set(text, lit);
         }
         const name = `@${lit.sym}`;
@@ -2337,7 +2652,7 @@ export class LlEmitter {
     cstr(text) {
         let c = this.cstrs.get(text);
         if (!c) {
-            c = { sym: `sc_cs_${this.cstrs.size}`, len: Buffer.byteLength(text, "utf8") };
+            c = { sym: this.contentSymbol("sc_cs_", text), len: Buffer.byteLength(text, "utf8") };
             this.cstrs.set(text, c);
         }
         return `@${c.sym}`;
@@ -2354,6 +2669,12 @@ export class LlEmitter {
         if (!arm || !isUnitType(arm)) {
             throw new InternalCompilerError(`llvm emitter bug: unit instance for non-unit arm ${tag} of ${unionId}`);
         }
+        const nullable = this.nullableUnions.get(unionId);
+        if (nullable) {
+            // NULL is the unit arm of a nullable union (`undefined` when it has
+            // both); the `null` sentinel is immortal. Neither owns anything.
+            return tag === nullable.nullTag ? NULLABLE_NULL : "null";
+        }
         const key = `${unionId}:${tag}`;
         let sym = this.unitInstances.get(key);
         if (!sym) {
@@ -2370,6 +2691,11 @@ export class LlEmitter {
         if (undefinedArmTag({ kind: "union", unionId }, this.unionsById) < 0) {
             throw new InternalCompilerError(`llvm emitter bug: absent state of ${unionId} without undefined`);
         }
+        if (this.nullableUnions.has(unionId)) {
+            this.needsNullableAbsent = true;
+            this.immortalValues.add(NULLABLE_ABSENT);
+            return NULLABLE_ABSENT;
+        }
         let sym = this.absentInstances.get(unionId);
         if (!sym) {
             sym = `sc_absent_${this.absentInstances.size}`;
@@ -2382,7 +2708,18 @@ export class LlEmitter {
     /** i1: a union value loaded from a field slot is the ABSENT state — the
      * undefined arm's tag with the absent payload marker. */
     fieldAbsentTest(value, unionId) {
-        return emitFieldAbsentTest(this.B, value, undefinedArmTag({ kind: "union", unionId }, this.unionsById));
+        return this.fieldAbsentTestIn(this.B, value, unionId);
+    }
+    /** fieldAbsentTest in another block builder (helper generators). A
+     * nullable union's ABSENT state is the module's immortal sentinel. */
+    fieldAbsentTestIn(B, value, unionId) {
+        if (this.nullableUnions.has(unionId)) {
+            this.needsNullableAbsent = true;
+            const t = B.tmp();
+            B.line(`${t} = icmp eq ptr ${value}, ${NULLABLE_ABSENT}`);
+            return t;
+        }
+        return emitFieldAbsentTest(B, value, undefinedArmTag({ kind: "union", unionId }, this.unionsById));
     }
     /** Loads a record field slot as a VALUE: an undefined-armed union slot
      * holding the ABSENT state surfaces as the ordinary undefined arm, so
@@ -2410,9 +2747,20 @@ export class LlEmitter {
             throw new InternalCompilerError("llvm emitter bug: no active statement frame");
         return frame;
     }
+    /** Whether a value is immortal: an interned constant, or a temp marked by
+     * markImmortal. */
+    isImmortal(name) {
+        return this.immortalValues.has(name) || this.B.immortalTemps.has(name);
+    }
+    /** Record that a temp holds an immortal value (a choice between interned
+     * literals): nothing owns it, and retains, releases and moves skip it. */
+    markImmortal(v) {
+        this.B.immortalTemps.add(v.name);
+        return v;
+    }
     /** Registers an owned refcounted value on the current statement frame. */
     own(v) {
-        if (isRefCounted(v.type) && !this.immortalValues.has(v.name))
+        if (isRefCounted(v.type) && !this.isImmortal(v.name))
             this.currentFrame().push(v);
         return v;
     }
@@ -2424,7 +2772,7 @@ export class LlEmitter {
     }
     /** Strike a refcounted temp from its frame: ownership is being moved. */
     moveTemp(v) {
-        if (!isRefCounted(v.type) || this.immortalValues.has(v.name))
+        if (!isRefCounted(v.type) || this.isImmortal(v.name))
             return;
         for (let i = this.frames.length - 1; i >= 0; i--) {
             const idx = this.frames[i].findIndex((e) => e.name === v.name);
@@ -2438,7 +2786,7 @@ export class LlEmitter {
     /** The retained (+1) read of a refcounted value — type-directed through
      * the `_v` table (immortals skip, exactly the C retain calls). */
     retainValue(name, type) {
-        if (this.immortalValues.has(name))
+        if (this.isImmortal(name))
             return name;
         const t = this.B.tmp();
         this.B.line(`${t} = call ptr ${retainSym(this.shapeHost, type)}(ptr ${name})`);
@@ -2447,7 +2795,7 @@ export class LlEmitter {
     /** The release call for one owned refcounted value — type-directed like
      * releaseCallC (all runtime releases are NULL-tolerant). */
     releaseValue(name, type) {
-        if (this.immortalValues.has(name))
+        if (this.isImmortal(name))
             return;
         this.B.line(`call void ${releaseSym(this.shapeHost, type)}(ptr ${name})`);
     }
@@ -2472,7 +2820,21 @@ export class LlEmitter {
         for (const e of scope) {
             const t = this.B.tmp();
             this.B.line(`${t} = load ptr, ptr ${e.slot}`);
-            if (e.boxed) {
+            if (e.boxed && e.lazy) {
+                // Unreachable code after a terminator emits nothing; a new block
+                // here would revive it.
+                if (this.B.isTerminated())
+                    continue;
+                const created = this.B.tmp();
+                this.B.line(`${created} = icmp ne ptr ${t}, null`);
+                const release = this.B.newLabel("lazy.release"), join = this.B.newLabel("lazy.release.j");
+                this.B.condBr(created, release, join);
+                this.B.startBlock(release);
+                this.B.line(`call void ${boxReleaseSym(this.shapeHost)}(ptr ${t})`);
+                this.B.br(join);
+                this.B.startBlock(join);
+            }
+            else if (e.boxed) {
                 this.B.line(`call void ${boxReleaseSym(this.shapeHost)}(ptr ${t})`);
             }
             else {
@@ -2523,16 +2885,34 @@ export class LlEmitter {
      * function — and branch to the handler / return a dummy value (never
      * read: callers of a may-throw function test the pending flag before
      * using the result). Callers own the surrounding pending branch; a
-     * `throw` unwinds unconditionally. */
-    emitUnwind() {
+     * `throw` unwinds unconditionally. `passThrough` names a scalar call
+     * result of the function's own return type: with nothing to release, the
+     * unwind returns it as the dummy, so a call in tail position keeps a single
+     * return and stays eligible for tail-call and recursion elimination. */
+    emitUnwind(passThrough) {
         if (this.mod.workers && this.tryStack.length > 0) {
-            this.declare(`declare zeroext i1 @scr_context_stopping()`);
-            const stopped = this.B.tmp();
-            this.B.line(`${stopped} = call zeroext i1 @scr_context_stopping()`);
             const stop = this.B.newLabel("context.stop");
             const ordinary = this.B.newLabel("context.throw");
-            this.B.condBr(stopped, stop, ordinary);
-            this.B.startBlock(stop);
+            if (this.executableTls) {
+                // A set stop bit unwinds while the active cell may still be clear:
+                // install the termination sentinel before skipping the handlers.
+                const word = this.loadExcFlag();
+                const bit = this.B.tmp();
+                const stopped = this.B.tmp();
+                this.B.line(`${bit} = and i32 ${word}, 2`);
+                this.B.line(`${stopped} = icmp ne i32 ${bit}, 0`);
+                this.B.condBr(stopped, stop, ordinary);
+                this.B.startBlock(stop);
+                this.declare(`declare zeroext i1 @scr_context_checkpoint()`);
+                this.B.line(`call zeroext i1 @scr_context_checkpoint()`);
+            }
+            else {
+                this.declare(`declare zeroext i1 @scr_context_stopping()`);
+                const stopped = this.B.tmp();
+                this.B.line(`${stopped} = call zeroext i1 @scr_context_stopping()`);
+                this.B.condBr(stopped, stop, ordinary);
+                this.B.startBlock(stop);
+            }
             const handlers = this.tryStack;
             this.tryStack = [];
             this.emitUnwind();
@@ -2574,6 +2954,11 @@ export class LlEmitter {
             }
         }
         if (entries.length === 0) {
+            if (passThrough !== undefined && !target && this.currentWasiCoro === null) {
+                const t = this.llType(this.currentReturnType);
+                if (t === "double" || t === "i1")
+                    terminator = `ret ${t} ${passThrough}`;
+            }
             this.B.terminate(terminator);
             return;
         }
@@ -2584,27 +2969,250 @@ export class LlEmitter {
         }
         this.B.br(cleanup.label);
     }
+    /** Loads the running thread's exact pending word (ELF worker
+     * executables, scr_exception.c): bit 0 mirrors the active cell, bit 1
+     * requests the context's stop. It lives in the executable's static TLS
+     * block, so the access is one thread-pointer-relative load. Monotonic by
+     * default: a loop must not hoist the load out and miss a cross-thread
+     * stop (see emitPendingCheck for the unordered tests). */
+    loadExcFlag(unordered = false) {
+        this.declare(`@scr_exc_flag = external thread_local(localexec) global i32, align 4`);
+        const word = this.B.tmp();
+        this.B.line(`${word} = load atomic i32, ptr @scr_exc_flag ${unordered ? "unordered" : "monotonic"}, align 4`);
+        return word;
+    }
+    /** Instructions (two-space indented) that set the i1 `dest` to "an
+     * exception is pending in the active context" — scr_exc_pending()'s
+     * meaning — for the helper and adapter bodies that test it outside
+     * emitPendingCheck. Executables read the runtime's exported active-cell
+     * pointer and compare its i32 kind (offset 0) against SCR_EXC_NONE inline,
+     * as emitPendingCheck does; the out-of-line call would be opaque to LLVM
+     * because the runtime links as prebuilt objects. Libraries and worker
+     * programs keep the runtime call, which is emitPendingCheck's path there
+     * too (workers also observe cross-thread termination in it). */
+    pendingTestLines(dest) {
+        if (this.mod.lib !== undefined || this.mod.workers === true) {
+            this.declare(`declare zeroext i1 @scr_exc_pending()`);
+            return [`  ${dest} = call zeroext i1 @scr_exc_pending()`];
+        }
+        this.declare(`@scr_exc_active = external global ptr`);
+        return [
+            `  ${dest}.cell = load ptr, ptr @scr_exc_active`,
+            `  ${dest}.kind = load i32, ptr ${dest}.cell`,
+            `  ${dest} = icmp ne i32 ${dest}.kind, 0`,
+        ];
+    }
     /** The emitter contract for exceptions: after EVERY call that can throw
      * (per the may-throw analysis), test the pending flag and unwind. The
      * call's result temp must join its frame BEFORE this runs so the unwind
-     * releases the dummy (NULL for refcounted kinds) harmlessly. */
-    emitPendingCheck() {
+     * releases the dummy (NULL for refcounted kinds) harmlessly. A scalar
+     * call result of the function's return type may be passed as the unwind's
+     * dummy value (see emitUnwind). `poll` marks a worker termination poll
+     * (function entry or loop budget), whose test must stay ordered. */
+    emitPendingCheck(passThrough, poll = false) {
+        const through = passThrough !== undefined &&
+            this.llType(passThrough.type) === this.llType(this.currentReturnType) &&
+            (passThrough.type.kind === "f64" || passThrough.type.kind === "bool")
+            ? passThrough.name
+            : undefined;
         const B = this.B;
         if (B.isTerminated())
             return;
-        this.declare(`declare zeroext i1 @scr_exc_pending()`);
-        const p = B.tmp();
-        B.line(`${p} = call zeroext i1 @scr_exc_pending()`);
+        if (this.mod.lib !== undefined) {
+            this.declare(`declare zeroext i1 @scr_exc_pending()`);
+            const p = B.tmp();
+            B.line(`${p} = call zeroext i1 @scr_exc_pending()`);
+            const lu = B.newLabel("exc.u");
+            const lk = B.newLabel("exc.k");
+            B.condBr(p, lu, lk);
+            B.startBlock(lu);
+            this.emitUnwind(through);
+            B.startBlock(lk);
+            return;
+        }
+        // Executables test the active exception cell's kind inline (its first
+        // field). ELF worker executables test the thread's exact pending word,
+        // which is also nonzero once the context must stop, and unwind directly:
+        // no site carries an out-of-line call, so LLVM's inliner sees the check
+        // as two instructions. Other worker programs test the process-wide
+        // alert word: it is nonzero while any script thread may have an
+        // exception pending in its active cell or has been asked to stop, so
+        // the common case is one ordinary global load (a thread-local access is
+        // a call on Darwin) and the out-of-line scr_exc_pending answers for this
+        // thread, observing cancellation and reinstalling the termination
+        // sentinel.
+        this.declare(`declare i1 @llvm.expect.i1(i1, i1)`);
+        let word;
+        const exact = this.mod.workers !== true || this.executableTls;
+        if (this.executableTls) {
+            // Termination stays observable where the polls were dropped for it:
+            // polls, tests inside source loops (exc's loop-poll rule relies on
+            // them every iteration) and tail-position tests (a dead ordered load
+            // keeps recursion from becoming a loop without stack growth) use an
+            // ordered load, which LLVM never deletes, hoists or merges. Every
+            // other test is an unordered load: it reads the same word, but LLVM's
+            // memory analyses no longer treat it as a write, so loads around it
+            // stay forwardable after inlining. Same-thread changes only happen in
+            // runtime calls, which clobber memory.
+            word = this.loadExcFlag(!poll && through === undefined && this.loopDepth === 0);
+        }
+        else if (this.mod.workers === true) {
+            // dso_local: executables link the runtime statically, so the word is
+            // addressed directly instead of through the GOT.
+            this.declare(`@scr_exc_alert = external dso_local global i32, align 64`);
+            word = B.tmp();
+            B.line(`${word} = load atomic i32, ptr @scr_exc_alert monotonic, align 64`);
+        }
+        else {
+            this.declare(`@scr_exc_active = external global ptr`);
+            let cell;
+            if (B.excCellInvariant) {
+                // Fiber switches restore the active cell before control returns to a
+                // synchronous frame, so its pointer is one value for the whole call:
+                // load it once in the entry block and test only the kind here.
+                if (B.excCell === null) {
+                    B.excCell = "%exc.cell";
+                    B.entryAllocas.push(`${B.excCell} = load ptr, ptr @scr_exc_active`);
+                }
+                cell = B.excCell;
+            }
+            else {
+                cell = B.tmp();
+                B.line(`${cell} = load ptr, ptr @scr_exc_active`);
+            }
+            word = B.tmp();
+            B.line(`${word} = load i32, ptr ${cell}`);
+        }
+        const hit = B.tmp();
+        const cold = B.tmp();
+        B.line(`${hit} = icmp ne i32 ${word}, 0`);
+        B.line(`${cold} = call i1 @llvm.expect.i1(i1 ${hit}, i1 false)`);
         const lu = B.newLabel("exc.u");
         const lk = B.newLabel("exc.k");
-        B.condBr(p, lu, lk);
+        if (!exact) {
+            this.declare(`declare zeroext i1 @scr_exc_pending()`);
+            const slow = B.newLabel("exc.s");
+            B.condBr(cold, slow, lk);
+            B.startBlock(slow);
+            const p = B.tmp();
+            B.line(`${p} = call zeroext i1 @scr_exc_pending()`);
+            B.condBr(p, lu, lk);
+        }
+        else {
+            B.condBr(cold, lu, lk);
+        }
         B.startBlock(lu);
-        this.emitUnwind();
+        this.emitUnwind(through);
         B.startBlock(lk);
     }
-    workerLoopBudget() {
+    /** After a runtime call that ALWAYS leaves an exception pending (the
+     * compiler-resolved Node throws): the pending test would always answer
+     * true, so unwind unconditionally. Emission continues in a block with no
+     * predecessors so the caller's remaining instructions stay well-formed;
+     * LLVM deletes it. */
+    emitAlwaysPendingUnwind() {
+        const B = this.B;
+        if (B.isTerminated())
+            return;
+        this.emitUnwind();
+        B.startBlock(B.newLabel("exc.dead"));
+    }
+    /** A recursive function's entry check: below the running stack's guard,
+     * throw Node's RangeError and unwind like any other pending exception. */
+    emitStackCheck() {
+        const B = this.B;
+        this.declare(`declare ptr @llvm.stacksave.p0()`);
+        this.declare(`declare i1 @llvm.expect.i1(i1, i1)`);
+        this.declare(`declare void @scr_stack_overflow()`);
+        const over = B.newLabel("stack.over");
+        const ok = B.newLabel("stack.ok");
+        const sp = B.tmp();
+        B.line(`${sp} = call ptr @llvm.stacksave.p0()`);
+        const test = (guard) => {
+            const low = B.tmp();
+            const cold = B.tmp();
+            B.line(`${low} = icmp ult ptr ${sp}, ${guard}`);
+            B.line(`${cold} = call i1 @llvm.expect.i1(i1 ${low}, i1 false)`);
+            B.condBr(cold, over, ok);
+        };
+        if (this.stackGuardTsd !== null) {
+            // A Darwin thread-local access is a call to its TLV thunk: read the
+            // guard from its thread-specific-data slot at the runtime-validated
+            // offset instead, and call out only when the runtime found no slot.
+            this.declare(`@scr_stack_guard_tsd = external dso_local global i64`);
+            this.declare(`declare i64 @scr_stack_guard_get()`);
+            const offset = B.tmp();
+            const direct = B.tmp();
+            const likely = B.tmp();
+            B.line(`${offset} = load i64, ptr @scr_stack_guard_tsd`);
+            B.line(`${direct} = icmp ne i64 ${offset}, 0`);
+            B.line(`${likely} = call i1 @llvm.expect.i1(i1 ${direct}, i1 true)`);
+            const fast = B.newLabel("stack.tsd");
+            const slow = B.newLabel("stack.tlv");
+            B.condBr(likely, fast, slow);
+            B.startBlock(fast);
+            const guard = B.tmp();
+            if (this.stackGuardTsd === "aarch64") {
+                this.declare(`declare i64 @llvm.read_register.i64(metadata)`);
+                const thread = B.tmp();
+                const base = B.tmp();
+                const slot = B.tmp();
+                const address = B.tmp();
+                B.line(`${thread} = call i64 @llvm.read_register.i64(metadata !{!"tpidrro_el0"})`);
+                B.line(`${base} = and i64 ${thread}, -8`);
+                B.line(`${slot} = add i64 ${base}, ${offset}`);
+                B.line(`${address} = inttoptr i64 ${slot} to ptr`);
+                B.line(`${guard} = load ptr, ptr ${address}`);
+            }
+            else {
+                const address = B.tmp();
+                B.line(`${address} = inttoptr i64 ${offset} to ptr addrspace(256)`);
+                B.line(`${guard} = load ptr, ptr addrspace(256) ${address}`);
+            }
+            test(guard);
+            B.startBlock(slow);
+            // uintptr_t scr_stack_guard_get(void): an i64 in the C ABI.
+            const raw = B.tmp();
+            const fallback = B.tmp();
+            B.line(`${raw} = call i64 @scr_stack_guard_get()`);
+            B.line(`${fallback} = inttoptr i64 ${raw} to ptr`);
+            test(fallback);
+        }
+        else {
+            const tl = this.mod.workers === true ? "thread_local " : "";
+            this.declare(`@scr_stack_guard = external ${tl}global ptr`);
+            const guard = B.tmp();
+            B.line(`${guard} = load ptr, ptr @scr_stack_guard`);
+            test(guard);
+        }
+        B.startBlock(over);
+        B.line(`call void @scr_stack_overflow()`);
+        this.emitUnwind();
+        B.startBlock(ok);
+    }
+    /** Whether the emitter follows this call with a pending test (the
+     * conditions in expr-calls.ts). */
+    callTestsPending(e) {
+        switch (e.kind) {
+            case "call":
+                return this.mayThrow.has(e.callee);
+            case "new":
+                return this.mayThrow.has(`%${e.className}.constructor`);
+            case "virtualCall":
+                return this.mayThrowMethods.has(e.method);
+            case "callValue":
+                return this.indirectMayThrow;
+            default:
+                return false;
+        }
+    }
+    workerLoopBudget(loop) {
         if (!this.mod.workers)
             return null;
+        // A loop that runs a pending test on every iteration observes a
+        // terminate request through it; a separate poll would only add work.
+        if (loopTestsEveryIteration(loop, (e) => this.callTestsPending(e)))
+            return null;
         const slot = this.B.slot();
         this.B.entryAllocas.push(`${slot} = alloca i32 ; worker cancellation budget`);
         this.B.line(`store i32 0, ptr ${slot}`);
@@ -2626,7 +3234,7 @@ export class LlEmitter {
         // Calls and throwing operations retain their own checks. Amortize the
         // extra cancellation poll across bounded loop batches so scalar work
         // does not cross the runtime ABI on every iteration.
-        this.emitPendingCheck();
+        this.emitPendingCheck(undefined, true);
         B.br(next);
         B.startBlock(next);
     }
@@ -2699,6 +3307,11 @@ export class LlEmitter {
             const def = this.unionsById.get(v.type.unionId);
             if (!def)
                 throw new InternalCompilerError(`llvm emitter bug: truthiness of unknown union ${v.type.unionId}`);
+            const nullable = this.nullableUnions.get(def.id);
+            // Object arms are always truthy: present iff neither unit encoding.
+            if (nullable && isObjectArm(nullable))
+                return emitNullablePresent(B, nullable, v.name);
+            const unionId = def.id;
             const slot = B.slot();
             B.entryAllocas.push(`${slot} = alloca i1`);
             const join = B.newLabel("ut.j");
@@ -2711,10 +3324,10 @@ export class LlEmitter {
                     valueName = this.unionGetBool(v.name);
                 }
                 else if (arm.kind === "string") {
-                    valueName = this.unionPeek(v.name);
+                    valueName = this.unionPeek(v.name, unionId);
                 }
                 else if (arm.kind === "bigint" || arm.kind === "dyn" || arm.kind === "jsval") {
-                    valueName = this.unionPeek(v.name);
+                    valueName = this.unionPeek(v.name, unionId);
                 }
                 const truthy = this.truthyOf(arm.kind, valueName, true);
                 B.line(`store i1 ${truthy}, ptr ${slot}`);
@@ -2820,22 +3433,22 @@ export class LlEmitter {
         }
     }
     // ── union plumbing ──────────────────────────────────────────────────────
-    /** Loads a union box's tag (i32). */
-    unionTag(uName) {
-        const p = this.B.tmp();
-        const t = this.B.tmp();
-        this.B.line(`${p} = getelementptr inbounds %ScrUnion, ptr ${uName}, i64 0, i32 1`);
-        this.B.line(`${t} = load i32, ptr ${p}`);
-        return t;
+    /** A union value's tag (i32): the box's tag word, or the NULL test of a
+     * nullable union's pointer. */
+    unionTag(uName, unionId) {
+        return emitUnionTag(this.B, this.nullableUnions.get(unionId), uName);
+    }
+    /** Guard for helpers that build or read a union's `%ScrUnion` box
+     * directly (library-shaped unions with fixed arms): a nullable union
+     * reaching one is an emitter bug, never a silent miscompile. */
+    requireBoxedUnion(unionId) {
+        if (this.nullableUnions.has(unionId))
+            throw new InternalCompilerError(`llvm emitter bug: nullable union ${unionId} reached a tagged-box helper`);
     }
     /** The BORROWED payload pointer of a ref arm (scr_union_peek inlined —
-     * the runtime's is a static inline). */
-    unionPeek(uName) {
-        const p = this.B.tmp();
-        const t = this.B.tmp();
-        this.B.line(`${p} = getelementptr inbounds %ScrUnion, ptr ${uName}, i64 0, i32 5`);
-        this.B.line(`${t} = load ptr, ptr ${p}`);
-        return t;
+     * the runtime's is a static inline); a nullable union is its payload. */
+    unionPeek(uName, unionId) {
+        return emitUnionPeek(this.B, this.nullableUnions.get(unionId), uName);
     }
     /** Emits `switch` over a union's tag with one block per arm; each arm
      * body must TERMINATE its block (the callers branch to a join). The
@@ -2843,7 +3456,7 @@ export class LlEmitter {
      * reads can group equivalent storage prefixes and emit one representative. */
     unionTagSwitch(uName, def, arm, fieldGroups) {
         const B = this.B;
-        const tag = this.unionTag(uName);
+        const tag = this.unionTag(uName, def.id);
         const bad = B.newLabel("u.bad");
         const labels = [];
         if (fieldGroups) {
@@ -2889,12 +3502,12 @@ export class LlEmitter {
     /** The +1 extraction of a union's single narrowed arm (unionNarrow /
      * the nullish-family reads): scalars via inline payload loads, ref arms
      * a retained peek. */
-    unionExtract(uName, arm) {
+    unionExtract(uName, unionId, arm) {
         if (arm.kind === "f64" || arm.kind === "procStream")
             return this.unionGetF64(uName);
         if (arm.kind === "bool")
             return this.unionGetBool(uName);
-        return this.retainValue(this.unionPeek(uName), arm);
+        return this.retainValue(this.unionPeek(uName, unionId), arm);
     }
     /** A scalar f64 arm's payload (scr_union_get_f64 inlined). Inline loads
      * keep stack boxes free of escaping calls, so LLVM can scalarize them. */
@@ -2918,8 +3531,15 @@ export class LlEmitter {
     /** Constructs a union box around an OWNED (+1, already moved) value —
      * the scr_union_new_* dispatch of unionWrap and the wrap-into-join
      * sites (shift). */
-    unionNewOwned(tag, v) {
+    unionNewOwned(unionId, tag, v) {
         const B = this.B;
+        const nullable = this.nullableUnions.get(unionId);
+        if (nullable) {
+            // The owned payload IS the nullable union's value.
+            if (tag !== nullable.refTag)
+                throw new InternalCompilerError(`llvm emitter bug: payload wrap into unit arm ${tag} of ${unionId}`);
+            return v.name;
+        }
         const t = B.tmp();
         if (v.type.kind === "f64" || v.type.kind === "procStream") {
             this.declare(`declare ptr @scr_union_new_f64(i32, double)`);
@@ -3062,6 +3682,42 @@ export class LlEmitter {
         B.line(`${z} = zext i1 ${value} to i8`);
         B.line(`store i8 ${z}, ptr ${ptr}${this.fieldAliasAttachment(ptr)}`);
     }
+    /** Reads an int32-specialized class field: the i32 slot is the value,
+     * and its widening is the exact double every program observation sees. */
+    loadInt32Field(ptr, type) {
+        const B = this.B;
+        const raw = B.tmp();
+        const number = B.tmp();
+        B.line(`${raw} = load i32, ptr ${ptr}${this.fieldAliasAttachment(ptr)}`);
+        B.line(`${number} = sitofp i32 ${raw} to double`);
+        return {
+            name: number,
+            type,
+            uint32: raw,
+            integer: { name: raw, type: "i32", signed: true, range: INT32_RANGE },
+        };
+    }
+    /** Stores a value the whole-program analysis proved to be an int32 (never
+     * -0, NaN or fractional) into an int32-specialized class field. */
+    storeInt32Field(ptr, value, expr) {
+        if (!this.int32Slots.provenWrites.has(expr))
+            throw new InternalCompilerError("llvm emitter bug: unproven int32 field write");
+        const B = this.B;
+        let bits;
+        if (value.integer?.type === "i32")
+            bits = value.integer.name;
+        else if (value.integer) {
+            bits = B.tmp();
+            B.line(`${bits} = trunc i64 ${value.integer.name} to i32`);
+        }
+        else if (value.uint32 !== undefined)
+            bits = value.uint32;
+        else {
+            bits = B.tmp();
+            B.line(`${bits} = fptosi double ${value.name} to i32`);
+        }
+        B.line(`store i32 ${bits}, ptr ${ptr}${this.fieldAliasAttachment(ptr)}`);
+    }
     // ── bindings ────────────────────────────────────────────────────────────
     /** A binding's storage: a module global, a plain local slot, or a boxed
      * local (the slot holds the capture BOX; access goes through it). */
@@ -3182,18 +3838,38 @@ export class LlEmitter {
         this.declare(`declare void @scr_box_set_ref(ptr, ptr)`);
         B.line(`call void @scr_box_set_ref(ptr ${box}, ptr ${cell})`);
     }
+    /** The payload a TDZ box holds before its declaration runs, when that is
+     * not NULL. A nullable union's value is its arm pointer with NULL as a
+     * unit arm (nullable-unions.ts), so a stored `null`/`undefined` would
+     * read back as the temporal dead zone; such boxes start at the module's
+     * immortal NULLABLE_ABSENT sentinel instead, which no value of the
+     * binding can hold and every RC entry point and the collector skip. */
+    tdzEmptySentinel(t) {
+        if (!this.nullableUnions.of(t))
+            return null;
+        this.needsNullableAbsent = true;
+        this.immortalValues.add(NULLABLE_ABSENT);
+        return NULLABLE_ABSENT;
+    }
     /** The TDZ-guarded read of a boxed binding: an empty payload slot is
      * the temporal dead zone — throw Node's exact catchable ReferenceError
      * (exprs.ts's varRef guard). Scalars then peek the one-element
      * array cell; ref kinds read the box normally (+1). */
-    checkTdz(box, name) {
+    checkTdz(box, t, name) {
         const B = this.B;
         const slotp = B.tmp();
         const slotv = B.tmp();
         const empty = B.tmp();
         B.line(`${slotp} = getelementptr inbounds %ScrBox, ptr ${box}, i64 0, i32 5`);
-        B.line(`${slotv} = load i64, ptr ${slotp}`);
-        B.line(`${empty} = icmp eq i64 ${slotv}, 0`);
+        const sentinel = this.tdzEmptySentinel(t);
+        if (sentinel !== null) {
+            B.line(`${slotv} = load ptr, ptr ${slotp}`);
+            B.line(`${empty} = icmp eq ptr ${slotv}, ${sentinel}`);
+        }
+        else {
+            B.line(`${slotv} = load i64, ptr ${slotp}`);
+            B.line(`${empty} = icmp eq i64 ${slotv}, 0`);
+        }
         this.throwIfUninitialized(empty, name);
         return slotv;
     }
@@ -3230,7 +3906,7 @@ export class LlEmitter {
         B.startBlock(lk);
     }
     tdzBoxRead(box, t, name) {
-        const slotv = this.checkTdz(box, name);
+        const slotv = this.checkTdz(box, t, name);
         const B = this.B;
         const acc = boxAccess(t);
         if (acc === "ref")
@@ -3250,7 +3926,7 @@ export class LlEmitter {
     writeBindingBox(box, local, value, initializes = false, borrowed = false) {
         if (local.tdz) {
             const first = initializes || !local.mutable;
-            const slotv = first ? null : this.checkTdz(box, local.name);
+            const slotv = first ? null : this.checkTdz(box, local.type, local.name);
             const acc = boxAccess(local.type);
             if (acc !== "ref") {
                 if (first)
@@ -3375,6 +4051,9 @@ export class LlEmitter {
     emitFunction(fn) {
         const B = new BlockBuilder();
         this.B = B;
+        // Fiber switches restore the active exception cell before control
+        // returns to a synchronous frame (emitPendingCheck).
+        B.excCellInvariant = fn.async !== true && fn.generator === undefined;
         this.debugScope = this.debug?.function(fn) ?? null;
         B.debugLocation = this.debug?.location(fn.loc, this.debugScope) ?? null;
         this.frames = [];
@@ -3407,6 +4086,7 @@ export class LlEmitter {
         const numericFn = withInitializerBindings(fn, initializerBindings);
         this.numericLocals = new Map(numericFn.locals.map((l) => [l.id, l]));
         this.borrowedParameters.clear();
+        this.reboundOwnerSlots.clear();
         this.projectedParameters.clear();
         const projectedParameterIndexes = this.callLifetimes.parameters.get(fn.name);
         if (projectedParameterIndexes)
@@ -3415,12 +4095,18 @@ export class LlEmitter {
         this.stableCallBindings = this.callLifetimes.bindings.get(fn.name) ?? new Set();
         const borrowedParameterIndexes = this.callLifetimes.borrowed.get(fn.name);
         if (borrowedParameterIndexes) {
+            // Rebound walk parameters borrow too, but only unchanged ones may
+            // serve as stable owners for call arguments and aliases.
             for (const index of borrowedParameterIndexes)
-                this.borrowedParameters.add(fn.params[index].localId);
+                if (!this.walkBorrowsByFunction.get(fn.name)?.has(fn.params[index].localId) &&
+                    !this.reboundByFunction.get(fn.name)?.has(fn.params[index].localId))
+                    this.borrowedParameters.add(fn.params[index].localId);
         }
         this.captureIds = new Set([...(fn.captures ?? []), ...(fn.classCaptures ?? [])].map((c) => c.localId));
         this.integerLoopBindings.clear();
         this.countedLoopsEnabled = this.debug === null && !fn.async && !fn.generator;
+        this.finalFieldBorrows =
+            !fn.async && !fn.generator && constructorClass(fn.name) === null && this.finalFields.size > 0;
         this.byteWindowsEnabled = this.countedLoopsEnabled;
         this.byteWindowEntries =
             this.byteWindowsEnabled && numericFn.locals.some((l) => l.type.kind === "bytes")
@@ -3433,21 +4119,24 @@ export class LlEmitter {
             this.debug === null
                 ? findLoopArrayBorrows(fn, this.callLifetimes, this.referenceEffects, this.optionalArrayReads)
                 : new Set();
-        this.localArrayReads = findLocalArrayReads(fn, this.fnByName, this.unionsById, this.referenceEffects.functions, this.callLifetimes, this.optionalArrayReads, this.loopArrayBorrows);
-        this.callArrayReads = findCallArrayReads(fn, this.optionalArrayReads, this.referenceEffects.functions, this.callLifetimes);
+        this.localArrayReads = findLocalArrayReads(fn, this.fnByName, this.unionsById, this.referenceEffects.functions, this.callLifetimes, this.optionalArrayReads, this.loopArrayBorrows, this.debug === null ? this.referenceEffects : undefined);
+        this.callArrayReads = findCallArrayReads(fn, this.optionalArrayReads, this.referenceEffects.functions, this.callLifetimes, this.debug === null ? this.referenceEffects : undefined);
         this.scalarStringSlices =
             this.debug === null ? findScalarStringSlices(fn, this.callLifetimes) : new Map();
-        this.mapReadLifetimes = findMapReadLifetimes(fn, this.unionsById, this.callLifetimes);
-        this.localStackUnions = findLocalStackUnions(fn, this.callLifetimes, this.unionsById);
-        this.localUnionStorageProofs = findLocalUnionStorage(fn, this.callLifetimes, this.unionsById, (e) => this.nullableFieldGet(e) !== null);
+        this.mapReadLifetimes = findMapReadLifetimes(fn, this.boxedUnionsById, this.callLifetimes);
+        this.localStackUnions = findLocalStackUnions(fn, this.callLifetimes, this.boxedUnionsById);
+        this.localUnionStorageProofs = findLocalUnionStorage(fn, this.callLifetimes, this.boxedUnionsById, (e) => this.nullableFieldGet(e) !== null);
         this.localUnionStorage = new Map();
-        this.integerRanges = analyzeIntegerRanges(numericFn);
+        this.walkBorrows = this.walkBorrowsByFunction.get(fn.name) ?? new Set();
+        this.integerRanges = analyzeIntegerRanges(numericFn, this.int32Slots.facts(fn.name));
         this.bytesBounds = findBytesBounds(numericFn, this.integerRanges);
         this.chainSlots.clear();
         this.finallyStack = [];
         this.tryStack = [];
+        this.loopDepth = 0;
         this.currentReturnType = fn.returnType;
         this.currentGenerator = fn.generator ?? null;
+        this.currentBorrowedReturn = this.borrowedReturns.has(fn.name);
         this.currentWasiCoro = null;
         this.logArgSlots = 0;
         if (this.wasi && (fn.async === true || fn.generator !== undefined)) {
@@ -3551,7 +4240,12 @@ export class LlEmitter {
             const cache = B.slot();
             B.entryAllocas.push(`${cache} = alloca ptr ; lazy box ${this.currentLocals.get(id).name}`);
             B.line(`store ptr null, ptr ${cache}`);
-            fnScope.push({ slot: cache, type: this.currentLocals.get(id).type, boxed: true });
+            fnScope.push({
+                slot: cache,
+                type: this.currentLocals.get(id).type,
+                boxed: true,
+                lazy: true,
+            });
             this.lazyCaptureBoxes.set(id, cache);
             // Environments that finish during the call can share an immortal
             // frame box. Its payload owner is released with the function scope.
@@ -3578,6 +4272,15 @@ export class LlEmitter {
             this.storeIntegerView(p.localId, { name: `%p_${mangleLocal(p.localId)}`, type: p.type });
             if (isRefCounted(p.type) && !borrowed?.has(index))
                 fnScope.push({ slot, type: p.type });
+            if (this.reboundByFunction.get(fn.name)?.has(p.localId) && borrowed?.has(index)) {
+                // The caller's borrow stays in the parameter slot; values the body
+                // assigns are owned here until rebinding or exit releases them.
+                const owner = `${slot}.owner`;
+                B.entryAllocas.push(`${owner} = alloca ptr`);
+                B.line(`store ptr null, ptr ${owner}`);
+                fnScope.push({ slot: owner, type: p.type });
+                this.reboundOwnerSlots.set(p.localId, owner);
+            }
         }
         this.scopes.push(fnScope);
         // Stackful native fibers retain these frames while suspended. The
@@ -3590,8 +4293,10 @@ export class LlEmitter {
             B.line(`call void @scr_stack_enter(ptr %source_frame, ptr ${this.cstr(frame)})`);
             B.returnEpilogue = `call void @scr_stack_leave(ptr %source_frame)`;
         }
-        if (this.mod.workers)
-            this.emitPendingCheck();
+        if (this.stackChecks?.has(fn.name))
+            this.emitStackCheck();
+        if (this.workerEntryPolls?.has(fn.name))
+            this.emitPendingCheck(undefined, true);
         this.emitStmts(fn.body);
         // Implicit exit of a void function: release the function scope unless
         // the body already terminated its final block (return, or a throw
@@ -3662,24 +4367,55 @@ export class LlEmitter {
         const debug = this.debugScope === null ? "" : ` !dbg ${this.debugScope}`;
         const symbol = borrowed ? mangleBorrowedFunction(fn.name) : mangleFunction(fn.name);
         const body = `define internal ${ret} @${symbol}(${params.join(", ")}) ${attrs}${debug} { ; ${fn.name}\n${B.render()}\n}`;
-        return borrowed ? body + "\n" + this.emitOwnedCallAdapter(fn, borrowed) : body;
+        if (!borrowed)
+            return body;
+        const slot = this.implSlotBorrowed(fn.name);
+        const virtual = slot.size > 0 && slot.size !== borrowed.size
+            ? "\n" + this.emitOwnedCallAdapter(fn, borrowed, slot)
+            : "";
+        return body + "\n" + this.emitOwnedCallAdapter(fn, borrowed) + virtual;
     }
     /** Keep the ordinary owned ABI for closures, virtual dispatch, generated
      * runtime adapters and library exports. Only direct IR calls select the
      * borrowing body. Ownership of other parameters moves into that body;
      * borrowed parameters are released here on normal and exceptional exits.
      * The pending exception remains for the adapter's caller to handle. */
-    emitOwnedCallAdapter(fn, borrowed) {
+    /** With `kept`, the virtual adapter of a borrowing slot instead: the
+     * slot's parameters stay borrowed, the body's other borrowed ones are
+     * released here. */
+    emitOwnedCallAdapter(fn, borrowed, kept = NO_BORROWED) {
         const B = new BlockBuilder();
         this.B = B;
         const params = fn.params.map((param, index) => `${this.llType(param.type)} %p${index}`);
         const ret = this.llType(fn.returnType);
         const call = `call ${ret} @${mangleBorrowedFunction(fn.name)}(${params.join(", ")})`;
         B.line(ret === "void" ? call : `%result = ${call}`);
+        // A borrowed result is reachable from the parameters: own it first. A
+        // throwing body returns a null dummy, which needs no owner (and string
+        // or array retains do not accept NULL).
+        let result = "%result";
+        if (this.borrowedReturns.has(fn.name)) {
+            const slot = B.slot();
+            B.entryAllocas.push(`${slot} = alloca ptr`);
+            B.line(`store ptr null, ptr ${slot}`);
+            const present = B.tmp();
+            const own = B.newLabel("result.own");
+            const done = B.newLabel("result.done");
+            B.line(`${present} = icmp ne ptr %result, null`);
+            B.condBr(present, own, done);
+            B.startBlock(own);
+            B.line(`store ptr ${this.retainValue("%result", fn.returnType)}, ptr ${slot}`);
+            B.br(done);
+            B.startBlock(done);
+            result = B.tmp();
+            B.line(`${result} = load ptr, ptr ${slot}`);
+        }
         for (const index of borrowed)
-            this.releaseValue(`%p${index}`, fn.params[index].type);
-        B.terminate(ret === "void" ? "ret void" : `ret ${ret} %result`);
-        return `define internal ${ret} @${mangleFunction(fn.name)}(${params.join(", ")}) ${FN_ATTRS} {\n${B.render()}\n}`;
+            if (!kept.has(index))
+                this.releaseValue(`%p${index}`, fn.params[index].type);
+        B.terminate(ret === "void" ? "ret void" : `ret ${ret} ${result}`);
+        const symbol = kept.size > 0 ? `${mangleBorrowedFunction(fn.name)}.virtual` : mangleFunction(fn.name);
+        return `define internal ${ret} @${symbol}(${params.join(", ")}) ${FN_ATTRS} {\n${B.render()}\n}`;
     }
     /** A local stable binding keeps its value alive while later arguments
      * and the callee execute. A proven local union box cannot escape or be
@@ -3688,6 +4424,46 @@ export class LlEmitter {
     canBorrowCallArgument(value) {
         if (value.kind === "strLit")
             return true;
+        // Class casts reinterpret the same pointer (prefix layouts).
+        if ((value.kind === "upcast" || value.kind === "downcast") &&
+            value.value.type.kind === "object")
+            return this.canBorrowCallArgument(value.value);
+        if (value.kind === "seqExpr") {
+            const guarded = guardedValue(value);
+            return guarded !== null && this.canBorrowCallArgument(guarded);
+        }
+        // A nullable-union wrap reinterprets its payload pointer; an immortal
+        // unit constant needs no owner at all.
+        const wrap = this.borrowableNullableWrap(value);
+        if (wrap === "unit")
+            return true;
+        if (wrap === "ref" && value.kind === "unionWrap")
+            return this.canBorrowCallArgument(value.value);
+        // Checked casts (`x as C`, `x!` on a nullable) lower to a ternary whose
+        // failing arm always throws; the successful arm projects the same
+        // stable owner. The throwing arm's typed dummy owns nothing.
+        if (value.kind === "unionNarrow")
+            return this.canBorrowCallArgument(value.value);
+        if (value.kind === "libCall")
+            return value.fn === "error.nodeThrow";
+        // A final field never changes outside constructors: while its object is
+        // borrowable, so is the field's value. Nullable-pointer fields have no
+        // box to lend and keep their owning path.
+        if (value.kind === "fieldGet" &&
+            this.finalFieldBorrows &&
+            isRefCounted(value.type) &&
+            this.finalFields.isFinal(value.className, value.field) &&
+            !this.nullableFieldGet(value))
+            return this.canBorrowReceiver(value.obj) && this.canBorrowCallArgument(value.obj);
+        if (value.kind === "ternary")
+            return (this.canBorrowReceiver(value.then) &&
+                this.canBorrowReceiver(value.else_) &&
+                this.canBorrowCallArgument(value.then) &&
+                this.canBorrowCallArgument(value.else_));
+        // An optional chain's bound receiver stays unchanged until its body
+        // finishes (see emitReadReceiver).
+        if (value.kind === "chainRecv")
+            return this.chainSlots.has(value.id);
         if (value.kind !== "varRef")
             return false;
         const binding = this.binding(value.localId);
@@ -3729,11 +4505,16 @@ export class LlEmitter {
     emitStmt(s) {
         const previous = this.B.debugLocation;
         this.B.debugLocation = this.debug?.location(s.loc, this.debugScope) ?? null;
+        const loop = s.kind === "while" || s.kind === "doWhile" || s.kind === "for" || s.kind === "forOf";
+        if (loop)
+            this.loopDepth++;
         try {
             this.emitStmtBody(s);
         }
         finally {
             this.B.debugLocation = previous;
+            if (loop)
+                this.loopDepth--;
         }
     }
     emitStmtBody(s) {
@@ -3742,6 +4523,12 @@ export class LlEmitter {
         switch (s.kind) {
             case "varDecl": {
                 const b = this.binding(s.localId);
+                if (this.walkBorrows.has(s.localId) && b.kind === "local") {
+                    // A borrowed walk pointer: no retain now, no release at scope exit.
+                    const v = s.init === null ? "null" : this.emitReadReceiver(s.init).name;
+                    B.line(`store ptr ${v}, ptr ${b.slot}`);
+                    break;
+                }
                 const slice = this.scalarStringSlices.get(s.localId);
                 if (slice) {
                     const snapshot = emitStringSliceSnapshot(this, slice);
@@ -3824,8 +4611,14 @@ export class LlEmitter {
                     B.line(`${box} = ${boxNew} ; let ${b.local.name} (boxed)`);
                     B.line(`store ptr ${box}, ptr ${b.slot}`);
                     this.scopes[this.scopes.length - 1].push({ slot: b.slot, type: b.type, boxed: true });
-                    if (s.init === null)
+                    if (s.init === null) {
+                        // An empty TDZ box whose payload can legitimately be NULL
+                        // starts at its distinct sentinel (tdzEmptySentinel).
+                        const sentinel = b.local.tdz === true ? this.tdzEmptySentinel(b.type) : null;
+                        if (sentinel !== null)
+                            B.line(`store ptr ${sentinel}, ptr ${this.boxSlot(box)}`);
                         break;
+                    }
                     const v = this.emitExpr(s.init);
                     if (isRefCounted(v.type))
                         this.moveTemp(v); // the box takes ownership
@@ -3874,6 +4667,23 @@ export class LlEmitter {
                 break;
             }
             case "assign": {
+                const owner = this.reboundOwnerSlots.get(s.localId);
+                if (owner !== undefined && !this.walkBorrows.has(s.localId)) {
+                    // A rebound borrowed parameter: the new value moves into the owner
+                    // slot, replacing (and releasing) the previous owned value. This
+                    // precedes the in-place string append, which would release the
+                    // caller's borrow.
+                    const param = this.binding(s.localId);
+                    const slot = param.slot;
+                    const v = this.emitExpr(s.value);
+                    this.moveTemp(v);
+                    const old = B.tmp();
+                    B.line(`${old} = load ptr, ptr ${owner}`);
+                    this.releaseValue(old, param.type);
+                    B.line(`store ptr ${v.name}, ptr ${slot}`);
+                    B.line(`store ptr ${v.name}, ptr ${owner}`);
+                    break;
+                }
                 const localStorage = this.localUnionStorage.get(s.localId);
                 if (localStorage) {
                     storeLocalUnion(this, localStorage, s.value);
@@ -3886,6 +4696,11 @@ export class LlEmitter {
                     break;
                 }
                 const b = this.binding(s.localId);
+                if (this.walkBorrows.has(s.localId) && b.kind === "local") {
+                    // Rebinding a borrowed walk pointer releases nothing.
+                    B.line(`store ptr ${this.emitReadReceiver(s.value).name}, ptr ${b.slot}`);
+                    break;
+                }
                 const v = this.emitExpr(s.value);
                 if (b.kind === "global" && !s.initializes)
                     this.checkGlobalTdz(s.localId);
@@ -3907,7 +4722,9 @@ export class LlEmitter {
                 break;
             }
             case "exprStmt":
-                this.emitExpr(s.expr);
+                // A statement-position splice never observes its removed elements.
+                if (!emitDiscardedSplice(this, s.expr))
+                    this.emitDiscarded(s.expr);
                 break;
             case "arraySet": {
                 // Evaluation order matches JS: array, index, then value. Ownership
@@ -3919,19 +4736,43 @@ export class LlEmitter {
                 if (s.arr.type.kind !== "array")
                     throw new InternalCompilerError("llvm emitter bug: arraySet on non-array");
                 const acc = elemAccess(s.arr.type.elem);
+                this.emitPublishedArrayGuard(arr.name, s.arr.type, 0, idx.name);
                 if (acc === "ref")
                     this.moveTemp(v);
                 emitDenseArraySet(this, arr.name, idx, s.index, acc, s.arr.type.elem, v.name);
                 break;
             }
             case "arraySetLength": {
+                // Pop's `length = 0` store on an empty array only matters when the
+                // array can be frozen (published); its operand is a local.
+                if (s.pop === true &&
+                    s.length.kind === "numLit" &&
+                    s.length.value === 0 &&
+                    this.publishedTypes?.containerGuarded(s.arr.type) !== true)
+                    break;
                 const arr = emitBorrowedInput(this, s.arr);
                 const length = this.emitExpr(s.length);
                 if (s.arr.type.kind !== "array")
                     throw new InternalCompilerError("llvm emitter bug: arraySetLength on non-array");
+                this.emitPublishedArrayGuard(arr.name, s.arr.type, s.pop === true ? 2 : 3);
                 this.declare(`declare void @scr_arr_set_len(ptr, double)`);
+                // Assigning the current length (a reused work array reset to where
+                // it already is) changes nothing: the runtime's validation accepts
+                // exactly the value equal to the length (-0 included, NaN never),
+                // and no element is released. Everything else keeps the call.
+                const lenPtr = B.tmp(), len = B.tmp(), lenNumber = B.tmp(), same = B.tmp();
+                const resize = B.newLabel("arr.len.set"), done = B.newLabel("arr.len.done");
+                B.line(`${lenPtr} = getelementptr inbounds %ScrArr, ptr ${arr.name}, i32 0, i32 1`);
+                this.markMemoryPointer(lenPtr, "array:header");
+                B.line(`${len} = load ${this.sizeType}, ptr ${lenPtr}${this.fieldAliasAttachment(lenPtr)}`);
+                B.line(`${lenNumber} = sitofp ${this.sizeType} ${len} to double`);
+                B.line(`${same} = fcmp oeq double ${length.name}, ${lenNumber}`);
+                B.condBr(same, done, resize);
+                B.startBlock(resize);
                 B.line(`call void @scr_arr_set_len(ptr ${arr.name}, double ${length.name})`);
                 this.emitPendingCheck();
+                B.br(done);
+                B.startBlock(done);
                 break;
             }
             case "arraySetUndefined":
@@ -3940,6 +4781,7 @@ export class LlEmitter {
                 const idx = this.emitExpr(s.index);
                 if (s.arr.type.kind !== "array")
                     throw new InternalCompilerError(`llvm emitter bug: ${s.kind} on non-array`);
+                this.emitPublishedArrayGuard(arr.name, s.arr.type, s.kind === "arrayDelete" ? 5 : 0, idx.name);
                 const fn = s.kind === "arraySetUndefined" ? "scr_arr_set_undefined" : "scr_arr_delete";
                 this.declare(`declare ${s.kind === "arrayDelete" ? "zeroext i1" : "void"} @${fn}(ptr, double)`);
                 if (s.kind === "arrayDelete")
@@ -3971,14 +4813,27 @@ export class LlEmitter {
                 // Classes and records share the struct layout, so one emission.
                 const nullable = s.kind === "fieldSet" ? this.nullableFields.get(s.className, s.field) : null;
                 if (nullable && s.kind === "fieldSet") {
-                    const obj = this.emitExpr(s.obj);
+                    const obj = this.emitStableReceiver(s.obj, [s.value]);
+                    // (The guard precedes the value here: the nullable store
+                    // evaluates it itself.)
+                    this.emitPublishedFieldGuard(obj.name, s.className, s.field);
                     this.emitNullableFieldStore(obj.name, s.className, s.field, nullable, s.value);
                     break;
                 }
-                const obj = isRefCounted(s.value.type)
-                    ? this.emitExpr(s.obj)
-                    : this.emitStableReceiver(s.obj, [s.value]);
+                if (s.kind === "fieldSet" && this.int32Slots.isField(s.className, s.field)) {
+                    const obj = this.emitStableReceiver(s.obj, [s.value]);
+                    const v = this.emitExpr(s.value);
+                    this.emitPublishedFieldGuard(obj.name, s.className, s.field);
+                    const { ptr } = this.classFieldPtr(obj.name, s.className, s.field);
+                    this.storeInt32Field(ptr, v, s.value);
+                    break;
+                }
+                const obj = this.emitStableReceiver(s.obj, [s.value]);
                 const v = this.emitExpr(s.value);
+                if (s.kind === "fieldSet")
+                    this.emitPublishedFieldGuard(obj.name, s.className, s.field);
+                else if (this.publishedTypes?.recordGuarded(s.shapeId) === true)
+                    this.emitPublishedFieldGuard(obj.name, null, s.field);
                 const { ptr, type } = s.kind === "fieldSet"
                     ? this.classFieldPtr(obj.name, s.className, s.field)
                     : this.recordFieldPtr(obj.name, s.shapeId, s.field);
@@ -4012,6 +4867,11 @@ export class LlEmitter {
                 // the overflow (key and value released; absent keys no-op).
                 const obj = this.emitExpr(s.obj);
                 const key = this.emitExpr(s.key);
+                if (this.publishedTypes?.recordGuarded(s.shapeId) === true) {
+                    // Node: "Cannot delete property 'k' of #<Object>" (key known at
+                    // run time only; the guard reports the frozen record generically).
+                    this.emitPublishedFieldGuard(obj.name, null, "[key]");
+                }
                 const ovf = this.recordOvfPtr(obj.name, s.shapeId);
                 this.declare(`declare zeroext i1 @scr_map_delete_str(ptr, ptr)`);
                 const t = B.tmp();
@@ -4027,6 +4887,8 @@ export class LlEmitter {
                 const obj = this.emitExpr(s.obj);
                 const key = this.emitExpr(s.key);
                 const v = this.emitExpr(s.value);
+                if (this.publishedTypes?.recordGuarded(s.shapeId) === true)
+                    this.emitPublishedFieldGuard(obj.name, null, "[key]");
                 if (isRefCounted(v.type))
                     this.moveTemp(v);
                 const shape = this.recordShape(s.shapeId);
@@ -4081,9 +4943,9 @@ export class LlEmitter {
                         B.line(`call void @scr_dyn_release(ptr ${v.name})`);
                         // Mismatched write: TypeError pending, field untouched — the
                         // statement-level check below unwinds.
-                        this.declare(`declare zeroext i1 @scr_exc_pending()`);
                         const pend = B.tmp();
-                        B.line(`${pend} = call zeroext i1 @scr_exc_pending()`);
+                        for (const line of this.pendingTestLines(pend))
+                            B.line(line.trimStart());
                         const lw = B.newLabel("rks.w");
                         B.condBr(pend, join, lw);
                         B.startBlock(lw);
@@ -4191,7 +5053,7 @@ export class LlEmitter {
                 break;
             }
             case "while": {
-                const workerBudget = this.workerLoopBudget();
+                const workerBudget = this.workerLoopBudget(s);
                 const lc = B.newLabel("loop.c");
                 const lb = B.newLabel("loop.b");
                 const le = B.newLabel("loop.e");
@@ -4216,7 +5078,7 @@ export class LlEmitter {
                 break;
             }
             case "doWhile": {
-                const workerBudget = this.workerLoopBudget();
+                const workerBudget = this.workerLoopBudget(s);
                 // Body first (runs at least once); continue jumps to the CONDITION.
                 const lb = B.newLabel("loop.b");
                 const lc = B.newLabel("loop.c");
@@ -4281,12 +5143,39 @@ export class LlEmitter {
                 }
                 let countedJoin = null;
                 if (countedLoop?.guarded) {
-                    const bound = this.emitExpr(countedLoop.limit);
-                    const safe = B.tmp();
+                    let safe = "true";
+                    if (countedLoop.limitGuarded) {
+                        const bound = this.emitExpr(countedLoop.limit);
+                        safe = B.tmp();
+                        B.line(`${safe} = fcmp ${countedLoop.step > 0 ? "ole" : "oge"} double ${bound.name}, ${f64Lit(countedLoop.guardLimit)}`);
+                    }
+                    if (countedLoop.startGuarded) {
+                        // An exact integer of at most 2^53 - 1 in magnitude, and not -0
+                        // (the bit patterns of the value and its round trip agree).
+                        // NaN and infinities fail the ordered range tests.
+                        const start = this.emitExpr(countedLoop.start);
+                        const low = B.tmp(), high = B.tmp(), raw = B.tmp(), wide = B.tmp(), back = B.tmp(), bits = B.tmp(), backBits = B.tmp(), exact = B.tmp(), inRange = B.tmp(), ok = B.tmp();
+                        B.line(`${low} = fcmp oge double ${start.name}, ${f64Lit(-Number.MAX_SAFE_INTEGER)}`);
+                        B.line(`${high} = fcmp ole double ${start.name}, ${f64Lit(Number.MAX_SAFE_INTEGER)}`);
+                        B.line(`${inRange} = and i1 ${low}, ${high}`);
+                        B.line(`${raw} = fptosi double ${start.name} to i64`);
+                        B.line(`${wide} = freeze i64 ${raw}`);
+                        B.line(`${back} = sitofp i64 ${wide} to double`);
+                        B.line(`${bits} = bitcast double ${start.name} to i64`);
+                        B.line(`${backBits} = bitcast double ${back} to i64`);
+                        B.line(`${exact} = icmp eq i64 ${bits}, ${backBits}`);
+                        B.line(`${ok} = and i1 ${inRange}, ${exact}`);
+                        if (safe === "true")
+                            safe = ok;
+                        else {
+                            const both = B.tmp();
+                            B.line(`${both} = and i1 ${safe}, ${ok}`);
+                            safe = both;
+                        }
+                    }
                     const fast = B.newLabel("counted.fast");
                     const slow = B.newLabel("counted.slow");
                     countedJoin = B.newLabel("counted.done");
-                    B.line(`${safe} = fcmp ${countedLoop.step > 0 ? "ole" : "oge"} double ${bound.name}, ${f64Lit(countedLoop.guardLimit)}`);
                     B.condBr(safe, fast, slow);
                     B.startBlock(slow);
                     this.countedLoopsEnabled = false;
@@ -4367,7 +5256,7 @@ export class LlEmitter {
                 };
                 const lu = s.update || capturedLets.length > 0 ? B.newLabel("loop.u") : lc;
                 freshenBindings();
-                const workerBudget = this.workerLoopBudget();
+                const workerBudget = this.workerLoopBudget(s);
                 B.br(lc);
                 B.startBlock(lc);
                 this.emitWorkerLoopCheck(workerBudget);
@@ -4475,7 +5364,7 @@ export class LlEmitter {
                 const lb = B.newLabel("fof.b");
                 const lu = B.newLabel("fof.u");
                 const le = B.newLabel("fof.e");
-                const workerBudget = this.workerLoopBudget();
+                const workerBudget = this.workerLoopBudget(s);
                 B.br(lc);
                 B.startBlock(lc);
                 this.emitWorkerLoopCheck(workerBudget);
@@ -4494,7 +5383,7 @@ export class LlEmitter {
                     B.line(`${lenPtr} = getelementptr inbounds %ScrArr, ptr ${arr.name}, i32 0, i32 1`);
                     this.markMemoryPointer(lenPtr, "array:header");
                     B.line(`${rawLen} = load ${this.sizeType}, ptr ${lenPtr}${this.fieldAliasAttachment(lenPtr)}`);
-                    B.line(`${len} = uitofp ${this.sizeType} ${rawLen} to double`);
+                    B.line(`${len} = sitofp ${this.sizeType} ${rawLen} to double`);
                     B.line(`${inBounds} = fcmp olt double ${i}, ${len}`);
                     cur = i;
                 }
@@ -4611,7 +5500,12 @@ export class LlEmitter {
                 // the actual ret. The parked value owns a synthetic slot-backed
                 // scope entry during each copy so a throwing finally releases it.
                 let v = null;
-                if (s.value !== null) {
+                if (s.value !== null && this.currentBorrowedReturn) {
+                    // A borrowed-return body hands back its walk without a reference
+                    // (it has no try statements, so no finally can intervene).
+                    v = this.emitReadReceiver(s.value);
+                }
+                else if (s.value !== null) {
                     v = this.emitExpr(s.value);
                     this.moveTemp(v);
                 }
@@ -4986,24 +5880,62 @@ export class LlEmitter {
         return emitLiteralExpr(this, e);
     }
     emitOperatorExpr(e) {
-        if (e.kind === "seqExpr") {
-            // Saved operands can feed later call arguments. Transfer ownership
-            // to this expression's frame so they survive those reads and still
-            // die on the path that created them, including inside lazy branches.
-            this.scopes.push([]);
-            const result = emitBorrowedFieldSequence(this, e) ?? emitOperatorExpr(this, e);
-            for (const local of this.scopes.pop()) {
-                this.currentFrame().push({
-                    name: local.slot,
-                    type: local.type,
-                    slot: true,
-                    ...(local.boxed ? { boxed: true } : {}),
-                });
-            }
-            return result;
-        }
+        if (e.kind === "seqExpr")
+            return this.emitSequence(() => emitBorrowedFieldSequence(this, e) ?? emitOperatorExpr(this, e));
         return emitOperatorExpr(this, e);
     }
+    /** Saved operands can feed later call arguments. Transfer ownership of a
+     * sequence's locals to this expression's frame so they survive those
+     * reads and still die on the path that created them, including inside
+     * lazy branches. */
+    emitSequence(body) {
+        this.scopes.push([]);
+        const result = body();
+        for (const local of this.scopes.pop()) {
+            this.currentFrame().push({
+                name: local.slot,
+                type: local.type,
+                slot: true,
+                ...(local.boxed ? { boxed: true } : {}),
+            });
+        }
+        return result;
+    }
+    /** A statement-position expression whose value is dropped. When a
+     * sequence's result only reads an unchanged local (a derived
+     * constructor's `super()` evaluates to `this`), its statements still run
+     * in place, but the result is neither retained nor released. */
+    /** Whether a discarded value can be skipped entirely: a borrowable read
+     * with no effect of its own. canBorrowCallArgument also accepts checked
+     * projections (a ternary or narrow whose failing arm throws, and the
+     * throwing call itself) because a borrowed use still evaluates them;
+     * skipping those would drop the throw. */
+    discardableRead(value) {
+        if (value.kind === "libCall" || value.kind === "ternary" || value.kind === "unionNarrow")
+            return false;
+        if ((value.kind === "upcast" || value.kind === "downcast" || value.kind === "unionWrap") &&
+            !this.discardableRead(value.value))
+            return false;
+        if (value.kind === "seqExpr") {
+            const guarded = guardedValue(value);
+            if (guarded === null || !this.discardableRead(guarded))
+                return false;
+        }
+        return this.canBorrowCallArgument(value);
+    }
+    emitDiscarded(e) {
+        if (e.kind === "seqExpr" &&
+            isRefCounted(e.result.type) &&
+            e.result.kind !== "strLit" &&
+            this.discardableRead(e.result)) {
+            this.emitSequence(() => {
+                for (const s of e.stmts)
+                    this.emitStmt(s);
+            });
+            return;
+        }
+        this.emitExpr(e);
+    }
     emitControlExpr(e) {
         return emitControlExpr(this, e);
     }
@@ -5017,8 +5949,17 @@ export class LlEmitter {
      * value, making the snapshot unique unless a real observable alias exists.
      */
     emitStringSelfConcatAssign(localId, left, suffix, retainForYield) {
+        const moved = this.emitMovedSelfConcat(localId, left, suffix, retainForYield);
+        if (moved)
+            return moved;
         const snapshot = this.emitExpr(left);
-        const right = this.emitExpr(suffix);
+        // A suffix of several parts, or a number, appends each operand to the
+        // snapshot directly (in place once the binding lets go of it) instead
+        // of first building the suffix as a separate string.
+        const parts = stringParts(suffix);
+        const mixed = parts.length > 1 || numberPart(parts[0]) !== null;
+        const inputs = mixed ? emitConcatInputs(this, parts) : [];
+        const right = mixed ? null : this.emitExpr(suffix);
         const b = this.binding(localId);
         const B = this.B;
         if (b.kind === "boxed") {
@@ -5031,9 +5972,15 @@ export class LlEmitter {
             B.line(`store ptr null, ptr ${b.slot}`);
             this.releaseValue(old, b.type);
         }
-        this.declare(`declare ptr @scr_str_concat(ptr, ptr)`);
-        const raw = B.tmp();
-        B.line(`${raw} = call ptr @scr_str_concat(ptr ${snapshot.name}, ptr ${right.name})`);
+        let raw;
+        if (right === null) {
+            raw = emitMixedConcat(this, snapshot.name, inputs);
+        }
+        else {
+            this.declare(`declare ptr @scr_str_concat(ptr, ptr)`);
+            raw = B.tmp();
+            B.line(`${raw} = call ptr @scr_str_concat(ptr ${snapshot.name}, ptr ${right.name})`);
+        }
         const result = this.own({ name: raw, type: left.type });
         if (retainForYield) {
             const stored = this.retainValue(result.name, result.type);
@@ -5051,6 +5998,43 @@ export class LlEmitter {
         }
         return result;
     }
+    /** `local = local + suffix` when the suffix cannot read or write the
+     * local (an unboxed binding is only reachable through this function's own
+     * expressions): reading the binding after the suffix gives the value the
+     * left side had, so it moves into a consuming concat, and the result takes
+     * its place. Null when the general snapshot path is needed. */
+    emitMovedSelfConcat(localId, left, suffix, retainForYield) {
+        const b = this.binding(localId);
+        if (retainForYield ||
+            b.kind !== "local" ||
+            b.local === undefined ||
+            b.local.boxed ||
+            b.local.tdz ||
+            b.type.kind !== "string" ||
+            left.kind !== "varRef" ||
+            left.localId !== localId ||
+            mentionsLocal(suffix, localId))
+            return null;
+        const parts = stringParts(suffix);
+        const mixed = parts.length > 1 || numberPart(parts[0]) !== null;
+        const inputs = mixed ? emitConcatInputs(this, parts) : [];
+        const right = mixed ? null : this.emitExpr(suffix);
+        this.materializeSplitLocal(localId);
+        const B = this.B;
+        const head = B.tmp();
+        B.line(`${head} = load ptr, ptr ${b.slot}`);
+        let raw;
+        if (right === null) {
+            raw = emitMixedConcat(this, head, inputs, true);
+        }
+        else {
+            this.declare(`declare ptr @scr_str_concat_move(ptr, ptr)`);
+            raw = B.tmp();
+            B.line(`${raw} = call ptr @scr_str_concat_move(ptr ${head}, ptr ${right.name})`);
+        }
+        B.line(`store ptr ${raw}, ptr ${b.slot}`);
+        return { name: raw, type: left.type }; // moved into the binding
+    }
     emitContainerExpr(e) {
         return emitContainerExpr(this, e);
     }
@@ -5064,8 +6048,152 @@ export class LlEmitter {
         return emitDynamicExpr(this, e);
     }
     emitIntrinsicExpr(e) {
+        if (e.name === "threads.publish")
+            return this.emitPublish(e);
         return emitIntrinsicExpr(this, e);
     }
+    publishWalkersCache = null;
+    /** Per-type publication walkers, created on the first publish. */
+    get publishWalkers() {
+        if (this.publishWalkersCache !== null)
+            return this.publishWalkersCache;
+        const byPre = [...this.classMeta.values()].sort((a, b) => a.pre - b.pre);
+        this.publishWalkersCache = new PublishWalkers({
+            declare: (decl) => this.declare(decl),
+            cstr: (text) => this.cstr(text),
+            sizeType: this.sizeType,
+            tracedShapes: this.tracedShapes,
+            unionsById: this.unionsById,
+            recordsById: this.recordsById,
+            nullableArm: (t) => this.nullableUnions.of(t)?.arm ?? null,
+            classInfo: (className) => {
+                const meta = this.classMetaOf(className);
+                return {
+                    def: meta.def,
+                    hierarchy: meta.hierarchy,
+                    pre: meta.pre,
+                    post: meta.post,
+                    runtimeRooted: meta.root.def.runtime === true,
+                    fields: meta.def.fields.map((f) => ({
+                        name: f.name,
+                        index: classFieldIndex(meta, f.name).index,
+                        type: this.nullableFields.storageType(className, f.name, f.type),
+                    })),
+                };
+            },
+            classesInInterval: (pre, post) => byPre.filter((m) => m.pre >= pre && m.pre <= post).map((m) => m.def.name),
+        });
+        return this.publishWalkersCache;
+    }
+    /** `publish(value)` (@scriptc/threads): makes the graph immortal and
+     * immutable (scr_publish with the static type's walker) and answers the
+     * same value. Throws (pending) when a dyn part is unpublishable. */
+    emitPublish(e) {
+        const value = this.emitExpr(e.args[0]);
+        if (this.B.isTerminated())
+            return value;
+        const lines = this.publishWalkers.emitPublish(value.name, value.type, e.loc);
+        if (lines.length > 0) {
+            for (const line of lines)
+                this.B.line(line.trimStart());
+            // A refusal unwinds while the operand temp still owns its reference.
+            this.emitPendingCheck();
+        }
+        // The result IS the operand: ownership moves to the result temp.
+        if (!isRefCounted(value.type))
+            return { name: value.name, type: e.type };
+        this.moveTemp(value);
+        return this.own({ name: value.name, type: e.type });
+    }
+    /** Branches on "`obj` is published" (rc == SIZE_MAX); leaves the builder
+     * in the cold block and answers the continuation label. */
+    emitPublishedTest(obj) {
+        const B = this.B;
+        const rc = B.tmp(), frozen = B.tmp(), expected = B.tmp();
+        B.line(`${rc} = load ${this.sizeType}, ptr ${obj}`);
+        B.line(`${frozen} = icmp eq ${this.sizeType} ${rc}, -1`);
+        this.declare(`declare i1 @llvm.expect.i1(i1, i1)`);
+        B.line(`${expected} = call i1 @llvm.expect.i1(i1 ${frozen}, i1 false)`);
+        const cold = B.newLabel("pub.frozen"), ok = B.newLabel("pub.ok");
+        B.condBr(expected, cold, ok);
+        B.startBlock(cold);
+        return ok;
+    }
+    publishedNamesSym = null;
+    /** The class-name table the hierarchy field guards index by preorder. */
+    publishedClassNamesDefs() {
+        if (this.publishedNamesSym === null)
+            return [];
+        const metas = [...this.classMeta.values()];
+        const size = metas.reduce((max, m) => Math.max(max, m.pre + 1), 0);
+        const names = new Array(size).fill("ptr null");
+        for (const m of metas)
+            names[m.pre] = `ptr ${this.cstr(m.def.jsName ?? m.def.name)}`;
+        return [
+            `${this.publishedNamesSym} = internal constant [${size} x ptr] [ ${names.join(", ")} ]`,
+            ``,
+        ];
+    }
+    /** The frozen-object guard of a class field or record field store:
+     * Node's "Cannot assign to read only property" TypeError when the target
+     * is published. `className` null means a record (`#<Object>`). */
+    emitPublishedFieldGuard(obj, className, field) {
+        const published = this.publishedTypes;
+        if (published === null)
+            return;
+        if (className !== null && !published.classGuarded(className))
+            return;
+        const B = this.B;
+        const ok = this.emitPublishedTest(obj);
+        let owner;
+        const meta = className === null ? undefined : this.classMeta.get(className);
+        if (meta === undefined)
+            owner = this.cstr("Object");
+        else if (!meta.hierarchy)
+            owner = this.cstr(meta.def.jsName ?? meta.def.name);
+        else {
+            // The DYNAMIC class names the object, as in Node.
+            this.publishedNamesSym ??= "@sc_pub_class_names";
+            const vtp = B.tmp(), vt = B.tmp(), pre = B.tmp(), slot = B.tmp(), name = B.tmp();
+            B.line(`${vtp} = getelementptr inbounds ptr, ptr ${obj}, i64 1`);
+            B.line(`${vt} = load ptr, ptr ${vtp}`);
+            B.line(`${pre} = load ${this.sizeType}, ptr ${vt}`);
+            B.line(`${slot} = getelementptr inbounds ptr, ptr ${this.publishedNamesSym}, ${this.sizeType} ${pre}`);
+            B.line(`${name} = load ptr, ptr ${slot}`);
+            owner = name;
+        }
+        this.declare(`declare void @scr_throw_published_field(ptr, ptr)`);
+        B.line(`call void @scr_throw_published_field(ptr ${this.cstr(field)}, ptr ${owner})`);
+        this.emitUnwind();
+        B.startBlock(ok);
+    }
+    /** The frozen-array guard (scr_throw_published_array's ops): `index` and
+     * `count` are doubles (the written index, the argument count). */
+    emitPublishedArrayGuard(arr, arrType, op, index = f64Lit(0), count = f64Lit(0)) {
+        if (this.publishedTypes?.containerGuarded(arrType) !== true)
+            return;
+        const B = this.B;
+        const ok = this.emitPublishedTest(arr);
+        this.declare(`declare zeroext i1 @scr_throw_published_array(i32, ptr, double, double)`);
+        const threw = B.tmp();
+        B.line(`${threw} = call zeroext i1 @scr_throw_published_array(i32 ${op}, ptr ${arr}, double ${index}, double ${count})`);
+        const unwind = B.newLabel("pub.throw");
+        B.condBr(threw, unwind, ok);
+        B.startBlock(unwind);
+        this.emitUnwind();
+        B.startBlock(ok);
+    }
+    /** The published Map/Set guard: "Cannot modify a published Map/Set". */
+    emitPublishedCollectionGuard(m, t) {
+        if (this.publishedTypes?.containerGuarded(t) !== true)
+            return;
+        const B = this.B;
+        const ok = this.emitPublishedTest(m);
+        this.declare(`declare void @scr_throw_published_collection(i1 zeroext)`);
+        B.line(`call void @scr_throw_published_collection(i1 ${t.kind === "set" ? "true" : "false"})`);
+        this.emitUnwind();
+        B.startBlock(ok);
+    }
     emitSerializationExpr(e) {
         return emitSerializationExpr(this, e);
     }
@@ -5085,6 +6213,13 @@ export class LlEmitter {
             return this.emitExpr(e);
         if (e.kind === "strLit")
             return { name: this.internLiteral(e.value), type: e.type };
+        const guarded = guardedValue(e);
+        if (guarded !== null) {
+            // Throwing guards run in place, exactly as the sequence emits them.
+            for (const s of e.stmts)
+                this.emitStmt(s);
+            return this.emitReadReceiver(guarded);
+        }
         if (e.kind === "varRef") {
             this.materializeSplitLocal(e.localId);
             const binding = this.binding(e.localId);
@@ -5106,7 +6241,32 @@ export class LlEmitter {
             this.B.line(`${value} = load ptr, ptr ${binding.slot}`);
             return { name: value, type: e.type };
         }
-        const read = matchMapRead(e, this.unionsById);
+        if (e.kind === "chainRecv") {
+            // The chain's bind slot holds its receiver unchanged until the body
+            // finishes, owned by the slot itself or by the chain's receiver.
+            const bound = this.chainSlots.get(e.id);
+            if (!bound)
+                throw new InternalCompilerError(`llvm emitter bug: chainRecv "${e.id}" outside its chain`);
+            const value = this.B.tmp();
+            this.B.line(`${value} = load ${this.llType(bound.type)}, ptr ${bound.name}`);
+            return { name: value, type: e.type };
+        }
+        if (e.kind === "arrayGet" && this.canBorrowReceiver(e)) {
+            // The array keeps the element alive until the consumer; a missing
+            // element still traps exactly like the owned read.
+            const slot = this.B.slot();
+            this.B.entryAllocas.push(`${slot} = alloca ptr`);
+            emitBorrowedArrayRead(this, e, slot);
+            const value = this.B.tmp();
+            this.B.line(`${value} = load ptr, ptr ${slot}`);
+            return { name: value, type: e.type };
+        }
+        const wrap = this.borrowableNullableWrap(e);
+        if (wrap === "unit" && e.kind === "unionWrap")
+            return { name: this.unitInstanceRef(e.unionId, e.tag), type: e.type };
+        if (wrap === "ref" && e.kind === "unionWrap")
+            return { name: this.emitReadReceiver(e.value).name, type: e.type };
+        const read = matchMapRead(e, this.boxedUnionsById);
         if (read) {
             const result = emitStackMapRead(this, read);
             if (result.owner)
@@ -5116,11 +6276,19 @@ export class LlEmitter {
         const arrayRead = this.optionalArrayReads.get(e);
         if (arrayRead)
             return emitProjectedArrayRead(this, arrayRead);
-        if (canStackUnion(e, this.unionsById))
+        const narrow = this.checkedNarrows.get(e);
+        const narrowed = narrow ? emitCheckedNarrowReceiver(this, narrow) : null;
+        if (narrowed)
+            return narrowed;
+        if (canStackUnion(e, this.boxedUnionsById))
             return emitStackUnion(this, e).value;
         if (e.kind === "unionNarrow") {
             const union = this.emitUnionProjection(e.value);
-            return { name: this.unionPeek(union.name), type: e.type };
+            return { name: this.unionPeek(union.name, e.unionId), type: e.type };
+        }
+        if ((e.kind === "downcast" || e.kind === "upcast") && e.value.type.kind === "object") {
+            // Prefix layouts: a class cast reads the operand's own pointer.
+            return { name: this.emitReadReceiver(e.value).name, type: e.type };
         }
         // A nullable-pointer field has no box to borrow. Projections use
         // emitUnionProjection; other borrowers get an owned heap box.
@@ -5133,6 +6301,8 @@ export class LlEmitter {
                 return { name: this.loadRecordField(ptr, type), type: e.type };
             }
             const { ptr, type } = this.classFieldPtr(receiver.name, e.className, e.field);
+            if (this.int32Slots.isField(e.className, e.field))
+                return this.loadInt32Field(ptr, e.type);
             return { name: this.loadField(ptr, type), type: e.type };
         }
         if (e.kind === "ternary" && this.canBorrowReceiver(e.then) && this.canBorrowReceiver(e.else_)) {
@@ -5160,6 +6330,8 @@ export class LlEmitter {
             B.line(`${value} = load ptr, ptr ${slot}`);
             return { name: value, type: e.type };
         }
+        if (e.kind === "call" && this.canBorrowReceiver(e))
+            return emitBorrowedResultCall(this, e);
         return this.emitExpr(e);
     }
     /** A private stack union source with an independently owned payload. */
@@ -5171,8 +6343,8 @@ export class LlEmitter {
     isStackUnionSource(e) {
         if (e.type.kind !== "union")
             return false;
-        return (canStackUnion(e, this.unionsById) ||
-            matchMapRead(e, this.unionsById) !== null ||
+        return (canStackUnion(e, this.boxedUnionsById) ||
+            matchMapRead(e, this.boxedUnionsById) !== null ||
             this.optionalArrayReads.get(e) !== null);
     }
     /** The nullable-pointer representation behind a union-typed class field
@@ -5244,7 +6416,10 @@ export class LlEmitter {
         B.br(join);
         B.startBlock(ref);
         const owned = this.retainValue(p, nullable.arm);
-        const box = this.unionNewOwned(nullable.refTag, { name: owned, type: nullable.arm });
+        const box = this.unionNewOwned(nullable.unionId, nullable.refTag, {
+            name: owned,
+            type: nullable.arm,
+        });
         B.line(`store ptr ${box}, ptr ${slot}`);
         B.br(join);
         B.startBlock(join);
@@ -5256,10 +6431,10 @@ export class LlEmitter {
      * box, which stays owned by its existing owner. */
     unionToNullable(u, nullable) {
         const B = this.B;
-        const tag = this.unionTag(u);
+        const tag = this.unionTag(u, nullable.unionId);
         const isRef = B.tmp(), sel = B.tmp();
         B.line(`${isRef} = icmp eq i32 ${tag}, ${nullable.refTag}`);
-        const payload = this.unionPeek(u);
+        const payload = this.unionPeek(u, nullable.unionId);
         B.line(`${sel} = select i1 ${isRef}, ptr ${payload}, ptr null`);
         return this.retainValue(sel, nullable.arm);
     }
@@ -5311,6 +6486,8 @@ export class LlEmitter {
     }
     canBorrowReceiver(e) {
         switch (e.kind) {
+            case "chainRecv":
+                return this.chainSlots.has(e.id);
             case "varRef": {
                 const binding = this.binding(e.localId);
                 return (binding.kind !== "boxed" ||
@@ -5320,20 +6497,166 @@ export class LlEmitter {
                         isRefCounted(e.type)));
             }
             case "unionNarrow":
+            // Class casts reinterpret the same pointer (prefix layouts).
+            case "downcast":
+            case "upcast":
                 return this.canBorrowReceiver(e.value);
             case "fieldGet":
             case "recordGet":
                 return this.canBorrowReceiver(e.obj);
             case "ternary":
                 return this.canBorrowReceiver(e.then) && this.canBorrowReceiver(e.else_);
+            case "seqExpr": {
+                const guarded = guardedValue(e);
+                return guarded !== null && this.canBorrowReceiver(guarded);
+            }
             // The runtime always sets a pending exception; its unreachable
             // typed dummy is null and owns no receiver.
             case "libCall":
                 return e.fn === "error.nodeThrow";
+            case "unionWrap": {
+                const wrap = this.borrowableNullableWrap(e);
+                return wrap === "unit" || (wrap === "ref" && this.canBorrowReceiver(e.value));
+            }
+            // A borrowed-return callee preserves edges, so its result stays
+            // reachable from borrowable arguments until the consumer runs.
+            case "call":
+                return (this.borrowedReturns.has(e.callee) &&
+                    e.args.every((arg) => (!isRefCounted(arg.type) || this.canBorrowReceiver(arg)) &&
+                        this.referenceEffects.preserves(arg)));
+            // A required element read: the (borrowed) array owns the element
+            // while an edge-preserving index computes.
+            case "arrayGet":
+                return (e.arr.type.kind === "array" &&
+                    isRefCounted(e.arr.type.elem) &&
+                    this.canBorrowReceiver(e.arr) &&
+                    this.referenceEffects.preserves(e.index));
             default:
                 return false;
         }
     }
+    /** A reference held as one plain pointer that emitReadReceiver can read
+     * without owning: class instances, records, arrays, strings and
+     * nullable-pointer unions. Tagged union boxes, closures and dynamic
+     * values keep ordinary ownership. */
+    plainReference(type) {
+        switch (type.kind) {
+            case "object":
+            case "record":
+            case "array":
+            case "string":
+                return true;
+            case "union":
+                return this.nullableUnions.has(type.unionId);
+            default:
+                return false;
+        }
+    }
+    /** Functions returning a walk of their borrowed parameters return it
+     * without a reference (+0) from their borrowing body; direct callers
+     * either consume it as a receiver/walk or retain it at once, and the owned
+     * adapter retains before releasing its parameters. Candidates preserve
+     * every heap edge (so the result stays reachable from the arguments),
+     * borrow every reference parameter and return plain pointers. The set
+     * grows to a fixpoint because a call to a borrowed-return function with
+     * walk arguments is itself a walk; walk facts are then recomputed with
+     * the final set, admitting only parameters whose convention borrows. */
+    analyzeBorrowedReturns() {
+        const pointer = (type) => this.plainReference(type);
+        const borrowedIds = (fn) => {
+            const indexes = this.callLifetimes.borrowed.get(fn.name);
+            return new Set(fn.params.filter((_, i) => indexes?.has(i)).map((p) => p.localId));
+        };
+        const hostFor = (fn) => {
+            const allowed = borrowedIds(fn);
+            return {
+                pointerLocal: (local) => pointer(local.type),
+                borrowsWithoutOwning: (e) => this.borrowsWithoutOwning(e),
+                borrowedReturn: (callee) => this.borrowedReturns.has(callee),
+                parameterAllowed: (id) => allowed.has(id),
+            };
+        };
+        const preserving = [...this.fnByName.values()].filter((fn) => this.referenceEffects.functions.has(fn.name));
+        const candidates = preserving.filter((fn) => {
+            if (!pointer(fn.returnType) || fn.async || fn.generator || fn.captures)
+                return false;
+            // A borrowing vtable slot dispatches to the borrowing body (or its
+            // virtual adapter) directly, and virtual callers own the result.
+            if (this.implSlotBorrowed(fn.name).size > 0)
+                return false;
+            const indexes = this.callLifetimes.borrowed.get(fn.name);
+            return (indexes !== undefined &&
+                indexes.size > 0 &&
+                fn.params.every((p, i) => !isRefCounted(p.type) || indexes.has(i)));
+        });
+        for (let changed = true; changed;) {
+            changed = false;
+            for (const fn of candidates) {
+                if (this.borrowedReturns.has(fn.name))
+                    continue;
+                if (!analyzeWalks(fn, hostFor(fn)).returnsWalk)
+                    continue;
+                this.borrowedReturns.add(fn.name);
+                changed = true;
+            }
+        }
+        if (this.borrowedReturns.size === 0)
+            return;
+        for (const fn of preserving) {
+            const walks = analyzeWalks(fn, hostFor(fn)).locals;
+            if (walks.size > 0)
+                this.walkBorrowsByFunction.set(fn.name, walks);
+        }
+    }
+    /** emitReadReceiver produces this node's pointer without acquiring a
+     * reference, given operands (and ternary arms) that do the same: plain
+     * class/record field reads, class casts, nullable-pointer narrows and
+     * wraps, and checked ternaries. Stack-boxed, map-read and boxed-field
+     * sources are owned. Depends only on module facts, not the current
+     * function. */
+    borrowsWithoutOwning(e) {
+        if (!isRefCounted(e.type) || this.isStackUnionSource(e))
+            return false;
+        if (matchMapRead(e, this.boxedUnionsById))
+            return false;
+        switch (e.kind) {
+            case "fieldGet":
+                return this.nullableFieldGet(e) === null;
+            case "recordGet":
+                return true;
+            case "unionNarrow":
+                return this.nullableUnions.has(e.unionId);
+            case "downcast":
+            case "upcast":
+                return e.value.type.kind === "object";
+            case "unionWrap":
+                return this.borrowableNullableWrap(e) !== null;
+            // The caller proves each arm separately.
+            case "ternary":
+                return true;
+            // The caller proves the arguments are walks; their evaluation must not
+            // remove an edge before the call reads them.
+            case "call":
+                return (this.borrowedReturns.has(e.callee) &&
+                    e.args.every((arg) => this.referenceEffects.preserves(arg)));
+            default:
+                return false;
+        }
+    }
+    /** A wrap into a nullable-pointer union is the payload pointer itself
+     * (the reference arm) or an immortal constant (a unit arm), so it can
+     * borrow exactly when its payload can. Void payloads run for effects and
+     * keep the ordinary path; tagged unions still construct a box. */
+    borrowableNullableWrap(e) {
+        if (e.kind !== "unionWrap")
+            return null;
+        const nullable = this.nullableUnions.get(e.unionId);
+        if (!nullable)
+            return null;
+        if (isUnitType(e.value.type))
+            return e.value.kind === "unitLit" ? "unit" : null;
+        return e.tag === nullable.refTag && isRefCounted(e.value.type) ? "ref" : null;
+    }
     materializeSplitLocal(localId) {
         const span = this.splitSpans.get(localId);
         if (span)
@@ -5420,8 +6743,8 @@ export class LlEmitter {
     resolveThunkFor(inner) {
         return resolveThunkFor(this, inner);
     }
-    tagInSet(uName, tags) {
-        return tagInSet(this, uName, tags);
+    tagInSet(uName, unionId, tags) {
+        return tagInSet(this, uName, unionId, tags);
     }
     arrPush(arr, acc, value) {
         return arrPush(this, arr, acc, value);
@@ -5465,8 +6788,8 @@ export class LlEmitter {
     emitBytesLength(elem, receiver, bytes) {
         return emitBytesLength(this, elem, receiver, bytes);
     }
-    emitBytesGet(elem, receiver, index, expr, inBounds = false) {
-        return emitBytesGet(this, elem, receiver, index, expr, inBounds);
+    emitBytesGet(elem, receiver, index, expr, inBounds = false, invalidNaN = false) {
+        return emitBytesGet(this, elem, receiver, index, expr, inBounds, invalidNaN);
     }
     emitToUint32(value, expr, uint32) {
         return emitToUint32(this, value, expr, uint32);