@scriptc/compiler 0.4.6 → 0.4.7

package/dist/frontend/lowering/lower-stmts.js

@@ -1,23 +1,26 @@
+import { lowerStaticPrivateAssignment } from "./private-statics.js";
 import { keepsInitializerLayout, notePreservedLayout } from "./structural-instances.js";
+import { partialFieldRead } from "./partial-assertions.js";
 import { jsGlobalValueByName } from "./global-values.js";
 import { lowerTupleAliasDecl, stripTypeWrappers } from "./typed-arguments.js";
-import { islandHandleBinding, lowerIslandExpr, lowerIslandSubclass } from "./lower-node-island.js";
+import { islandHandleBinding, lowerIslandExpr, isIslandRequireSpec, lowerIslandRequireAtStatement, lowerIslandSubclass, } from "./lower-node-island.js";
 import { isIslandSubclassDecl } from "../../node-islands/boundary.js";
 import { allBytesArms, indexedUnionArms, lowerIndexedUnionMember, lowerIndexedUnionNumberRead, lowerIndexedUnionRead, } from "./indexed-unions.js";
-import { declaredMemberOf, isPromisePrototypeRead, lowerUnionKeyedRead, } from "./expressions/property-access.js";
+import { declaredMemberOf, fenceDatePrototypeWrite, isPromisePrototypeRead, lowerUnionKeyedRead, } from "./expressions/property-access.js";
 import { hostedStorageView, hostsAll } from "./expressions/hosted-narrowing.js";
 import { requestGeneralStreamSurface } from "./general-streams.js";
 import { lowerForAwaitDynStream, nodeStreamInterfaceSide } from "./dyn-streams.js";
 import { lowerForAwaitValueStream } from "./builtins/hash-stream.js";
 import { lowerChildPropertyWrite } from "./handle-properties.js";
 import { matchAllRowsReadByElements, storedMatchAllRowsReadByElements, } from "./containers/match-row-uses.js";
-import { dynUndefinedExpr, nodeThrowExpr, numLit, varRef } from "../../ir/build.js";
+import { dynUndefinedExpr, nodeThrowExpr, numLit, strLit, varRef } from "../../ir/build.js";
 import { runtimeKeyPatternRead } from "./expressions/keyed-field-targets.js";
 import { declaresHoistedBinding, staticCondition } from "./static-typeof.js";
 import { lowerCollectionSpread } from "./containers/collection-methods.js";
 import { lowerEventObjectPropertyWrite } from "./lower-event-target.js";
 import { lowerDynObjectLiteral } from "./expressions/object-literals.js";
 import { importMetaBindingSource } from "./import-meta.js";
+import { nullishEmptyPatternSource } from "./nullish-empty-pattern.js";
 import { anyResidueReplacedBy } from "./any-collection-residue.js";
 import { iteratorCanStep, iteratorValue } from "./iterator-consumption.js";
 import { notIterableSpelling } from "./iterable-spelling.js";
@@ -31,6 +34,7 @@ import { isWebStreamValueInJavaScript, typeInvolvesWebStream } from "./builtins/
 import * as ts from "../ts7/adapter.js";
 import { lowerOptionalIndex } from "./undefined-index.js";
 import { processDataMemberValue, programReadsExitCode } from "./builtins/process.js";
+import { heldEnvValueType, refuseHeldEnvCopyHold } from "./builtins/environment.js";
 import { requireInitFlagStmt } from "./require-initialization.js";
 import { isJsonRequireDecl } from "./json-require.js";
 import { isTimeValueDateDeclaration } from "./date-values.js";
@@ -43,7 +47,7 @@ import { isDeadTscHelperDecl, tscInteropBindingOfDecl } from "./cjs-tsc-interop.
 import { arrayValueRead, arrayValueStore, arrayValueType, unionArrayValueRead, lowerSafeIndexRead, } from "./array-values.js";
 import { lowerForAwaitGenerator, lowerForOfGenerator, lowerYieldStarStatement, } from "./lower-generators.js";
 import { classAsyncGeneratorIterator, lowerForAwaitBuiltin } from "./lower-async-iteration.js";
-import { BOOL, BYTES_U8, CAUGHT, DATE_T, DYN, F64, SEARCH_PARAMS_T, STRING, UNDEFINED_T, VOID, arrayOf, isDynTypedRefType, isUnitType, shapeHasAccessorSlots, typeEquals, } from "../../ir/ir.js";
+import { BOOL, BYTES_U8, CAUGHT, DATE_T, DYN_HANDLE_KINDS, DYN, F64, SEARCH_PARAMS_T, STRING, UNDEFINED_T, VOID, arrayOf, isDynTypedRefType, isUnitType, shapeHasAccessorSlots, typeEquals, } from "../../ir/ir.js";
 import { PoisonError, boundIdentifiersOf, dynFallbackType, neverTaintedJsType, staticImportNamespaceType, } from "./lowerer.js";
 import { enforceLibBoundary, lowerSurplusCalls } from "./lib-boundary.js";
 import { cjsExportAssignmentOf, cjsExportChainOf, cjsVoidInitPreambleReals, cjsExportDiscardReason, cjsExportTargetLiteral, isCjsJsFile, isEsModuleStamp, isJsSourceFile, locOf, requireEarlyReference, requireSpecOf, } from "../program.js";
@@ -734,8 +738,11 @@ function lowerOneStatement(lowerer, stmt, out, usingMarkers, diagsBefore, deferF
     if (deferFences && lowerer.diagSink === null && lowerer.diags.length > diagsBefore) {
         const flushed = lowerer.diags.splice(diagsBefore);
         const ice = flushed.filter((d) => d.code === "SC9001");
-        lowerer.diags.push(...ice);
-        lowerer.runtimeFences.push(...flushed.filter((d) => d.code !== "SC9001"));
+        for (const d of ice)
+            lowerer.diags.push(d);
+        for (const d of flushed)
+            if (d.code !== "SC9001")
+                lowerer.runtimeFences.push(d);
     }
 }
 /** Whether a statement list belongs to a function body (at any block
@@ -883,6 +890,11 @@ export function predeclareForwardCapture(lowerer, symbol) {
                     lowerer.isStdlibGlobal(decl.initializer.expression.expression, "Object"))) &&
             lowerer.dynConvertible(type))
             type = DYN;
+        // An island handle binding holds a checked-dynamic value whatever its
+        // declared type says: its own declaration lowers as one, and so must
+        // the slot a closure captured first.
+        if (islandHandleBinding(lowerer, decl.name))
+            type = DYN;
         if (!TDZ_KINDS.has(type.kind) || isUnitType(type))
             return false;
         const name = decl.name.text;
@@ -995,8 +1007,11 @@ export function predeclareForwardFnDecl(lowerer, symbol) {
         }
         catch (e) {
             entry.ctx.hoistedFnDecls.delete(decl);
-            if (previousSink !== null)
-                previousSink.push(...lowerer.diags.splice(diagsBefore));
+            if (previousSink !== null) {
+                const flushed = lowerer.diags.splice(diagsBefore);
+                for (const d of flushed)
+                    previousSink.push(d);
+            }
             throw e;
         }
         finally {
@@ -1023,7 +1038,9 @@ function hostVariableDeclarationOf(name) {
     while (ts.isBindingElement(n) || ts.isArrayBindingPattern(n) || ts.isObjectBindingPattern(n)) {
         n = n.parent;
     }
-    return ts.isVariableDeclaration(n) ? n : null;
+    // A catch parameter is a VariableDeclaration of the CatchClause: its
+    // bindings are scoped to the clause, and each execution makes new ones.
+    return ts.isVariableDeclaration(n) && !ts.isCatchClause(n.parent) ? n : null;
 }
 /** `for (var x of ...)` loop variables: the ONE function-scoped binding
  * every for-of desugar must ASSIGN per iteration instead of declaring a
@@ -1483,10 +1500,12 @@ const THROWN_AS_DYN = new Set([
 ]);
 /** A `return` at the top level of a CommonJS module (preflight admits it
  * there only): it ends the module's evaluation, and its value is
- * evaluated and discarded, as Node's module wrapper does. Top-level
- * bindings and export assignments after it would be left uninitialized
- * where Node leaves them in their temporal dead zone or absent, so a
- * module with any keeps a refusal. Null for a return inside a function. */
+ * evaluated and discarded, as Node's module wrapper does. Bindings
+ * declared after it stay uninitialized when it is taken, which only code
+ * that exists by then can observe: a function created before the return,
+ * or a hoisted function declaration. A module whose such functions read a
+ * later binding, or that assigns exports after the return, keeps a
+ * refusal. Null for a return inside a function. */
 function lowerModuleLevelReturn(lowerer, stmt) {
     let top = stmt;
     while (top.parent !== undefined && !ts.isSourceFile(top.parent)) {
@@ -1498,9 +1517,25 @@ function lowerModuleLevelReturn(lowerer, stmt) {
     if (sf === undefined || !ts.isSourceFile(sf))
         return null;
     const stmts = sf.statements.nodes;
-    const later = stmts.slice(stmts.indexOf(top) + 1);
-    if (later.some((s) => ts.isVariableStatement(s) || ts.isClassDeclaration(s) || cjsExportAssignmentOf(s) !== null)) {
-        lowerer.unsupported("SC1090", stmt, "a top-level return in a CommonJS module that declares variables or classes, or assigns exports, after it");
+    const index = stmts.indexOf(top);
+    const later = stmts.slice(index + 1);
+    if (later.some((s) => cjsExportAssignmentOf(s) !== null)) {
+        lowerer.unsupported("SC1090", stmt, "a top-level return in a CommonJS module that assigns exports after it");
+    }
+    const laterBindings = laterModuleBindings(lowerer, later);
+    if (laterBindings.size > 0) {
+        // Functions that exist when the return is taken: every function in the
+        // statements up to the return, and the hoisted declarations after it.
+        const reachable = [
+            ...stmts.slice(0, index + 1),
+            ...later.filter((s) => ts.isFunctionDeclaration(s)),
+        ];
+        const read = reachable
+            .map((s) => functionReadOf(lowerer, s, laterBindings, ts.isFunctionDeclaration(s)))
+            .find((r) => r !== null);
+        if (read) {
+            lowerer.unsupported("SC1090", read, `reading '${read.text}', declared after a top-level CommonJS return, from a function that can run once the return is taken`);
+        }
     }
     const loc = locOf(stmt);
     const ret = { kind: "return", value: null, loc };
@@ -1512,6 +1547,50 @@ function lowerModuleLevelReturn(lowerer, stmt) {
         loc,
     };
 }
+/** The module-scope bindings `stmts` declare: variables and classes, with
+ * `var` declarations in nested blocks. Bindings inside functions are not
+ * module-scope and are skipped. */
+function laterModuleBindings(lowerer, stmts) {
+    const bindings = new Set();
+    const addName = (name) => {
+        if (ts.isIdentifier(name)) {
+            const symbol = lowerer.checker.getSymbolAtLocation(name);
+            if (symbol)
+                bindings.add(symbol);
+            return;
+        }
+        for (const element of name.elements.nodes) {
+            if (ts.isBindingElement(element) && element.name)
+                addName(element.name);
+        }
+    };
+    const visit = (node) => {
+        if (ts.isFunctionLike(node) || ts.isClassStaticBlockDeclaration(node))
+            return;
+        if (ts.isVariableDeclaration(node))
+            addName(node.name);
+        if (ts.isClassDeclaration(node) && node.name)
+            addName(node.name);
+        ts.forEachChild(node, visit);
+    };
+    for (const stmt of stmts)
+        visit(stmt);
+    return bindings;
+}
+/** The first identifier inside a function or class in `node` (anywhere in
+ * `node` when `inFunction`) that reads one of `bindings`, or null. */
+function functionReadOf(lowerer, node, bindings, inFunction) {
+    if (inFunction && ts.isIdentifier(node)) {
+        const symbol = lowerer.resolveValueSymbol(node);
+        return symbol && bindings.has(symbol) ? node : null;
+    }
+    // Class bodies count as functions: field initializers run per instance.
+    const nested = inFunction ||
+        ts.isFunctionLike(node) ||
+        ts.isClassDeclaration(node) ||
+        ts.isClassExpression(node);
+    return (ts.forEachChild(node, (child) => functionReadOf(lowerer, child, bindings, nested) ?? undefined) ?? null);
+}
 export function lowerStmt(lowerer, stmt) {
     if (ownPrototypeResetStatement(lowerer, stmt))
         return { kind: "block", body: [], loc: locOf(stmt) };
@@ -1865,6 +1944,11 @@ function lowerVarDeclarator(lowerer, stmt, decl, isConst, isLet) {
         if (lowerer.externalTypes.has(spec))
             lowerer.externalHostFence(spec, decl, false);
         if (ts.isSourceFile(stmt.parent)) {
+            // `const x = require("<island>")` and `const { name } = …`: the
+            // island module loads here, at the statement (lower-node-island.ts).
+            const island = lowerIslandRequireAtStatement(lowerer, decl);
+            if (island !== null)
+                return [island];
             const init = lowerer.requireInitStmt(spec, decl);
             const out = init ? [init] : [];
             // Nested patterns destructure the named export's value right after
@@ -1883,6 +1967,12 @@ function lowerVarDeclarator(lowerer, stmt, decl, isConst, isLet) {
         // same routing top-level requires use, and no statement remains.
         // Relative requires keep the fence: their module-init-at-position
         // semantics needs storage this model doesn't represent.
+        // A nested require of an island package is an ordinary binding of the
+        // island module, loaded at the statement (lower-node-island.ts).
+        if (isIslandRequireSpec(lowerer, ts.getSourceFileOfNode(decl).fileName, spec)) {
+            const lowered = lowerer.lowerVarDecl(decl, isLet);
+            return lowered ? [lowered] : [];
+        }
         if (canonicalBuiltinModule(spec) !== null) {
             return canonicalBuiltinModule(spec) === "punycode"
                 ? [lowerer.punycodeRequireWarning(decl)]
@@ -2142,6 +2232,7 @@ export function lowerDestructuringDecl(lowerer, decl, isLet) {
             return tokenBound;
     }
     let init = importMetaBindingSource(lowerer, decl.name, decl.initializer) ??
+        nullishEmptyPatternSource(lowerer, decl.name, decl.initializer) ??
         lowerer.lowerExpr(decl.initializer);
     const parseArgsDynObject = init.type.kind === "dyn" &&
         isParseArgsDynCheckerType(lowerer, lowerer.typeOf(decl.initializer));
@@ -2187,13 +2278,26 @@ export function lowerDestructuringDecl(lowerer, decl, isLet) {
         }
     }
     const out = [];
+    // V8's destructuring TypeError spells STATIC sources: an identifier
+    // source reads "<name> is not iterable", an identifier-callee call
+    // "<name> is not a function or its return value is not iterable";
+    // everything else (property reads, method calls, parameters) gets the
+    // runtime kind wording — exactly V8's CallPrinter behavior. The DYN
+    // pattern arm and the unit arms of a narrowed union consume this.
+    const src = decl.initializer;
+    const dynSpell = ts.isIdentifier(src)
+        ? `${src.text} is not iterable`
+        : ts.isCallExpression(src) && ts.isIdentifier(src.expression)
+            ? `${src.expression.text} is not a function or its return value is not iterable`
+            : undefined;
     // JS: a union source with exactly ONE destructurable arm beside unit
     // arms (`nameAndArgs.match(re)` — `RegExpMatchArray | null`, the
     // always-matches idiom) destructures through a VALIDATED narrow: the
-    // unit arms throw at runtime exactly where Node's TypeError would
-    // (the message is the fence's — a unit value here is the failure
-    // path either way). TypeScript keeps the fence: narrowing first is
-    // the annotated fix.
+    // unit arms throw Node's TypeError, through the checks a dyn source
+    // takes (RequireObjectCoercible for an object pattern, GetIterator for
+    // an array pattern). An object pattern whose source has no V8
+    // spelling keeps the fence. TypeScript keeps the fence: narrowing
+    // first is the annotated fix.
     if (isJsSourceFile(ts.getSourceFileOfNode(decl)) && init.type.kind === "union") {
         const def = lowerer.unions.get(init.type.unionId);
         const dataArms = (def?.arms ?? []).filter((a) => !isUnitType(a));
@@ -2204,9 +2308,56 @@ export function lowerDestructuringDecl(lowerer, decl, isLet) {
             def.arms.every((a) => a === arm || isUnitType(a)) &&
             (arm.kind === "array" || arm.kind === "record")) {
             const tag = def.arms.indexOf(arm);
+            const unionId = init.type.unionId;
             const utmp = lowerer.declareHiddenLocal("%destrU", init.type);
             out.push({ kind: "varDecl", localId: utmp.id, init, loc });
             const uref = { kind: "varRef", localId: utmp.id, type: init.type, loc };
+            // The failure branch holds one of the unit arms: the check reads it
+            // as the dyn null or undefined it is, so the data arm needs no dyn
+            // form (a record holding a generator has none).
+            const unitValue = () => {
+                const unitOf = (t) => lowerer.coerceToExpected({ kind: "unitLit", unit: t.kind === "nullT" ? "null" : "undefined", type: t, loc }, DYN);
+                const units = def.arms.filter(isUnitType);
+                const last = units[units.length - 1];
+                return units.slice(0, -1).reduceRight((rest, t) => ({
+                    kind: "ternary",
+                    cond: {
+                        kind: "unionIsTag",
+                        unionId,
+                        tag: def.arms.indexOf(t),
+                        negated: false,
+                        value: uref,
+                        type: BOOL,
+                        loc,
+                    },
+                    then: unitOf(t),
+                    else_: rest,
+                    type: DYN,
+                    loc,
+                }), unitOf(last));
+            };
+            const spelling = destrSpellingOf(src);
+            const check = ts.isArrayBindingPattern(decl.name)
+                ? {
+                    kind: "dynIterN",
+                    value: unitValue(),
+                    count: decl.name.elements.nodes.length,
+                    ...(dynSpell ? { notIterableMessage: dynSpell } : {}),
+                    type: DYN,
+                    loc,
+                }
+                : firstReadsWithDefault(decl.name)
+                    ? firstKeyRead(lowerer, decl.name, unitValue, loc)
+                    : spelling !== null
+                        ? {
+                            kind: "dynDestrCheck",
+                            value: unitValue(),
+                            spelling,
+                            ...firstPatternProp(lowerer, decl.name),
+                            type: DYN,
+                            loc,
+                        }
+                        : null;
             out.push({
                 kind: "if",
                 cond: {
@@ -2219,6 +2370,7 @@ export function lowerDestructuringDecl(lowerer, decl, isLet) {
                     loc,
                 },
                 then: [
+                    ...(check !== null ? [{ kind: "exprStmt", expr: check, loc }] : []),
                     {
                         kind: "runtimeFence",
                         code: "SC1031",
@@ -2241,58 +2393,40 @@ export function lowerDestructuringDecl(lowerer, decl, isLet) {
     // value: RequireObjectCoercible with V8's own TypeError ("Cannot
     // destructure property 'a' of 'f(...)' as it is null.") for the source
     // spellings the assignment form reproduces; other sources are refused,
-    // as in the assignment form. JavaScript files keep their existing
-    // per-read errors, except that a runtime computed first key checks the
-    // source first: Node throws before it evaluates any key, and V8's bare
-    // message names the source.
-    const jsRuntimeKeyCheck = init.type.kind === "dyn" &&
+    // as in the assignment form. A JavaScript object pattern over a dyn
+    // source checks the source first in the same way when V8 can spell it,
+    // so a null or undefined source throws Node's message before any key
+    // is read or evaluated; other sources keep their per-read errors. V8
+    // skips the check when the first element has a default and a static
+    // key: the read of that key throws ("Cannot read properties of null
+    // (reading 'a')"), and so does the lowering's.
+    const jsSourceCheck = init.type.kind === "dyn" &&
         ts.isObjectBindingPattern(decl.name) &&
         isJsSourceFile(ts.getSourceFileOfNode(decl)) &&
-        (decl.name.elements.nodes.length === 0 || startsWithRuntimeKey(lowerer, decl.name)) &&
         destrSpellingOf(decl.initializer) !== null;
-    if (jsRuntimeKeyCheck ||
+    if ((jsSourceCheck ||
         (init.type.kind === "dyn" &&
             ts.isObjectBindingPattern(decl.name) &&
             !isJsSourceFile(ts.getSourceFileOfNode(decl)) &&
-            lowerer.anyOrigin(decl.initializer))) {
+            lowerer.anyOrigin(decl.initializer))) &&
+        !firstReadsWithDefault(decl.name)) {
         const spelling = destrSpellingOf(decl.initializer);
         if (spelling === null) {
             lowerer.unsupported("SC1031", decl.initializer, "destructuring declaration from an `any` source whose expression spelling is unsupported (use a variable, ordinary property chain, or ordinary call)");
         }
-        const first = decl.name.elements.nodes[0];
-        const firstKey = first === undefined || first.dotDotDotToken !== undefined
-            ? undefined
-            : (first.propertyName ?? first.name);
-        // V8 names the first property when its key is an identifier, a string
-        // or a number; a computed first key takes the bare (source-only) form.
-        const firstProp = firstKey === undefined || ts.isComputedPropertyName(firstKey)
-            ? undefined
-            : (patternKeyNameOf(lowerer, firstKey) ?? undefined);
         out.push({
             kind: "exprStmt",
             expr: {
                 kind: "dynDestrCheck",
                 value: { kind: "varRef", localId: tmp.id, type: init.type, loc },
                 spelling,
-                ...(firstProp !== undefined ? { firstProp } : {}),
+                ...firstPatternProp(lowerer, decl.name),
                 type: init.type,
                 loc,
             },
             loc,
         });
     }
-    // V8's destructuring TypeError spells STATIC sources: an identifier
-    // source reads "<name> is not iterable", an identifier-callee call
-    // "<name> is not a function or its return value is not iterable";
-    // everything else (property reads, method calls, parameters) gets the
-    // runtime kind wording — exactly V8's CallPrinter behavior. Only the
-    // DYN pattern arm consumes this.
-    const src = decl.initializer;
-    const dynSpell = ts.isIdentifier(src)
-        ? `${src.text} is not iterable`
-        : ts.isCallExpression(src) && ts.isIdentifier(src.expression)
-            ? `${src.expression.text} is not a function or its return value is not iterable`
-            : undefined;
     lowerer.lowerBindingPattern(decl.name, () => ({ kind: "varRef", localId: tmp.id, type: init.type, loc }), init.type, isLet, out, dynSpell, parseArgsDynObject);
     return out;
 }
@@ -3198,6 +3332,10 @@ export function lowerBindingPattern(lowerer, pattern, srcRef, srcType, isLet, ou
             type: fieldType,
             loc,
         };
+        // A field some partial record assertion leaves unwritten (a partial
+        // record view, partial-assertions.ts): the element read throws the
+        // catchable TypeError instead of reading a slot the view lacks.
+        value = partialFieldRead(lowerer, srcRef(), srcType.shapeId, propName, fieldType, loc) ?? value;
         // `{ tld = "localhost" }`: the element default applies exactly when
         // the field holds the undefined arm — the same undefined test and
         // narrow/retag as a defaulted parameter's prologue (declareParams).
@@ -4643,9 +4781,13 @@ export function lowerVarDeclList(lowerer, list) {
     const out = [];
     for (const decl of list.declarations.nodes) {
         if (ts.isArrayBindingPattern(decl.name) || ts.isObjectBindingPattern(decl.name)) {
-            // Destructuring produces nested initialization blocks; copying
-            // their captured bindings still needs a distinct head-scope plan.
-            lowerer.unsupported("SC1031", decl.name, "let/const destructuring in for-loop initializers (declare the pattern before the loop, or use var)");
+            // The pattern desugars to a flat statement list whose bindings are
+            // ordinary head declarations (`for (let [a, b] = xs; ...)`: `%destr`
+            // plus `a`, `b`), so the loop emitter finds them as head lets and
+            // freshens the captured ones per iteration like any other
+            // declarator (emit-statements: capturedLets).
+            out.push(...lowerer.lowerDestructuringDecl(decl, isLet));
+            continue;
         }
         const lowered = lowerer.lowerVarDecl(decl, isLet);
         if (!lowered)
@@ -4864,17 +5006,24 @@ function evolvingArrayHolderType(lowerer, decl) {
 /** A single static type for an initializer-less JavaScript `let` whose
  * later plain writes all agree. An evolving JS local reads as `undefined`
  * until control flow proves a write, so a scalar slot is sound only when
- * every ordinary use already has that concrete flow type. Any closure
- * capture stays checked-dynamic: it can observe the local before an outer
- * assignment, and the checker deliberately leaves captured evolving lets
- * broad. */
-function inferredEvolvingLetType(lowerer, decl) {
+ * every ordinary use already has that concrete flow type. A write's call
+ * counts when its signature is declared in the standard library, whose
+ * return types are declared rather than inferred from JavaScript. A
+ * closure capture can observe the local before an outer assignment, and
+ * the checker leaves captured evolving lets broad: a captured runtime
+ * handle (`let child; if (...) child = spawn(...)`) takes the handle or
+ * `undefined`, which nested functions read as a checked-dynamic value
+ * (closureDynLets), and other captured bindings stay checked-dynamic. */
+export function inferredEvolvingLetType(lowerer, decl) {
     if (!ts.isIdentifier(decl.name))
         return null;
     const symbol = lowerer.checker.getSymbolAtLocation(decl.name);
     const scope = decl.parent?.parent?.parent;
     if (symbol === undefined || (!ts.isBlock(scope) && !ts.isSourceFile(scope)))
         return null;
+    // Another module reads an exported binding, which this scan does not see.
+    if (ts.getCombinedModifierFlags(decl) & ts.ModifierFlags.Export)
+        return null;
     // A shorthand property's name (`{ width }`) resolves to the property
     // symbol, but it reads the binding: the checker's shorthand-value symbol.
     const refersToBinding = (node) => (ts.isShorthandPropertyAssignment(node.parent) && node.parent.name === node
@@ -4904,10 +5053,19 @@ function inferredEvolvingLetType(lowerer, decl) {
     const writes = [];
     const reads = [];
     let invalid = false;
-    ts.walkPreorder(scope, (node) => {
-        if (node !== scope && ts.isFunctionLike(node)) {
-            if (captures(node))
-                invalid = true;
+    let captured = false;
+    // The capturing closure being scanned: reads inside one carry the
+    // checker's broad type, so only its writes are collected.
+    let closure = null;
+    const visit = (node) => {
+        if (node !== scope && node !== closure && ts.isFunctionLike(node)) {
+            if (captures(node)) {
+                captured = true;
+                const outer = closure;
+                closure = node;
+                ts.walkPreorder(node, visit);
+                closure = outer;
+            }
             return "skip";
         }
         if (ts.isBinaryExpression(node)) {
@@ -4919,9 +5077,7 @@ function inferredEvolvingLetType(lowerer, decl) {
                     invalid = true;
                     return "stop";
                 }
-                if (ts.isCallExpression(node.right) &&
-                    (implicitMethodCallInfersReturn(lowerer, node.right) ||
-                        isJsSourceFile(ts.getSourceFileOfNode(node.right)))) {
+                if (ts.isCallExpression(node.right) && !stdlibDeclaredCall(lowerer, node.right)) {
                     invalid = true;
                     return "stop";
                 }
@@ -4948,23 +5104,40 @@ function inferredEvolvingLetType(lowerer, decl) {
             invalid = true;
             return "stop";
         }
-        if (ts.isIdentifier(node) &&
+        if (closure === null &&
+            ts.isIdentifier(node) &&
             node !== decl.name &&
             refersToBinding(node) &&
             !isPlainAssignmentTarget(node)) {
             reads.push(node);
         }
         return undefined;
-    });
+    };
+    ts.walkPreorder(scope, visit);
     const first = writes[0];
     if (invalid || first === undefined || !writes.every((write) => typeEquals(write, first)))
         return null;
-    return reads.every((read) => {
+    if (!reads.every((read) => {
         const mapped = lowerer.mapTypeOf(lowerer.typeOf(read));
         return mapped !== null && typeEquals(mapped, first);
-    })
-        ? first
-        : null;
+    }))
+        return null;
+    if (!captured)
+        return first;
+    if (!DYN_HANDLE_KINDS.has(first.kind))
+        return null;
+    lowerer.closureDynLets.add(symbol);
+    return { kind: "union", unionId: lowerer.unions.intern([first, UNDEFINED_T]) };
+}
+/** Whether a call's resolved signature is declared in the standard library
+ * (`spawn(...)`), so its declared return type is the value's type. Calls of
+ * JavaScript functions, and implicit generic methods, infer theirs, and a
+ * `require(...)` result is a module rather than a value of its type. */
+function stdlibDeclaredCall(lowerer, call) {
+    if (implicitMethodCallInfersReturn(lowerer, call) || requireSpecOf(call) !== null)
+        return false;
+    const declaration = lowerer.checker.getResolvedSignature(call)?.declaration;
+    return declaration !== undefined && lowerer.isStdlibFile(ts.getSourceFileOfNode(declaration));
 }
 export function lowerVarDecl(lowerer, decl, isLet) {
     // --provenance-sources: an elided pure-annotated dead const emits
@@ -5001,6 +5174,10 @@ export function lowerVarDecl(lowerer, decl, isLet) {
     }
     if (!ts.isIdentifier(decl.name))
         lowerer.unsupported("SC1031", decl.name);
+    // A binding that holds `process.env` under any type but the env record
+    // is a snapshot copy whose reads would drift from Node's live table
+    // (refuseHeldEnvCopyHold); refuse it here, at the hold itself.
+    refuseHeldEnvCopyHold(lowerer, decl.name, decl);
     {
         const alias = lowerTupleAliasDecl(lowerer, decl);
         if (alias)
@@ -5444,6 +5621,13 @@ export function lowerVarDecl(lowerer, decl, isLet) {
         type = init.type;
         notePreservedLayout(lowerer, decl);
     }
+    // A JavaScript binding assigned values outside its declared type
+    // (analyzeJsWidenedBindings in lowerer.ts) holds them as checked-dynamic.
+    {
+        const symbol = lowerer.resolveValueSymbol(decl.name);
+        if (symbol && lowerer.jsWidenedBindings.has(symbol))
+            type = DYN;
+    }
     // A typed-arguments function expression (typed-arguments.ts): the
     // checker types the binding variadic, but its value has the fixed
     // signature every use asserts.
@@ -6129,10 +6313,14 @@ export function jsBindingHasOpenWrites(lowerer, decl) {
         return false;
     if (candidates.some((node) => (lowerer.typeOf(node.right).flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !== 0))
         return true;
-    // A `+=` of a string turns a number or boolean binding into a string
-    // (`n += "px"`); the checker keeps the declared type.
+    // A `+=` of a string, or of a value that may be one, turns a number or
+    // boolean binding into a string (`n += "px"`); the checker keeps the
+    // declared type.
+    const mayBeString = (type) => type.flags & ts.TypeFlags.Union
+        ? constituentTypes(type).some(mayBeString)
+        : (type.flags & ts.TypeFlags.StringLike) !== 0;
     if (candidates.some((node) => node.operatorToken.kind === ts.SyntaxKind.PlusEqualsToken &&
-        (lowerer.typeOf(node.right).flags & ts.TypeFlags.StringLike) !== 0)) {
+        mayBeString(lowerer.typeOf(node.right)))) {
         const declared = lowerer.mapTypeOf(lowerer.typeOf(decl.name));
         if (declared?.kind === "f64" || declared?.kind === "bool")
             return true;
@@ -6163,6 +6351,11 @@ export function jsBindingHasOpenWrites(lowerer, decl) {
         return false;
     return differing.some((node) => {
         const written = lowerer.mapTypeOf(lowerer.typeOf(node.right));
+        // A union a primitive binding cannot hold (`x = c ? 1 : "a"` into
+        // `var x = 0`).
+        if (written?.kind === "union" &&
+            (declared.kind === "f64" || declared.kind === "bool" || declared.kind === "string"))
+            return true;
         return (written !== null &&
             written.kind !== "dyn" &&
             written.kind !== "union" &&
@@ -6480,10 +6673,15 @@ function lowerBranchSwitch(lowerer, stmt, disc, labels, compare) {
  *   === "string"/"number"/"boolean"`), reads under a proven narrow
  *   (caughtRead bridges them with caughtNarrow, verified at run time like
  *   unionNarrow), and rethrow (`throw e`). Unsupported raw uses and
- *   assignments are fenced (SC1063 and friends); destructuring patterns
- *   are SC1062. Captures retain the snapshot beyond the catch scope.
- *   The `: any` / `: unknown` annotations tsc admits both
- *   lower the same way (tsc narrows either through the tests).
+ *   assignments are fenced (SC1063 and friends). The `: any` /
+ *   `: unknown` annotations tsc admits both lower the same way (tsc
+ *   narrows either through the tests). Captures retain the snapshot
+ *   beyond the catch scope.
+ * - `catch ([a])` / `catch ({ p })` binds the thrown value through a
+ *   destructuring pattern: the exception cell keeps its hidden CAUGHT
+ *   local, and the pattern reads its checked-dynamic view
+ *   (caughtToDyn), so a JS catch parameter that destructures lowers the
+ *   way the same pattern does over an `any` source.
  * - `finally` runs on normal completion, exception paths, and every
  *   abrupt completion that crosses it. Return values are snapshotted
  *   before cleanup; an abrupt completion inside the finally replaces the
@@ -6496,9 +6694,6 @@ export function lowerTry(lowerer, stmt) {
     let catchLocalId = null;
     if (stmt.catchClause) {
         const vd = stmt.catchClause.variableDeclaration;
-        if (vd && !ts.isIdentifier(vd.name)) {
-            lowerer.unsupported("SC1062", vd);
-        }
         if (vd && ts.isIdentifier(vd.name)) {
             lowerer.scopes.push(new Map());
             try {
@@ -6511,7 +6706,59 @@ export function lowerTry(lowerer, stmt) {
             }
         }
         else {
-            catchBody = lowerer.lowerScopedBlock(stmt.catchClause.block);
+            lowerer.scopes.push(new Map());
+            try {
+                if (vd) {
+                    // `catch ([a])` / `catch ({ a })`: the thrown value crosses into
+                    // the checked-dynamic tree and the pattern binds through the same
+                    // per-read fences a dyn source takes — GetIterator for an array
+                    // pattern (positions past the end bind undefined, an iterator
+                    // with values left closes) and RequireObjectCoercible plus keyed
+                    // reads for an object pattern. The hidden CAUGHT local is the
+                    // exception cell every other catch path binds; the dyn conversion
+                    // is its identity-preserving view (caughtToDyn).
+                    const loc = locOf(vd);
+                    const local = lowerer.declareHiddenLocal("%caught", CAUGHT);
+                    catchLocalId = local.id;
+                    const tmp = lowerer.declareHiddenLocal("%destr", DYN);
+                    const out = [
+                        {
+                            kind: "varDecl",
+                            localId: tmp.id,
+                            init: { kind: "caughtToDyn", value: varRef(local.id, CAUGHT, loc), type: DYN, loc },
+                            loc,
+                        },
+                    ];
+                    // V8 spells the catch parameter's source '.catch' in the
+                    // RequireObjectCoercible TypeError ("Cannot destructure property
+                    // 'a' of '.catch' as it is null."), except when the first element
+                    // has a default: V8 reads that key first, so a nullish source
+                    // throws the read's TypeError, which the pattern's own first read
+                    // throws.
+                    if (ts.isObjectBindingPattern(vd.name) && !firstReadsWithDefault(vd.name))
+                        out.push({
+                            kind: "exprStmt",
+                            expr: {
+                                kind: "dynDestrCheck",
+                                value: varRef(tmp.id, DYN, loc),
+                                spelling: ".catch",
+                                ...firstPatternProp(lowerer, vd.name),
+                                type: DYN,
+                                loc,
+                            },
+                            loc,
+                        });
+                    lowerer.lowerBindingPattern(vd.name, () => varRef(tmp.id, DYN, loc), DYN, true, // catch bindings are mutable
+                    out);
+                    catchBody = [...out, ...lowerer.lowerScopedBlock(stmt.catchClause.block)];
+                }
+                else {
+                    catchBody = lowerer.lowerScopedBlock(stmt.catchClause.block);
+                }
+            }
+            finally {
+                lowerer.scopes.pop();
+            }
         }
     }
     const finallyBody = stmt.finallyBlock ? lowerer.lowerScopedBlock(stmt.finallyBlock) : null;
@@ -6524,13 +6771,45 @@ export function lowerTry(lowerer, stmt) {
         loc: locOf(stmt),
     };
 }
+/** The refusal for `delete` of an optional `unknown`/`any` field, whose
+ * slot is the checked-dynamic one and so has no ABSENT state to write. */
+const OPTIONAL_CHECKED_DYN_DELETE = "'delete' of optional 'unknown'/'any' fields (the checked-dynamic slot has no absent state yet — an omitted such field already reads as present)";
+/** TypeScript's declaration marks property `name` of `receiver` optional
+ * (`?:`), in every union constituent. A mapped IR type cannot tell an
+ * optional `unknown`/`any` field from a required one — both ride the
+ * checked-dynamic slot — so a refused `delete`'s real reason comes from
+ * the declaration. */
+function declaredOptionalProperty(lowerer, receiver, name) {
+    const receiverType = lowerer.typeOf(receiver);
+    const parts = receiverType.flags & ts.TypeFlags.Union ? constituentTypes(receiverType) : [receiverType];
+    return parts.every((part) => {
+        const property = lowerer.checker.getPropertyOfType(part, name);
+        return property !== undefined && (property.flags & ts.SymbolFlags.Optional) !== 0;
+    });
+}
+/** `type` — a record or a union whose every arm is a non-tuple record —
+ * declares `name` in the checked-dynamic slot, which has no ABSENT state:
+ * an optional such field cannot be removed by a `delete`. */
+function declaresCheckedDynField(lowerer, type, name) {
+    if (type.kind === "record") {
+        const shape = lowerer.shapes.get(type.shapeId);
+        if (!shape || shape.tuple)
+            return false;
+        return shape.fields.find((f) => f.name === name)?.type.kind === "dyn";
+    }
+    if (type.kind !== "union")
+        return false;
+    const arms = lowerer.unions.get(type.unionId)?.arms ?? [];
+    return arms.length > 0 && arms.every((arm) => declaresCheckedDynField(lowerer, arm, name));
+}
 /** Statement-position `delete`: process.env keys → process.envUnset
  * (unsetenv), pure `Record<string, T>` keys → recordKeyDelete (the
  * overflow Map delete), declared OPTIONAL fields → the field's ABSENT
  * state (the slot reads undefined and no longer counts as an own
  * property). Everything else
  * fences with the honest reason — a required field is a struct slot no
- * runtime can remove. */
+ * runtime can remove, and an optional `unknown`/`any` field maps to the
+ * checked-dynamic slot, which has no ABSENT state yet. */
 function lowerDeleteStatement(lowerer, expr) {
     const loc = locOf(expr);
     let target = expr.expression;
@@ -6539,6 +6818,9 @@ function lowerDeleteStatement(lowerer, expr) {
     if (!ts.isElementAccessExpression(target) && !ts.isPropertyAccessExpression(target)) {
         lowerer.unsupported("SC1090", expr, "'delete' of non-property expressions");
     }
+    // Deleting a member of `Date.prototype` is a write through the read-only
+    // prototype value (property-access.ts's fence).
+    fenceDatePrototypeWrite(lowerer, target);
     fenceNodeModuleMutation(lowerer, target, "delete");
     if (ts.isPropertyAccessExpression(target) && target.name.text === "cause") {
         const field = lowerer.fieldTarget(target);
@@ -6564,7 +6846,8 @@ function lowerDeleteStatement(lowerer, expr) {
             return { kind: "strLit", value: target.name.text, type: STRING, loc: locOf(target.name) };
         }
         const keyNode = target.argumentExpression;
-        let key = lowerer.isProcessEnv(target.expression)
+        let key = lowerer.isProcessEnv(target.expression) ||
+            heldEnvValueType(lowerer, target.expression) !== null
             ? lowerEnvironmentKey(lowerer, keyNode)
             : lowerer.lowerExpr(keyNode);
         if (key.type.kind === "dyn") {
@@ -6578,7 +6861,8 @@ function lowerDeleteStatement(lowerer, expr) {
         }
         return key;
     };
-    if (lowerer.isProcessEnv(target.expression)) {
+    if (lowerer.isProcessEnv(target.expression) ||
+        heldEnvValueType(lowerer, target.expression) !== null) {
         return {
             kind: "exprStmt",
             expr: { kind: "libCall", fn: "process.envUnset", args: [lowerKey()], type: VOID, loc },
@@ -6670,6 +6954,20 @@ function lowerDeleteStatement(lowerer, expr) {
             loc,
         };
     }
+    // The constant property key of the target (dot access or a literal
+    // bracket), when there is one.
+    const constantKey = ts.isPropertyAccessExpression(target)
+        ? target.name.text
+        : ts.isStringLiteral(target.argumentExpression)
+            ? target.argumentExpression.text
+            : null;
+    // An OPTIONAL `unknown`/`any` field rides the checked-dynamic slot,
+    // which has no ABSENT state yet (an omitted such field already reads as
+    // present), so it cannot delete. Name that reason instead of calling
+    // the field required or blaming the receiver.
+    const optionalCheckedDynDelete = constantKey !== null &&
+        declaresCheckedDynField(lowerer, obj.type, constantKey) &&
+        declaredOptionalProperty(lowerer, target.expression, constantKey);
     if (obj.type.kind === "record") {
         const shape = lowerer.shapes.get(obj.type.shapeId);
         if (shape?.indexValue && shape.fields.length === 0 && !shape.tuple) {
@@ -6682,13 +6980,8 @@ function lowerDeleteStatement(lowerer, expr) {
         // while a later write makes it present again. Constant keys only
         // (dot access or a literal bracket); required fields keep the honest
         // fence below.
-        const fieldName = ts.isPropertyAccessExpression(target)
-            ? target.name.text
-            : ts.isStringLiteral(target.argumentExpression)
-                ? target.argumentExpression.text
-                : null;
-        const field = fieldName !== null && !shape?.tuple
-            ? shape?.fields.find((f) => f.name === fieldName)
+        const field = constantKey !== null && !shape?.tuple
+            ? shape?.fields.find((f) => f.name === constantKey)
             : undefined;
         if (field) {
             const absent = lowerer.absentFieldValue(field.type, loc);
@@ -6706,8 +6999,14 @@ function lowerDeleteStatement(lowerer, expr) {
         if (shape?.indexValue) {
             lowerer.unsupported("SC1090", expr, "'delete' of hybrid index-signature keys (declared struct slots and overflow entries answer differently — model deletable dynamic keys with a pure Record<string, T>)");
         }
+        if (optionalCheckedDynDelete) {
+            lowerer.unsupported("SC1090", expr, OPTIONAL_CHECKED_DYN_DELETE);
+        }
         lowerer.unsupported("SC1090", expr, "'delete' of required record fields (a monomorphic shape cannot remove its slot — only optional fields delete, becoming the undefined arm)");
     }
+    if (optionalCheckedDynDelete) {
+        lowerer.unsupported("SC1090", expr, OPTIONAL_CHECKED_DYN_DELETE);
+    }
     lowerer.unsupported("SC1090", expr, `'delete' on '${lowerer.fmt(obj.type)}' receivers (process.env keys and pure Record<string, T> keys delete)`);
 }
 /** True when the `var`/`let` binding `nameNode` names cannot change after
@@ -7384,6 +7683,13 @@ export function lowerExprStatement(lowerer, expr) {
                 return { kind: "exprStmt", expr: urlWrite, loc: locOf(expr) };
         }
         if (opKind === ts.SyntaxKind.EqualsToken) {
+            // A write through `Date.prototype` or one of its members keeps its
+            // fence: the prototype value is a read surface (property-access.ts).
+            if (ts.isPropertyAccessExpression(expr.left) || ts.isElementAccessExpression(expr.left))
+                fenceDatePrototypeWrite(lowerer, expr.left);
+            const staticPrivateWrite = lowerStaticPrivateAssignment(lowerer, expr);
+            if (staticPrivateWrite)
+                return { kind: "exprStmt", expr: staticPrivateWrite, loc: locOf(expr) };
             const callableWrite = lowerNativeFunctionAssignment(lowerer, expr);
             if (callableWrite)
                 return { kind: "exprStmt", expr: callableWrite, loc: locOf(expr) };
@@ -7431,7 +7737,12 @@ export function lowerExprStatement(lowerer, expr) {
                 // (Node stringifies everything; a non-string RHS fences instead
                 // of diverging from Node). The computed-key form lands in
                 // lowerElementWrite.
-                if (lowerer.isProcessEnv(expr.left.expression) && !expr.left.questionDotToken) {
+                // The same setenv for a value HELD from process.env (`const env =
+                // process.env; env.X = v`): the hold aliases the live table, as
+                // Node's does.
+                if (!expr.left.questionDotToken &&
+                    (lowerer.isProcessEnv(expr.left.expression) ||
+                        heldEnvValueType(lowerer, expr.left.expression) !== null)) {
                     const loc = locOf(expr);
                     const key = {
                         kind: "strLit",
@@ -7901,6 +8212,39 @@ export function lowerExprStatement(lowerer, expr) {
                     };
                 }
             }
+            // process.stdout.write = fn (and stderr): replace the stream object's
+            // write slot. Every later write to the stream — console output, typed
+            // write calls (programPatchesStdio), runtime writers — goes through it.
+            if (ts.isPropertyAccessExpression(expr.left) && expr.left.name.text === "write") {
+                const recv = expr.left.expression;
+                const stream = ts.isPropertyAccessExpression(recv)
+                    ? lowerer.stdlibGlobalMember(recv, "process")
+                    : null;
+                if (stream === "stdout" || stream === "stderr") {
+                    const loc = locOf(expr);
+                    return {
+                        kind: "exprStmt",
+                        expr: {
+                            kind: "libCall",
+                            fn: "dyn.keySet",
+                            args: [
+                                {
+                                    kind: "libCall",
+                                    fn: "process.stdioSlot",
+                                    args: [numLit(stream === "stdout" ? 1 : 2, loc)],
+                                    type: DYN,
+                                    loc,
+                                },
+                                strLit("write", locOf(expr.left.name)),
+                                lowerer.lowerExprExpecting(expr.right, DYN),
+                            ],
+                            type: VOID,
+                            loc,
+                        },
+                        loc,
+                    };
+                }
+            }
             if (!ts.isIdentifier(expr.left)) {
                 lowerer.unsupported("SC1090", expr.left, "assignment to non-variables");
             }
@@ -7933,6 +8277,8 @@ export function lowerExprStatement(lowerer, expr) {
         const compound = COMPOUND_ASSIGN_OPS[opKind];
         if (compound !== undefined) {
             // Desugar `x op= e` to `x = x op e` — reads x before e, like JS.
+            if (ts.isPropertyAccessExpression(expr.left) || ts.isElementAccessExpression(expr.left))
+                fenceDatePrototypeWrite(lowerer, expr.left);
             if (ts.isElementAccessExpression(expr.left)) {
                 // `this[kLimit] += v` — a declared symbol-keyed class field is
                 // the dotted compound in element spelling. Array and byte-view
@@ -7974,6 +8320,7 @@ export function lowerExprStatement(lowerer, expr) {
         (expr.operator === ts.SyntaxKind.PlusPlusToken ||
             expr.operator === ts.SyntaxKind.MinusMinusToken)) {
         if (ts.isPropertyAccessExpression(expr.operand) || ts.isElementAccessExpression(expr.operand)) {
+            fenceDatePrototypeWrite(lowerer, expr.operand);
             // Statement and value positions share ToNumeric and reference order.
             // Namespace/expando globals retain their direct binding path below.
             const binding = ts.isPropertyAccessExpression(expr.operand)
@@ -8193,6 +8540,45 @@ export function lowerDestructuringAssign(lowerer, target, init, blame, loc) {
     const parts = destructuringAssignInto(lowerer, target, init, null, blame, loc);
     return { kind: "block", body: parts.stmts, loc };
 }
+/** An object pattern whose first element has a default and a static key
+ * (`{ a = 1 }`, `{ a: b = 1 }`): V8 reads that key without checking the
+ * source first, so a null or undefined source throws the read's TypeError. */
+function firstReadsWithDefault(pattern) {
+    const first = pattern.elements.nodes[0];
+    return (first !== undefined &&
+        first.dotDotDotToken === undefined &&
+        first.initializer !== undefined &&
+        !(first.propertyName !== undefined && ts.isComputedPropertyName(first.propertyName)));
+}
+/** The read of the first key of a pattern that `firstReadsWithDefault`
+ * accepts, over a dyn source: on null or undefined it throws the read's
+ * TypeError, as V8 does. Null when the key has no static name. */
+function firstKeyRead(lowerer, pattern, source, loc) {
+    const { firstProp } = firstPatternProp(lowerer, pattern);
+    if (firstProp === undefined)
+        return null;
+    return {
+        kind: "dynKeyGet",
+        key: { kind: "strLit", value: firstProp, type: STRING, loc },
+        value: source(),
+        type: DYN,
+        loc,
+    };
+}
+/** The first property V8 names in an object pattern's destructuring
+ * TypeError ("Cannot destructure property 'a' of ..."): an identifier,
+ * string or numeric first key. A computed first key, a rest element or
+ * an empty pattern takes the bare (source-only) form. */
+function firstPatternProp(lowerer, pattern) {
+    const first = pattern.elements.nodes[0];
+    const firstKey = first === undefined || first.dotDotDotToken !== undefined
+        ? undefined
+        : (first.propertyName ?? first.name);
+    const firstProp = firstKey === undefined || ts.isComputedPropertyName(firstKey)
+        ? undefined
+        : (patternKeyNameOf(lowerer, firstKey) ?? undefined);
+    return firstProp !== undefined ? { firstProp } : {};
+}
 /** V8's spelling of a destructuring RHS in its TypeError message
  * ("Cannot destructure 'a' as it is undefined.") — plain identifiers
  * spell their name (parens unwrap), `this`, property chains and
@@ -8341,8 +8727,8 @@ function destructuringAssignInto(lowerer, target, init, rhs, blame, loc) {
             ts.isBinaryExpression(rhsInner) &&
             rhsInner.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
             (ts.isObjectLiteralExpression(rhsInner.left) || ts.isArrayLiteralExpression(rhsInner.left));
-        if (!checkedByInner) {
-            const spelling = rhs === null ? null : destrSpellingOf(rhs);
+        if (!checkedByInner && rhs !== null) {
+            const spelling = destrSpellingOf(rhs);
             if (spelling === null) {
                 lowerer.unsupported("SC1031", blame, "destructuring assignment from a checked-dynamic source whose expression spelling is unsupported (use a variable, ordinary property chain, or ordinary call)");
             }
@@ -8373,20 +8759,57 @@ function destructuringAssignInto(lowerer, target, init, rhs, blame, loc) {
         }
         for (const prop of target.properties.nodes) {
             const piece = destructAssignPiece(lowerer, prop);
-            const read = {
+            const propLoc = locOf(prop);
+            let read = {
                 kind: "dynKeyGet",
-                key: { kind: "strLit", value: piece.field, type: STRING, loc: locOf(prop) },
+                key: { kind: "strLit", value: piece.field, type: STRING, loc: propLoc },
                 value: tmpRef(),
                 type: DYN,
-                loc: locOf(prop),
+                loc: propLoc,
             };
+            if (piece.dflt !== undefined) {
+                // `{ x = 1 }` / `{ x: y = 1 }`: the default fires on the undefined
+                // read and is evaluated lazily, exactly the declaration path's
+                // checked-dynamic default.
+                const readTmp = lowerer.declareHiddenLocal("%destr", DYN);
+                out.push({ kind: "varDecl", localId: readTmp.id, init: read, loc: propLoc });
+                const readRef = { kind: "varRef", localId: readTmp.id, type: DYN, loc: propLoc };
+                read = {
+                    kind: "ternary",
+                    cond: { kind: "dynTest", test: "undefined", value: readRef, type: BOOL, loc: propLoc },
+                    then: lowerer.coerceInto(piece.dflt, lowerer.lowerExpr(piece.dflt), DYN),
+                    else_: readRef,
+                    type: DYN,
+                    loc: propLoc,
+                };
+            }
             out.push({
                 kind: "assign",
                 localId: piece.target.id,
                 value: lowerer.coerceInto(prop, read, piece.target.type),
-                loc: locOf(prop),
+                loc: propLoc,
             });
         }
+        if (rhs === null && target.properties.nodes.length === 0) {
+            // A pattern with no reads still owes the source's own coercion, and a
+            // PRE-LOWERED source (`for ({} of …)`) has no source text: V8 reads
+            // the value instead of spelling it ("Cannot read properties of null").
+            for (const unit of ["null", "undefined"]) {
+                out.push({
+                    kind: "if",
+                    cond: { kind: "dynTest", test: unit, value: tmpRef(), type: BOOL, loc },
+                    then: [
+                        {
+                            kind: "exprStmt",
+                            expr: nodeThrowExpr(1, "", `Cannot read properties of ${unit}`, VOID, loc),
+                            loc,
+                        },
+                    ],
+                    else_: null,
+                    loc,
+                });
+            }
+        }
         return { stmts: out, value };
     }
     if (target.properties.nodes.length === 0) {
@@ -8860,10 +9283,11 @@ function lowerAssignTargetInto(lowerer, out, targetNode, blame, dflt, valueOf) {
 function destructAssignPiece(lowerer, prop) {
     let fieldName;
     let bindTo;
+    let dflt;
     if (ts.isShorthandPropertyAssignment(prop)) {
-        if (prop.objectAssignmentInitializer) {
-            lowerer.unsupported("SC1031", prop, "destructuring assignment with defaults (assign, then apply the default)");
-        }
+        // `{ x = 1 }`: the shorthand's default (the checker's name resolution
+        // still answers the outer binding through the shorthand).
+        dflt = prop.objectAssignmentInitializer;
         fieldName = prop.name.text;
         bindTo = prop.name;
     }
@@ -8874,7 +9298,12 @@ function destructAssignPiece(lowerer, prop) {
             lowerer.unsupported("SC1031", prop, "destructuring assignment with computed keys that do not fold to one property name");
         }
         fieldName = folded ?? "";
+        // `{ x: y = 1 }`: a defaulted target, the AssignmentPattern spelling.
         bindTo = prop.initializer;
+        if (ts.isBinaryExpression(bindTo) && bindTo.operatorToken.kind === ts.SyntaxKind.EqualsToken) {
+            dflt = bindTo.right;
+            bindTo = bindTo.left;
+        }
     }
     else {
         lowerer.unsupported("SC1031", prop, "destructuring assignment with rest or spread properties");
@@ -8895,7 +9324,7 @@ function destructAssignPiece(lowerer, prop) {
     if (!target) {
         lowerer.rejectUnresolved(bindTo, `assignment to '${bindTo.text}' (not a writable local or module global)`);
     }
-    return { field: fieldName, target };
+    return { field: fieldName, target, ...(dflt !== undefined ? { dflt } : {}) };
 }
 /** The ARRAY half of destructuring assignment: element assigns from a
  * tuple/array/checked-dynamic source pushed into `out` (see
@@ -11174,7 +11603,55 @@ function lowerForIn(lowerer, stmt) {
             receiver = lowerer.coerceToExpected(receiver, DYN);
         }
     }
+    return lowerForInReceiver(lowerer, stmt, labels, receiver);
+}
+/** for-in over the lowered `receiver` of `stmt`. */
+function lowerForInReceiver(lowerer, stmt, labels, receiver) {
+    const loc = locOf(stmt);
     const recvT = receiver.type;
+    // A receiver that may be null or undefined: for-in visits nothing for
+    // either, and walks a present value as its own type. The receiver is
+    // evaluated once.
+    if (recvT.kind === "union") {
+        const arms = lowerer.unions.get(recvT.unionId)?.arms ?? [];
+        const present = arms.filter((arm) => arm.kind !== "undefinedT" && arm.kind !== "nullT");
+        if (present.length === 1 && present.length < arms.length) {
+            const arm = present[0];
+            const tag = lowerer.armTag(recvT.unionId, arm);
+            const recv = lowerer.declareHiddenLocal("%innullable", recvT);
+            const ref = varRef(recv.id, recvT, loc);
+            const narrowed = {
+                kind: "unionNarrow",
+                unionId: recvT.unionId,
+                tag,
+                value: ref,
+                type: arm,
+                loc,
+            };
+            return {
+                kind: "block",
+                body: [
+                    { kind: "varDecl", localId: recv.id, init: receiver, loc },
+                    {
+                        kind: "if",
+                        cond: {
+                            kind: "unionIsTag",
+                            unionId: recvT.unionId,
+                            tag,
+                            negated: false,
+                            value: ref,
+                            type: BOOL,
+                            loc,
+                        },
+                        then: [lowerForInReceiver(lowerer, stmt, labels, narrowed)],
+                        else_: null,
+                        loc,
+                    },
+                ],
+                loc,
+            };
+        }
+    }
     if (recvT.kind === "dyn") {
         const recv = lowerer.declareHiddenLocal("%indyn", DYN);
         const ref = { kind: "varRef", localId: recv.id, type: DYN, loc };