@scriptc/compiler 0.2.8 → 0.2.10

package/dist/backend/llvm/emitter.js

@@ -1,5 +1,5 @@
 import { emitLlvmLayouts } from "./layouts.js";
-import { inlineAllocSupported } from "./alloc.js";
+import { FIRST_EMITTED_CYC_KIND, inlineAllocSupported } from "./alloc.js";
 import { llvmBytes as llBytes } from "../literals.js";
 import { InternalCompilerError } from "../../errors.js";
 /** Lower typed IR to LLVM, using the runtime's C ABI.
@@ -23,6 +23,7 @@ import { createHash } from "node:crypto";
 import { deflateRawSync } from "node:zlib";
 import { endsWithJump, matchStringSelfConcat, streamTypedRefEligible, undefinedArmTag, } from "../../ir/analysis.js";
 import { emitLibraryIdentityLines } from "../library-identity-markers.js";
+import { loopTestsEveryIteration } from "../loop-polls.js";
 import { CAUGHT, ffiCallbackType, isDynTypedRefType, isFfiContextParam, isRefCounted, isUnitType, POINTER_KINDS, RUNTIME_EMITTER_CLASS, RUNTIME_ERROR_CLASSES, RUNTIME_STREAM_CLASSES, typeEquals, typeKey, STRING, VOID, } from "../../ir/ir.js";
 import { moduleRuntimeFeatures, moduleEmbedsBuiltin, moduleEmbedsCompressedNpm, NPM_COMPRESS_MIN, } from "../../ir/runtime-features.js";
 import { matchIntegerArrayForLoop, matchIntegerBytesForLoop, matchIntegerCountedForLoop, } from "../../ir/integer-loops.js";
@@ -35,7 +36,10 @@ import { scalarizeNumericRecords } from "../../ir/scalar-records.js";
 import { specializeNumericCalls } from "../../ir/numeric-call-specialization.js";
 import { everyExprChild, everyStmtChild, everyStmtList } from "../../ir/traverse.js";
 import { analyzeIntegerRanges, INT32_RANGE } from "../../ir/integer-ranges.js";
+import { unshareNodes } from "../../ir/unshare.js";
 import { analyzeInt32Slots } from "../../ir/int32-slots.js";
+import { analyzeFinalFields, constructorClass } from "../../ir/final-fields.js";
+import { foldConstantGlobals } from "../../ir/constant-globals.js";
 import { findIntegerViews } from "./integer-views.js";
 import { findInitializerBindings, withInitializerBindings } from "../../ir/initializer-bindings.js";
 import { findConstantNumericTables } from "../../ir/constant-tables.js";
@@ -53,10 +57,11 @@ import { CheckedNarrows, emitCheckedNarrowReceiver } from "./checked-narrows.js"
 import { emitDenseArrayGet, emitDenseArraySet } from "./dense-array-access.js";
 import { emitStackMapRead, findMapReadLifetimes, matchMapRead, } from "./map-read-lifetimes.js";
 import { emitBorrowedFieldSequence, guardedValue } from "./borrowed-receivers.js";
-import { emitBorrowedInput } from "./borrowed-inputs.js";
+import { borrowableInputs, emitBorrowedInput } from "./borrowed-inputs.js";
 import { analyzeWalks, findWalkBorrows } from "./walk-borrows.js";
 import { findReboundParameters } from "./rebound-parameters.js";
 import { ReferenceEffects } from "./reference-effects.js";
+import { ReferenceWrites } from "./reference-writes.js";
 import { LlvmDebugInfo } from "./debug-info.js";
 import { StackCallbacks } from "./stack-callbacks.js";
 import { findLoopArrayBorrows } from "./loop-array-borrows.js";
@@ -64,7 +69,7 @@ import { AmbientReceiverReaders, findConstantCallbacks } from "./constant-callba
 import { findScalarStringSlices, emitStringSliceSnapshot, } from "./string-slices.js";
 import { LazyCaptures } from "./lazy-captures.js";
 import { StackCaptures } from "./stack-captures.js";
-import { ABSENT_FIELD_PAYLOAD, emitFieldAbsentTest, f64Lit, ffiNativeTypeLl, ffiNativeParamLl, ffiNativeReturnLl, llvmCommentText, } from "./common.js";
+import { ABSENT_FIELD_PAYLOAD, emitFieldAbsentTest, exactIndexLines, f64Lit, ffiNativeTypeLl, ffiNativeParamLl, ffiNativeReturnLl, llvmCommentText, } from "./common.js";
 import { ffiExtendsNarrowIntegers } from "../targets.js";
 import { emitLiteralExpr, emitOperatorExpr, emitStringExpr, emitContainerExpr, emitRecordExpr, } from "./expr-primitives.js";
 import { emitControlExpr } from "./expr-control.js";
@@ -72,6 +77,7 @@ import { emitBorrowedResultCall, emitCallExpr } from "./expr-calls.js";
 import { emitDynamicExpr } from "./expr-dynamic.js";
 import { emitIntrinsicExpr, emitSerializationExpr, emitAsyncExpr } from "./expr-async.js";
 import { PublishWalkers } from "./publish.js";
+import { computeImmutableFields, stableGlobals } from "../immutability.js";
 import { computePublishedTypes } from "../publication.js";
 import { emitJsInteropExpr, emitExpr } from "./expr-dispatch.js";
 import { emitJsMarshal, emitJsOp, emitJsExit, islandAdapter, islandTypedAdapter, } from "./expr-island.js";
@@ -94,7 +100,7 @@ import { LlWalkers } from "./walkers.js";
 import { isObjectArm, NULLABLE_ABSENT, NULLABLE_NULL, NullableUnions } from "./nullable-unions.js";
 import { emitNullablePresent, emitUnionPeek, emitUnionTag } from "./union-repr.js";
 import { literalCapWord, literalCapWord32 } from "./string-key-hash.js";
-import { NUMBER_MAP_ENTRY_DECL } from "./map-number-lookup.js";
+import { NUMBER_MAP_ENTRY_DECL, STRING_MAP_ENTRY_DECL } from "./map-number-lookup.js";
 import { STRING_READ_HELPERS } from "./string-reads.js";
 import { emitConcatInputs, emitMixedConcat, numberPart, stringParts, } from "./string-construction.js";
 import { arrNewCall, boxAccess, boxNewCall, boxReleaseSym, computeTraced, elemAccess, emitInlineRcHelpers, emitNullableRetainWrappers, FN_ATTRS, inlineRcDecls, llFieldType, releaseSym, retainSym, traceArg, typedRefConstructor, vAdapters, } from "./shapes.js";
@@ -124,16 +130,20 @@ function ffiCallbackDummyLl(callback) {
             return "i32 0";
     }
 }
-export function emitLlvmModule(mod, options = {}) {
+export function emitLlvmModule(input, options = {}) {
+    // Facts are keyed by node identity: emit the same module whether it was
+    // lowered in memory or read back from its serialized form.
+    const mod = unshareNodes(input);
     // Keep source storage intact for debugger inspection in dev builds.
     return new LlEmitter(options.debugSources === undefined
-        ? scalarizeNumericRecords(specializeNumericCalls(mod, mangleFunction))
+        ? scalarizeNumericRecords(specializeNumericCalls(foldConstantGlobals(mod), mangleFunction))
         : mod, options).emit();
 }
 /** Keep large translation units below the host's single-string limit. */
-export function emitLlvmModuleSource(mod, options = {}) {
+export function emitLlvmModuleSource(input, options = {}) {
+    const mod = unshareNodes(input);
     const parts = new LlEmitter(options.debugSources === undefined
-        ? scalarizeNumericRecords(specializeNumericCalls(mod, mangleFunction))
+        ? scalarizeNumericRecords(specializeNumericCalls(foldConstantGlobals(mod), mangleFunction))
         : mod, options).emitParts();
     const length = parts.reduce((total, part) => total + part.length, Math.max(0, parts.length - 1));
     if (length <= 256 * 1024 * 1024)
@@ -224,12 +234,27 @@ export class LlEmitter {
     debugScope = null;
     sizeType;
     ffiExtendNarrowIntegers;
-    cycleColorOffset;
+    cycleBufferedOffset;
+    /** Emitted ScrCycType descriptors so far (their collector statistics
+     * indices; see ShapeHost.nextCycKind). */
+    cycKinds = 0;
     wasi;
+    /** The target lacks a rounding instruction at its baseline CPU (x86-64
+     * before SSE4.1), so `llvm.trunc` would lower to a libm call: emit
+     * truncation inline through an integer round trip instead. */
+    inlineTrunc;
     /** ELF worker executables give thread-locals the executable TLS models. */
     executableTls;
+    /** Source loops enclosing the statement being emitted in the current
+     * function body. */
+    loopDepth = 0;
+    /** Darwin worker executables read the stack guard from a pthread
+     * thread-specific-data slot off the thread pointer (scr_runtime.h's
+     * SCR_STACK_GUARD_TSD): the architecture names the access sequence. */
+    stackGuardTsd;
     emitLibraryIdentity;
     runtimeAbiMarker;
+    detachedExit;
     /** Interned string literals: UTF-8 text → { symbol, byte length } —
      * first-use order, the runtime ABI’s determinism discipline. */
     literals = new Map();
@@ -284,6 +309,12 @@ export class LlEmitter {
      * fiberless-async analysis scans it for suspension entry points. */
     fnDefText = new Map();
     referenceEffects;
+    /** Field-sensitive reference writes (null in debug builds). */
+    referenceWrites = null;
+    borrowedReturnKeyCache = new Map();
+    /** The statement list being emitted and the current index, for blocks
+     * whose bindings end with the list (emitBlock and function bodies). */
+    stmtCursor = null;
     optionalArrayReads;
     checkedNarrows;
     callArrayReads = new Map();
@@ -327,6 +358,9 @@ export class LlEmitter {
     ffiHasRetainedCallback;
     ffiHasForeignCallback;
     globalTypes = new Map();
+    /** Module constants that keep one value once initialized
+     * (immutability.ts stableGlobals). */
+    stableGlobals = new Set();
     tdzGlobals = new Map();
     constantNumericTables;
     /** May-throw analysis (computeMayThrow): pending
@@ -342,6 +376,13 @@ export class LlEmitter {
     /** Static types whose values can be published (@scriptc/threads): their
      * stores carry the frozen-object guard. Null without publish calls. */
     publishedTypes;
+    /** Construction-only class and record fields (immutability.ts); null
+     * where the facts are disabled. */
+    immutableFields;
+    /** Constructor function names: their bodies may still write their own
+     * `this`'s construction-only fields. */
+    constructorFunctions;
+    inConstructor = false;
     /** Method names with at least one may-throw implementation — the
      * virtualCall pending check's key. */
     mayThrowMethods = new Set();
@@ -418,11 +459,22 @@ export class LlEmitter {
     initializerBindings;
     /** Whole-program int32 storage and parameter/result facts. */
     int32Slots;
+    /** Immutable module constants (contract types) whose graphs become
+     * immortal once initialized: their reads need no reference counting. */
+    immortalGlobals;
+    /** ProgramLifetime hierarchy roots (contract types): their instances are
+     * immortal from construction (classes.ts programLifetimeClass). */
+    programLifetime;
     numericLocals = new Map();
     captureIds = new Set();
     /** Active induction bindings retain their width independently of size_t. */
     integerLoopBindings = new Map();
     countedLoopsEnabled = false;
+    /** Whole-program final reference fields (ir/final-fields.ts). */
+    finalFields;
+    /** The current function may borrow final fields of borrowable objects:
+     * not a constructor (where they change), not async or a generator. */
+    finalFieldBorrows = false;
     integerRanges = new Map();
     byteWindowsEnabled = true;
     byteWindowEntries = new Map();
@@ -472,22 +524,43 @@ export class LlEmitter {
         this.constantNumericTables = findConstantNumericTables(mod);
         this.initializerBindings = findInitializerBindings(mod);
         this.int32Slots = analyzeInt32Slots(mod);
+        this.immortalGlobals = new Set(mod.contracts?.immortalGlobals ?? []);
+        this.programLifetime = new Set(mod.contracts?.programLifetime ?? []);
+        this.finalFields = analyzeFinalFields(mod);
         this.sizeType = options.pointerBits === 32 ? "i32" : "i64";
         this.ffiExtendNarrowIntegers =
             options.wasi === true || ffiExtendsNarrowIntegers(options.targetTriple);
         this.wasi = options.wasi === true;
+        // An empty triple targets the host, as for executableTls below: the
+        // Node-hosted CLI passes none, the native CLI passes its toolchain's, and
+        // both must emit the same module for the same target.
+        this.inlineTrunc =
+            !this.wasi &&
+                (options.targetTriple
+                    ? /^(x86_64|amd64)\b/i.test(options.targetTriple)
+                    : process.arch === "x64");
         this.executableTls =
             mod.workers === true &&
                 mod.lib === undefined &&
                 !this.wasi &&
                 !/apple|darwin|windows|mingw|cygwin|win32/.test(options.targetTriple || process.platform);
+        const host = options.targetTriple || `${process.arch}-${process.platform}`;
+        this.stackGuardTsd =
+            mod.workers === true && mod.lib === undefined && !this.wasi && /apple|darwin/.test(host)
+                ? /^(arm64|aarch64)/.test(host)
+                    ? "aarch64"
+                    : /^(x86_64|amd64|x64)/.test(host)
+                        ? "x86_64"
+                        : null
+                : null;
         this.emitLibraryIdentity = options.emitLibraryIdentity !== false;
         this.runtimeAbiMarker = options.runtimeAbiMarker === true;
+        this.detachedExit = options.detachedExit === true;
         this.rcHelpers = options.inlineRc === true ? new Set() : null;
-        // ScrCycHdr.color stays 12 bytes behind a wasm32 object and 16 bytes
-        // behind a 64-bit object. The wasm32 header pads before color so its
-        // payload remains double-aligned without changing this ABI offset.
-        this.cycleColorOffset = options.pointerBits === 32 ? 12 : 16;
+        // ScrCycHdr.buffered sits 6 bytes behind every object. The wasm32
+        // header pads before its descriptor so its payload remains
+        // double-aligned without changing this ABI offset.
+        this.cycleBufferedOffset = 6;
         this.ffiCallbackAdapters = allocateFfiCallbackAdapters(mod.ffiImports ?? []);
         this.ffiHasRetainedCallback = hasRetainedFfiCallback(mod.ffiImports ?? []);
         this.ffiHasForeignCallback = hasForeignFfiCallback(mod.ffiImports ?? []);
@@ -507,6 +580,8 @@ export class LlEmitter {
         this.workerEntryPolls = mt.workerEntryPolls ?? null;
         this.stackChecks = mt.stackChecks ?? null;
         this.publishedTypes = computePublishedTypes(mod);
+        this.immutableFields = computeImmutableFields(mod);
+        this.constructorFunctions = new Set((mod.classes ?? []).map((c) => `%${c.name}.constructor`));
         this.indirectMayThrow = mt.indirect || mod.workers === true;
         for (const cls of mod.classes ?? []) {
             for (const m of cls.methods ?? []) {
@@ -522,9 +597,12 @@ export class LlEmitter {
         this.nullableFields = new NullableRefFields(mod.classes ?? [], this.boxedUnionsById);
         // Optional array reads also cover nullable unions: emitLocalArrayRead
         // then yields the (borrowed or owned) element pointer, not a stack box.
-        this.optionalArrayReads = new OptionalArrayReads(this.fnByName, this.unionsById);
+        // Arrays of such a union are read the same way.
+        this.optionalArrayReads = new OptionalArrayReads(this.fnByName, this.unionsById, (id) => this.nullableUnions.has(id));
         this.checkedNarrows = new CheckedNarrows(this.fnByName);
         this.referenceEffects = new ReferenceEffects(this.fnByName, (call) => this.optionalArrayReads.get(call) !== null, mod.classes ?? []);
+        if (this.debug === null)
+            this.referenceWrites = new ReferenceWrites(this.fnByName, mod.classes ?? [], (call) => this.optionalArrayReads.get(call) !== null, new Set((mod.globals ?? []).map((g) => g.id)), { unions: mod.unions, records: mod.records }, this.immutableFields);
         const walkParameters = new Map();
         if (this.debug === null) {
             const host = {
@@ -532,9 +610,10 @@ export class LlEmitter {
                 borrowsWithoutOwning: (e) => this.borrowsWithoutOwning(e),
             };
             for (const fn of this.fnByName.values()) {
-                if (!this.referenceEffects.functions.has(fn.name))
+                const preserving = this.referenceEffects.functions.has(fn.name);
+                if (!preserving && this.referenceWrites === null)
                     continue;
-                const walks = findWalkBorrows(fn, host);
+                const walks = findWalkBorrows(fn, preserving ? host : this.unwrittenWalkHost(fn, host));
                 if (walks.size === 0)
                     continue;
                 this.walkBorrowsByFunction.set(fn.name, walks);
@@ -578,7 +657,7 @@ export class LlEmitter {
         this.tracedUnions = traced.unions;
         this.shapeHost = {
             sizeType: this.sizeType,
-            cycleColorOffset: this.cycleColorOffset,
+            cycleBufferedOffset: this.cycleBufferedOffset,
             tracedShapes: this.tracedShapes,
             tracedUnions: this.tracedUnions,
             nullableUnions: this.nullableUnions,
@@ -595,6 +674,7 @@ export class LlEmitter {
             // paths address its thread-local state.
             threadLocalAlloc: mod.workers === true,
             rcHelpers: this.rcHelpers,
+            nextCycKind: () => FIRST_EMITTED_CYC_KIND + this.cycKinds++,
             unionsById: this.unionsById,
             declare: (decl) => this.declare(decl),
             needOom: () => this.needOom(),
@@ -617,6 +697,7 @@ export class LlEmitter {
             },
             pendingTestLines: (dest) => this.pendingTestLines(dest),
             virtualEntry: (implFn) => this.virtualEntry(implFn),
+            programLifetime: this.programLifetime,
         };
         this.walkers = new LlWalkers(this.shapeHost);
         this.dyn = new LlDyn(this.shapeHost);
@@ -638,6 +719,7 @@ export class LlEmitter {
             if (g.tdz)
                 this.tdzGlobals.set(g.id, g.name);
         }
+        this.stableGlobals = stableGlobals(mod);
         // Runtime error, EventEmitter, and stream classes have known layouts.
         // Subclasses embed the ScrEmitter/ScrStream prefixes from classes.ts.
         const classes = mod.classes ?? [];
@@ -997,14 +1079,16 @@ export class LlEmitter {
         if (!this.executableTls)
             return parts;
         // A worker executable's thread-locals all live in the executable's own
-        // TLS block (the program's internal ones, the runtime's external ones),
-        // so on ELF they can use the executable models: LLVM's default
-        // general-dynamic sequence (relaxed by the linker to `mov %fs:0` plus
-        // an add) becomes one %fs-relative access LLVM can fold into loads.
-        // Darwin's thread-local variables have a single model.
+        // TLS block: the program's internal ones, and the runtime's external
+        // ones, because the runtime is always linked statically into the
+        // executable. So on ELF they can all use the local-exec model: LLVM's
+        // default general-dynamic sequence (relaxed by the linker to `mov %fs:0`
+        // plus an add), and even initial-exec (relaxed to `mov $offset` plus an
+        // indexed access), become one %fs-relative operand LLVM can fold into
+        // loads and compares. Darwin's thread-local variables have one model.
         return parts.map((part) => part
             .replace(/^(@[-$._A-Za-z0-9]+ = internal )thread_local global /gm, "$1thread_local(localexec) global ")
-            .replace(/^(@[-$._A-Za-z0-9]+ = external )thread_local global /gm, "$1thread_local(initialexec) global "));
+            .replace(/^(@[-$._A-Za-z0-9]+ = external )thread_local global /gm, "$1thread_local(localexec) global "));
     }
     emitModuleParts() {
         // Function bodies first (the literal/unit/fn-value tables fill as they
@@ -1356,10 +1440,15 @@ export class LlEmitter {
             `%ScrClosure = type { ${this.sizeType}, ptr, ${this.sizeType}, ptr, i32, i32, ptr }`,
             `%ScrFfiTable = type { ptr, ${this.sizeType}, ${this.sizeType}, ptr, i8, ptr, ptr, ${this.sizeType}, ${this.sizeType}, ${this.sizeType}, ptr, ptr }`,
             `%ScrRegex = type { ${this.sizeType}, ptr, ptr, ptr, double, ptr, ptr }`,
-            // ScrArr mirrors scr_runtime.h field-for-field. Live dynamic stream
-            // commits swap its mutable dense, sparse, presence, and property
-            // storage while preserving the target object's identity.
-            `%ScrArr = type { ${this.sizeType}, ${this.sizeType}, ${this.sizeType}, i32, ptr, ptr, ptr, ptr, ptr, ptr, ${this.sizeType}, ${this.sizeType}, ptr, ${this.sizeType}, ${this.sizeType}, ptr }`,
+            // ScrArr mirrors scr_runtime.h field-for-field: { rc, len, cap, elem,
+            // cyc, ops, data, present, ext } (field numbers in SCR_ARR_FIELD),
+            // where ops points at the element type's constant RC descriptor
+            // (%ScrArrOps, SCR_ELEM_REF only) and ext at the out-of-line sparse,
+            // property and metadata storage (NULL until first used). Live dynamic
+            // stream commits swap its dense, presence and out-of-line storage while
+            // preserving the target object's identity.
+            `%ScrArr = type { ${this.sizeType}, ${this.sizeType}, ${this.sizeType}, i32, i32, ptr, ptr, ptr, ptr }`,
+            `%ScrArrOps = type { ptr, ptr, ptr }`,
             // The ScrMap prefix { rc, key_kind, val_kind, val_retain, val_release,
             // val_trace, key_retain, key_release, key_trace } — the inline RC
             // fast paths test the two trace slots (shapes.ts).
@@ -1372,9 +1461,13 @@ export class LlEmitter {
             ...(this.decls.has(NUMBER_MAP_ENTRY_DECL)
                 ? [
                     `%ScrMapIx = type { ${this.sizeType}, i32, i32, ptr, ptr, ptr, ptr, ptr, ptr, ${this.sizeType}, ${this.sizeType}, ${this.sizeType}, ptr, ${this.sizeType}, ptr, ${this.sizeType}, ptr, ptr, ptr, ${this.sizeType} }`,
-                    `%ScrMapEntry = type { i64, i64, i64 }`,
                 ]
                 : []),
+            // String-keyed reference reads load the value slot of the entry
+            // scr_map_entry_str returns (map-number-lookup.ts).
+            ...(this.decls.has(NUMBER_MAP_ENTRY_DECL) || this.decls.has(STRING_MAP_ENTRY_DECL)
+                ? [`%ScrMapEntry = type { i64, i64, i64 }`]
+                : []),
             // The runtime error prefix { rc, vt, name, message, code, cause } and the
             // class-object shape { rc, pre, post, ctor, name } — field reads on
             // builtin errors and classval loads GEP through these.
@@ -1422,6 +1515,10 @@ export class LlEmitter {
         const tl = this.mod.workers === true || this.mod.lib?.threadInstances === true ? "thread_local " : "";
         out.push(``, `@scr_error_vts = external ${tl}global [${RUNTIME_ERROR_CLASSES.size} x %ScrVt]`, `declare void @scr_init()`, `declare void @scr_lib_init(i32, ptr)`, ...(this.mod.workers ? [`declare void @scr_runtime_workers_v8()`] : []), ...(this.stackChecks?.size ? [`declare void @scr_stack_guard_init()`] : []), ...(this.runtimeAbiMarker && this.mod.lib === undefined
             ? [`declare void @${RUNTIME_ABI_MARKER}()`]
+            : []), 
+        // Overrides the runtime's weak default (scr_lib.c).
+        ...(this.detachedExit && this.mod.lib === undefined
+            ? [`@scr_detached_exit = constant i8 1`]
             : []));
         for (const d of this.decls)
             out.push(d);
@@ -1429,10 +1526,9 @@ export class LlEmitter {
         const flushedDecls = new Set(this.decls);
         for (const table of this.constantNumericTables.values()) {
             const n = table.values.length;
-            out.push(`@${table.symbol} = private constant [${n} x double] [${table.values.map((v) => `double ${f64Lit(v)}`).join(", ")}]`, `define internal double @${table.symbol}_get(ptr %a, double %i) alwaysinline #0 {`, `entry:`, `  %initialized = icmp ne ptr %a, null`, `  %nonnegative = fcmp oge double %i, ${f64Lit(0)}`, `  %below = fcmp olt double %i, ${f64Lit(n)}`, `  %range = and i1 %nonnegative, %below`, `  %safe = and i1 %initialized, %range`, `  br i1 %safe, label %convert, label %fallback`, `convert:`, 
-            // The branch must dominate fptoui: NaN/out-of-range conversion
-            // would produce poison. Fractional indices also need a fallback.
-            `  %index = fptoui double %i to ${this.sizeType}`, `  %roundtrip = uitofp ${this.sizeType} %index to double`, `  %integer = fcmp oeq double %roundtrip, %i`, `  br i1 %integer, label %read, label %fallback`, `read:`, `  %slot = getelementptr inbounds [${n} x double], ptr @${table.symbol}, ${this.sizeType} 0, ${this.sizeType} %index`, `  %value = load double, ptr %slot`, `  ret double %value`, `fallback:`, `  %generic = call double @scr_arr_get_number(ptr %a, double %i)`, `  ret double %generic`, `}`, ``);
+            let tableTmp = 0;
+            const tableIndex = exactIndexLines("%i", String(n), "i64", () => `%ix${tableTmp++}`);
+            out.push(`@${table.symbol} = private constant [${n} x double] [${table.values.map((v) => `double ${f64Lit(v)}`).join(", ")}]`, `define internal double @${table.symbol}_get(ptr %a, double %i) alwaysinline #0 {`, `entry:`, `  %initialized = icmp ne ptr %a, null`, ...tableIndex.lines.map((line) => `  ${line}`), `  %safe = and i1 %initialized, ${tableIndex.ok}`, `  br i1 %safe, label %read, label %fallback`, `read:`, `  %slot = getelementptr inbounds [${n} x double], ptr @${table.symbol}, i64 0, i64 ${tableIndex.wide}`, `  %value = load double, ptr %slot`, `  ret double %value`, `fallback:`, `  %generic = call double @scr_arr_get_number(ptr %a, double %i)`, `  ret double %generic`, `}`, ``);
         }
         for (const [text, lit] of this.literals) {
             // Immortal interned ScrStr: { rc = SIZE_MAX, len, cap = len, bytes\0 } —
@@ -1499,7 +1595,7 @@ export class LlEmitter {
             // strings — a no-op.
             const n = inst.slots.length;
             const present = n === 0 ? "zeroinitializer" : `[ ${inst.slots.map(() => "i8 1").join(", ")} ]`;
-            out.push(`@${inst.sym}_data = internal constant [${n} x ptr] [ ${inst.slots.map((s) => `ptr ${s}`).join(", ")} ]`, `@${inst.sym}_present = internal constant [${n} x i8] ${present}`, `@${inst.sym} = internal global %ScrArr { ${this.sizeType} -1, ${this.sizeType} ${n}, ${this.sizeType} ${n}, i32 2, ptr null, ptr null, ptr null, ptr @${inst.sym}_data, ptr @${inst.sym}_present, ptr null, ${this.sizeType} 0, ${this.sizeType} 0, ptr null, ${this.sizeType} 0, ${this.sizeType} 0, ptr null }`);
+            out.push(`@${inst.sym}_data = internal constant [${n} x ptr] [ ${inst.slots.map((s) => `ptr ${s}`).join(", ")} ]`, `@${inst.sym}_present = internal constant [${n} x i8] ${present}`, `@${inst.sym} = internal global %ScrArr { ${this.sizeType} -1, ${this.sizeType} ${n}, ${this.sizeType} ${n}, i32 2, i32 0, ptr null, ptr @${inst.sym}_data, ptr @${inst.sym}_present, ptr null }`);
         }
         if (this.templateStringsInstances.size > 0)
             out.push(``);
@@ -2024,7 +2120,13 @@ export class LlEmitter {
         // keeps the complete SameValueZero semantics.
         if (this.decls.has(NUMBER_MAP_ENTRY_DECL)) {
             const sz = this.sizeType;
-            defs.push(`define internal ptr @sc_map_entry_f64(ptr %m, double %k) ${FN_ATTRS} {`, `entry:`, `  %ndp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 19`, `  %nd = load ${sz}, ptr %ndp`, `  %ndf = uitofp ${sz} %nd to double`, `  %lo = fcmp oge double %k, 0.0`, `  %hi = fcmp olt double %k, %ndf`, `  %in = and i1 %lo, %hi`, `  br i1 %in, label %direct, label %outside`, `direct:`, `  %i = fptoui double %k to ${sz}`, `  %back = uitofp ${sz} %i to double`, `  %int = fcmp oeq double %back, %k`, `  br i1 %int, label %slot, label %miss`, `slot:`, `  %dp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 18`, `  %dense = load ptr, ptr %dp`, `  %sp = getelementptr inbounds i32, ptr %dense, ${sz} %i`, `  %s = load i32, ptr %sp`, `  %empty = icmp eq i32 %s, 0`, `  br i1 %empty, label %miss, label %hit`, `hit:`, `  %e32 = sub i32 %s, 1`, sz === "i32" ? `  %e = add i32 %e32, 0` : `  %e = zext i32 %e32 to ${sz}`, `  %ep = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 12`, `  %entries = load ptr, ptr %ep`, `  %found = getelementptr inbounds %ScrMapEntry, ptr %entries, ${sz} %e`, `  ret ptr %found`, `miss:`, `  ret ptr null`, `outside:`, `  %dense.any = icmp ne ${sz} %nd, 0`, `  br i1 %dense.any, label %miss, label %slow`, `slow:`, `  %r = call ptr @scr_map_entry_f64(ptr %m, double %k)`, `  ret ptr %r`, `}`, ``);
+            let mapTmp = 0;
+            const mapIndex = exactIndexLines("%k", "%nd", sz, () => `%ix${mapTmp++}`);
+            defs.push(`define internal ptr @sc_map_entry_f64(ptr %m, double %k) ${FN_ATTRS} {`, `entry:`, `  %ndp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 19`, `  %nd = load ${sz}, ptr %ndp`, 
+            // A non-integral key inside the table is as absent as one outside it.
+            ...mapIndex.lines.map((line) => `  ${line}`), `  br i1 ${mapIndex.ok}, label %slot, label %outside`, `slot:`, sz === "i64"
+                ? `  %i = add i64 ${mapIndex.wide}, 0`
+                : `  %i = trunc i64 ${mapIndex.wide} to ${sz}`, `  %dp = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 18`, `  %dense = load ptr, ptr %dp`, `  %sp = getelementptr inbounds i32, ptr %dense, ${sz} %i`, `  %s = load i32, ptr %sp`, `  %empty = icmp eq i32 %s, 0`, `  br i1 %empty, label %miss, label %hit`, `hit:`, `  %e32 = sub i32 %s, 1`, sz === "i32" ? `  %e = add i32 %e32, 0` : `  %e = zext i32 %e32 to ${sz}`, `  %ep = getelementptr inbounds %ScrMapIx, ptr %m, i32 0, i32 12`, `  %entries = load ptr, ptr %ep`, `  %found = getelementptr inbounds %ScrMapEntry, ptr %entries, ${sz} %e`, `  ret ptr %found`, `miss:`, `  ret ptr null`, `outside:`, `  %dense.any = icmp ne ${sz} %nd, 0`, `  br i1 %dense.any, label %miss, label %slow`, `slow:`, `  %r = call ptr @scr_map_entry_f64(ptr %m, double %k)`, `  ret ptr %r`, `}`, ``);
         }
         // String comparisons enter through small internal wrappers that LLVM
         // inlines at each site: interned literals and shared values compare by
@@ -2833,13 +2935,28 @@ export class LlEmitter {
      * return and stays eligible for tail-call and recursion elimination. */
     emitUnwind(passThrough) {
         if (this.mod.workers && this.tryStack.length > 0) {
-            this.declare(`declare zeroext i1 @scr_context_stopping()`);
-            const stopped = this.B.tmp();
-            this.B.line(`${stopped} = call zeroext i1 @scr_context_stopping()`);
             const stop = this.B.newLabel("context.stop");
             const ordinary = this.B.newLabel("context.throw");
-            this.B.condBr(stopped, stop, ordinary);
-            this.B.startBlock(stop);
+            if (this.executableTls) {
+                // A set stop bit unwinds while the active cell may still be clear:
+                // install the termination sentinel before skipping the handlers.
+                const word = this.loadExcFlag();
+                const bit = this.B.tmp();
+                const stopped = this.B.tmp();
+                this.B.line(`${bit} = and i32 ${word}, 2`);
+                this.B.line(`${stopped} = icmp ne i32 ${bit}, 0`);
+                this.B.condBr(stopped, stop, ordinary);
+                this.B.startBlock(stop);
+                this.declare(`declare zeroext i1 @scr_context_checkpoint()`);
+                this.B.line(`call zeroext i1 @scr_context_checkpoint()`);
+            }
+            else {
+                this.declare(`declare zeroext i1 @scr_context_stopping()`);
+                const stopped = this.B.tmp();
+                this.B.line(`${stopped} = call zeroext i1 @scr_context_stopping()`);
+                this.B.condBr(stopped, stop, ordinary);
+                this.B.startBlock(stop);
+            }
             const handlers = this.tryStack;
             this.tryStack = [];
             this.emitUnwind();
@@ -2896,6 +3013,18 @@ export class LlEmitter {
         }
         this.B.br(cleanup.label);
     }
+    /** Loads the running thread's exact pending word (ELF worker
+     * executables, scr_exception.c): bit 0 mirrors the active cell, bit 1
+     * requests the context's stop. It lives in the executable's static TLS
+     * block, so the access is one thread-pointer-relative load. Monotonic by
+     * default: a loop must not hoist the load out and miss a cross-thread
+     * stop (see emitPendingCheck for the unordered tests). */
+    loadExcFlag(unordered = false) {
+        this.declare(`@scr_exc_flag = external thread_local(localexec) global i32, align 4`);
+        const word = this.B.tmp();
+        this.B.line(`${word} = load atomic i32, ptr @scr_exc_flag ${unordered ? "unordered" : "monotonic"}, align 4`);
+        return word;
+    }
     /** Instructions (two-space indented) that set the i1 `dest` to "an
      * exception is pending in the active context" — scr_exc_pending()'s
      * meaning — for the helper and adapter bodies that test it outside
@@ -2922,8 +3051,9 @@ export class LlEmitter {
      * call's result temp must join its frame BEFORE this runs so the unwind
      * releases the dummy (NULL for refcounted kinds) harmlessly. A scalar
      * call result of the function's return type may be passed as the unwind's
-     * dummy value (see emitUnwind). */
-    emitPendingCheck(passThrough) {
+     * dummy value (see emitUnwind). `poll` marks a worker termination poll
+     * (function entry or loop budget), whose test must stay ordered. */
+    emitPendingCheck(passThrough, poll = false) {
         const through = passThrough !== undefined &&
             this.llType(passThrough.type) === this.llType(this.currentReturnType) &&
             (passThrough.type.kind === "f64" || passThrough.type.kind === "bool")
@@ -2945,16 +3075,35 @@ export class LlEmitter {
             return;
         }
         // Executables test the active exception cell's kind inline (its first
-        // field). Worker programs test the process-wide alert word instead: it
-        // is nonzero while any script thread may have an exception pending in
-        // its active cell or has been asked to stop, so the common case is one
-        // ordinary global load (a thread-local access is a call on Darwin) and
-        // the out-of-line scr_exc_pending answers for this thread, observing
-        // cancellation and reinstalling the termination sentinel.
+        // field). ELF worker executables test the thread's exact pending word,
+        // which is also nonzero once the context must stop, and unwind directly:
+        // no site carries an out-of-line call, so LLVM's inliner sees the check
+        // as two instructions. Other worker programs test the process-wide
+        // alert word: it is nonzero while any script thread may have an
+        // exception pending in its active cell or has been asked to stop, so
+        // the common case is one ordinary global load (a thread-local access is
+        // a call on Darwin) and the out-of-line scr_exc_pending answers for this
+        // thread, observing cancellation and reinstalling the termination
+        // sentinel.
         this.declare(`declare i1 @llvm.expect.i1(i1, i1)`);
         let word;
-        if (this.mod.workers === true) {
-            this.declare(`@scr_exc_alert = external global i32, align 64`);
+        const exact = this.mod.workers !== true || this.executableTls;
+        if (this.executableTls) {
+            // Termination stays observable where the polls were dropped for it:
+            // polls, tests inside source loops (exc's loop-poll rule relies on
+            // them every iteration) and tail-position tests (a dead ordered load
+            // keeps recursion from becoming a loop without stack growth) use an
+            // ordered load, which LLVM never deletes, hoists or merges. Every
+            // other test is an unordered load: it reads the same word, but LLVM's
+            // memory analyses no longer treat it as a write, so loads around it
+            // stay forwardable after inlining. Same-thread changes only happen in
+            // runtime calls, which clobber memory.
+            word = this.loadExcFlag(!poll && through === undefined && this.loopDepth === 0);
+        }
+        else if (this.mod.workers === true) {
+            // dso_local: executables link the runtime statically, so the word is
+            // addressed directly instead of through the GOT.
+            this.declare(`@scr_exc_alert = external dso_local global i32, align 64`);
             word = B.tmp();
             B.line(`${word} = load atomic i32, ptr @scr_exc_alert monotonic, align 64`);
         }
@@ -2984,7 +3133,7 @@ export class LlEmitter {
         B.line(`${cold} = call i1 @llvm.expect.i1(i1 ${hit}, i1 false)`);
         const lu = B.newLabel("exc.u");
         const lk = B.newLabel("exc.k");
-        if (this.mod.workers === true) {
+        if (!exact) {
             this.declare(`declare zeroext i1 @scr_exc_pending()`);
             const slow = B.newLabel("exc.s");
             B.condBr(cold, slow, lk);
@@ -3016,30 +3165,98 @@ export class LlEmitter {
      * throw Node's RangeError and unwind like any other pending exception. */
     emitStackCheck() {
         const B = this.B;
-        const tl = this.mod.workers === true ? "thread_local " : "";
-        this.declare(`@scr_stack_guard = external ${tl}global ptr`);
         this.declare(`declare ptr @llvm.stacksave.p0()`);
         this.declare(`declare i1 @llvm.expect.i1(i1, i1)`);
         this.declare(`declare void @scr_stack_overflow()`);
-        const sp = B.tmp();
-        const guard = B.tmp();
-        const low = B.tmp();
-        const cold = B.tmp();
-        B.line(`${sp} = call ptr @llvm.stacksave.p0()`);
-        B.line(`${guard} = load ptr, ptr @scr_stack_guard`);
-        B.line(`${low} = icmp ult ptr ${sp}, ${guard}`);
-        B.line(`${cold} = call i1 @llvm.expect.i1(i1 ${low}, i1 false)`);
         const over = B.newLabel("stack.over");
         const ok = B.newLabel("stack.ok");
-        B.condBr(cold, over, ok);
+        const sp = B.tmp();
+        B.line(`${sp} = call ptr @llvm.stacksave.p0()`);
+        const test = (guard) => {
+            const low = B.tmp();
+            const cold = B.tmp();
+            B.line(`${low} = icmp ult ptr ${sp}, ${guard}`);
+            B.line(`${cold} = call i1 @llvm.expect.i1(i1 ${low}, i1 false)`);
+            B.condBr(cold, over, ok);
+        };
+        if (this.stackGuardTsd !== null) {
+            // A Darwin thread-local access is a call to its TLV thunk: read the
+            // guard from its thread-specific-data slot at the runtime-validated
+            // offset instead, and call out only when the runtime found no slot.
+            this.declare(`@scr_stack_guard_tsd = external dso_local global i64`);
+            this.declare(`declare i64 @scr_stack_guard_get()`);
+            const offset = B.tmp();
+            const direct = B.tmp();
+            const likely = B.tmp();
+            B.line(`${offset} = load i64, ptr @scr_stack_guard_tsd`);
+            B.line(`${direct} = icmp ne i64 ${offset}, 0`);
+            B.line(`${likely} = call i1 @llvm.expect.i1(i1 ${direct}, i1 true)`);
+            const fast = B.newLabel("stack.tsd");
+            const slow = B.newLabel("stack.tlv");
+            B.condBr(likely, fast, slow);
+            B.startBlock(fast);
+            const guard = B.tmp();
+            if (this.stackGuardTsd === "aarch64") {
+                this.declare(`declare i64 @llvm.read_register.i64(metadata)`);
+                const thread = B.tmp();
+                const base = B.tmp();
+                const slot = B.tmp();
+                const address = B.tmp();
+                B.line(`${thread} = call i64 @llvm.read_register.i64(metadata !{!"tpidrro_el0"})`);
+                B.line(`${base} = and i64 ${thread}, -8`);
+                B.line(`${slot} = add i64 ${base}, ${offset}`);
+                B.line(`${address} = inttoptr i64 ${slot} to ptr`);
+                B.line(`${guard} = load ptr, ptr ${address}`);
+            }
+            else {
+                const address = B.tmp();
+                B.line(`${address} = inttoptr i64 ${offset} to ptr addrspace(256)`);
+                B.line(`${guard} = load ptr, ptr addrspace(256) ${address}`);
+            }
+            test(guard);
+            B.startBlock(slow);
+            // uintptr_t scr_stack_guard_get(void): an i64 in the C ABI.
+            const raw = B.tmp();
+            const fallback = B.tmp();
+            B.line(`${raw} = call i64 @scr_stack_guard_get()`);
+            B.line(`${fallback} = inttoptr i64 ${raw} to ptr`);
+            test(fallback);
+        }
+        else {
+            const tl = this.mod.workers === true ? "thread_local " : "";
+            this.declare(`@scr_stack_guard = external ${tl}global ptr`);
+            const guard = B.tmp();
+            B.line(`${guard} = load ptr, ptr @scr_stack_guard`);
+            test(guard);
+        }
         B.startBlock(over);
         B.line(`call void @scr_stack_overflow()`);
         this.emitUnwind();
         B.startBlock(ok);
     }
-    workerLoopBudget() {
+    /** Whether the emitter follows this call with a pending test (the
+     * conditions in expr-calls.ts). */
+    callTestsPending(e) {
+        switch (e.kind) {
+            case "call":
+                return this.mayThrow.has(e.callee);
+            case "new":
+                return this.mayThrow.has(`%${e.className}.constructor`);
+            case "virtualCall":
+                return this.mayThrowMethods.has(e.method);
+            case "callValue":
+                return this.indirectMayThrow;
+            default:
+                return false;
+        }
+    }
+    workerLoopBudget(loop) {
         if (!this.mod.workers)
             return null;
+        // A loop that runs a pending test on every iteration observes a
+        // terminate request through it; a separate poll would only add work.
+        if (loopTestsEveryIteration(loop, (e) => this.callTestsPending(e)))
+            return null;
         const slot = this.B.slot();
         this.B.entryAllocas.push(`${slot} = alloca i32 ; worker cancellation budget`);
         this.B.line(`store i32 0, ptr ${slot}`);
@@ -3061,7 +3278,7 @@ export class LlEmitter {
         // Calls and throwing operations retain their own checks. Amortize the
         // extra cancellation poll across bounded loop batches so scalar work
         // does not cross the runtime ABI on every iteration.
-        this.emitPendingCheck();
+        this.emitPendingCheck(undefined, true);
         B.br(next);
         B.startBlock(next);
     }
@@ -3665,18 +3882,38 @@ export class LlEmitter {
         this.declare(`declare void @scr_box_set_ref(ptr, ptr)`);
         B.line(`call void @scr_box_set_ref(ptr ${box}, ptr ${cell})`);
     }
+    /** The payload a TDZ box holds before its declaration runs, when that is
+     * not NULL. A nullable union's value is its arm pointer with NULL as a
+     * unit arm (nullable-unions.ts), so a stored `null`/`undefined` would
+     * read back as the temporal dead zone; such boxes start at the module's
+     * immortal NULLABLE_ABSENT sentinel instead, which no value of the
+     * binding can hold and every RC entry point and the collector skip. */
+    tdzEmptySentinel(t) {
+        if (!this.nullableUnions.of(t))
+            return null;
+        this.needsNullableAbsent = true;
+        this.immortalValues.add(NULLABLE_ABSENT);
+        return NULLABLE_ABSENT;
+    }
     /** The TDZ-guarded read of a boxed binding: an empty payload slot is
      * the temporal dead zone — throw Node's exact catchable ReferenceError
      * (exprs.ts's varRef guard). Scalars then peek the one-element
      * array cell; ref kinds read the box normally (+1). */
-    checkTdz(box, name) {
+    checkTdz(box, t, name) {
         const B = this.B;
         const slotp = B.tmp();
         const slotv = B.tmp();
         const empty = B.tmp();
         B.line(`${slotp} = getelementptr inbounds %ScrBox, ptr ${box}, i64 0, i32 5`);
-        B.line(`${slotv} = load i64, ptr ${slotp}`);
-        B.line(`${empty} = icmp eq i64 ${slotv}, 0`);
+        const sentinel = this.tdzEmptySentinel(t);
+        if (sentinel !== null) {
+            B.line(`${slotv} = load ptr, ptr ${slotp}`);
+            B.line(`${empty} = icmp eq ptr ${slotv}, ${sentinel}`);
+        }
+        else {
+            B.line(`${slotv} = load i64, ptr ${slotp}`);
+            B.line(`${empty} = icmp eq i64 ${slotv}, 0`);
+        }
         this.throwIfUninitialized(empty, name);
         return slotv;
     }
@@ -3713,7 +3950,7 @@ export class LlEmitter {
         B.startBlock(lk);
     }
     tdzBoxRead(box, t, name) {
-        const slotv = this.checkTdz(box, name);
+        const slotv = this.checkTdz(box, t, name);
         const B = this.B;
         const acc = boxAccess(t);
         if (acc === "ref")
@@ -3733,7 +3970,7 @@ export class LlEmitter {
     writeBindingBox(box, local, value, initializes = false, borrowed = false) {
         if (local.tdz) {
             const first = initializes || !local.mutable;
-            const slotv = first ? null : this.checkTdz(box, local.name);
+            const slotv = first ? null : this.checkTdz(box, local.type, local.name);
             const acc = boxAccess(local.type);
             if (acc !== "ref") {
                 if (first)
@@ -3893,6 +4130,7 @@ export class LlEmitter {
         const numericFn = withInitializerBindings(fn, initializerBindings);
         this.numericLocals = new Map(numericFn.locals.map((l) => [l.id, l]));
         this.borrowedParameters.clear();
+        this.referenceWrites?.enter(fn);
         this.reboundOwnerSlots.clear();
         this.projectedParameters.clear();
         const projectedParameterIndexes = this.callLifetimes.parameters.get(fn.name);
@@ -3912,6 +4150,8 @@ export class LlEmitter {
         this.captureIds = new Set([...(fn.captures ?? []), ...(fn.classCaptures ?? [])].map((c) => c.localId));
         this.integerLoopBindings.clear();
         this.countedLoopsEnabled = this.debug === null && !fn.async && !fn.generator;
+        this.finalFieldBorrows =
+            !fn.async && !fn.generator && constructorClass(fn.name) === null && this.finalFields.size > 0;
         this.byteWindowsEnabled = this.countedLoopsEnabled;
         this.byteWindowEntries =
             this.byteWindowsEnabled && numericFn.locals.some((l) => l.type.kind === "bytes")
@@ -3922,10 +4162,10 @@ export class LlEmitter {
         this.integerArrayBindings.clear();
         this.loopArrayBorrows =
             this.debug === null
-                ? findLoopArrayBorrows(fn, this.callLifetimes, this.referenceEffects, this.optionalArrayReads)
+                ? findLoopArrayBorrows(fn, this.callLifetimes, this.referenceEffects, this.optionalArrayReads, this.referenceWrites)
                 : new Set();
-        this.localArrayReads = findLocalArrayReads(fn, this.fnByName, this.unionsById, this.referenceEffects.functions, this.callLifetimes, this.optionalArrayReads, this.loopArrayBorrows);
-        this.callArrayReads = findCallArrayReads(fn, this.optionalArrayReads, this.referenceEffects.functions, this.callLifetimes);
+        this.localArrayReads = findLocalArrayReads(fn, this.fnByName, this.unionsById, this.referenceEffects.functions, this.callLifetimes, this.optionalArrayReads, this.loopArrayBorrows, this.debug === null ? this.referenceEffects : undefined);
+        this.callArrayReads = findCallArrayReads(fn, this.optionalArrayReads, this.referenceEffects.functions, this.callLifetimes, this.debug === null ? this.referenceEffects : undefined);
         this.scalarStringSlices =
             this.debug === null ? findScalarStringSlices(fn, this.callLifetimes) : new Map();
         this.mapReadLifetimes = findMapReadLifetimes(fn, this.boxedUnionsById, this.callLifetimes);
@@ -3938,9 +4178,11 @@ export class LlEmitter {
         this.chainSlots.clear();
         this.finallyStack = [];
         this.tryStack = [];
+        this.loopDepth = 0;
         this.currentReturnType = fn.returnType;
         this.currentGenerator = fn.generator ?? null;
         this.currentBorrowedReturn = this.borrowedReturns.has(fn.name);
+        this.inConstructor = this.constructorFunctions.has(fn.name);
         this.currentWasiCoro = null;
         this.logArgSlots = 0;
         if (this.wasi && (fn.async === true || fn.generator !== undefined)) {
@@ -4100,8 +4342,8 @@ export class LlEmitter {
         if (this.stackChecks?.has(fn.name))
             this.emitStackCheck();
         if (this.workerEntryPolls?.has(fn.name))
-            this.emitPendingCheck();
-        this.emitStmts(fn.body);
+            this.emitPendingCheck(undefined, true);
+        this.emitStmts(fn.body, true);
         // Implicit exit of a void function: release the function scope unless
         // the body already terminated its final block (return, or a throw
         // whose unwind released everything down to depth 0).
@@ -4167,7 +4409,14 @@ export class LlEmitter {
         if (fn.captures !== undefined)
             params.unshift("ptr %sc_env");
         const ret = this.llType(fn.returnType);
-        const attrs = coro !== null ? "#1" : FN_ATTRS;
+        let attrs = coro !== null ? "#1" : FN_ATTRS;
+        // The shared indexed-read helper (lowerSafeIndexRead) is a dense bounds
+        // test, a state test and a load behind cold runtime fallbacks, called
+        // from every `a[i]` of one element type. Without the hint LLVM keeps the
+        // hot instances out of line once they have many callers: every read pays
+        // a call, and an integer index converts to a double and back across it.
+        if (fn.name.startsWith("%arr.idxOr."))
+            attrs = `inlinehint ${attrs}`;
         const debug = this.debugScope === null ? "" : ` !dbg ${this.debugScope}`;
         const symbol = borrowed ? mangleBorrowedFunction(fn.name) : mangleFunction(fn.name);
         const body = `define internal ${ret} @${symbol}(${params.join(", ")}) ${attrs}${debug} { ; ${fn.name}\n${B.render()}\n}`;
@@ -4250,14 +4499,34 @@ export class LlEmitter {
             return this.canBorrowCallArgument(value.value);
         if (value.kind === "libCall")
             return value.fn === "error.nodeThrow";
+        // A final field never changes outside constructors: while its object is
+        // borrowable, so is the field's value. Nullable-pointer fields have no
+        // box to lend and keep their owning path.
+        if (value.kind === "fieldGet" &&
+            this.finalFieldBorrows &&
+            isRefCounted(value.type) &&
+            this.finalFields.isFinal(value.className, value.field) &&
+            !this.nullableFieldGet(value))
+            return this.canBorrowReceiver(value.obj) && this.canBorrowCallArgument(value.obj);
         if (value.kind === "ternary")
             return (this.canBorrowReceiver(value.then) &&
                 this.canBorrowReceiver(value.else_) &&
                 this.canBorrowCallArgument(value.then) &&
                 this.canBorrowCallArgument(value.else_));
+        // A construction-only field of a stable owner keeps its value until the
+        // owner dies: no later operand or callee can replace and release it.
+        if ((value.kind === "fieldGet" || value.kind === "recordGet") && this.immutableRead(value))
+            return this.canBorrowCallArgument(value.obj);
+        // An optional chain's bound receiver stays unchanged until its body
+        // finishes (see emitReadReceiver).
+        if (value.kind === "chainRecv")
+            return this.chainSlots.has(value.id);
         if (value.kind !== "varRef")
             return false;
         const binding = this.binding(value.localId);
+        // A module constant owns its value for the rest of the program.
+        if (binding.kind === "global")
+            return this.stableGlobals.has(value.localId);
         return (binding.kind === "local" &&
             binding.local !== undefined &&
             (!binding.local.mutable ||
@@ -4267,15 +4536,212 @@ export class LlEmitter {
             !binding.local.boxed &&
             !binding.local.tdz);
     }
+    /** A plain-pointer read of a construction-only field outside any
+     * constructor (ImmutableFields). */
+    immutableRead(e) {
+        if (this.inConstructor || this.immutableFields === null)
+            return false;
+        const t = e.type.kind;
+        if (t !== "object" && t !== "record" && t !== "array" && t !== "string")
+            return false;
+        return e.kind === "fieldGet"
+            ? this.immutableFields.classField(e.className, e.field)
+            : this.immutableFields.recordField(e.shapeId, e.field);
+    }
+    /** A projection read whose locations nothing writes while a borrowed
+     * read of it is in use (ReferenceWrites), given the writes of that
+     * extent. The root binding itself must stay alive across it too, which
+     * its own location (`l:`, `g:`, `bx`) covers. */
+    unwrittenRead(e, writes) {
+        const rw = this.referenceWrites;
+        if (rw === null)
+            return false;
+        const keys = rw.readKeys(e, (call) => this.borrowedReturnKeys(call.callee));
+        return keys !== null && !rw.conflicts(keys, writes);
+    }
+    /** A stable binding initialized by a projection can borrow it when the
+     * rest of its block (its whole lifetime) writes none of the projection's
+     * locations: the source edge then keeps the value alive, and uses that
+     * escape still retain their own copies. */
+    unwrittenAlias(s) {
+        const cursor = this.stmtCursor;
+        const rw = this.referenceWrites;
+        if (rw === null || s.init === null || cursor === null || cursor.stmts[cursor.index] !== s)
+            return false;
+        if (!this.plainReference(s.init.type) ||
+            !this.canBorrowReceiver(s.init) ||
+            !this.unownedWalk(s.init))
+            return false;
+        const writes = rw.union([rw.expr(s.init), rw.stmts(cursor.stmts.slice(cursor.index + 1))]);
+        return this.unwrittenRead(s.init, writes);
+    }
+    /** An optional element read into a projection-only local can borrow the
+     * element when the rest of the block writes no array element and none of
+     * the locations keeping the array alive (which must itself be read
+     * without a frame owner). */
+    unwrittenLocalArrayRead(s, read) {
+        const cursor = this.stmtCursor;
+        const rw = this.referenceWrites;
+        if (rw === null || s.init === null || cursor === null || cursor.stmts[cursor.index] !== s)
+            return false;
+        if (!this.unownedWalk(read.array))
+            return false;
+        const keys = rw.readKeys(read.array);
+        if (keys === null || rw.expr(read.index) !== null)
+            return false;
+        const writes = rw.union([rw.expr(s.init), rw.stmts(cursor.stmts.slice(cursor.index + 1))]);
+        return !rw.conflicts(["a", ...keys], writes);
+    }
+    /** An optional element read passed to a projection-only parameter can
+     * borrow the element when the callee and later arguments (`writes`)
+     * write no array element and nothing keeping the array alive. */
+    unwrittenCallArrayRead(read, writes) {
+        const rw = this.referenceWrites;
+        if (rw === null)
+            return false;
+        const keys = rw.readKeys(read.array);
+        if (keys === null || rw.expr(read.index) !== null)
+            return false;
+        return !rw.conflicts(["a", ...keys], writes);
+    }
+    /** `return x` of a local whose slot is an owned scope entry of the same
+     * type: the return can take over the local's reference. */
+    movableReturn(value) {
+        if (value === null || value.kind !== "varRef" || !isRefCounted(value.type))
+            return null;
+        if (this.currentBorrowedReturn || this.currentWasiCoro !== null)
+            return null;
+        const binding = this.binding(value.localId);
+        if (binding.kind !== "local" || binding.local === undefined || binding.local.boxed)
+            return null;
+        if (!typeEquals(binding.type, value.type) || !typeEquals(this.currentReturnType, value.type))
+            return null;
+        for (const scope of this.scopes) {
+            const index = scope.findIndex((entry) => entry.slot === binding.slot);
+            if (index < 0)
+                continue;
+            const entry = scope[index];
+            if (entry.boxed || entry.lazy || !typeEquals(entry.type, value.type))
+                return null;
+            return { scope, entry, index };
+        }
+        return null;
+    }
+    /** A walk host for a body that may write the heap: each walk must read
+     * only locations the whole body (with its callees) never writes;
+     * rebinding the walk locals themselves releases nothing. */
+    unwrittenWalkHost(fn, host) {
+        return {
+            ...host,
+            unwritten: (value, candidates) => this.referenceWrites?.unwrittenWalk(fn, value, candidates, (call) => this.borrowedReturnKeys(call.callee)) ?? false,
+        };
+    }
+    /** emitReadReceiver yields a plain pointer for `e` that no statement
+     * frame owns, so it can outlive the statement (walk-borrows' walks, from
+     * any unboxed plain-pointer binding, plus element reads). */
+    unownedWalk(e) {
+        switch (e.kind) {
+            case "varRef": {
+                const binding = this.binding(e.localId);
+                if (binding.kind === "global")
+                    return this.plainReference(binding.type);
+                return (binding.kind === "local" &&
+                    binding.local !== undefined &&
+                    !binding.local.boxed &&
+                    !binding.local.tdz &&
+                    this.plainReference(binding.local.type) &&
+                    !this.stringSlices.has(e.localId) &&
+                    !this.storedSplits.has(e.localId) &&
+                    !this.localUnionStorage.has(e.localId));
+            }
+            case "fieldGet":
+            case "recordGet":
+                return this.borrowsWithoutOwning(e) && this.unownedWalk(e.obj);
+            case "unionNarrow":
+            case "downcast":
+            case "upcast":
+                return this.borrowsWithoutOwning(e) && this.unownedWalk(e.value);
+            case "unionWrap":
+                if (!this.borrowsWithoutOwning(e))
+                    return false;
+                return e.value.kind === "unitLit" || this.unownedWalk(e.value);
+            case "ternary": {
+                const arm = (v) => (v.kind === "libCall" && v.fn === "error.nodeThrow") || this.unownedWalk(v);
+                return this.borrowsWithoutOwning(e) && arm(e.then) && arm(e.else_);
+            }
+            case "call":
+                return (this.borrowsWithoutOwning(e) &&
+                    e.args.every((arg) => !isRefCounted(arg.type) || this.unownedWalk(arg)));
+            case "arrayGet":
+                return (!this.isStackUnionSource(e) &&
+                    this.optionalArrayReads.get(e) === null &&
+                    this.unownedWalk(e.arr));
+            case "seqExpr": {
+                const guarded = guardedValue(e);
+                return guarded !== null && this.unownedWalk(guarded);
+            }
+            default:
+                return false;
+        }
+    }
+    /** Every location a borrowed-return callee's walks can read (its body's
+     * field, record and element reads, through nested borrowed returns). */
+    borrowedReturnKeys(callee) {
+        if (!this.borrowedReturns.has(callee))
+            return null;
+        const known = this.borrowedReturnKeyCache.get(callee);
+        if (known)
+            return known;
+        const rw = this.referenceWrites;
+        const keys = new Set();
+        const seen = new Set([callee]);
+        const pending = [callee];
+        while (pending.length > 0) {
+            const fn = this.fnByName.get(pending.pop());
+            if (!fn)
+                continue;
+            everyStmtList(fn.body, {
+                stmt: () => true,
+                expr: (e) => {
+                    if (e.kind === "fieldGet")
+                        keys.add(rw.fieldKey(e.className, e.field));
+                    else if (e.kind === "recordGet") {
+                        keys.add(`r:${e.field}`);
+                        keys.add("r:*");
+                    }
+                    else if (e.kind === "arrayGet")
+                        keys.add("a");
+                    else if (e.kind === "call" && this.borrowedReturns.has(e.callee) && !seen.has(e.callee)) {
+                        seen.add(e.callee);
+                        pending.push(e.callee);
+                    }
+                    return true;
+                },
+            });
+        }
+        const result = [...keys];
+        this.borrowedReturnKeyCache.set(callee, result);
+        return result;
+    }
     // ── statements ──────────────────────────────────────────────────────────
-    emitStmts(stmts) {
-        for (const s of stmts) {
-            // Statements after a terminator are unreachable (dead code after
-            // return/break/continue). Skip them so no dropped SSA definition
-            // can leak forward.
-            if (this.B.isTerminated())
-                return;
-            this.emitStmt(s);
+    emitStmts(stmts, scoped = false) {
+        const saved = this.stmtCursor;
+        const cursor = scoped ? { stmts, index: 0 } : null;
+        try {
+            for (let i = 0; i < stmts.length; i++) {
+                // Statements after a terminator are unreachable (dead code after
+                // return/break/continue). Skip them so no dropped SSA definition
+                // can leak forward.
+                if (this.B.isTerminated())
+                    return;
+                if (cursor)
+                    cursor.index = i;
+                this.stmtCursor = cursor;
+                this.emitStmt(stmts[i]);
+            }
+        }
+        finally {
+            this.stmtCursor = saved;
         }
     }
     /** Emits a block in its own lexical scope (refcounted locals released at
@@ -4287,7 +4753,7 @@ export class LlEmitter {
         const scope = [];
         this.scopes.push(scope);
         setup?.(scope);
-        this.emitStmts(stmts);
+        this.emitStmts(stmts, true);
         const ended = endsWithJump(stmts);
         this.scopes.pop();
         if (!ended)
@@ -4296,11 +4762,16 @@ export class LlEmitter {
     emitStmt(s) {
         const previous = this.B.debugLocation;
         this.B.debugLocation = this.debug?.location(s.loc, this.debugScope) ?? null;
+        const loop = s.kind === "while" || s.kind === "doWhile" || s.kind === "for" || s.kind === "forOf";
+        if (loop)
+            this.loopDepth++;
         try {
             this.emitStmtBody(s);
         }
         finally {
             this.B.debugLocation = previous;
+            if (loop)
+                this.loopDepth--;
         }
     }
     emitStmtBody(s) {
@@ -4344,7 +4815,9 @@ export class LlEmitter {
                 }
                 const localRead = this.localArrayReads.get(s.localId);
                 if (localRead) {
-                    const owner = emitLocalArrayRead(this, localRead, b.slot);
+                    const owner = emitLocalArrayRead(this, !localRead.borrow && this.unwrittenLocalArrayRead(s, localRead)
+                        ? { ...localRead, borrow: true }
+                        : localRead, b.slot);
                     if (owner)
                         this.scopes[this.scopes.length - 1].push(owner);
                     break;
@@ -4397,8 +4870,14 @@ export class LlEmitter {
                     B.line(`${box} = ${boxNew} ; let ${b.local.name} (boxed)`);
                     B.line(`store ptr ${box}, ptr ${b.slot}`);
                     this.scopes[this.scopes.length - 1].push({ slot: b.slot, type: b.type, boxed: true });
-                    if (s.init === null)
+                    if (s.init === null) {
+                        // An empty TDZ box whose payload can legitimately be NULL
+                        // starts at its distinct sentinel (tdzEmptySentinel).
+                        const sentinel = b.local.tdz === true ? this.tdzEmptySentinel(b.type) : null;
+                        if (sentinel !== null)
+                            B.line(`store ptr ${sentinel}, ptr ${this.boxSlot(box)}`);
                         break;
+                    }
                     const v = this.emitExpr(s.init);
                     if (isRefCounted(v.type))
                         this.moveTemp(v); // the box takes ownership
@@ -4432,7 +4911,7 @@ export class LlEmitter {
                     b.local &&
                     isRefCounted(b.type) &&
                     this.stableCallBindings.has(s.localId) &&
-                    this.canBorrowCallArgument(s.init)) {
+                    (this.canBorrowCallArgument(s.init) || this.unwrittenAlias(s))) {
                     const v = this.emitReadReceiver(s.init);
                     B.line(`store ptr ${v.name}, ptr ${b.slot}`);
                     break;
@@ -4499,6 +4978,32 @@ export class LlEmitter {
                 }
                 B.line(`store ${this.llType(b.type)} ${v.name}, ptr ${b.slot}`);
                 this.storeIntegerView(s.localId, v, s.value);
+                if (b.kind === "global" && this.immortalGlobals.has(s.localId)) {
+                    // An Immutable module constant (contracts/check.ts proved it is
+                    // fresh, publishable and never written): its graph becomes
+                    // immortal, so reads skip reference counting and the collector
+                    // never visits it.
+                    const lines = this.publishWalkers.emitPublish(v.name, v.type, s.loc);
+                    for (const line of lines)
+                        B.line(line.trimStart());
+                    // Reads of this global skip retains from here on, which is only
+                    // sound once the graph really is immortal. Node.js never fails
+                    // here, so a refusal means the contract proof was wrong: stop
+                    // rather than keep running with a mortal graph read as immortal.
+                    if (lines.length > 0) {
+                        this.declare(`declare zeroext i1 @scr_exc_pending()`);
+                        this.declare(`declare void @scr_trap(ptr)`);
+                        const refused = B.tmp();
+                        B.line(`${refused} = call zeroext i1 @scr_exc_pending()`);
+                        const stop = B.newLabel("immutable.refused");
+                        const done = B.newLabel("immutable.published");
+                        B.condBr(refused, stop, done);
+                        B.startBlock(stop);
+                        B.line(`call void @scr_trap(ptr ${this.cstr("scriptc: internal error: an Immutable value could not be published\n")})`);
+                        B.terminate("unreachable");
+                        B.startBlock(done);
+                    }
+                }
                 break;
             }
             case "exprStmt":
@@ -4545,7 +5050,7 @@ export class LlEmitter {
                 B.line(`${lenPtr} = getelementptr inbounds %ScrArr, ptr ${arr.name}, i32 0, i32 1`);
                 this.markMemoryPointer(lenPtr, "array:header");
                 B.line(`${len} = load ${this.sizeType}, ptr ${lenPtr}${this.fieldAliasAttachment(lenPtr)}`);
-                B.line(`${lenNumber} = uitofp ${this.sizeType} ${len} to double`);
+                B.line(`${lenNumber} = sitofp ${this.sizeType} ${len} to double`);
                 B.line(`${same} = fcmp oeq double ${length.name}, ${lenNumber}`);
                 B.condBr(same, done, resize);
                 B.startBlock(resize);
@@ -4596,14 +5101,14 @@ export class LlEmitter {
                     const obj = this.emitStableReceiver(s.obj, [s.value]);
                     // (The guard precedes the value here: the nullable store
                     // evaluates it itself.)
-                    this.emitPublishedFieldGuard(obj.name, s.className, s.field);
+                    this.emitStoreGuard(obj.name, s);
                     this.emitNullableFieldStore(obj.name, s.className, s.field, nullable, s.value);
                     break;
                 }
                 if (s.kind === "fieldSet" && this.int32Slots.isField(s.className, s.field)) {
                     const obj = this.emitStableReceiver(s.obj, [s.value]);
                     const v = this.emitExpr(s.value);
-                    this.emitPublishedFieldGuard(obj.name, s.className, s.field);
+                    this.emitStoreGuard(obj.name, s);
                     const { ptr } = this.classFieldPtr(obj.name, s.className, s.field);
                     this.storeInt32Field(ptr, v, s.value);
                     break;
@@ -4611,7 +5116,7 @@ export class LlEmitter {
                 const obj = this.emitStableReceiver(s.obj, [s.value]);
                 const v = this.emitExpr(s.value);
                 if (s.kind === "fieldSet")
-                    this.emitPublishedFieldGuard(obj.name, s.className, s.field);
+                    this.emitStoreGuard(obj.name, s);
                 else if (this.publishedTypes?.recordGuarded(s.shapeId) === true)
                     this.emitPublishedFieldGuard(obj.name, null, s.field);
                 const { ptr, type } = s.kind === "fieldSet"
@@ -4833,7 +5338,7 @@ export class LlEmitter {
                 break;
             }
             case "while": {
-                const workerBudget = this.workerLoopBudget();
+                const workerBudget = this.workerLoopBudget(s);
                 const lc = B.newLabel("loop.c");
                 const lb = B.newLabel("loop.b");
                 const le = B.newLabel("loop.e");
@@ -4858,7 +5363,7 @@ export class LlEmitter {
                 break;
             }
             case "doWhile": {
-                const workerBudget = this.workerLoopBudget();
+                const workerBudget = this.workerLoopBudget(s);
                 // Body first (runs at least once); continue jumps to the CONDITION.
                 const lb = B.newLabel("loop.b");
                 const lc = B.newLabel("loop.c");
@@ -4923,12 +5428,39 @@ export class LlEmitter {
                 }
                 let countedJoin = null;
                 if (countedLoop?.guarded) {
-                    const bound = this.emitExpr(countedLoop.limit);
-                    const safe = B.tmp();
+                    let safe = "true";
+                    if (countedLoop.limitGuarded) {
+                        const bound = this.emitExpr(countedLoop.limit);
+                        safe = B.tmp();
+                        B.line(`${safe} = fcmp ${countedLoop.step > 0 ? "ole" : "oge"} double ${bound.name}, ${f64Lit(countedLoop.guardLimit)}`);
+                    }
+                    if (countedLoop.startGuarded) {
+                        // An exact integer of at most 2^53 - 1 in magnitude, and not -0
+                        // (the bit patterns of the value and its round trip agree).
+                        // NaN and infinities fail the ordered range tests.
+                        const start = this.emitExpr(countedLoop.start);
+                        const low = B.tmp(), high = B.tmp(), raw = B.tmp(), wide = B.tmp(), back = B.tmp(), bits = B.tmp(), backBits = B.tmp(), exact = B.tmp(), inRange = B.tmp(), ok = B.tmp();
+                        B.line(`${low} = fcmp oge double ${start.name}, ${f64Lit(-Number.MAX_SAFE_INTEGER)}`);
+                        B.line(`${high} = fcmp ole double ${start.name}, ${f64Lit(Number.MAX_SAFE_INTEGER)}`);
+                        B.line(`${inRange} = and i1 ${low}, ${high}`);
+                        B.line(`${raw} = fptosi double ${start.name} to i64`);
+                        B.line(`${wide} = freeze i64 ${raw}`);
+                        B.line(`${back} = sitofp i64 ${wide} to double`);
+                        B.line(`${bits} = bitcast double ${start.name} to i64`);
+                        B.line(`${backBits} = bitcast double ${back} to i64`);
+                        B.line(`${exact} = icmp eq i64 ${bits}, ${backBits}`);
+                        B.line(`${ok} = and i1 ${inRange}, ${exact}`);
+                        if (safe === "true")
+                            safe = ok;
+                        else {
+                            const both = B.tmp();
+                            B.line(`${both} = and i1 ${safe}, ${ok}`);
+                            safe = both;
+                        }
+                    }
                     const fast = B.newLabel("counted.fast");
                     const slow = B.newLabel("counted.slow");
                     countedJoin = B.newLabel("counted.done");
-                    B.line(`${safe} = fcmp ${countedLoop.step > 0 ? "ole" : "oge"} double ${bound.name}, ${f64Lit(countedLoop.guardLimit)}`);
                     B.condBr(safe, fast, slow);
                     B.startBlock(slow);
                     this.countedLoopsEnabled = false;
@@ -4947,7 +5479,11 @@ export class LlEmitter {
                     if (integerArrayLoop && s.init?.kind === "varDecl" && s.init.init) {
                         const value = this.emitExpr(s.init.init);
                         start = B.tmp();
-                        B.line(`${start} = fptoui double ${value.name} to ${this.sizeType}`);
+                        // The start is 0 or an enclosing array index plus one (at most
+                        // 2^32 - 1): on 64-bit targets the signed conversion is exact
+                        // and avoids x86-64's unsigned 64-bit conversion sequence.
+                        const conversion = this.sizeType === "i64" ? "fptosi" : "fptoui";
+                        B.line(`${start} = ${conversion} double ${value.name} to ${this.sizeType}`);
                         this.integerArrayBindings.add(integerLoop.localId);
                     }
                     B.line(`store ${this.sizeType} ${start}, ptr ${integerSlot}`);
@@ -5009,7 +5545,7 @@ export class LlEmitter {
                 };
                 const lu = s.update || capturedLets.length > 0 ? B.newLabel("loop.u") : lc;
                 freshenBindings();
-                const workerBudget = this.workerLoopBudget();
+                const workerBudget = this.workerLoopBudget(s);
                 B.br(lc);
                 B.startBlock(lc);
                 this.emitWorkerLoopCheck(workerBudget);
@@ -5117,7 +5653,7 @@ export class LlEmitter {
                 const lb = B.newLabel("fof.b");
                 const lu = B.newLabel("fof.u");
                 const le = B.newLabel("fof.e");
-                const workerBudget = this.workerLoopBudget();
+                const workerBudget = this.workerLoopBudget(s);
                 B.br(lc);
                 B.startBlock(lc);
                 this.emitWorkerLoopCheck(workerBudget);
@@ -5136,7 +5672,7 @@ export class LlEmitter {
                     B.line(`${lenPtr} = getelementptr inbounds %ScrArr, ptr ${arr.name}, i32 0, i32 1`);
                     this.markMemoryPointer(lenPtr, "array:header");
                     B.line(`${rawLen} = load ${this.sizeType}, ptr ${lenPtr}${this.fieldAliasAttachment(lenPtr)}`);
-                    B.line(`${len} = uitofp ${this.sizeType} ${rawLen} to double`);
+                    B.line(`${len} = sitofp ${this.sizeType} ${rawLen} to double`);
                     B.line(`${inBounds} = fcmp olt double ${i}, ${len}`);
                     cur = i;
                 }
@@ -5253,10 +5789,32 @@ export class LlEmitter {
                 // the actual ret. The parked value owns a synthetic slot-backed
                 // scope entry during each copy so a throwing finally releases it.
                 let v = null;
-                if (s.value !== null && this.currentBorrowedReturn) {
+                const moved = this.finallyStack.length === 0 ? this.movableReturn(s.value) : null;
+                if (moved !== null) {
+                    // Returning an owned local hands its reference to the caller: no
+                    // retain now and no release of the local below.
+                    const t = B.tmp();
+                    B.line(`${t} = load ptr, ptr ${moved.entry.slot}`);
+                    v = { name: t, type: s.value.type };
+                    moved.scope.splice(moved.scope.indexOf(moved.entry), 1);
+                    this.releaseForJump(0, 0);
+                    moved.scope.splice(moved.index, 0, moved.entry);
+                }
+                else if (s.value !== null && this.currentBorrowedReturn) {
                     // A borrowed-return body hands back its walk without a reference
-                    // (it has no try statements, so no finally can intervene).
-                    v = this.emitReadReceiver(s.value);
+                    // (it has no try statements, so no finally can intervene). An
+                    // optional element read lends the element its array keeps alive.
+                    const read = this.optionalArrayReads.get(s.value);
+                    if (read) {
+                        const slot = B.slot();
+                        B.entryAllocas.push(`${slot} = alloca ptr`);
+                        emitLocalArrayRead(this, { ...read, borrow: true }, slot);
+                        const t = B.tmp();
+                        B.line(`${t} = load ptr, ptr ${slot}`);
+                        v = { name: t, type: s.value.type };
+                    }
+                    else
+                        v = this.emitReadReceiver(s.value);
                 }
                 else if (s.value !== null) {
                     v = this.emitExpr(s.value);
@@ -5293,7 +5851,7 @@ export class LlEmitter {
                     this.finallyStack = savedFinally;
                     this.tryStack = savedTry;
                 }
-                else {
+                else if (moved === null) {
                     this.releaseForJump(0, 0);
                 }
                 if (!B.isTerminated()) {
@@ -5551,7 +6109,7 @@ export class LlEmitter {
         const caseLabels = s.cases.map(() => B.newLabel("sw.c"));
         const defaultIdx = s.cases.findIndex((c) => c.test === null);
         const fallback = defaultIdx >= 0 ? caseLabels[defaultIdx] : end;
-        if (!emitLiteralSwitch(this, disc, s.cases, caseLabels, fallback)) {
+        if (!emitLiteralSwitch(this, disc, s.disc, s.cases, caseLabels, fallback)) {
             s.cases.forEach((c, i) => {
                 if (c.test === null)
                     return;
@@ -5887,6 +6445,13 @@ export class LlEmitter {
             ``,
         ];
     }
+    /** The frozen-object guard of a class field store, unless the store
+     * provably targets a still-private `this` (PublishedTypes.privateStores). */
+    emitStoreGuard(obj, s) {
+        if (this.publishedTypes?.privateStores.has(s) === true)
+            return;
+        this.emitPublishedFieldGuard(obj, s.className, s.field);
+    }
     /** The frozen-object guard of a class field or record field store:
      * Node's "Cannot assign to read only property" TypeError when the target
      * is published. `className` null means a record (`#<Object>`). */
@@ -5994,6 +6559,16 @@ export class LlEmitter {
             this.B.line(`${value} = load ptr, ptr ${binding.slot}`);
             return { name: value, type: e.type };
         }
+        if (e.kind === "chainRecv") {
+            // The chain's bind slot holds its receiver unchanged until the body
+            // finishes, owned by the slot itself or by the chain's receiver.
+            const bound = this.chainSlots.get(e.id);
+            if (!bound)
+                throw new InternalCompilerError(`llvm emitter bug: chainRecv "${e.id}" outside its chain`);
+            const value = this.B.tmp();
+            this.B.line(`${value} = load ${this.llType(bound.type)}, ptr ${bound.name}`);
+            return { name: value, type: e.type };
+        }
         if (e.kind === "arrayGet" && this.canBorrowReceiver(e)) {
             // The array keeps the element alive until the consumer; a missing
             // element still traps exactly like the owned read.
@@ -6016,6 +6591,10 @@ export class LlEmitter {
                 this.ownSlot(result.owner.slot, result.owner.type);
             return result.value;
         }
+        // A borrowed-return helper (such as an optional element read) lends its
+        // result like any borrowed-return call.
+        if (e.kind === "call" && this.borrowedReturns.has(e.callee) && this.canBorrowReceiver(e))
+            return emitBorrowedResultCall(this, e);
         const arrayRead = this.optionalArrayReads.get(e);
         if (arrayRead)
             return emitProjectedArrayRead(this, arrayRead);
@@ -6229,6 +6808,8 @@ export class LlEmitter {
     }
     canBorrowReceiver(e) {
         switch (e.kind) {
+            case "chainRecv":
+                return this.chainSlots.has(e.id);
             case "varRef": {
                 const binding = this.binding(e.localId);
                 return (binding.kind !== "boxed" ||
@@ -6259,12 +6840,24 @@ export class LlEmitter {
                 const wrap = this.borrowableNullableWrap(e);
                 return wrap === "unit" || (wrap === "ref" && this.canBorrowReceiver(e.value));
             }
-            // A borrowed-return callee preserves edges, so its result stays
-            // reachable from borrowable arguments until the consumer runs.
-            case "call":
-                return (this.borrowedReturns.has(e.callee) &&
-                    e.args.every((arg) => (!isRefCounted(arg.type) || this.canBorrowReceiver(arg)) &&
-                        this.referenceEffects.preserves(arg)));
+            // A borrowed-return result stays reachable from its borrowed
+            // arguments until the consumer runs. Each argument is lent without a
+            // snapshot, so neither the callee nor a later argument may replace
+            // what it was read from: a callee that preserves every edge cannot,
+            // and any other one must leave the argument's locations unwritten.
+            case "call": {
+                if (!this.borrowedReturns.has(e.callee))
+                    return false;
+                if (!e.args.every((arg) => this.referenceEffects.preserves(arg)))
+                    return false;
+                const preserving = this.referenceEffects.functions.has(e.callee);
+                if (preserving)
+                    return e.args.every((arg) => !isRefCounted(arg.type) || this.canBorrowReceiver(arg));
+                if (this.referenceWrites === null)
+                    return false;
+                const lent = borrowableInputs(this, e.args, false, this.referenceWrites.summary(e.callee));
+                return e.args.every((arg, i) => !isRefCounted(arg.type) || lent[i] === true);
+            }
             // A required element read: the (borrowed) array owns the element
             // while an edge-preserving index computes.
             case "arrayGet":
@@ -6310,14 +6903,17 @@ export class LlEmitter {
         };
         const hostFor = (fn) => {
             const allowed = borrowedIds(fn);
-            return {
+            const host = {
                 pointerLocal: (local) => pointer(local.type),
                 borrowsWithoutOwning: (e) => this.borrowsWithoutOwning(e),
                 borrowedReturn: (callee) => this.borrowedReturns.has(callee),
                 parameterAllowed: (id) => allowed.has(id),
             };
+            return this.referenceEffects.functions.has(fn.name) ? host : this.unwrittenWalkHost(fn, host);
         };
-        const preserving = [...this.fnByName.values()].filter((fn) => this.referenceEffects.functions.has(fn.name));
+        // With ReferenceWrites, a body that writes none of its walks' locations
+        // qualifies like one that preserves every edge.
+        const preserving = [...this.fnByName.values()].filter((fn) => this.referenceEffects.functions.has(fn.name) || this.referenceWrites !== null);
         const candidates = preserving.filter((fn) => {
             if (!pointer(fn.returnType) || fn.async || fn.generator || fn.captures)
                 return false;
@@ -6338,6 +6934,8 @@ export class LlEmitter {
                 if (!analyzeWalks(fn, hostFor(fn)).returnsWalk)
                     continue;
                 this.borrowedReturns.add(fn.name);
+                // Nested borrowed returns extend the locations a caller depends on.
+                this.borrowedReturnKeyCache.clear();
                 changed = true;
             }
         }
@@ -6365,6 +6963,12 @@ export class LlEmitter {
                 return this.nullableFieldGet(e) === null;
             case "recordGet":
                 return true;
+            // emitReadReceiver lends a required element of a borrowed array when
+            // computing the index removes no edge.
+            case "arrayGet":
+                return (e.arr.type.kind === "array" &&
+                    this.optionalArrayReads.get(e) === null &&
+                    this.referenceEffects.preserves(e.index));
             case "unionNarrow":
                 return this.nullableUnions.has(e.unionId);
             case "downcast":