@scriptc/compiler 0.4.6 → 0.4.8

package/dist/frontend/lowering/lower-stmts.js

@@ -1,23 +1,27 @@
-import { keepsInitializerLayout, notePreservedLayout } from "./structural-instances.js";
+import { lowerStaticPrivateAssignment } from "./private-statics.js";
+import { keepsCheckedDynamicValue, keepsInitializerLayout, notePreservedLayout, } from "./structural-instances.js";
+import { partialFieldRead } from "./partial-assertions.js";
 import { jsGlobalValueByName } from "./global-values.js";
 import { lowerTupleAliasDecl, stripTypeWrappers } from "./typed-arguments.js";
-import { islandHandleBinding, lowerIslandExpr, lowerIslandSubclass } from "./lower-node-island.js";
+import { islandHandleBinding, lowerIslandExpr, isIslandRequireSpec, lowerIslandRequireAtStatement, lowerIslandSubclass, } from "./lower-node-island.js";
 import { isIslandSubclassDecl } from "../../node-islands/boundary.js";
 import { allBytesArms, indexedUnionArms, lowerIndexedUnionMember, lowerIndexedUnionNumberRead, lowerIndexedUnionRead, } from "./indexed-unions.js";
-import { declaredMemberOf, isPromisePrototypeRead, lowerUnionKeyedRead, } from "./expressions/property-access.js";
-import { hostedStorageView, hostsAll } from "./expressions/hosted-narrowing.js";
+import { declaredMemberOf, fenceDatePrototypeWrite, isPromisePrototypeRead, lowerUnionKeyedRead, } from "./expressions/property-access.js";
+import { hostedStorageView, hostsAll, recordViewHosted } from "./expressions/hosted-narrowing.js";
+import { assertionViewCopy, bindingIdentityUse, bindingWrite } from "./divergences.js";
 import { requestGeneralStreamSurface } from "./general-streams.js";
 import { lowerForAwaitDynStream, nodeStreamInterfaceSide } from "./dyn-streams.js";
 import { lowerForAwaitValueStream } from "./builtins/hash-stream.js";
 import { lowerChildPropertyWrite } from "./handle-properties.js";
 import { matchAllRowsReadByElements, storedMatchAllRowsReadByElements, } from "./containers/match-row-uses.js";
-import { dynUndefinedExpr, nodeThrowExpr, numLit, varRef } from "../../ir/build.js";
-import { runtimeKeyPatternRead } from "./expressions/keyed-field-targets.js";
+import { dynUndefinedExpr, nodeThrowExpr, numLit, strLit, varRef } from "../../ir/build.js";
+import { literalFieldKeys, runtimeKeyPatternRead } from "./expressions/keyed-field-targets.js";
 import { declaresHoistedBinding, staticCondition } from "./static-typeof.js";
 import { lowerCollectionSpread } from "./containers/collection-methods.js";
 import { lowerEventObjectPropertyWrite } from "./lower-event-target.js";
 import { lowerDynObjectLiteral } from "./expressions/object-literals.js";
 import { importMetaBindingSource } from "./import-meta.js";
+import { nullishEmptyPatternSource } from "./nullish-empty-pattern.js";
 import { anyResidueReplacedBy } from "./any-collection-residue.js";
 import { iteratorCanStep, iteratorValue } from "./iterator-consumption.js";
 import { notIterableSpelling } from "./iterable-spelling.js";
@@ -31,21 +35,23 @@ import { isWebStreamValueInJavaScript, typeInvolvesWebStream } from "./builtins/
 import * as ts from "../ts7/adapter.js";
 import { lowerOptionalIndex } from "./undefined-index.js";
 import { processDataMemberValue, programReadsExitCode } from "./builtins/process.js";
+import { heldEnvValueType, refuseHeldEnvCopyHold } from "./builtins/environment.js";
 import { requireInitFlagStmt } from "./require-initialization.js";
 import { isJsonRequireDecl } from "./json-require.js";
 import { isTimeValueDateDeclaration } from "./date-values.js";
 import { bindingSource } from "../binding-source.js";
-import { lowerConstructorReturn } from "./constructor-returns.js";
+import { clearPendingPrimitiveReturn, lowerConstructorReturn } from "./constructor-returns.js";
 import { statementGroupKey } from "./type-failure.js";
 import { cjsExportValueByName, cjsNamespaceDestructureOf, cjsTableMethodEntry, inlineProgramRequireOf, requireNestedPatternsOf, splitRequireAssignmentOf, splitRequireBindingOf, splitRequireBindingOfIdent, splitRequireEarlyReadOf, wholeExportSymbolOfModule, } from "./cjs-inline-require.js";
 import { cjsExportMemberWriteGlobalOf, isCjsExportsIdentifier, isCjsModuleExports, isFreshExportsReset, } from "./cjs-exports-object.js";
 import { isDeadTscHelperDecl, tscInteropBindingOfDecl } from "./cjs-tsc-interop.js";
 import { arrayValueRead, arrayValueStore, arrayValueType, unionArrayValueRead, lowerSafeIndexRead, } from "./array-values.js";
 import { lowerForAwaitGenerator, lowerForOfGenerator, lowerYieldStarStatement, } from "./lower-generators.js";
-import { classAsyncGeneratorIterator, lowerForAwaitBuiltin } from "./lower-async-iteration.js";
-import { BOOL, BYTES_U8, CAUGHT, DATE_T, DYN, F64, SEARCH_PARAMS_T, STRING, UNDEFINED_T, VOID, arrayOf, isDynTypedRefType, isUnitType, shapeHasAccessorSlots, typeEquals, } from "../../ir/ir.js";
+import { classAsyncGeneratorIterator, isNodeReadableIteratorSource, isWebReadableIteratorSource, lowerForAwaitBuiltin, } from "./lower-async-iteration.js";
+import { BOOL, BYTES_U8, CAUGHT, DATE_T, DYN_HANDLE_KINDS, DYN, F64, SEARCH_PARAMS_T, STRING, UNDEFINED_T, VOID, arrayOf, isDynTypedRefType, isUnitType, shapeHasAccessorSlots, typeEquals, } from "../../ir/ir.js";
 import { PoisonError, boundIdentifiersOf, dynFallbackType, neverTaintedJsType, staticImportNamespaceType, } from "./lowerer.js";
 import { enforceLibBoundary, lowerSurplusCalls } from "./lib-boundary.js";
+import { isBuiltinIdentityToken, isPrimitiveValueType, lowerPrimitiveBaseDelete, } from "./primitive-throws.js";
 import { cjsExportAssignmentOf, cjsExportChainOf, cjsVoidInitPreambleReals, cjsExportDiscardReason, cjsExportTargetLiteral, isCjsJsFile, isEsModuleStamp, isJsSourceFile, locOf, requireEarlyReference, requireSpecOf, } from "../program.js";
 import { isStrictCode } from "./strict-mode.js";
 import { markSloppyRecordWrites } from "./frozen-records.js";
@@ -58,7 +64,7 @@ import { lowerForOfArrayIter, lowerForOfMap, lowerForOfSearchParams, lowerForOfS
 import { lowerForOfHelperChain } from "./containers/iterator-helpers.js";
 import { objectIterOverIndexShape } from "./containers/indexed-objects.js";
 import { strCharsCall } from "./containers/array-construction.js";
-import { bindingContextualGenericFnNodeOf, bindingGenericFnAliasInfoOf, bindingGenericFnInfoOf, bindingGenericFnNodeOf, genericBindingPresenceStore, genericBindingStoredValue, implicitLocalFnInfoOf, implicitLocalFnNodeOf, implicitMethodCallInfersReturn, genericLocalClassBinding, } from "./generic-functions.js";
+import { bindingContextualGenericFnNodeOf, bindingGenericFnAliasInfoOf, bindingGenericFnInfoOf, bindingGenericFnNodeOf, genericAliasPresenceStore, genericBindingPresenceStore, genericBindingStoredValue, implicitLocalFnInfoOf, implicitLocalFnNodeOf, implicitMethodCallInfersReturn, genericLocalClassBinding, } from "./generic-functions.js";
 import { bindingNeverReassigned, deadUnmappableBinding, fileWritesBinding, nullishExprUnitOf, nullishGenericBindingUnitOf, } from "./binding-analysis.js";
 import { hasExplicitJsDocReturn } from "./function-returns.js";
 import { recordKeysArrayCall } from "./lower-calls.js";
@@ -734,8 +740,11 @@ function lowerOneStatement(lowerer, stmt, out, usingMarkers, diagsBefore, deferF
     if (deferFences && lowerer.diagSink === null && lowerer.diags.length > diagsBefore) {
         const flushed = lowerer.diags.splice(diagsBefore);
         const ice = flushed.filter((d) => d.code === "SC9001");
-        lowerer.diags.push(...ice);
-        lowerer.runtimeFences.push(...flushed.filter((d) => d.code !== "SC9001"));
+        for (const d of ice)
+            lowerer.diags.push(d);
+        for (const d of flushed)
+            if (d.code !== "SC9001")
+                lowerer.runtimeFences.push(d);
     }
 }
 /** Whether a statement list belongs to a function body (at any block
@@ -883,6 +892,11 @@ export function predeclareForwardCapture(lowerer, symbol) {
                     lowerer.isStdlibGlobal(decl.initializer.expression.expression, "Object"))) &&
             lowerer.dynConvertible(type))
             type = DYN;
+        // An island handle binding holds a checked-dynamic value whatever its
+        // declared type says: its own declaration lowers as one, and so must
+        // the slot a closure captured first.
+        if (islandHandleBinding(lowerer, decl.name))
+            type = DYN;
         if (!TDZ_KINDS.has(type.kind) || isUnitType(type))
             return false;
         const name = decl.name.text;
@@ -995,8 +1009,11 @@ export function predeclareForwardFnDecl(lowerer, symbol) {
         }
         catch (e) {
             entry.ctx.hoistedFnDecls.delete(decl);
-            if (previousSink !== null)
-                previousSink.push(...lowerer.diags.splice(diagsBefore));
+            if (previousSink !== null) {
+                const flushed = lowerer.diags.splice(diagsBefore);
+                for (const d of flushed)
+                    previousSink.push(d);
+            }
             throw e;
         }
         finally {
@@ -1023,7 +1040,9 @@ function hostVariableDeclarationOf(name) {
     while (ts.isBindingElement(n) || ts.isArrayBindingPattern(n) || ts.isObjectBindingPattern(n)) {
         n = n.parent;
     }
-    return ts.isVariableDeclaration(n) ? n : null;
+    // A catch parameter is a VariableDeclaration of the CatchClause: its
+    // bindings are scoped to the clause, and each execution makes new ones.
+    return ts.isVariableDeclaration(n) && !ts.isCatchClause(n.parent) ? n : null;
 }
 /** `for (var x of ...)` loop variables: the ONE function-scoped binding
  * every for-of desugar must ASSIGN per iteration instead of declaring a
@@ -1483,10 +1502,12 @@ const THROWN_AS_DYN = new Set([
 ]);
 /** A `return` at the top level of a CommonJS module (preflight admits it
  * there only): it ends the module's evaluation, and its value is
- * evaluated and discarded, as Node's module wrapper does. Top-level
- * bindings and export assignments after it would be left uninitialized
- * where Node leaves them in their temporal dead zone or absent, so a
- * module with any keeps a refusal. Null for a return inside a function. */
+ * evaluated and discarded, as Node's module wrapper does. Bindings
+ * declared after it stay uninitialized when it is taken, which only code
+ * that exists by then can observe: a function created before the return,
+ * or a hoisted function declaration. A module whose such functions read a
+ * later binding, or that assigns exports after the return, keeps a
+ * refusal. Null for a return inside a function. */
 function lowerModuleLevelReturn(lowerer, stmt) {
     let top = stmt;
     while (top.parent !== undefined && !ts.isSourceFile(top.parent)) {
@@ -1498,9 +1519,25 @@ function lowerModuleLevelReturn(lowerer, stmt) {
     if (sf === undefined || !ts.isSourceFile(sf))
         return null;
     const stmts = sf.statements.nodes;
-    const later = stmts.slice(stmts.indexOf(top) + 1);
-    if (later.some((s) => ts.isVariableStatement(s) || ts.isClassDeclaration(s) || cjsExportAssignmentOf(s) !== null)) {
-        lowerer.unsupported("SC1090", stmt, "a top-level return in a CommonJS module that declares variables or classes, or assigns exports, after it");
+    const index = stmts.indexOf(top);
+    const later = stmts.slice(index + 1);
+    if (later.some((s) => cjsExportAssignmentOf(s) !== null)) {
+        lowerer.unsupported("SC1090", stmt, "a top-level return in a CommonJS module that assigns exports after it");
+    }
+    const laterBindings = laterModuleBindings(lowerer, later);
+    if (laterBindings.size > 0) {
+        // Functions that exist when the return is taken: every function in the
+        // statements up to the return, and the hoisted declarations after it.
+        const reachable = [
+            ...stmts.slice(0, index + 1),
+            ...later.filter((s) => ts.isFunctionDeclaration(s)),
+        ];
+        const read = reachable
+            .map((s) => functionReadOf(lowerer, s, laterBindings, ts.isFunctionDeclaration(s)))
+            .find((r) => r !== null);
+        if (read) {
+            lowerer.unsupported("SC1090", read, `reading '${read.text}', declared after a top-level CommonJS return, from a function that can run once the return is taken`);
+        }
     }
     const loc = locOf(stmt);
     const ret = { kind: "return", value: null, loc };
@@ -1512,6 +1549,50 @@ function lowerModuleLevelReturn(lowerer, stmt) {
         loc,
     };
 }
+/** The module-scope bindings `stmts` declare: variables and classes, with
+ * `var` declarations in nested blocks. Bindings inside functions are not
+ * module-scope and are skipped. */
+function laterModuleBindings(lowerer, stmts) {
+    const bindings = new Set();
+    const addName = (name) => {
+        if (ts.isIdentifier(name)) {
+            const symbol = lowerer.checker.getSymbolAtLocation(name);
+            if (symbol)
+                bindings.add(symbol);
+            return;
+        }
+        for (const element of name.elements.nodes) {
+            if (ts.isBindingElement(element) && element.name)
+                addName(element.name);
+        }
+    };
+    const visit = (node) => {
+        if (ts.isFunctionLike(node) || ts.isClassStaticBlockDeclaration(node))
+            return;
+        if (ts.isVariableDeclaration(node))
+            addName(node.name);
+        if (ts.isClassDeclaration(node) && node.name)
+            addName(node.name);
+        ts.forEachChild(node, visit);
+    };
+    for (const stmt of stmts)
+        visit(stmt);
+    return bindings;
+}
+/** The first identifier inside a function or class in `node` (anywhere in
+ * `node` when `inFunction`) that reads one of `bindings`, or null. */
+function functionReadOf(lowerer, node, bindings, inFunction) {
+    if (inFunction && ts.isIdentifier(node)) {
+        const symbol = lowerer.resolveValueSymbol(node);
+        return symbol && bindings.has(symbol) ? node : null;
+    }
+    // Class bodies count as functions: field initializers run per instance.
+    const nested = inFunction ||
+        ts.isFunctionLike(node) ||
+        ts.isClassDeclaration(node) ||
+        ts.isClassExpression(node);
+    return (ts.forEachChild(node, (child) => functionReadOf(lowerer, child, bindings, nested) ?? undefined) ?? null);
+}
 export function lowerStmt(lowerer, stmt) {
     if (ownPrototypeResetStatement(lowerer, stmt))
         return { kind: "block", body: [], loc: locOf(stmt) };
@@ -1647,6 +1728,39 @@ export function lowerStmt(lowerer, stmt) {
         // observed empty returns even when JSDoc omits undefined. Any remaining
         // incompatible boundary keeps the ordinary per-statement refusal.
         let value = null;
+        // A derived constructor that can record a pending TypeError on a
+        // primitive return drops it when a return of its own completes: a
+        // `finally` block's `return;`, `return undefined` or `return this`
+        // replaces the earlier completion instead of leaving it pending. The
+        // drop follows the operand, which may throw — an operand that throws
+        // never completes the return, so a `finally` that catches it and then
+        // finishes resumes the earlier primitive return (and its TypeError).
+        const withClearedPending = (ret) => {
+            const clear = clearPendingPrimitiveReturn(lowerer, stmt);
+            if (clear.length === 0)
+                return ret;
+            const loc = locOf(stmt);
+            const body = ret.kind === "block" ? ret.body : [ret];
+            const last = body.at(-1);
+            if (last?.kind !== "return")
+                return { kind: "block", body: [...clear, ret], loc };
+            const before = body.slice(0, -1);
+            if (last.value === null)
+                return { kind: "block", body: [...before, ...clear, last], loc };
+            // A constructor returns void, so a valued operand only evaluates for
+            // effect — ahead of the drop, since a `return this.fail()` inside a
+            // `finally` that catches the throw never completes.
+            return {
+                kind: "block",
+                body: [
+                    ...before,
+                    { kind: "exprStmt", expr: last.value, loc },
+                    ...clear,
+                    { kind: "return", value: null, loc },
+                ],
+                loc,
+            };
+        };
         if (stmt.expression) {
             // A constructor's returned object replaces the constructed `this`.
             if (lowerer.currentClass?.ctor) {
@@ -1654,7 +1768,7 @@ export function lowerStmt(lowerer, stmt) {
                 if (constructorReturn !== null)
                     return constructorReturn;
             }
-            return lowerer.lowerReturnStmt(stmt.expression, locOf(stmt));
+            return withClearedPending(lowerer.lowerReturnStmt(stmt.expression, locOf(stmt)));
         }
         else if (lowerer.ctx.returnType.kind === "union") {
             value = lowerer.wrappedUndefined(lowerer.ctx.returnType, locOf(stmt));
@@ -1670,8 +1784,8 @@ export function lowerStmt(lowerer, stmt) {
         }
         // An async generator's bare return has no operand to await.
         if (lowerer.ctx.isAsync === true && lowerer.ctx.generator)
-            return { kind: "return", value, awaited: true, loc: locOf(stmt) };
-        return { kind: "return", value, loc: locOf(stmt) };
+            return withClearedPending({ kind: "return", value, awaited: true, loc: locOf(stmt) });
+        return withClearedPending({ kind: "return", value, loc: locOf(stmt) });
     }
     if (ts.isBreakStatement(stmt) || ts.isContinueStatement(stmt)) {
         const kw = ts.isBreakStatement(stmt) ? "break" : "continue";
@@ -1865,6 +1979,11 @@ function lowerVarDeclarator(lowerer, stmt, decl, isConst, isLet) {
         if (lowerer.externalTypes.has(spec))
             lowerer.externalHostFence(spec, decl, false);
         if (ts.isSourceFile(stmt.parent)) {
+            // `const x = require("<island>")` and `const { name } = …`: the
+            // island module loads here, at the statement (lower-node-island.ts).
+            const island = lowerIslandRequireAtStatement(lowerer, decl);
+            if (island !== null)
+                return [island];
             const init = lowerer.requireInitStmt(spec, decl);
             const out = init ? [init] : [];
             // Nested patterns destructure the named export's value right after
@@ -1883,6 +2002,12 @@ function lowerVarDeclarator(lowerer, stmt, decl, isConst, isLet) {
         // same routing top-level requires use, and no statement remains.
         // Relative requires keep the fence: their module-init-at-position
         // semantics needs storage this model doesn't represent.
+        // A nested require of an island package is an ordinary binding of the
+        // island module, loaded at the statement (lower-node-island.ts).
+        if (isIslandRequireSpec(lowerer, ts.getSourceFileOfNode(decl).fileName, spec)) {
+            const lowered = lowerer.lowerVarDecl(decl, isLet);
+            return lowered ? [lowered] : [];
+        }
         if (canonicalBuiltinModule(spec) !== null) {
             return canonicalBuiltinModule(spec) === "punycode"
                 ? [lowerer.punycodeRequireWarning(decl)]
@@ -2142,6 +2267,7 @@ export function lowerDestructuringDecl(lowerer, decl, isLet) {
             return tokenBound;
     }
     let init = importMetaBindingSource(lowerer, decl.name, decl.initializer) ??
+        nullishEmptyPatternSource(lowerer, decl.name, decl.initializer) ??
         lowerer.lowerExpr(decl.initializer);
     const parseArgsDynObject = init.type.kind === "dyn" &&
         isParseArgsDynCheckerType(lowerer, lowerer.typeOf(decl.initializer));
@@ -2187,13 +2313,26 @@ export function lowerDestructuringDecl(lowerer, decl, isLet) {
         }
     }
     const out = [];
+    // V8's destructuring TypeError spells STATIC sources: an identifier
+    // source reads "<name> is not iterable", an identifier-callee call
+    // "<name> is not a function or its return value is not iterable";
+    // everything else (property reads, method calls, parameters) gets the
+    // runtime kind wording — exactly V8's CallPrinter behavior. The DYN
+    // pattern arm and the unit arms of a narrowed union consume this.
+    const src = decl.initializer;
+    const dynSpell = ts.isIdentifier(src)
+        ? `${src.text} is not iterable`
+        : ts.isCallExpression(src) && ts.isIdentifier(src.expression)
+            ? `${src.expression.text} is not a function or its return value is not iterable`
+            : undefined;
     // JS: a union source with exactly ONE destructurable arm beside unit
     // arms (`nameAndArgs.match(re)` — `RegExpMatchArray | null`, the
     // always-matches idiom) destructures through a VALIDATED narrow: the
-    // unit arms throw at runtime exactly where Node's TypeError would
-    // (the message is the fence's — a unit value here is the failure
-    // path either way). TypeScript keeps the fence: narrowing first is
-    // the annotated fix.
+    // unit arms throw Node's TypeError, through the checks a dyn source
+    // takes (RequireObjectCoercible for an object pattern, GetIterator for
+    // an array pattern). An object pattern whose source has no V8
+    // spelling keeps the fence. TypeScript keeps the fence: narrowing
+    // first is the annotated fix.
     if (isJsSourceFile(ts.getSourceFileOfNode(decl)) && init.type.kind === "union") {
         const def = lowerer.unions.get(init.type.unionId);
         const dataArms = (def?.arms ?? []).filter((a) => !isUnitType(a));
@@ -2204,9 +2343,56 @@ export function lowerDestructuringDecl(lowerer, decl, isLet) {
             def.arms.every((a) => a === arm || isUnitType(a)) &&
             (arm.kind === "array" || arm.kind === "record")) {
             const tag = def.arms.indexOf(arm);
+            const unionId = init.type.unionId;
             const utmp = lowerer.declareHiddenLocal("%destrU", init.type);
             out.push({ kind: "varDecl", localId: utmp.id, init, loc });
             const uref = { kind: "varRef", localId: utmp.id, type: init.type, loc };
+            // The failure branch holds one of the unit arms: the check reads it
+            // as the dyn null or undefined it is, so the data arm needs no dyn
+            // form (a record holding a generator has none).
+            const unitValue = () => {
+                const unitOf = (t) => lowerer.coerceToExpected({ kind: "unitLit", unit: t.kind === "nullT" ? "null" : "undefined", type: t, loc }, DYN);
+                const units = def.arms.filter(isUnitType);
+                const last = units[units.length - 1];
+                return units.slice(0, -1).reduceRight((rest, t) => ({
+                    kind: "ternary",
+                    cond: {
+                        kind: "unionIsTag",
+                        unionId,
+                        tag: def.arms.indexOf(t),
+                        negated: false,
+                        value: uref,
+                        type: BOOL,
+                        loc,
+                    },
+                    then: unitOf(t),
+                    else_: rest,
+                    type: DYN,
+                    loc,
+                }), unitOf(last));
+            };
+            const spelling = destrSpellingOf(src);
+            const check = ts.isArrayBindingPattern(decl.name)
+                ? {
+                    kind: "dynIterN",
+                    value: unitValue(),
+                    count: decl.name.elements.nodes.length,
+                    ...(dynSpell ? { notIterableMessage: dynSpell } : {}),
+                    type: DYN,
+                    loc,
+                }
+                : firstReadsWithDefault(decl.name)
+                    ? firstKeyRead(lowerer, decl.name, unitValue, loc)
+                    : spelling !== null
+                        ? {
+                            kind: "dynDestrCheck",
+                            value: unitValue(),
+                            spelling,
+                            ...firstPatternProp(lowerer, decl.name),
+                            type: DYN,
+                            loc,
+                        }
+                        : null;
             out.push({
                 kind: "if",
                 cond: {
@@ -2219,6 +2405,7 @@ export function lowerDestructuringDecl(lowerer, decl, isLet) {
                     loc,
                 },
                 then: [
+                    ...(check !== null ? [{ kind: "exprStmt", expr: check, loc }] : []),
                     {
                         kind: "runtimeFence",
                         code: "SC1031",
@@ -2241,58 +2428,40 @@ export function lowerDestructuringDecl(lowerer, decl, isLet) {
     // value: RequireObjectCoercible with V8's own TypeError ("Cannot
     // destructure property 'a' of 'f(...)' as it is null.") for the source
     // spellings the assignment form reproduces; other sources are refused,
-    // as in the assignment form. JavaScript files keep their existing
-    // per-read errors, except that a runtime computed first key checks the
-    // source first: Node throws before it evaluates any key, and V8's bare
-    // message names the source.
-    const jsRuntimeKeyCheck = init.type.kind === "dyn" &&
+    // as in the assignment form. A JavaScript object pattern over a dyn
+    // source checks the source first in the same way when V8 can spell it,
+    // so a null or undefined source throws Node's message before any key
+    // is read or evaluated; other sources keep their per-read errors. V8
+    // skips the check when the first element has a default and a static
+    // key: the read of that key throws ("Cannot read properties of null
+    // (reading 'a')"), and so does the lowering's.
+    const jsSourceCheck = init.type.kind === "dyn" &&
         ts.isObjectBindingPattern(decl.name) &&
         isJsSourceFile(ts.getSourceFileOfNode(decl)) &&
-        (decl.name.elements.nodes.length === 0 || startsWithRuntimeKey(lowerer, decl.name)) &&
         destrSpellingOf(decl.initializer) !== null;
-    if (jsRuntimeKeyCheck ||
+    if ((jsSourceCheck ||
         (init.type.kind === "dyn" &&
             ts.isObjectBindingPattern(decl.name) &&
             !isJsSourceFile(ts.getSourceFileOfNode(decl)) &&
-            lowerer.anyOrigin(decl.initializer))) {
+            lowerer.anyOrigin(decl.initializer))) &&
+        !firstReadsWithDefault(decl.name)) {
         const spelling = destrSpellingOf(decl.initializer);
         if (spelling === null) {
             lowerer.unsupported("SC1031", decl.initializer, "destructuring declaration from an `any` source whose expression spelling is unsupported (use a variable, ordinary property chain, or ordinary call)");
         }
-        const first = decl.name.elements.nodes[0];
-        const firstKey = first === undefined || first.dotDotDotToken !== undefined
-            ? undefined
-            : (first.propertyName ?? first.name);
-        // V8 names the first property when its key is an identifier, a string
-        // or a number; a computed first key takes the bare (source-only) form.
-        const firstProp = firstKey === undefined || ts.isComputedPropertyName(firstKey)
-            ? undefined
-            : (patternKeyNameOf(lowerer, firstKey) ?? undefined);
         out.push({
             kind: "exprStmt",
             expr: {
                 kind: "dynDestrCheck",
                 value: { kind: "varRef", localId: tmp.id, type: init.type, loc },
                 spelling,
-                ...(firstProp !== undefined ? { firstProp } : {}),
+                ...firstPatternProp(lowerer, decl.name),
                 type: init.type,
                 loc,
             },
             loc,
         });
     }
-    // V8's destructuring TypeError spells STATIC sources: an identifier
-    // source reads "<name> is not iterable", an identifier-callee call
-    // "<name> is not a function or its return value is not iterable";
-    // everything else (property reads, method calls, parameters) gets the
-    // runtime kind wording — exactly V8's CallPrinter behavior. Only the
-    // DYN pattern arm consumes this.
-    const src = decl.initializer;
-    const dynSpell = ts.isIdentifier(src)
-        ? `${src.text} is not iterable`
-        : ts.isCallExpression(src) && ts.isIdentifier(src.expression)
-            ? `${src.expression.text} is not a function or its return value is not iterable`
-            : undefined;
     lowerer.lowerBindingPattern(decl.name, () => ({ kind: "varRef", localId: tmp.id, type: init.type, loc }), init.type, isLet, out, dynSpell, parseArgsDynObject);
     return out;
 }
@@ -3198,6 +3367,10 @@ export function lowerBindingPattern(lowerer, pattern, srcRef, srcType, isLet, ou
             type: fieldType,
             loc,
         };
+        // A field some partial record assertion leaves unwritten (a partial
+        // record view, partial-assertions.ts): the element read throws the
+        // catchable TypeError instead of reading a slot the view lacks.
+        value = partialFieldRead(lowerer, srcRef(), srcType.shapeId, propName, fieldType, loc) ?? value;
         // `{ tld = "localhost" }`: the element default applies exactly when
         // the field holds the undefined arm — the same undefined test and
         // narrow/retag as a defaulted parameter's prologue (declareParams).
@@ -4643,9 +4816,13 @@ export function lowerVarDeclList(lowerer, list) {
     const out = [];
     for (const decl of list.declarations.nodes) {
         if (ts.isArrayBindingPattern(decl.name) || ts.isObjectBindingPattern(decl.name)) {
-            // Destructuring produces nested initialization blocks; copying
-            // their captured bindings still needs a distinct head-scope plan.
-            lowerer.unsupported("SC1031", decl.name, "let/const destructuring in for-loop initializers (declare the pattern before the loop, or use var)");
+            // The pattern desugars to a flat statement list whose bindings are
+            // ordinary head declarations (`for (let [a, b] = xs; ...)`: `%destr`
+            // plus `a`, `b`), so the loop emitter finds them as head lets and
+            // freshens the captured ones per iteration like any other
+            // declarator (emit-statements: capturedLets).
+            out.push(...lowerer.lowerDestructuringDecl(decl, isLet));
+            continue;
         }
         const lowered = lowerer.lowerVarDecl(decl, isLet);
         if (!lowered)
@@ -4861,20 +5038,30 @@ function evolvingArrayHolderType(lowerer, decl) {
         return null;
     return evolvingArrayHold(lowerer, decl.initializer) === null ? null : DYN;
 }
-/** A single static type for an initializer-less JavaScript `let` whose
- * later plain writes all agree. An evolving JS local reads as `undefined`
- * until control flow proves a write, so a scalar slot is sound only when
- * every ordinary use already has that concrete flow type. Any closure
- * capture stays checked-dynamic: it can observe the local before an outer
- * assignment, and the checker deliberately leaves captured evolving lets
- * broad. */
-function inferredEvolvingLetType(lowerer, decl) {
+/** A single static type for an initializer-less `let` without an
+ * annotation whose later plain writes all agree. An evolving local reads as
+ * `undefined` until control flow proves a write, so a scalar slot is sound
+ * only when every ordinary use already has that concrete flow type (or an
+ * arm of it). A write of `null` or `undefined` joins the written type as an
+ * optional arm (`let stat; try { stat = lstatSync(".") } catch { stat = null }`
+ * holds `Stats | null`). A write's call counts when its signature is
+ * declared in the standard library, whose return types are declared rather
+ * than inferred from JavaScript. A closure capture can observe the local
+ * before an outer assignment, and the checker leaves captured evolving lets
+ * broad: a captured runtime handle (`let child; if (...) child = spawn(...)`)
+ * takes the handle or `undefined`, which nested functions read as a
+ * checked-dynamic value (closureDynLets), and other captured bindings stay
+ * checked-dynamic. */
+export function inferredEvolvingLetType(lowerer, decl) {
     if (!ts.isIdentifier(decl.name))
         return null;
     const symbol = lowerer.checker.getSymbolAtLocation(decl.name);
     const scope = decl.parent?.parent?.parent;
     if (symbol === undefined || (!ts.isBlock(scope) && !ts.isSourceFile(scope)))
         return null;
+    // Another module reads an exported binding, which this scan does not see.
+    if (ts.getCombinedModifierFlags(decl) & ts.ModifierFlags.Export)
+        return null;
     // A shorthand property's name (`{ width }`) resolves to the property
     // symbol, but it reads the binding: the checker's shorthand-value symbol.
     const refersToBinding = (node) => (ts.isShorthandPropertyAssignment(node.parent) && node.parent.name === node
@@ -4904,13 +5091,25 @@ function inferredEvolvingLetType(lowerer, decl) {
     const writes = [];
     const reads = [];
     let invalid = false;
-    ts.walkPreorder(scope, (node) => {
-        if (node !== scope && ts.isFunctionLike(node)) {
-            if (captures(node))
-                invalid = true;
+    let captured = false;
+    // The capturing closure being scanned: reads inside one carry the
+    // checker's broad type, so only its writes are collected.
+    let closure = null;
+    const visit = (node) => {
+        if (node !== scope && node !== closure && ts.isFunctionLike(node)) {
+            if (captures(node)) {
+                captured = true;
+                const outer = closure;
+                closure = node;
+                ts.walkPreorder(node, visit);
+                closure = outer;
+            }
             return "skip";
         }
-        if (ts.isBinaryExpression(node)) {
+        // A compound assignment (`x += 1`) reads and rewrites the binding
+        // through an operator this scan does not model; a comparison
+        // (`x === null`) only reads it, and the read check below covers that.
+        if (ts.isBinaryExpression(node) && ts.isAssignmentOperator(node.operatorToken.kind)) {
             let left = node.left;
             while (ts.isParenthesizedExpression(left))
                 left = left.expression;
@@ -4919,9 +5118,7 @@ function inferredEvolvingLetType(lowerer, decl) {
                     invalid = true;
                     return "stop";
                 }
-                if (ts.isCallExpression(node.right) &&
-                    (implicitMethodCallInfersReturn(lowerer, node.right) ||
-                        isJsSourceFile(ts.getSourceFileOfNode(node.right)))) {
+                if (ts.isCallExpression(node.right) && !stdlibDeclaredCall(lowerer, node.right)) {
                     invalid = true;
                     return "stop";
                 }
@@ -4935,7 +5132,7 @@ function inferredEvolvingLetType(lowerer, decl) {
                     return "stop";
                 }
                 const mapped = lowerer.mapTypeOf(lowerer.typeOf(node.right));
-                if (!mapped || mapped.kind === "dyn" || mapped.kind === "void" || isUnitType(mapped)) {
+                if (!mapped || mapped.kind === "dyn" || mapped.kind === "void") {
                     invalid = true;
                     return "stop";
                 }
@@ -4948,23 +5145,69 @@ function inferredEvolvingLetType(lowerer, decl) {
             invalid = true;
             return "stop";
         }
-        if (ts.isIdentifier(node) &&
+        if (closure === null &&
+            ts.isIdentifier(node) &&
             node !== decl.name &&
             refersToBinding(node) &&
             !isPlainAssignmentTarget(node)) {
             reads.push(node);
         }
         return undefined;
-    });
-    const first = writes[0];
-    if (invalid || first === undefined || !writes.every((write) => typeEquals(write, first)))
+    };
+    ts.walkPreorder(scope, visit);
+    // A write of an already-unioned value contributes its arms, so a call
+    // declared `Stats | null` reads the same as separate value and unit
+    // writes.
+    const armsOf = (t) => t.kind === "union" ? (lowerer.unions.get(t.unionId)?.arms ?? [t]) : [t];
+    const valueArms = [];
+    const unitArms = [];
+    for (const write of writes) {
+        for (const arm of armsOf(write)) {
+            const seen = isUnitType(arm) ? unitArms : valueArms;
+            if (!seen.some((other) => typeEquals(other, arm)))
+                seen.push(arm);
+        }
+    }
+    const value = valueArms[0];
+    if (invalid || value === undefined || valueArms.length > 1)
         return null;
-    return reads.every((read) => {
+    const arms = [value];
+    if (unitArms.length > 0) {
+        // An evolving local reads as `undefined` before control flow proves a
+        // write, so the optional storage carries that arm as well.
+        arms.push(UNDEFINED_T);
+        for (const unit of unitArms) {
+            if (unit.kind !== "undefinedT")
+                arms.push(unit);
+        }
+    }
+    const storage = arms.length === 1 ? value : { kind: "union", unionId: lowerer.unions.intern(arms) };
+    // A narrowed read sees an arm, or a sub-union of arms, of the storage.
+    if (!reads.every((read) => {
         const mapped = lowerer.mapTypeOf(lowerer.typeOf(read));
-        return mapped !== null && typeEquals(mapped, first);
-    })
-        ? first
-        : null;
+        return (mapped !== null && armsOf(mapped).every((arm) => arms.some((own) => typeEquals(own, arm))));
+    }))
+        return null;
+    if (!captured)
+        return storage;
+    if (!DYN_HANDLE_KINDS.has(value.kind))
+        return null;
+    lowerer.closureDynLets.add(symbol);
+    // A nested function can read the binding before the outer assignment:
+    // the optional arm is what the checked-dynamic read of the closure sees.
+    return storage.kind === "union"
+        ? storage
+        : { kind: "union", unionId: lowerer.unions.intern([value, UNDEFINED_T]) };
+}
+/** Whether a call's resolved signature is declared in the standard library
+ * (`spawn(...)`), so its declared return type is the value's type. Calls of
+ * JavaScript functions, and implicit generic methods, infer theirs, and a
+ * `require(...)` result is a module rather than a value of its type. */
+function stdlibDeclaredCall(lowerer, call) {
+    if (implicitMethodCallInfersReturn(lowerer, call) || requireSpecOf(call) !== null)
+        return false;
+    const declaration = lowerer.checker.getResolvedSignature(call)?.declaration;
+    return declaration !== undefined && lowerer.isStdlibFile(ts.getSourceFileOfNode(declaration));
 }
 export function lowerVarDecl(lowerer, decl, isLet) {
     // --provenance-sources: an elided pure-annotated dead const emits
@@ -5001,6 +5244,10 @@ export function lowerVarDecl(lowerer, decl, isLet) {
     }
     if (!ts.isIdentifier(decl.name))
         lowerer.unsupported("SC1031", decl.name);
+    // A binding that holds `process.env` under any type but the env record
+    // is a snapshot copy whose reads would drift from Node's live table
+    // (refuseHeldEnvCopyHold); refuse it here, at the hold itself.
+    refuseHeldEnvCopyHold(lowerer, decl.name, decl);
     {
         const alias = lowerTupleAliasDecl(lowerer, decl);
         if (alias)
@@ -5136,11 +5383,11 @@ export function lowerVarDecl(lowerer, decl, isLet) {
     }
     // `const h = id` — an ALIAS of a generic function: the alias's symbol
     // registers the target's info (calls and pinned values resolve like
-    // the target's own name), the binding has no runtime value, and the
-    // statement emits nothing (collectGlobals skipped module-scope
-    // globals by the same test; block-scoped aliases register here).
+    // the target's own name) and the binding has no runtime value, so the
+    // statement emits nothing but the flag of a module-scope alias whose
+    // reads can run before it (genericAliasPresenceStore).
     if (bindingGenericFnAliasInfoOf(lowerer, decl))
-        return null;
+        return genericAliasPresenceStore(lowerer, decl);
     // `const stored = overloadedDeclaration`: no runtime slot is needed;
     // calls project onto the declaration's implementation ABI and value
     // reads reuse its interned closure identity.
@@ -5262,6 +5509,12 @@ export function lowerVarDecl(lowerer, decl, isLet) {
             raw.type.kind === "dyn" &&
             (g.type.kind === "record" ||
                 g.type.kind === "object" ||
+                // `const p = Promise.all.call(C, xs)` in JavaScript: the call runs
+                // the specification's algorithm with `C`'s capability and returns
+                // whatever `C` constructed, a foreign instance the checker still
+                // calls `Promise<T>`. The binding holds that value as dyn; a
+                // native-promise check would reject it (t262-db B3).
+                (g.type.kind === "promise" && isJsPromiseStaticCall(raw)) ||
                 (ts.isIdentifier(decl.name) &&
                     jsBindingKeepsCheckedObject(lowerer, decl.name, g.type) &&
                     (existingValueForm(decl.initializer) || jsHoldsDynObject(lowerer, decl.initializer)))))
@@ -5275,6 +5528,18 @@ export function lowerVarDecl(lowerer, decl, isLet) {
             g.type = raw.type;
             notePreservedLayout(lowerer, decl);
         }
+        // The same for a module const initialized by an assertion: the value's
+        // storage already answers the asserted view (narrowing.ts), so the
+        // module holds that layout and writes through it reach the object.
+        if (!isVarDeclared(decl) &&
+            (ts.getCombinedNodeFlags(decl) & ts.NodeFlags.Const) !== 0 &&
+            assertionKeepsStorageLayout(lowerer, decl, raw.type, g.type)) {
+            g.type = raw.type;
+            notePreservedLayout(lowerer, decl);
+        }
+        if (!isVarDeclared(decl) &&
+            keepsCheckedDynamicValue(lowerer, decl.initializer, raw.type, g.type))
+            g.type = raw.type;
         const arithmetic = raw.type.kind === "union" ? lowerer.unions.get(raw.type.unionId)?.arms : undefined;
         if (arithmetic?.length === 2 &&
             arithmetic.every((a) => a.kind === "f64" || a.kind === "string" || a.kind === "bool") &&
@@ -5287,6 +5552,7 @@ export function lowerVarDecl(lowerer, decl, isLet) {
             lowerer.runtimeOptionalArithmeticGlobals.add(g);
         }
         const init = lowerer.coerceInto(decl.initializer, raw, g.type);
+        refuseAssertionViewWrite(lowerer, decl);
         return {
             kind: "assign",
             localId: g.id,
@@ -5328,12 +5594,13 @@ export function lowerVarDecl(lowerer, decl, isLet) {
         // `let x: number;` — declared, uninitialized. tsc guarantees no read
         // before assignment (TS2454) and rejects uninitialized const (TS1155).
         // Unannotated `let x;` is an evolving `any` — the checked-dynamic
-        // binding fallback (irTypeOf → dynFallbackType).
+        // binding fallback (irTypeOf → dynFallbackType) unless its writes agree
+        // on a type.
         // Undefined-armed unions (`let x: string | undefined;`) are readable
         // immediately (the type covers the unassigned state), so they
         // initialize to the interned undefined arm like an omitted optional.
         let type = lowerer.irTypeOf(decl.name);
-        if (type.kind === "dyn" && isLet && isJsSourceFile(ts.getSourceFileOfNode(decl))) {
+        if (type.kind === "dyn" && isLet && decl.type === undefined) {
             type = inferredEvolvingLetType(lowerer, decl) ?? type;
         }
         // `var v: void;` / `let x: undefined;` — a unit-only binding rides
@@ -5444,6 +5711,19 @@ export function lowerVarDecl(lowerer, decl, isLet) {
         type = init.type;
         notePreservedLayout(lowerer, decl);
     }
+    // An index-signature binding whose assertion of an existing value lowered
+    // to that value (narrowing.ts keeps it instead of answering a copy whose
+    // keys live in a map of its own) keeps the value too: converting it here
+    // would take every write through the binding with it.
+    if (keepsCheckedDynamicValue(lowerer, decl.initializer, init.type, type))
+        type = init.type;
+    // A JavaScript binding assigned values outside its declared type
+    // (analyzeJsWidenedBindings in lowerer.ts) holds them as checked-dynamic.
+    {
+        const symbol = lowerer.resolveValueSymbol(decl.name);
+        if (symbol && lowerer.jsWidenedBindings.has(symbol))
+            type = DYN;
+    }
     // A typed-arguments function expression (typed-arguments.ts): the
     // checker types the binding variadic, but its value has the fixed
     // signature every use asserts.
@@ -5494,9 +5774,18 @@ export function lowerVarDecl(lowerer, decl, isLet) {
     const keepsAssertedObject = init.type.kind === "dyn" &&
         !decl.type &&
         keptIdentityAssertion(lowerer, decl.initializer) !== undefined;
+    // `const p = Promise.all.call(C, xs)` in JavaScript: the checked-dynamic
+    // promise-static call returns whatever `C` constructed — a foreign
+    // instance, not the `Promise<T>` the checker infers from the signature —
+    // so the binding holds it as dyn (t262-db B3).
+    const keepsPromiseStaticValue = isJsSourceFile(ts.getSourceFileOfNode(decl)) &&
+        !decl.type &&
+        !hasJsTypeAnnotation(decl) &&
+        isJsPromiseStaticCall(init);
     if (expandsObject ||
         preservesObjectIdentity ||
         keepsAssertedObject ||
+        keepsPromiseStaticValue ||
         (isJsSourceFile(ts.getSourceFileOfNode(decl)) &&
             !decl.type &&
             isNativeBuiltinValueInitializer(lowerer, decl.initializer))) {
@@ -5793,13 +6082,9 @@ export function lowerVarDecl(lowerer, decl, isLet) {
     // the stored type hosts (`const view: Route & { order: number } = ...`)
     // keeps it too: coercing into the annotated layout would copy the
     // value and read members the writes have not created yet.
-    if (!isLet &&
-        decl.initializer &&
-        isAssertionInitializer(decl.initializer) &&
-        (settledType.kind === "union" || settledType.kind === "record") &&
-        (init.type.kind === "union" || init.type.kind === "record") &&
-        hostsAll(lowerer, init.type, settledType)) {
+    if (!isLet && assertionKeepsStorageLayout(lowerer, decl, init.type, settledType)) {
         settledType = init.type;
+        notePreservedLayout(lowerer, decl);
     }
     // An exact class behind a generic interface keeps its native
     // representation so generic calls can specialize against its body.
@@ -5828,6 +6113,7 @@ export function lowerVarDecl(lowerer, decl, isLet) {
     // Slot coercion: `const r: A | B = bValue;` wraps implicitly; width
     // subtyping (`const p: {a: number} = wider;`) is rejected, not coerced.
     init = lowerer.coerceInto(decl.initializer, init, settledType);
+    refuseAssertionViewWrite(lowerer, decl);
     const local = lowerer.declareLocal(decl.name, decl.name.text, settledType, isLet);
     if (runtimeStringArithmetic && init.type.kind === "union") {
         lowerer.runtimeOptionalArithmeticLocals.add(lowerer.runtimeOptionalRootOf(local));
@@ -5877,6 +6163,17 @@ function inferredOptionalRecordType(lowerer, decl, declared, actual) {
         return declared;
     return actual;
 }
+/** Whether a lowered initializer is the checked-dynamic `Promise.<static>.call(C, …)`
+ * call (lower-calls.ts, JavaScript sources only). Its result is whatever `C`
+ * constructed, so a binding the checker typed `Promise<T>` holds it as dyn. */
+function isJsPromiseStaticCall(value) {
+    // Surplus arguments evaluate as statements before the call, so the
+    // initializer is a sequence expression whose result is the call.
+    let result = value;
+    while (result.kind === "seqExpr")
+        result = result.result;
+    return result.kind === "libCall" && result.fn === "promise.genericStatic";
+}
 function lowerVariableInitializer(lowerer, node, expected) {
     let value = node;
     while (ts.isParenthesizedExpression(value) ||
@@ -6129,10 +6426,14 @@ export function jsBindingHasOpenWrites(lowerer, decl) {
         return false;
     if (candidates.some((node) => (lowerer.typeOf(node.right).flags & (ts.TypeFlags.Any | ts.TypeFlags.Unknown)) !== 0))
         return true;
-    // A `+=` of a string turns a number or boolean binding into a string
-    // (`n += "px"`); the checker keeps the declared type.
+    // A `+=` of a string, or of a value that may be one, turns a number or
+    // boolean binding into a string (`n += "px"`); the checker keeps the
+    // declared type.
+    const mayBeString = (type) => type.flags & ts.TypeFlags.Union
+        ? constituentTypes(type).some(mayBeString)
+        : (type.flags & ts.TypeFlags.StringLike) !== 0;
     if (candidates.some((node) => node.operatorToken.kind === ts.SyntaxKind.PlusEqualsToken &&
-        (lowerer.typeOf(node.right).flags & ts.TypeFlags.StringLike) !== 0)) {
+        mayBeString(lowerer.typeOf(node.right)))) {
         const declared = lowerer.mapTypeOf(lowerer.typeOf(decl.name));
         if (declared?.kind === "f64" || declared?.kind === "bool")
             return true;
@@ -6163,6 +6464,11 @@ export function jsBindingHasOpenWrites(lowerer, decl) {
         return false;
     return differing.some((node) => {
         const written = lowerer.mapTypeOf(lowerer.typeOf(node.right));
+        // A union a primitive binding cannot hold (`x = c ? 1 : "a"` into
+        // `var x = 0`).
+        if (written?.kind === "union" &&
+            (declared.kind === "f64" || declared.kind === "bool" || declared.kind === "string"))
+            return true;
         return (written !== null &&
             written.kind !== "dyn" &&
             written.kind !== "union" &&
@@ -6480,10 +6786,15 @@ function lowerBranchSwitch(lowerer, stmt, disc, labels, compare) {
  *   === "string"/"number"/"boolean"`), reads under a proven narrow
  *   (caughtRead bridges them with caughtNarrow, verified at run time like
  *   unionNarrow), and rethrow (`throw e`). Unsupported raw uses and
- *   assignments are fenced (SC1063 and friends); destructuring patterns
- *   are SC1062. Captures retain the snapshot beyond the catch scope.
- *   The `: any` / `: unknown` annotations tsc admits both
- *   lower the same way (tsc narrows either through the tests).
+ *   assignments are fenced (SC1063 and friends). The `: any` /
+ *   `: unknown` annotations tsc admits both lower the same way (tsc
+ *   narrows either through the tests). Captures retain the snapshot
+ *   beyond the catch scope.
+ * - `catch ([a])` / `catch ({ p })` binds the thrown value through a
+ *   destructuring pattern: the exception cell keeps its hidden CAUGHT
+ *   local, and the pattern reads its checked-dynamic view
+ *   (caughtToDyn), so a JS catch parameter that destructures lowers the
+ *   way the same pattern does over an `any` source.
  * - `finally` runs on normal completion, exception paths, and every
  *   abrupt completion that crosses it. Return values are snapshotted
  *   before cleanup; an abrupt completion inside the finally replaces the
@@ -6496,9 +6807,6 @@ export function lowerTry(lowerer, stmt) {
     let catchLocalId = null;
     if (stmt.catchClause) {
         const vd = stmt.catchClause.variableDeclaration;
-        if (vd && !ts.isIdentifier(vd.name)) {
-            lowerer.unsupported("SC1062", vd);
-        }
         if (vd && ts.isIdentifier(vd.name)) {
             lowerer.scopes.push(new Map());
             try {
@@ -6511,7 +6819,59 @@ export function lowerTry(lowerer, stmt) {
             }
         }
         else {
-            catchBody = lowerer.lowerScopedBlock(stmt.catchClause.block);
+            lowerer.scopes.push(new Map());
+            try {
+                if (vd) {
+                    // `catch ([a])` / `catch ({ a })`: the thrown value crosses into
+                    // the checked-dynamic tree and the pattern binds through the same
+                    // per-read fences a dyn source takes — GetIterator for an array
+                    // pattern (positions past the end bind undefined, an iterator
+                    // with values left closes) and RequireObjectCoercible plus keyed
+                    // reads for an object pattern. The hidden CAUGHT local is the
+                    // exception cell every other catch path binds; the dyn conversion
+                    // is its identity-preserving view (caughtToDyn).
+                    const loc = locOf(vd);
+                    const local = lowerer.declareHiddenLocal("%caught", CAUGHT);
+                    catchLocalId = local.id;
+                    const tmp = lowerer.declareHiddenLocal("%destr", DYN);
+                    const out = [
+                        {
+                            kind: "varDecl",
+                            localId: tmp.id,
+                            init: { kind: "caughtToDyn", value: varRef(local.id, CAUGHT, loc), type: DYN, loc },
+                            loc,
+                        },
+                    ];
+                    // V8 spells the catch parameter's source '.catch' in the
+                    // RequireObjectCoercible TypeError ("Cannot destructure property
+                    // 'a' of '.catch' as it is null."), except when the first element
+                    // has a default: V8 reads that key first, so a nullish source
+                    // throws the read's TypeError, which the pattern's own first read
+                    // throws.
+                    if (ts.isObjectBindingPattern(vd.name) && !firstReadsWithDefault(vd.name))
+                        out.push({
+                            kind: "exprStmt",
+                            expr: {
+                                kind: "dynDestrCheck",
+                                value: varRef(tmp.id, DYN, loc),
+                                spelling: ".catch",
+                                ...firstPatternProp(lowerer, vd.name),
+                                type: DYN,
+                                loc,
+                            },
+                            loc,
+                        });
+                    lowerer.lowerBindingPattern(vd.name, () => varRef(tmp.id, DYN, loc), DYN, true, // catch bindings are mutable
+                    out);
+                    catchBody = [...out, ...lowerer.lowerScopedBlock(stmt.catchClause.block)];
+                }
+                else {
+                    catchBody = lowerer.lowerScopedBlock(stmt.catchClause.block);
+                }
+            }
+            finally {
+                lowerer.scopes.pop();
+            }
         }
     }
     const finallyBody = stmt.finallyBlock ? lowerer.lowerScopedBlock(stmt.finallyBlock) : null;
@@ -6524,13 +6884,67 @@ export function lowerTry(lowerer, stmt) {
         loc: locOf(stmt),
     };
 }
+/** The refusal for `delete` of an optional `unknown`/`any` field, whose
+ * slot is the checked-dynamic one and so has no ABSENT state to write. */
+const OPTIONAL_CHECKED_DYN_DELETE = "'delete' of optional 'unknown'/'any' fields (the checked-dynamic slot has no absent state yet — an omitted such field already reads as present)";
+/** TypeScript's declaration marks property `name` of `receiver` optional
+ * (`?:`), in every union constituent. A mapped IR type cannot tell an
+ * optional `unknown`/`any` field from a required one — both ride the
+ * checked-dynamic slot — so a refused `delete`'s real reason comes from
+ * the declaration. */
+function declaredOptionalProperty(lowerer, receiver, name) {
+    const receiverType = lowerer.typeOf(receiver);
+    const parts = receiverType.flags & ts.TypeFlags.Union ? constituentTypes(receiverType) : [receiverType];
+    return parts.every((part) => {
+        const property = lowerer.checker.getPropertyOfType(part, name);
+        return property !== undefined && (property.flags & ts.SymbolFlags.Optional) !== 0;
+    });
+}
+/** `type` — a record or a union whose every arm is a non-tuple record —
+ * declares `name` in the checked-dynamic slot, which has no ABSENT state:
+ * an optional such field cannot be removed by a `delete`. */
+function declaresCheckedDynField(lowerer, type, name) {
+    if (type.kind === "record") {
+        const shape = lowerer.shapes.get(type.shapeId);
+        if (!shape || shape.tuple)
+            return false;
+        return shape.fields.find((f) => f.name === name)?.type.kind === "dyn";
+    }
+    if (type.kind !== "union")
+        return false;
+    const arms = lowerer.unions.get(type.unionId)?.arms ?? [];
+    return arms.length > 0 && arms.every((arm) => declaresCheckedDynField(lowerer, arm, name));
+}
+/** The constant property key of a `delete` target: the name of a dot
+ * access, or the one key of a bracket access spelled as a literal or
+ * proved by a literal-typed binding (`const key = "a"`). A key of several
+ * literals folds to nothing — deleting it would need per-key dispatch, so
+ * the record branch refuses and names the keys. Consistent with keyed
+ * record reads/writes (literalFieldKeys), the key expression is not
+ * evaluated: only a literal or an identifier folds, and an identifier
+ * read is pure. */
+function constantDeleteKey(lowerer, target) {
+    if (ts.isPropertyAccessExpression(target))
+        return target.name.text;
+    if (!ts.isElementAccessExpression(target))
+        return null;
+    const keyNode = target.argumentExpression;
+    if (ts.isStringLiteralLike(keyNode))
+        return keyNode.text;
+    if (!ts.isIdentifier(keyNode))
+        return null;
+    const keys = literalFieldKeys(lowerer, keyNode);
+    return keys?.length === 1 ? keys[0] : null;
+}
 /** Statement-position `delete`: process.env keys → process.envUnset
  * (unsetenv), pure `Record<string, T>` keys → recordKeyDelete (the
  * overflow Map delete), declared OPTIONAL fields → the field's ABSENT
  * state (the slot reads undefined and no longer counts as an own
  * property). Everything else
- * fences with the honest reason — a required field is a struct slot no
- * runtime can remove. */
+ * fences with the honest reason — a required record field is a struct slot
+ * with no ABSENT state, a class field is part of the instance's fixed
+ * layout, and an optional `unknown`/`any` field maps to the
+ * checked-dynamic slot, which has no ABSENT state yet. */
 function lowerDeleteStatement(lowerer, expr) {
     const loc = locOf(expr);
     let target = expr.expression;
@@ -6539,6 +6953,9 @@ function lowerDeleteStatement(lowerer, expr) {
     if (!ts.isElementAccessExpression(target) && !ts.isPropertyAccessExpression(target)) {
         lowerer.unsupported("SC1090", expr, "'delete' of non-property expressions");
     }
+    // Deleting a member of `Date.prototype` is a write through the read-only
+    // prototype value (property-access.ts's fence).
+    fenceDatePrototypeWrite(lowerer, target);
     fenceNodeModuleMutation(lowerer, target, "delete");
     if (ts.isPropertyAccessExpression(target) && target.name.text === "cause") {
         const field = lowerer.fieldTarget(target);
@@ -6564,7 +6981,8 @@ function lowerDeleteStatement(lowerer, expr) {
             return { kind: "strLit", value: target.name.text, type: STRING, loc: locOf(target.name) };
         }
         const keyNode = target.argumentExpression;
-        let key = lowerer.isProcessEnv(target.expression)
+        let key = lowerer.isProcessEnv(target.expression) ||
+            heldEnvValueType(lowerer, target.expression) !== null
             ? lowerEnvironmentKey(lowerer, keyNode)
             : lowerer.lowerExpr(keyNode);
         if (key.type.kind === "dyn") {
@@ -6578,7 +6996,8 @@ function lowerDeleteStatement(lowerer, expr) {
         }
         return key;
     };
-    if (lowerer.isProcessEnv(target.expression)) {
+    if (lowerer.isProcessEnv(target.expression) ||
+        heldEnvValueType(lowerer, target.expression) !== null) {
         return {
             kind: "exprStmt",
             expr: { kind: "libCall", fn: "process.envUnset", args: [lowerKey()], type: VOID, loc },
@@ -6595,6 +7014,18 @@ function lowerDeleteStatement(lowerer, expr) {
             return unionDelete;
     }
     let obj = lowerer.lowerExpr(target.expression);
+    // A PRIMITIVE receiver: `delete` runs ToObject on the base AFTER the key,
+    // and the base's type decides the answer — null and undefined throw
+    // Node's TypeError, `?.` on a nullish base short-circuits to `true`
+    // without evaluating the key, and every other primitive deletes from its
+    // ToObject wrapper (a String's indexes and `length` refuse the delete).
+    if (isPrimitiveValueType(obj.type) && !isBuiltinIdentityToken(lowerer, target.expression, obj)) {
+        return {
+            kind: "exprStmt",
+            expr: lowerPrimitiveBaseDelete(lowerer, expr, target, obj, VOID),
+            loc,
+        };
+    }
     // `delete this.stack` in an Error subclass that declares a `stack`
     // accessor (quickjs-wasi's JSException): V8 gives each error an own
     // `stack` that shadows the accessor, and the delete removes it so reads
@@ -6670,6 +7101,19 @@ function lowerDeleteStatement(lowerer, expr) {
             loc,
         };
     }
+    // The constant property key of the target: dot access, a literal
+    // bracket, or an element access whose key is a literal-typed binding
+    // (`const key = "a"; delete r[key]`) — the same stance a keyed record
+    // read/write takes (literalFieldKeys): identifier evaluation is pure, so
+    // skipping it matches JavaScript.
+    const constantKey = constantDeleteKey(lowerer, target);
+    // An OPTIONAL `unknown`/`any` field rides the checked-dynamic slot,
+    // which has no ABSENT state yet (an omitted such field already reads as
+    // present), so it cannot delete. Name that reason instead of calling
+    // the field required or blaming the receiver.
+    const optionalCheckedDynDelete = constantKey !== null &&
+        declaresCheckedDynField(lowerer, obj.type, constantKey) &&
+        declaredOptionalProperty(lowerer, target.expression, constantKey);
     if (obj.type.kind === "record") {
         const shape = lowerer.shapes.get(obj.type.shapeId);
         if (shape?.indexValue && shape.fields.length === 0 && !shape.tuple) {
@@ -6682,13 +7126,8 @@ function lowerDeleteStatement(lowerer, expr) {
         // while a later write makes it present again. Constant keys only
         // (dot access or a literal bracket); required fields keep the honest
         // fence below.
-        const fieldName = ts.isPropertyAccessExpression(target)
-            ? target.name.text
-            : ts.isStringLiteral(target.argumentExpression)
-                ? target.argumentExpression.text
-                : null;
-        const field = fieldName !== null && !shape?.tuple
-            ? shape?.fields.find((f) => f.name === fieldName)
+        const field = constantKey !== null && !shape?.tuple
+            ? shape?.fields.find((f) => f.name === constantKey)
             : undefined;
         if (field) {
             const absent = lowerer.absentFieldValue(field.type, loc);
@@ -6706,9 +7145,32 @@ function lowerDeleteStatement(lowerer, expr) {
         if (shape?.indexValue) {
             lowerer.unsupported("SC1090", expr, "'delete' of hybrid index-signature keys (declared struct slots and overflow entries answer differently — model deletable dynamic keys with a pure Record<string, T>)");
         }
-        lowerer.unsupported("SC1090", expr, "'delete' of required record fields (a monomorphic shape cannot remove its slot — only optional fields delete, becoming the undefined arm)");
+        if (optionalCheckedDynDelete) {
+            lowerer.unsupported("SC1090", expr, OPTIONAL_CHECKED_DYN_DELETE);
+        }
+        // A key of SEVERAL literals names no single slot: say that instead of
+        // blaming a field the caller never named.
+        const keyNames = constantKey === null && ts.isElementAccessExpression(target)
+            ? literalFieldKeys(lowerer, target.argumentExpression)
+            : null;
+        if (keyNames !== null && keyNames.length > 1) {
+            lowerer.unsupported("SC1090", expr, `'delete' through keys of ${keyNames.length} literals (${keyNames.map((k) => `'${k}'`).join(", ")}; delete one constant key at a time, or switch over the key)`);
+        }
+        lowerer.unsupported("SC1090", expr, "'delete' of required record fields (the shape's slot cannot be removed — only an optional field (`f?: T`) has an absent state, which Object.keys, 'in', and JSON.stringify follow; make the field optional if the program must remove it)");
+    }
+    if (optionalCheckedDynDelete) {
+        lowerer.unsupported("SC1090", expr, OPTIONAL_CHECKED_DYN_DELETE);
+    }
+    // A class field lives in the instance's fixed layout: there is no
+    // per-field presence state for a delete to write, so Object.keys,
+    // `in`, and JSON.stringify would keep reporting the field where Node
+    // drops it. Name that reason instead of the generic receiver fence.
+    if (obj.type.kind === "object" &&
+        constantKey !== null &&
+        lowerer.classes.get(obj.type.className)?.fields.has(constantKey)) {
+        lowerer.unsupported("SC1090", expr, "'delete' of class fields (an instance's fields are its fixed layout — there is no per-field presence state, so Object.keys, 'in', and JSON.stringify would still report a deleted field; only optional record fields (`f?: T`) and Record<string, T> keys delete)");
     }
-    lowerer.unsupported("SC1090", expr, `'delete' on '${lowerer.fmt(obj.type)}' receivers (process.env keys and pure Record<string, T> keys delete)`);
+    lowerer.unsupported("SC1090", expr, `'delete' on '${lowerer.fmt(obj.type)}' receivers (process.env keys, pure Record<string, T> keys, and optional record fields delete)`);
 }
 /** True when the `var`/`let` binding `nameNode` names cannot change after
  * the top-level CommonJS export statement `exportNode` that exports it by
@@ -7384,6 +7846,13 @@ export function lowerExprStatement(lowerer, expr) {
                 return { kind: "exprStmt", expr: urlWrite, loc: locOf(expr) };
         }
         if (opKind === ts.SyntaxKind.EqualsToken) {
+            // A write through `Date.prototype` or one of its members keeps its
+            // fence: the prototype value is a read surface (property-access.ts).
+            if (ts.isPropertyAccessExpression(expr.left) || ts.isElementAccessExpression(expr.left))
+                fenceDatePrototypeWrite(lowerer, expr.left);
+            const staticPrivateWrite = lowerStaticPrivateAssignment(lowerer, expr);
+            if (staticPrivateWrite)
+                return { kind: "exprStmt", expr: staticPrivateWrite, loc: locOf(expr) };
             const callableWrite = lowerNativeFunctionAssignment(lowerer, expr);
             if (callableWrite)
                 return { kind: "exprStmt", expr: callableWrite, loc: locOf(expr) };
@@ -7431,7 +7900,12 @@ export function lowerExprStatement(lowerer, expr) {
                 // (Node stringifies everything; a non-string RHS fences instead
                 // of diverging from Node). The computed-key form lands in
                 // lowerElementWrite.
-                if (lowerer.isProcessEnv(expr.left.expression) && !expr.left.questionDotToken) {
+                // The same setenv for a value HELD from process.env (`const env =
+                // process.env; env.X = v`): the hold aliases the live table, as
+                // Node's does.
+                if (!expr.left.questionDotToken &&
+                    (lowerer.isProcessEnv(expr.left.expression) ||
+                        heldEnvValueType(lowerer, expr.left.expression) !== null)) {
                     const loc = locOf(expr);
                     const key = {
                         kind: "strLit",
@@ -7901,6 +8375,39 @@ export function lowerExprStatement(lowerer, expr) {
                     };
                 }
             }
+            // process.stdout.write = fn (and stderr): replace the stream object's
+            // write slot. Every later write to the stream — console output, typed
+            // write calls (programPatchesStdio), runtime writers — goes through it.
+            if (ts.isPropertyAccessExpression(expr.left) && expr.left.name.text === "write") {
+                const recv = expr.left.expression;
+                const stream = ts.isPropertyAccessExpression(recv)
+                    ? lowerer.stdlibGlobalMember(recv, "process")
+                    : null;
+                if (stream === "stdout" || stream === "stderr") {
+                    const loc = locOf(expr);
+                    return {
+                        kind: "exprStmt",
+                        expr: {
+                            kind: "libCall",
+                            fn: "dyn.keySet",
+                            args: [
+                                {
+                                    kind: "libCall",
+                                    fn: "process.stdioSlot",
+                                    args: [numLit(stream === "stdout" ? 1 : 2, loc)],
+                                    type: DYN,
+                                    loc,
+                                },
+                                strLit("write", locOf(expr.left.name)),
+                                lowerer.lowerExprExpecting(expr.right, DYN),
+                            ],
+                            type: VOID,
+                            loc,
+                        },
+                        loc,
+                    };
+                }
+            }
             if (!ts.isIdentifier(expr.left)) {
                 lowerer.unsupported("SC1090", expr.left, "assignment to non-variables");
             }
@@ -7933,6 +8440,8 @@ export function lowerExprStatement(lowerer, expr) {
         const compound = COMPOUND_ASSIGN_OPS[opKind];
         if (compound !== undefined) {
             // Desugar `x op= e` to `x = x op e` — reads x before e, like JS.
+            if (ts.isPropertyAccessExpression(expr.left) || ts.isElementAccessExpression(expr.left))
+                fenceDatePrototypeWrite(lowerer, expr.left);
             if (ts.isElementAccessExpression(expr.left)) {
                 // `this[kLimit] += v` — a declared symbol-keyed class field is
                 // the dotted compound in element spelling. Array and byte-view
@@ -7974,6 +8483,7 @@ export function lowerExprStatement(lowerer, expr) {
         (expr.operator === ts.SyntaxKind.PlusPlusToken ||
             expr.operator === ts.SyntaxKind.MinusMinusToken)) {
         if (ts.isPropertyAccessExpression(expr.operand) || ts.isElementAccessExpression(expr.operand)) {
+            fenceDatePrototypeWrite(lowerer, expr.operand);
             // Statement and value positions share ToNumeric and reference order.
             // Namespace/expando globals retain their direct binding path below.
             const binding = ts.isPropertyAccessExpression(expr.operand)
@@ -8193,6 +8703,45 @@ export function lowerDestructuringAssign(lowerer, target, init, blame, loc) {
     const parts = destructuringAssignInto(lowerer, target, init, null, blame, loc);
     return { kind: "block", body: parts.stmts, loc };
 }
+/** An object pattern whose first element has a default and a static key
+ * (`{ a = 1 }`, `{ a: b = 1 }`): V8 reads that key without checking the
+ * source first, so a null or undefined source throws the read's TypeError. */
+function firstReadsWithDefault(pattern) {
+    const first = pattern.elements.nodes[0];
+    return (first !== undefined &&
+        first.dotDotDotToken === undefined &&
+        first.initializer !== undefined &&
+        !(first.propertyName !== undefined && ts.isComputedPropertyName(first.propertyName)));
+}
+/** The read of the first key of a pattern that `firstReadsWithDefault`
+ * accepts, over a dyn source: on null or undefined it throws the read's
+ * TypeError, as V8 does. Null when the key has no static name. */
+function firstKeyRead(lowerer, pattern, source, loc) {
+    const { firstProp } = firstPatternProp(lowerer, pattern);
+    if (firstProp === undefined)
+        return null;
+    return {
+        kind: "dynKeyGet",
+        key: { kind: "strLit", value: firstProp, type: STRING, loc },
+        value: source(),
+        type: DYN,
+        loc,
+    };
+}
+/** The first property V8 names in an object pattern's destructuring
+ * TypeError ("Cannot destructure property 'a' of ..."): an identifier,
+ * string or numeric first key. A computed first key, a rest element or
+ * an empty pattern takes the bare (source-only) form. */
+function firstPatternProp(lowerer, pattern) {
+    const first = pattern.elements.nodes[0];
+    const firstKey = first === undefined || first.dotDotDotToken !== undefined
+        ? undefined
+        : (first.propertyName ?? first.name);
+    const firstProp = firstKey === undefined || ts.isComputedPropertyName(firstKey)
+        ? undefined
+        : (patternKeyNameOf(lowerer, firstKey) ?? undefined);
+    return firstProp !== undefined ? { firstProp } : {};
+}
 /** V8's spelling of a destructuring RHS in its TypeError message
  * ("Cannot destructure 'a' as it is undefined.") — plain identifiers
  * spell their name (parens unwrap), `this`, property chains and
@@ -8341,8 +8890,8 @@ function destructuringAssignInto(lowerer, target, init, rhs, blame, loc) {
             ts.isBinaryExpression(rhsInner) &&
             rhsInner.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
             (ts.isObjectLiteralExpression(rhsInner.left) || ts.isArrayLiteralExpression(rhsInner.left));
-        if (!checkedByInner) {
-            const spelling = rhs === null ? null : destrSpellingOf(rhs);
+        if (!checkedByInner && rhs !== null) {
+            const spelling = destrSpellingOf(rhs);
             if (spelling === null) {
                 lowerer.unsupported("SC1031", blame, "destructuring assignment from a checked-dynamic source whose expression spelling is unsupported (use a variable, ordinary property chain, or ordinary call)");
             }
@@ -8373,20 +8922,57 @@ function destructuringAssignInto(lowerer, target, init, rhs, blame, loc) {
         }
         for (const prop of target.properties.nodes) {
             const piece = destructAssignPiece(lowerer, prop);
-            const read = {
+            const propLoc = locOf(prop);
+            let read = {
                 kind: "dynKeyGet",
-                key: { kind: "strLit", value: piece.field, type: STRING, loc: locOf(prop) },
+                key: { kind: "strLit", value: piece.field, type: STRING, loc: propLoc },
                 value: tmpRef(),
                 type: DYN,
-                loc: locOf(prop),
+                loc: propLoc,
             };
+            if (piece.dflt !== undefined) {
+                // `{ x = 1 }` / `{ x: y = 1 }`: the default fires on the undefined
+                // read and is evaluated lazily, exactly the declaration path's
+                // checked-dynamic default.
+                const readTmp = lowerer.declareHiddenLocal("%destr", DYN);
+                out.push({ kind: "varDecl", localId: readTmp.id, init: read, loc: propLoc });
+                const readRef = { kind: "varRef", localId: readTmp.id, type: DYN, loc: propLoc };
+                read = {
+                    kind: "ternary",
+                    cond: { kind: "dynTest", test: "undefined", value: readRef, type: BOOL, loc: propLoc },
+                    then: lowerer.coerceInto(piece.dflt, lowerer.lowerExpr(piece.dflt), DYN),
+                    else_: readRef,
+                    type: DYN,
+                    loc: propLoc,
+                };
+            }
             out.push({
                 kind: "assign",
                 localId: piece.target.id,
                 value: lowerer.coerceInto(prop, read, piece.target.type),
-                loc: locOf(prop),
+                loc: propLoc,
             });
         }
+        if (rhs === null && target.properties.nodes.length === 0) {
+            // A pattern with no reads still owes the source's own coercion, and a
+            // PRE-LOWERED source (`for ({} of …)`) has no source text: V8 reads
+            // the value instead of spelling it ("Cannot read properties of null").
+            for (const unit of ["null", "undefined"]) {
+                out.push({
+                    kind: "if",
+                    cond: { kind: "dynTest", test: unit, value: tmpRef(), type: BOOL, loc },
+                    then: [
+                        {
+                            kind: "exprStmt",
+                            expr: nodeThrowExpr(1, "", `Cannot read properties of ${unit}`, VOID, loc),
+                            loc,
+                        },
+                    ],
+                    else_: null,
+                    loc,
+                });
+            }
+        }
         return { stmts: out, value };
     }
     if (target.properties.nodes.length === 0) {
@@ -8860,10 +9446,11 @@ function lowerAssignTargetInto(lowerer, out, targetNode, blame, dflt, valueOf) {
 function destructAssignPiece(lowerer, prop) {
     let fieldName;
     let bindTo;
+    let dflt;
     if (ts.isShorthandPropertyAssignment(prop)) {
-        if (prop.objectAssignmentInitializer) {
-            lowerer.unsupported("SC1031", prop, "destructuring assignment with defaults (assign, then apply the default)");
-        }
+        // `{ x = 1 }`: the shorthand's default (the checker's name resolution
+        // still answers the outer binding through the shorthand).
+        dflt = prop.objectAssignmentInitializer;
         fieldName = prop.name.text;
         bindTo = prop.name;
     }
@@ -8874,7 +9461,12 @@ function destructAssignPiece(lowerer, prop) {
             lowerer.unsupported("SC1031", prop, "destructuring assignment with computed keys that do not fold to one property name");
         }
         fieldName = folded ?? "";
+        // `{ x: y = 1 }`: a defaulted target, the AssignmentPattern spelling.
         bindTo = prop.initializer;
+        if (ts.isBinaryExpression(bindTo) && bindTo.operatorToken.kind === ts.SyntaxKind.EqualsToken) {
+            dflt = bindTo.right;
+            bindTo = bindTo.left;
+        }
     }
     else {
         lowerer.unsupported("SC1031", prop, "destructuring assignment with rest or spread properties");
@@ -8895,7 +9487,7 @@ function destructAssignPiece(lowerer, prop) {
     if (!target) {
         lowerer.rejectUnresolved(bindTo, `assignment to '${bindTo.text}' (not a writable local or module global)`);
     }
-    return { field: fieldName, target };
+    return { field: fieldName, target, ...(dflt !== undefined ? { dflt } : {}) };
 }
 /** The ARRAY half of destructuring assignment: element assigns from a
  * tuple/array/checked-dynamic source pushed into `out` (see
@@ -9238,7 +9830,12 @@ export function lowerForOf(lowerer, stmt) {
     }
     const awaitArray = !!stmt.awaitModifier && lowerer.mapTypeOf(lowerer.typeOf(stmt.expression))?.kind === "array";
     if (stmt.awaitModifier && !awaitArray) {
-        {
+        // A web ReadableStream's and a Node readable's iterator views both type
+        // as AsyncIterableIterator, which lowers like the async protocols — but
+        // the loop consumes each view through its own lowering
+        // (lowerForAwaitBuiltin below).
+        if (!isWebReadableIteratorSource(lowerer, stmt.expression) &&
+            !isNodeReadableIteratorSource(lowerer, stmt.expression)) {
             const genT = lowerer.stageSourceType(stmt.expression) ??
                 lowerer.mapTypeOf(lowerer.typeOf(stmt.expression));
             if (genT?.kind === "generator" && genT.async) {
@@ -11174,7 +11771,55 @@ function lowerForIn(lowerer, stmt) {
             receiver = lowerer.coerceToExpected(receiver, DYN);
         }
     }
+    return lowerForInReceiver(lowerer, stmt, labels, receiver);
+}
+/** for-in over the lowered `receiver` of `stmt`. */
+function lowerForInReceiver(lowerer, stmt, labels, receiver) {
+    const loc = locOf(stmt);
     const recvT = receiver.type;
+    // A receiver that may be null or undefined: for-in visits nothing for
+    // either, and walks a present value as its own type. The receiver is
+    // evaluated once.
+    if (recvT.kind === "union") {
+        const arms = lowerer.unions.get(recvT.unionId)?.arms ?? [];
+        const present = arms.filter((arm) => arm.kind !== "undefinedT" && arm.kind !== "nullT");
+        if (present.length === 1 && present.length < arms.length) {
+            const arm = present[0];
+            const tag = lowerer.armTag(recvT.unionId, arm);
+            const recv = lowerer.declareHiddenLocal("%innullable", recvT);
+            const ref = varRef(recv.id, recvT, loc);
+            const narrowed = {
+                kind: "unionNarrow",
+                unionId: recvT.unionId,
+                tag,
+                value: ref,
+                type: arm,
+                loc,
+            };
+            return {
+                kind: "block",
+                body: [
+                    { kind: "varDecl", localId: recv.id, init: receiver, loc },
+                    {
+                        kind: "if",
+                        cond: {
+                            kind: "unionIsTag",
+                            unionId: recvT.unionId,
+                            tag,
+                            negated: false,
+                            value: ref,
+                            type: BOOL,
+                            loc,
+                        },
+                        then: [lowerForInReceiver(lowerer, stmt, labels, narrowed)],
+                        else_: null,
+                        loc,
+                    },
+                ],
+                loc,
+            };
+        }
+    }
     if (recvT.kind === "dyn") {
         const recv = lowerer.declareHiddenLocal("%indyn", DYN);
         const ref = { kind: "varRef", localId: recv.id, type: DYN, loc };
@@ -11845,4 +12490,54 @@ function isAssertionInitializer(node) {
         e = e.expression;
     return ts.isAsExpression(e) || ts.isTypeAssertion(e);
 }
+/** `const view = route as Route & { order: number }`: the asserted type
+ * refines the record arms the value is stored in (hosted-narrowing.ts), and
+ * a projection (`{ text: string }` over `TextBlock`) only names members the
+ * stored record already holds. Either way Node erases the assertion and
+ * keeps the object, so the binding keeps the value's layout and its writes
+ * reach that object instead of a copy. */
+function assertionKeepsStorageLayout(lowerer, decl, init, settled) {
+    if (decl.initializer === undefined || !isAssertionInitializer(decl.initializer))
+        return false;
+    if (settled.kind !== "union" && settled.kind !== "record")
+        return false;
+    if (init.kind !== "union" && init.kind !== "record")
+        return false;
+    if (hostsAll(lowerer, init, settled))
+        return true;
+    // A projection (`{ text: string }` over `TextBlock`) keeps the stored
+    // record only when the binding's identity is observable through it
+    // (a write, an identity comparison). A read-only view is equal either
+    // way, keeps the copy narrowing.ts made, and stays reported.
+    if (!bindingIdentityUse(decl, lowerer.checker))
+        return false;
+    return (init.kind === "record" &&
+        settled.kind === "record" &&
+        recordViewHosted(lowerer, init.shapeId, settled.shapeId));
+}
+/** `const v = x as { a: number; extra?: string }; v.extra = "x"`: the
+ * assertion's view names a member the value's own layout does not, so the
+ * binding receives a COPY of `x` and the write lands on that copy — Node
+ * erases the assertion and adds the property to `x` itself, so the write
+ * must reach a caller-visible object. Reads of a copy are equal either
+ * way, and so is a nested write through a member the copy shares (the same
+ * child object in both), so only a write to the copy's own field is
+ * refused, by name. Where the layouts agree the binding keeps the value's
+ * storage instead (assertionKeepsStorageLayout), narrowing.ts and
+ * lowerVarDecl record that in layoutKeptNodes, and nothing here fires.
+ * Runs for file-scope and local bindings alike, after the declaration has
+ * been lowered (so the keep is known). */
+function refuseAssertionViewWrite(lowerer, decl) {
+    if (decl.initializer === undefined || !isAssertionInitializer(decl.initializer))
+        return;
+    if (lowerer.layoutKeptNodes.has(decl.initializer))
+        return;
+    const copy = assertionViewCopy(lowerer, decl.initializer);
+    if (copy === null)
+        return;
+    const write = bindingWrite(lowerer, decl);
+    if (write === null)
+        return;
+    lowerer.unsupported("SC1090", decl, `writing '${write.text}' through '${decl.name.getText()}', a copy of the '${copy.source}' value the assertion views as '${copy.target}' (the write would land on the copy; write through the original binding, or declare the member on the value's type)`);
+}
 //# sourceMappingURL=lower-stmts.js.map