@scriptc/compiler 0.4.6 → 0.4.8

package/dist/frontend/lowering/lower-calls.js

@@ -1,6 +1,10 @@
+import { lowerIteratorFromDyn } from "./iterator-prototype.js";
+import { programCreatesWrappers } from "./primitive-wrappers.js";
 import { arrayClassMemberOwner, arrayClassReceiver, lowerArrayClassStaticCall, } from "./builtins/array-classes.js";
 import { structuralCallInstance } from "./structural-instances.js";
+import { classViewOf } from "./class-views.js";
 import { checkedPrivateMethodReceiver, privateNameClass } from "./private-brands.js";
+import { lowerStaticPrivateCall } from "./private-statics.js";
 import { assertFunctionAliasOf } from "./lower-assert.js";
 import { keyedHelperName } from "./stable-names.js";
 import { perKeyOrder } from "./key-order-witness.js";
@@ -8,7 +12,8 @@ import { lowerDateToPrimitiveCall } from "./builtins/dates.js";
 import { isForwardedTupleSpread, lowerForwardingApply } from "./typed-arguments.js";
 import { guardNullProto, nullProtoRecordShape } from "./null-prototype.js";
 import { lowerDynStreamMemberCall } from "./dyn-streams.js";
-import { lowerBuiltinClassCall } from "./builtins/builtin-class-dyn.js";
+import { isPureReference } from "./effect-free.js";
+import { builtinClassKind, builtinClassKindOf, builtinClassValue, lowerBuiltinClassCall, } from "./builtins/builtin-class-dyn.js";
 import { refuseModuleMemberThis } from "./module-member-this.js";
 import { lowerUnionEquality, tagEqualityMayMissAlias } from "./strict-equality.js";
 import { lowerHashStreamCall } from "./builtins/hash-stream.js";
@@ -38,13 +43,14 @@ import { lowerClassSymbolMethodCall } from "./symbol-methods.js";
 import { lowerReadlineDisposeCall } from "./builtins/readline.js";
 import { errorToStringCall } from "./error-methods.js";
 import { lowerClassPrototypeAssign, lowerClassPrototypeDescriptors } from "./class-prototypes.js";
-import { BYTES_ELEMENT_NAME, BYTES_U8, BIGINT_T, BOOL, CAUGHT, DYN, DYN_HANDLE_KINDS, F64, NULL_T, STRING, SYMBOL_T, UNDEFINED_T, VOID, arrayOf, canBoxFuncIntoDyn, canConvertToDyn, canDynCheckTo, funcOf, isDynTypedRefType, isUnitType, shapeHasAccessorSlots, shapeKeyOrders, typeEquals, RUNTIME_EMITTER_CLASS, } from "../../ir/ir.js";
+import { BYTES_ELEMENT_NAME, BYTES_U8, BIGINT_T, BOOL, CAUGHT, DYN, DYN_HANDLE_KINDS, F64, NULL_T, STRING, SYMBOL_T, UNDEFINED_T, VOID, arrayOf, canBoxFuncIntoDyn, canConvertToDyn, canDynCheckTo, funcOf, isDynTypedRefType, isUnitType, recordTextCodecClass, shapeHasAccessorSlots, shapeKeyOrders, typeEquals, RUNTIME_EMITTER_CLASS, } from "../../ir/ir.js";
 import { lowerProtocolMethodCall } from "./class-protocol-dispatch.js";
+import { MUTABLE_BUFFER_MEMBERS } from "./buffers.js";
 import { isJsSourceFile, locOf, requireSpecOf } from "../program.js";
 import { isPackageShimFile, isShimIntrinsicName } from "../package-shims.js";
 import { lowerJsonRequireCall } from "./json-require.js";
 import { lowerAssertInstanceCall } from "./assert-instances.js";
-import { isGenericCallableMemberType, isOverloadedCallableMemberType, typeKey, } from "../type-mapper.js";
+import { erasedOverloadMemberType, isGenericCallableMemberType, isOverloadedCallableMemberType, typeKey, } from "../type-mapper.js";
 import { dynFallbackType, jsFuncNameOf, newFnCtx, staticImportNamespaceType } from "./lowerer.js";
 import { NARROW_FIRST, STRING_INDEX_METHODS, STR_METHODS, UTIL_TYPES_KEYS, stdlibGlobalNameOf, } from "./surfaces.js";
 import { dynStringReceiver } from "./containers/dynamic-receivers.js";
@@ -52,12 +58,13 @@ import { lowerArrayConstructor, lowerArrayFromCall, lowerArrayOfCall, } from "./
 import { lowerArrayFromAsyncCall } from "./containers/array-from-async.js";
 import { lowerDynArrayFilterCall, lowerDynArrayFlatMapCall } from "./containers/array-callbacks.js";
 import { lowerGroupByStaticCall } from "./containers/collection-grouping.js";
-import { lowerGeneratorHelperCall, lowerHelperReturnCall, lowerIteratorFromCall, lowerIteratorHelperCall, } from "./containers/iterator-helpers.js";
+import { lowerGeneratorHelperCall, lowerHelperReturnCall, lowerIteratorFromCall, lowerIteratorHelperCall, lowerWidenedIteratorHelperCall, } from "./containers/iterator-helpers.js";
 import { lowerObjectAssignIndexShape, lowerObjectConstructor, lowerObjectFromEntriesCall, lowerObjectIterOverIndexShape, } from "./containers/indexed-objects.js";
 import { lowerTupleReadMethodCall } from "./containers/array-methods.js";
 import { tryFuseIndexRead } from "./array-values.js";
+import { builtinGlobalValue, isPrimitivePrototypeRead } from "./expressions/property-access.js";
 import { lowerBufferConstruct, lowerBytesPrototypeSetCall, lowerBytesStaticCall, } from "./containers/bytes.js";
-import { lowerRegexMethodCall, lowerStringIndexCall, lowerStringMethodCall, lowerStringPaddingCall, lowerStringSplitCall, isDynPrimitiveKindMethod, lowerDynPrimitiveMethodCall, lowerExtraNumberMethodCall, } from "./containers/string-and-regexp.js";
+import { EXTRA_STRING_METHODS, lowerRegexMethodCall, lowerStringIndexCall, lowerStringMethodCall, lowerStringPaddingCall, lowerStringSplitCall, isDynPrimitiveKindMethod, lowerDynPrimitiveMethodCall, lowerExtraNumberMethodCall, lowerExtraStringMethodCall, } from "./containers/string-and-regexp.js";
 import { createRequireSpecOf } from "./builtins/module-bindings.js";
 import { lowerChildStreamMethodCall, lowerChildWriterMethodCall, } from "./builtins/child-process-methods.js";
 import { lowerCreateRequireCall, lowerImportMetaResolveCall, lowerRequireResolveCall, } from "./builtins/module-resolution.js";
@@ -69,10 +76,12 @@ import { lowerDirentMethodCall, lowerFileHandleMethodCall, lowerDirMethodCall, l
 import { fencePerfEntryKeyWalk, isPerfEntryType, lowerHistogramMethodCall, lowerPerfHooksCall, perfEntryTag, } from "./builtins/performance.js";
 import { fenceX509KeyWalk } from "./builtins/x509.js";
 import { lowerProcStreamMethodCall, lowerProcessBuiltinModuleNamespace, } from "./builtins/process.js";
-import { recordMayKeepSource, throughRecordSource } from "./record-sources.js";
+import { recordMayKeepSource, recordSourceTest, throughRecordSource } from "./record-sources.js";
+import { answerLinkedCopies, linkedCopyBranches, recordStringCall, registerLinkedHelper, } from "./record-links.js";
 import { lowerReflectCall } from "./builtins/reflection.js";
 import { lowerAbsenceProbe, v8CalleeText, lowerPromiseAllTupleCall, lowerPromiseRejectCall, lowerToNumberArgument, stringWrapperToString, symbolFieldInfo, templateRawTextOf, primitiveCtorClosure, } from "./lower-exprs.js";
 import { isSafeToDiscard } from "./expressions/evaluation-safety.js";
+import { nullishLiteral, nullishReadTypeError, throwAfterEach } from "./primitive-throws.js";
 import { tryLowerExpression } from "./expressions/try-lower-expression.js";
 import { lowerChildMethodValue, lowerChildPropertyCall } from "./handle-properties.js";
 import { classObjectTag, classToNumberConversion } from "./class-to-primitive.js";
@@ -81,14 +90,16 @@ import { structuralReadType } from "./class-unions.js";
 import { httpClientFnBindingOf, lowerCompatReqStreamOptionalCall, lowerHttpClientFnCall, } from "./lower-server.js";
 import { EMITTER_API_MEMBERS, exactClassOfReceiver, exactInstanceClassOf, findGenericMethodOn, lowerClassGenericMethodCall, lowerStaticMethodCall, lowerStaticFieldRead, returnsOnlyThis, storedClassValueType, } from "./lower-classes.js";
 import { classCallbackCall, isClassCallback } from "./class-callbacks.js";
-import { emitterRooted, lowerEmitterMethodCall } from "./lower-event-emitter.js";
+import { emitOverrideAtOrAbove, emitterRooted, lowerEmitterMethodCall, } from "./lower-event-emitter.js";
 import { eventTargetApiMethod, lowerEventTargetMethodCall } from "./lower-event-target.js";
 import { dateRootOf, isDatePrototypeMethod, lowerInheritedDateMethodCall, } from "./builtins/date-classes.js";
 import { lowerConsoleInstanceCall, lowerConsoleMethodCall, lowerConsoleOutput, } from "./lower-console.js";
 import { STREAM_API_MEMBERS, STREAM_OPERATORS, lowerStreamMethodCall, lowerStreamStaticCall, streamSidesOf, } from "./lower-stream.js";
 import { ambientNsRootOf, ambientUndefReadType, ambientUndefVarRootOf, ambientUndefinedFnSymbolOf, contextualUndefReadType, fenceEarlyAliasUse, fenceEarlyNsMemberRef, nsMemberIdentOf, nsUndefRead, } from "./lower-namespaces.js";
+import { hostGlobalNameOfRead, hostGlobalPrototypeMemberOf } from "./host-globals.js";
 import { expandoMemberRead } from "./lower-expando.js";
-import { fenceNodeModuleMutationCall, lowerRequireCacheKeys } from "./lower-node-module.js";
+import { fenceNodeModuleMutationCall, isCjsRequireGlobal, lowerRequireCacheKeys, } from "./lower-node-module.js";
+import { pathModuleValue } from "./lower-builtin-values.js";
 import { defaultAfterUndefined, lowerOptionalArgument, lowerStaticallyUndefinedArgument, positionNumber, } from "./optional-arguments.js";
 import { fenceSymbolFieldCopy } from "./symbol-fields.js";
 import { lowerClassDataDescriptor, lowerClassDescriptorRead } from "./class-descriptors.js";
@@ -97,15 +108,17 @@ import { freezableRecordType, lowerNativeFreeze, noteUntypedIntegrity } from "./
 import { classStaticDataFor } from "./class-static-data.js";
 import { lowerUrlFactory } from "./lower-url.js";
 import { nullishValueUnitOf } from "./binding-analysis.js";
-import { spreadNeedsRuntimeArity, completeFuncValueArgs, lowerSpreadArgsCall, completeArgs, } from "./call-arguments.js";
+import { spreadNeedsRuntimeArity, completeFuncValueArgs, checkedRestCallArgs, lowerSpreadArgsCall, completeArgs, } from "./call-arguments.js";
 import { isThisParameter } from "./call-signatures.js";
 import { dynamicOverloadChoice } from "./overload-choice.js";
 import { lowerStringIteratorValue } from "./iterator-adapters.js";
+import { iterableGenerator, iterableUnionOf } from "./iterable-values.js";
 import { checkedArmExtraction } from "./coercions/unions.js";
 import { maybePromiseReturnStmt, promiseArmedUnionOf, promiseOrUnitUnionOf, } from "./maybe-promise.js";
 import { requireObjLitGenericReceiver, objLitGenericFnNodeOf, objLitGenericFnInfoOf, genericCallInstance, } from "./generic-functions.js";
 import { codeGenerationCalleeOf, lowerCodeGenerationCall } from "./code-generation.js";
 import { lowerRecordInheritedCall } from "./record-inherited.js";
+import { fenceDatePrototypeWriteCall } from "./expressions/property-access.js";
 const ZLIB_STREAM_METHODS = new Set(["flush", "params", "close", "reset"]);
 /** The node:util member a `(0, member)` callee names, or null. */
 function indirectUtilCalleeOf(lowerer, callee) {
@@ -175,8 +188,60 @@ function receiverlessCalleeOf(callee) {
 }
 export function lowerCall(lowerer, expr) {
     const loc = locOf(expr);
+    // A JavaScript source calling a member that resizes, grows or detaches a
+    // buffer is the mutableBuffers fact (buffers.ts, t262-dc §2.4). The
+    // receiver may be a checked-dynamic value, so the callee's name decides;
+    // the member read never reaches lowerPropertyAccessExpr when the call
+    // lowers straight through its receiver.
+    if (isJsSourceFile(ts.getSourceFileOfNode(expr))) {
+        const callee = expr.expression;
+        const name = ts.isPropertyAccessExpression(callee)
+            ? callee.name.text
+            : ts.isElementAccessExpression(callee)
+                ? lowerer.foldedStringKeyOf(callee.argumentExpression)
+                : null;
+        if (name !== null && MUTABLE_BUFFER_MEMBERS.has(name))
+            lowerer.buffersMutable = true;
+    }
+    // `(null).foo()` / `(undefined)["foo"]()`: the MEMBER READ throws Node's
+    // TypeError before the arguments evaluate, exactly as a plain read does.
+    // Only a nullish LITERAL qualifies — every other receiver, a binding or a
+    // property included, has a value the runtime reads and refuses itself,
+    // with the same message and the same order.
+    {
+        const callee = expr.expression;
+        const member = ts.isPropertyAccessExpression(callee) && !callee.questionDotToken
+            ? { base: callee.expression, name: callee.name.text }
+            : ts.isElementAccessExpression(callee) && !callee.questionDotToken
+                ? { base: callee.expression, name: lowerer.foldedStringKeyOf(callee.argumentExpression) }
+                : null;
+        const unit = !expr.questionDotToken && member !== null ? nullishLiteral(lowerer, member.base) : null;
+        if (member !== null && member.name !== null && unit !== null) {
+            const recv = lowerer.lowerExpr(member.base);
+            const t = lowerer.mapTypeOf(lowerer.typeOf(expr)) ?? F64;
+            return throwAfterEach([recv], nullishReadTypeError(unit, member.name, t, loc), loc);
+        }
+    }
     if (lowerer.errorAccessorReflection === null)
         noteErrorAccessorReflection(lowerer, expr);
+    // Calling a Node 24 global the native runtime does not provide (WebSocket,
+    // FormData, …): the value a read answers refuses the call
+    // (host-global-values.ts), so the call is that refusal — SC2020, which a
+    // JavaScript source defers to the throw at this statement.
+    {
+        const hostGlobal = hostGlobalNameOfRead(lowerer, expr.expression);
+        if (hostGlobal !== null)
+            lowerer.hostGlobalFence(hostGlobal, expr.expression);
+    }
+    // A method on the value's prototype (`FormData.prototype.append(...)`):
+    // the prototype carries the constructor link only, so the method is
+    // surface native code does not have (SC2020, host-global). A call reads
+    // its callee without going through the member-read hook.
+    {
+        const prototypeOf = hostGlobalPrototypeMemberOf(lowerer, expr.expression);
+        if (prototypeOf !== null)
+            lowerer.hostGlobalFence(prototypeOf, expr.expression);
+    }
     // Object's checker return type is `any`. Claim known object inputs
     // before generic checked-dynamic dispatch tries to load the constructor.
     if (ts.isIdentifier(expr.expression) &&
@@ -191,6 +256,14 @@ export function lowerCall(lowerer, expr) {
     const builtinClassCall = lowerBuiltinClassCall(lowerer, expr);
     if (builtinClassCall)
         return builtinClassCall;
+    // `R.<method>.call(thisArg, ...)` over EventEmitter.prototype's methods.
+    if (ts.isPropertyAccessExpression(expr.expression) &&
+        !expr.expression.questionDotToken &&
+        expr.expression.name.text === "call") {
+        const emitterMethod = lowerEmitterMethodValueCall(lowerer, expr, expr.expression);
+        if (emitterMethod)
+            return emitterMethod;
+    }
     // require() of a JSON document: the shared parsed object.
     const json = lowerJsonRequireCall(lowerer, expr);
     if (json)
@@ -269,6 +342,20 @@ export function lowerCall(lowerer, expr) {
         if (inlineValue)
             return inlineValue;
     }
+    // `require("path/posix")` of a builtin as a value: the module's
+    // namespace, as a `const posix = require("path/posix")` binding is.
+    if (ts.isIdentifier(expr.expression) &&
+        expr.expression.text === "require" &&
+        isCjsRequireGlobal(lowerer, expr.expression)) {
+        const module = lowerer.builtinNamespaceModuleOf(expr);
+        // The platform namespaces are the path module objects.
+        if (module === "path/posix" || module === "path/win32")
+            return pathModuleValue(lowerer, module, loc);
+        if (module !== null && module !== "constants") {
+            const moduleId = `builtin:${module}`;
+            return { kind: "moduleNsRef", moduleId, type: { kind: "moduleNs", moduleId }, loc };
+        }
+    }
     // A call whose chain ROOTS at an ambient-undefined name (`declare
     // const value: Y | undefined; value?.foo("a")`, `declare function
     // chain...; chain(o).mapValues(f).value()`, a trap binding's read):
@@ -441,6 +528,9 @@ export function lowerCall(lowerer, expr) {
     if (ts.isPropertyAccessExpression(expr.expression) &&
         ts.isPrivateIdentifier(expr.expression.name) &&
         !expr.expression.questionDotToken) {
+        const staticPrivate = lowerStaticPrivateCall(lowerer, expr, expr.expression);
+        if (staticPrivate)
+            return staticPrivate;
         const privateCall = lowerCheckedPrivateMethodCall(lowerer, expr, expr.expression);
         if (privateCall)
             return privateCall;
@@ -688,7 +778,12 @@ export function lowerCall(lowerer, expr) {
         const converted = lowerBigIntConstructorValue(lowerer, arg, loc);
         if (converted)
             return converted;
-        lowerer.noLowering(`BigInt of ${lowerer.fmt(arg.type)} values`, argNode, "string, number, boolean, and bigint arguments are supported");
+        // Report the type the program wrote, which is the type the checker has
+        // narrowed to here. The stored union only shows up when it is what
+        // actually blocks the conversion.
+        const narrowed = lowerer.mapTypeOf(lowerer.typeOf(argNode));
+        const shown = narrowed && !typeEquals(narrowed, arg.type) ? narrowed : arg.type;
+        lowerer.noLowering(`BigInt of ${lowerer.fmt(shown)} values`, argNode, bigintRefusalHint(lowerer, arg, narrowed));
     }
     if (lowerer.isStdlibGlobal(expr.expression, "String") ||
         lowerer.isStdlibGlobal(expr.expression, "Boolean") ||
@@ -968,32 +1063,7 @@ export function lowerCall(lowerer, expr) {
         // different, non-stdlib symbol.
         if ((expr.expression.text === "atob" || expr.expression.text === "btoa") &&
             lowerer.isStdlibSymbol(lowerer.resolveValueSymbol(expr.expression) ?? undefined)) {
-            const name = expr.expression.text;
-            if (expr.arguments.nodes.length === 0) {
-                return { kind: "libCall", fn: "str.b64Missing", args: [], type: STRING, loc };
-            }
-            if (expr.arguments.nodes.length > 1) {
-                lowerer.noLowering(`${name} with ${expr.arguments.nodes.length} arguments`, expr);
-            }
-            const argNode = expr.arguments.nodes[0];
-            const v = lowerer.lowerExpr(argNode);
-            let data;
-            if (v.type.kind === "dyn") {
-                data = v;
-            }
-            else if (v.kind === "unitLit" || lowerer.dynConvertible(v.type)) {
-                data = { kind: "dynFrom", value: v, type: DYN, loc };
-            }
-            else {
-                lowerer.noLowering(`${name} with a '${lowerer.fmt(v.type)}' argument`, argNode, "string-convertible arguments lower (Node ToStrings the value — convert it explicitly)");
-            }
-            return {
-                kind: "libCall",
-                fn: name === "atob" ? "str.atob" : "str.btoa",
-                args: [data],
-                type: STRING,
-                loc,
-            };
+            return lowerBase64Call(lowerer, expr, expr.expression.text, loc);
         }
         // global function executes — callFn(globalGet(name)) — and the
         // result exits to the declared static type. A user function
@@ -1415,6 +1485,11 @@ export function lowerCall(lowerer, expr) {
             // (untyped in fallback builds, so before the dyn receiver path) or
             // webcrypto.
             lowerWebCryptoMethodCall(lowerer, expr, expr.expression) ??
+            // A helper call on a JavaScript binding reassigned with a helper
+            // stage (`let it = g(); it = it.filter(...)`): the binding holds the
+            // checked value, and the dyn receiver path would read `filter` as
+            // Array.prototype's. Before it, so the runtime's helper answers.
+            lowerWidenedIteratorHelperCall(lowerer, expr) ??
             // Dyn receivers (JSON.parse-derived `unknown`/`any` values) —
             lowerDynReceiverMethodCall(lowerer, expr, expr.expression) ??
             // Narrowing filters (inferred predicates, filter(Boolean)) claim
@@ -1561,6 +1636,11 @@ export function lowerCall(lowerer, expr) {
                 lowerer.unsupported("SC1090", expr, `calls of the generic method '${expr.expression.name.text}' through this receiver (no compiled declaration with a body resolves statically here — ambient 'declare class' and interface-only methods are signature-only, and only class, static, and object-literal generic methods with bodies monomorphize)`);
             }
         }
+        {
+            const unionCall = lowerUnionReceiverMethodCall(lowerer, expr, expr.expression);
+            if (unionCall)
+                return unionCall;
+        }
         lowerer.unsupported("SC1090", expr, `method calls like '${ts.getTextOfNode(expr.expression)}'`);
     }
     // `s[Symbol.iterator]()` on a string: the string iterator as a value.
@@ -1751,9 +1831,156 @@ function callableInstanceStringCall(lowerer, expr, callee, loc) {
         loc,
     };
 }
+/** Refuses a copying conversion at a call through a value whose checker
+ * signature keeps its own type parameters — the erased instance
+ * lowerGenericFnValue / erasedGenericInstance produce. The call itself
+ * needs no new rule: such a value's IR type is already the erased func
+ * type, so the ordinary func-value lane completes its arguments into the
+ * erased signature's `unknown` slots (records, arrays and collections box
+ * as live capsules, primitives as themselves) and leaves the result dyn
+ * for each use to convert, where a lie throws (dynCheck) instead of
+ * answering a value the program never had. Keeping the lane unchanged is
+ * what keeps every program that compiles today byte-identical. */
+function refuseCopyingErasureInstanceCall(lowerer, call, callee) {
+    if (callee.type.kind !== "func")
+        return;
+    const sigs = lowerer.checker.getCallSignatures(lowerer.typeOf(call.expression));
+    if (!sigs.some((sig) => sig.getTypeParameters().length > 0))
+        return;
+    refuseCopyingErasureBoundary(lowerer, call, callee.type);
+}
+/** Refuse an erased instantiation whose boundary conversion would COPY the
+ * value instead of carrying it by reference.
+ *
+ * Most conversions across the erased boundary are exact: records and arrays
+ * box into `unknown` as live capsules of themselves, and the checked unbox
+ * back answers the same object (object-model S1). Two conversions are not,
+ * and compiling them would silently hand the program a different object
+ * than Node's:
+ *
+ * - a promise payload crossing the boundary. The dynamic promise conversion
+ *   re-materializes the settled record rather than boxing it live, so a
+ *   `Promise<{ id: number }>` that crosses into `unknown` (or into a wider
+ *   promise) settles to a copy. This is a pre-existing dynamic-tier
+ *   behaviour — it is what `const u: unknown = await p` does today for a
+ *   `Promise<Record>` with no generics in sight — so the erased form must
+ *   not promise otherwise. A closure counts by its RESULT: calling a boxed
+ *   closure converts its result into `unknown`, so a callback returning a
+ *   promise of a record loses that record's identity (the createLimiter
+ *   shape: `async () => shared` over the boundary).
+ * - a record (or array) converting to a different record (or array) type: a
+ *   width conversion copies.
+ *
+ * Everything the rule names is a shape the compiler refuses today, so no
+ * program that compiles changes: these fences only replace a silent
+ * divergence with a diagnostic. */
+function refuseCopyingErasureBoundary(lowerer, call, funcType) {
+    const argNodes = call.arguments.nodes;
+    for (let i = 0; i < argNodes.length && i < funcType.params.length; i++) {
+        const arg = argNodes[i];
+        if (ts.isSpreadElement(arg))
+            continue;
+        const reason = erasureCopyReason(lowerer, lowerer.irTypeOf(arg), funcType.params[i]);
+        if (reason !== null) {
+            lowerer.unsupported("SC1090", arg, `passing this argument across the erased generic boundary (${reason}; JavaScript hands the same object over)`);
+        }
+    }
+    const reason = erasureCopyReason(lowerer, funcType.ret, lowerer.irTypeOf(call));
+    if (reason !== null) {
+        lowerer.unsupported("SC1090", call, `returning this call's result across the erased generic boundary (${reason}; JavaScript hands the same object back)`);
+    }
+}
+/** Why converting a value of type `src` at the erased boundary (`dst`)
+ * copies it, or null when the conversion is exact. */
+function erasureCopyReason(lowerer, src, dst) {
+    if (typeEquals(src, dst))
+        return null;
+    // An unboxed capsule answers the same object, and a promise payload
+    // boxes by reference as well (object-model S1), so no dynamic-side
+    // crossing copies.
+    if (src.kind === "dyn")
+        return null;
+    if (dst.kind === "dyn")
+        return dynCrossingCopyReason(lowerer, src);
+    if (src.kind === "record" && dst.kind === "record")
+        return `a '${lowerer.fmt(src)}' becomes the narrower '${lowerer.fmt(dst)}' by copying it`;
+    if (src.kind === "array" && dst.kind === "array")
+        return `a '${lowerer.fmt(src)}' becomes '${lowerer.fmt(dst)}' by copying it`;
+    if (src.kind === "promise" && dst.kind === "promise")
+        return erasureCopyReason(lowerer, src.inner, dst.inner);
+    if (src.kind === "func" && dst.kind === "func")
+        return erasureCopyReason(lowerer, src.ret, dst.ret);
+    return null;
+}
+/** Why a value of type `t` crossing INTO `unknown` copies, or null. A
+ * record, array or promise boxes as a live capsule of itself (a promise's
+ * payload boxes by reference too, object-model S1); a function boxes as a
+ * callable whose RESULT converts through the dynamic call, so a record or
+ * array result comes back as a fresh value. */
+function dynCrossingCopyReason(lowerer, t) {
+    if (t.kind === "func") {
+        const inner = dynCrossingCopyReason(lowerer, t.ret);
+        if (inner !== null)
+            return inner;
+        if (structuredResultHoldsCopy(lowerer, t.ret))
+            return `a '${lowerer.fmt(t.ret)}' result is re-materialized when the boxed function returns it`;
+        return null;
+    }
+    if (t.kind === "union") {
+        const def = lowerer.unions.get(t.unionId);
+        for (const arm of def?.arms ?? []) {
+            const reason = dynCrossingCopyReason(lowerer, arm);
+            if (reason !== null)
+                return reason;
+        }
+        return null;
+    }
+    return null;
+}
+/** True when a boxed function's RESULT is a record or array, or a union with
+ * such an arm. The boxed callable converts that result through the dynamic
+ * call, which answers a fresh value, so the caller does not get the object
+ * the function returned. */
+function structuredResultHoldsCopy(lowerer, t) {
+    if (t.kind === "record" || t.kind === "array")
+        return true;
+    if (t.kind !== "union")
+        return false;
+    const def = lowerer.unions.get(t.unionId);
+    return def !== undefined && def.arms.some((arm) => structuredResultHoldsCopy(lowerer, arm));
+}
 /** A call through an evaluated callee value: checked-dynamic callees,
  * function unions, typed-rest and runtime-arity closures. */
-function lowerCallThroughValue(lowerer, expr, callee, loc) {
+export function lowerCallThroughValue(lowerer, expr, callee, loc) {
+    return overloadValueResult(lowerer, expr, callee, lowerCallThroughValueRaw(lowerer, expr, callee, loc));
+}
+/** A call through a VALUE of an OVERLOADED type: the value holds the set's
+ * erased function (mapType's overload-value rule), so its result converts to
+ * the resolved overload's type, as a call through an overloaded record
+ * member does. Only a callee whose IR type IS that erased function converts,
+ * so a class method or a declared function called through its own
+ * implementation is unchanged. Shared with the optional chain's own call
+ * step (`f?.(x)`, `a.m?.(x)`), which builds its callValue directly. */
+export function overloadValueResult(lowerer, expr, callee, result) {
+    if (result.kind !== "callValue" || callee.type.kind !== "func")
+        return result;
+    const calleeTs = lowerer.checker.getNonNullableType(lowerer.typeOf(expr.expression));
+    if (!isOverloadedCallableMemberType(calleeTs, lowerer.checker))
+        return result;
+    const erased = erasedOverloadMemberType(calleeTs, lowerer.typeCtx);
+    if (erased === undefined || !typeEquals(erased, callee.type))
+        return result;
+    return lowerer.coerceInto(expr, result, resolvedOverloadResultType(lowerer, expr));
+}
+function lowerCallThroughValueRaw(lowerer, expr, callee, loc) {
+    // A callee value that keeps its call signature's OWN type parameters
+    // (`f(3)` where `f: <T>(x: T) => T`, a generic method's record slot, a
+    // generic result read back) is the ERASED instance — one function whose
+    // parameters and result are `unknown`, exactly the function JavaScript
+    // runs for every type argument. Its IR type is that erased func type, so
+    // the ordinary lanes below serve the call; only a boundary conversion
+    // that would COPY is refused instead of compiled.
+    refuseCopyingErasureInstanceCall(lowerer, expr, callee);
     // A CHECKED-DYNAMIC callee — `fn(a, b)` where fn is an implicit-any
     // JS binding (the mustCall body's `fn(...args)`), a dyn capture, or a
     // keyed read off a dyn value: the dynCall boundary. Arguments convert
@@ -2138,6 +2365,32 @@ function lowerNumberConstructorValue(lowerer, argNode, loc) {
         ? "unions of numbers, booleans, strings, null, and undefined lower — narrow other arms first"
         : undefined);
 }
+/** Whether a stored union arm converts on its own. A whole dynamic
+ * argument takes dyn.bigintConstructor instead, so dyn is never a
+ * dispatched arm. */
+function bigintArmLowers(arm) {
+    return (arm.kind === "bigint" ||
+        arm.kind === "string" ||
+        arm.kind === "f64" ||
+        arm.kind === "bool" ||
+        arm.kind === "bytes" ||
+        arm.kind === "array" ||
+        isUnitType(arm));
+}
+/** The hint for a BigInt argument no conversion covers. Lowering dispatches
+ * on the STORED union, which a call-site guard need not narrow; when the
+ * checker sees a different type, name both and point at the arms that stand
+ * in the way, rather than pasting the whole tagged storage at the reader. */
+function bigintRefusalHint(lowerer, arg, narrowed) {
+    const supported = "string, number, boolean, bigint, byte views, and array arguments are supported";
+    if (!narrowed || arg.type.kind !== "union" || typeEquals(narrowed, arg.type))
+        return supported;
+    const arms = lowerer.unions.get(arg.type.unionId)?.arms ?? [];
+    const blocking = arms.filter((arm) => !bigintArmLowers(arm)).map((arm) => lowerer.fmt(arm));
+    if (blocking.length === 0)
+        return supported;
+    return `the checker narrows the argument to ${lowerer.fmt(narrowed)}, but the stored value can also hold ${blocking.join(" | ")} at run time; ${supported}`;
+}
 /** A runtime-optional local retains its full tagged storage even after a
  * checker guard. Dispatch BigInt by the actual value, including nullish
  * TypeErrors, rather than interpreting that storage as the narrowed arm. */
@@ -2155,7 +2408,10 @@ function lowerBigIntConstructorValue(lowerer, arg, loc) {
     // as that element, none as 0n, several throw the SyntaxError for the
     // joined text), a Buffer's is its UTF-8 decoding and a DataView's is
     // "[object DataView]". The runtime value tells them apart, as for String.
-    if (arg.type.kind === "bytes") {
+    // An array reaches the same ToPrimitive: its text is the elements joined
+    // with "," (`[5]` reads "5", `[]` reads ""), whichever element types it
+    // holds, and BigInt parses that.
+    if (arg.type.kind === "bytes" || arg.type.kind === "array") {
         const text = {
             kind: "toString",
             operand: { kind: "dynFrom", value: arg, type: DYN, loc },
@@ -2194,13 +2450,7 @@ function lowerBigIntConstructorValue(lowerer, arg, loc) {
         return null;
     const unionId = arg.type.unionId;
     const arms = lowerer.unions.get(unionId)?.arms;
-    if (!arms ||
-        !arms.every((arm) => arm.kind === "bigint" ||
-            arm.kind === "string" ||
-            arm.kind === "f64" ||
-            arm.kind === "bool" ||
-            arm.kind === "bytes" ||
-            isUnitType(arm)))
+    if (!arms || !arms.every(bigintArmLowers))
         return null;
     const key = `bigint.scalar:${unionId}`;
     let helper = lowerer.valueHelpers.get(key);
@@ -2283,8 +2533,12 @@ function objectToStringTag(lowerer, type) {
             return "Symbol";
         case "array":
             return "Array";
-        case "record":
-            return "Object";
+        case "record": {
+            // TextEncoder and TextDecoder define Symbol.toStringTag on their
+            // prototypes.
+            const shape = lowerer.shapes.get(type.shapeId);
+            return (shape && recordTextCodecClass(shape)) ?? "Object";
+        }
         case "func":
         case "classval":
             return "Function";
@@ -2393,6 +2647,29 @@ function immediateObjectTagReceiver(lowerer, node) {
     }
     return null;
 }
+/** Array.prototype methods whose `.<name>.call(receiver, ...)` form the
+ * array-like unit runs generically when `receiver` is not a native array:
+ * the rest of the prototype's methods besides the invoke unit's own set
+ * (at, slice, indexOf, lastIndexOf, includes and the higher-order
+ * callbacks). */
+const ARRAY_LIKE_BORROW_METHODS = new Set([
+    "concat",
+    "copyWithin",
+    "fill",
+    "flat",
+    "flatMap",
+    "join",
+    "pop",
+    "push",
+    "reverse",
+    "shift",
+    "splice",
+    "toReversed",
+    "toSorted",
+    "toSpliced",
+    "unshift",
+    "with",
+]);
 const ARRAY_BORROW_METHODS = new Set([
     "at",
     "every",
@@ -2421,7 +2698,7 @@ function lowerArrayPrototypeBorrowCall(lowerer, call, access) {
         return null;
     const method = access.expression;
     if (method.questionDotToken ||
-        !ARRAY_BORROW_METHODS.has(method.name.text) ||
+        !(ARRAY_BORROW_METHODS.has(method.name.text) || ARRAY_LIKE_BORROW_METHODS.has(method.name.text)) ||
         !ts.isPropertyAccessExpression(method.expression) ||
         method.expression.questionDotToken ||
         method.expression.name.text !== "prototype" ||
@@ -2435,7 +2712,12 @@ function lowerArrayPrototypeBorrowCall(lowerer, call, access) {
     const args = call.arguments.nodes.slice(1).map((arg) => lowerer.lowerExprExpecting(arg, DYN));
     return {
         kind: "libCall",
-        fn: "dyn.arrayProtoCall",
+        // The array-like unit runs an extended method's algorithm over a
+        // receiver that is not a native array and delegates the rest to the
+        // invoke unit's dispatch.
+        fn: ARRAY_LIKE_BORROW_METHODS.has(method.name.text)
+            ? "dyn.arrayLikeProtoCall"
+            : "dyn.arrayProtoCall",
         args: [
             receiver,
             { kind: "strLit", value: method.name.text, type: STRING, loc },
@@ -2800,11 +3082,16 @@ function lowerStringPrototypeCall(lowerer, call, access) {
         return null;
     const methodAccess = access.expression;
     const prototypeAccess = methodAccess.expression;
+    // The Annex B CreateHTML methods, substr, concat and the locale-cased pair
+    // lower only as EXTRA_STRING_METHODS; a `.call` reaches the same lowering
+    // with the receiver as its first argument.
+    const extraMethod = EXTRA_STRING_METHODS.has(methodAccess.name.text);
     if (!ts.isPropertyAccessExpression(prototypeAccess) ||
         prototypeAccess.name.text !== "prototype" ||
         !ts.isIdentifier(prototypeAccess.expression) ||
         prototypeAccess.expression.text !== "String" ||
-        (!Object.hasOwn(STR_METHODS, methodAccess.name.text) &&
+        (!extraMethod &&
+            !Object.hasOwn(STR_METHODS, methodAccess.name.text) &&
             !STRING_INDEX_METHODS.has(methodAccess.name.text)) ||
         !lowerer.isStdlibMember(methodAccess))
         return null;
@@ -2814,9 +3101,11 @@ function lowerStringPrototypeCall(lowerer, call, access) {
     const indexMethod = STRING_INDEX_METHODS.has(methodAccess.name.text)
         ? methodAccess.name.text
         : null;
-    const resultType = indexMethod
-        ? lowerer.withUndefinedArmOf(indexMethod === "at" ? STRING : F64)
-        : entry?.result;
+    const resultType = extraMethod
+        ? STRING
+        : indexMethod
+            ? lowerer.withUndefinedArmOf(indexMethod === "at" ? STRING : F64)
+            : entry?.result;
     if (!resultType)
         return null;
     const method = methodAccess.name.text === "trimStart"
@@ -2876,6 +3165,17 @@ function lowerStringPrototypeCall(lowerer, call, access) {
                 false));
     // Other methods convert object receivers before lowering their arguments;
     // padding uses a helper that delays conversion until every argument is ready.
+    if (extraMethod) {
+        // Only the receivers the typed extra-method lowering already accepts: a
+        // scalar converts without running code, and the checked-dynamic receiver
+        // took the branch above. An object receiver's ToString can run user code,
+        // which `Function.call` orders after every argument, so it keeps its fence.
+        if (!scalar) {
+            lowerer.noLowering(`String.prototype.${methodAccess.name.text}.call with ${lowerer.fmt(receiverType)} receivers`, call);
+        }
+        const receiver = lowerer.ensureString(receiverValue, receiverNode);
+        return lowerExtraStringMethodCall(lowerer, call, methodAccess.name.text, receiver, receiverNode, call.arguments.nodes.slice(1));
+    }
     const objectWithoutMethodArgs = entry?.maxArgs === 0 &&
         call.arguments.nodes.length === 1 &&
         (receiverType.kind === "record" ||
@@ -3020,7 +3320,11 @@ function lowerOptionalStringNumber(lowerer, arg, loc, fn = "num.fromString", lab
     return { kind: "call", callee: helper, args: [arg], type: F64, loc };
 }
 /** `s[Symbol.iterator]()` on a string-typed receiver: the generator over
- * its code points. Null for other element calls. */
+ * its code points. On an `Iterable<T>` value (`Iterable<SegmentData>` in a
+ * union with another iterable, an option's segment function): GetIterator
+ * over the current arm, the same interned helper for-of and spread open —
+ * the answer is the canonical iterator, so `.next()` reads like any other.
+ * Null for other element calls. */
 function lowerStringIteratorCall(lowerer, call, access) {
     let key = access.argumentExpression;
     while (ts.isParenthesizedExpression(key))
@@ -3028,7 +3332,11 @@ function lowerStringIteratorCall(lowerer, call, access) {
     if (!ts.isPropertyAccessExpression(key) ||
         lowerer.stdlibGlobalMember(key, "Symbol") !== "iterator")
         return null;
-    if (lowerer.mapTypeOf(lowerer.typeOf(access.expression))?.kind !== "string")
+    const receiverT = lowerer.mapTypeOf(lowerer.typeOf(access.expression));
+    const iterable = receiverT ? iterableUnionOf(lowerer, receiverT) : null;
+    if (iterable)
+        return iterableGenerator(lowerer, lowerer.lowerExpr(access.expression), iterable);
+    if (receiverT?.kind !== "string")
         return null;
     const type = lowerer.mapTypeOf(lowerer.typeOf(call));
     if (type?.kind !== "generator")
@@ -3062,6 +3370,57 @@ function isFreshCallResult(node) {
         e = e.expression;
     return ts.isCallExpression(e);
 }
+/** A METHOD call on a union receiver whose arms declare the member with
+ * DIFFERENT signatures (`OAuthAuth | ApiKeyAuth` both declare `login`, one
+ * with an options parameter): no single static signature picks an arm, and
+ * JavaScript does not pick one either — it reads the property off the value
+ * and calls it. Box the receiver into the checked-dynamic value and lower
+ * the read and the call dynamically, so the member lookup and the call stay
+ * checked (a missing member throws V8's own TypeError) and the result
+ * crosses back through the expected type's checked conversion. Null when
+ * the receiver is not a union of object/record arms with a dyn-safe layout,
+ * leaving the method-call fence in place. */
+function lowerUnionReceiverMethodCall(lowerer, call, access) {
+    if (access.questionDotToken || call.questionDotToken)
+        return null;
+    if (call.arguments.nodes.some(ts.isSpreadElement))
+        return null;
+    const value = tryLowerExpression(lowerer, access.expression);
+    if (value?.type.kind !== "union")
+        return null;
+    const union = lowerer.unions.get(value.type.unionId);
+    if (!union || !union.arms.every((arm) => arm.kind === "object" || arm.kind === "record")) {
+        return null;
+    }
+    if (!lowerer.dynConvertible(value.type))
+        return null;
+    const loc = locOf(call);
+    const boxed = lowerer.coerceToExpected(value, DYN);
+    const local = lowerer.declareHiddenLocal("%unionReceiver", DYN);
+    const receiver = { kind: "varRef", localId: local.id, type: DYN, loc };
+    const member = {
+        kind: "dynKeyGet",
+        value: receiver,
+        key: { kind: "strLit", value: access.name.text, type: STRING, loc },
+        type: DYN,
+        loc,
+    };
+    return {
+        kind: "seqExpr",
+        stmts: [{ kind: "varDecl", localId: local.id, init: boxed, loc }],
+        result: {
+            kind: "dynCall",
+            callee: member,
+            receiver,
+            calleeName: ts.getTextOfNode(access),
+            args: call.arguments.nodes.map((arg) => lowerer.lowerExprExpecting(arg, DYN)),
+            type: DYN,
+            loc,
+        },
+        type: DYN,
+        loc,
+    };
+}
 /** METHOD calls on dyn receivers (`pkg.name.replace(...)`, `rawName.split`,
  * `ws.packages.filter(...)` — JSON.parse-derived values): validate the
  * receiver's dyn kind, extract, and ride the STATIC method machinery — the
@@ -3277,6 +3636,12 @@ function lowerDynReceiverMethodCall(lowerer, call, access, boxTypedTemporary = f
         recv = lowerer.coerceToExpected(recv, DYN);
     if (recv.type.kind !== "dyn")
         return null;
+    // `Number.prototype.m(...)` reads the prototype OBJECT, whose `m` is its
+    // own member, so every primitive specialization below — which assumes a
+    // primitive receiver and coerces the value it is given — would be wrong.
+    // The shared dispatch reads the member and calls it with the prototype as
+    // `this`, which is Node's answer for the wrapper around +0 / false.
+    const prototypeReceiver = isPrimitivePrototypeRead(lowerer, access.expression);
     if (access.name.text === "normalize" &&
         call.arguments.nodes.length <= 1 &&
         !call.arguments.nodes.some(ts.isSpreadElement)) {
@@ -3383,7 +3748,7 @@ function lowerDynReceiverMethodCall(lowerer, call, access, boxTypedTemporary = f
     // prototype declares (Array carries includes/indexOf/slice too), so no
     // other kind inherits them. Shared names would need a receiver-kind
     // dispatch — they keep the fence.
-    if (DYN_STRING_ONLY_METHODS.has(access.name.text) && !ownCallable) {
+    if (DYN_STRING_ONLY_METHODS.has(access.name.text) && !ownCallable && !prototypeReceiver) {
         // A checked-dynamic object can still carry its OWN member of that
         // name: zod's schemas assign `trim`, `toLowerCase` and `startsWith`
         // in their constructors (`z.string().trim().min(1)`), an object's
@@ -3394,9 +3759,10 @@ function lowerDynReceiverMethodCall(lowerer, call, access, boxTypedTemporary = f
         // receiver's runtime kind: a string runs the string lowering, anything
         // else calls its member as Node does.
         if ((checkerUntyped ||
-            (lowerer.typeOf(access).flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !== 0) &&
-            !call.questionDotToken &&
-            !access.questionDotToken &&
+            (lowerer.typeOf(access).flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !== 0 ||
+            // A receiver of the boxed String type may be a wrapper object.
+            (lowerer.createsWrappers ??= programCreatesWrappers(lowerer))) &&
+            !lowerer.chainBlocked(call, access) &&
             !call.arguments.nodes.some(ts.isSpreadElement))
             return lowerStringOrMemberCall(lowerer, call, access, recv);
         const checked = () => dynStringReceiver(lowerer, recv, access);
@@ -3408,8 +3774,7 @@ function lowerDynReceiverMethodCall(lowerer, call, access, boxTypedTemporary = f
     // or number receiver runs the typed lowering, every other kind keeps the
     // runtime dispatch.
     if (!ownCallable &&
-        !call.questionDotToken &&
-        !access.questionDotToken &&
+        !prototypeReceiver &&
         isDynPrimitiveKindMethod(access.name.text) &&
         !lowerer.chainBlocked(access, call)) {
         const primitive = lowerDynPrimitiveMethodCall(lowerer, call, access.name.text, ts.getTextOfNode(access), recv);
@@ -3423,6 +3788,7 @@ function lowerDynReceiverMethodCall(lowerer, call, access, boxTypedTemporary = f
     if (access.name.text === "toString" &&
         call.arguments.nodes.length <= 1 &&
         !ownCallable &&
+        !prototypeReceiver &&
         !(checkerUntyped && jsAssignsOwnToString(lowerer, access.expression))) {
         const argument = call.arguments.nodes[0];
         return {
@@ -3440,7 +3806,7 @@ function lowerDynReceiverMethodCall(lowerer, call, access, boxTypedTemporary = f
     // Every dyn kind's prototype chain declares valueOf, and the runtime
     // answers each kind's own: primitives and plain objects themselves, a
     // Date its time value, an own or inherited valueOf member its result.
-    if (access.name.text === "valueOf" && call.arguments.nodes.length === 0) {
+    if (access.name.text === "valueOf" && call.arguments.nodes.length === 0 && !prototypeReceiver) {
         const webAssembly = lowerWebAssemblyValueOf(lowerer, access.expression, recv, locOf(call));
         if (webAssembly !== null)
             return webAssembly;
@@ -3537,9 +3903,13 @@ function lowerDynReceiverMethodCall(lowerer, call, access, boxTypedTemporary = f
         !ownToString &&
         !stringOnlyName)
         return null;
-    // Optional forms (`obj.cb?.()`, `obj?.cb()`) belong to the chain
-    // machinery's short-circuit semantics — not modeled here yet.
-    if (call.questionDotToken || access.questionDotToken)
+    // An UNHANDLED `?.` step (`obj.cb?.()`, `obj?.cb()`) belongs to the chain
+    // machinery's short-circuit semantics. Inside the guarded body of a chain
+    // the active lowering has ALREADY proven the receiver present, so the
+    // step is a plain read-and-call there — the same "read the member, call
+    // it" shape below, with `dynCall` throwing Node's catchable
+    // "obj.cb is not a function" for a present but non-callable member.
+    if (lowerer.chainBlocked(call, access))
         return null;
     const loc = locOf(call);
     const receiverLocal = lowerer.declareHiddenLocal("%dynCallReceiver", DYN);
@@ -3604,7 +3974,24 @@ function lowerStringOrMemberCall(lowerer, call, access, recv) {
     const loc = locOf(call);
     const receiverLocal = lowerer.declareHiddenLocal("%dynCallReceiver", DYN);
     const receiver = varRef(receiverLocal.id, DYN, loc);
-    const isString = { kind: "dynTest", test: "string", value: receiver, type: BOOL, loc };
+    const nameLit = { kind: "strLit", value: access.name.text, type: STRING, loc };
+    const receiverIsString = {
+        kind: "dynTest",
+        test: "string",
+        value: receiver,
+        type: BOOL,
+        loc,
+    };
+    // In a program that creates wrapper objects, a receiver whose member is
+    // the builtin String.prototype method runs the string lowering on
+    // ToString of the receiver, after the arguments, as the builtin does.
+    // The member is read once: the check inspects the value the call read.
+    const wrappers = (lowerer.createsWrappers ??= programCreatesWrappers(lowerer));
+    const builtinLocal = wrappers ? lowerer.declareHiddenLocal("%dynCallStringMethod", BOOL) : null;
+    const isString = builtinLocal
+        ? { kind: "varRef", localId: builtinLocal.id, type: BOOL, loc }
+        : receiverIsString;
+    const stringLocal = wrappers ? lowerer.declareHiddenLocal("%dynCallString", DYN) : null;
     const calleeLocal = lowerer.declareHiddenLocal("%dynCallCallee", DYN);
     const callee = varRef(calleeLocal.id, DYN, loc);
     const stmts = [
@@ -3614,7 +4001,7 @@ function lowerStringOrMemberCall(lowerer, call, access, recv) {
             localId: calleeLocal.id,
             init: {
                 kind: "ternary",
-                cond: isString,
+                cond: receiverIsString,
                 then: dynUndefinedExpr(loc),
                 else_: {
                     kind: "dynKeyGet",
@@ -3628,16 +4015,52 @@ function lowerStringOrMemberCall(lowerer, call, access, recv) {
             },
             loc,
         },
+        ...(builtinLocal
+            ? [
+                {
+                    kind: "varDecl",
+                    localId: builtinLocal.id,
+                    init: {
+                        kind: "logical",
+                        op: "||",
+                        left: receiverIsString,
+                        right: {
+                            kind: "libCall",
+                            fn: "wrapper.isStringMethod",
+                            args: [callee, nameLit],
+                            type: BOOL,
+                            loc,
+                        },
+                        type: BOOL,
+                        loc,
+                    },
+                    loc,
+                },
+            ]
+            : []),
     ];
     const args = call.arguments.nodes.map((node) => {
-        const value = lowerer.lowerExpr(node);
+        const lowered = lowerer.lowerExpr(node);
+        // A unit-typed argument (`f()` of a void function, a literal undefined
+        // or null) has no local storage of its own: hold it as the dynamic
+        // value both branches receive.
+        const value = lowered.type.kind === "void" ||
+            lowered.type.kind === "undefinedT" ||
+            lowered.type.kind === "nullT"
+            ? lowerer.coerceToExpected(lowered, DYN)
+            : lowered;
         const local = lowerer.declareHiddenLocal("%dynCallArg", value.type);
         stmts.push({ kind: "varDecl", localId: local.id, init: value, loc: value.loc });
         return { node, value: varRef(local.id, value.type, value.loc) };
     });
     // String.prototype methods ignore arguments past the ones they read.
     const arity = DYN_STRING_ONLY_ARITY[access.name.text] ?? call.arguments.nodes.length;
-    const stringReceiver = () => ({ kind: "dynCheck", value: receiver, type: STRING, loc });
+    const stringReceiver = () => ({
+        kind: "dynCheck",
+        value: stringLocal ? varRef(stringLocal.id, DYN, loc) : receiver,
+        type: STRING,
+        loc,
+    });
     const lowerString = () => (call.arguments.nodes.length <= arity
         ? lowerRegexMethodCall(lowerer, call, access, stringReceiver)
         : null) ??
@@ -3659,7 +4082,35 @@ function lowerStringOrMemberCall(lowerer, call, access, recv) {
             kind: "ternary",
             cond: isString,
             then: stringCall
-                ? lowerer.coerceToExpected(stringCall, DYN)
+                ? stringLocal
+                    ? {
+                        kind: "seqExpr",
+                        stmts: [
+                            {
+                                kind: "varDecl",
+                                localId: stringLocal.id,
+                                init: {
+                                    kind: "ternary",
+                                    cond: receiverIsString,
+                                    then: receiver,
+                                    else_: {
+                                        kind: "libCall",
+                                        fn: "wrapper.thisString",
+                                        args: [receiver, nameLit],
+                                        type: DYN,
+                                        loc,
+                                    },
+                                    type: DYN,
+                                    loc,
+                                },
+                                loc,
+                            },
+                        ],
+                        result: lowerer.coerceToExpected(stringCall, DYN),
+                        type: DYN,
+                        loc,
+                    }
+                    : lowerer.coerceToExpected(stringCall, DYN)
                 : nodeThrowExpr(0, "SC1090", `method calls like '${ts.getTextOfNode(access)}' on a string are not supported yet [SC1090 at ${ts.getSourceFileOfNode(call).fileName}:${ts.getLineAndCharacterOfPosition(ts.getSourceFileOfNode(call), ts.tokenStartOfNode(call)).line + 1}]`, DYN, loc),
             else_: memberCall,
             type: DYN,
@@ -4243,7 +4694,10 @@ function lowerArrayIsArrayCall(lowerer, call, access) {
         return folded;
     // A computed argument (`Array.isArray(make())`, `Array.isArray([1, 2])`)
     // still answers from its static type, so evaluate the argument for its
-    // effects and discard the value.
+    // effects and discard the value. `undefined`/`null` lower to a bare unitLit,
+    // which carries no effect and is not a valid IR expression statement.
+    if (arg.kind === "unitLit")
+        return folded;
     return {
         kind: "seqExpr",
         stmts: [{ kind: "exprStmt", expr: arg, loc }],
@@ -4476,8 +4930,13 @@ function lowerDefaultToStringCall(lowerer, call, access) {
     // throws "<callee> is not a function".
     const nullProtoT = nullProtoRecordShape(lowerer, recvT);
     const missing = nullProtoT ? `${ts.getTextOfNode(access)} is not a function` : null;
+    // A linked copy or a record with a kept source answers as its source
+    // does (record-links.ts).
+    const linked = !missing && recvT.kind === "record" && recordMayKeepSource(lowerer, recvT);
     if (!missing && pureObjectToStringReceiver(access.expression))
-        return constant;
+        return linked
+            ? recordStringCall(lowerer, lowerer.lowerExpr(access.expression), "string", loc, "constant")
+            : constant;
     const recv = lowerer.lowerExpr(access.expression);
     const key = `objToStr:${typeKey(recv.type)}${missing ? `:${missing}` : ""}`;
     let helper = lowerer.valueHelpers.get(key);
@@ -4485,7 +4944,7 @@ function lowerDefaultToStringCall(lowerer, call, access) {
         helper = keyedHelperName(lowerer, "%obj.tostr", key);
         lowerer.valueHelpers.set(key, helper);
         const o = varRef("o.0", recv.type, loc);
-        lowerer.liftedFns.push({
+        const fn = {
             name: helper,
             params: [{ localId: "o.0", name: "o", type: recv.type }],
             returnType: STRING,
@@ -4500,7 +4959,10 @@ function lowerDefaultToStringCall(lowerer, call, access) {
                 },
             ],
             loc,
-        });
+        };
+        lowerer.liftedFns.push(fn);
+        if (linked)
+            registerLinkedHelper(lowerer, fn, recvT.shapeId, "string");
     }
     return { kind: "call", callee: helper, args: [recv], type: STRING, loc };
 }
@@ -4713,17 +5175,57 @@ function lowerPrimitiveProtoCall(lowerer, call, recv, name, memberSym) {
     }
     // Number.prototype.toLocaleString("en-US") — the spec makes it
     // NumberFormat(locale).format(this), so the en-US embedded formatter
-    // answers exactly. The unlowered forms fence by NAME: no locale (the
-    // host environment's default, which a compiled binary cannot carry),
-    // other locales (ICU data the binary does not embed), options bags.
+    // answers exactly. Without a locale (or with `undefined`) the DEFAULT
+    // locale answers, over the ICU data scr_intl.c loads; other locales and
+    // options bags stay fenced.
     if (name === "toLocaleString" && recvKind === "f64") {
-        if (call.arguments.nodes.length === 0) {
-            lowerer.noLowering("Number.prototype.toLocaleString without a locale", call, "the default locale is the host environment's, which a compiled binary cannot carry — " +
-                'pass it explicitly: x.toLocaleString("en-US")');
+        // Exactly undefined (or void): what the absent form means. A union that
+        // merely includes undefined may hold a locale at run time and falls
+        // through to the refusal below.
+        const isUndefined = (node) => {
+            const flags = lowerer.typeOf(node).flags;
+            return flags === ts.TypeFlags.Undefined || flags === ts.TypeFlags.Void;
+        };
+        const defaultLocale = call.arguments.nodes.length === 0 ||
+            (call.arguments.nodes.length === 1 &&
+                !ts.isSpreadElement(call.arguments.nodes[0]) &&
+                isUndefined(call.arguments.nodes[0]));
+        if (defaultLocale) {
+            const operand = lowerer.lowerExpr(recv);
+            if (operand.type.kind !== "f64")
+                return null;
+            const stmts = [];
+            let formatted = operand;
+            if (call.arguments.nodes.length === 1) {
+                // An explicit undefined may be any expression that evaluates to it
+                // (a call, a variable), so it still runs, after the receiver and
+                // before the formatting: the receiver's value is read first, so an
+                // argument that writes it does not change the number formatted. Its
+                // unit value has no standalone representation, so it is coerced
+                // into the dynamic slot every argument occupies.
+                const receiver = lowerer.declareHiddenLocal("%localeReceiver", F64);
+                stmts.push({ kind: "varDecl", localId: receiver.id, init: operand, loc });
+                formatted = varRef(receiver.id, F64, loc);
+                const arg = call.arguments.nodes[0];
+                const value = lowerer.lowerExpr(arg);
+                stmts.push({
+                    kind: "exprStmt",
+                    expr: value.type.kind === "void" ? value : lowerer.coerceInto(arg, value, DYN),
+                    loc,
+                });
+            }
+            const call_ = {
+                kind: "libCall",
+                fn: "icu.numFormatDefault",
+                args: [formatted],
+                type: STRING,
+                loc,
+            };
+            return stmts.length ? { kind: "seqExpr", stmts, result: call_, type: STRING, loc } : call_;
         }
         if (call.arguments.nodes.length > 1) {
-            lowerer.noLowering("Number.prototype.toLocaleString with an options bag", call, "the embedded data covers DEFAULT options only (decimal notation, up to 3 fraction " +
-                'digits, grouping) — x.toLocaleString("en-US")');
+            lowerer.noLowering("Number.prototype.toLocaleString with an options bag", call, "what lowers is the DEFAULT options shape (decimal notation, up to 3 fraction digits, " +
+                "grouping) at the default locale or at en-US — omit the options bag");
         }
         const locNode = call.arguments.nodes[0];
         if (ts.isSpreadElement(locNode) ||
@@ -4731,8 +5233,8 @@ function lowerPrimitiveProtoCall(lowerer, call, recv, name, memberSym) {
             locNode.text !== "en-US") {
             lowerer.noLowering(!ts.isSpreadElement(locNode) && ts.isStringLiteralLike(locNode)
                 ? `Number.prototype.toLocaleString at locale "${locNode.text}"`
-                : "Number.prototype.toLocaleString with a non-literal locale", locNode, '"en-US" (Node\'s default-build locale) is the one locale whose data the runtime embeds — ' +
-                "everything else is ICU data the binary does not carry");
+                : "Number.prototype.toLocaleString with a non-literal locale", locNode, "what lowers is the default locale (no argument) and the composed en-US form — " +
+                "other locales are ICU data the binary does not negotiate yet");
         }
         const operand = lowerer.lowerExpr(recv);
         if (operand.type.kind !== "f64")
@@ -6506,11 +7008,39 @@ export function recordKeysArrayCall(lowerer, receiver, argIr, shape, loc) {
             }
             body.push(...perKeyOrder(current, ref, walks, loc));
             body.push({ kind: "return", value: outRef, loc });
+            // A record that kept undeclared keys answers for-in through its live
+            // kept view, exactly as Object.keys does at its call site. Gated on
+            // the shape being one a kept width spread builds (a shape that keeps
+            // no source stays byte-identical to main) and on the shape holding a
+            // source at all.
+            if (lowerer.keyOrder.keptSourceShapes.has(argIr.shapeId) &&
+                recordMayKeepSource(lowerer, argIr)) {
+                body.unshift({
+                    kind: "if",
+                    cond: recordSourceTest(ref, loc),
+                    then: [
+                        {
+                            kind: "return",
+                            value: {
+                                kind: "libCall",
+                                fn: "dyn.objKeyStrings",
+                                args: [{ kind: "dynFrom", value: ref, liveRef: true, type: DYN, loc }],
+                                type: resultT,
+                                loc,
+                            },
+                            loc,
+                        },
+                    ],
+                    else_: null,
+                    loc,
+                });
+            }
             fn.body = body;
         };
         finalize();
         lowerer.shapeOrderHelperFinalizers.push(finalize);
         lowerer.liftedFns.push(fn);
+        registerLinkedHelper(lowerer, fn, argIr.shapeId, "keys");
     }
     return { kind: "call", callee: helper, args: [receiver], type: resultT, loc };
 }
@@ -6553,7 +7083,7 @@ export function recordHasOwnHelper(lowerer, shapeId, loc) {
         ? { kind: "recordOvfHas", obj: rRef, shapeId, key: kRef, type: BOOL, loc }
         : { kind: "boolLit", value: false, type: BOOL, loc };
     body.push({ kind: "return", value: fallback, loc });
-    lowerer.liftedFns.push({
+    const fn = {
         name: helper,
         params: [
             { localId: "r.0", name: "r", type: recT },
@@ -6566,7 +7096,37 @@ export function recordHasOwnHelper(lowerer, shapeId, loc) {
         ],
         body,
         loc,
-    });
+    };
+    lowerer.liftedFns.push(fn);
+    registerLinkedHelper(lowerer, fn, shapeId, "hasOwn");
+    // A record that kept undeclared keys answers an undeclared key through
+    // its kept view: the declared branches above stay exact (the table's
+    // placeholders only fill declared names the record owns), and the
+    // closed-shape `false` fallback becomes the view's own-key test when a
+    // kept width spread builds this shape.
+    if (!shape.indexValue && recordMayKeepSource(lowerer, recT)) {
+        lowerer.shapeOrderHelperFinalizers.push(() => {
+            if (!lowerer.keyOrder.keptSourceShapes.has(shapeId))
+                return;
+            const last = fn.body[fn.body.length - 1];
+            if (last.kind !== "return")
+                return;
+            last.value = {
+                kind: "logical",
+                op: "&&",
+                left: recordSourceTest(rRef, loc),
+                right: {
+                    kind: "libCall",
+                    fn: "dyn.hasOwn",
+                    args: [{ kind: "dynFrom", value: rRef, liveRef: true, type: DYN, loc }, kRef],
+                    type: BOOL,
+                    loc,
+                },
+                type: BOOL,
+                loc,
+            };
+        });
+    }
     return helper;
 }
 /** Whether `Object.assign(instance, record)` can copy every field of the
@@ -6725,6 +7285,12 @@ function lowerIteratorStaticFence(lowerer, call, access) {
     const from = lowerIteratorFromCall(lowerer, call, access);
     if (from)
         return from;
+    // Any other argument in JavaScript: the runtime's Iterator.from.
+    if (access.name.text === "from" && !call.questionDotToken && !access.questionDotToken) {
+        const dynamic = lowerIteratorFromDyn(lowerer, call);
+        if (dynamic)
+            return dynamic;
+    }
     lowerer.noLowering(`Iterator.${access.name.text}`, call, access.name.text === "from"
         ? "Iterator.from accepts arrays, strings, typed arrays, Sets, Maps and iterator objects such as generators"
         : "iterator helpers apply directly to generators and to array, Map and Set iterators: " +
@@ -6839,6 +7405,67 @@ function isDynEntryPairsType(lowerer, t) {
     const field = (name) => shape.fields.find((f) => f.name === name)?.type;
     return field("0")?.kind === "string" && field("1")?.kind === "dyn";
 }
+/** Object.seal, Object.freeze, Object.preventExtensions and their queries
+ * over a byte view (a typed array or a DataView) in JavaScript code. A view
+ * boxes BY REFERENCE and carries its integrity state on itself
+ * (ScrBytes.properties), so the checked-dynamic operations model it exactly:
+ * seal and freeze of a view with elements throw after making it
+ * non-extensible, as in V8. seal, freeze and preventExtensions answer the
+ * view itself, so the result converts back to the same view (a checked cast,
+ * which preserves its identity) wherever the element type admits the
+ * conversion — bytes<u8>, the DataView and Uint8Array case. A view of wider
+ * elements stays checked-dynamic, which the discarded statement form and a
+ * later comparison against the view both handle exactly. The queries answer
+ * a boolean. */
+export function lowerBytesIntegrity(lowerer, fn, view, loc) {
+    const query = fn.startsWith("dyn.is");
+    const result = {
+        kind: "libCall",
+        fn,
+        args: [lowerer.coerceToExpected(view, DYN)],
+        type: query ? BOOL : DYN,
+        loc,
+    };
+    return query ? result : lowerer.coerceToExpected(result, view.type);
+}
+/** True when the expression is statically a PLAIN OBJECT at runtime: a dyn
+ *  object literal, or a record (a literal, a clone, or any expression of a
+ *  record type, which dynFrom boxes field by field). Both build an ordinary
+ *  object whose fields are own data properties, which the plain-object
+ *  descriptor reader answers exactly. Every other expression (a variable of
+ *  any other type, a call, an array, a function) may be an object of any
+ *  kind with inherited fields, so it takes the entry points whose
+ *  ToPropertyDescriptor reads every object kind (dyn.definePropertyShapes
+ *  and its siblings). */
+export function isPlainObjectLiteral(expr) {
+    if (expr.kind === "dynObjLit")
+        return true;
+    if (expr.kind !== "dynFrom")
+        return false;
+    const value = expr.value;
+    return value.kind === "dynObjLit" || value.type.kind === "record";
+}
+/** True when the expression is a plain property-descriptor map for
+ *  Object.defineProperties or Object.create: a plain object
+ *  (isPlainObjectLiteral) whose every field is a plain object too. A dyn
+ *  literal's field values are checked with isPlainObjectLiteral and a
+ *  record's fields by their types, since dynFrom boxes a record-typed field
+ *  into an ordinary object. A map with any other field (`{ a: view }`, where
+ *  `view` is a DataView or an array) takes the any-object entry points. */
+export function isPlainDescriptorMap(expr, getRecord) {
+    if (!isPlainObjectLiteral(expr))
+        return false;
+    const literal = expr.kind === "dynFrom" ? expr.value : expr;
+    if (literal.kind === "dynObjLit")
+        return (literal.fields ?? []).every((field) => isPlainObjectLiteral(field.value));
+    if (literal.type.kind !== "record")
+        return false;
+    const shape = getRecord(literal.type.shapeId);
+    return (shape !== undefined &&
+        !shape.tuple &&
+        shape.indexValue === undefined &&
+        shape.fields.every((field) => field.type.kind === "record"));
+}
 function lowerObjectStaticCall(lowerer, call, access) {
     if (call.questionDotToken || access.questionDotToken)
         return null;
@@ -6883,6 +7510,16 @@ function lowerObjectStaticCall(lowerer, call, access) {
             object.type.kind === "bool" ||
             isUnitType(object.type))
             object = { kind: "dynFrom", value: object, type: DYN, loc: locOf(call) };
+        // An array or class instance reflects through its own checked-dynamic
+        // view (own fields and elements, in property order). A record keeps its
+        // static key walk below when it has one — `getOwnPropertyNames` over a
+        // fixed record is exactly Object.keys' construction, and boxing a typed
+        // record would link the dynamic tier into a program that needs none of
+        // it. The descriptor and symbol forms have no static walk, so a record
+        // takes the view there.
+        const staticWalk = member === "getOwnPropertyNames" && object.type.kind === "record";
+        if (!staticWalk && object.type.kind !== "dyn" && lowerer.dynConvertible(object.type))
+            object = lowerer.coerceToExpected(object, DYN);
         if (object.type.kind === "dyn")
             return {
                 kind: "libCall",
@@ -7133,7 +7770,12 @@ function lowerObjectStaticCall(lowerer, call, access) {
             if (descriptors.type.kind === "dyn")
                 return {
                     kind: "libCall",
-                    fn: "dyn.objCreateWithProperties",
+                    // A descriptor map built by an expression, or a literal map with a
+                    // descriptor built by one, may hold an array, a function or an
+                    // object with inherited fields.
+                    fn: isPlainDescriptorMap(descriptors, (id) => lowerer.shapes.get(id))
+                        ? "dyn.objCreateWithProperties"
+                        : "dyn.objCreateWithPropertiesShapes",
                     args: [proto, descriptors],
                     type: DYN,
                     loc,
@@ -7147,6 +7789,9 @@ function lowerObjectStaticCall(lowerer, call, access) {
         const prototype = lowerClassPrototypeAssign(lowerer, call);
         if (prototype)
             return prototype;
+        // A standard-library prototype value as the target is a write through it.
+        if (call.arguments.nodes.length > 0)
+            fenceDatePrototypeWriteCall(lowerer, call.arguments.nodes[0]);
         if (isJsSourceFile(ts.getSourceFileOfNode(call)) &&
             call.arguments.nodes.length > 0 &&
             !call.arguments.nodes.some(ts.isSpreadElement)) {
@@ -7220,8 +7865,14 @@ function lowerObjectStaticCall(lowerer, call, access) {
             const sProbe = tryLowerExpression(lowerer, call.arguments.nodes[1]);
             // CHECKED-DYNAMIC target and source (the JS file-scope
             // object-literal identity story): the runtime dyn copy — own
-            // members of the source land on the target, which returns.
-            if (tProbe?.type.kind === "dyn") {
+            // members of the source land on the target, which returns. A
+            // CLASS-INSTANCE target joins them when the call's own RESULT type
+            // is checked-dynamic: that is the `C & { extra }` intersection
+            // (mapClassExpandoIntersection), whose value IS the instance, so
+            // the same dyn copy writes the expando members onto its view and
+            // answers the instance — identity and prototype intact.
+            if (tProbe?.type.kind === "dyn" ||
+                (tProbe?.type.kind === "object" && lowerer.mapTypeOf(lowerer.typeOf(call))?.kind === "dyn")) {
                 const loc = locOf(call);
                 const target = lowerer.lowerExpr(call.arguments.nodes[0]);
                 const rawSource = lowerer.lowerExpr(call.arguments.nodes[1]);
@@ -7232,8 +7883,9 @@ function lowerObjectStaticCall(lowerer, call, access) {
                 if (ts.isObjectLiteralExpression(targetNode))
                     fenceClassCopyIntoFreshObject(lowerer, call, call.arguments.nodes[1], rawSource);
                 const source = lowerer.coerceToExpected(rawSource, DYN);
-                if (target.type.kind === "dyn" && source.type.kind === "dyn") {
-                    return { kind: "libCall", fn: "dyn.assign", args: [target, source], type: DYN, loc };
+                const dynTarget = target.type.kind === "dyn" ? target : lowerer.coerceToExpected(target, DYN);
+                if (dynTarget.type.kind === "dyn" && source.type.kind === "dyn") {
+                    return { kind: "libCall", fn: "dyn.assign", args: [dynTarget, source], type: DYN, loc };
                 }
             }
             // A CLASS-INSTANCE target and a plain record source whose fields are
@@ -7253,9 +7905,30 @@ function lowerObjectStaticCall(lowerer, call, access) {
                     }
                 }
             }
-            if (tProbe?.type.kind === "record" && sProbe?.type.kind === "record") {
-                const tShape = lowerer.shapes.get(tProbe.type.shapeId);
-                const sShape = lowerer.shapes.get(sProbe.type.shapeId);
+            // An operand the CHECKER narrowed to one record ARM of its declared
+            // union (`content?.type === "toolCall"` narrows the array element to
+            // ToolCall, whose lowered value still carries the element's
+            // `ToolCall | ToolResult`): the plan runs over the arm, and the
+            // operand lowers through the CHECKED extraction — the same
+            // `%union.narrow` every other arm-typed site uses, so a value that
+            // is not that arm throws the catchable TypeError instead of being
+            // copied through the wrong layout. The extraction yields the arm's
+            // own record, so the write still mutates the value the program holds.
+            const assignOperand = (node, probe) => {
+                if (probe?.type.kind === "record")
+                    return probe.type;
+                if (probe?.type.kind !== "union")
+                    return null;
+                const site = lowerer.mapTypeOf(lowerer.typeOf(node));
+                return site?.kind === "record" && lowerer.armTag(probe.type.unionId, site) >= 0
+                    ? site
+                    : null;
+            };
+            const tOperand = assignOperand(call.arguments.nodes[0], tProbe);
+            const sOperand = assignOperand(call.arguments.nodes[1], sProbe);
+            if (tOperand?.kind === "record" && sOperand?.kind === "record") {
+                const tShape = lowerer.shapes.get(tOperand.shapeId);
+                const sShape = lowerer.shapes.get(sOperand.shapeId);
                 const ok = tShape &&
                     sShape &&
                     !tShape.tuple &&
@@ -7273,8 +7946,12 @@ function lowerObjectStaticCall(lowerer, call, access) {
                     });
                 if (ok) {
                     const loc = locOf(call);
-                    const target = lowerer.lowerExpr(call.arguments.nodes[0]);
-                    const source = lowerer.lowerExpr(call.arguments.nodes[1]);
+                    const operand = (node, arm) => {
+                        const value = lowerer.lowerExpr(node);
+                        return value.type.kind === "record" ? value : lowerer.coerceToExpected(value, arm);
+                    };
+                    const target = operand(call.arguments.nodes[0], tOperand);
+                    const source = operand(call.arguments.nodes[1], sOperand);
                     if (target.type.kind === "record" && source.type.kind === "record") {
                         const helper = recordAssignHelper(lowerer, target.type.shapeId, source.type.shapeId, loc);
                         return { kind: "call", callee: helper, args: [target, source], type: target.type, loc };
@@ -7439,8 +8116,14 @@ function lowerObjectStaticCall(lowerer, call, access) {
         (member === "getOwnPropertyDescriptor" && call.arguments.nodes.length === 2)) {
         if (call.arguments.nodes.some((a) => ts.isSpreadElement(a)))
             return null;
-        let target = tryLowerExpression(lowerer, call.arguments.nodes[0]);
         const targetNode = call.arguments.nodes[0];
+        // Object.defineProperty/defineProperties over a standard-library prototype
+        // value: a typed Date never observes a dynamic definition there, so the
+        // write keeps the fence it reached before the value existed. The
+        // descriptor READ below is not a write and stays open.
+        if (member === "defineProperty")
+            fenceDatePrototypeWriteCall(lowerer, targetNode);
+        let target = tryLowerExpression(lowerer, targetNode);
         // The checker gives C.prototype the instance type, but its lowered
         // value is the shared prototype table, not an instance to unbox.
         const prototypeTarget = ts.isPropertyAccessExpression(targetNode) &&
@@ -7517,7 +8200,10 @@ function lowerObjectStaticCall(lowerer, call, access) {
             return null;
         return {
             kind: "libCall",
-            fn: "dyn.defineProperty",
+            // A descriptor built by an expression may be an array, a function or an
+            // object with inherited fields, which only the any-object entry point
+            // reads; a plain object literal keeps the plain-object reader.
+            fn: isPlainObjectLiteral(descriptor) ? "dyn.defineProperty" : "dyn.definePropertyShapes",
             args: [target, key, descriptor],
             type: DYN,
             loc: locOf(call),
@@ -7533,6 +8219,10 @@ function lowerObjectStaticCall(lowerer, call, access) {
     if (member === "defineProperties" &&
         call.arguments.nodes.length === 2 &&
         !call.arguments.nodes.some((a) => ts.isSpreadElement(a))) {
+        // A standard-library prototype value as the target is a write through it,
+        // exactly like the defineProperty form above: a typed Date never observes
+        // a definition made on the dynamic prototype object.
+        fenceDatePrototypeWriteCall(lowerer, call.arguments.nodes[0]);
         const prototype = lowerClassPrototypeDescriptors(lowerer, call, member);
         if (prototype)
             return prototype;
@@ -7573,7 +8263,12 @@ function lowerObjectStaticCall(lowerer, call, access) {
             if (descs.type.kind === "dyn") {
                 return {
                     kind: "libCall",
-                    fn: "dyn.defineProps",
+                    // As for Object.create above: a descriptor map built by an
+                    // expression, or a literal map with a descriptor built by one, takes
+                    // the any-object entry point.
+                    fn: isPlainDescriptorMap(descs, (id) => lowerer.shapes.get(id))
+                        ? "dyn.defineProps"
+                        : "dyn.definePropsShapes",
                     args: [target, descs],
                     type: DYN,
                     loc: locOf(call),
@@ -7624,6 +8319,17 @@ function lowerObjectStaticCall(lowerer, call, access) {
                 ? extensible
                 : { kind: "unary", op: "!", operand: extensible, type: BOOL, loc: locOf(call) };
         }
+        // A byte view carries its integrity state on itself and boxes by
+        // reference, so the checked-dynamic operations model these exactly.
+        if (value.type.kind === "bytes" && isJsSourceFile(ts.getSourceFileOfNode(call))) {
+            const operation = {
+                preventExtensions: "dyn.preventExtensions",
+                isExtensible: "dyn.isExtensible",
+                seal: "dyn.seal",
+                isSealed: "dyn.isSealed",
+            };
+            return lowerBytesIntegrity(lowerer, operation[member], value, locOf(call));
+        }
         if (member === "preventExtensions" || member === "seal") {
             const integrity = lowerClassIntegrity(lowerer, call, member, value);
             if (integrity)
@@ -7640,11 +8346,16 @@ function lowerObjectStaticCall(lowerer, call, access) {
             };
         }
         if (value.type.kind === "dyn") {
+            // The kind is only known at runtime: the queries refuse a native
+            // handle or a promise, whose integrity state scriptc does not track
+            // (Object.preventExtensions and Object.seal do not change it, so any
+            // answer would be invented). The static arms above keep the plain
+            // queries for the kinds whose state is modeled.
             const operation = {
                 preventExtensions: "dyn.preventExtensions",
-                isExtensible: "dyn.isExtensible",
+                isExtensible: "dyn.isExtensibleQuery",
                 seal: "dyn.seal",
-                isSealed: "dyn.isSealed",
+                isSealed: "dyn.isSealedQuery",
             };
             const fn = operation[member];
             if (!member.startsWith("is"))
@@ -7697,6 +8408,8 @@ function lowerObjectStaticCall(lowerer, call, access) {
                     loc,
                 };
         }
+        if (probedKind === "bytes" && isJsSourceFile(ts.getSourceFileOfNode(call)))
+            return lowerBytesIntegrity(lowerer, "dyn.isFrozen", lowerer.lowerExpr(argNode), locOf(call));
         const value = lowerer.lowerExprExpecting(argNode, DYN);
         return { kind: "libCall", fn: "dyn.isFrozen", args: [value], type: BOOL, loc: locOf(call) };
     }
@@ -7755,6 +8468,8 @@ function lowerObjectStaticCall(lowerer, call, access) {
             return lowerNativeFreeze(lowerer, "array.freeze", value, locOf(call));
         if (value.type.kind === "map" || value.type.kind === "set")
             return lowerNativeFreeze(lowerer, "collection.preventExtensions", value, locOf(call));
+        if (value.type.kind === "bytes" && isJsSourceFile(ts.getSourceFileOfNode(call)))
+            return lowerBytesIntegrity(lowerer, "dyn.freeze", value, locOf(call));
         lowerer.noLowering("Object.freeze of a possibly-aliased value", call, "freeze of a FRESH object/array literal (and of primitives) compiles — frozen-ness is unobservable there; an aliased target's later writes would need the runtime frozen bit");
     }
     // `Object.hasOwn(r, k)` over a RECORD receiver: a record's own-key set
@@ -8140,7 +8855,6 @@ function lowerObjectStaticCall(lowerer, call, access) {
         helper = keyedHelperName(lowerer, `%obj.${member}`, key);
         const recT = argIr;
         const ref = { kind: "varRef", localId: "r.0", type: recT, loc };
-        const outRef = { kind: "varRef", localId: "out.0", type: resultT, loc };
         const fn = {
             name: helper,
             params: [{ localId: "r.0", name: "r", type: recT }],
@@ -8152,189 +8866,290 @@ function lowerObjectStaticCall(lowerer, call, access) {
             body: [],
             loc,
         };
-        const finalize = () => {
-            const latest = lowerer.shapes.get(argIr.shapeId);
-            const current = latest !== undefined ? latest : shape;
-            const body = [
-                {
-                    kind: "varDecl",
-                    localId: "out.0",
-                    init: { kind: "arrayLit", elems: [], type: resultT, loc },
-                    loc,
-                },
-            ];
-            // One walk per key order (see perKeyOrder).
-            const orders = shapeKeyOrders(current);
-            const walks = orders.map(() => []);
-            for (const [k, name] of orders.flatMap((order, k) => order.map((name) => [k, name]))) {
-                const f = current.fields.find((x) => x.name === name);
-                const raw = {
-                    kind: "recordGet",
-                    obj: ref,
-                    shapeId: argIr.shapeId,
-                    field: f.name,
-                    type: f.type,
-                    loc,
-                };
-                // The pushed element per member; null when the field's value
-                // cannot flow into the result element type.
-                const elemOf = (value, vt) => {
-                    if (!valueT)
-                        return null;
-                    if (typeEquals(vt, valueT))
-                        return value;
-                    if (valueT.kind === "dyn" && lowerer.dynConvertible(vt))
-                        return lowerer.coerceToExpected(value, DYN);
-                    if (valueT.kind === "union" && vt.kind !== "union") {
-                        const tag = lowerer.armTag(valueT.unionId, vt);
-                        if (tag >= 0) {
-                            return { kind: "unionWrap", unionId: valueT.unionId, tag, value, type: valueT, loc };
-                        }
-                    }
+        // The statement that pushes field `f` of the record `obj` (of shape
+        // `shapeId`), or the reason its value cannot flow into the result.
+        const fieldPush = (obj, shapeId, f, out) => {
+            const raw = {
+                kind: "recordGet",
+                obj,
+                shapeId,
+                field: f.name,
+                type: f.type,
+                loc,
+            };
+            // The pushed element per member; null when the field's value
+            // cannot flow into the result element type.
+            const elemOf = (value, vt) => {
+                if (!valueT)
                     return null;
-                };
-                // Undefined-armed fields: the push is guarded by the field's
-                // presence; a narrowed push re-tags the non-undefined arm.
-                let guardUndefTag = null;
-                let value = raw;
-                let vt = f.type;
-                if (f.type.kind === "union") {
-                    const undefTag = lowerer.armTag(f.type.unionId, UNDEFINED_T);
-                    if (undefTag >= 0) {
-                        guardUndefTag = undefTag;
-                        const arms = lowerer.unions.get(f.type.unionId)?.arms ?? [];
-                        const others = arms.filter((a) => a.kind !== "undefinedT");
-                        if (valueT?.kind === "dyn" || typeEquals(f.type, valueT ?? f.type)) {
-                            // The field union IS the result union (single-field shapes):
-                            // push the raw box — but then the undefined skip must NOT
-                            // narrow. Handled below via vt === valueT.
-                            value = raw;
-                            vt = f.type;
-                        }
-                        else if (others.length === 1) {
-                            vt = others[0];
-                            // A UNIT other arm (`null | undefined` fields — the mixed-
-                            // defaults spread idiom; undefined was filtered above, so
-                            // the unit is null): units carry no payload, so the guarded
-                            // push writes the unit LITERAL — unionNarrow to a unit arm
-                            // (and unionWrap of a narrowed unit) is malformed IR; the
-                            // literal is the one legal unit spelling.
-                            value = isUnitType(vt)
-                                ? { kind: "unitLit", unit: "null", type: vt, loc }
-                                : {
-                                    kind: "unionNarrow",
-                                    unionId: f.type.unionId,
-                                    tag: lowerer.armTag(f.type.unionId, vt),
-                                    value: raw,
-                                    type: vt,
-                                    loc,
-                                };
-                        }
-                        else {
-                            lowerer.unsupported("SC1090", call, `Object.${member} over '${lowerer.fmt(argIr)}' (field '${f.name}' is a multi-arm union that ` +
-                                "cannot re-tag into the result element type — read the fields directly)");
-                        }
+                if (typeEquals(vt, valueT))
+                    return value;
+                if (valueT.kind === "dyn" && lowerer.dynConvertible(vt))
+                    return lowerer.coerceToExpected(value, DYN);
+                if (valueT.kind === "union" && vt.kind === "union") {
+                    // A field union that is a PROPER SUBSET of the element union
+                    // (`{ accent: number | string; scrollbarThumb: number | string
+                    // | undefined }` enumerates as `[string, number | string |
+                    // undefined][]`): every arm the field can hold is an arm of the
+                    // element union, so the box re-tags onto it — the same runtime
+                    // value under the element union's tag numbering.
+                    return lowerer.unionRetagMappable(vt.unionId, valueT.unionId)
+                        ? lowerer.coerceToExpected(value, valueT)
+                        : null;
+                }
+                if (valueT.kind === "union" && vt.kind !== "union") {
+                    const tag = lowerer.armTag(valueT.unionId, vt);
+                    if (tag >= 0) {
+                        return { kind: "unionWrap", unionId: valueT.unionId, tag, value, type: valueT, loc };
+                    }
+                }
+                return null;
+            };
+            // Undefined-armed fields: the push is guarded by the field's
+            // presence; a narrowed push re-tags the non-undefined arm.
+            let guardUndefTag = null;
+            let value = raw;
+            let vt = f.type;
+            if (f.type.kind === "union") {
+                const undefTag = lowerer.armTag(f.type.unionId, UNDEFINED_T);
+                if (undefTag >= 0) {
+                    guardUndefTag = undefTag;
+                    const arms = lowerer.unions.get(f.type.unionId)?.arms ?? [];
+                    const others = arms.filter((a) => a.kind !== "undefinedT");
+                    if (valueT?.kind === "dyn" || typeEquals(f.type, valueT ?? f.type)) {
+                        // The field union IS the result union (single-field shapes):
+                        // push the raw box — but then the undefined skip must NOT
+                        // narrow. Handled below via vt === valueT.
+                        value = raw;
+                        vt = f.type;
                     }
-                    else if (valueT?.kind !== "dyn" && !typeEquals(f.type, valueT ?? f.type)) {
-                        lowerer.unsupported("SC1090", call, `Object.${member} over '${lowerer.fmt(argIr)}' (field '${f.name}' is a union that cannot ` +
-                            "re-tag into the result element type — read the fields directly)");
+                    else if (others.length === 1) {
+                        vt = others[0];
+                        // A UNIT other arm (`null | undefined` fields — the mixed-
+                        // defaults spread idiom; undefined was filtered above, so
+                        // the unit is null): units carry no payload, so the guarded
+                        // push writes the unit LITERAL — unionNarrow to a unit arm
+                        // (and unionWrap of a narrowed unit) is malformed IR; the
+                        // literal is the one legal unit spelling.
+                        value = isUnitType(vt)
+                            ? { kind: "unitLit", unit: "null", type: vt, loc }
+                            : {
+                                kind: "unionNarrow",
+                                unionId: f.type.unionId,
+                                tag: lowerer.armTag(f.type.unionId, vt),
+                                value: raw,
+                                type: vt,
+                                loc,
+                            };
+                    }
+                    else {
+                        return `field '${f.name}' is a multi-arm union that cannot re-tag into the result element type`;
                     }
                 }
-                const coerced = elemOf(value, vt);
-                if (!coerced) {
-                    lowerer.unsupported("SC1090", call, `Object.${member} over '${lowerer.fmt(argIr)}' (field '${f.name}' of type '${lowerer.fmt(f.type)}' ` +
-                        `cannot flow into the '${lowerer.fmt(valueT)}' result element — read the fields directly)`);
+                else if (valueT?.kind !== "dyn" &&
+                    !typeEquals(f.type, valueT ?? f.type) &&
+                    !(valueT?.kind === "union" && lowerer.unionRetagMappable(f.type.unionId, valueT.unionId))) {
+                    return `field '${f.name}' is a union that cannot re-tag into the result element type`;
                 }
-                const pushOf = (element) => ({
-                    kind: "exprStmt",
-                    expr: {
-                        kind: "arrIntrinsic",
-                        method: "push",
-                        receiver: outRef,
-                        args: [
-                            member === "values"
-                                ? element
-                                : {
-                                    kind: "recordLit",
-                                    fields: [
-                                        { name: "0", value: { kind: "strLit", value: f.name, type: STRING, loc } },
-                                        { name: "1", value: element },
-                                    ],
-                                    type: tupleT,
-                                    loc,
-                                },
-                        ],
-                        type: F64,
-                        loc,
-                    },
+            }
+            const coerced = elemOf(value, vt);
+            if (!coerced) {
+                return (`field '${f.name}' of type '${lowerer.fmt(f.type)}' ` +
+                    `cannot flow into the '${lowerer.fmt(valueT)}' result element`);
+            }
+            const pushOf = (element) => ({
+                kind: "exprStmt",
+                expr: {
+                    kind: "arrIntrinsic",
+                    method: "push",
+                    receiver: out,
+                    args: [
+                        member === "values"
+                            ? element
+                            : {
+                                kind: "recordLit",
+                                fields: [
+                                    { name: "0", value: { kind: "strLit", value: f.name, type: STRING, loc } },
+                                    { name: "1", value: element },
+                                ],
+                                type: tupleT,
+                                loc,
+                            },
+                    ],
+                    type: F64,
                     loc,
-                });
-                let stmt = pushOf(coerced);
-                if (guardUndefTag !== null && f.type.kind === "union") {
-                    if (value !== raw) {
-                        // A narrowed push: a present field holding undefined pushes
-                        // the result element's own undefined when it has one; a values
-                        // array without one stores a present undefined element (a
-                        // runtime-optional field the checker typed as required). An
-                        // entries tuple slot has no spelling for it.
-                        const undefinedElement = valueT ? lowerer.wrappedUndefined(valueT, loc) : null;
-                        const undefinedPush = undefinedElement
-                            ? pushOf(undefinedElement)
-                            : member === "values"
-                                ? {
-                                    kind: "arraySetUndefined",
-                                    arr: outRef,
-                                    index: {
-                                        kind: "arrIntrinsic",
-                                        method: "length",
-                                        receiver: outRef,
-                                        args: [],
-                                        type: F64,
-                                        loc,
-                                    },
+                },
+                loc,
+            });
+            let stmt = pushOf(coerced);
+            if (guardUndefTag !== null && f.type.kind === "union") {
+                if (value !== raw) {
+                    // A narrowed push: a present field holding undefined pushes
+                    // the result element's own undefined when it has one; a values
+                    // array without one stores a present undefined element (a
+                    // runtime-optional field the checker typed as required). An
+                    // entries tuple slot has no spelling for it.
+                    const undefinedElement = valueT ? lowerer.wrappedUndefined(valueT, loc) : null;
+                    const undefinedPush = undefinedElement
+                        ? pushOf(undefinedElement)
+                        : member === "values"
+                            ? {
+                                kind: "arraySetUndefined",
+                                arr: out,
+                                index: {
+                                    kind: "arrIntrinsic",
+                                    method: "length",
+                                    receiver: out,
+                                    args: [],
+                                    type: F64,
                                     loc,
-                                }
-                                : null;
-                        stmt = {
-                            kind: "if",
-                            cond: {
-                                kind: "unionIsTag",
-                                unionId: f.type.unionId,
-                                tag: guardUndefTag,
-                                negated: true,
-                                value: raw,
-                                type: BOOL,
+                                },
                                 loc,
-                            },
-                            then: [stmt],
-                            else_: undefinedPush ? [undefinedPush] : null,
-                            loc,
-                        };
-                    }
-                    // Absent fields contribute nothing; present ones push their
-                    // value, undefined included.
+                            }
+                            : null;
                     stmt = {
                         kind: "if",
-                        cond: lowerer.recordFieldPresent(ref, argIr.shapeId, f.name, loc),
+                        cond: {
+                            kind: "unionIsTag",
+                            unionId: f.type.unionId,
+                            tag: guardUndefTag,
+                            negated: true,
+                            value: raw,
+                            type: BOOL,
+                            loc,
+                        },
                         then: [stmt],
-                        else_: null,
+                        else_: undefinedPush ? [undefinedPush] : null,
                         loc,
                     };
                 }
-                walks[k].push(stmt);
+                // Absent fields contribute nothing; present ones push their
+                // value, undefined included.
+                stmt = {
+                    kind: "if",
+                    cond: lowerer.recordFieldPresent(obj, shapeId, f.name, loc),
+                    then: [stmt],
+                    else_: null,
+                    loc,
+                };
             }
-            body.push(...perKeyOrder(current, ref, walks, loc));
-            body.push({ kind: "return", value: outRef, loc });
-            fn.body = body;
+            return stmt;
+        };
+        // The walk that pushes the fields of `obj` (of `current`) into out.0,
+        // one walk per key order (see perKeyOrder). `refused` answers a field
+        // whose value cannot flow into the result.
+        // The walk that pushes the fields of `obj` (of `current`) into the
+        // local `outId` and returns it, one walk per key order (see
+        // perKeyOrder). `refused` answers a field whose value cannot flow into
+        // the result.
+        const fieldWalk = (obj, current, outId, refused) => {
+            const out = { kind: "varRef", localId: outId, type: resultT, loc };
+            const orders = shapeKeyOrders(current);
+            const walks = orders.map(() => []);
+            for (const [k, name] of orders.flatMap((order, k) => order.map((name) => [k, name]))) {
+                const f = current.fields.find((x) => x.name === name);
+                const stmt = fieldPush(obj, current.id, f, out);
+                walks[k].push(typeof stmt === "string" ? refused(stmt) : stmt);
+            }
+            return [
+                {
+                    kind: "varDecl",
+                    localId: outId,
+                    init: { kind: "arrayLit", elems: [], type: resultT, loc },
+                    loc,
+                },
+                ...perKeyOrder(current, obj, walks, loc),
+                { kind: "return", value: out, loc },
+            ];
+        };
+        const finalize = () => {
+            const latest = lowerer.shapes.get(argIr.shapeId);
+            const current = latest !== undefined ? latest : shape;
+            fn.body = fieldWalk(ref, current, "out.0", (reason) => lowerer.unsupported("SC1090", call, `Object.${member} over '${lowerer.fmt(argIr)}' (${reason} — read the fields directly)`));
         };
         finalize();
         lowerer.arrHofHelpers.set(key, helper);
         lowerer.shapeOrderHelperFinalizers.push(finalize);
         lowerer.liftedFns.push(fn);
+        // A linked copy lists its source's fields. When one of them cannot
+        // flow into the result, the copy answers as a kept source does: its
+        // checked view's values, checked into the result (which throws).
+        registerLinkedHelper(lowerer, fn, argIr.shapeId, "custom");
+        lowerer.linkedHelperFinalizers.push(() => {
+            // The answer for the composed record of a link, which can itself be
+            // a linked copy or keep a checked source: their properties come first.
+            // `path` holds the record types the links followed so far. Two types
+            // can link both ways (each lacks an optional field of the other): a
+            // composed record of this helper's own type calls the helper, and one
+            // of another type on the path answers from its checked view.
+            const answerAt = (path) => (composed) => {
+                const composedT = composed.type;
+                const sourceShape = lowerer.shapes.get(composedT.shapeId);
+                const view = { kind: "dynFrom", value: composed, liveRef: true, type: DYN, loc };
+                const viewAnswer = {
+                    kind: "return",
+                    value: {
+                        kind: "dynCheck",
+                        value: {
+                            kind: "libCall",
+                            fn: member === "values" ? "dyn.objValues" : "dyn.objEntries",
+                            args: [view],
+                            type: DYN,
+                            loc,
+                        },
+                        type: resultT,
+                        loc,
+                    },
+                    loc,
+                };
+                if (composedT.shapeId === argIr.shapeId)
+                    return [
+                        {
+                            kind: "return",
+                            value: { kind: "call", callee: fn.name, args: [composed], type: resultT, loc },
+                            loc,
+                        },
+                    ];
+                if (path.has(composedT.shapeId))
+                    return [viewAnswer];
+                let fits = true;
+                const walk = fieldWalk(composed, sourceShape, linkedOut(fn, resultT), () => {
+                    fits = false;
+                    return {
+                        kind: "exprStmt",
+                        expr: { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc },
+                        loc,
+                    };
+                });
+                const further = linkedCopyBranches(lowerer, fn, composed, composedT.shapeId, answerAt(new Set([...path, composedT.shapeId])));
+                if (!fits)
+                    return [...further, viewAnswer];
+                if (!recordMayKeepSource(lowerer, composedT))
+                    return [...further, ...walk];
+                return [
+                    ...further,
+                    {
+                        kind: "if",
+                        cond: recordSourceTest(composed, loc),
+                        then: [viewAnswer],
+                        else_: null,
+                        loc,
+                    },
+                    ...walk,
+                ];
+            };
+            answerLinkedCopies(lowerer, fn, argIr.shapeId, answerAt(new Set([argIr.shapeId])));
+        });
     }
     const callee = helper;
     return sourced((receiver) => ({ kind: "call", callee, args: [receiver], type: resultT, loc }));
 }
+/** A fresh hidden local of `fn` for a linked copy's values or entries. */
+function linkedOut(fn, type) {
+    const id = `linkedOut.${fn.locals.length}`;
+    fn.locals.push({ id, name: "linkedOut", type, mutable: false });
+    return id;
+}
 /** An entries array consumed pair by pair right where it is built: a
  * for-of loop or an array callback method. These consumers bind each pair
  * from the array's own layout, so the pair's value slot can keep a
@@ -8616,6 +9431,60 @@ export function lowerRecordFieldCall(lowerer, call, access) {
             lowerer.unsupported("SC1090", call, `calling a function field of a '${lowerer.fmt(target.obj.type)}' record (the record has no dynamic form to pass as 'this')`);
         }
     }
+    // A generic member's field holds its erased instance, and the call
+    // through the field crosses the same boundary as one through the
+    // instance value itself: the conversions that would copy are refused
+    // here too.
+    refuseCopyingErasureInstanceCall(lowerer, call, callee);
+    // A rest-marked field value hides one synthetic trailing dyn array in
+    // its lifted signature — the checked variadic ABI a JS rest closure
+    // has, and the one a generic member's erased instance keeps when its
+    // erased signature cannot pin the tail (`...args: EventArguments<…>`, a
+    // conditional tuple over the member's own type parameters). The call
+    // passes that slot natively, so a record or array the callee returns
+    // comes back as the object it returned, exactly as JavaScript hands it
+    // back; the boxed thunk would copy it and break identity and mutation
+    // sharing. A call that leaves an omitted parameter without an absent
+    // spelling still rides the thunk (JavaScript's own arity).
+    if (init === null &&
+        receiver === undefined &&
+        callee.type.rest === true &&
+        callee.type.restAbi === undefined &&
+        !call.arguments.nodes.some(ts.isSpreadElement) &&
+        canBoxFuncIntoDyn(callee.type, (id) => lowerer.shapes.get(id), (id) => lowerer.unions.get(id))) {
+        const nativeArgs = checkedRestCallArgs(lowerer, call, callee.type, loc);
+        if (nativeArgs) {
+            // The resolved result converts exactly like the fixed-arity lane
+            // below; a void result needs no conversion (the call's own value is
+            // discarded, as an `unknown` has no void spelling).
+            let nativeResult = {
+                kind: "callValue",
+                callee,
+                args: nativeArgs,
+                type: callee.type.ret,
+                loc,
+            };
+            const resolved = lowerer.irTypeOf(call);
+            if (resolved.kind !== "void" &&
+                isGenericCallableMemberType(lowerer.typeOf(access), lowerer.checker))
+                nativeResult = lowerer.coerceInto(call, nativeResult, resolved);
+            return nativeResult;
+        }
+        const boxed = { kind: "dynFrom", value: callee, type: DYN, loc };
+        let boxedResult = {
+            kind: "dynCall",
+            callee: boxed,
+            calleeName: v8CalleeText(call.expression),
+            args: call.arguments.nodes.map((arg) => lowerer.lowerExprExpecting(arg, DYN)),
+            type: DYN,
+            loc,
+        };
+        const resolved = lowerer.irTypeOf(call);
+        if (resolved.kind !== "void" &&
+            isGenericCallableMemberType(lowerer.typeOf(access), lowerer.checker))
+            boxedResult = lowerer.coerceInto(call, boxedResult, resolved);
+        return boxedResult;
+    }
     const args = completeFuncValueArgs(lowerer, call, callee.type, locOf(call));
     let result = {
         kind: "callValue",
@@ -8649,9 +9518,11 @@ export function lowerRecordFieldCall(lowerer, call, access) {
 /** The URL factories use the constructor's conversion order and parser.
  * URL.revokeObjectURL() with NO argument: Node's ERR_MISSING_ARGS
  * throws before the registry lookup, so the zero-argument contract is
- * exact without any blob machinery. The one-argument form (Node's
- * no-op for unregistered ids) and createObjectURL keep their
- * fences — a compiled program has no blob registry to consult. */
+ * exact without any blob machinery. The one-argument form coerces the
+ * id to a string (a Symbol throws) and finds nothing registered — a
+ * compiled program cannot create a blob URL, so the lookup always
+ * misses and the call is its own coercion. createObjectURL keeps its
+ * fence: there is no blob registry to register into. */
 function lowerUrlStaticCall(lowerer, call, callee) {
     if (!ts.isPropertyAccessExpression(callee) || callee.questionDotToken !== undefined)
         return null;
@@ -8663,9 +9534,20 @@ function lowerUrlStaticCall(lowerer, call, callee) {
     if (callee.name.text === "canParse" || callee.name.text === "parse") {
         return lowerUrlFactory(lowerer, call, callee.name.text);
     }
-    if (callee.name.text !== "revokeObjectURL" || call.arguments.nodes.length !== 0)
+    if (callee.name.text !== "revokeObjectURL")
+        return null;
+    const args = call.arguments.nodes;
+    if (args.length === 0) {
+        return nodeThrowExpr(1, "ERR_MISSING_ARGS", 'The "url" argument must be specified', VOID, locOf(call));
+    }
+    if (args.length !== 1)
         return null;
-    return nodeThrowExpr(1, "ERR_MISSING_ARGS", 'The "url" argument must be specified', VOID, locOf(call));
+    const arg = args[0];
+    const id = lowerer.lowerExpr(arg);
+    const text = id.type.kind === "url"
+        ? { kind: "libCall", fn: "url.href", args: [id], type: STRING, loc: locOf(arg) }
+        : lowerer.ensureString(id, arg);
+    return { kind: "libCall", fn: "url.revokeObjectURL", args: [text], type: VOID, loc: locOf(call) };
 }
 const SP_BRAND_METHODS = new Set([
     "append",
@@ -8870,10 +9752,84 @@ function lowerArrowFunctionApply(lowerer, call, access) {
     }
     return { kind: "seqExpr", stmts, result, type: DYN, loc };
 }
+/** The Promise statics whose generic algorithms depend only on the `this`
+ * constructor: NewPromiseCapability(C), GetPromiseResolve(C) and the
+ * iterator protocol. scr_js_promise_generic.c runs them for a `this` that
+ * is not %Promise%. `withResolvers` and `try` take no iterable and stay
+ * refused (their capability shapes have no dynamic representation yet). */
+const PROMISE_GENERIC_STATICS = new Set([
+    "all",
+    "allSettled",
+    "any",
+    "race",
+    "resolve",
+    "reject",
+]);
 function lowerObjLitGenericMethodCall(lowerer, call, access) {
     if (lowerer.chainBlocked(access, call))
         return null;
     const name = access.name.text;
+    // The Promise statics through Function.prototype.call with ANY `this`
+    // (`Promise.all.call(NotPromise, iterable)`): the specification's
+    // algorithms over NewPromiseCapability(C), where %Promise% answers the
+    // ordinary implementation. A `.js` source only — the arm replaces the
+    // checked-value fence below, so no typed program changes shape. The
+    // runtime unit scr_js_promise_generic.c runs the generic steps; the
+    // builtin function's own thunk (dyn_builtin_fn_call) does not grow.
+    if (name === "call" && !call.questionDotToken && isJsSourceFile(ts.getSourceFileOfNode(call))) {
+        const stat = ts.isPropertyAccessExpression(access.expression)
+            ? lowerer.stdlibGlobalMember(access.expression, "Promise")
+            : null;
+        if (stat !== null &&
+            PROMISE_GENERIC_STATICS.has(stat) &&
+            !call.arguments.nodes.some(ts.isSpreadElement)) {
+            const loc = locOf(call);
+            const thisArg = call.arguments.nodes[0];
+            const value = call.arguments.nodes[1];
+            // `Promise.all.call(Promise, …)` is the ordinary call: the runtime
+            // recognizes %Promise% by identity and forwards to the native
+            // implementation. The global read yields the interned constructor
+            // value (`dyn.globalConstructor`) — exactly the identity compared —
+            // rather than the reflected-value fence a stdlib global read as a
+            // `.call` receiver otherwise reports.
+            let thisIr = !thisArg
+                ? dynUndefinedExpr(loc)
+                : stdlibGlobalNameOf(lowerer, thisArg) === "Promise"
+                    ? (builtinGlobalValue("Promise", loc, true) ?? lowerer.lowerExprExpecting(thisArg, DYN))
+                    : lowerer.lowerExprExpecting(thisArg, DYN);
+            let valueIr = value ? lowerer.lowerExprExpecting(value, DYN) : dynUndefinedExpr(loc);
+            const callOf = (receiver, iterable) => ({
+                kind: "libCall",
+                fn: "promise.genericStatic",
+                args: [{ kind: "strLit", value: stat, type: STRING, loc }, receiver, iterable],
+                type: DYN,
+                loc,
+            });
+            // The algorithm reads only the first two arguments, but Node evaluates
+            // every argument of the call before it runs: the receiver and the
+            // iterable first, then each surplus argument, in source order. Hold the
+            // two the unit reads in hidden locals so the surplus arguments'
+            // effects and exceptions happen after them, and drop their values.
+            const surplus = call.arguments.nodes.slice(2);
+            if (surplus.length === 0)
+                return callOf(thisIr, valueIr);
+            const holds = [];
+            // Both are lowered into the checked-dynamic slot, so each is a dyn value
+            // a hidden local can hold.
+            const hold = (expr, name) => {
+                const local = lowerer.declareHiddenLocal(name, expr.type);
+                holds.push({ kind: "varDecl", localId: local.id, init: expr, loc });
+                return varRef(local.id, expr.type, loc);
+            };
+            thisIr = hold(thisIr, "%promiseStaticThis");
+            valueIr = hold(valueIr, "%promiseStaticIterable");
+            for (const arg of surplus) {
+                const argIr = lowerer.lowerExprExpecting(arg, DYN);
+                holds.push({ kind: "exprStmt", expr: argIr, loc: locOf(arg) });
+            }
+            return { kind: "seqExpr", stmts: holds, result: callOf(thisIr, valueIr), type: DYN, loc };
+        }
+    }
     // URLSearchParams method values through Function.prototype.call/apply
     // with a receiver that is provably NOT a URLSearchParams (the suite's
     // `params.append.call(undefined)` probes): the WHATWG brand check
@@ -9959,7 +10915,8 @@ function maybePromiseHandlerResult(lowerer, call, value, R) {
     }
     return stmt;
 }
-/** `view.m(args)` where `view` is a `Pick<C, K>` / `Omit<C, K>` view of a
+/** `view.m(args)` where `view` is a `Pick<C, K>` / `Omit<C, K>` view (inline
+ * or through type aliases, classViewOf) of a
  * program class C and `m` is one of C's GENERIC methods (its overloads
  * included): generic methods have no dispatchable method value, so the
  * view's live receiver is extracted as the C instance it holds (a checked
@@ -9967,12 +10924,10 @@ function maybePromiseHandlerResult(lowerer, call, value, R) {
  * text naming C) and the call monomorphizes statically against C, the
  * same lowering a C-typed receiver gets. Null for other receivers. */
 function pickViewGenericMethodCall(lowerer, call, access, recvTs) {
-    const alias = recvTs.getAliasSymbol();
-    if (alias === undefined || (ts.symbolName(alias) !== "Pick" && ts.symbolName(alias) !== "Omit"))
+    const view = classViewOf(lowerer.checker, recvTs);
+    if (view === null)
         return null;
-    if (!alias.declarations.every((d) => ts.getSourceFileOfNode(d).isDeclarationFile))
-        return null;
-    const source = recvTs.getAliasTypeArguments()[0];
+    const source = view.source;
     const symbol = source?.getSymbol();
     const info = symbol ? lowerer.classBySymbol.get(symbol) : undefined;
     if (!info || call.questionDotToken || access.questionDotToken)
@@ -9989,7 +10944,7 @@ function pickViewGenericMethodCall(lowerer, call, access, recvTs) {
     if (lowered.type.kind === "object" &&
         lowered.type.className !== info.def.name &&
         !lowerer.isSubclassOf(lowered.type.className, info.def.name)) {
-        lowerer.unsupported("SC1090", access, `calling the generic method '${access.name.text}' through a '${ts.symbolName(alias)}' view of '${info.def.name}' that holds a '${lowerer.fmt(lowered.type)}'`);
+        lowerer.unsupported("SC1090", access, `calling the generic method '${access.name.text}' through a '${view.name}' view of '${info.def.name}' that holds a '${lowerer.fmt(lowered.type)}'`);
     }
     const receiver = lowered.type.kind === "object"
         ? lowered
@@ -10247,4 +11202,130 @@ function checkedDynamicOperand(expr) {
         return expr;
     return expr.kind === "dynCheck" && expr.value.type.kind === "dyn" ? expr.value : null;
 }
+/** The class of the object `node` is statically, or null. */
+function objectClassOf(lowerer, node) {
+    let t;
+    try {
+        t = lowerer.mapTypeOf(lowerer.typeOf(node));
+    }
+    catch {
+        return null;
+    }
+    if (t?.kind !== "object")
+        return null;
+    return lowerer.classes.get(t.className) ?? null;
+}
+/** The class of an EventEmitter instance (not a stream) that `node` is
+ * statically, or null. */
+function plainEmitterInfoOf(lowerer, node) {
+    const info = objectClassOf(lowerer, node);
+    return info && emitterRooted(lowerer, info) && streamSidesOf(lowerer, info) === null
+        ? info
+        : null;
+}
+/** `R.<method>.call(thisArg, ...args)` where `R.<method>` is
+ * EventEmitter.prototype's method: R is `EventEmitter.prototype` or an
+ * EventEmitter instance (not a stream) whose class does not override
+ * `emit`, read without effects. Node runs the method with thisArg as
+ * `this`. A thisArg that is statically such an emitter takes the method's
+ * typed lowering with thisArg as the receiver and static dispatch (the
+ * super spelling); any other thisArg calls the untyped
+ * EventEmitter.prototype method, which works on the object's `_events`.
+ * Null for every other shape. */
+function lowerEmitterMethodValueCall(lowerer, call, access) {
+    const target = access.expression;
+    if (!ts.isPropertyAccessExpression(target) || target.questionDotToken)
+        return null;
+    const member = target.name.text;
+    if (!EMITTER_API_MEMBERS.has(member))
+        return null;
+    const holderNode = target.expression;
+    const emitterKind = builtinClassKind(RUNTIME_EMITTER_CLASS);
+    const isPrototype = ts.isPropertyAccessExpression(holderNode) &&
+        holderNode.name.text === "prototype" &&
+        builtinClassKindOf(lowerer, holderNode.expression) === emitterKind;
+    // `EventEmitter.prototype` is a builtin read; any other holder must be
+    // effect-free, or its getter (and its exceptions) would be skipped.
+    if (!isPrototype && !isPureReference(lowerer, holderNode))
+        return null;
+    const holder = isPrototype ? null : plainEmitterInfoOf(lowerer, holderNode);
+    if (!isPrototype && (!holder || (member === "emit" && emitOverrideAtOrAbove(holder))))
+        return null;
+    const args = call.arguments.nodes;
+    if (args.length === 0 || args.some(ts.isSpreadElement))
+        return null;
+    const thisArg = args[0];
+    const thisInfo = plainEmitterInfoOf(lowerer, thisArg);
+    const thisClass = objectClassOf(lowerer, thisArg);
+    if (!thisInfo &&
+        thisClass !== null &&
+        emitterRooted(lowerer, thisClass) &&
+        streamSidesOf(lowerer, thisClass) !== null) {
+        // A stream keeps its own event table: the untyped method would read
+        // fields the compiled stream does not have.
+        lowerer.noLowering(`EventEmitter.prototype.${member}.call on a stream`, call, "call the method on the stream directly");
+    }
+    if (thisInfo && member === "emit" && emitOverrideAtOrAbove(thisInfo)) {
+        lowerer.noLowering("EventEmitter.prototype.emit called on an instance whose class overrides emit", call, "call the override, or emit from a class that does not override emit");
+    }
+    if (thisInfo) {
+        const thisRef = lowerer.lowerExpr(thisArg);
+        if (thisRef.type.kind !== "object")
+            return null;
+        return lowerEmitterMethodCall(lowerer, call, target, thisInfo, { thisRef, cls: thisInfo }, args.slice(1));
+    }
+    const loc = locOf(call);
+    const prototype = {
+        kind: "dynKeyGet",
+        value: builtinClassValue(emitterKind, loc),
+        key: { kind: "strLit", value: "prototype", type: STRING, loc },
+        type: DYN,
+        loc,
+    };
+    return {
+        kind: "dynInvoke",
+        recv: {
+            kind: "dynKeyGet",
+            value: prototype,
+            key: { kind: "strLit", value: member, type: STRING, loc },
+            type: DYN,
+            loc,
+        },
+        method: "call",
+        calleeName: ts.getTextOfNode(access),
+        args: args.map((arg) => lowerer.lowerExprExpecting(arg, DYN)),
+        type: DYN,
+        loc,
+    };
+}
+/** atob(data) / btoa(data), the globals and node:buffer's members (the same
+ * functions in Node): str.atob / str.btoa over the argument as a dyn value,
+ * str.b64Missing for the zero-argument call. */
+export function lowerBase64Call(lowerer, expr, name, loc) {
+    if (expr.arguments.nodes.length === 0) {
+        return { kind: "libCall", fn: "str.b64Missing", args: [], type: STRING, loc };
+    }
+    if (expr.arguments.nodes.length > 1) {
+        lowerer.noLowering(`${name} with ${expr.arguments.nodes.length} arguments`, expr);
+    }
+    const argNode = expr.arguments.nodes[0];
+    const v = lowerer.lowerExpr(argNode);
+    let data;
+    if (v.type.kind === "dyn") {
+        data = v;
+    }
+    else if (v.kind === "unitLit" || lowerer.dynConvertible(v.type)) {
+        data = { kind: "dynFrom", value: v, type: DYN, loc };
+    }
+    else {
+        lowerer.noLowering(`${name} with a '${lowerer.fmt(v.type)}' argument`, argNode, "string-convertible arguments lower (Node ToStrings the value — convert it explicitly)");
+    }
+    return {
+        kind: "libCall",
+        fn: name === "atob" ? "str.atob" : "str.btoa",
+        args: [data],
+        type: STRING,
+        loc,
+    };
+}
 //# sourceMappingURL=lower-calls.js.map