diff --git a/packages/compiler/src/backend/llvm/expr-primitives.ts b/packages/compiler/src/backend/llvm/expr-primitives.ts
index 4e7d418f84..4cb8437f39 100644
--- a/packages/compiler/src/backend/llvm/expr-primitives.ts
+++ b/packages/compiler/src/backend/llvm/expr-primitives.ts
@@ -379,7 +379,29 @@ export function emitOperatorExpr(
         const fn = libm[e.op];
         if (fn === undefined) throw new LlvmUnsupportedError(`bin:${e.op}`, e.loc);
         host.declare(`declare double @${fn}(double, double)`);
-        B.line(`${t} = call double @${fn}(double ${l.name}, double ${r.name})`);
+        // libm's pow answers 1 for pow(±1, ±Infinity) and pow(1, NaN), where
+        // `**` answers NaN (and LLVM folds pow(1.0, x) to 1.0): an inline
+        // guard selects NaN for a base of ±1 with a non-finite exponent and
+        // keeps the direct pow call. A finite literal exponent, or a literal
+        // base other than ±1, cannot meet those cases and needs no guard.
+        if (fn === "pow" && !libmPowAgrees(e.left, e.right)) {
+          host.declare(`declare double @llvm.fabs.f64(double)`);
+          const power = B.tmp();
+          B.line(`${power} = call double @pow(double ${l.name}, double ${r.name})`);
+          const base = B.tmp();
+          const unit = B.tmp();
+          const magnitude = B.tmp();
+          const finite = B.tmp();
+          const reject = B.tmp();
+          B.line(`${base} = call double @llvm.fabs.f64(double ${l.name})`);
+          B.line(`${unit} = fcmp oeq double ${base}, 1.0`);
+          B.line(`${magnitude} = call double @llvm.fabs.f64(double ${r.name})`);
+          B.line(`${finite} = fcmp olt double ${magnitude}, 0x7FF0000000000000`);
+          B.line(`${reject} = select i1 ${finite}, i1 false, i1 ${unit}`);
+          B.line(`${t} = select i1 ${reject}, double 0x7FF8000000000000, double ${power}`);
+        } else {
+          B.line(`${t} = call double @${fn}(double ${l.name}, double ${r.name})`);
+        }
       }
       return { name: t, type: e.type };
     }
@@ -1106,3 +1128,19 @@ export function emitRecordLitFields(
     host.initField(ptr, type, inline, v);
   }
 }
+
+/** Whether libm pow matches `**` for these operands: every case except a
+ * base of ±1 with a NaN or infinite exponent agrees. */
+function libmPowAgrees(base: IrExpr, exponent: IrExpr): boolean {
+  const power = numericLiteral(exponent);
+  if (power !== null && Number.isFinite(power)) return true;
+  const value = numericLiteral(base);
+  return value !== null && !Number.isNaN(value) && Math.abs(value) !== 1;
+}
+
+function numericLiteral(expr: IrExpr): number | null {
+  if (expr.kind === "numLit") return expr.value;
+  if (expr.kind === "unary" && expr.op === "-" && expr.operand.kind === "numLit")
+    return -expr.operand.value;
+  return null;
+}
diff --git a/packages/compiler/src/frontend/lowering/builtin-function-fences.ts b/packages/compiler/src/frontend/lowering/builtin-function-fences.ts
new file mode 100644
index 0000000000..e6221384b8
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/builtin-function-fences.ts
@@ -0,0 +1,52 @@
+/** A builtin module function used as a JavaScript value when it has no
+ * value adapter (lowerNativeCallableValue). Node hands the program a real
+ * function; the compiled value is one function per builtin that throws the
+ * named fence when called. Identity flows (`fn === fs.readFileSync`, Set
+ * membership) still hold, `typeof` answers "function" and inspection
+ * prints `[Function: name]`, where a string token would answer "string"
+ * and turn a call into an ordinary "is not a function" TypeError. */
+import * as ts from "../ts7/adapter.js";
+import { DYN, type IrExpr, type SrcLoc, funcOf } from "../../ir/ir.js";
+import { unsupportedDiag } from "../../diagnostics/diagnostic.js";
+import type { Lowerer } from "./lowerer.js";
+
+export function builtinFunctionFenceValue(
+  lowerer: Lowerer,
+  bi: { module: string; member: string },
+  node: ts.Identifier,
+  loc: SrcLoc,
+): IrExpr {
+  const display = `${bi.module}.${bi.member}`;
+  const name = `%builtin.fence.${display}`;
+  if (!lowerer.liftedFns.some((fn) => fn.name === name)) {
+    const diag = unsupportedDiag(
+      "SC1090",
+      loc,
+      `library functions as values ('${display}' has no function-value lowering; call it directly)`,
+    );
+    lowerer.runtimeFences.push(diag);
+    const line = ts.getLineAndCharacterOfPosition(node.getSourceFile(), loc.start).line + 1;
+    lowerer.liftedFns.push({
+      name,
+      params: [],
+      locals: [],
+      returnType: DYN,
+      body: [
+        {
+          kind: "runtimeFence",
+          code: diag.code,
+          message: `${diag.message} [${diag.code} at ${loc.file}:${line}]`,
+          loc,
+        },
+      ],
+      loc,
+    });
+  }
+  return {
+    kind: "dynFrom",
+    value: { kind: "closure", fnName: name, captures: [], type: funcOf([], DYN), loc },
+    fnName: bi.member,
+    type: DYN,
+    loc,
+  };
+}
diff --git a/packages/compiler/src/frontend/lowering/class-construction.ts b/packages/compiler/src/frontend/lowering/class-construction.ts
index 4dae7ecd09..7f4a003c9f 100644
--- a/packages/compiler/src/frontend/lowering/class-construction.ts
+++ b/packages/compiler/src/frontend/lowering/class-construction.ts
@@ -1,4 +1,5 @@
 import { dynUndefinedExpr, varRef } from "../../ir/build.js";
+import { constructedValue } from "./constructor-returns.js";
 import {
   BOOL,
   DYN,
@@ -389,13 +390,13 @@ export class ClassConstructionDispatch {
         if (!args) continue;
         const type: IrType = { kind: "classval", className: name };
         const callee = varRef("p.0", DYN, loc);
-        const value: IrExpr = {
+        const value = constructedValue(lowerer, info, {
           kind: "newValue",
           callee: { kind: "dynCheck", value: callee, type, loc },
           args,
           type: { kind: "object", className: name },
           loc,
-        };
+        });
         const body: IrStmt[] = [
           { kind: "return", value: lowerer.coerceToExpected(value, DYN), loc },
         ];
diff --git a/packages/compiler/src/frontend/lowering/class-dynamic-dispatch.ts b/packages/compiler/src/frontend/lowering/class-dynamic-dispatch.ts
index a0ed496e1e..f789218bfe 100644
--- a/packages/compiler/src/frontend/lowering/class-dynamic-dispatch.ts
+++ b/packages/compiler/src/frontend/lowering/class-dynamic-dispatch.ts
@@ -1,4 +1,5 @@
 import { dynUndefinedExpr, helperLoc, nodeThrowExpr, varRef } from "../../ir/build.js";
+import { constructedValue } from "./constructor-returns.js";
 import { eventTargetApiMembers, eventTargetInheritedMember } from "./lower-event-target.js";
 import {
   BOOL,
@@ -3164,13 +3165,13 @@ export class ClassDynamicDispatch {
         }
         if (!supported || !info.decl) continue;
         const cls = classValueRef(lowerer, info, info.decl);
-        const result: IrExpr = {
+        const result = constructedValue(lowerer, info, {
           kind: "new",
           className: name,
           args,
           type: { kind: "object", className: name },
           loc,
-        };
+        });
         this.constructDispatch.body.unshift({
           kind: "if",
           cond: {
diff --git a/packages/compiler/src/frontend/lowering/coercions/structural.ts b/packages/compiler/src/frontend/lowering/coercions/structural.ts
index 925f59d9b7..6a5e0058f6 100644
--- a/packages/compiler/src/frontend/lowering/coercions/structural.ts
+++ b/packages/compiler/src/frontend/lowering/coercions/structural.ts
@@ -1,3 +1,4 @@
+import { constructedValue } from "../constructor-returns.js";
 import { dynUndefinedExpr, varRef } from "../../../ir/build.js";
 import type { FieldLift } from "./structural-plans.js";
 import { buildArrayConversion } from "./builders.js";
@@ -524,7 +525,13 @@ export function recordClassWidthHelper(
     params: [{ localId: "r.0", name: "r", type: fromT }],
     returnType: toT,
     locals: [{ id: "r.0", name: "r", type: fromT, mutable: true }],
-    body: [{ kind: "return", value: { kind: "new", className, args, type: toT, loc }, loc }],
+    body: [
+      {
+        kind: "return",
+        value: constructedValue(lowerer, info, { kind: "new", className, args, type: toT, loc }),
+        loc,
+      },
+    ],
     loc,
   });
   return name;
diff --git a/packages/compiler/src/frontend/lowering/constructor-returns.ts b/packages/compiler/src/frontend/lowering/constructor-returns.ts
new file mode 100644
index 0000000000..1cc4c6057b
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/constructor-returns.ts
@@ -0,0 +1,522 @@
+/** Constructors that `return` a value.
+ *
+ * JavaScript's `new C()` answers the constructor's returned value when it
+ * is an object (functions included) and the constructed `this` otherwise.
+ * A primitive or bare return therefore keeps the ordinary lowering, which
+ * evaluates the operand and drops it.
+ *
+ * A return whose value is an instance of the constructor's own class keeps
+ * the class representation (`if (Single.instance) return
+ * Single.instance;`). The return stores that instance in a per-class
+ * result slot and every direct `new C()` takes it from there. Any other
+ * object has no representation as a `C` instance and refuses at the return
+ * statement, deferred to run time in JavaScript like other statement
+ * fences. A JavaScript value that is an object only at run time (`any`)
+ * is tested when it returns: a primitive answers the constructed
+ * instance, an instance of the class takes the result slot, and any other
+ * object refuses.
+ *
+ * `super()` from a subclass refuses: Node would rebind the subclass's
+ * `this` to the returned instance. In JavaScript the refusal is a run-time
+ * test after the call: an instance other than the subclass's own `this`
+ * refuses, and the constructed instance itself (`return this.set(r, g,
+ * b)`, where `set` answers `this`) continues. */
+import * as ts from "../ts7/adapter.js";
+import { varRef } from "../../ir/build.js";
+import {
+  BOOL,
+  DYN,
+  type IrExpr,
+  type IrGlobal,
+  type IrStmt,
+  type IrType,
+  STRING,
+  typeKey,
+  VOID,
+} from "../../ir/ir.js";
+import { unsupportedDiag } from "../../diagnostics/diagnostic.js";
+import { isJsSourceFile, locOf } from "../program.js";
+import type { ClassInfo } from "./lower-classes.js";
+import type { Lowerer } from "./lowerer.js";
+
+type ReturnKind = "instance" | "object" | "mixed";
+
+export interface ConstructorReturnPlan {
+  /** Returns whose value may be an object, by kind. Primitive and `this`
+   * returns are absent: they keep the ordinary lowering. */
+  returns: Map<ts.ReturnStatement, ReturnKind>;
+  /** The result slot (`C | undefined`), present when some return yields an
+   * instance of the class itself. */
+  slot: IrGlobal | null;
+}
+
+const PRIMITIVE_FLAGS =
+  ts.TypeFlags.Primitive | ts.TypeFlags.EnumLike | ts.TypeFlags.Void | ts.TypeFlags.Never;
+
+/** Types whose values may be primitives or objects: open types, type
+ * variables and intersections (a branded `string & { tag }` is a string). */
+const OPEN_FLAGS =
+  ts.TypeFlags.AnyOrUnknown | ts.TypeFlags.InstantiableNonPrimitive | ts.TypeFlags.Intersection;
+
+function unparenthesized(node: ts.Expression): ts.Expression {
+  let e = node;
+  while (ts.isParenthesizedExpression(e)) e = e.expression;
+  return e;
+}
+
+/** Whether a value of this checker type can be an object: "never",
+ * "always", or "maybe" (open types and primitive/object unions). */
+function objectness(type: ts.Type): "never" | "always" | "maybe" {
+  const parts = type.isUnionType() ? ts.constituentTypes(type) : [type];
+  let primitive = false;
+  let object = false;
+  for (const part of parts) {
+    if ((part.flags & OPEN_FLAGS) !== 0) return "maybe";
+    if ((part.flags & PRIMITIVE_FLAGS) !== 0) primitive = true;
+    else object = true;
+  }
+  if (!object) return "never";
+  return primitive ? "maybe" : "always";
+}
+
+/** The constructor's own `return <expr>` statements: nested functions,
+ * arrows and classes have their own returns. */
+function ownValueReturns(ctor: ts.ConstructorDeclaration): ts.ReturnStatement[] {
+  const out: ts.ReturnStatement[] = [];
+  const visit = (node: ts.Node): void => {
+    if (ts.isFunctionLike(node) || ts.isClassLikeDeclaration(node)) return;
+    if (ts.isReturnStatement(node) && node.expression !== undefined) out.push(node);
+    node.forEachChild(visit);
+  };
+  ctor.body?.forEachChild(visit);
+  return out;
+}
+
+/** A return inside a `try` with a `finally` block: the finally block runs
+ * after the result is stored and may throw past it. */
+function insideFinallyTry(node: ts.Node, ctor: ts.ConstructorDeclaration): boolean {
+  for (let p = node.parent; p !== undefined && p !== ctor; p = p.parent) {
+    if (ts.isTryStatement(p) && p.finallyBlock !== undefined && !nodeWithin(node, p.finallyBlock))
+      return true;
+  }
+  return false;
+}
+
+function nodeWithin(node: ts.Node, ancestor: ts.Node): boolean {
+  return node.pos >= ancestor.pos && node.end <= ancestor.end;
+}
+
+function instanceType(info: ClassInfo): IrType {
+  return { kind: "object", className: info.def.name };
+}
+
+function isInstanceOf(lowerer: Lowerer, info: ClassInfo, type: IrType | null): boolean {
+  if (type === null) return false;
+  if (type.kind === "object") return type.className === info.def.name;
+  if (type.kind !== "union") return false;
+  const arms = lowerer.unions.get(type.unionId)?.arms ?? [];
+  return (
+    arms.length === 2 &&
+    arms.some((arm) => arm.kind === "object" && arm.className === info.def.name) &&
+    arms.some((arm) => arm.kind === "undefinedT")
+  );
+}
+
+/** Whether an expression always yields the receiver itself: `this`, or a
+ * call `this.m(...)` / `super.m(...)` whose every implementation the
+ * receiver can reach (the statically resolved method and, for `this`
+ * calls, each subclass override) returns only `this`, a primitive, or
+ * nothing (`return this.set(r, g, b)` with a chainable setter). Such a
+ * return answers the constructed instance. Methods already being checked
+ * count as returning `this` (their other returns decide). */
+function returnsThis(
+  lowerer: Lowerer,
+  info: ClassInfo,
+  node: ts.Expression,
+  visiting: Set<ts.Node> = new Set(),
+): boolean {
+  let e = node;
+  while (ts.isParenthesizedExpression(e) || ts.isAsExpression(e) || ts.isNonNullExpression(e))
+    e = e.expression;
+  if (e.kind === ts.SyntaxKind.ThisKeyword) return true;
+  if (!ts.isCallExpression(e)) return false;
+  const callee = unparenthesized(e.expression);
+  if (
+    !ts.isPropertyAccessExpression(callee) ||
+    callee.questionDotToken !== undefined ||
+    !ts.isIdentifier(callee.name)
+  )
+    return false;
+  const receiver = unparenthesized(callee.expression).kind;
+  if (receiver !== ts.SyntaxKind.ThisKeyword && receiver !== ts.SyntaxKind.SuperKeyword)
+    return false;
+  const name = callee.name.text;
+  const symbol = lowerer.checker.getSymbolAtLocation(callee.name);
+  if (symbol === undefined) return false;
+  const methods: ts.Node[] = [...lowerer.checker.declarationsOf(symbol)];
+  if (receiver === ts.SyntaxKind.ThisKeyword) {
+    const pending = [...info.subclasses];
+    while (pending.length > 0) {
+      const sub = pending.pop()!;
+      pending.push(...sub.subclasses);
+      for (const member of sub.decl?.members.nodes ?? []) {
+        if (member.name === undefined || !ts.isIdentifier(member.name) || member.name.text !== name)
+          continue;
+        if (!ts.isMethodDeclaration(member)) return false;
+        methods.push(member);
+      }
+    }
+  }
+  if (methods.length === 0) return false;
+  for (const method of methods) {
+    if (!ts.isMethodDeclaration(method) || method.body === undefined) return false;
+    if (visiting.has(method)) continue;
+    visiting.add(method);
+    for (const ret of ownReturns(method.body)) {
+      if (ret.expression === undefined) continue;
+      if (objectness(lowerer.typeOf(ret.expression)) === "never") continue;
+      if (!returnsThis(lowerer, info, ret.expression, visiting)) return false;
+    }
+  }
+  return true;
+}
+
+/** A function body's own return statements (nested functions, arrows and
+ * classes have their own). */
+function ownReturns(body: ts.Node): ts.ReturnStatement[] {
+  const out: ts.ReturnStatement[] = [];
+  const visit = (node: ts.Node): void => {
+    if (ts.isFunctionLike(node) || ts.isClassLikeDeclaration(node)) return;
+    if (ts.isReturnStatement(node)) out.push(node);
+    node.forEachChild(visit);
+  };
+  body.forEachChild(visit);
+  return out;
+}
+
+export function constructorReturnPlan(
+  lowerer: Lowerer,
+  info: ClassInfo,
+): ConstructorReturnPlan | null {
+  const byClass = lowerer.constructorReturnPlans;
+  const known = byClass.get(info.def.name);
+  if (known !== undefined) return known;
+  const ctor = info.ctor;
+  let plan: ConstructorReturnPlan | null = null;
+  if (ctor?.body !== undefined && info.decl !== null) {
+    const returns = new Map<ts.ReturnStatement, ReturnKind>();
+    for (const stmt of ownValueReturns(ctor)) {
+      const value = unparenthesized(stmt.expression!);
+      if (returnsThis(lowerer, info, value)) continue;
+      const type = lowerer.typeOf(value);
+      const shape = objectness(type);
+      if (shape === "never") continue;
+      // Local classes construct through their own environment, which has
+      // no result slot.
+      const instance =
+        info.localClass === undefined &&
+        !insideFinallyTry(stmt, ctor) &&
+        isInstanceOf(lowerer, info, lowerer.mapTypeOf(type));
+      returns.set(stmt, instance ? "instance" : shape === "always" ? "object" : "mixed");
+    }
+    if (returns.size > 0) {
+      let slot: IrGlobal | null = null;
+      // A JavaScript value typed only at run time may hold an instance of
+      // the class too (`if (C.instance) return C.instance;`).
+      const runtimeInstance =
+        info.localClass === undefined &&
+        isJsSourceFile(ctor.getSourceFile()) &&
+        [...returns].some(([stmt, kind]) => kind === "mixed" && !insideFinallyTry(stmt, ctor));
+      if ([...returns.values()].includes("instance") || runtimeInstance) {
+        slot = {
+          id: `%g.${info.def.name}.%constructorResult`,
+          name: `${info.def.name}.%constructorResult`,
+          type: lowerer.withUndefinedArm(instanceType(info)),
+          mutable: true,
+        };
+        lowerer.globalsList.push(slot);
+      }
+      plan = { returns, slot };
+    }
+  }
+  byClass.set(info.def.name, plan);
+  return plan;
+}
+
+function foreignObjectFeature(info: ClassInfo): string {
+  const display = info.def.name.replace(/^%|^%m\d+\./, "");
+  return `returning an object other than an instance of the class from a constructor (Node's 'new ${display}()' answers the returned object, which has no representation as a '${display}' instance)`;
+}
+
+/** `return <expr>` inside a class constructor whose value may be an
+ * object. Null when the statement keeps the ordinary lowering. */
+export function lowerConstructorReturn(lowerer: Lowerer, stmt: ts.ReturnStatement): IrStmt | null {
+  const info = lowerer.currentClass;
+  if (info === null || info.ctor === null || stmt.expression === undefined) return null;
+  let fn: ts.Node | undefined = stmt.parent;
+  while (fn !== undefined && !ts.isFunctionLike(fn) && !ts.isClassLikeDeclaration(fn))
+    fn = fn.parent;
+  if (fn !== info.ctor) return null;
+  const plan = constructorReturnPlan(lowerer, info);
+  const kind = plan?.returns.get(stmt);
+  if (plan === null || kind === undefined) return null;
+  const loc = locOf(stmt);
+  if (kind === "instance") {
+    const value = lowerer.coerceInto(
+      stmt.expression,
+      lowerer.lowerExpr(stmt.expression),
+      plan.slot!.type,
+    );
+    return {
+      kind: "block",
+      body: [
+        { kind: "assign", localId: plan.slot!.id, value, loc },
+        { kind: "return", value: null, loc },
+      ],
+      loc,
+    };
+  }
+  const feature = foreignObjectFeature(info);
+  if (kind === "object" || !isJsSourceFile(stmt.getSourceFile()))
+    lowerer.unsupported("SC1090", stmt, feature);
+  // A JavaScript value that is an object only sometimes: a primitive
+  // still answers the constructed instance, an object refuses.
+  const value = lowerer.coerceToExpected(lowerer.lowerExpr(stmt.expression), DYN);
+  if (value.type.kind !== "dyn") lowerer.unsupported("SC1090", stmt, feature);
+  const held = lowerer.declareHiddenLocal("%returned", DYN);
+  const read = varRef(held.id, DYN, loc);
+  const typeOf: IrExpr = { kind: "libCall", fn: "dyn.typeof", args: [read], type: STRING, loc };
+  const typeIs = (name: string): IrExpr => ({
+    kind: "strEq",
+    negated: false,
+    left: typeOf,
+    right: { kind: "strLit", value: name, type: STRING, loc },
+    type: BOOL,
+    loc,
+  });
+  const diag = unsupportedDiag("SC1090", loc, feature);
+  lowerer.runtimeFences.push(diag);
+  const sf = stmt.getSourceFile();
+  const line = ts.getLineAndCharacterOfPosition(sf, loc.start).line + 1;
+  return {
+    kind: "block",
+    body: [
+      { kind: "varDecl", localId: held.id, init: value, loc },
+      {
+        kind: "if",
+        // null answers "object" and is falsy; every object is truthy.
+        cond: {
+          kind: "logical",
+          op: "||",
+          left: typeIs("function"),
+          right: {
+            kind: "logical",
+            op: "&&",
+            left: typeIs("object"),
+            right: lowerer.ensureBool(read, stmt.expression),
+            type: BOOL,
+            loc,
+          },
+          type: BOOL,
+          loc,
+        },
+        then: [
+          ...(plan.slot !== null && !insideFinallyTry(stmt, info.ctor)
+            ? [
+                {
+                  kind: "if" as const,
+                  cond: {
+                    kind: "libCall" as const,
+                    fn: "dyn.typedRefIs" as const,
+                    args: [
+                      read,
+                      {
+                        kind: "strLit" as const,
+                        value: typeKey(instanceType(info)),
+                        type: STRING,
+                        loc,
+                      },
+                    ],
+                    type: BOOL,
+                    loc,
+                  },
+                  then: [
+                    {
+                      kind: "assign" as const,
+                      localId: plan.slot.id,
+                      value: lowerer.coerceToExpected(
+                        lowerer.coerceToExpected(read, instanceType(info)),
+                        plan.slot.type,
+                      ),
+                      loc,
+                    },
+                    { kind: "return" as const, value: null, loc },
+                  ],
+                  else_: null,
+                  loc,
+                },
+              ]
+            : []),
+          {
+            kind: "runtimeFence",
+            code: diag.code,
+            message: `${diag.message} [${diag.code} at ${loc.file}:${line}]`,
+            loc,
+          },
+        ],
+        else_: null,
+        loc,
+      },
+      { kind: "return", value: null, loc },
+    ],
+    loc,
+  };
+}
+
+/** The value of a construction of exactly class `C`: the constructed
+ * instance, or the instance the constructor returned. Unchanged for
+ * classes without a result slot. The slot is read and cleared by a
+ * per-class helper, so every construction site (direct `new`, class
+ * values, the checked dynamic dispatchers) shares one protocol. */
+export function constructedValue(lowerer: Lowerer, info: ClassInfo, constructed: IrExpr): IrExpr {
+  const slot = constructorReturnPlan(lowerer, info)?.slot;
+  if (slot === null || slot === undefined) return constructed;
+  const loc = constructed.loc;
+  const type = instanceType(info);
+  const name = `%${info.def.name}.%constructed`;
+  if (!lowerer.liftedFns.some((fn) => fn.name === name)) {
+    const instance = { id: "instance.0", name: "instance", type, mutable: false };
+    const returned = { id: "returned.0", name: "returned", type: slot.type, mutable: false };
+    lowerer.liftedFns.push({
+      name,
+      params: [{ localId: instance.id, name: instance.name, type }],
+      returnType: type,
+      locals: [instance, returned],
+      body: [
+        { kind: "varDecl", localId: returned.id, init: varRef(slot.id, slot.type, loc), loc },
+        { kind: "assign", localId: slot.id, value: lowerer.wrappedUndefined(slot.type, loc)!, loc },
+        {
+          kind: "return",
+          value: {
+            kind: "orDefault",
+            left: varRef(returned.id, slot.type, loc),
+            right: varRef(instance.id, type, loc),
+            type,
+            loc,
+          },
+          loc,
+        },
+      ],
+      loc,
+    });
+  }
+  return { kind: "call", callee: name, args: [constructed], type, loc };
+}
+
+/** A construction through a class value whose static class is `info`: the
+ * value holds `info` itself or a descendant. Descendants of a class with a
+ * result slot refuse at their `super()`, so only `info`'s own slot can
+ * apply; a descendant with its own slot has no static home here. */
+export function constructedFromValue(
+  lowerer: Lowerer,
+  info: ClassInfo,
+  constructed: IrExpr,
+  blame: ts.Node,
+): IrExpr {
+  const pending = [...info.subclasses];
+  while (pending.length > 0) {
+    const sub = pending.pop()!;
+    pending.push(...sub.subclasses);
+    const plan = constructorReturnPlan(lowerer, sub);
+    if (plan === null || plan.slot === null) continue;
+    const display = sub.def.name.replace(/^%|^%m\d+\./, "");
+    lowerer.unsupported(
+      "SC1090",
+      blame,
+      `constructing through a class value that may hold '${display}', whose constructor can return an existing instance`,
+    );
+  }
+  return constructedValue(lowerer, info, constructed);
+}
+
+/** `super()` into a class with a result slot, from the constructor of
+ * class `sub`: `call` runs the base constructor over `self` (the
+ * subclass's `this`, upcast to the base). Node rebinds the subclass's
+ * `this` to an instance the base constructor returns, which has no
+ * representation. A TypeScript subclass refuses. In JavaScript the base
+ * stores the instance it returns in its slot, and a per-subclass helper
+ * reads and clears the slot after the call: an instance other than `self`
+ * refuses at run time. Unchanged for bases without a result slot. */
+export function superIntoResultSlot(
+  lowerer: Lowerer,
+  base: ClassInfo,
+  sub: ClassInfo,
+  call: IrStmt,
+  self: IrExpr,
+  blame: ts.Node,
+): IrStmt {
+  const plan = constructorReturnPlan(lowerer, base);
+  if (plan === null || plan.slot === null) return call;
+  const slot = plan.slot;
+  const display = base.def.name.replace(/^%|^%m\d+\./, "");
+  const feature = `extending a class whose constructor can return an existing instance ('super()' would rebind 'this' to the instance '${display}' returns)`;
+  if (!isJsSourceFile(blame.getSourceFile())) {
+    lowerer.unsupported("SC1090", blame, feature);
+    return call;
+  }
+  const loc = locOf(blame);
+  const type = instanceType(base);
+  const name = `%${sub.def.name}.%superResult`;
+  if (!lowerer.liftedFns.some((fn) => fn.name === name)) {
+    const diag = unsupportedDiag("SC1090", loc, feature);
+    lowerer.runtimeFences.push(diag);
+    const line = ts.getLineAndCharacterOfPosition(blame.getSourceFile(), loc.start).line + 1;
+    const instance = { id: "instance.0", name: "instance", type, mutable: false };
+    const returned = { id: "returned.0", name: "returned", type: slot.type, mutable: false };
+    lowerer.liftedFns.push({
+      name,
+      params: [{ localId: instance.id, name: instance.name, type }],
+      returnType: VOID,
+      locals: [instance, returned],
+      body: [
+        { kind: "varDecl", localId: returned.id, init: varRef(slot.id, slot.type, loc), loc },
+        { kind: "assign", localId: slot.id, value: lowerer.wrappedUndefined(slot.type, loc)!, loc },
+        {
+          kind: "if",
+          cond: {
+            kind: "bin",
+            op: "!==",
+            left: {
+              kind: "orDefault",
+              left: varRef(returned.id, slot.type, loc),
+              right: varRef(instance.id, type, loc),
+              type,
+              loc,
+            },
+            right: varRef(instance.id, type, loc),
+            type: BOOL,
+            loc,
+          },
+          then: [
+            {
+              kind: "runtimeFence",
+              code: diag.code,
+              message: `${diag.message} [${diag.code} at ${loc.file}:${line}]`,
+              loc,
+            },
+          ],
+          else_: null,
+          loc,
+        },
+        { kind: "return", value: null, loc },
+      ],
+      loc,
+    });
+  }
+  const check: IrStmt = {
+    kind: "exprStmt",
+    expr: { kind: "call", callee: name, args: [self], type: VOID, loc },
+    loc,
+  };
+  return { kind: "block", body: [call, check], loc };
+}
diff --git a/packages/compiler/src/frontend/lowering/cycle-initialization.ts b/packages/compiler/src/frontend/lowering/cycle-initialization.ts
index 1e8b9e5a58..fb62fb998f 100644
--- a/packages/compiler/src/frontend/lowering/cycle-initialization.ts
+++ b/packages/compiler/src/frontend/lowering/cycle-initialization.ts
@@ -41,6 +41,10 @@ export interface CycleInitFlag {
    * own module's early calls is checked opportunistically: whatever cannot
    * be checked keeps the unchecked behavior instead of refusing. */
   cycle: boolean;
+  /** A pointer-guarded binding declared without an initializer: its
+   * declaration initializes it (to undefined, which the pointer cannot
+   * hold), so the flag alone decides its writes (markUninitializedWrites). */
+  uninitialized?: true;
   /** A class binding: its references are the class's own IR forms and its
    * static field storage (`global` is the flag itself). */
   className?: string;
@@ -107,6 +111,30 @@ export function markCycleEarlyBindings(lowerer: Lowerer): void {
       registerInitFlag(lowerer, binding, global, false);
     }
   }
+  // `let f: T;` with a pointer-guarded slot: once the declaration ran the
+  // binding is initialized while the slot is still empty, so a write
+  // checks the flag (where code can run before the declaration) instead of
+  // the empty pointer. `f = () => f(...)` is the shape.
+  for (const [id, entry] of lowerer.uninitializedLexicalGlobals) {
+    const global = lowerer.globalsList.find((g) => g.id === id);
+    if (global === undefined) continue;
+    if (!lowerer.cycleInitFlags.has(id)) {
+      registerInitFlag(
+        lowerer,
+        {
+          symbol: entry.symbol,
+          name: entry.name,
+          kind: "lexical",
+          module: entry.module,
+          reference: entry.name,
+          settled: new Set(),
+        },
+        global,
+        false,
+      );
+    }
+    lowerer.cycleInitFlags.get(id)!.uninitialized = true;
+  }
 }
 
 /** A class that its module's early-running code can reach before the class
@@ -304,6 +332,22 @@ export function checkCycleBindingAccesses(lowerer: Lowerer, mod: IrModule): void
   const fileOfInit = new Map<string, ts.SourceFile>();
   for (const [sf, name] of lowerer.initNameOf) fileOfInit.set(name, sf);
   for (const fn of mod.functions) rewriteFunction(lowerer, fn, fileOfInit.get(fn.name));
+  markUninitializedWrites(lowerer, mod);
+}
+
+/** Writes to a binding declared without an initializer that run after its
+ * declaration store into an initialized binding whose slot may still be
+ * empty: the pointer guard must not refuse them. Writes that can run
+ * earlier carry the flag check rewriteFunction inserted. */
+function markUninitializedWrites(lowerer: Lowerer, mod: IrModule): void {
+  const ids = new Set<string>();
+  for (const [id, flag] of lowerer.cycleInitFlags) if (flag.uninitialized) ids.add(id);
+  if (ids.size === 0) return;
+  const mark = (s: IrStmt): IrStmt =>
+    s.kind === "assign" && !s.initializes && ids.has(s.localId) ? { ...s, initializes: true } : s;
+  const rewriteExpr = (e: IrExpr): IrExpr => mapExprChildren(e, rewriteExpr, rewriteStmt);
+  const rewriteStmt = (s: IrStmt): IrStmt => mark(mapStmtChildren(s, rewriteExpr, rewriteStmt));
+  for (const fn of mod.functions) fn.body = fn.body.map(rewriteStmt);
 }
 
 function rewriteFunction(
@@ -444,6 +488,7 @@ function rewriteFunction(
         kind: "assign",
         localId: s.localId,
         value: { kind: "varRef", localId: t, type: s.value.type, loc: s.loc },
+        ...(flag.uninitialized ? { initializes: true as const } : {}),
         loc: s.loc,
       };
       return {
diff --git a/packages/compiler/src/frontend/lowering/lower-calls.ts b/packages/compiler/src/frontend/lowering/lower-calls.ts
index 67ca01b3f3..eae177b2f9 100644
--- a/packages/compiler/src/frontend/lowering/lower-calls.ts
+++ b/packages/compiler/src/frontend/lowering/lower-calls.ts
@@ -1,4 +1,5 @@
 import { guardNullProto, nullProtoRecordShape } from "./null-prototype.js";
+import { refuseModuleMemberThis } from "./module-member-this.js";
 import { lowerUnionEquality, tagEqualityMayMissAlias } from "./strict-equality.js";
 import { lowerHashStreamCall } from "./builtins/hash-stream.js";
 import { lowerResponseStaticJson } from "./lower-stdlib.js";
@@ -1249,6 +1250,7 @@ export function lowerCall(lowerer: Lowerer, expr: ts.CallExpression): IrExpr {
       if (facadeServed) return facadeServed;
       const memberSym = lowerer.checker.getSymbolAtLocation(nsMember);
       if (memberSym) fenceEarlyNsMemberRef(lowerer, expr.expression, memberSym);
+      refuseModuleMemberThis(lowerer, expr, nsMember);
       const generic = lowerer.genericFnOf(nsMember);
       if (generic) return lowerer.lowerGenericCall(expr, generic);
       const sig = lowerer.fnSigOf(nsMember);
@@ -1312,6 +1314,7 @@ export function lowerCall(lowerer: Lowerer, expr: ts.CallExpression): IrExpr {
     if (!ts.isIdentifier(nameId)) {
       lowerer.unsupported("SC1090", nameId, "private-named module members");
     }
+    refuseModuleMemberThis(lowerer, expr, nameId);
     const generic = lowerer.genericFnOf(nameId);
     if (generic) return lowerer.lowerGenericCall(expr, generic);
     const sig = lowerer.fnSigOf(nameId);
diff --git a/packages/compiler/src/frontend/lowering/lower-classes.ts b/packages/compiler/src/frontend/lowering/lower-classes.ts
index 770c748407..9888855445 100644
--- a/packages/compiler/src/frontend/lowering/lower-classes.ts
+++ b/packages/compiler/src/frontend/lowering/lower-classes.ts
@@ -1,5 +1,10 @@
 import { lowerValueReturningConstructorNew } from "./js-dynamic-objects.js";
 import { dynUndefinedExpr, nodeThrowExpr, varRef } from "../../ir/build.js";
+import {
+  constructedFromValue,
+  constructedValue,
+  superIntoResultSlot,
+} from "./constructor-returns.js";
 import { checkedIterableSpread } from "./checked-iterable-spread.js";
 import { lowerReadlineUiNew } from "./builtins/readline.js";
 import { checkedClassUnionAssertion } from "./class-assertions.js";
@@ -86,7 +91,7 @@ import {
   isNodeTypesPath,
   locOf,
 } from "../program.js";
-import { PoisonError, dynFallbackType, newFnCtx, own } from "./lowerer.js";
+import { PoisonError, dynFallbackType, jsFuncNameOf, newFnCtx, own } from "./lowerer.js";
 import { isAssertClassNew } from "./assert-instances.js";
 import { lowerArrayConstructor } from "./containers/array-construction.js";
 import { lowerMapSeedNew, lowerSetSeedNew } from "./containers/collection-methods.js";
@@ -8303,7 +8308,7 @@ export function superCallStmt(
     )[0]!;
   }
   lowerer.noteSuperConstructorEdge(`%${base.def.name}.constructor`);
-  return {
+  const call: IrStmt = {
     kind: "exprStmt",
     expr: {
       kind: "call",
@@ -8314,6 +8319,14 @@ export function superCallStmt(
     },
     loc,
   };
+  return superIntoResultSlot(
+    lowerer,
+    base,
+    info,
+    call,
+    lowerer.upcastTo({ ...thisRef }, base.def.name),
+    info.ctor ?? info.decl!,
+  );
 }
 
 /** `super.method(args)`: the base chain's implementation, called
@@ -8711,21 +8724,21 @@ function lowerProgramClassNew(
     : lowerer.completeArgs(expr.arguments?.nodes ?? [], info.ctorParams, loc, expr);
   for (let current: ClassInfo | null = info; current; current = current.base) {
     if (current.def.baseValueGlobal)
-      return {
+      return constructedValue(lowerer, info, {
         kind: "newValue",
         callee: classValueRef(lowerer, info, expr),
         args,
         type: { kind: "object", className: info.def.name },
         loc,
-      };
+      });
   }
-  return {
+  return constructedValue(lowerer, info, {
     kind: "new",
     className: info.def.name,
     args,
     type: { kind: "object", className: info.def.name },
     loc,
-  };
+  });
 }
 
 function assignedThisFieldType(lowerer: Lowerer, expr: ts.NewExpression): IrType | null {
@@ -9026,13 +9039,18 @@ export function lowerNew(lowerer: Lowerer, expr: ts.NewExpression): IrExpr {
             loc,
             expr,
           );
-          return {
-            kind: "newValue",
-            callee,
-            args,
-            type: { kind: "object", className: info.def.name },
-            loc,
-          };
+          return constructedFromValue(
+            lowerer,
+            info,
+            {
+              kind: "newValue",
+              callee,
+              args,
+              type: { kind: "object", className: info.def.name },
+              loc,
+            },
+            expr,
+          );
         }
       }
     }
@@ -9955,13 +9973,18 @@ export function lowerNew(lowerer: Lowerer, expr: ts.NewExpression): IrExpr {
         loc,
         expr,
       );
-      const built: IrExpr = {
-        kind: "newValue",
-        callee,
-        args,
-        type: { kind: "object", className: info.def.name },
-        loc,
-      };
+      const built = constructedFromValue(
+        lowerer,
+        info,
+        {
+          kind: "newValue",
+          callee,
+          args,
+          type: { kind: "object", className: info.def.name },
+          loc,
+        },
+        expr,
+      );
       // A runtime class slot widened from a union (`[Readable, Writable]`'s
       // elements hold EventEmitter values): the checker types the result as
       // the union of the arms' instances, which the checked class view
@@ -10028,7 +10051,15 @@ export function lowerNew(lowerer: Lowerer, expr: ts.NewExpression): IrExpr {
       ((callee.type.kind === "func" || callee.type.kind === "classval") &&
         lowerer.dynConvertible(callee.type)))
   ) {
-    return lowerCheckedConstructor(lowerer, expr, lowerer.coerceToExpected(callee, DYN));
+    let boxed = lowerer.coerceToExpected(callee, DYN);
+    // A plain function's box carries its name: the construction's
+    // prototype records it as `constructor`, which util.inspect prints
+    // (`F { a: 2 }`).
+    if (boxed.kind === "dynFrom" && boxed.fnName === undefined && callee.type.kind === "func") {
+      const name = jsFuncNameOf(expr.expression, lowerer);
+      if (name !== null) boxed = { ...boxed, fnName: name };
+    }
+    return lowerCheckedConstructor(lowerer, expr, boxed);
   }
   lowerer.unsupported(
     "SC1090",
diff --git a/packages/compiler/src/frontend/lowering/lower-exprs.ts b/packages/compiler/src/frontend/lowering/lower-exprs.ts
index 09407f71f2..7cb8dde5bb 100644
--- a/packages/compiler/src/frontend/lowering/lower-exprs.ts
+++ b/packages/compiler/src/frontend/lowering/lower-exprs.ts
@@ -33,6 +33,7 @@ import { literalUnionArm } from "../union-discriminants.js";
  * (FieldTarget). */
 import { isFsStreamMember, lowerFsStreamProperty } from "./builtins/fs-streams.js";
 import * as ts from "../ts7/adapter.js";
+import { builtinFunctionFenceValue } from "./builtin-function-fences.js";
 import {
   isZlibStreamMember,
   lowerZlibInstanceOf,
@@ -1341,6 +1342,9 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
         // the same identity-token story as stdlib globals above (the
         // harness adds worker_threads.Worker to its identity Set).
         if (isJsSourceFile(expr.getSourceFile())) {
+          // A function member is a function value that fences when called.
+          if (builtinModuleFnOf(lowerer, bi.module, bi.member))
+            return builtinFunctionFenceValue(lowerer, bi, expr, loc);
           return {
             kind: "strLit",
             value: `[builtin ${bi.module}.${bi.member}]`,
@@ -11728,6 +11732,25 @@ function lowerLogicalPair(lowerer: Lowerer, expr: ts.BinaryExpression, left: IrE
         }
       }
     }
+    // `&&` over an always-truthy plain left operand (an array, object or
+    // function value) whose result union has no arm for it: every JS
+    // object is truthy, so `list && list[0]` evaluates the left for its
+    // effects and answers the right. Coercing the left into that union
+    // would trap at run time where Node answers the right operand.
+    if (
+      op === ts.SyntaxKind.AmpersandAmpersandToken &&
+      target?.kind === "union" &&
+      REF_TRUTHY_KINDS.has(left.type.kind) &&
+      lowerer.armTag(target.unionId, left.type) < 0
+    ) {
+      return {
+        kind: "seqExpr",
+        stmts: [{ kind: "exprStmt", expr: left, loc }],
+        result: lowerer.coerceInto(expr.right, right, target),
+        type: target,
+        loc,
+      };
+    }
     if (target?.kind === "union") {
       // `&&` whose left does NOT fit the result union: the checker
       // built that result by DROPPING left arms which are always
diff --git a/packages/compiler/src/frontend/lowering/lower-modules.ts b/packages/compiler/src/frontend/lowering/lower-modules.ts
index 96e22f2080..78e899070b 100644
--- a/packages/compiler/src/frontend/lowering/lower-modules.ts
+++ b/packages/compiler/src/frontend/lowering/lower-modules.ts
@@ -2516,6 +2516,11 @@ export function collectGlobals(
           };
           lowerer.globalsBySymbol.set(symbol, g);
           lowerer.globalsList.push(g);
+          // `let f: T;` initializes the binding (to undefined) where the
+          // declaration runs: later writes are ordinary stores, which the
+          // pointer guard alone would refuse (markCycleEarlyBindings).
+          if (g.tdz && !decl.initializer)
+            lowerer.uninitializedLexicalGlobals.set(g.id, { name: nameNode, module: sf, symbol });
           // Mutable checked-dynamic LET globals ride the same entry
           // init: a closure called above the declaration statement
           // reads the dyn undefined instead of faulting on NULL — the
diff --git a/packages/compiler/src/frontend/lowering/lower-stmts.ts b/packages/compiler/src/frontend/lowering/lower-stmts.ts
index 36abb9130a..a86465de8d 100644
--- a/packages/compiler/src/frontend/lowering/lower-stmts.ts
+++ b/packages/compiler/src/frontend/lowering/lower-stmts.ts
@@ -19,6 +19,7 @@ import { processDataMemberValue } from "./builtins/process.js";
 import { requireInitFlagStmt } from "./require-initialization.js";
 import { isJsonRequireDecl } from "./json-require.js";
 import { bindingSource } from "../binding-source.js";
+import { lowerConstructorReturn } from "./constructor-returns.js";
 import type { Lowerer } from "./lowerer.js";
 import {
   cjsExportValueByName,
@@ -1450,6 +1451,11 @@ export function lowerStmt(lowerer: Lowerer, stmt: ts.Statement): IrStmt | IrStmt
     // incompatible boundary keeps the ordinary per-statement refusal.
     let value: IrExpr | null = null;
     if (stmt.expression) {
+      // A constructor's returned object replaces the constructed `this`.
+      if (lowerer.currentClass?.ctor) {
+        const constructorReturn = lowerConstructorReturn(lowerer, stmt);
+        if (constructorReturn !== null) return constructorReturn;
+      }
       return lowerer.lowerReturnStmt(stmt.expression, locOf(stmt));
     } else if (lowerer.ctx.returnType.kind === "union") {
       value = lowerer.wrappedUndefined(lowerer.ctx.returnType, locOf(stmt));
diff --git a/packages/compiler/src/frontend/lowering/lowerer.ts b/packages/compiler/src/frontend/lowering/lowerer.ts
index d252af2500..988130b6be 100644
--- a/packages/compiler/src/frontend/lowering/lowerer.ts
+++ b/packages/compiler/src/frontend/lowering/lowerer.ts
@@ -4,6 +4,7 @@ import {
   lowerLifetimeRegionCall,
   lowerLifetimeRegionNew,
 } from "./lifetime-regions.js";
+import type { ConstructorReturnPlan } from "./constructor-returns.js";
 import { internTableType, lowerInternTableCall, lowerInternTableNew } from "./intern-tables.js";
 import { lowerThreadSlotsCall, lowerThreadSlotsNew, threadSlotsType } from "./thread-slots.js";
 import { isExperimentalDeclarationFile } from "../experimental-import.js";
@@ -2531,6 +2532,8 @@ export class Lowerer {
    * so named imports, namespace reads, CommonJS bindings, and alias chains
    * all reuse one immortal zero-capture closure. */
   readonly builtinCallableValueFns = new Map<string, string>();
+  /** Each builtin function-value adapter's Node name, for boxed values. */
+  readonly builtinCallableValueNames = new Map<string, string>();
   /** Optional-chain lowering state. While a chain body lowers, the guarded
    * receiver NODE reads as a chainRecv (typed by the narrowed arm) instead
    * of re-lowering, its checker type reads non-nullish (typeOf), and the
@@ -2816,6 +2819,16 @@ export class Lowerer {
    * by class name (cycle-initialization.ts). */
   readonly classInitFlags = new Map<string, CycleInitFlag>();
   readonly cycleInitDeclarations = new Map<ts.Statement, CycleInitFlag[]>();
+  /** Each class's constructor return plan by class name
+   * (constructor-returns.ts); null when no return can yield an object. */
+  readonly constructorReturnPlans = new Map<string, ConstructorReturnPlan | null>();
+  /** Pointer-guarded (`tdz`) module bindings declared without an
+   * initializer (`let f: T;`): an initialization flag tracks their
+   * declaration (markCycleEarlyBindings). */
+  readonly uninitializedLexicalGlobals = new Map<
+    string,
+    { name: ts.Identifier; module: ts.SourceFile; symbol: ts.Symbol }
+  >();
   /** CommonJS require declarations whose bindings code running before the
    * require can read, and those references (require-initialization.ts). */
   readonly requireInitFlags = new Map<ts.VariableDeclaration, RequireInitFlag>();
@@ -8597,12 +8610,17 @@ export class Lowerer {
           liveReference(expr.type) ||
           (expr.type.kind === "union" &&
             (this.unions.get(expr.type.unionId)?.arms.some(liveReference) ?? false));
+        // A builtin function's adapter boxes under the builtin's name, the
+        // name Node's function carries (`[Function: randomUUID]`).
+        const builtinName =
+          expr.kind === "closure" ? this.builtinCallableValueNames.get(expr.fnName) : undefined;
         return {
           kind: "dynFrom",
           value: expr,
           type: DYN,
           loc: expr.loc,
           ...(liveRef ? { liveRef: true as const } : {}),
+          ...(builtinName !== undefined ? { fnName: builtinName } : {}),
         };
       }
       return expr;
@@ -12398,11 +12416,12 @@ export class Lowerer {
         param.mode === "optional" ? `${param.mode}:${param.defaultValue}` : param.mode,
       )
       .join(",");
-    const key = `${fn.fn}:${typeKey(funcType)}:${adapterShape}`;
+    const key = `${fn.valueFn ?? fn.fn}:${typeKey(funcType)}:${adapterShape}`;
     let fnName = this.builtinCallableValueFns.get(key);
     if (!fnName) {
-      fnName = `%builtin.value.${fn.fn}.${this.builtinCallableValueFns.size}`;
+      fnName = `%builtin.value.${fn.valueFn ?? fn.fn}.${this.builtinCallableValueFns.size}`;
       this.builtinCallableValueFns.set(key, fnName);
+      this.builtinCallableValueNames.set(fnName, display.slice(display.lastIndexOf(".") + 1));
       const params = funcType.params.map((type, index) => ({
         localId: `arg.${index}`,
         name: `arg${index}`,
@@ -12467,7 +12486,7 @@ export class Lowerer {
           loc,
         };
       });
-      const call: IrExpr = { kind: "libCall", fn: fn.fn, args, type: fn.result, loc };
+      const call: IrExpr = { kind: "libCall", fn: fn.valueFn ?? fn.fn, args, type: fn.result, loc };
       const body: IrStmt[] =
         fn.result.kind === "void"
           ? [
diff --git a/packages/compiler/src/frontend/lowering/module-member-this.ts b/packages/compiler/src/frontend/lowering/module-member-this.ts
new file mode 100644
index 0000000000..a29e361d9c
--- /dev/null
+++ b/packages/compiler/src/frontend/lowering/module-member-this.ts
@@ -0,0 +1,64 @@
+/* A module export called through its module binding (`m.f()` where `m` is
+ * `const m = require("./x")` or `import * as m from "./x"`): Node passes
+ * the module object (the exports object, or the namespace) as `this`. The
+ * member call lowers to a direct call of the exported function, which has
+ * no module object to pass, so an export that reads `this` refuses instead
+ * of seeing another receiver. */
+import * as ts from "../ts7/adapter.js";
+import type { Lowerer } from "./lowerer.js";
+
+/** The function an export binding holds, when its declaration shows it. */
+function exportedFunction(decl: ts.Node): ts.Node | null {
+  let node: ts.Node | undefined = decl;
+  if (ts.isPropertyAccessExpression(node) && node.parent && ts.isBinaryExpression(node.parent))
+    node = node.parent;
+  if (ts.isBinaryExpression(node)) node = node.right;
+  else if (ts.isVariableDeclaration(node) || ts.isPropertyAssignment(node)) node = node.initializer;
+  while (node !== undefined && ts.isParenthesizedExpression(node)) node = node.expression;
+  if (node === undefined) return null;
+  if (
+    ts.isFunctionDeclaration(node) ||
+    ts.isFunctionExpression(node) ||
+    ts.isMethodDeclaration(node)
+  )
+    return node;
+  return null;
+}
+
+/** Whether a function's own body reads `this` (arrows share it; other
+ * functions and classes have their own). */
+function readsOwnThis(fn: ts.Node): boolean {
+  let found = false;
+  const visit = (node: ts.Node): void => {
+    if (found) return;
+    if (node.kind === ts.SyntaxKind.ThisKeyword) {
+      found = true;
+      return;
+    }
+    if ((ts.isFunctionLike(node) && !ts.isArrowFunction(node)) || ts.isClassLikeDeclaration(node))
+      return;
+    node.forEachChild(visit);
+  };
+  fn.forEachChild(visit);
+  return found;
+}
+
+export function refuseModuleMemberThis(
+  lowerer: Lowerer,
+  call: ts.CallExpression,
+  member: ts.Identifier,
+): void {
+  let symbol = lowerer.checker.getSymbolAtLocation(member);
+  if (symbol !== undefined && (symbol.flags & ts.SymbolFlags.Alias) !== 0)
+    symbol = lowerer.checker.getAliasedSymbol(symbol);
+  if (symbol === undefined) return;
+  for (const decl of lowerer.checker.declarationsOf(symbol)) {
+    const fn = exportedFunction(decl);
+    if (fn === null || !readsOwnThis(fn)) continue;
+    lowerer.unsupported(
+      "SC1090",
+      call,
+      `calling a module export that reads 'this' through its module binding ('${member.text}': Node passes the module object as 'this', which this call has no value for)`,
+    );
+  }
+}
diff --git a/packages/compiler/src/frontend/lowering/surfaces.ts b/packages/compiler/src/frontend/lowering/surfaces.ts
index e43748b39c..f2afd76eb7 100644
--- a/packages/compiler/src/frontend/lowering/surfaces.ts
+++ b/packages/compiler/src/frontend/lowering/surfaces.ts
@@ -793,6 +793,10 @@ export interface BuiltinModuleFn {
    * omission or explicit undefined; rest parameters pack into one typed
    * array slot. Entries with call-site-specific validation remain absent. */
   valueParams?: BuiltinValueParam[];
+  /** The libCall a function value's adapter makes when it differs from the
+   * direct-call row's `fn` (a direct call picks an arity-specific entry
+   * point; the value accepts every arity through one). */
+  valueFn?: IrLibFn;
 }
 
 export type BuiltinValueParam =
@@ -1502,7 +1506,15 @@ export const BUILTIN_MODULE_FNS: Record<
     userInfo: { fn: "os.userName", params: [], result: VOID },
   },
   crypto: {
-    randomUUID: { fn: "crypto.randomUUID", params: [], result: STRING },
+    randomUUID: {
+      fn: "crypto.randomUUID",
+      params: [],
+      result: STRING,
+      // As a value (uuid's `export default { randomUUID }`), the optional
+      // options argument goes through the validating entry point.
+      valueFn: "crypto.randomUUIDOpts",
+      valueParams: [{ mode: "optional", type: DYN, defaultValue: undefined }],
+    },
     // A real Buffer result. The composed randomBytes(n).toString(enc)
     // form KEEPS its one-libCall lowering (lowerCryptoComposedCall runs
     // first and the Buffer never materializes there); this entry covers
@@ -1523,7 +1535,12 @@ export const BUILTIN_MODULE_FNS: Record<
     randomFillSync: { fn: "crypto.randomFill", params: [BYTES_U8, F64, F64], result: BYTES_U8 },
     randomInt: { fn: "crypto.randomInt", params: [F64, F64], result: F64 },
     randomFill: { fn: "crypto.randomFillCb", params: [], result: VOID },
-    randomUUIDv7: { fn: "crypto.randomUUIDv7", params: [DYN], result: STRING },
+    randomUUIDv7: {
+      fn: "crypto.randomUUIDv7",
+      params: [DYN],
+      result: STRING,
+      valueParams: [{ mode: "optional", type: DYN, defaultValue: undefined }],
+    },
     createSecretKey: { fn: "crypto.createSecretKey", params: [DYN, DYN], result: DYN },
     generateKeySync: { fn: "crypto.generateKeySync", params: [DYN, DYN], result: DYN },
     generateKey: { fn: "crypto.generateKeyCb", params: [], result: VOID },
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/bound-constructor-inspect-names.cjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/bound-constructor-inspect-names.cjs.json
new file mode 100644
index 0000000000..b6046aead5
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/bound-constructor-inspect-names.cjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/bound-constructor-inspect-names.cjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/builtin-function-record-values/main.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/builtin-function-record-values/main.ts.json
new file mode 100644
index 0000000000..eb79fc63a5
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/builtin-function-record-values/main.ts.json
@@ -0,0 +1,7 @@
+{
+ "order": [
+  "<repo>/tests/corpus/builtin-function-record-values/native.js",
+  "<repo>/tests/corpus/builtin-function-record-values/main.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/builtin-function-values.mjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/builtin-function-values.mjs.json
new file mode 100644
index 0000000000..f13bd6642b
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/builtin-function-values.mjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/builtin-function-values.mjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-chained-this.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-chained-this.js.json
new file mode 100644
index 0000000000..ad1317aa62
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-chained-this.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/constructor-returns-chained-this.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-chained-this.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-chained-this.ts.json
new file mode 100644
index 0000000000..9fb2595c4f
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-chained-this.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/constructor-returns-chained-this.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-instance.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-instance.js.json
new file mode 100644
index 0000000000..a85c33c1a1
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-instance.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/constructor-returns-instance.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-instance.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-instance.ts.json
new file mode 100644
index 0000000000..e01b6a4266
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-instance.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/constructor-returns-instance.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-this-super.js.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-this-super.js.json
new file mode 100644
index 0000000000..fa81da713c
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/constructor-returns-this-super.js.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/constructor-returns-this-super.js"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/es5-constructor-inspect-names.cjs.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/es5-constructor-inspect-names.cjs.json
new file mode 100644
index 0000000000..b5e8ba0875
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/es5-constructor-inspect-names.cjs.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/es5-constructor-inspect-names.cjs"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/exponent-unit-base.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/exponent-unit-base.ts.json
new file mode 100644
index 0000000000..b8de10f6a1
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/exponent-unit-base.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/exponent-unit-base.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/let-uninitialized-function-binding.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/let-uninitialized-function-binding.ts.json
new file mode 100644
index 0000000000..f5706acaa4
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/let-uninitialized-function-binding.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/let-uninitialized-function-binding.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/logical-and-truthy-index.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/logical-and-truthy-index.ts.json
new file mode 100644
index 0000000000..2e73889846
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/corpus/logical-and-truthy-index.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/logical-and-truthy-index.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/constructor-returns-instance-super.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/constructor-returns-instance-super.ts.json
new file mode 100644
index 0000000000..86b15f6804
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/constructor-returns-instance-super.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/diagnostics/constructor-returns-instance-super.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/constructor-returns-object.ts.json b/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/constructor-returns-object.ts.json
new file mode 100644
index 0000000000..f3415a9373
--- /dev/null
+++ b/packages/compiler/test/ts7/baselines/order-parity/tests/diagnostics/constructor-returns-object.ts.json
@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/diagnostics/constructor-returns-object.ts"
+ ],
+ "diags": []
+}
diff --git a/packages/runtime/src/scr_json.c b/packages/runtime/src/scr_json.c
index 6174913c0b..83b56bea4d 100644
--- a/packages/runtime/src/scr_json.c
+++ b/packages/runtime/src/scr_json.c
@@ -4356,6 +4356,60 @@ bool scr_dyn_data_view_is(const ScrDyn *value) {
   return value->kind == SCR_DYN_BYTES && value->v.bytes->is_data_view;
 }
 
+/* util.inspect names an object after the function held by the first own
+ * `constructor` data property on its prototype chain (Node's
+ * getConstructorName). The dyn printer reads runtime class names
+ * (v.obj.class_name, set only on prototypes that stay alive), so a
+ * construction through a plain function stamps that prototype with a copy
+ * of the function's name and keeps it alive. The copy is the stamp's own: a
+ * function's name can live in storage the function owns (a bound
+ * function's "bound <name>"), and the function is released when the
+ * writable `constructor` property is replaced. The stamps are cleared and
+ * their copies freed before release at exit, so freelist reuse never sees
+ * them. */
+typedef struct {
+  ScrDyn *prototype;
+  char *name;
+} ScrDynNamedPrototype;
+static SCR_TL ScrDynNamedPrototype *scr_dyn_named_prototypes;
+static SCR_TL size_t scr_dyn_named_count, scr_dyn_named_cap;
+
+static void scr_dyn_named_prototypes_cleanup(void) {
+  for (size_t i = 0; i < scr_dyn_named_count; i++) {
+    scr_dyn_named_prototypes[i].prototype->v.obj.class_name = NULL;
+    scr_dyn_release(scr_dyn_named_prototypes[i].prototype);
+    free(scr_dyn_named_prototypes[i].name);
+  }
+  free(scr_dyn_named_prototypes);
+  scr_dyn_named_prototypes = NULL;
+  scr_dyn_named_count = scr_dyn_named_cap = 0;
+}
+
+static void scr_dyn_name_prototype_chain(const ScrDyn *object) {
+  for (ScrDyn *p = object->prototype; p; p = p->prototype) {
+    if (p->kind != SCR_DYN_OBJ || p->v.obj.class_name) return;
+    ScrDynEntry *entry = scr_dyn_find_entry(p, "constructor", 11);
+    if (!entry || entry->accessor || !entry->value || entry->value->kind != SCR_DYN_FUNC) continue;
+    const char *name = entry->value->v.fn.name;
+    if (!name || !name[0]) continue;
+    if (scr_dyn_named_count == scr_dyn_named_cap) {
+      if (scr_dyn_named_cap == 0) scr_atexit(scr_dyn_named_prototypes_cleanup);
+      size_t cap = scr_dyn_named_cap ? scr_dyn_named_cap * 2 : 8;
+      ScrDynNamedPrototype *grown = realloc(scr_dyn_named_prototypes, cap * sizeof *grown);
+      if (!grown) scr_json_oom();
+      scr_dyn_named_prototypes = grown;
+      scr_dyn_named_cap = cap;
+    }
+    size_t len = strlen(name);
+    char *copy = malloc(len + 1);
+    if (!copy) scr_json_oom();
+    memcpy(copy, name, len + 1);
+    p->v.obj.class_name = copy;
+    scr_dyn_named_prototypes[scr_dyn_named_count++] = (ScrDynNamedPrototype){ scr_dyn_retain(p), copy };
+    return;
+  }
+}
+
 /* Ordinary native function constructors retain their live prototype table.
  * A constructor may replace the fresh receiver with another object. */
 ScrDyn *scr_dyn_construct(const ScrDyn *callee, const ScrDyn *args, const ScrStr *what) {
@@ -4366,6 +4420,7 @@ ScrDyn *scr_dyn_construct(const ScrDyn *callee, const ScrDyn *args, const ScrStr
   ScrDyn *receiver = scr_iterator_object(prototype) ? scr_dyn_obj_create(prototype) : scr_dyn_new_obj();
   scr_dyn_release(prototype);
   if (!receiver) return NULL;
+  scr_dyn_name_prototype_chain(receiver);
   scr_dyn_this_push_dyn(receiver);
   ScrDyn *result = scr_dyn_call(callee, args->v.arr.items, args->v.arr.len, what->data);
   scr_dyn_this_pop();
diff --git a/tests/corpus/bound-constructor-inspect-names.cjs b/tests/corpus/bound-constructor-inspect-names.cjs
new file mode 100644
index 0000000000..52faa689c7
--- /dev/null
+++ b/tests/corpus/bound-constructor-inspect-names.cjs
@@ -0,0 +1,36 @@
+'use strict';
+// util.inspect names an object after the function in the first own
+// `constructor` property on its prototype chain. Here that function is a
+// bound function, whose name ("bound " and the target's name) is built at
+// bind time, and the property is replaced after construction, which
+// releases the first bound function. The instance keeps the name. The
+// targets are anonymous, so the bound names are "bound " and "bound bound ".
+const util = require('util');
+
+// Array elements give the functions no name.
+const [Point, Pair] = [
+  function (x) {
+    this.x = x;
+  },
+  function (a, b) {
+    this.a = a;
+    this.b = b;
+  },
+];
+Point.prototype.constructor = Point.bind(null);
+const p = new Point(1);
+console.log(util.inspect(p));
+
+Point.prototype.constructor = Point.bind(null);
+const filler = [];
+for (let i = 0; i < 200; i++) filler.push('bound '.repeat(i % 5) + i);
+console.log(util.inspect(p));
+console.log(p);
+console.log(filler.length);
+
+// A bound function of a bound function, replaced the same way.
+Pair.prototype.constructor = Pair.bind(null).bind(null);
+const q = new Pair(1, 2);
+Pair.prototype.constructor = Pair.bind(null).bind(null);
+console.log(util.inspect(q));
+console.log(q);
diff --git a/tests/corpus/builtin-function-record-values/main.ts b/tests/corpus/builtin-function-record-values/main.ts
new file mode 100644
index 0000000000..c742acc161
--- /dev/null
+++ b/tests/corpus/builtin-function-record-values/main.ts
@@ -0,0 +1,10 @@
+// A builtin function stored in a JavaScript record is a real function:
+// TypeScript consumers call it through the record.
+import native from "./native.js";
+const shape = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const id = native.randomUUID();
+console.log(typeof id, id.length, shape.test(id));
+const ids = new Set<string>();
+for (let i = 0; i < 50; i++) ids.add(native.randomUUID());
+console.log(ids.size);
+console.log(shape.test(native.randomUUID({ disableEntropyCache: true })));
diff --git a/tests/corpus/builtin-function-record-values/native.js b/tests/corpus/builtin-function-record-values/native.js
new file mode 100644
index 0000000000..7009a2cd95
--- /dev/null
+++ b/tests/corpus/builtin-function-record-values/native.js
@@ -0,0 +1,3 @@
+// uuid's native.js layout: a record exporting a builtin function value.
+import { randomUUID } from "crypto";
+export default { randomUUID };
diff --git a/tests/corpus/builtin-function-values.mjs b/tests/corpus/builtin-function-values.mjs
new file mode 100644
index 0000000000..ad03312919
--- /dev/null
+++ b/tests/corpus/builtin-function-values.mjs
@@ -0,0 +1,17 @@
+// Builtin functions used as JavaScript values are functions: typeof,
+// identity, their name, and calls through the value.
+import { randomUUID, scryptSync } from "crypto";
+const table = { randomUUID, scryptSync };
+console.log(typeof table.randomUUID, table.randomUUID === randomUUID);
+console.log(/^[0-9a-f-]{36}$/.test(table.randomUUID()));
+console.log(/^[0-9a-f-]{36}$/.test(table.randomUUID(undefined)));
+try {
+  table.randomUUID(5);
+} catch (e) {
+  console.log(e.code, e.name);
+}
+console.log(table.randomUUID);
+console.log(typeof table.scryptSync, table.scryptSync === scryptSync);
+console.log(new Set([scryptSync]).has(table.scryptSync), table.scryptSync.name);
+const pick = (useNative) => (useNative && table.randomUUID ? table.randomUUID() : "fallback");
+console.log(pick(true).length, pick(false));
diff --git a/tests/corpus/constructor-returns-chained-this.js b/tests/corpus/constructor-returns-chained-this.js
new file mode 100644
index 0000000000..c3a2a04696
--- /dev/null
+++ b/tests/corpus/constructor-returns-chained-this.js
@@ -0,0 +1,40 @@
+// The JavaScript shape three.js ships: the constructor returns a chainable
+// setter's result and other classes extend it.
+class Color {
+  constructor(r, g, b) {
+    this.isColor = true;
+    this.r = 1;
+    this.g = 1;
+    this.b = 1;
+    return this.set(r, g, b);
+  }
+  set(r, g, b) {
+    if (g === undefined && b === undefined) {
+      if (r !== undefined) this.setScalar(r);
+    } else {
+      this.r = r;
+      this.g = g;
+      this.b = b;
+    }
+    return this;
+  }
+  setScalar(s) {
+    this.r = this.g = this.b = s;
+    return this;
+  }
+}
+class Tinted extends Color {
+  constructor(r, g, b, tint) {
+    super(r, g, b);
+    this.tint = tint;
+  }
+  set(r, g, b, a = 1) {
+    this.a = a;
+    return super.set(r, g, b);
+  }
+}
+const c = new Color(0.5);
+console.log(c.r, c.g, c.b, c instanceof Color);
+const t = new Tinted(0.1, 0.2, 0.3, 'warm');
+console.log(t.r, t.g, t.b, t.a, t.tint, t instanceof Tinted, t instanceof Color);
+console.log(new Color().r);
diff --git a/tests/corpus/constructor-returns-chained-this.ts b/tests/corpus/constructor-returns-chained-this.ts
new file mode 100644
index 0000000000..d2a9f39558
--- /dev/null
+++ b/tests/corpus/constructor-returns-chained-this.ts
@@ -0,0 +1,38 @@
+// A constructor that ends with `return this.set(...)`, where every
+// reachable `set` returns `this`, answers the constructed instance, so
+// subclasses still construct through super() (three.js's Color).
+class Color {
+  r = 0;
+  g = 0;
+  b = 0;
+  constructor(r?: number, g?: number, b?: number) {
+    return this.set(r ?? 0, g ?? 0, b ?? 0);
+  }
+  set(r: number, g: number, b: number): this {
+    if (r < 0) return this.clear();
+    this.r = r;
+    this.g = g;
+    this.b = b;
+    return this;
+  }
+  clear(): this {
+    this.r = this.g = this.b = 0;
+    return this;
+  }
+}
+class NamedColor extends Color {
+  name: string;
+  constructor(name: string, r: number, g: number, b: number) {
+    super(r, g, b);
+    this.name = name;
+  }
+  override set(r: number, g: number, b: number): this {
+    super.set(r * 2, g * 2, b * 2);
+    return this;
+  }
+}
+const plain = new Color(1, 2, 3);
+console.log(plain instanceof Color, plain.r, plain.g, plain.b);
+console.log(new Color(-1, 5, 5).r, new Color().b);
+const named = new NamedColor("teal", 0, 1, 2);
+console.log(named instanceof NamedColor, named instanceof Color, named.name, named.r, named.g, named.b);
diff --git a/tests/corpus/constructor-returns-instance.js b/tests/corpus/constructor-returns-instance.js
new file mode 100644
index 0000000000..ab7af8b2c9
--- /dev/null
+++ b/tests/corpus/constructor-returns-instance.js
@@ -0,0 +1,45 @@
+// JavaScript constructors whose returned value is typed only at run time:
+// an instance of the class replaces `this`, a primitive keeps it.
+class Connection {
+  constructor(url) {
+    if (Connection.open && Connection.open.url === url) return Connection.open;
+    this.url = url;
+    this.uses = 0;
+    Connection.open = this;
+  }
+  use() {
+    this.uses++;
+    return this;
+  }
+}
+const c1 = new Connection("db://a").use();
+const c2 = new Connection("db://a").use();
+const c3 = new Connection("db://b").use();
+console.log(c1 === c2, c2.uses, c3 === c1, c3.uses, c3.url);
+
+class Counter {
+  constructor(start, answer) {
+    this.count = start;
+    return answer;
+  }
+}
+console.log(new Counter(1, 5).count, new Counter(2, "x").count, new Counter(3, null).count);
+console.log(new Counter(4, undefined).count, new Counter(5, true).count);
+const kept = new Counter(6, 0);
+console.log(new Counter(7, kept) === kept, kept.count);
+
+const memoCache = new Map();
+let memoCreated = 0;
+class Memo {
+  constructor(key) {
+    const hit = memoCache.get(key);
+    if (hit !== undefined) return hit;
+    this.key = key;
+    this.created = ++memoCreated;
+    memoCache.set(key, this);
+  }
+}
+const m1 = new Memo("k");
+const m2 = new Memo("k");
+const m3 = new Memo("j");
+console.log(m1 === m2, m3 === m1, m2.created, m3.created, memoCreated);
diff --git a/tests/corpus/constructor-returns-instance.ts b/tests/corpus/constructor-returns-instance.ts
new file mode 100644
index 0000000000..81e25a12de
--- /dev/null
+++ b/tests/corpus/constructor-returns-instance.ts
@@ -0,0 +1,112 @@
+// A constructor's returned object replaces the constructed instance when it
+// is an object; primitive, bare and `this` returns answer the instance.
+class Registry {
+  static current: Registry | undefined = undefined;
+  readonly id: number = 0;
+  entries: string[] = [];
+  constructor(id: number) {
+    if (Registry.current) return Registry.current;
+    this.id = id;
+    Registry.current = this;
+  }
+  add(entry: string): this {
+    this.entries.push(entry);
+    return this;
+  }
+}
+const first = new Registry(1).add("a");
+const second = new Registry(2).add("b");
+console.log(first === second, second.id, second.entries.join(","));
+
+// An instance returned only on some paths.
+class Slot {
+  static previous: Slot | undefined = undefined;
+  label: string;
+  constructor(label: string, reuse: boolean) {
+    this.label = label;
+    const previous = Slot.previous;
+    Slot.previous = this;
+    if (reuse && previous) return previous;
+  }
+}
+const s1 = new Slot("one", true);
+const s2 = new Slot("two", true);
+const s3 = new Slot("three", false);
+console.log(s1.label, s2.label, s3.label, s2 === s1, s3 === s2);
+
+// Constructing the class again inside its own constructor.
+class Node2 {
+  static made = 0;
+  value: number;
+  child: Node2 | null = null;
+  constructor(depth: number, share: Node2 | null) {
+    Node2.made++;
+    this.value = depth;
+    if (share !== null) return share;
+    if (depth > 0) this.child = new Node2(depth - 1, null);
+  }
+}
+const root = new Node2(2, null);
+const alias = new Node2(9, root);
+console.log(alias === root, alias.value, root.child?.value, root.child?.child?.value, Node2.made);
+
+// A constructor that throws leaves later constructions unaffected.
+class Guarded {
+  static kept: Guarded | undefined = undefined;
+  n: number;
+  constructor(n: number) {
+    if (n < 0) throw new RangeError(`negative: ${n}`);
+    this.n = n;
+    if (n === 0 && Guarded.kept) return Guarded.kept;
+    Guarded.kept = this;
+  }
+}
+try {
+  new Guarded(-1);
+} catch (e) {
+  console.log((e as Error).message);
+}
+const g1 = new Guarded(5);
+const g2 = new Guarded(0);
+const g3 = new Guarded(7);
+console.log(g1.n, g2.n, g3.n, g1 === g2, g3 === g1);
+
+// Primitive, bare and `this` returns keep the constructed instance.
+class Plain {
+  v = 3;
+  constructor(mode: number) {
+    if (mode === 1) return;
+    if (mode === 2) return this;
+  }
+}
+const plain = new Plain(2);
+console.log(new Plain(0).v, new Plain(1).v, plain.v, plain instanceof Plain);
+
+// The derived class's own constructor may return an instance of itself.
+class Animal {
+  sound = "...";
+}
+class Dog extends Animal {
+  static pack: Dog[] = [];
+  name: string;
+  constructor(name: string) {
+    super();
+    this.name = name;
+    this.sound = "woof";
+    const known = Dog.pack.find((d) => d.name === name);
+    if (known) return known;
+    Dog.pack.push(this);
+  }
+}
+const rex = new Dog("rex");
+const again = new Dog("rex");
+const fido = new Dog("fido");
+console.log(rex === again, fido === rex, Dog.pack.length, again.sound, again instanceof Animal);
+
+// Constructions through class values take the returned instance too.
+const Ctor: typeof Registry = Registry;
+console.log(new Ctor(3) === first);
+function build<T>(make: new (id: number) => T, id: number): T {
+  return new make(id);
+}
+console.log(build(Registry, 4) === first, build(Registry, 5).entries.length);
diff --git a/tests/corpus/constructor-returns-this-super.js b/tests/corpus/constructor-returns-this-super.js
new file mode 100644
index 0000000000..3901c55536
--- /dev/null
+++ b/tests/corpus/constructor-returns-this-super.js
@@ -0,0 +1,33 @@
+// A JavaScript base constructor that returns `this` through a method, as
+// three.js's Color does: `super()` from a subclass keeps the subclass's own
+// instance.
+class Color {
+  constructor(r, g, b) {
+    this.r = 1;
+    this.g = 1;
+    this.b = 1;
+    return this.set(r, g, b);
+  }
+  set(r, g, b) {
+    if (g === undefined) {
+      this.r = this.g = this.b = r;
+    } else {
+      this.r = r;
+      this.g = g;
+      this.b = b;
+    }
+    return this;
+  }
+}
+class Color4 extends Color {
+  constructor(r, g, b, a = 1) {
+    super(r, g, b);
+    this.a = a;
+  }
+}
+const c = new Color(0.5);
+const c4 = new Color4(0.1, 0.2, 0.3);
+const c4b = new Color4(1, 0, 0, 0.5);
+console.log(c.r, c.g, c.b, c instanceof Color);
+console.log(c4.r, c4.g, c4.b, c4.a, c4 instanceof Color4, c4 instanceof Color);
+console.log(c4b.a, c4b !== c4, Object.keys(c4b).join(","));
diff --git a/tests/corpus/es5-constructor-inspect-names.cjs b/tests/corpus/es5-constructor-inspect-names.cjs
new file mode 100644
index 0000000000..b7cc843491
--- /dev/null
+++ b/tests/corpus/es5-constructor-inspect-names.cjs
@@ -0,0 +1,41 @@
+// util.inspect names objects built by plain constructor functions after
+// the constructor their prototype chain records, as Node does.
+'use strict';
+const util = require('util');
+function Point(x, y) {
+  this.x = x;
+  this.y = y;
+}
+Point.prototype.norm = function () {
+  return Math.hypot(this.x, this.y);
+};
+const p = new Point(3, 4);
+console.log(p, p.norm());
+p.z = 0;
+console.log(p);
+function Empty() {}
+console.log(new Empty(), [new Empty()], { inner: new Empty() });
+console.log(util.inspect(new Point(1, 2)));
+console.log(`${util.inspect({ list: [new Point(0, 1)] })}`);
+// A subclass whose prototype was replaced without a constructor reports
+// the nearest constructor on the chain.
+function Base(n) {
+  this.n = n;
+}
+function Derived(n) {
+  Base.call(this, n);
+  this.extra = true;
+}
+Derived.prototype = Object.create(Base.prototype);
+console.log(new Derived(1));
+Derived.prototype.constructor = Derived;
+console.log(new Derived(2));
+// A replaced prototype object without a constructor prints plainly.
+function Plain() {
+  this.v = 1;
+}
+Plain.prototype = { get() { return this.v; } };
+console.log(new Plain());
+const made = Object.create(Point.prototype);
+made.x = 9;
+console.log(made);
diff --git a/tests/corpus/exponent-unit-base.ts b/tests/corpus/exponent-unit-base.ts
new file mode 100644
index 0000000000..d8d4cd1ac9
--- /dev/null
+++ b/tests/corpus/exponent-unit-base.ts
@@ -0,0 +1,16 @@
+// `**` answers NaN for a base of ±1 with a NaN or infinite exponent, where
+// libm's pow (and LLVM's folding of pow(1, x)) answers 1.
+const values = [Infinity, -Infinity, NaN, 0, -0, 2, 0.5];
+const read = (i: number): number => values[i % values.length]!;
+for (let i = 0; i < values.length; i++) {
+  const x = read(i);
+  console.log(x, 1 ** x, (-1) ** x, x ** 0, x ** 1, 2 ** x, x ** -1);
+}
+let base = 1;
+let exponent = Infinity;
+console.log(base ** exponent, (-base) ** exponent, base ** NaN);
+exponent = 3;
+console.log(base ** exponent, (-1) ** exponent);
+let acc = 1;
+acc **= Infinity;
+console.log(acc, Math.pow(1, Infinity), NaN ** 0, (-0) ** -1, 0 ** -1);
diff --git a/tests/corpus/let-uninitialized-function-binding.ts b/tests/corpus/let-uninitialized-function-binding.ts
new file mode 100644
index 0000000000..ade6748d30
--- /dev/null
+++ b/tests/corpus/let-uninitialized-function-binding.ts
@@ -0,0 +1,46 @@
+// A module-scope `let` declared without an initializer is initialized (to
+// undefined) where the declaration runs, so a later assignment of a closure
+// that calls the binding itself is an ordinary write.
+type Step = (n: number) => number;
+
+// A write that runs before the declaration is still in the dead zone.
+function early(): void {
+  late = () => 1;
+}
+try {
+  early();
+} catch (e) {
+  console.log((e as Error).name, (e as Error).message);
+}
+let late: () => number;
+late = () => 2;
+early();
+console.log(late());
+
+let countdown: Step;
+countdown = (n) => (n <= 0 ? 0 : 1 + countdown(n - 1));
+console.log(countdown(5));
+
+let log: (s: string) => void;
+log = (s) => {
+  if (s.length < 3) log(s + "!");
+  else console.log(s);
+};
+log("a");
+
+// Reassignment and assignment from a function body after the declaration.
+let pick: (xs: number[]) => number;
+function install(largest: boolean): void {
+  pick = largest ? (xs) => Math.max(...xs) : (xs) => Math.min(...xs);
+}
+install(true);
+console.log(pick!([3, 9, 4]));
+install(false);
+console.log(pick!([3, 9, 4]));
+
+// Mutual recursion through two such bindings.
+let isEven: (n: number) => boolean;
+let isOdd: (n: number) => boolean;
+isEven = (n) => (n === 0 ? true : isOdd(n - 1));
+isOdd = (n) => (n === 0 ? false : isEven(n - 1));
+console.log(isEven(10), isOdd(7), isEven(3));
diff --git a/tests/corpus/logical-and-truthy-index.ts b/tests/corpus/logical-and-truthy-index.ts
new file mode 100644
index 0000000000..b89e4d78da
--- /dev/null
+++ b/tests/corpus/logical-and-truthy-index.ts
@@ -0,0 +1,44 @@
+// `&&` whose left operand is an array, object or function value: every
+// object is truthy, so the result is the right operand, here an element
+// read that may be undefined at run time.
+const list = [3, 1, 2];
+const head = list && list[0];
+console.log(head);
+const words: string[] = ["x"];
+console.log(words && words[0], words && words[5]);
+const empty: number[] = [];
+console.log(empty && empty[0]);
+function first(xs: (string | number)[]): string | number {
+  return xs && xs[0];
+}
+console.log(first([1]), first(["s"]));
+type Item = { n: number } | string;
+const items: Item[] = [{ n: 1 }, "z"];
+console.log(items && items[0], items && items[1]);
+const nested: number[][] = [[1]];
+console.log(nested && nested[0]);
+const flags: boolean[] = [false];
+console.log(flags && flags[0]);
+const maybe: (number | null)[] = [null];
+console.log(maybe && maybe[0]);
+const holes: (number | undefined)[] = [undefined, 4];
+console.log(holes && holes[0], holes && holes[1]);
+const box = { k: [1, 2] };
+console.log(box.k && box.k[1]);
+// The left operand still evaluates exactly once.
+let reads = 0;
+const source = (): number[] => {
+  reads++;
+  return [7, 8];
+};
+console.log(source() && source()[1], reads);
+const table: Record<string, number[]> = { a: [5] };
+const pick = (key: string): number | undefined => table[key] && table[key][0];
+console.log(pick("a"), reads);
+class Holder {
+  xs = [1, 2];
+  second(): number | undefined {
+    return this.xs && this.xs[1];
+  }
+}
+console.log(new Holder().second());
diff --git a/tests/diagnostics/constructor-returns-instance-super.ts b/tests/diagnostics/constructor-returns-instance-super.ts
new file mode 100644
index 0000000000..c5e34c7a1a
--- /dev/null
+++ b/tests/diagnostics/constructor-returns-instance-super.ts
@@ -0,0 +1,15 @@
+// `super()` into a constructor that can return an existing instance would
+// rebind the subclass's `this` to that instance.
+class Shared {
+  static one: Shared | undefined = undefined;
+  constructor() {
+    if (Shared.one) return Shared.one;
+    Shared.one = this;
+  }
+}
+class Derived extends Shared {
+  constructor() {
+    super();
+  }
+}
+console.log(new Derived() instanceof Derived);
diff --git a/tests/diagnostics/constructor-returns-object.ts b/tests/diagnostics/constructor-returns-object.ts
new file mode 100644
index 0000000000..63abf4c4d8
--- /dev/null
+++ b/tests/diagnostics/constructor-returns-object.ts
@@ -0,0 +1,10 @@
+// Node's `new Point()` answers the object a constructor returns. A plain
+// object has no representation as a Point instance, so the return refuses
+// instead of answering the constructed instance.
+class Point {
+  x = 1;
+  constructor() {
+    return { x: 2 };
+  }
+}
+console.log(new Point().x);
diff --git a/tests/harness/__snapshots__/constructor-returns-instance-super.ts.txt b/tests/harness/__snapshots__/constructor-returns-instance-super.ts.txt
new file mode 100644
index 0000000000..53a01d4318
--- /dev/null
+++ b/tests/harness/__snapshots__/constructor-returns-instance-super.ts.txt
@@ -0,0 +1,6 @@
+constructor-returns-instance-super.ts:11:3 - error SC1090: extending a class whose constructor can return an existing instance ('super()' would rebind 'this' to the instance 'Shared' returns) is not supported yet
+
+  10 | class Derived extends Shared {
+  11 |   constructor() {
+     |   ^~~~~~~~~~~~~~~
+  12 |     super();
\ No newline at end of file
diff --git a/tests/harness/__snapshots__/constructor-returns-object.ts.txt b/tests/harness/__snapshots__/constructor-returns-object.ts.txt
new file mode 100644
index 0000000000..fe2220d563
--- /dev/null
+++ b/tests/harness/__snapshots__/constructor-returns-object.ts.txt
@@ -0,0 +1,6 @@
+constructor-returns-object.ts:7:5 - error SC1090: returning an object other than an instance of the class from a constructor (Node's 'new Point()' answers the returned object, which has no representation as a 'Point' instance) is not supported yet
+
+  6 |   constructor() {
+  7 |     return { x: 2 };
+    |     ^~~~~~~~~~~~~~~~
+  8 |   }
\ No newline at end of file
diff --git a/tests/harness/corpus-costs.json b/tests/harness/corpus-costs.json
index 1cb2f1a143..381132f84e 100644
--- a/tests/harness/corpus-costs.json
+++ b/tests/harness/corpus-costs.json
@@ -2521,6 +2521,7 @@
     "constant-module-globals/main.ts": 2455,
     "constant-number-remainders.ts": 2350,
     "constructed-class-dispatch.ts": 3014,
+    "constructor-returns-this-super.js": 2431,
     "contextual-array-union-write.ts": 5379,
     "contextual-return-layouts.ts": 2919,
     "counted-loop-numbers.ts": 2515,
@@ -5613,6 +5614,7 @@
     "constant-module-globals/main.ts": 2911,
     "constant-number-remainders.ts": 2372,
     "constructed-class-dispatch.ts": 3382,
+    "constructor-returns-this-super.js": 4629,
     "contextual-array-union-write.ts": 6417,
     "contextual-return-layouts.ts": 3746,
     "counted-loop-numbers.ts": 2724,
diff --git a/tests/harness/corpus-costs/bound-constructor-inspect-names.cjs.json b/tests/harness/corpus-costs/bound-constructor-inspect-names.cjs.json
new file mode 100644
index 0000000000..ab2bc177b4
--- /dev/null
+++ b/tests/harness/corpus-costs/bound-constructor-inspect-names.cjs.json
@@ -0,0 +1 @@
+{ "plain": 2400, "san": 2700 }
diff --git a/tests/harness/errors.test.ts b/tests/harness/errors.test.ts
index 92ac8f5ab5..2092b5467e 100644
--- a/tests/harness/errors.test.ts
+++ b/tests/harness/errors.test.ts
@@ -1051,6 +1051,107 @@ console.log(typeof Derived);
   });
 });
 
+describe("constructors returning objects (JS lane)", () => {
+  test("a returned plain object is a named deferred fence", async () => {
+    // Node's `new Box(2)` answers `{ size: 99 }`; a Box instance cannot
+    // hold that object, so the return refuses instead of answering `this`.
+    const r = await compileAndRun(
+      "constructor-returns-object",
+      `'use strict';
+class Box {
+  constructor(size) {
+    this.size = size;
+    if (size > 1) return { size: 99 };
+  }
+}
+console.log(new Box(1).size);
+console.log(new Box(2));
+`,
+      "cjs",
+    );
+    expect(r.exitCode).toBe(1);
+    expect(r.stdout).toBe("1\n");
+    expect(r.stderr).toMatch(
+      /^Uncaught Error: returning an object other than an instance of the class from a constructor \(Node's 'new Box\(\)' answers the returned object, .*\) is not supported yet \[SC1090 at .*constructor-returns-object\.cjs:5\]\n$/,
+    );
+  });
+
+  test("an untyped returned value fences only when it holds a foreign object", async () => {
+    // Primitive results answer the constructed instance, as in Node; an
+    // object that is not a Wrap instance refuses.
+    const r = await compileAndRun(
+      "constructor-returns-untyped",
+      `'use strict';
+class Wrap {
+  constructor(value) {
+    this.value = value;
+    return value;
+  }
+}
+console.log(new Wrap(1).value, new Wrap('s').value, new Wrap(null).value);
+const w = new Wrap(0);
+console.log(new Wrap(w) === w);
+console.log(new Wrap({ a: 1 }));
+`,
+      "cjs",
+    );
+    expect(r.exitCode).toBe(1);
+    expect(r.stdout).toBe("1 s null\ntrue\n");
+    expect(r.stderr).toMatch(
+      /^Uncaught Error: returning an object other than an instance of the class from a constructor .* is not supported yet \[SC1090 at .*constructor-returns-untyped\.cjs:5\]\n$/,
+    );
+  });
+});
+
+describe("module exports that read this, called through the module binding (JS lane)", () => {
+  test("a require binding's member call is a named deferred fence", async () => {
+    // Node passes the exports object as `this` to `m.hello()`; the direct
+    // call has none to pass, so it refuses instead of reading another one.
+    const r = await compileAndRun(
+      "require-member-this",
+      `'use strict';
+const m = require('./lib.cjs');
+console.log(m.plain(21));
+console.log(m.hello());
+`,
+      "cjs",
+      {
+        "lib.cjs": `'use strict';
+exports.name = 'lib';
+exports.hello = function () { return 'hi from ' + this.name; };
+exports.plain = function (x) { return x * 2; };
+`,
+      },
+    );
+    expect(r.exitCode).toBe(1);
+    expect(r.stdout).toBe("42\n");
+    expect(r.stderr).toMatch(
+      /^Uncaught Error: calling a module export that reads 'this' through its module binding \('hello': .*\) is not supported yet \[SC1090 at .*require-member-this\.cjs:4\]\n$/,
+    );
+  });
+
+  test("a namespace import's member call is a named deferred fence", async () => {
+    const r = await compileAndRun(
+      "namespace-member-this",
+      `import * as ns from './lib.mjs';
+console.log(ns.plain(1));
+console.log(ns.who());
+`,
+      "mjs",
+      {
+        "lib.mjs": `export function who() { return typeof this; }
+export function plain(x) { return x + 1; }
+`,
+      },
+    );
+    expect(r.exitCode).toBe(1);
+    expect(r.stdout).toBe("2\n");
+    expect(r.stderr).toMatch(
+      /^Uncaught Error: calling a module export that reads 'this' through its module binding \('who': .*\) is not supported yet \[SC1090 at .*namespace-member-this\.mjs:3\]\n$/,
+    );
+  });
+});
+
 // CommonJS forms around the module's exports that keep a refusal name the
 // construct itself (they used to report an unlowerable `require` value, a
 // "binding form with no lowering", or the ES-module `module` message).