diff --git a/Analysis/include/Luau/Anyification.h b/Analysis/include/Luau/Anyification.h
index 7b6f71716..c81dc3fb5 100644
--- a/Analysis/include/Luau/Anyification.h
+++ b/Analysis/include/Luau/Anyification.h
@@ -4,7 +4,7 @@
 
 #include "Luau/NotNull.h"
 #include "Luau/Substitution.h"
-#include "Luau/Type.h"
+#include "Luau/TypeFwd.h"
 
 #include <memory>
 
@@ -39,4 +39,4 @@ struct Anyification : Substitution
     bool ignoreChildren(TypePackId ty) override;
 };
 
-} // namespace Luau
\ No newline at end of file
+} // namespace Luau
diff --git a/Analysis/include/Luau/ApplyTypeFunction.h b/Analysis/include/Luau/ApplyTypeFunction.h
index 3f5f47fd4..71430b28f 100644
--- a/Analysis/include/Luau/ApplyTypeFunction.h
+++ b/Analysis/include/Luau/ApplyTypeFunction.h
@@ -3,7 +3,7 @@
 
 #include "Luau/Substitution.h"
 #include "Luau/TxnLog.h"
-#include "Luau/Type.h"
+#include "Luau/TypeFwd.h"
 
 namespace Luau
 {
diff --git a/Analysis/include/Luau/AstQuery.h b/Analysis/include/Luau/AstQuery.h
index e7a018c0a..7652a89f0 100644
--- a/Analysis/include/Luau/AstQuery.h
+++ b/Analysis/include/Luau/AstQuery.h
@@ -3,6 +3,7 @@
 
 #include "Luau/Ast.h"
 #include "Luau/Documentation.h"
+#include "Luau/TypeFwd.h"
 
 #include <memory>
 
@@ -13,9 +14,6 @@ struct Binding;
 struct SourceModule;
 struct Module;
 
-struct Type;
-using TypeId = const Type*;
-
 using ScopePtr = std::shared_ptr<struct Scope>;
 
 struct ExprOrLocal
diff --git a/Analysis/include/Luau/Breadcrumb.h b/Analysis/include/Luau/Breadcrumb.h
deleted file mode 100644
index 59b293a0b..000000000
--- a/Analysis/include/Luau/Breadcrumb.h
+++ /dev/null
@@ -1,75 +0,0 @@
-// This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
-#pragma once
-
-#include "Luau/Def.h"
-#include "Luau/NotNull.h"
-#include "Luau/Variant.h"
-
-#include <string>
-#include <optional>
-
-namespace Luau
-{
-
-using NullableBreadcrumbId = const struct Breadcrumb*;
-using BreadcrumbId = NotNull<const struct Breadcrumb>;
-
-struct FieldMetadata
-{
-    std::string prop;
-};
-
-struct SubscriptMetadata
-{
-    BreadcrumbId key;
-};
-
-using Metadata = Variant<FieldMetadata, SubscriptMetadata>;
-
-struct Breadcrumb
-{
-    NullableBreadcrumbId previous;
-    DefId def;
-    std::optional<Metadata> metadata;
-    std::vector<BreadcrumbId> children;
-};
-
-inline Breadcrumb* asMutable(NullableBreadcrumbId breadcrumb)
-{
-    LUAU_ASSERT(breadcrumb);
-    return const_cast<Breadcrumb*>(breadcrumb);
-}
-
-template<typename T>
-const T* getMetadata(NullableBreadcrumbId breadcrumb)
-{
-    if (!breadcrumb || !breadcrumb->metadata)
-        return nullptr;
-
-    return get_if<T>(&*breadcrumb->metadata);
-}
-
-struct BreadcrumbArena
-{
-    TypedAllocator<Breadcrumb> allocator;
-
-    template<typename... Args>
-    BreadcrumbId add(NullableBreadcrumbId previous, DefId def, Args&&... args)
-    {
-        Breadcrumb* bc = allocator.allocate(Breadcrumb{previous, def, std::forward<Args>(args)...});
-        if (previous)
-            asMutable(previous)->children.push_back(NotNull{bc});
-        return NotNull{bc};
-    }
-
-    template<typename T, typename... Args>
-    BreadcrumbId emplace(NullableBreadcrumbId previous, DefId def, Args&&... args)
-    {
-        Breadcrumb* bc = allocator.allocate(Breadcrumb{previous, def, Metadata{T{std::forward<Args>(args)...}}});
-        if (previous)
-            asMutable(previous)->children.push_back(NotNull{bc});
-        return NotNull{bc};
-    }
-};
-
-} // namespace Luau
diff --git a/Analysis/include/Luau/Constraint.h b/Analysis/include/Luau/Constraint.h
index 67f9470ee..4598efc41 100644
--- a/Analysis/include/Luau/Constraint.h
+++ b/Analysis/include/Luau/Constraint.h
@@ -4,8 +4,8 @@
 #include "Luau/Ast.h" // Used for some of the enumerations
 #include "Luau/DenseHash.h"
 #include "Luau/NotNull.h"
-#include "Luau/Type.h"
 #include "Luau/Variant.h"
+#include "Luau/TypeFwd.h"
 
 #include <string>
 #include <memory>
@@ -16,12 +16,6 @@ namespace Luau
 
 struct Scope;
 
-struct Type;
-using TypeId = const Type*;
-
-struct TypePackVar;
-using TypePackId = const TypePackVar*;
-
 // subType <: superType
 struct SubtypeConstraint
 {
@@ -55,31 +49,6 @@ struct InstantiationConstraint
     TypeId superType;
 };
 
-struct UnaryConstraint
-{
-    AstExprUnary::Op op;
-    TypeId operandType;
-    TypeId resultType;
-};
-
-// let L : leftType
-// let R : rightType
-// in
-//     L op R : resultType
-struct BinaryConstraint
-{
-    AstExprBinary::Op op;
-    TypeId leftType;
-    TypeId rightType;
-    TypeId resultType;
-
-    // When we dispatch this constraint, we update the key at this map to record
-    // the overload that we selected.
-    const AstNode* astFragment;
-    DenseHashMap<const AstNode*, TypeId>* astOriginalCallTypes;
-    DenseHashMap<const AstNode*, TypeId>* astOverloadResolvedTypes;
-};
-
 // iteratee is iterable
 // iterators is the iteration types.
 struct IterableConstraint
@@ -241,6 +210,22 @@ struct RefineConstraint
     TypeId discriminant;
 };
 
+// resultType ~ T0 op T1 op ... op TN
+//
+// op is either union or intersection.  If any of the input types are blocked,
+// this constraint will block unless forced.
+struct SetOpConstraint
+{
+    enum
+    {
+        Intersection,
+        Union
+    } mode;
+
+    TypeId resultType;
+    std::vector<TypeId> types;
+};
+
 // ty ~ reduce ty
 //
 // Try to reduce ty, if it is a TypeFamilyInstanceType. Otherwise, do nothing.
@@ -257,10 +242,9 @@ struct ReducePackConstraint
     TypePackId tp;
 };
 
-using ConstraintV = Variant<SubtypeConstraint, PackSubtypeConstraint, GeneralizationConstraint, InstantiationConstraint, UnaryConstraint,
-    BinaryConstraint, IterableConstraint, NameConstraint, TypeAliasExpansionConstraint, FunctionCallConstraint, PrimitiveTypeConstraint,
-    HasPropConstraint, SetPropConstraint, SetIndexerConstraint, SingletonOrTopTypeConstraint, UnpackConstraint, RefineConstraint, ReduceConstraint,
-    ReducePackConstraint>;
+using ConstraintV = Variant<SubtypeConstraint, PackSubtypeConstraint, GeneralizationConstraint, InstantiationConstraint, IterableConstraint,
+    NameConstraint, TypeAliasExpansionConstraint, FunctionCallConstraint, PrimitiveTypeConstraint, HasPropConstraint, SetPropConstraint,
+    SetIndexerConstraint, SingletonOrTopTypeConstraint, UnpackConstraint, RefineConstraint, SetOpConstraint, ReduceConstraint, ReducePackConstraint>;
 
 struct Constraint
 {
diff --git a/Analysis/include/Luau/ConstraintGraphBuilder.h b/Analysis/include/Luau/ConstraintGraphBuilder.h
index 955a683ec..bba5ebd93 100644
--- a/Analysis/include/Luau/ConstraintGraphBuilder.h
+++ b/Analysis/include/Luau/ConstraintGraphBuilder.h
@@ -5,15 +5,17 @@
 #include "Luau/Constraint.h"
 #include "Luau/ControlFlow.h"
 #include "Luau/DataFlowGraph.h"
+#include "Luau/InsertionOrderedMap.h"
 #include "Luau/Module.h"
 #include "Luau/ModuleResolver.h"
+#include "Luau/Normalize.h"
 #include "Luau/NotNull.h"
 #include "Luau/Refinement.h"
 #include "Luau/Symbol.h"
-#include "Luau/Type.h"
+#include "Luau/TypeFwd.h"
 #include "Luau/TypeUtils.h"
 #include "Luau/Variant.h"
-#include "Normalize.h"
+#include "Luau/Normalize.h"
 
 #include <memory>
 #include <vector>
@@ -69,11 +71,18 @@ struct ConstraintGraphBuilder
     // This is null when the CGB is initially constructed.
     Scope* rootScope;
 
+    struct InferredBinding
+    {
+        Scope* scope;
+        Location location;
+        TypeIds types;
+    };
+
     // During constraint generation, we only populate the Scope::bindings
     // property for annotated symbols.  Unannotated symbols must be handled in a
-    // postprocessing step because we do not yet have the full breadcrumb graph.
-    // We queue them up here.
-    std::vector<std::tuple<Scope*, Symbol, BreadcrumbId>> inferredBindings;
+    // postprocessing step because we have not yet allocated the types that will
+    // be assigned to those unannotated symbols, so we queue them up here.
+    std::map<Symbol, InferredBinding> inferredBindings;
 
     // Constraints that go straight to the solver.
     std::vector<ConstraintPtr> constraints;
@@ -155,6 +164,18 @@ struct ConstraintGraphBuilder
      */
     NotNull<Constraint> addConstraint(const ScopePtr& scope, std::unique_ptr<Constraint> c);
 
+    struct RefinementPartition
+    {
+        // Types that we want to intersect against the type of the expression.
+        std::vector<TypeId> discriminantTypes;
+
+        // Sometimes the type we're discriminating against is implicitly nil.
+        bool shouldAppendNilType = false;
+    };
+
+    using RefinementContext = InsertionOrderedMap<DefId, RefinementPartition>;
+    void unionRefinements(const RefinementContext& lhs, const RefinementContext& rhs, RefinementContext& dest, std::vector<ConstraintV>* constraints);
+    void computeRefinement(const ScopePtr& scope, RefinementId refinement, RefinementContext* refis, bool sense, bool eq, std::vector<ConstraintV>* constraints);
     void applyRefinements(const ScopePtr& scope, Location location, RefinementId refinement);
 
     ControlFlow visitBlockWithoutChildScope(const ScopePtr& scope, AstStatBlock* block);
@@ -211,13 +232,15 @@ struct ConstraintGraphBuilder
     Inference check(const ScopePtr& scope, AstExprTable* expr, std::optional<TypeId> expectedType);
     std::tuple<TypeId, TypeId, RefinementId> checkBinary(const ScopePtr& scope, AstExprBinary* binary, std::optional<TypeId> expectedType);
 
-    TypeId checkLValue(const ScopePtr& scope, AstExpr* expr);
-    TypeId checkLValue(const ScopePtr& scope, AstExprLocal* local);
-    TypeId checkLValue(const ScopePtr& scope, AstExprGlobal* global);
-    TypeId checkLValue(const ScopePtr& scope, AstExprIndexName* indexName);
-    TypeId checkLValue(const ScopePtr& scope, AstExprIndexExpr* indexExpr);
+    std::optional<TypeId> checkLValue(const ScopePtr& scope, AstExpr* expr);
+    std::optional<TypeId> checkLValue(const ScopePtr& scope, AstExprLocal* local);
+    std::optional<TypeId> checkLValue(const ScopePtr& scope, AstExprGlobal* global);
+    std::optional<TypeId> checkLValue(const ScopePtr& scope, AstExprIndexName* indexName);
+    std::optional<TypeId> checkLValue(const ScopePtr& scope, AstExprIndexExpr* indexExpr);
     TypeId updateProperty(const ScopePtr& scope, AstExpr* expr);
 
+    void updateLValueType(AstExpr* lvalue, TypeId ty);
+
     struct FunctionSignature
     {
         // The type of the function.
diff --git a/Analysis/include/Luau/ConstraintSolver.h b/Analysis/include/Luau/ConstraintSolver.h
index 672b46030..3f2feaef1 100644
--- a/Analysis/include/Luau/ConstraintSolver.h
+++ b/Analysis/include/Luau/ConstraintSolver.h
@@ -111,8 +111,6 @@ struct ConstraintSolver
     bool tryDispatch(const PackSubtypeConstraint& c, NotNull<const Constraint> constraint, bool force);
     bool tryDispatch(const GeneralizationConstraint& c, NotNull<const Constraint> constraint, bool force);
     bool tryDispatch(const InstantiationConstraint& c, NotNull<const Constraint> constraint, bool force);
-    bool tryDispatch(const UnaryConstraint& c, NotNull<const Constraint> constraint, bool force);
-    bool tryDispatch(const BinaryConstraint& c, NotNull<const Constraint> constraint, bool force);
     bool tryDispatch(const IterableConstraint& c, NotNull<const Constraint> constraint, bool force);
     bool tryDispatch(const NameConstraint& c, NotNull<const Constraint> constraint);
     bool tryDispatch(const TypeAliasExpansionConstraint& c, NotNull<const Constraint> constraint);
@@ -124,6 +122,7 @@ struct ConstraintSolver
     bool tryDispatch(const SingletonOrTopTypeConstraint& c, NotNull<const Constraint> constraint);
     bool tryDispatch(const UnpackConstraint& c, NotNull<const Constraint> constraint);
     bool tryDispatch(const RefineConstraint& c, NotNull<const Constraint> constraint, bool force);
+    bool tryDispatch(const SetOpConstraint& c, NotNull<const Constraint> constraint, bool force);
     bool tryDispatch(const ReduceConstraint& c, NotNull<const Constraint> constraint, bool force);
     bool tryDispatch(const ReducePackConstraint& c, NotNull<const Constraint> constraint, bool force);
 
diff --git a/Analysis/include/Luau/DataFlowGraph.h b/Analysis/include/Luau/DataFlowGraph.h
index 63be6b942..34a0484a3 100644
--- a/Analysis/include/Luau/DataFlowGraph.h
+++ b/Analysis/include/Luau/DataFlowGraph.h
@@ -3,29 +3,46 @@
 
 // Do not include LValue. It should never be used here.
 #include "Luau/Ast.h"
-#include "Luau/Breadcrumb.h"
 #include "Luau/DenseHash.h"
 #include "Luau/Def.h"
 #include "Luau/Symbol.h"
+#include "Luau/TypedAllocator.h"
 
 #include <unordered_map>
 
 namespace Luau
 {
 
+struct RefinementKey
+{
+    const RefinementKey* parent = nullptr;
+    DefId def;
+    std::optional<std::string> propName;
+};
+
+struct RefinementKeyArena
+{
+    TypedAllocator<RefinementKey> allocator;
+
+    const RefinementKey* leaf(DefId def);
+    const RefinementKey* node(const RefinementKey* parent, DefId def, const std::string& propName);
+};
+
 struct DataFlowGraph
 {
     DataFlowGraph(DataFlowGraph&&) = default;
     DataFlowGraph& operator=(DataFlowGraph&&) = default;
 
-    NullableBreadcrumbId getBreadcrumb(const AstExpr* expr) const;
+    DefId getDef(const AstExpr* expr) const;
+    // Look up for the rvalue breadcrumb for a compound assignment.
+    std::optional<DefId> getRValueDefForCompoundAssign(const AstExpr* expr) const;
 
-    BreadcrumbId getBreadcrumb(const AstLocal* local) const;
-    BreadcrumbId getBreadcrumb(const AstExprLocal* local) const;
-    BreadcrumbId getBreadcrumb(const AstExprGlobal* global) const;
+    DefId getDef(const AstLocal* local) const;
 
-    BreadcrumbId getBreadcrumb(const AstStatDeclareGlobal* global) const;
-    BreadcrumbId getBreadcrumb(const AstStatDeclareFunction* func) const;
+    DefId getDef(const AstStatDeclareGlobal* global) const;
+    DefId getDef(const AstStatDeclareFunction* func) const;
+
+    const RefinementKey* getRefinementKey(const AstExpr* expr) const;
 
 private:
     DataFlowGraph() = default;
@@ -33,17 +50,23 @@ struct DataFlowGraph
     DataFlowGraph(const DataFlowGraph&) = delete;
     DataFlowGraph& operator=(const DataFlowGraph&) = delete;
 
-    DefArena defs;
-    BreadcrumbArena breadcrumbs;
+    DefArena defArena;
+    RefinementKeyArena keyArena;
 
-    DenseHashMap<const AstExpr*, NullableBreadcrumbId> astBreadcrumbs{nullptr};
+    DenseHashMap<const AstExpr*, const Def*> astDefs{nullptr};
 
     // Sometimes we don't have the AstExprLocal* but we have AstLocal*, and sometimes we need to extract that DefId.
-    DenseHashMap<const AstLocal*, NullableBreadcrumbId> localBreadcrumbs{nullptr};
+    DenseHashMap<const AstLocal*, const Def*> localDefs{nullptr};
 
     // There's no AstStatDeclaration, and it feels useless to introduce it just to enforce an invariant in one place.
     // All keys in this maps are really only statements that ambiently declares a symbol.
-    DenseHashMap<const AstStat*, NullableBreadcrumbId> declaredBreadcrumbs{nullptr};
+    DenseHashMap<const AstStat*, const Def*> declaredDefs{nullptr};
+
+    // Compound assignments are in a weird situation where the local being assigned to is also being used at its
+    // previous type implicitly in an rvalue position. This map provides the previous binding.
+    DenseHashMap<const AstExpr*, const Def*> compoundAssignBreadcrumbs{nullptr};
+
+    DenseHashMap<const AstExpr*, const RefinementKey*> astRefinementKeys{nullptr};
 
     friend struct DataFlowGraphBuilder;
 };
@@ -51,15 +74,19 @@ struct DataFlowGraph
 struct DfgScope
 {
     DfgScope* parent;
-    DenseHashMap<Symbol, NullableBreadcrumbId> bindings{Symbol{}};
-    DenseHashMap<const Def*, std::unordered_map<std::string, NullableBreadcrumbId>> props{nullptr};
+    DenseHashMap<Symbol, const Def*> bindings{Symbol{}};
+    DenseHashMap<const Def*, std::unordered_map<std::string, const Def*>> props{nullptr};
 
-    NullableBreadcrumbId lookup(Symbol symbol) const;
-    NullableBreadcrumbId lookup(DefId def, const std::string& key) const;
+    std::optional<DefId> lookup(Symbol symbol) const;
+    std::optional<DefId> lookup(DefId def, const std::string& key) const;
+};
+
+struct DataFlowResult
+{
+    DefId def;
+    const RefinementKey* parent = nullptr;
 };
 
-// Currently unsound. We do not presently track the control flow of the program.
-// Additionally, we do not presently track assignments.
 struct DataFlowGraphBuilder
 {
     static DataFlowGraph build(AstStatBlock* root, NotNull<struct InternalErrorReporter> handle);
@@ -71,8 +98,8 @@ struct DataFlowGraphBuilder
     DataFlowGraphBuilder& operator=(const DataFlowGraphBuilder&) = delete;
 
     DataFlowGraph graph;
-    NotNull<DefArena> defs{&graph.defs};
-    NotNull<BreadcrumbArena> breadcrumbs{&graph.breadcrumbs};
+    NotNull<DefArena> defArena{&graph.defArena};
+    NotNull<RefinementKeyArena> keyArena{&graph.keyArena};
 
     struct InternalErrorReporter* handle = nullptr;
     DfgScope* moduleScope = nullptr;
@@ -105,27 +132,28 @@ struct DataFlowGraphBuilder
     void visit(DfgScope* scope, AstStatDeclareClass* d);
     void visit(DfgScope* scope, AstStatError* error);
 
-    BreadcrumbId visitExpr(DfgScope* scope, AstExpr* e);
-    BreadcrumbId visitExpr(DfgScope* scope, AstExprLocal* l);
-    BreadcrumbId visitExpr(DfgScope* scope, AstExprGlobal* g);
-    BreadcrumbId visitExpr(DfgScope* scope, AstExprCall* c);
-    BreadcrumbId visitExpr(DfgScope* scope, AstExprIndexName* i);
-    BreadcrumbId visitExpr(DfgScope* scope, AstExprIndexExpr* i);
-    BreadcrumbId visitExpr(DfgScope* scope, AstExprFunction* f);
-    BreadcrumbId visitExpr(DfgScope* scope, AstExprTable* t);
-    BreadcrumbId visitExpr(DfgScope* scope, AstExprUnary* u);
-    BreadcrumbId visitExpr(DfgScope* scope, AstExprBinary* b);
-    BreadcrumbId visitExpr(DfgScope* scope, AstExprTypeAssertion* t);
-    BreadcrumbId visitExpr(DfgScope* scope, AstExprIfElse* i);
-    BreadcrumbId visitExpr(DfgScope* scope, AstExprInterpString* i);
-    BreadcrumbId visitExpr(DfgScope* scope, AstExprError* error);
-
-    void visitLValue(DfgScope* scope, AstExpr* e, BreadcrumbId bc);
-    void visitLValue(DfgScope* scope, AstExprLocal* l, BreadcrumbId bc);
-    void visitLValue(DfgScope* scope, AstExprGlobal* g, BreadcrumbId bc);
-    void visitLValue(DfgScope* scope, AstExprIndexName* i, BreadcrumbId bc);
-    void visitLValue(DfgScope* scope, AstExprIndexExpr* i, BreadcrumbId bc);
-    void visitLValue(DfgScope* scope, AstExprError* e, BreadcrumbId bc);
+    DataFlowResult visitExpr(DfgScope* scope, AstExpr* e);
+    DataFlowResult visitExpr(DfgScope* scope, AstExprGroup* group);
+    DataFlowResult visitExpr(DfgScope* scope, AstExprLocal* l);
+    DataFlowResult visitExpr(DfgScope* scope, AstExprGlobal* g);
+    DataFlowResult visitExpr(DfgScope* scope, AstExprCall* c);
+    DataFlowResult visitExpr(DfgScope* scope, AstExprIndexName* i);
+    DataFlowResult visitExpr(DfgScope* scope, AstExprIndexExpr* i);
+    DataFlowResult visitExpr(DfgScope* scope, AstExprFunction* f);
+    DataFlowResult visitExpr(DfgScope* scope, AstExprTable* t);
+    DataFlowResult visitExpr(DfgScope* scope, AstExprUnary* u);
+    DataFlowResult visitExpr(DfgScope* scope, AstExprBinary* b);
+    DataFlowResult visitExpr(DfgScope* scope, AstExprTypeAssertion* t);
+    DataFlowResult visitExpr(DfgScope* scope, AstExprIfElse* i);
+    DataFlowResult visitExpr(DfgScope* scope, AstExprInterpString* i);
+    DataFlowResult visitExpr(DfgScope* scope, AstExprError* error);
+
+    void visitLValue(DfgScope* scope, AstExpr* e, DefId incomingDef, bool isCompoundAssignment = false);
+    void visitLValue(DfgScope* scope, AstExprLocal* l, DefId incomingDef, bool isCompoundAssignment);
+    void visitLValue(DfgScope* scope, AstExprGlobal* g, DefId incomingDef, bool isCompoundAssignment);
+    void visitLValue(DfgScope* scope, AstExprIndexName* i, DefId incomingDef);
+    void visitLValue(DfgScope* scope, AstExprIndexExpr* i, DefId incomingDef);
+    void visitLValue(DfgScope* scope, AstExprError* e, DefId incomingDef);
 
     void visitType(DfgScope* scope, AstType* t);
     void visitType(DfgScope* scope, AstTypeReference* r);
diff --git a/Analysis/include/Luau/Def.h b/Analysis/include/Luau/Def.h
index 10d81367e..0a286ae98 100644
--- a/Analysis/include/Luau/Def.h
+++ b/Analysis/include/Luau/Def.h
@@ -23,6 +23,7 @@ using DefId = NotNull<const Def>;
  */
 struct Cell
 {
+    bool subscripted = false;
 };
 
 /**
@@ -71,11 +72,13 @@ const T* get(DefId def)
     return get_if<T>(&def->v);
 }
 
+bool containsSubscriptedDefinition(DefId def);
+
 struct DefArena
 {
     TypedAllocator<Def> allocator;
 
-    DefId freshCell();
+    DefId freshCell(bool subscripted = false);
     // TODO: implement once we have cases where we need to merge in definitions
     // DefId phi(const std::vector<DefId>& defs);
 };
diff --git a/Analysis/include/Luau/Differ.h b/Analysis/include/Luau/Differ.h
index 43c44b71d..587ed5ae7 100644
--- a/Analysis/include/Luau/Differ.h
+++ b/Analysis/include/Luau/Differ.h
@@ -2,11 +2,12 @@
 #pragma once
 
 #include "Luau/DenseHash.h"
-#include "Luau/Type.h"
+#include "Luau/TypeFwd.h"
 #include "Luau/UnifierSharedState.h"
+
 #include <optional>
 #include <string>
-#include <unordered_map>
+#include <unordered_set>
 
 namespace Luau
 {
diff --git a/Analysis/include/Luau/Error.h b/Analysis/include/Luau/Error.h
index 71442fb1d..4b6c64c33 100644
--- a/Analysis/include/Luau/Error.h
+++ b/Analysis/include/Luau/Error.h
@@ -5,6 +5,9 @@
 #include "Luau/NotNull.h"
 #include "Luau/Type.h"
 #include "Luau/Variant.h"
+#include "Luau/Ast.h"
+
+#include <set>
 
 namespace Luau
 {
diff --git a/Analysis/include/Luau/GlobalTypes.h b/Analysis/include/Luau/GlobalTypes.h
index 7a34f9354..55a6d6c73 100644
--- a/Analysis/include/Luau/GlobalTypes.h
+++ b/Analysis/include/Luau/GlobalTypes.h
@@ -6,12 +6,11 @@
 #include "Luau/NotNull.h"
 #include "Luau/Scope.h"
 #include "Luau/TypeArena.h"
+#include "Luau/TypeFwd.h"
 
 namespace Luau
 {
 
-struct BuiltinTypes;
-
 struct GlobalTypes
 {
     explicit GlobalTypes(NotNull<BuiltinTypes> builtinTypes);
diff --git a/Analysis/include/Luau/Instantiation.h b/Analysis/include/Luau/Instantiation.h
index 1dbf6b67b..2122f0faf 100644
--- a/Analysis/include/Luau/Instantiation.h
+++ b/Analysis/include/Luau/Instantiation.h
@@ -3,13 +3,12 @@
 
 #include "Luau/NotNull.h"
 #include "Luau/Substitution.h"
-#include "Luau/Type.h"
+#include "Luau/TypeFwd.h"
 #include "Luau/Unifiable.h"
 
 namespace Luau
 {
 
-struct BuiltinTypes;
 struct TxnLog;
 struct TypeArena;
 struct TypeCheckLimits;
diff --git a/Analysis/include/Luau/IostreamHelpers.h b/Analysis/include/Luau/IostreamHelpers.h
index 42b362bee..a16455dfa 100644
--- a/Analysis/include/Luau/IostreamHelpers.h
+++ b/Analysis/include/Luau/IostreamHelpers.h
@@ -5,6 +5,7 @@
 #include "Luau/Location.h"
 #include "Luau/Type.h"
 #include "Luau/Ast.h"
+#include "Luau/TypePath.h"
 
 #include <ostream>
 
@@ -48,4 +49,14 @@ std::ostream& operator<<(std::ostream& lhs, const TypePackVar& tv);
 
 std::ostream& operator<<(std::ostream& lhs, const TypeErrorData& ted);
 
+std::ostream& operator<<(std::ostream& lhs, TypeId ty);
+std::ostream& operator<<(std::ostream& lhs, TypePackId tp);
+
+namespace TypePath
+{
+
+std::ostream& operator<<(std::ostream& lhs, const Path& path);
+
+}; // namespace TypePath
+
 } // namespace Luau
diff --git a/Analysis/include/Luau/LValue.h b/Analysis/include/Luau/LValue.h
index 9a8b863b3..e20d9901e 100644
--- a/Analysis/include/Luau/LValue.h
+++ b/Analysis/include/Luau/LValue.h
@@ -3,6 +3,7 @@
 
 #include "Luau/Variant.h"
 #include "Luau/Symbol.h"
+#include "Luau/TypeFwd.h"
 
 #include <memory>
 #include <unordered_map>
@@ -10,9 +11,6 @@
 namespace Luau
 {
 
-struct Type;
-using TypeId = const Type*;
-
 struct Field;
 
 // Deprecated. Do not use in new work.
diff --git a/Analysis/include/Luau/Normalize.h b/Analysis/include/Luau/Normalize.h
index 0f9352d15..ebb80e0f7 100644
--- a/Analysis/include/Luau/Normalize.h
+++ b/Analysis/include/Luau/Normalize.h
@@ -2,10 +2,15 @@
 #pragma once
 
 #include "Luau/NotNull.h"
-#include "Luau/Type.h"
+#include "Luau/TypeFwd.h"
 #include "Luau/UnifierSharedState.h"
 
+#include <initializer_list>
+#include <map>
 #include <memory>
+#include <unordered_map>
+#include <unordered_set>
+#include <vector>
 
 namespace Luau
 {
@@ -13,7 +18,6 @@ namespace Luau
 struct InternalErrorReporter;
 struct Module;
 struct Scope;
-struct BuiltinTypes;
 
 using ModulePtr = std::shared_ptr<Module>;
 
@@ -33,10 +37,15 @@ class TypeIds
     using iterator = std::vector<TypeId>::iterator;
     using const_iterator = std::vector<TypeId>::const_iterator;
 
-    TypeIds(const TypeIds&) = default;
-    TypeIds(TypeIds&&) = default;
     TypeIds() = default;
     ~TypeIds() = default;
+
+    TypeIds(std::initializer_list<TypeId> tys);
+
+    TypeIds(const TypeIds&) = default;
+    TypeIds& operator=(const TypeIds&) = default;
+
+    TypeIds(TypeIds&&) = default;
     TypeIds& operator=(TypeIds&&) = default;
 
     void insert(TypeId ty);
diff --git a/Analysis/include/Luau/Predicate.h b/Analysis/include/Luau/Predicate.h
index 50fd7edd8..52ee1f298 100644
--- a/Analysis/include/Luau/Predicate.h
+++ b/Analysis/include/Luau/Predicate.h
@@ -4,15 +4,13 @@
 #include "Luau/Location.h"
 #include "Luau/LValue.h"
 #include "Luau/Variant.h"
+#include "Luau/TypeFwd.h"
 
 #include <vector>
 
 namespace Luau
 {
 
-struct Type;
-using TypeId = const Type*;
-
 struct TruthyPredicate;
 struct IsAPredicate;
 struct TypeGuardPredicate;
diff --git a/Analysis/include/Luau/Quantify.h b/Analysis/include/Luau/Quantify.h
index b562c54c7..bae3751da 100644
--- a/Analysis/include/Luau/Quantify.h
+++ b/Analysis/include/Luau/Quantify.h
@@ -1,10 +1,12 @@
 // This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
 #pragma once
 
-#include "Luau/Type.h"
+#include "Luau/TypeFwd.h"
 #include "Luau/DenseHash.h"
+#include "Luau/Unifiable.h"
 
 #include <vector>
+#include <optional>
 
 namespace Luau
 {
diff --git a/Analysis/include/Luau/Refinement.h b/Analysis/include/Luau/Refinement.h
index fecf459ad..3fea78688 100644
--- a/Analysis/include/Luau/Refinement.h
+++ b/Analysis/include/Luau/Refinement.h
@@ -4,14 +4,13 @@
 #include "Luau/NotNull.h"
 #include "Luau/TypedAllocator.h"
 #include "Luau/Variant.h"
+#include "Luau/TypeFwd.h"
 
 namespace Luau
 {
 
-using BreadcrumbId = NotNull<const struct Breadcrumb>;
-
-struct Type;
-using TypeId = const Type*;
+struct RefinementKey;
+using DefId = NotNull<const struct Def>;
 
 struct Variadic;
 struct Negation;
@@ -52,7 +51,7 @@ struct Equivalence
 
 struct Proposition
 {
-    BreadcrumbId breadcrumb;
+    const RefinementKey* key;
     TypeId discriminantTy;
 };
 
@@ -69,7 +68,7 @@ struct RefinementArena
     RefinementId conjunction(RefinementId lhs, RefinementId rhs);
     RefinementId disjunction(RefinementId lhs, RefinementId rhs);
     RefinementId equivalence(RefinementId lhs, RefinementId rhs);
-    RefinementId proposition(BreadcrumbId breadcrumb, TypeId discriminantTy);
+    RefinementId proposition(const RefinementKey* key, TypeId discriminantTy);
 
 private:
     TypedAllocator<Refinement> allocator;
diff --git a/Analysis/include/Luau/Scope.h b/Analysis/include/Luau/Scope.h
index a0b115ad7..8cdffcb49 100644
--- a/Analysis/include/Luau/Scope.h
+++ b/Analysis/include/Luau/Scope.h
@@ -2,9 +2,13 @@
 #pragma once
 
 #include "Luau/Def.h"
+#include "Luau/LValue.h"
 #include "Luau/Location.h"
 #include "Luau/NotNull.h"
 #include "Luau/Type.h"
+#include "Luau/DenseHash.h"
+#include "Luau/Symbol.h"
+#include "Luau/Unifiable.h"
 
 #include <unordered_map>
 #include <optional>
@@ -54,6 +58,7 @@ struct Scope
     std::optional<TypeId> lookup(Symbol sym) const;
     std::optional<TypeId> lookupLValue(DefId def) const;
     std::optional<TypeId> lookup(DefId def) const;
+    std::optional<std::pair<TypeId, Scope*>> lookupEx(DefId def);
     std::optional<std::pair<Binding*, Scope*>> lookupEx(Symbol sym);
 
     std::optional<TypeFun> lookupType(const Name& name) const;
diff --git a/Analysis/include/Luau/Simplify.h b/Analysis/include/Luau/Simplify.h
index 27ed44f8f..064648d73 100644
--- a/Analysis/include/Luau/Simplify.h
+++ b/Analysis/include/Luau/Simplify.h
@@ -2,7 +2,8 @@
 
 #pragma once
 
-#include "Luau/Type.h"
+#include "Luau/NotNull.h"
+#include "Luau/TypeFwd.h"
 
 #include <set>
 
@@ -10,7 +11,6 @@ namespace Luau
 {
 
 struct TypeArena;
-struct BuiltinTypes;
 
 struct SimplifyResult
 {
diff --git a/Analysis/include/Luau/Substitution.h b/Analysis/include/Luau/Substitution.h
index b18c64846..d4c0f166b 100644
--- a/Analysis/include/Luau/Substitution.h
+++ b/Analysis/include/Luau/Substitution.h
@@ -2,8 +2,7 @@
 #pragma once
 
 #include "Luau/TypeArena.h"
-#include "Luau/TypePack.h"
-#include "Luau/Type.h"
+#include "Luau/TypeFwd.h"
 #include "Luau/DenseHash.h"
 
 // We provide an implementation of substitution on types,
diff --git a/Analysis/include/Luau/Subtyping.h b/Analysis/include/Luau/Subtyping.h
index f8aa584db..321563e7c 100644
--- a/Analysis/include/Luau/Subtyping.h
+++ b/Analysis/include/Luau/Subtyping.h
@@ -1,10 +1,10 @@
 // This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
 #pragma once
 
-#include "Luau/Type.h"
-#include "Luau/TypePack.h"
+#include "Luau/TypeFwd.h"
 #include "Luau/TypePairHash.h"
 #include "Luau/UnifierSharedState.h"
+#include "Luau/TypePath.h"
 
 #include <vector>
 #include <optional>
@@ -23,6 +23,13 @@ struct NormalizedClassType;
 struct NormalizedStringType;
 struct NormalizedFunctionType;
 
+struct SubtypingReasoning
+{
+    Path subPath;
+    Path superPath;
+
+    bool operator==(const SubtypingReasoning& other) const;
+};
 
 struct SubtypingResult
 {
@@ -31,8 +38,18 @@ struct SubtypingResult
     bool normalizationTooComplex = false;
     bool isCacheable = true;
 
+    /// The reason for isSubtype to be false. May not be present even if
+    /// isSubtype is false, depending on the input types.
+    std::optional<SubtypingReasoning> reasoning;
+
     SubtypingResult& andAlso(const SubtypingResult& other);
     SubtypingResult& orElse(const SubtypingResult& other);
+    SubtypingResult& withBothComponent(TypePath::Component component);
+    SubtypingResult& withSuperComponent(TypePath::Component component);
+    SubtypingResult& withSubComponent(TypePath::Component component);
+    SubtypingResult& withBothPath(TypePath::Path path);
+    SubtypingResult& withSubPath(TypePath::Path path);
+    SubtypingResult& withSuperPath(TypePath::Path path);
 
     // Only negates the `isSubtype`.
     static SubtypingResult negate(const SubtypingResult& result);
diff --git a/Analysis/include/Luau/ToDot.h b/Analysis/include/Luau/ToDot.h
index 1a9c2811a..6fa99ec3f 100644
--- a/Analysis/include/Luau/ToDot.h
+++ b/Analysis/include/Luau/ToDot.h
@@ -2,16 +2,12 @@
 #pragma once
 
 #include "Luau/Common.h"
+#include "Luau/TypeFwd.h"
 
 #include <string>
 
 namespace Luau
 {
-struct Type;
-using TypeId = const Type*;
-
-struct TypePackVar;
-using TypePackId = const TypePackVar*;
 
 struct ToDotOptions
 {
diff --git a/Analysis/include/Luau/ToString.h b/Analysis/include/Luau/ToString.h
index a256e12f2..091d8dd1f 100644
--- a/Analysis/include/Luau/ToString.h
+++ b/Analysis/include/Luau/ToString.h
@@ -2,6 +2,7 @@
 #pragma once
 
 #include "Luau/Common.h"
+#include "Luau/TypeFwd.h"
 
 #include <memory>
 #include <optional>
@@ -20,13 +21,6 @@ class AstExpr;
 
 struct Scope;
 
-struct Type;
-using TypeId = const Type*;
-
-struct TypePackVar;
-using TypePackId = const TypePackVar*;
-
-struct FunctionType;
 struct Constraint;
 
 struct Position;
@@ -149,4 +143,14 @@ std::string generateName(size_t n);
 std::string toString(const Position& position);
 std::string toString(const Location& location, int offset = 0, bool useBegin = true);
 
+std::string toString(const TypeOrPack& tyOrTp, ToStringOptions& opts);
+
+inline std::string toString(const TypeOrPack& tyOrTp)
+{
+    ToStringOptions opts{};
+    return toString(tyOrTp, opts);
+}
+
+std::string dump(const TypeOrPack& tyOrTp);
+
 } // namespace Luau
diff --git a/Analysis/include/Luau/Type.h b/Analysis/include/Luau/Type.h
index 2eb7d749f..9b8564fb8 100644
--- a/Analysis/include/Luau/Type.h
+++ b/Analysis/include/Luau/Type.h
@@ -1,6 +1,8 @@
 // This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
 #pragma once
 
+#include "Luau/TypeFwd.h"
+
 #include "Luau/Ast.h"
 #include "Luau/Common.h"
 #include "Luau/Refinement.h"
@@ -9,6 +11,7 @@
 #include "Luau/Predicate.h"
 #include "Luau/Unifiable.h"
 #include "Luau/Variant.h"
+#include "Luau/TypeFwd.h"
 
 #include <atomic>
 #include <deque>
@@ -59,22 +62,6 @@ struct TypeFamily;
  * ```
  */
 
-// So... why `const T*` here rather than `T*`?
-// It's because we've had problems caused by the type graph being mutated
-// in ways it shouldn't be, for example mutating types from other modules.
-// To try to control this, we make the use of types immutable by default,
-// then provide explicit mutable access via getMutable and asMutable.
-// This means we can grep for all the places we're mutating the type graph,
-// and it makes it possible to provide other APIs (e.g. the txn log)
-// which control mutable access to the type graph.
-struct TypePackVar;
-using TypePackId = const TypePackVar*;
-
-struct Type;
-
-// Should never be null
-using TypeId = const Type*;
-
 using Name = std::string;
 
 // A free type is one whose exact shape has yet to be fully determined.
@@ -244,22 +231,6 @@ const T* get(const SingletonType* stv)
         return nullptr;
 }
 
-struct GenericTypeDefinition
-{
-    TypeId ty;
-    std::optional<TypeId> defaultValue;
-
-    bool operator==(const GenericTypeDefinition& rhs) const;
-};
-
-struct GenericTypePackDefinition
-{
-    TypePackId tp;
-    std::optional<TypePackId> defaultValue;
-
-    bool operator==(const GenericTypePackDefinition& rhs) const;
-};
-
 struct FunctionArgument
 {
     Name name;
@@ -549,42 +520,6 @@ struct TypeFamilyInstanceType
     std::vector<TypePackId> packArguments;
 };
 
-struct TypeFun
-{
-    // These should all be generic
-    std::vector<GenericTypeDefinition> typeParams;
-    std::vector<GenericTypePackDefinition> typePackParams;
-
-    /** The underlying type.
-     *
-     * WARNING!  This is not safe to use as a type if typeParams is not empty!!
-     * You must first use TypeChecker::instantiateTypeFun to turn it into a real type.
-     */
-    TypeId type;
-
-    TypeFun() = default;
-
-    explicit TypeFun(TypeId ty)
-        : type(ty)
-    {
-    }
-
-    TypeFun(std::vector<GenericTypeDefinition> typeParams, TypeId type)
-        : typeParams(std::move(typeParams))
-        , type(type)
-    {
-    }
-
-    TypeFun(std::vector<GenericTypeDefinition> typeParams, std::vector<GenericTypePackDefinition> typePackParams, TypeId type)
-        : typeParams(std::move(typeParams))
-        , typePackParams(std::move(typePackParams))
-        , type(type)
-    {
-    }
-
-    bool operator==(const TypeFun& rhs) const;
-};
-
 /** Represents a pending type alias instantiation.
  *
  * In order to afford (co)recursive type aliases, we need to reason about a
@@ -729,6 +664,58 @@ struct Type final
     Type& operator=(const Type& rhs);
 };
 
+struct GenericTypeDefinition
+{
+    TypeId ty;
+    std::optional<TypeId> defaultValue;
+
+    bool operator==(const GenericTypeDefinition& rhs) const;
+};
+
+struct GenericTypePackDefinition
+{
+    TypePackId tp;
+    std::optional<TypePackId> defaultValue;
+
+    bool operator==(const GenericTypePackDefinition& rhs) const;
+};
+
+struct TypeFun
+{
+    // These should all be generic
+    std::vector<GenericTypeDefinition> typeParams;
+    std::vector<GenericTypePackDefinition> typePackParams;
+
+    /** The underlying type.
+     *
+     * WARNING!  This is not safe to use as a type if typeParams is not empty!!
+     * You must first use TypeChecker::instantiateTypeFun to turn it into a real type.
+     */
+    TypeId type;
+
+    TypeFun() = default;
+
+    explicit TypeFun(TypeId ty)
+        : type(ty)
+    {
+    }
+
+    TypeFun(std::vector<GenericTypeDefinition> typeParams, TypeId type)
+        : typeParams(std::move(typeParams))
+        , type(type)
+    {
+    }
+
+    TypeFun(std::vector<GenericTypeDefinition> typeParams, std::vector<GenericTypePackDefinition> typePackParams, TypeId type)
+        : typeParams(std::move(typeParams))
+        , typePackParams(std::move(typePackParams))
+        , type(type)
+    {
+    }
+
+    bool operator==(const TypeFun& rhs) const;
+};
+
 using SeenSet = std::set<std::pair<const void*, const void*>>;
 bool areEqual(SeenSet& seen, const Type& lhs, const Type& rhs);
 
diff --git a/Analysis/include/Luau/TypeFamily.h b/Analysis/include/Luau/TypeFamily.h
index ede104b95..4a7366471 100644
--- a/Analysis/include/Luau/TypeFamily.h
+++ b/Analysis/include/Luau/TypeFamily.h
@@ -1,13 +1,12 @@
 // This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
 #pragma once
 
-#include "ConstraintSolver.h"
-#include "Error.h"
+#include "Luau/ConstraintSolver.h"
 #include "Luau/Error.h"
 #include "Luau/NotNull.h"
+#include "Luau/TypeCheckLimits.h"
+#include "Luau/TypeFwd.h"
 #include "Luau/Variant.h"
-#include "NotNull.h"
-#include "TypeCheckLimits.h"
 
 #include <functional>
 #include <string>
@@ -16,14 +15,7 @@
 namespace Luau
 {
 
-struct Type;
-using TypeId = const Type*;
-
-struct TypePackVar;
-using TypePackId = const TypePackVar*;
-
 struct TypeArena;
-struct BuiltinTypes;
 struct TxnLog;
 class Normalizer;
 
@@ -150,6 +142,8 @@ struct BuiltinTypeFamilies
     BuiltinTypeFamilies();
 
     TypeFamily notFamily;
+    TypeFamily lenFamily;
+    TypeFamily unmFamily;
 
     TypeFamily addFamily;
     TypeFamily subFamily;
diff --git a/Analysis/include/Luau/TypeFwd.h b/Analysis/include/Luau/TypeFwd.h
new file mode 100644
index 000000000..e43181566
--- /dev/null
+++ b/Analysis/include/Luau/TypeFwd.h
@@ -0,0 +1,59 @@
+// This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
+#pragma once
+
+#include "Luau/Variant.h"
+
+#include <string>
+
+namespace Luau
+{
+
+// So... why `const T*` here rather than `T*`?
+// It's because we've had problems caused by the type graph being mutated
+// in ways it shouldn't be, for example mutating types from other modules.
+// To try to control this, we make the use of types immutable by default,
+// then provide explicit mutable access via getMutable and asMutable.
+// This means we can grep for all the places we're mutating the type graph,
+// and it makes it possible to provide other APIs (e.g. the txn log)
+// which control mutable access to the type graph.
+
+struct Type;
+using TypeId = const Type*;
+
+struct FreeType;
+struct GenericType;
+struct PrimitiveType;
+struct BlockedType;
+struct PendingExpansionType;
+struct SingletonType;
+struct FunctionType;
+struct TableType;
+struct MetatableType;
+struct ClassType;
+struct AnyType;
+struct UnionType;
+struct IntersectionType;
+struct LazyType;
+struct UnknownType;
+struct NeverType;
+struct NegationType;
+struct TypeFamilyInstanceType;
+
+struct TypePackVar;
+using TypePackId = const TypePackVar*;
+
+struct FreeTypePack;
+struct GenericTypePack;
+struct TypePack;
+struct VariadicTypePack;
+struct BlockedTypePack;
+struct TypeFamilyInstanceTypePack;
+
+using Name = std::string;
+using ModuleName = std::string;
+
+struct BuiltinTypes;
+
+using TypeOrPack = Variant<TypeId, TypePackId>;
+
+} // namespace Luau
diff --git a/Analysis/include/Luau/TypeInfer.h b/Analysis/include/Luau/TypeInfer.h
index abae8b923..7de014068 100644
--- a/Analysis/include/Luau/TypeInfer.h
+++ b/Analysis/include/Luau/TypeInfer.h
@@ -9,9 +9,8 @@
 #include "Luau/Substitution.h"
 #include "Luau/Symbol.h"
 #include "Luau/TxnLog.h"
-#include "Luau/Type.h"
+#include "Luau/TypeFwd.h"
 #include "Luau/TypeCheckLimits.h"
-#include "Luau/TypePack.h"
 #include "Luau/TypeUtils.h"
 #include "Luau/Unifier.h"
 #include "Luau/UnifierSharedState.h"
diff --git a/Analysis/include/Luau/TypeOrPack.h b/Analysis/include/Luau/TypeOrPack.h
new file mode 100644
index 000000000..2bdca1df4
--- /dev/null
+++ b/Analysis/include/Luau/TypeOrPack.h
@@ -0,0 +1,45 @@
+// This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
+#pragma once
+
+#include "Luau/Type.h"
+#include "Luau/TypePack.h"
+#include "Luau/Variant.h"
+
+#include <type_traits>
+
+namespace Luau
+{
+
+const void* ptr(TypeOrPack ty);
+
+template<typename T>
+const T* get(TypeOrPack ty)
+{
+    if constexpr (std::is_same_v<T, TypeId>)
+        return ty.get_if<TypeId>();
+    else if constexpr (std::is_same_v<T, TypePackId>)
+        return ty.get_if<TypePackId>();
+    else if constexpr (TypeVariant::is_part_of_v<T>)
+    {
+        if (auto innerTy = ty.get_if<TypeId>())
+            return get<T>(*innerTy);
+        else
+            return nullptr;
+    }
+    else if constexpr (TypePackVariant::is_part_of_v<T>)
+    {
+        if (auto innerTp = ty.get_if<TypePackId>())
+            return get<T>(*innerTp);
+        else
+            return nullptr;
+    }
+    else
+    {
+        static_assert(always_false_v<T>, "invalid T to get from TypeOrPack");
+        LUAU_UNREACHABLE();
+    }
+}
+
+TypeOrPack follow(TypeOrPack ty);
+
+} // namespace Luau
diff --git a/Analysis/include/Luau/TypePack.h b/Analysis/include/Luau/TypePack.h
index d159aa45d..11721f401 100644
--- a/Analysis/include/Luau/TypePack.h
+++ b/Analysis/include/Luau/TypePack.h
@@ -1,12 +1,15 @@
 // This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
 #pragma once
 
-#include "Luau/Type.h"
 #include "Luau/Unifiable.h"
 #include "Luau/Variant.h"
+#include "Luau/TypeFwd.h"
+#include "Luau/NotNull.h"
+#include "Luau/Common.h"
 
 #include <optional>
 #include <set>
+#include <vector>
 
 namespace Luau
 {
@@ -20,9 +23,6 @@ struct VariadicTypePack;
 struct BlockedTypePack;
 struct TypeFamilyInstanceTypePack;
 
-struct TypePackVar;
-using TypePackId = const TypePackVar*;
-
 struct FreeTypePack
 {
     explicit FreeTypePack(TypeLevel level);
diff --git a/Analysis/include/Luau/TypePairHash.h b/Analysis/include/Luau/TypePairHash.h
index 029818ba1..5cddebef0 100644
--- a/Analysis/include/Luau/TypePairHash.h
+++ b/Analysis/include/Luau/TypePairHash.h
@@ -1,7 +1,7 @@
 // This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
 #pragma once
 
-#include "Type.h"
+#include "Luau/TypeFwd.h"
 
 #include <utility>
 
diff --git a/Analysis/include/Luau/TypePath.h b/Analysis/include/Luau/TypePath.h
new file mode 100644
index 000000000..96fcdcb15
--- /dev/null
+++ b/Analysis/include/Luau/TypePath.h
@@ -0,0 +1,220 @@
+// This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
+#pragma once
+
+#include "Luau/TypeFwd.h"
+#include "Luau/Variant.h"
+#include "Luau/NotNull.h"
+#include "Luau/TypeOrPack.h"
+
+#include <optional>
+#include <string>
+#include <vector>
+
+namespace Luau
+{
+
+namespace TypePath
+{
+
+/// Represents a property of a class, table, or anything else with a concept of
+/// a named property.
+struct Property
+{
+    /// The name of the property.
+    std::string name;
+    /// Whether to look at the read or the write type.
+    bool isRead = true;
+
+    explicit Property(std::string name);
+    Property(std::string name, bool read)
+        : name(std::move(name))
+        , isRead(read)
+    {
+    }
+
+    static Property read(std::string name);
+    static Property write(std::string name);
+
+    bool operator==(const Property& other) const;
+};
+
+/// Represents an index into a type or a pack. For a type, this indexes into a
+/// union or intersection's list. For a pack, this indexes into the pack's nth
+/// element.
+struct Index
+{
+    /// The 0-based index to use for the lookup.
+    size_t index;
+
+    bool operator==(const Index& other) const;
+};
+
+/// Represents fields of a type or pack that contain a type.
+enum class TypeField
+{
+    /// The metatable of a type. This could be a metatable type, a primitive
+    /// type, a class type, or perhaps even a string singleton type.
+    Metatable,
+    /// The lower bound of this type, if one is present.
+    LowerBound,
+    /// The upper bound of this type, if present.
+    UpperBound,
+    /// The index type.
+    IndexLookup,
+    /// The indexer result type.
+    IndexResult,
+    /// The negated type, for negations.
+    Negated,
+    /// The variadic type for a type pack.
+    Variadic,
+};
+
+/// Represents fields of a type or type pack that contain a type pack.
+enum class PackField
+{
+    /// What arguments this type accepts.
+    Arguments,
+    /// What this type returns when called.
+    Returns,
+    /// The tail of a type pack.
+    Tail,
+};
+
+/// A single component of a path, representing one inner type or type pack to
+/// traverse into.
+using Component = Luau::Variant<Property, Index, TypeField, PackField>;
+
+/// A path through a type or type pack accessing a particular type or type pack
+/// contained within.
+///
+/// Paths are always relative; to make use of a Path, you need to specify an
+/// entry point. They are not canonicalized; two Paths may not compare equal but
+/// may point to the same result, depending on the layout of the entry point.
+///
+/// Paths always descend through an entry point. This doesn't mean that they
+/// cannot reach "upwards" in the actual type hierarchy in some cases, but it
+/// does mean that there is no equivalent to `../` in file system paths. This is
+/// intentional and unavoidable, because types and type packs don't have a
+/// concept of a parent - they are a directed cyclic graph, with no hierarchy
+/// that actually holds in all cases.
+struct Path
+{
+    /// The Components of this Path.
+    std::vector<Component> components;
+
+    /// Creates a new empty Path.
+    Path()
+    {
+    }
+
+    /// Creates a new Path from a list of components.
+    explicit Path(std::vector<Component> components)
+        : components(std::move(components))
+    {
+    }
+
+    /// Creates a new single-component Path.
+    explicit Path(Component component)
+        : components({component})
+    {
+    }
+
+    /// Creates a new Path by appending another Path to this one.
+    /// @param suffix the Path to append
+    /// @return a new Path representing `this + suffix`
+    Path append(const Path& suffix) const;
+
+    /// Creates a new Path by appending a Component to this Path.
+    /// @param component the Component to append
+    /// @return a new Path with `component` appended to it.
+    Path push(Component component) const;
+
+    /// Creates a new Path by prepending a Component to this Path.
+    /// @param component the Component to prepend
+    /// @return a new Path with `component` prepended to it.
+    Path push_front(Component component) const;
+
+    /// Creates a new Path by removing the last Component of this Path.
+    /// If the Path is empty, this is a no-op.
+    /// @return a Path with the last component removed.
+    Path pop() const;
+
+    /// Returns the last Component of this Path, if present.
+    std::optional<Component> last() const;
+
+    /// Returns whether this Path is empty, meaning it has no components at all.
+    /// Traversing an empty Path results in the type you started with.
+    bool empty() const;
+
+    bool operator==(const Path& other) const;
+    bool operator!=(const Path& other) const
+    {
+        return !(*this == other);
+    }
+};
+
+/// The canonical "empty" Path, meaning a Path with no components.
+static const Path kEmpty{};
+
+struct PathBuilder
+{
+    std::vector<Component> components;
+
+    Path build();
+
+    PathBuilder& readProp(std::string name);
+    PathBuilder& writeProp(std::string name);
+    PathBuilder& prop(std::string name);
+    PathBuilder& index(size_t i);
+    PathBuilder& mt();
+    PathBuilder& lb();
+    PathBuilder& ub();
+    PathBuilder& indexKey();
+    PathBuilder& indexValue();
+    PathBuilder& negated();
+    PathBuilder& variadic();
+    PathBuilder& args();
+    PathBuilder& rets();
+    PathBuilder& tail();
+};
+
+} // namespace TypePath
+
+using Path = TypePath::Path;
+
+/// Converts a Path to a string for debugging purposes. This output may not be
+/// terribly clear to end users of the Luau type system.
+std::string toString(const TypePath::Path& path);
+
+std::optional<TypeOrPack> traverse(TypeId root, const Path& path, NotNull<BuiltinTypes> builtinTypes);
+std::optional<TypeOrPack> traverse(TypePackId root, const Path& path, NotNull<BuiltinTypes> builtinTypes);
+
+/// Traverses a path from a type to its end point, which must be a type.
+/// @param root the entry point of the traversal
+/// @param path the path to traverse
+/// @param builtinTypes the built-in types in use (used to acquire the string metatable)
+/// @returns the TypeId at the end of the path, or nullopt if the traversal failed.
+std::optional<TypeId> traverseForType(TypeId root, const Path& path, NotNull<BuiltinTypes> builtinTypes);
+
+/// Traverses a path from a type pack to its end point, which must be a type.
+/// @param root the entry point of the traversal
+/// @param path the path to traverse
+/// @param builtinTypes the built-in types in use (used to acquire the string metatable)
+/// @returns the TypeId at the end of the path, or nullopt if the traversal failed.
+std::optional<TypeId> traverseForType(TypePackId root, const Path& path, NotNull<BuiltinTypes> builtinTypes);
+
+/// Traverses a path from a type to its end point, which must be a type pack.
+/// @param root the entry point of the traversal
+/// @param path the path to traverse
+/// @param builtinTypes the built-in types in use (used to acquire the string metatable)
+/// @returns the TypePackId at the end of the path, or nullopt if the traversal failed.
+std::optional<TypePackId> traverseForPack(TypeId root, const Path& path, NotNull<BuiltinTypes> builtinTypes);
+
+/// Traverses a path from a type pack to its end point, which must be a type pack.
+/// @param root the entry point of the traversal
+/// @param path the path to traverse
+/// @param builtinTypes the built-in types in use (used to acquire the string metatable)
+/// @returns the TypePackId at the end of the path, or nullopt if the traversal failed.
+std::optional<TypePackId> traverseForPack(TypePackId root, const Path& path, NotNull<BuiltinTypes> builtinTypes);
+
+} // namespace Luau
diff --git a/Analysis/include/Luau/Unifier.h b/Analysis/include/Luau/Unifier.h
index 1260ac93c..d1a3b3584 100644
--- a/Analysis/include/Luau/Unifier.h
+++ b/Analysis/include/Luau/Unifier.h
@@ -9,7 +9,7 @@
 #include "Luau/TxnLog.h"
 #include "Luau/TypeArena.h"
 #include "Luau/UnifierSharedState.h"
-#include "Normalize.h"
+#include "Luau/Normalize.h"
 
 #include <unordered_set>
 
diff --git a/Analysis/include/Luau/Unifier2.h b/Analysis/include/Luau/Unifier2.h
index 7b6fa608a..3d5b5a1a1 100644
--- a/Analysis/include/Luau/Unifier2.h
+++ b/Analysis/include/Luau/Unifier2.h
@@ -4,10 +4,10 @@
 
 #include "Luau/DenseHash.h"
 #include "Luau/NotNull.h"
-#include "Type.h"
-#include "TypePairHash.h"
-#include "TypeCheckLimits.h"
-#include "TypeChecker2.h"
+#include "Luau/TypePairHash.h"
+#include "Luau/TypeCheckLimits.h"
+#include "Luau/TypeChecker2.h"
+#include "Luau/TypeFwd.h"
 
 #include <optional>
 #include <vector>
@@ -16,10 +16,6 @@
 namespace Luau
 {
 
-using TypeId = const struct Type*;
-using TypePackId = const struct TypePackVar*;
-
-struct BuiltinTypes;
 struct InternalErrorReporter;
 struct Scope;
 struct TypeArena;
diff --git a/Analysis/include/Luau/UnifierSharedState.h b/Analysis/include/Luau/UnifierSharedState.h
index ada56ec56..de69c17cf 100644
--- a/Analysis/include/Luau/UnifierSharedState.h
+++ b/Analysis/include/Luau/UnifierSharedState.h
@@ -3,8 +3,7 @@
 
 #include "Luau/DenseHash.h"
 #include "Luau/Error.h"
-#include "Luau/Type.h"
-#include "Luau/TypePack.h"
+#include "Luau/TypeFwd.h"
 
 #include <utility>
 
diff --git a/Analysis/include/Luau/Variant.h b/Analysis/include/Luau/Variant.h
index 95fdfac4d..eeaa2c01a 100644
--- a/Analysis/include/Luau/Variant.h
+++ b/Analysis/include/Luau/Variant.h
@@ -44,6 +44,9 @@ class Variant
 public:
     using first_alternative = typename First<Ts...>::type;
 
+    template<typename T>
+    static constexpr bool is_part_of_v = std::disjunction_v<typename std::is_same<std::decay_t<Ts>, T>...>;
+
     Variant()
     {
         static_assert(std::is_default_constructible_v<first_alternative>, "first alternative type must be default constructible");
diff --git a/Analysis/src/Clone.cpp b/Analysis/src/Clone.cpp
index 4d6bcf03a..01b0bdfd5 100644
--- a/Analysis/src/Clone.cpp
+++ b/Analysis/src/Clone.cpp
@@ -701,6 +701,7 @@ void TypeCloner::operator()(const FunctionType& t)
     ftv->argNames = t.argNames;
     ftv->retTypes = clone(t.retTypes, dest, cloneState);
     ftv->hasNoFreeOrGenericTypes = t.hasNoFreeOrGenericTypes;
+    ftv->isCheckedFunction = t.isCheckedFunction;
 }
 
 void TypeCloner::operator()(const TableType& t)
diff --git a/Analysis/src/ConstraintGraphBuilder.cpp b/Analysis/src/ConstraintGraphBuilder.cpp
index 5eb2ce49f..4f4ff3065 100644
--- a/Analysis/src/ConstraintGraphBuilder.cpp
+++ b/Analysis/src/ConstraintGraphBuilder.cpp
@@ -2,7 +2,7 @@
 #include "Luau/ConstraintGraphBuilder.h"
 
 #include "Luau/Ast.h"
-#include "Luau/Breadcrumb.h"
+#include "Luau/Def.h"
 #include "Luau/Common.h"
 #include "Luau/Constraint.h"
 #include "Luau/ControlFlow.h"
@@ -216,19 +216,7 @@ NotNull<Constraint> ConstraintGraphBuilder::addConstraint(const ScopePtr& scope,
     return NotNull{constraints.emplace_back(std::move(c)).get()};
 }
 
-struct RefinementPartition
-{
-    // Types that we want to intersect against the type of the expression.
-    std::vector<TypeId> discriminantTypes;
-
-    // Sometimes the type we're discriminating against is implicitly nil.
-    bool shouldAppendNilType = false;
-};
-
-using RefinementContext = InsertionOrderedMap<DefId, RefinementPartition>;
-
-static void unionRefinements(NotNull<BuiltinTypes> builtinTypes, NotNull<TypeArena> arena, const RefinementContext& lhs, const RefinementContext& rhs,
-    RefinementContext& dest, std::vector<ConstraintV>* constraints)
+void ConstraintGraphBuilder::unionRefinements(const RefinementContext& lhs, const RefinementContext& rhs, RefinementContext& dest, std::vector<ConstraintV>* constraints)
 {
     const auto intersect = [&](const std::vector<TypeId>& types) {
         if (1 == types.size())
@@ -264,44 +252,43 @@ static void unionRefinements(NotNull<BuiltinTypes> builtinTypes, NotNull<TypeAre
     }
 }
 
-static void computeRefinement(NotNull<BuiltinTypes> builtinTypes, NotNull<TypeArena> arena, const ScopePtr& scope, RefinementId refinement,
-    RefinementContext* refis, bool sense, bool eq, std::vector<ConstraintV>* constraints)
+void ConstraintGraphBuilder::computeRefinement(const ScopePtr& scope, RefinementId refinement, RefinementContext* refis, bool sense, bool eq, std::vector<ConstraintV>* constraints)
 {
     if (!refinement)
         return;
     else if (auto variadic = get<Variadic>(refinement))
     {
         for (RefinementId refi : variadic->refinements)
-            computeRefinement(builtinTypes, arena, scope, refi, refis, sense, eq, constraints);
+            computeRefinement(scope, refi, refis, sense, eq, constraints);
     }
     else if (auto negation = get<Negation>(refinement))
-        return computeRefinement(builtinTypes, arena, scope, negation->refinement, refis, !sense, eq, constraints);
+        return computeRefinement(scope, negation->refinement, refis, !sense, eq, constraints);
     else if (auto conjunction = get<Conjunction>(refinement))
     {
         RefinementContext lhsRefis;
         RefinementContext rhsRefis;
 
-        computeRefinement(builtinTypes, arena, scope, conjunction->lhs, sense ? refis : &lhsRefis, sense, eq, constraints);
-        computeRefinement(builtinTypes, arena, scope, conjunction->rhs, sense ? refis : &rhsRefis, sense, eq, constraints);
+        computeRefinement(scope, conjunction->lhs, sense ? refis : &lhsRefis, sense, eq, constraints);
+        computeRefinement(scope, conjunction->rhs, sense ? refis : &rhsRefis, sense, eq, constraints);
 
         if (!sense)
-            unionRefinements(builtinTypes, arena, lhsRefis, rhsRefis, *refis, constraints);
+            unionRefinements(lhsRefis, rhsRefis, *refis, constraints);
     }
     else if (auto disjunction = get<Disjunction>(refinement))
     {
         RefinementContext lhsRefis;
         RefinementContext rhsRefis;
 
-        computeRefinement(builtinTypes, arena, scope, disjunction->lhs, sense ? &lhsRefis : refis, sense, eq, constraints);
-        computeRefinement(builtinTypes, arena, scope, disjunction->rhs, sense ? &rhsRefis : refis, sense, eq, constraints);
+        computeRefinement(scope, disjunction->lhs, sense ? &lhsRefis : refis, sense, eq, constraints);
+        computeRefinement(scope, disjunction->rhs, sense ? &rhsRefis : refis, sense, eq, constraints);
 
         if (sense)
-            unionRefinements(builtinTypes, arena, lhsRefis, rhsRefis, *refis, constraints);
+            unionRefinements(lhsRefis, rhsRefis, *refis, constraints);
     }
     else if (auto equivalence = get<Equivalence>(refinement))
     {
-        computeRefinement(builtinTypes, arena, scope, equivalence->lhs, refis, sense, true, constraints);
-        computeRefinement(builtinTypes, arena, scope, equivalence->rhs, refis, sense, true, constraints);
+        computeRefinement(scope, equivalence->lhs, refis, sense, true, constraints);
+        computeRefinement(scope, equivalence->rhs, refis, sense, true, constraints);
     }
     else if (auto proposition = get<Proposition>(refinement))
     {
@@ -314,40 +301,27 @@ static void computeRefinement(NotNull<BuiltinTypes> builtinTypes, NotNull<TypeAr
             constraints->push_back(SingletonOrTopTypeConstraint{discriminantTy, proposition->discriminantTy, !sense});
         }
 
-        RefinementContext uncommittedRefis;
-        uncommittedRefis.insert(proposition->breadcrumb->def, {});
-        uncommittedRefis.get(proposition->breadcrumb->def)->discriminantTypes.push_back(discriminantTy);
-
-        // When the top-level expression is `t[x]`, we want to refine it into `nil`, not `never`.
-        if ((sense || !eq) && getMetadata<SubscriptMetadata>(proposition->breadcrumb))
-            uncommittedRefis.get(proposition->breadcrumb->def)->shouldAppendNilType = true;
-
-        for (NullableBreadcrumbId current = proposition->breadcrumb; current && current->previous; current = current->previous)
+        for (const RefinementKey* key = proposition->key; key; key = key->parent)
         {
-            LUAU_ASSERT(get<Cell>(current->def));
-
-            // If this current breadcrumb has no metadata, it's no-op for the purpose of building a discriminant type.
-            if (!current->metadata)
-                continue;
-            else if (auto field = getMetadata<FieldMetadata>(current))
-            {
-                TableType::Props props{{field->prop, Property{discriminantTy}}};
-                discriminantTy = arena->addType(TableType{std::move(props), std::nullopt, TypeLevel{}, scope.get(), TableState::Sealed});
-                uncommittedRefis.insert(current->previous->def, {});
-                uncommittedRefis.get(current->previous->def)->discriminantTypes.push_back(discriminantTy);
-            }
-        }
+            refis->insert(key->def, {});
+            refis->get(key->def)->discriminantTypes.push_back(discriminantTy);
 
-        // And now it's time to commit it.
-        for (auto& [def, partition] : uncommittedRefis)
-        {
-            (*refis).insert(def, {});
+            // Reached leaf node
+            if (!key->propName)
+                break;
 
-            for (TypeId discriminantTy : partition.discriminantTypes)
-                (*refis).get(def)->discriminantTypes.push_back(discriminantTy);
+            TypeId nextDiscriminantTy = arena->addType(TableType{});
+            NotNull<TableType> table{getMutable<TableType>(nextDiscriminantTy)};
+            table->props[*key->propName] = {discriminantTy};
+            table->scope = scope.get();
+            table->state = TableState::Sealed;
 
-            (*refis).get(def)->shouldAppendNilType |= partition.shouldAppendNilType;
+            discriminantTy = nextDiscriminantTy;
         }
+
+        // When the top-level expression is `t[x]`, we want to refine it into `nil`, not `never`.
+        LUAU_ASSERT(refis->get(proposition->key->def));
+        refis->get(proposition->key->def)->shouldAppendNilType = (sense || !eq) && containsSubscriptedDefinition(proposition->key->def);
     }
 }
 
@@ -415,7 +389,7 @@ void ConstraintGraphBuilder::applyRefinements(const ScopePtr& scope, Location lo
 
     RefinementContext refinements;
     std::vector<ConstraintV> constraints;
-    computeRefinement(builtinTypes, arena, scope, refinement, &refinements, /*sense*/ true, /*eq*/ false, &constraints);
+    computeRefinement(scope, refinement, &refinements, /*sense*/ true, /*eq*/ false, &constraints);
 
     for (auto& [def, partition] : refinements)
     {
@@ -586,20 +560,22 @@ ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStat* stat)
     }
 }
 
-ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStatLocal* local)
+ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStatLocal* statLocal)
 {
     std::vector<std::optional<TypeId>> varTypes;
-    varTypes.reserve(local->vars.size);
+    varTypes.reserve(statLocal->vars.size);
 
     std::vector<TypeId> assignees;
-    assignees.reserve(local->vars.size);
+    assignees.reserve(statLocal->vars.size);
 
     // Used to name the first value type, even if it's not placed in varTypes,
     // for the purpose of synthetic name attribution.
     std::optional<TypeId> firstValueType;
 
-    for (AstLocal* local : local->vars)
+    for (AstLocal* local : statLocal->vars)
     {
+        const Location location = local->location;
+
         TypeId assignee = arena->addType(BlockedType{});
         assignees.push_back(assignee);
 
@@ -612,21 +588,27 @@ ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStatLocal* l
             varTypes.push_back(annotationTy);
 
             addConstraint(scope, local->location, SubtypeConstraint{assignee, annotationTy});
+
+            scope->bindings[local] = Binding{annotationTy, location};
         }
         else
+        {
             varTypes.push_back(std::nullopt);
 
-        BreadcrumbId bc = dfg->getBreadcrumb(local);
-        scope->lvalueTypes[bc->def] = assignee;
+            inferredBindings[local] = {scope.get(), location, {assignee}};
+        }
+
+        DefId def = dfg->getDef(local);
+        scope->lvalueTypes[def] = assignee;
     }
 
-    TypePackId resultPack = checkPack(scope, local->values, varTypes).tp;
-    addConstraint(scope, local->location, UnpackConstraint{arena->addTypePack(std::move(assignees)), resultPack});
+    TypePackId resultPack = checkPack(scope, statLocal->values, varTypes).tp;
+    addConstraint(scope, statLocal->location, UnpackConstraint{arena->addTypePack(std::move(assignees)), resultPack});
 
-    if (local->vars.size == 1 && local->values.size == 1 && firstValueType && scope.get() == rootScope)
+    if (statLocal->vars.size == 1 && statLocal->values.size == 1 && firstValueType && scope.get() == rootScope)
     {
-        AstLocal* var = local->vars.data[0];
-        AstExpr* value = local->values.data[0];
+        AstLocal* var = statLocal->vars.data[0];
+        AstExpr* value = statLocal->values.data[0];
 
         if (value->is<AstExprTable>())
             addConstraint(scope, value->location, NameConstraint{*firstValueType, var->name.value, /*synthetic*/ true});
@@ -639,29 +621,12 @@ ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStatLocal* l
         }
     }
 
-    for (size_t i = 0; i < local->vars.size; ++i)
-    {
-        AstLocal* l = local->vars.data[i];
-        Location location = l->location;
-
-        std::optional<TypeId> annotation = varTypes[i];
-        BreadcrumbId bc = dfg->getBreadcrumb(l);
-
-        if (annotation)
-            scope->bindings[l] = Binding{*annotation, location};
-        else
-        {
-            scope->bindings[l] = Binding{builtinTypes->neverType, location};
-            inferredBindings.emplace_back(scope.get(), l, bc);
-        }
-    }
-
-    if (local->values.size > 0)
+    if (statLocal->values.size > 0)
     {
         // To correctly handle 'require', we need to import the exported type bindings into the variable 'namespace'.
-        for (size_t i = 0; i < local->values.size && i < local->vars.size; ++i)
+        for (size_t i = 0; i < statLocal->values.size && i < statLocal->vars.size; ++i)
         {
-            const AstExprCall* call = local->values.data[i]->as<AstExprCall>();
+            const AstExprCall* call = statLocal->values.data[i]->as<AstExprCall>();
             if (!call)
                 continue;
 
@@ -679,7 +644,7 @@ ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStatLocal* l
             if (!module)
                 continue;
 
-            const Name name{local->vars.data[i]->name.value};
+            const Name name{statLocal->vars.data[i]->name.value};
             scope->importedTypeBindings[name] = module->exportedTypeBindings;
             scope->importedModules[name] = moduleInfo->name;
 
@@ -719,9 +684,9 @@ ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStatFor* for
     ScopePtr forScope = childScope(for_, scope);
     forScope->bindings[for_->var] = Binding{annotationTy, for_->var->location};
 
-    BreadcrumbId bc = dfg->getBreadcrumb(for_->var);
-    forScope->lvalueTypes[bc->def] = annotationTy;
-    forScope->rvalueRefinements[bc->def] = annotationTy;
+    DefId def = dfg->getDef(for_->var);
+    forScope->lvalueTypes[def] = annotationTy;
+    forScope->rvalueRefinements[def] = annotationTy;
 
     visit(forScope, for_->body);
 
@@ -750,8 +715,8 @@ ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStatForIn* f
         TypeId assignee = arena->addType(BlockedType{});
         variableTypes.push_back(assignee);
 
-        BreadcrumbId bc = dfg->getBreadcrumb(var);
-        loopScope->lvalueTypes[bc->def] = assignee;
+        DefId def = dfg->getDef(var);
+        loopScope->lvalueTypes[def] = assignee;
     }
 
     TypePackId variablePack = arena->addTypePack(std::move(variableTypes));
@@ -803,11 +768,11 @@ ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStatLocalFun
     FunctionSignature sig = checkFunctionSignature(scope, function->func, /* expectedType */ std::nullopt, function->name->location);
     sig.bodyScope->bindings[function->name] = Binding{sig.signature, function->func->location};
 
-    BreadcrumbId bc = dfg->getBreadcrumb(function->name);
-    scope->lvalueTypes[bc->def] = functionType;
-    scope->rvalueRefinements[bc->def] = functionType;
-    sig.bodyScope->lvalueTypes[bc->def] = sig.signature;
-    sig.bodyScope->rvalueRefinements[bc->def] = sig.signature;
+    DefId def = dfg->getDef(function->name);
+    scope->lvalueTypes[def] = functionType;
+    scope->rvalueRefinements[def] = functionType;
+    sig.bodyScope->lvalueTypes[def] = sig.signature;
+    sig.bodyScope->rvalueRefinements[def] = sig.signature;
 
     Checkpoint start = checkpoint(this);
     checkFunctionBody(sig.bodyScope, function->func);
@@ -848,11 +813,8 @@ ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStatFunction
 
     std::unordered_set<Constraint*> excludeList;
 
-    const NullableBreadcrumbId functionBreadcrumb = dfg->getBreadcrumb(function->name);
-
-    std::optional<TypeId> existingFunctionTy;
-    if (functionBreadcrumb)
-        existingFunctionTy = scope->lookupLValue(functionBreadcrumb->def);
+    DefId def = dfg->getDef(function->name);
+    std::optional<TypeId> existingFunctionTy = scope->lookupLValue(def);
 
     if (AstExprLocal* localName = function->name->as<AstExprLocal>())
     {
@@ -867,12 +829,8 @@ ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStatFunction
             scope->bindings[localName->local] = Binding{generalizedType, localName->location};
 
         sig.bodyScope->bindings[localName->local] = Binding{sig.signature, localName->location};
-
-        if (functionBreadcrumb)
-        {
-            sig.bodyScope->lvalueTypes[functionBreadcrumb->def] = sig.signature;
-            sig.bodyScope->rvalueRefinements[functionBreadcrumb->def] = sig.signature;
-        }
+        sig.bodyScope->lvalueTypes[def] = sig.signature;
+        sig.bodyScope->rvalueRefinements[def] = sig.signature;
     }
     else if (AstExprGlobal* globalName = function->name->as<AstExprGlobal>())
     {
@@ -882,17 +840,14 @@ ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStatFunction
         generalizedType = *existingFunctionTy;
 
         sig.bodyScope->bindings[globalName->name] = Binding{sig.signature, globalName->location};
-
-        if (functionBreadcrumb)
-        {
-            sig.bodyScope->lvalueTypes[functionBreadcrumb->def] = sig.signature;
-            sig.bodyScope->rvalueRefinements[functionBreadcrumb->def] = sig.signature;
-        }
+        sig.bodyScope->lvalueTypes[def] = sig.signature;
+        sig.bodyScope->rvalueRefinements[def] = sig.signature;
     }
     else if (AstExprIndexName* indexName = function->name->as<AstExprIndexName>())
     {
         Checkpoint check1 = checkpoint(this);
-        TypeId lvalueType = checkLValue(scope, indexName);
+        std::optional<TypeId> lvalueType = checkLValue(scope, indexName);
+        LUAU_ASSERT(lvalueType);
         Checkpoint check2 = checkpoint(this);
 
         forEachConstraint(check1, check2, this, [&excludeList](const ConstraintPtr& c) {
@@ -901,10 +856,13 @@ ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStatFunction
 
         // TODO figure out how to populate the location field of the table Property.
 
-        if (get<FreeType>(lvalueType))
-            asMutable(lvalueType)->ty.emplace<BoundType>(generalizedType);
-        else
-            addConstraint(scope, indexName->location, SubtypeConstraint{lvalueType, generalizedType});
+        if (lvalueType)
+        {
+            if (get<FreeType>(*lvalueType))
+                asMutable(*lvalueType)->ty.emplace<BoundType>(generalizedType);
+            else
+                addConstraint(scope, indexName->location, SubtypeConstraint{*lvalueType, generalizedType});
+        }
     }
     else if (AstExprError* err = function->name->as<AstExprError>())
     {
@@ -914,8 +872,7 @@ ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStatFunction
     if (generalizedType == nullptr)
         ice->ice("generalizedType == nullptr", function->location);
 
-    if (functionBreadcrumb)
-        scope->rvalueRefinements[functionBreadcrumb->def] = generalizedType;
+    scope->rvalueRefinements[def] = generalizedType;
 
     checkFunctionBody(sig.bodyScope, function->func);
     Checkpoint end = checkpoint(this);
@@ -997,18 +954,23 @@ ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStatAssign*
 
     for (AstExpr* lvalue : assign->vars)
     {
-        TypeId upperBound = follow(checkLValue(scope, lvalue));
-        if (get<FreeType>(upperBound))
-            expectedTypes.push_back(std::nullopt);
-        else
-            expectedTypes.push_back(upperBound);
-
         TypeId assignee = arena->addType(BlockedType{});
         assignees.push_back(assignee);
-        addConstraint(scope, lvalue->location, SubtypeConstraint{assignee, upperBound});
 
-        if (NullableBreadcrumbId bc = dfg->getBreadcrumb(lvalue))
-            scope->lvalueTypes[bc->def] = assignee;
+        std::optional<TypeId> upperBound = follow(checkLValue(scope, lvalue));
+        if (upperBound)
+        {
+            if (get<FreeType>(*upperBound))
+                expectedTypes.push_back(std::nullopt);
+            else
+                expectedTypes.push_back(*upperBound);
+
+            addConstraint(scope, lvalue->location, SubtypeConstraint{assignee, *upperBound});
+        }
+
+        DefId def = dfg->getDef(lvalue);
+        scope->lvalueTypes[def] = assignee;
+        updateLValueType(lvalue, assignee);
     }
 
     TypePackId resultPack = checkPack(scope, assign->values, expectedTypes).tp;
@@ -1019,15 +981,15 @@ ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStatAssign*
 
 ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStatCompoundAssign* assign)
 {
-    // We need to tweak the BinaryConstraint that we emit, so we cannot use the
-    // strategy of falsifying an AST fragment.
-    TypeId varTy = checkLValue(scope, assign->var);
-    TypeId valueTy = check(scope, assign->value).ty;
+    std::optional<TypeId> varTy = checkLValue(scope, assign->var);
+
+    AstExprBinary binop = AstExprBinary{assign->location, assign->op, assign->var, assign->value};
+    TypeId resultTy = check(scope, &binop).ty;
+    if (varTy)
+        addConstraint(scope, assign->location, SubtypeConstraint{resultTy, *varTy});
 
-    TypeId resultType = arena->addType(BlockedType{});
-    addConstraint(scope, assign->location,
-        BinaryConstraint{assign->op, varTy, valueTy, resultType, assign, &module->astOriginalCallTypes, &module->astOverloadResolvedTypes});
-    addConstraint(scope, assign->location, SubtypeConstraint{resultType, varTy});
+    DefId def = dfg->getDef(assign->var);
+    scope->lvalueTypes[def] = resultTy;
 
     return ControlFlow::None;
 }
@@ -1138,9 +1100,9 @@ ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStatDeclareG
     module->declaredGlobals[globalName] = globalTy;
     rootScope->bindings[global->name] = Binding{globalTy, global->location};
 
-    BreadcrumbId bc = dfg->getBreadcrumb(global);
-    rootScope->lvalueTypes[bc->def] = globalTy;
-    rootScope->rvalueRefinements[bc->def] = globalTy;
+    DefId def = dfg->getDef(global);
+    rootScope->lvalueTypes[def] = globalTy;
+    rootScope->rvalueRefinements[def] = globalTy;
 
     return ControlFlow::None;
 }
@@ -1310,9 +1272,9 @@ ControlFlow ConstraintGraphBuilder::visit(const ScopePtr& scope, AstStatDeclareF
     module->declaredGlobals[fnName] = fnType;
     scope->bindings[global->name] = Binding{fnType, global->location};
 
-    BreadcrumbId bc = dfg->getBreadcrumb(global);
-    rootScope->lvalueTypes[bc->def] = fnType;
-    rootScope->rvalueRefinements[bc->def] = fnType;
+    DefId def = dfg->getDef(global);
+    rootScope->lvalueTypes[def] = fnType;
+    rootScope->rvalueRefinements[def] = fnType;
 
     return ControlFlow::None;
 }
@@ -1409,10 +1371,10 @@ InferencePack ConstraintGraphBuilder::checkPack(const ScopePtr& scope, AstExprCa
 
         exprArgs.push_back(indexExpr->expr);
 
-        if (auto bc = dfg->getBreadcrumb(indexExpr->expr))
+        if (auto key = dfg->getRefinementKey(indexExpr->expr))
         {
             TypeId discriminantTy = arena->addType(BlockedType{});
-            returnRefinements.push_back(refinementArena.proposition(NotNull{bc}, discriminantTy));
+            returnRefinements.push_back(refinementArena.proposition(key, discriminantTy));
             discriminantTypes.push_back(discriminantTy);
         }
         else
@@ -1423,10 +1385,10 @@ InferencePack ConstraintGraphBuilder::checkPack(const ScopePtr& scope, AstExprCa
     {
         exprArgs.push_back(arg);
 
-        if (auto bc = dfg->getBreadcrumb(arg))
+        if (auto key = dfg->getRefinementKey(arg))
         {
             TypeId discriminantTy = arena->addType(BlockedType{});
-            returnRefinements.push_back(refinementArena.proposition(NotNull{bc}, discriminantTy));
+            returnRefinements.push_back(refinementArena.proposition(key, discriminantTy));
             discriminantTypes.push_back(discriminantTy);
         }
         else
@@ -1525,9 +1487,12 @@ InferencePack ConstraintGraphBuilder::checkPack(const ScopePtr& scope, AstExprCa
         {
             scope->bindings[targetLocal->local].typeId = resultTy;
 
-            BreadcrumbId bc = dfg->getBreadcrumb(targetLocal);
-            scope->lvalueTypes[bc->def] = resultTy; // TODO: typestates: track this as an assignment
-            scope->rvalueRefinements[bc->def] = resultTy; // TODO: typestates: track this as an assignment
+            DefId def = dfg->getDef(targetLocal);
+            scope->lvalueTypes[def] = resultTy;       // TODO: typestates: track this as an assignment
+            scope->rvalueRefinements[def] = resultTy; // TODO: typestates: track this as an assignment
+
+            if (auto it = inferredBindings.find(targetLocal->local); it != inferredBindings.end())
+                it->second.types.insert(resultTy);
         }
 
         return InferencePack{arena->addTypePack({resultTy}), {refinementArena.variadic(returnRefinements)}};
@@ -1686,27 +1651,51 @@ Inference ConstraintGraphBuilder::check(const ScopePtr& scope, AstExprConstantBo
 
 Inference ConstraintGraphBuilder::check(const ScopePtr& scope, AstExprLocal* local)
 {
-    BreadcrumbId bc = dfg->getBreadcrumb(local);
+    const RefinementKey* key = dfg->getRefinementKey(local);
+    std::optional<DefId> rvalueDef = dfg->getRValueDefForCompoundAssign(local);
+    LUAU_ASSERT(key || rvalueDef);
+
+    std::optional<TypeId> maybeTy;
+
+    // if we have a refinement key, we can look up its type.
+    if (key)
+        maybeTy = scope->lookup(key->def);
+
+    // if the current def doesn't have a type, we might be doing a compound assignment
+    // and therefore might need to look at the rvalue def instead.
+    if (!maybeTy && rvalueDef)
+        maybeTy = scope->lookup(*rvalueDef);
+
+    if (maybeTy)
+    {
+        TypeId ty = follow(*maybeTy);
+        if (auto it = inferredBindings.find(local->local); it != inferredBindings.end())
+            it->second.types.insert(ty);
 
-    if (auto ty = scope->lookup(bc->def))
-        return Inference{*ty, refinementArena.proposition(bc, builtinTypes->truthyType)};
+        return Inference{ty, refinementArena.proposition(key, builtinTypes->truthyType)};
+    }
     else
         ice->ice("CGB: AstExprLocal came before its declaration?");
 }
 
 Inference ConstraintGraphBuilder::check(const ScopePtr& scope, AstExprGlobal* global)
 {
-    BreadcrumbId bc = dfg->getBreadcrumb(global);
+    const RefinementKey* key = dfg->getRefinementKey(global);
+    std::optional<DefId> rvalueDef = dfg->getRValueDefForCompoundAssign(global);
+    LUAU_ASSERT(key || rvalueDef);
+
+    // we'll use whichever of the two definitions we have here.
+    DefId def = key ? key->def : *rvalueDef;
 
     /* prepopulateGlobalScope() has already added all global functions to the environment by this point, so any
      * global that is not already in-scope is definitely an unknown symbol.
      */
-    if (auto ty = scope->lookup(bc->def))
-        return Inference{*ty, refinementArena.proposition(bc, builtinTypes->truthyType)};
+    if (auto ty = scope->lookup(def))
+        return Inference{*ty, refinementArena.proposition(key, builtinTypes->truthyType)};
     else if (auto ty = scope->lookup(global->name))
     {
-        rootScope->rvalueRefinements[bc->def] = *ty;
-        return Inference{*ty, refinementArena.proposition(bc, builtinTypes->truthyType)};
+        rootScope->rvalueRefinements[key->def] = *ty;
+        return Inference{*ty, refinementArena.proposition(key, builtinTypes->truthyType)};
     }
     else
     {
@@ -1720,19 +1709,19 @@ Inference ConstraintGraphBuilder::check(const ScopePtr& scope, AstExprIndexName*
     TypeId obj = check(scope, indexName->expr).ty;
     TypeId result = arena->addType(BlockedType{});
 
-    NullableBreadcrumbId bc = dfg->getBreadcrumb(indexName);
-    if (bc)
+    const RefinementKey* key = dfg->getRefinementKey(indexName);
+    if (key)
     {
-        if (auto ty = scope->lookup(bc->def))
-            return Inference{*ty, refinementArena.proposition(NotNull{bc}, builtinTypes->truthyType)};
+        if (auto ty = scope->lookup(key->def))
+            return Inference{*ty, refinementArena.proposition(key, builtinTypes->truthyType)};
 
-        scope->rvalueRefinements[bc->def] = result;
+        scope->rvalueRefinements[key->def] = result;
     }
 
     addConstraint(scope, indexName->expr->location, HasPropConstraint{result, obj, indexName->index.value});
 
-    if (bc)
-        return Inference{result, refinementArena.proposition(NotNull{bc}, builtinTypes->truthyType)};
+    if (key)
+        return Inference{result, refinementArena.proposition(key, builtinTypes->truthyType)};
     else
         return Inference{result};
 }
@@ -1743,13 +1732,13 @@ Inference ConstraintGraphBuilder::check(const ScopePtr& scope, AstExprIndexExpr*
     TypeId indexType = check(scope, indexExpr->index).ty;
     TypeId result = freshType(scope);
 
-    NullableBreadcrumbId bc = dfg->getBreadcrumb(indexExpr);
-    if (bc)
+    const RefinementKey* key = dfg->getRefinementKey(indexExpr);
+    if (key)
     {
-        if (auto ty = scope->lookup(bc->def))
-            return Inference{*ty, refinementArena.proposition(NotNull{bc}, builtinTypes->truthyType)};
+        if (auto ty = scope->lookup(key->def))
+            return Inference{*ty, refinementArena.proposition(key, builtinTypes->truthyType)};
 
-        scope->rvalueRefinements[bc->def] = result;
+        scope->rvalueRefinements[key->def] = result;
     }
 
     TableIndexer indexer{indexType, result};
@@ -1757,8 +1746,8 @@ Inference ConstraintGraphBuilder::check(const ScopePtr& scope, AstExprIndexExpr*
 
     addConstraint(scope, indexExpr->expr->location, SubtypeConstraint{obj, tableType});
 
-    if (bc)
-        return Inference{result, refinementArena.proposition(NotNull{bc}, builtinTypes->truthyType)};
+    if (key)
+        return Inference{result, refinementArena.proposition(key, builtinTypes->truthyType)};
     else
         return Inference{result};
 }
@@ -1812,12 +1801,28 @@ Inference ConstraintGraphBuilder::check(const ScopePtr& scope, AstExprUnary* una
         addConstraint(scope, unary->location, ReduceConstraint{resultType});
         return Inference{resultType, refinementArena.negation(refinement)};
     }
-    default:
+    case AstExprUnary::Op::Len:
     {
-        TypeId resultType = arena->addType(BlockedType{});
-        addConstraint(scope, unary->location, UnaryConstraint{unary->op, operandType, resultType});
-        return Inference{resultType};
+        TypeId resultType = arena->addType(TypeFamilyInstanceType{
+            NotNull{&kBuiltinTypeFamilies.lenFamily},
+            {operandType},
+            {},
+        });
+        addConstraint(scope, unary->location, ReduceConstraint{resultType});
+        return Inference{resultType, refinementArena.negation(refinement)};
+    }
+    case AstExprUnary::Op::Minus:
+    {
+        TypeId resultType = arena->addType(TypeFamilyInstanceType{
+            NotNull{&kBuiltinTypeFamilies.unmFamily},
+            {operandType},
+            {},
+        });
+        addConstraint(scope, unary->location, ReduceConstraint{resultType});
+        return Inference{resultType, refinementArena.negation(refinement)};
     }
+    default: // msvc can't prove that this is exhaustive.
+        LUAU_UNREACHABLE();
     }
 }
 
@@ -1978,13 +1983,10 @@ Inference ConstraintGraphBuilder::check(const ScopePtr& scope, AstExprBinary* bi
         addConstraint(scope, binary->location, ReduceConstraint{resultType});
         return Inference{resultType, std::move(refinement)};
     }
-    default:
-    {
-        TypeId resultType = arena->addType(BlockedType{});
-        addConstraint(scope, binary->location,
-            BinaryConstraint{binary->op, leftType, rightType, resultType, binary, &module->astOriginalCallTypes, &module->astOverloadResolvedTypes});
-        return Inference{resultType, std::move(refinement)};
-    }
+    case AstExprBinary::Op::Op__Count:
+        ice->ice("Op__Count should never be generated in an AST.");
+    default: // msvc can't prove that this is exhaustive.
+        LUAU_UNREACHABLE();
     }
 }
 
@@ -2056,9 +2058,10 @@ std::tuple<TypeId, TypeId, RefinementId> ConstraintGraphBuilder::checkBinary(
         TypeId leftType = check(scope, binary->left).ty;
         TypeId rightType = check(scope, binary->right).ty;
 
-        NullableBreadcrumbId bc = dfg->getBreadcrumb(typeguard->target);
-        if (!bc)
+        const RefinementKey* key = dfg->getRefinementKey(typeguard->target);
+        if (!key)
             return {leftType, rightType, nullptr};
+
         auto augmentForErrorSupression = [&](TypeId ty) -> TypeId {
             return arena->addType(UnionType{{ty, builtinTypes->errorType}});
         };
@@ -2096,7 +2099,7 @@ std::tuple<TypeId, TypeId, RefinementId> ConstraintGraphBuilder::checkBinary(
                 discriminantTy = ty;
         }
 
-        RefinementId proposition = refinementArena.proposition(NotNull{bc}, discriminantTy);
+        RefinementId proposition = refinementArena.proposition(key, discriminantTy);
         if (binary->op == AstExprBinary::CompareEq)
             return {leftType, rightType, proposition};
         else if (binary->op == AstExprBinary::CompareNe)
@@ -2111,13 +2114,8 @@ std::tuple<TypeId, TypeId, RefinementId> ConstraintGraphBuilder::checkBinary(
         TypeId leftType = check(scope, binary->left, {}, true).ty;
         TypeId rightType = check(scope, binary->right, {}, true).ty;
 
-        RefinementId leftRefinement = nullptr;
-        if (auto bc = dfg->getBreadcrumb(binary->left))
-            leftRefinement = refinementArena.proposition(NotNull{bc}, rightType);
-
-        RefinementId rightRefinement = nullptr;
-        if (auto bc = dfg->getBreadcrumb(binary->right))
-            rightRefinement = refinementArena.proposition(NotNull{bc}, leftType);
+        RefinementId leftRefinement = refinementArena.proposition(dfg->getRefinementKey(binary->left), rightType);
+        RefinementId rightRefinement = refinementArena.proposition(dfg->getRefinementKey(binary->right), leftType);
 
         if (binary->op == AstExprBinary::CompareNe)
         {
@@ -2135,7 +2133,7 @@ std::tuple<TypeId, TypeId, RefinementId> ConstraintGraphBuilder::checkBinary(
     }
 }
 
-TypeId ConstraintGraphBuilder::checkLValue(const ScopePtr& scope, AstExpr* expr)
+std::optional<TypeId> ConstraintGraphBuilder::checkLValue(const ScopePtr& scope, AstExpr* expr)
 {
     if (auto local = expr->as<AstExprLocal>())
         return checkLValue(scope, local);
@@ -2154,24 +2152,42 @@ TypeId ConstraintGraphBuilder::checkLValue(const ScopePtr& scope, AstExpr* expr)
         ice->ice("checkLValue is inexhaustive");
 }
 
-TypeId ConstraintGraphBuilder::checkLValue(const ScopePtr& scope, AstExprLocal* local)
+std::optional<TypeId> ConstraintGraphBuilder::checkLValue(const ScopePtr& scope, AstExprLocal* local)
 {
-    std::optional<TypeId> upperBound = scope->lookup(Symbol{local->local});
-    LUAU_ASSERT(upperBound);
-    return *upperBound;
+    /*
+     * The caller of this method uses the returned type to emit the proper
+     * SubtypeConstraint.
+     *
+     * At this point during constraint generation, the binding table is only
+     * populated by symbols that have type annotations.
+     *
+     * If this local has an interesting type annotation, it is important that we
+     * return that.
+     */
+    std::optional<TypeId> annotatedTy = scope->lookup(local->local);
+    if (annotatedTy)
+        return annotatedTy;
+
+    /*
+     * As a safety measure, we'll assert that no type has yet been ascribed to
+     * the corresponding def.  We'll populate this when we generate
+     * constraints for assignment and compound assignment statements.
+     */
+    LUAU_ASSERT(!scope->lookupLValue(dfg->getDef(local)));
+    return std::nullopt;
 }
 
-TypeId ConstraintGraphBuilder::checkLValue(const ScopePtr& scope, AstExprGlobal* global)
+std::optional<TypeId> ConstraintGraphBuilder::checkLValue(const ScopePtr& scope, AstExprGlobal* global)
 {
-    return scope->lookup(Symbol{global->name}).value_or(builtinTypes->errorRecoveryType());
+    return scope->lookup(Symbol{global->name});
 }
 
-TypeId ConstraintGraphBuilder::checkLValue(const ScopePtr& scope, AstExprIndexName* indexName)
+std::optional<TypeId> ConstraintGraphBuilder::checkLValue(const ScopePtr& scope, AstExprIndexName* indexName)
 {
     return updateProperty(scope, indexName);
 }
 
-TypeId ConstraintGraphBuilder::checkLValue(const ScopePtr& scope, AstExprIndexExpr* indexExpr)
+std::optional<TypeId> ConstraintGraphBuilder::checkLValue(const ScopePtr& scope, AstExprIndexExpr* indexExpr)
 {
     return updateProperty(scope, indexExpr);
 }
@@ -2226,7 +2242,7 @@ TypeId ConstraintGraphBuilder::updateProperty(const ScopePtr& scope, AstExpr* ex
         return check(scope, expr).ty;
 
     Symbol sym;
-    NullableBreadcrumbId bc = nullptr;
+    const Def* def = nullptr;
     std::vector<std::string> segments;
     std::vector<AstExpr*> exprs;
 
@@ -2236,13 +2252,13 @@ TypeId ConstraintGraphBuilder::updateProperty(const ScopePtr& scope, AstExpr* ex
         if (auto global = e->as<AstExprGlobal>())
         {
             sym = global->name;
-            bc = dfg->getBreadcrumb(global);
+            def = dfg->getDef(global);
             break;
         }
         else if (auto local = e->as<AstExprLocal>())
         {
             sym = local->local;
-            bc = dfg->getBreadcrumb(local);
+            def = dfg->getDef(local);
             break;
         }
         else if (auto indexName = e->as<AstExprIndexName>())
@@ -2275,20 +2291,12 @@ TypeId ConstraintGraphBuilder::updateProperty(const ScopePtr& scope, AstExpr* ex
     std::reverse(begin(segments), end(segments));
     std::reverse(begin(exprs), end(exprs));
 
-    auto lookupResult = scope->lookupEx(sym);
+    LUAU_ASSERT(def);
+    std::optional<std::pair<TypeId, Scope*>> lookupResult = scope->lookupEx(NotNull{def});
     if (!lookupResult)
         return check(scope, expr).ty;
-    const auto [subjectBinding, symbolScope] = std::move(*lookupResult);
-
-    LUAU_ASSERT(bc);
-    std::optional<TypeId> subjectTy = scope->lookup(bc->def);
 
-    /* If we have a breadcrumb but no type, it can only mean that we're setting
-     * a property of some builtin table.  This isn't legal, but we still want to
-     * wire up the constraints properly so that we can report why it is not
-     * legal.
-     */
-    TypeId subjectType = subjectTy.value_or(subjectBinding->typeId);
+    const auto [subjectType, subjectScope] = *lookupResult;
 
     TypeId propTy = freshType(scope);
 
@@ -2311,20 +2319,29 @@ TypeId ConstraintGraphBuilder::updateProperty(const ScopePtr& scope, AstExpr* ex
 
     if (!subjectType->persistent)
     {
-        symbolScope->bindings[sym].typeId = updatedType;
+        subjectScope->bindings[sym].typeId = updatedType;
 
         // This can fail if the user is erroneously trying to augment a builtin
         // table like os or string.
-        if (auto bc = dfg->getBreadcrumb(e))
+        if (auto key = dfg->getRefinementKey(e))
         {
-            symbolScope->lvalueTypes[bc->def] = updatedType;
-            symbolScope->rvalueRefinements[bc->def] = updatedType;
+            subjectScope->lvalueTypes[key->def] = updatedType;
+            subjectScope->rvalueRefinements[key->def] = updatedType;
         }
     }
 
     return propTy;
 }
 
+void ConstraintGraphBuilder::updateLValueType(AstExpr* lvalue, TypeId ty)
+{
+    if (auto local = lvalue->as<AstExprLocal>())
+    {
+        if (auto it = inferredBindings.find(local->local); it != inferredBindings.end())
+            it->second.types.insert(ty);
+    }
+}
+
 Inference ConstraintGraphBuilder::check(const ScopePtr& scope, AstExprTable* expr, std::optional<TypeId> expectedType)
 {
     const bool expectedTypeIsFree = expectedType && get<FreeType>(follow(*expectedType));
@@ -2525,9 +2542,9 @@ ConstraintGraphBuilder::FunctionSignature ConstraintGraphBuilder::checkFunctionS
         argNames.emplace_back(FunctionArgument{fn->self->name.value, fn->self->location});
         signatureScope->bindings[fn->self] = Binding{selfType, fn->self->location};
 
-        BreadcrumbId bc = dfg->getBreadcrumb(fn->self);
-        signatureScope->lvalueTypes[bc->def] = selfType;
-        signatureScope->rvalueRefinements[bc->def] = selfType;
+        DefId def = dfg->getDef(fn->self);
+        signatureScope->lvalueTypes[def] = selfType;
+        signatureScope->rvalueRefinements[def] = selfType;
     }
 
     for (size_t i = 0; i < fn->args.size; ++i)
@@ -2552,14 +2569,13 @@ ConstraintGraphBuilder::FunctionSignature ConstraintGraphBuilder::checkFunctionS
             signatureScope->bindings[local] = Binding{argTy, local->location};
         else
         {
-            BreadcrumbId bc = dfg->getBreadcrumb(local);
             signatureScope->bindings[local] = Binding{builtinTypes->neverType, local->location};
-            inferredBindings.emplace_back(signatureScope.get(), local, bc);
+            inferredBindings[local] = {signatureScope.get(), {}};
         }
 
-        BreadcrumbId bc = dfg->getBreadcrumb(local);
-        signatureScope->lvalueTypes[bc->def] = argTy;
-        signatureScope->rvalueRefinements[bc->def] = argTy;
+        DefId def = dfg->getDef(local);
+        signatureScope->lvalueTypes[def] = argTy;
+        signatureScope->rvalueRefinements[def] = argTy;
     }
 
     TypePackId varargPack = nullptr;
@@ -2854,7 +2870,10 @@ TypeId ConstraintGraphBuilder::resolveType(const ScopePtr& scope, AstType* ty, b
     }
     else if (auto boolAnnotation = ty->as<AstTypeSingletonBool>())
     {
-        result = arena->addType(SingletonType(BooleanSingleton{boolAnnotation->value}));
+        if (boolAnnotation->value)
+            result = builtinTypes->trueType;
+        else
+            result = builtinTypes->falseType;
     }
     else if (auto stringAnnotation = ty->as<AstTypeSingletonString>())
     {
@@ -3042,10 +3061,8 @@ struct GlobalPrepopulator : AstVisitor
             TypeId bt = arena->addType(BlockedType{});
             globalScope->bindings[g->name] = Binding{bt};
 
-            NullableBreadcrumbId bc = dfg->getBreadcrumb(function->name);
-            LUAU_ASSERT(bc);
-
-            globalScope->lvalueTypes[bc->def] = bt;
+            DefId def = dfg->getDef(function->name);
+            globalScope->lvalueTypes[def] = bt;
         }
 
         return true;
@@ -3064,32 +3081,16 @@ void ConstraintGraphBuilder::prepopulateGlobalScope(const ScopePtr& globalScope,
 
 void ConstraintGraphBuilder::fillInInferredBindings(const ScopePtr& globalScope, AstStatBlock* block)
 {
-    std::deque<BreadcrumbId> queue;
-
-    for (const auto& [scope, symbol, breadcrumb] : inferredBindings)
+    for (const auto& [symbol, p] : inferredBindings)
     {
-        LUAU_ASSERT(queue.empty());
-
-        queue.push_back(breadcrumb);
+        const auto& [scope, location, types] = p;
 
-        TypeId ty = builtinTypes->neverType;
+        std::vector<TypeId> tys(types.begin(), types.end());
 
-        while (!queue.empty())
-        {
-            const BreadcrumbId bc = queue.front();
-            queue.pop_front();
-
-            TypeId* lvalueType = scope->lvalueTypes.find(bc->def);
-            if (!lvalueType)
-                continue;
-
-            ty = simplifyUnion(builtinTypes, arena, ty, *lvalueType).result;
-
-            for (BreadcrumbId child : bc->children)
-                queue.push_back(child);
-        }
+        TypeId ty = arena->addType(BlockedType{});
+        addConstraint(globalScope, Location{}, SetOpConstraint{SetOpConstraint::Union, ty, std::move(tys)});
 
-        scope->bindings[symbol].typeId = ty;
+        scope->bindings[symbol] = Binding{ty, location};
     }
 }
 
diff --git a/Analysis/src/ConstraintSolver.cpp b/Analysis/src/ConstraintSolver.cpp
index bdcd1663f..924958ab3 100644
--- a/Analysis/src/ConstraintSolver.cpp
+++ b/Analysis/src/ConstraintSolver.cpp
@@ -516,10 +516,6 @@ bool ConstraintSolver::tryDispatch(NotNull<const Constraint> constraint, bool fo
         success = tryDispatch(*gc, constraint, force);
     else if (auto ic = get<InstantiationConstraint>(*constraint))
         success = tryDispatch(*ic, constraint, force);
-    else if (auto uc = get<UnaryConstraint>(*constraint))
-        success = tryDispatch(*uc, constraint, force);
-    else if (auto bc = get<BinaryConstraint>(*constraint))
-        success = tryDispatch(*bc, constraint, force);
     else if (auto ic = get<IterableConstraint>(*constraint))
         success = tryDispatch(*ic, constraint, force);
     else if (auto nc = get<NameConstraint>(*constraint))
@@ -542,6 +538,8 @@ bool ConstraintSolver::tryDispatch(NotNull<const Constraint> constraint, bool fo
         success = tryDispatch(*uc, constraint);
     else if (auto rc = get<RefineConstraint>(*constraint))
         success = tryDispatch(*rc, constraint, force);
+    else if (auto soc = get<SetOpConstraint>(*constraint))
+        success = tryDispatch(*soc, constraint, force);
     else if (auto rc = get<ReduceConstraint>(*constraint))
         success = tryDispatch(*rc, constraint, force);
     else if (auto rpc = get<ReducePackConstraint>(*constraint))
@@ -652,335 +650,6 @@ bool ConstraintSolver::tryDispatch(const InstantiationConstraint& c, NotNull<con
     return true;
 }
 
-bool ConstraintSolver::tryDispatch(const UnaryConstraint& c, NotNull<const Constraint> constraint, bool force)
-{
-    TypeId operandType = follow(c.operandType);
-
-    if (isBlocked(operandType))
-        return block(operandType, constraint);
-
-    if (!force && get<FreeType>(operandType))
-        return block(operandType, constraint);
-
-    LUAU_ASSERT(get<BlockedType>(c.resultType));
-
-    switch (c.op)
-    {
-    case AstExprUnary::Not:
-    {
-        asMutable(c.resultType)->ty.emplace<BoundType>(builtinTypes->booleanType);
-
-        unblock(c.resultType, constraint->location);
-        return true;
-    }
-    case AstExprUnary::Len:
-    {
-        // __len must return a number.
-        asMutable(c.resultType)->ty.emplace<BoundType>(builtinTypes->numberType);
-
-        unblock(c.resultType, constraint->location);
-        return true;
-    }
-    case AstExprUnary::Minus:
-    {
-        if (isNumber(operandType) || get<AnyType>(operandType) || get<ErrorType>(operandType) || get<NeverType>(operandType))
-        {
-            asMutable(c.resultType)->ty.emplace<BoundType>(c.operandType);
-        }
-        else if (std::optional<TypeId> mm = findMetatableEntry(builtinTypes, errors, operandType, "__unm", constraint->location))
-        {
-            TypeId mmTy = follow(*mm);
-
-            if (get<FreeType>(mmTy) && !force)
-                return block(mmTy, constraint);
-
-            TypePackId argPack = arena->addTypePack(TypePack{{operandType}, {}});
-            TypePackId retPack = arena->addTypePack(BlockedTypePack{});
-
-            TypeId res = freshType(arena, builtinTypes, constraint->scope);
-            asMutable(c.resultType)->ty.emplace<BoundType>(res);
-
-            pushConstraint(constraint->scope, constraint->location, PackSubtypeConstraint{retPack, arena->addTypePack(TypePack{{c.resultType}})});
-
-            pushConstraint(constraint->scope, constraint->location, FunctionCallConstraint{mmTy, argPack, retPack, nullptr});
-        }
-        else
-        {
-            asMutable(c.resultType)->ty.emplace<BoundType>(builtinTypes->errorRecoveryType());
-        }
-
-        unblock(c.resultType, constraint->location);
-        return true;
-    }
-    }
-
-    LUAU_ASSERT(false);
-    return false;
-}
-
-bool ConstraintSolver::tryDispatch(const BinaryConstraint& c, NotNull<const Constraint> constraint, bool force)
-{
-    TypeId leftType = follow(c.leftType);
-    TypeId rightType = follow(c.rightType);
-    TypeId resultType = follow(c.resultType);
-
-    LUAU_ASSERT(get<BlockedType>(resultType));
-
-    bool isLogical = c.op == AstExprBinary::Op::And || c.op == AstExprBinary::Op::Or;
-
-    /* Compound assignments create constraints of the form
-     *
-     *     A <: Binary<op, A, B>
-     *
-     * This constraint is the one that is meant to unblock A, so it doesn't
-     * make any sense to stop and wait for someone else to do it.
-     */
-
-    // If any is present, the expression must evaluate to any as well.
-    bool leftAny = get<AnyType>(leftType) || get<ErrorType>(leftType);
-    bool rightAny = get<AnyType>(rightType) || get<ErrorType>(rightType);
-    bool anyPresent = leftAny || rightAny;
-
-    if (isBlocked(leftType) && leftType != resultType)
-        return block(c.leftType, constraint);
-
-    if (isBlocked(rightType) && rightType != resultType)
-        return block(c.rightType, constraint);
-
-    if (!force)
-    {
-        // Logical expressions may proceed if the LHS is free.
-        if (hasTypeInIntersection<FreeType>(leftType) && !isLogical)
-            return block(leftType, constraint);
-    }
-
-    // Logical expressions may proceed if the LHS is free.
-    if (isBlocked(leftType) || (hasTypeInIntersection<FreeType>(leftType) && !isLogical))
-    {
-        asMutable(resultType)->ty.emplace<BoundType>(errorRecoveryType());
-        unblock(resultType, constraint->location);
-        return true;
-    }
-
-    // Metatables go first, even if there is primitive behavior.
-    if (auto it = kBinaryOpMetamethods.find(c.op); it != kBinaryOpMetamethods.end())
-    {
-        LUAU_ASSERT(FFlag::LuauFloorDivision || c.op != AstExprBinary::Op::FloorDiv);
-
-        // Metatables are not the same. The metamethod will not be invoked.
-        if ((c.op == AstExprBinary::Op::CompareEq || c.op == AstExprBinary::Op::CompareNe) &&
-            getMetatable(leftType, builtinTypes) != getMetatable(rightType, builtinTypes))
-        {
-            // TODO: Boolean singleton false? The result is _always_ boolean false.
-            asMutable(resultType)->ty.emplace<BoundType>(builtinTypes->booleanType);
-            unblock(resultType, constraint->location);
-            return true;
-        }
-
-        std::optional<TypeId> mm;
-
-        // The LHS metatable takes priority over the RHS metatable, where
-        // present.
-        if (std::optional<TypeId> leftMm = findMetatableEntry(builtinTypes, errors, leftType, it->second, constraint->location))
-            mm = leftMm;
-        else if (std::optional<TypeId> rightMm = findMetatableEntry(builtinTypes, errors, rightType, it->second, constraint->location))
-            mm = rightMm;
-
-        if (mm)
-        {
-            std::optional<TypeId> instantiatedMm = instantiate(builtinTypes, arena, NotNull{&limits}, constraint->scope, *mm);
-            if (!instantiatedMm)
-            {
-                reportError(CodeTooComplex{}, constraint->location);
-                return true;
-            }
-
-            // TODO: Is a table with __call legal here?
-            // TODO: Overloads
-            if (const FunctionType* ftv = get<FunctionType>(follow(*instantiatedMm)))
-            {
-                TypePackId inferredArgs;
-                // For >= and > we invoke __lt and __le respectively with
-                // swapped argument ordering.
-                if (c.op == AstExprBinary::Op::CompareGe || c.op == AstExprBinary::Op::CompareGt)
-                {
-                    inferredArgs = arena->addTypePack({rightType, leftType});
-                }
-                else
-                {
-                    inferredArgs = arena->addTypePack({leftType, rightType});
-                }
-
-                unify(constraint->scope, constraint->location, inferredArgs, ftv->argTypes);
-
-                TypeId mmResult;
-
-                // Comparison operations always evaluate to a boolean,
-                // regardless of what the metamethod returns.
-                switch (c.op)
-                {
-                case AstExprBinary::Op::CompareEq:
-                case AstExprBinary::Op::CompareNe:
-                case AstExprBinary::Op::CompareGe:
-                case AstExprBinary::Op::CompareGt:
-                case AstExprBinary::Op::CompareLe:
-                case AstExprBinary::Op::CompareLt:
-                    mmResult = builtinTypes->booleanType;
-                    break;
-                default:
-                    if (get<NeverType>(leftType) || get<NeverType>(rightType))
-                        mmResult = builtinTypes->neverType;
-                    else
-                        mmResult = first(ftv->retTypes).value_or(errorRecoveryType());
-                }
-
-                asMutable(resultType)->ty.emplace<BoundType>(mmResult);
-                unblock(resultType, constraint->location);
-
-                (*c.astOriginalCallTypes)[c.astFragment] = *mm;
-                (*c.astOverloadResolvedTypes)[c.astFragment] = *instantiatedMm;
-                return true;
-            }
-        }
-
-        // If there's no metamethod available, fall back to primitive behavior.
-    }
-
-    switch (c.op)
-    {
-    // For arithmetic operators, if the LHS is a number, the RHS must be a
-    // number as well. The result will also be a number.
-    case AstExprBinary::Op::Add:
-    case AstExprBinary::Op::Sub:
-    case AstExprBinary::Op::Mul:
-    case AstExprBinary::Op::Div:
-    case AstExprBinary::Op::FloorDiv:
-    case AstExprBinary::Op::Pow:
-    case AstExprBinary::Op::Mod:
-    {
-        LUAU_ASSERT(FFlag::LuauFloorDivision || c.op != AstExprBinary::Op::FloorDiv);
-
-        const NormalizedType* normLeftTy = normalizer->normalize(leftType);
-        if (hasTypeInIntersection<FreeType>(leftType) && force)
-            asMutable(leftType)->ty.emplace<BoundType>(anyPresent ? builtinTypes->anyType : builtinTypes->numberType);
-        // We want to check if the left type has tops because `any` is a valid type for the lhs
-        if (normLeftTy && (normLeftTy->isExactlyNumber() || get<AnyType>(normLeftTy->tops)))
-        {
-            unify(constraint->scope, constraint->location, leftType, rightType);
-            asMutable(resultType)->ty.emplace<BoundType>(anyPresent ? builtinTypes->anyType : leftType);
-            unblock(resultType, constraint->location);
-            return true;
-        }
-        else if (get<NeverType>(leftType) || get<NeverType>(rightType))
-        {
-            unify(constraint->scope, constraint->location, leftType, rightType);
-            asMutable(resultType)->ty.emplace<BoundType>(builtinTypes->neverType);
-            unblock(resultType, constraint->location);
-            return true;
-        }
-
-        break;
-    }
-    // For concatenation, if the LHS is a string, the RHS must be a string as
-    // well. The result will also be a string.
-    case AstExprBinary::Op::Concat:
-    {
-        if (hasTypeInIntersection<FreeType>(leftType) && force)
-            asMutable(leftType)->ty.emplace<BoundType>(anyPresent ? builtinTypes->anyType : builtinTypes->stringType);
-        const NormalizedType* leftNormTy = normalizer->normalize(leftType);
-        if (leftNormTy && leftNormTy->isSubtypeOfString())
-        {
-            unify(constraint->scope, constraint->location, leftType, rightType);
-            asMutable(resultType)->ty.emplace<BoundType>(anyPresent ? builtinTypes->anyType : leftType);
-            unblock(resultType, constraint->location);
-            return true;
-        }
-        else if (get<NeverType>(leftType) || get<NeverType>(rightType))
-        {
-            unify(constraint->scope, constraint->location, leftType, rightType);
-            asMutable(resultType)->ty.emplace<BoundType>(builtinTypes->neverType);
-            unblock(resultType, constraint->location);
-            return true;
-        }
-
-        break;
-    }
-    // Inexact comparisons require that the types be both numbers or both
-    // strings, and evaluate to a boolean.
-    case AstExprBinary::Op::CompareGe:
-    case AstExprBinary::Op::CompareGt:
-    case AstExprBinary::Op::CompareLe:
-    case AstExprBinary::Op::CompareLt:
-    {
-        const NormalizedType* lt = normalizer->normalize(leftType);
-        const NormalizedType* rt = normalizer->normalize(rightType);
-        // If the lhs is any, comparisons should be valid.
-        if (lt && rt && (lt->isExactlyNumber() || get<AnyType>(lt->tops)) && rt->isExactlyNumber())
-        {
-            asMutable(resultType)->ty.emplace<BoundType>(builtinTypes->booleanType);
-            unblock(resultType, constraint->location);
-            return true;
-        }
-
-        if (lt && rt && (lt->isSubtypeOfString() || get<AnyType>(lt->tops)) && rt->isSubtypeOfString())
-        {
-            asMutable(resultType)->ty.emplace<BoundType>(builtinTypes->booleanType);
-            unblock(resultType, constraint->location);
-            return true;
-        }
-
-
-        if (get<NeverType>(leftType) || get<NeverType>(rightType))
-        {
-            asMutable(resultType)->ty.emplace<BoundType>(builtinTypes->booleanType);
-            unblock(resultType, constraint->location);
-            return true;
-        }
-
-        break;
-    }
-
-    // == and ~= always evaluate to a boolean, and impose no other constraints
-    // on their parameters.
-    case AstExprBinary::Op::CompareEq:
-    case AstExprBinary::Op::CompareNe:
-        asMutable(resultType)->ty.emplace<BoundType>(builtinTypes->booleanType);
-        unblock(resultType, constraint->location);
-        return true;
-    // And evalutes to a boolean if the LHS is falsey, and the RHS type if LHS is
-    // truthy.
-    case AstExprBinary::Op::And:
-    {
-        TypeId leftFilteredTy = simplifyIntersection(builtinTypes, arena, leftType, builtinTypes->falsyType).result;
-
-        asMutable(resultType)->ty.emplace<BoundType>(simplifyUnion(builtinTypes, arena, rightType, leftFilteredTy).result);
-        unblock(resultType, constraint->location);
-        return true;
-    }
-    // Or evaluates to the LHS type if the LHS is truthy, and the RHS type if
-    // LHS is falsey.
-    case AstExprBinary::Op::Or:
-    {
-        TypeId leftFilteredTy = simplifyIntersection(builtinTypes, arena, leftType, builtinTypes->truthyType).result;
-
-        asMutable(resultType)->ty.emplace<BoundType>(simplifyUnion(builtinTypes, arena, rightType, leftFilteredTy).result);
-        unblock(resultType, constraint->location);
-        return true;
-    }
-    default:
-        iceReporter.ice("Unhandled AstExprBinary::Op for binary operation", constraint->location);
-        break;
-    }
-
-    // We failed to either evaluate a metamethod or invoke primitive behavior.
-    unify(constraint->scope, constraint->location, leftType, errorRecoveryType());
-    unify(constraint->scope, constraint->location, rightType, errorRecoveryType());
-    asMutable(resultType)->ty.emplace<BoundType>(errorRecoveryType());
-    unblock(resultType, constraint->location);
-
-    return true;
-}
-
 bool ConstraintSolver::tryDispatch(const IterableConstraint& c, NotNull<const Constraint> constraint, bool force)
 {
     /*
@@ -1946,6 +1615,32 @@ bool ConstraintSolver::tryDispatch(const RefineConstraint& c, NotNull<const Cons
     return true;
 }
 
+bool ConstraintSolver::tryDispatch(const SetOpConstraint& c, NotNull<const Constraint> constraint, bool force)
+{
+    bool blocked = false;
+    for (TypeId ty : c.types)
+    {
+        if (isBlocked(ty))
+        {
+            blocked = true;
+            block(ty, constraint);
+        }
+    }
+    if (blocked && !force)
+        return false;
+
+    LUAU_ASSERT(SetOpConstraint::Union == c.mode);
+
+    TypeId res = builtinTypes->neverType;
+
+    for (TypeId ty : c.types)
+        res = simplifyUnion(builtinTypes, arena, res, ty).result;
+
+    asMutable(c.resultType)->ty.emplace<BoundType>(res);
+
+    return true;
+}
+
 bool ConstraintSolver::tryDispatch(const ReduceConstraint& c, NotNull<const Constraint> constraint, bool force)
 {
     TypeId ty = follow(c.ty);
diff --git a/Analysis/src/DataFlowGraph.cpp b/Analysis/src/DataFlowGraph.cpp
index 523f8df60..e39335742 100644
--- a/Analysis/src/DataFlowGraph.cpp
+++ b/Analysis/src/DataFlowGraph.cpp
@@ -2,11 +2,12 @@
 #include "Luau/DataFlowGraph.h"
 
 #include "Luau/Ast.h"
-#include "Luau/Breadcrumb.h"
+#include "Luau/Def.h"
+#include "Luau/Common.h"
 #include "Luau/Error.h"
-#include "Luau/Refinement.h"
 
 #include <algorithm>
+#include <optional>
 
 LUAU_FASTFLAG(DebugLuauFreezeArena)
 LUAU_FASTFLAG(DebugLuauDeferredConstraintResolution)
@@ -14,74 +15,81 @@ LUAU_FASTFLAG(DebugLuauDeferredConstraintResolution)
 namespace Luau
 {
 
-NullableBreadcrumbId DataFlowGraph::getBreadcrumb(const AstExpr* expr) const
+const RefinementKey* RefinementKeyArena::leaf(DefId def)
 {
-    // We need to skip through AstExprGroup because DFG doesn't try its best to transitively
-    while (auto group = expr->as<AstExprGroup>())
-        expr = group->expr;
-    if (auto bc = astBreadcrumbs.find(expr))
-        return *bc;
-    return nullptr;
+    return allocator.allocate(RefinementKey{nullptr, def, std::nullopt});
 }
 
-BreadcrumbId DataFlowGraph::getBreadcrumb(const AstLocal* local) const
+const RefinementKey* RefinementKeyArena::node(const RefinementKey* parent, DefId def, const std::string& propName)
 {
-    auto bc = localBreadcrumbs.find(local);
-    LUAU_ASSERT(bc);
-    return NotNull{*bc};
+    return allocator.allocate(RefinementKey{parent, def, propName});
 }
 
-BreadcrumbId DataFlowGraph::getBreadcrumb(const AstExprLocal* local) const
+DefId DataFlowGraph::getDef(const AstExpr* expr) const
 {
-    auto bc = astBreadcrumbs.find(local);
-    LUAU_ASSERT(bc);
-    return NotNull{*bc};
+    auto def = astDefs.find(expr);
+    LUAU_ASSERT(def);
+    return NotNull{*def};
 }
 
-BreadcrumbId DataFlowGraph::getBreadcrumb(const AstExprGlobal* global) const
+std::optional<DefId> DataFlowGraph::getRValueDefForCompoundAssign(const AstExpr* expr) const
 {
-    auto bc = astBreadcrumbs.find(global);
-    LUAU_ASSERT(bc);
-    return NotNull{*bc};
+    auto def = compoundAssignBreadcrumbs.find(expr);
+    return def ? std::optional<DefId>(*def) : std::nullopt;
 }
 
-BreadcrumbId DataFlowGraph::getBreadcrumb(const AstStatDeclareGlobal* global) const
+DefId DataFlowGraph::getDef(const AstLocal* local) const
 {
-    auto bc = declaredBreadcrumbs.find(global);
-    LUAU_ASSERT(bc);
-    return NotNull{*bc};
+    auto def = localDefs.find(local);
+    LUAU_ASSERT(def);
+    return NotNull{*def};
 }
 
-BreadcrumbId DataFlowGraph::getBreadcrumb(const AstStatDeclareFunction* func) const
+DefId DataFlowGraph::getDef(const AstStatDeclareGlobal* global) const
 {
-    auto bc = declaredBreadcrumbs.find(func);
-    LUAU_ASSERT(bc);
-    return NotNull{*bc};
+    auto def = declaredDefs.find(global);
+    LUAU_ASSERT(def);
+    return NotNull{*def};
+}
+
+DefId DataFlowGraph::getDef(const AstStatDeclareFunction* func) const
+{
+    auto def = declaredDefs.find(func);
+    LUAU_ASSERT(def);
+    return NotNull{*def};
+}
+
+const RefinementKey* DataFlowGraph::getRefinementKey(const AstExpr* expr) const
+{
+    if (auto key = astRefinementKeys.find(expr))
+        return *key;
+
+    return nullptr;
 }
 
-NullableBreadcrumbId DfgScope::lookup(Symbol symbol) const
+std::optional<DefId> DfgScope::lookup(Symbol symbol) const
 {
     for (const DfgScope* current = this; current; current = current->parent)
     {
-        if (auto breadcrumb = current->bindings.find(symbol))
-            return *breadcrumb;
+        if (auto def = current->bindings.find(symbol))
+            return NotNull{*def};
     }
 
-    return nullptr;
+    return std::nullopt;
 }
 
-NullableBreadcrumbId DfgScope::lookup(DefId def, const std::string& key) const
+std::optional<DefId> DfgScope::lookup(DefId def, const std::string& key) const
 {
     for (const DfgScope* current = this; current; current = current->parent)
     {
         if (auto map = props.find(def))
         {
             if (auto it = map->find(key); it != map->end())
-                return it->second;
+                return NotNull{it->second};
         }
     }
 
-    return nullptr;
+    return std::nullopt;
 }
 
 DataFlowGraph DataFlowGraphBuilder::build(AstStatBlock* block, NotNull<InternalErrorReporter> handle)
@@ -95,8 +103,8 @@ DataFlowGraph DataFlowGraphBuilder::build(AstStatBlock* block, NotNull<InternalE
 
     if (FFlag::DebugLuauFreezeArena)
     {
-        builder.defs->allocator.freeze();
-        builder.breadcrumbs->allocator.freeze();
+        builder.defArena->allocator.freeze();
+        builder.keyArena->allocator.freeze();
     }
 
     return std::move(builder.graph);
@@ -217,10 +225,10 @@ void DataFlowGraphBuilder::visit(DfgScope* scope, AstStatExpr* e)
 void DataFlowGraphBuilder::visit(DfgScope* scope, AstStatLocal* l)
 {
     // We're gonna need a `visitExprList` and `visitVariadicExpr` (function calls and `...`)
-    std::vector<BreadcrumbId> bcs;
-    bcs.reserve(l->values.size);
+    std::vector<DefId> defs;
+    defs.reserve(l->values.size);
     for (AstExpr* e : l->values)
-        bcs.push_back(visitExpr(scope, e));
+        defs.push_back(visitExpr(scope, e).def);
 
     for (size_t i = 0; i < l->vars.size; ++i)
     {
@@ -228,10 +236,12 @@ void DataFlowGraphBuilder::visit(DfgScope* scope, AstStatLocal* l)
         if (local->annotation)
             visitType(scope, local->annotation);
 
-        // We need to create a new breadcrumb with new defs to intentionally avoid alias tracking.
-        BreadcrumbId bc = breadcrumbs->add(nullptr, defs->freshCell(), i < bcs.size() ? bcs[i]->metadata : std::nullopt);
-        graph.localBreadcrumbs[local] = bc;
-        scope->bindings[local] = bc;
+        // We need to create a new def to intentionally avoid alias tracking, but we'd like to
+        // make sure that the non-aliased defs are also marked as a subscript for refinements.
+        bool subscripted = i < defs.size() && containsSubscriptedDefinition(defs[i]);
+        DefId def = defArena->freshCell(subscripted);
+        graph.localDefs[local] = def;
+        scope->bindings[local] = def;
     }
 }
 
@@ -247,10 +257,9 @@ void DataFlowGraphBuilder::visit(DfgScope* scope, AstStatFor* f)
     if (f->var->annotation)
         visitType(forScope, f->var->annotation);
 
-    // TODO: RangeMetadata.
-    BreadcrumbId bc = breadcrumbs->add(nullptr, defs->freshCell());
-    graph.localBreadcrumbs[f->var] = bc;
-    scope->bindings[f->var] = bc;
+    DefId def = defArena->freshCell();
+    graph.localDefs[f->var] = def;
+    scope->bindings[f->var] = def;
 
     // TODO(controlflow): entry point has a back edge from exit point
     visit(forScope, f->body);
@@ -265,10 +274,9 @@ void DataFlowGraphBuilder::visit(DfgScope* scope, AstStatForIn* f)
         if (local->annotation)
             visitType(forScope, local->annotation);
 
-        // TODO: IterMetadata (different from RangeMetadata)
-        BreadcrumbId bc = breadcrumbs->add(nullptr, defs->freshCell());
-        graph.localBreadcrumbs[local] = bc;
-        forScope->bindings[local] = bc;
+        DefId def = defArena->freshCell();
+        graph.localDefs[local] = def;
+        forScope->bindings[local] = def;
     }
 
     // TODO(controlflow): entry point has a back edge from exit point
@@ -281,11 +289,15 @@ void DataFlowGraphBuilder::visit(DfgScope* scope, AstStatForIn* f)
 
 void DataFlowGraphBuilder::visit(DfgScope* scope, AstStatAssign* a)
 {
-    for (size_t i = 0; i < std::max(a->vars.size, a->values.size); ++i)
+    std::vector<DefId> defs;
+    defs.reserve(a->values.size);
+    for (AstExpr* e : a->values)
+        defs.push_back(visitExpr(scope, e).def);
+
+    for (size_t i = 0; i < a->vars.size; ++i)
     {
-        BreadcrumbId bc = i < a->values.size ? visitExpr(scope, a->values.data[i]) : breadcrumbs->add(nullptr, defs->freshCell());
-        if (i < a->vars.size)
-            visitLValue(scope, a->vars.data[i], bc);
+        AstExpr* v = a->vars.data[i];
+        visitLValue(scope, v, i < defs.size() ? defs[i] : defArena->freshCell());
     }
 }
 
@@ -297,9 +309,9 @@ void DataFlowGraphBuilder::visit(DfgScope* scope, AstStatCompoundAssign* c)
     //
     // local a = 5 -- a-1
     // a += 5      -- a-2 = a-1 + 5
-    //
     // We can't just visit `c->var` as a rvalue and then separately traverse `c->var` as an lvalue, since that's O(n^2).
-    visitLValue(scope, c->var, visitExpr(scope, c->value));
+    DefId def = visitExpr(scope, c->value).def;
+    visitLValue(scope, c->var, def, /* isCompoundAssignment */ true);
 }
 
 void DataFlowGraphBuilder::visit(DfgScope* scope, AstStatFunction* f)
@@ -314,14 +326,17 @@ void DataFlowGraphBuilder::visit(DfgScope* scope, AstStatFunction* f)
     //
     // which is evidence that references to variables must be a phi node of all possible definitions,
     // but for bug compatibility, we'll assume the same thing here.
-    visitLValue(scope, f->name, visitExpr(scope, f->func));
+    DefId prototype = defArena->freshCell();
+    visitLValue(scope, f->name, prototype);
+    visitExpr(scope, f->func);
 }
 
 void DataFlowGraphBuilder::visit(DfgScope* scope, AstStatLocalFunction* l)
 {
-    BreadcrumbId bc = visitExpr(scope, l->func);
-    graph.localBreadcrumbs[l->name] = bc;
-    scope->bindings[l->name] = bc;
+    DefId def = defArena->freshCell();
+    graph.localDefs[l->name] = def;
+    scope->bindings[l->name] = def;
+    visitExpr(scope, l->func);
 }
 
 void DataFlowGraphBuilder::visit(DfgScope* scope, AstStatTypeAlias* t)
@@ -334,20 +349,18 @@ void DataFlowGraphBuilder::visit(DfgScope* scope, AstStatTypeAlias* t)
 
 void DataFlowGraphBuilder::visit(DfgScope* scope, AstStatDeclareGlobal* d)
 {
-    // TODO: AmbientDeclarationMetadata.
-    BreadcrumbId bc = breadcrumbs->add(nullptr, defs->freshCell());
-    graph.declaredBreadcrumbs[d] = bc;
-    scope->bindings[d->name] = bc;
+    DefId def = defArena->freshCell();
+    graph.declaredDefs[d] = def;
+    scope->bindings[d->name] = def;
 
     visitType(scope, d->type);
 }
 
 void DataFlowGraphBuilder::visit(DfgScope* scope, AstStatDeclareFunction* d)
 {
-    // TODO: AmbientDeclarationMetadata.
-    BreadcrumbId bc = breadcrumbs->add(nullptr, defs->freshCell());
-    graph.declaredBreadcrumbs[d] = bc;
-    scope->bindings[d->name] = bc;
+    DefId def = defArena->freshCell();
+    graph.declaredDefs[d] = def;
+    scope->bindings[d->name] = def;
 
     DfgScope* unreachable = childScope(scope);
     visitGenerics(unreachable, d->generics);
@@ -375,116 +388,125 @@ void DataFlowGraphBuilder::visit(DfgScope* scope, AstStatError* error)
         visitExpr(unreachable, e);
 }
 
-BreadcrumbId DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExpr* e)
-{
-    if (auto g = e->as<AstExprGroup>())
-        return visitExpr(scope, g->expr);
-    else if (auto c = e->as<AstExprConstantNil>())
-        return breadcrumbs->add(nullptr, defs->freshCell()); // ok
-    else if (auto c = e->as<AstExprConstantBool>())
-        return breadcrumbs->add(nullptr, defs->freshCell()); // ok
-    else if (auto c = e->as<AstExprConstantNumber>())
-        return breadcrumbs->add(nullptr, defs->freshCell()); // ok
-    else if (auto c = e->as<AstExprConstantString>())
-        return breadcrumbs->add(nullptr, defs->freshCell()); // ok
-    else if (auto l = e->as<AstExprLocal>())
-        return visitExpr(scope, l);
-    else if (auto g = e->as<AstExprGlobal>())
-        return visitExpr(scope, g);
-    else if (auto v = e->as<AstExprVarargs>())
-        return breadcrumbs->add(nullptr, defs->freshCell()); // ok
-    else if (auto c = e->as<AstExprCall>())
-        return visitExpr(scope, c);
-    else if (auto i = e->as<AstExprIndexName>())
-        return visitExpr(scope, i);
-    else if (auto i = e->as<AstExprIndexExpr>())
-        return visitExpr(scope, i);
-    else if (auto f = e->as<AstExprFunction>())
-        return visitExpr(scope, f);
-    else if (auto t = e->as<AstExprTable>())
-        return visitExpr(scope, t);
-    else if (auto u = e->as<AstExprUnary>())
-        return visitExpr(scope, u);
-    else if (auto b = e->as<AstExprBinary>())
-        return visitExpr(scope, b);
-    else if (auto t = e->as<AstExprTypeAssertion>())
-        return visitExpr(scope, t);
-    else if (auto i = e->as<AstExprIfElse>())
-        return visitExpr(scope, i);
-    else if (auto i = e->as<AstExprInterpString>())
-        return visitExpr(scope, i);
-    else if (auto error = e->as<AstExprError>())
-        return visitExpr(scope, error);
-    else
-        handle->ice("Unknown AstExpr in DataFlowGraphBuilder::visitExpr");
+DataFlowResult DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExpr* e)
+{
+    auto go = [&]() -> DataFlowResult {
+        if (auto g = e->as<AstExprGroup>())
+            return visitExpr(scope, g);
+        else if (auto c = e->as<AstExprConstantNil>())
+            return {defArena->freshCell(), nullptr}; // ok
+        else if (auto c = e->as<AstExprConstantBool>())
+            return {defArena->freshCell(), nullptr}; // ok
+        else if (auto c = e->as<AstExprConstantNumber>())
+            return {defArena->freshCell(), nullptr}; // ok
+        else if (auto c = e->as<AstExprConstantString>())
+            return {defArena->freshCell(), nullptr}; // ok
+        else if (auto l = e->as<AstExprLocal>())
+            return visitExpr(scope, l);
+        else if (auto g = e->as<AstExprGlobal>())
+            return visitExpr(scope, g);
+        else if (auto v = e->as<AstExprVarargs>())
+            return {defArena->freshCell(), nullptr}; // ok
+        else if (auto c = e->as<AstExprCall>())
+            return visitExpr(scope, c);
+        else if (auto i = e->as<AstExprIndexName>())
+            return visitExpr(scope, i);
+        else if (auto i = e->as<AstExprIndexExpr>())
+            return visitExpr(scope, i);
+        else if (auto f = e->as<AstExprFunction>())
+            return visitExpr(scope, f);
+        else if (auto t = e->as<AstExprTable>())
+            return visitExpr(scope, t);
+        else if (auto u = e->as<AstExprUnary>())
+            return visitExpr(scope, u);
+        else if (auto b = e->as<AstExprBinary>())
+            return visitExpr(scope, b);
+        else if (auto t = e->as<AstExprTypeAssertion>())
+            return visitExpr(scope, t);
+        else if (auto i = e->as<AstExprIfElse>())
+            return visitExpr(scope, i);
+        else if (auto i = e->as<AstExprInterpString>())
+            return visitExpr(scope, i);
+        else if (auto error = e->as<AstExprError>())
+            return visitExpr(scope, error);
+        else
+            handle->ice("Unknown AstExpr in DataFlowGraphBuilder::visitExpr");
+    };
+
+    auto [def, key] = go();
+    graph.astDefs[e] = def;
+    if (key)
+        graph.astRefinementKeys[e] = key;
+    return {def, key};
 }
 
-BreadcrumbId DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprLocal* l)
+DataFlowResult DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprGroup* group)
 {
-    NullableBreadcrumbId breadcrumb = scope->lookup(l->local);
-    if (!breadcrumb)
-        handle->ice("DFG: AstExprLocal came before its declaration?");
-
-    graph.astBreadcrumbs[l] = breadcrumb;
-    return NotNull{breadcrumb};
+    return visitExpr(scope, group->expr);
 }
 
-BreadcrumbId DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprGlobal* g)
+DataFlowResult DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprLocal* l)
 {
-    NullableBreadcrumbId bc = scope->lookup(g->name);
-    if (!bc)
+    if (auto def = scope->lookup(l->local))
     {
-        bc = breadcrumbs->add(nullptr, defs->freshCell());
-        moduleScope->bindings[g->name] = bc;
+        const RefinementKey* key = keyArena->leaf(*def);
+        return {*def, key};
     }
 
-    graph.astBreadcrumbs[g] = bc;
-    return NotNull{bc};
+    handle->ice("DFG: AstExprLocal came before its declaration?");
+}
+
+DataFlowResult DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprGlobal* g)
+{
+    if (auto def = scope->lookup(g->name))
+        return {*def, keyArena->leaf(*def)};
+
+    DefId def = defArena->freshCell();
+    moduleScope->bindings[g->name] = def;
+    return {def, keyArena->leaf(def)};
 }
 
-BreadcrumbId DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprCall* c)
+DataFlowResult DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprCall* c)
 {
     visitExpr(scope, c->func);
 
     for (AstExpr* arg : c->args)
         visitExpr(scope, arg);
 
-    return breadcrumbs->add(nullptr, defs->freshCell());
+    return {defArena->freshCell(), nullptr};
 }
 
-BreadcrumbId DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprIndexName* i)
+DataFlowResult DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprIndexName* i)
 {
-    BreadcrumbId parentBreadcrumb = visitExpr(scope, i->expr);
+    auto [parentDef, parentKey] = visitExpr(scope, i->expr);
 
-    std::string key = i->index.value;
-    NullableBreadcrumbId& propBreadcrumb = moduleScope->props[parentBreadcrumb->def][key];
-    if (!propBreadcrumb)
-        propBreadcrumb = breadcrumbs->emplace<FieldMetadata>(parentBreadcrumb, defs->freshCell(), key);
+    std::string index = i->index.value;
+    auto& propDef = moduleScope->props[parentDef][index];
+    if (!propDef)
+        propDef = defArena->freshCell();
 
-    graph.astBreadcrumbs[i] = propBreadcrumb;
-    return NotNull{propBreadcrumb};
+    return {NotNull{propDef}, keyArena->node(parentKey, NotNull{propDef}, index)};
 }
 
-BreadcrumbId DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprIndexExpr* i)
+DataFlowResult DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprIndexExpr* i)
 {
-    BreadcrumbId parentBreadcrumb = visitExpr(scope, i->expr);
-    BreadcrumbId key = visitExpr(scope, i->index);
+    auto [parentDef, parentKey] = visitExpr(scope, i->expr);
+    visitExpr(scope, i->index);
 
     if (auto string = i->index->as<AstExprConstantString>())
     {
-        std::string key{string->value.data, string->value.size};
-        NullableBreadcrumbId& propBreadcrumb = moduleScope->props[parentBreadcrumb->def][key];
-        if (!propBreadcrumb)
-            propBreadcrumb = breadcrumbs->emplace<FieldMetadata>(parentBreadcrumb, defs->freshCell(), key);
+        std::string index{string->value.data, string->value.size};
+        auto& propDef = moduleScope->props[parentDef][index];
+        if (!propDef)
+            propDef = defArena->freshCell();
 
-        graph.astBreadcrumbs[i] = NotNull{propBreadcrumb};
-        return NotNull{propBreadcrumb};
+        return {NotNull{propDef}, keyArena->node(parentKey, NotNull{propDef}, index)};
     }
 
-    return breadcrumbs->emplace<SubscriptMetadata>(nullptr, defs->freshCell(), key);
+    return {defArena->freshCell(/* subscripted= */true), nullptr};
 }
 
-BreadcrumbId DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprFunction* f)
+DataFlowResult DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprFunction* f)
 {
     DfgScope* signatureScope = childScope(scope);
 
@@ -493,10 +515,9 @@ BreadcrumbId DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprFunction* f
         // There's no syntax for `self` to have an annotation if using `function t:m()`
         LUAU_ASSERT(!self->annotation);
 
-        // TODO: ParameterMetadata.
-        BreadcrumbId bc = breadcrumbs->add(nullptr, defs->freshCell());
-        graph.localBreadcrumbs[self] = bc;
-        signatureScope->bindings[self] = bc;
+        DefId def = defArena->freshCell();
+        graph.localDefs[self] = def;
+        signatureScope->bindings[self] = def;
     }
 
     for (AstLocal* param : f->args)
@@ -504,10 +525,9 @@ BreadcrumbId DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprFunction* f
         if (param->annotation)
             visitType(signatureScope, param->annotation);
 
-        // TODO: ParameterMetadata.
-        BreadcrumbId bc = breadcrumbs->add(nullptr, defs->freshCell());
-        graph.localBreadcrumbs[param] = bc;
-        signatureScope->bindings[param] = bc;
+        DefId def = defArena->freshCell();
+        graph.localDefs[param] = def;
+        signatureScope->bindings[param] = def;
     }
 
     if (f->varargAnnotation)
@@ -526,10 +546,10 @@ BreadcrumbId DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprFunction* f
     // g() --> 5
     visit(signatureScope, f->body);
 
-    return breadcrumbs->add(nullptr, defs->freshCell());
+    return {defArena->freshCell(), nullptr};
 }
 
-BreadcrumbId DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprTable* t)
+DataFlowResult DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprTable* t)
 {
     for (AstExprTable::Item item : t->items)
     {
@@ -538,120 +558,132 @@ BreadcrumbId DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprTable* t)
         visitExpr(scope, item.value);
     }
 
-    return breadcrumbs->add(nullptr, defs->freshCell());
+    return {defArena->freshCell(), nullptr};
 }
 
-BreadcrumbId DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprUnary* u)
+DataFlowResult DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprUnary* u)
 {
     visitExpr(scope, u->expr);
 
-    return breadcrumbs->add(nullptr, defs->freshCell());
+    return {defArena->freshCell(), nullptr};
 }
 
-BreadcrumbId DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprBinary* b)
+DataFlowResult DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprBinary* b)
 {
     visitExpr(scope, b->left);
     visitExpr(scope, b->right);
 
-    return breadcrumbs->add(nullptr, defs->freshCell());
+    return {defArena->freshCell(), nullptr};
 }
 
-BreadcrumbId DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprTypeAssertion* t)
+DataFlowResult DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprTypeAssertion* t)
 {
-    // TODO: TypeAssertionMetadata?
-    BreadcrumbId bc = visitExpr(scope, t->expr);
+    auto [def, key] = visitExpr(scope, t->expr);
     visitType(scope, t->annotation);
 
-    return bc;
+    return {def, key};
 }
 
-BreadcrumbId DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprIfElse* i)
+DataFlowResult DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprIfElse* i)
 {
     visitExpr(scope, i->condition);
     visitExpr(scope, i->trueExpr);
     visitExpr(scope, i->falseExpr);
 
-    return breadcrumbs->add(nullptr, defs->freshCell());
+    return {defArena->freshCell(), nullptr};
 }
 
-BreadcrumbId DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprInterpString* i)
+DataFlowResult DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprInterpString* i)
 {
     for (AstExpr* e : i->expressions)
         visitExpr(scope, e);
 
-    return breadcrumbs->add(nullptr, defs->freshCell());
+    return {defArena->freshCell(), nullptr};
 }
 
-BreadcrumbId DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprError* error)
+DataFlowResult DataFlowGraphBuilder::visitExpr(DfgScope* scope, AstExprError* error)
 {
     DfgScope* unreachable = childScope(scope);
     for (AstExpr* e : error->expressions)
         visitExpr(unreachable, e);
 
-    return breadcrumbs->add(nullptr, defs->freshCell());
+    return {defArena->freshCell(), nullptr};
 }
 
-void DataFlowGraphBuilder::visitLValue(DfgScope* scope, AstExpr* e, BreadcrumbId bc)
+void DataFlowGraphBuilder::visitLValue(DfgScope* scope, AstExpr* e, DefId incomingDef, bool isCompoundAssignment)
 {
     if (auto l = e->as<AstExprLocal>())
-        return visitLValue(scope, l, bc);
+        return visitLValue(scope, l, incomingDef, isCompoundAssignment);
     else if (auto g = e->as<AstExprGlobal>())
-        return visitLValue(scope, g, bc);
+        return visitLValue(scope, g, incomingDef, isCompoundAssignment);
     else if (auto i = e->as<AstExprIndexName>())
-        return visitLValue(scope, i, bc);
+        return visitLValue(scope, i, incomingDef);
     else if (auto i = e->as<AstExprIndexExpr>())
-        return visitLValue(scope, i, bc);
+        return visitLValue(scope, i, incomingDef);
     else if (auto error = e->as<AstExprError>())
-        return visitLValue(scope, error, bc);
+        return visitLValue(scope, error, incomingDef);
     else
         handle->ice("Unknown AstExpr in DataFlowGraphBuilder::visitLValue");
 }
 
-void DataFlowGraphBuilder::visitLValue(DfgScope* scope, AstExprLocal* l, BreadcrumbId bc)
+void DataFlowGraphBuilder::visitLValue(DfgScope* scope, AstExprLocal* l, DefId incomingDef, bool isCompoundAssignment)
 {
-    // In order to avoid alias tracking, we need to clip the reference to the parent breadcrumb
-    // as well as the def that was about to be assigned onto this lvalue. However, we want to
-    // copy the metadata so that refinements can be consistent.
-    BreadcrumbId updated = breadcrumbs->add(scope->lookup(l->local), defs->freshCell(), bc->metadata);
-    graph.astBreadcrumbs[l] = updated;
+    // We need to keep the previous breadcrumb around for a compound assignment.
+    if (isCompoundAssignment)
+    {
+        if (auto def = scope->lookup(l->local))
+            graph.compoundAssignBreadcrumbs[l] = *def;
+    }
+
+    // In order to avoid alias tracking, we need to clip the reference to the parent def.
+    DefId updated = defArena->freshCell(containsSubscriptedDefinition(incomingDef));
+    graph.astDefs[l] = updated;
     scope->bindings[l->local] = updated;
 }
 
-void DataFlowGraphBuilder::visitLValue(DfgScope* scope, AstExprGlobal* g, BreadcrumbId bc)
+void DataFlowGraphBuilder::visitLValue(DfgScope* scope, AstExprGlobal* g, DefId incomingDef, bool isCompoundAssignment)
 {
-    // In order to avoid alias tracking, we need to clip the reference to the parent breadcrumb
-    // as well as the def that was about to be assigned onto this lvalue. However, we want to
-    // copy the metadata so that refinements can be consistent.
-    BreadcrumbId updated = breadcrumbs->add(scope->lookup(g->name), defs->freshCell(), bc->metadata);
-    graph.astBreadcrumbs[g] = updated;
+    // We need to keep the previous breadcrumb around for a compound assignment.
+    if (isCompoundAssignment)
+    {
+        if (auto def = scope->lookup(g->name))
+            graph.compoundAssignBreadcrumbs[g] = *def;
+    }
+
+    // In order to avoid alias tracking, we need to clip the reference to the parent def.
+    DefId updated = defArena->freshCell(containsSubscriptedDefinition(incomingDef));
+    graph.astDefs[g] = updated;
     scope->bindings[g->name] = updated;
 }
 
-void DataFlowGraphBuilder::visitLValue(DfgScope* scope, AstExprIndexName* i, BreadcrumbId bc)
+void DataFlowGraphBuilder::visitLValue(DfgScope* scope, AstExprIndexName* i, DefId incomingDef)
 {
-    BreadcrumbId parentBreadcrumb = visitExpr(scope, i->expr);
+    DefId parentDef = visitExpr(scope, i->expr).def;
 
-    BreadcrumbId updated = breadcrumbs->add(scope->props[parentBreadcrumb->def][i->index.value], defs->freshCell(), bc->metadata);
-    graph.astBreadcrumbs[i] = updated;
-    scope->props[parentBreadcrumb->def][i->index.value] = updated;
+    DefId updated = defArena->freshCell(containsSubscriptedDefinition(incomingDef));
+    graph.astDefs[i] = updated;
+    scope->props[parentDef][i->index.value] = updated;
 }
 
-void DataFlowGraphBuilder::visitLValue(DfgScope* scope, AstExprIndexExpr* i, BreadcrumbId bc)
+void DataFlowGraphBuilder::visitLValue(DfgScope* scope, AstExprIndexExpr* i, DefId incomingDef)
 {
-    BreadcrumbId parentBreadcrumb = visitExpr(scope, i->expr);
+    DefId parentDef = visitExpr(scope, i->expr).def;
     visitExpr(scope, i->index);
 
     if (auto string = i->index->as<AstExprConstantString>())
     {
-        BreadcrumbId updated = breadcrumbs->add(scope->props[parentBreadcrumb->def][string->value.data], defs->freshCell(), bc->metadata);
-        graph.astBreadcrumbs[i] = updated;
-        scope->props[parentBreadcrumb->def][string->value.data] = updated;
+        DefId updated = defArena->freshCell(containsSubscriptedDefinition(incomingDef));
+        graph.astDefs[i] = updated;
+        scope->props[parentDef][string->value.data] = updated;
     }
+
+    graph.astDefs[i] = defArena->freshCell();
 }
 
-void DataFlowGraphBuilder::visitLValue(DfgScope* scope, AstExprError* error, BreadcrumbId bc)
+void DataFlowGraphBuilder::visitLValue(DfgScope* scope, AstExprError* error, DefId incomingDef)
 {
-    visitExpr(scope, error);
+    DefId def = visitExpr(scope, error).def;
+    graph.astDefs[error] = def;
 }
 
 void DataFlowGraphBuilder::visitType(DfgScope* scope, AstType* t)
diff --git a/Analysis/src/Def.cpp b/Analysis/src/Def.cpp
index 7be075c25..d34b5cdc7 100644
--- a/Analysis/src/Def.cpp
+++ b/Analysis/src/Def.cpp
@@ -1,12 +1,22 @@
 // This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
 #include "Luau/Def.h"
+#include "Luau/Common.h"
 
 namespace Luau
 {
 
-DefId DefArena::freshCell()
+bool containsSubscriptedDefinition(DefId def)
 {
-    return NotNull{allocator.allocate(Def{Cell{}})};
+    if (auto cell = get<Cell>(def))
+        return cell->subscripted;
+
+    LUAU_ASSERT(!"Phi nodes not implemented yet");
+    return false;
+}
+
+DefId DefArena::freshCell(bool subscripted)
+{
+    return NotNull{allocator.allocate(Def{Cell{subscripted}})};
 }
 
 } // namespace Luau
diff --git a/Analysis/src/IostreamHelpers.cpp b/Analysis/src/IostreamHelpers.cpp
index 75e1f7c31..7a58a2444 100644
--- a/Analysis/src/IostreamHelpers.cpp
+++ b/Analysis/src/IostreamHelpers.cpp
@@ -1,6 +1,7 @@
 // This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
 #include "Luau/IostreamHelpers.h"
 #include "Luau/ToString.h"
+#include "Luau/TypePath.h"
 
 namespace Luau
 {
@@ -236,4 +237,34 @@ std::ostream& operator<<(std::ostream& stream, const TypePackVar& tv)
     return stream << toString(tv);
 }
 
+std::ostream& operator<<(std::ostream& stream, TypeId ty)
+{
+    // we commonly use a null pointer when a type may not be present; we need to
+    // account for that here.
+    if (!ty)
+        return stream << "<nullptr>";
+
+    return stream << toString(ty);
+}
+
+std::ostream& operator<<(std::ostream& stream, TypePackId tp)
+{
+    // we commonly use a null pointer when a type may not be present; we need to
+    // account for that here.
+    if (!tp)
+        return stream << "<nullptr>";
+
+    return stream << toString(tp);
+}
+
+namespace TypePath
+{
+
+std::ostream& operator<<(std::ostream& stream, const Path& path)
+{
+    return stream << toString(path);
+}
+
+} // namespace TypePath
+
 } // namespace Luau
diff --git a/Analysis/src/NonStrictTypeChecker.cpp b/Analysis/src/NonStrictTypeChecker.cpp
index a7bb9d291..595794a0f 100644
--- a/Analysis/src/NonStrictTypeChecker.cpp
+++ b/Analysis/src/NonStrictTypeChecker.cpp
@@ -325,6 +325,7 @@ struct NonStrictTypeChecker
             return;
 
         TypeId fnTy = *originalCallTy;
+        // TODO: how should we link this to the passed in context here
         NonStrictContext fresh{};
         if (auto fn = get<FunctionType>(follow(fnTy)))
         {
@@ -351,28 +352,20 @@ struct NonStrictTypeChecker
                     // We will compare arg and ~number
                     AstExpr* arg = call->args.data[i];
                     TypeId expectedArgType = argTypes[i];
-                    NullableBreadcrumbId bc = dfg->getBreadcrumb(arg);
+                    DefId def = dfg->getDef(arg);
                     // TODO: Cache negations created here!!!
                     // See Jira Ticket: https://roblox.atlassian.net/browse/CLI-87539
-                    if (bc)
-                    {
-                        TypeId runTimeErrorTy = arena.addType(NegationType{expectedArgType});
-                        DefId def = bc->def;
-                        fresh.context[def.get()] = runTimeErrorTy;
-                    }
-                    else
-                    {
-                        std::cout << "bad" << std::endl;
-                    }
+                    TypeId runTimeErrorTy = arena.addType(NegationType{expectedArgType});
+                    fresh.context[def.get()] = runTimeErrorTy;
                 }
 
                 // Populate the context and now iterate through each of the arguments to the call to find out if we satisfy the types
+                AstName name = getIdentifier(call->func);
                 for (size_t i = 0; i < call->args.size; i++)
                 {
                     AstExpr* arg = call->args.data[i];
-                    // TODO: pipe in name of checked function to report Error
                     if (auto runTimeFailureType = willRunTimeError(arg, fresh))
-                        reportError(CheckedFunctionCallError{argTypes[i], *runTimeFailureType, "", i}, arg->location);
+                        reportError(CheckedFunctionCallError{argTypes[i], *runTimeFailureType, name.value, i}, arg->location);
                 }
             }
         }
@@ -401,25 +394,22 @@ struct NonStrictTypeChecker
     // If this fragment of the ast will run time error, return the type that causes this
     std::optional<TypeId> willRunTimeError(AstExpr* fragment, const NonStrictContext& context)
     {
-
-        if (NullableBreadcrumbId bc = dfg->getBreadcrumb(fragment))
+        DefId def = dfg->getDef(fragment);
+        if (std::optional<TypeId> contextTy = context.find(def))
         {
-            std::optional<TypeId> contextTy = context.find(bc->def);
-            if (contextTy)
-            {
 
-                TypeId actualType = lookupType(fragment);
-                SubtypingResult r = subtyping.isSubtype(actualType, *contextTy);
-                if (r.normalizationTooComplex)
-                    reportError(NormalizationTooComplex{}, fragment->location);
+            TypeId actualType = lookupType(fragment);
+            SubtypingResult r = subtyping.isSubtype(actualType, *contextTy);
+            if (r.normalizationTooComplex)
+                reportError(NormalizationTooComplex{}, fragment->location);
 
-                if (!r.isSubtype && !r.isErrorSuppressing)
-                    reportError(TypeMismatch{actualType, *contextTy}, fragment->location);
+            if (!r.isSubtype && !r.isErrorSuppressing)
+                reportError(TypeMismatch{actualType, *contextTy}, fragment->location);
 
-                if (r.isSubtype)
-                    return {actualType};
-            }
+            if (r.isSubtype)
+                return {actualType};
         }
+
         return {};
     }
 };
diff --git a/Analysis/src/Normalize.cpp b/Analysis/src/Normalize.cpp
index 4f9532c06..52bbc5d9c 100644
--- a/Analysis/src/Normalize.cpp
+++ b/Analysis/src/Normalize.cpp
@@ -22,6 +22,13 @@ LUAU_FASTFLAG(DebugLuauReadWriteProperties)
 
 namespace Luau
 {
+
+TypeIds::TypeIds(std::initializer_list<TypeId> tys)
+{
+    for (TypeId ty : tys)
+        insert(ty);
+}
+
 void TypeIds::insert(TypeId ty)
 {
     ty = follow(ty);
diff --git a/Analysis/src/Refinement.cpp b/Analysis/src/Refinement.cpp
index a81063c7b..e98b6e5a9 100644
--- a/Analysis/src/Refinement.cpp
+++ b/Analysis/src/Refinement.cpp
@@ -1,37 +1,60 @@
 // This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
 #include "Luau/Refinement.h"
+#include <algorithm>
 
 namespace Luau
 {
 
 RefinementId RefinementArena::variadic(const std::vector<RefinementId>& refis)
 {
+    bool hasRefinements = false;
+    for (RefinementId r : refis)
+        hasRefinements |= bool(r);
+
+    if (!hasRefinements)
+        return nullptr;
+
     return NotNull{allocator.allocate(Variadic{refis})};
 }
 
 RefinementId RefinementArena::negation(RefinementId refinement)
 {
+    if (!refinement)
+        return nullptr;
+
     return NotNull{allocator.allocate(Negation{refinement})};
 }
 
 RefinementId RefinementArena::conjunction(RefinementId lhs, RefinementId rhs)
 {
+    if (!lhs && !rhs)
+        return nullptr;
+
     return NotNull{allocator.allocate(Conjunction{lhs, rhs})};
 }
 
 RefinementId RefinementArena::disjunction(RefinementId lhs, RefinementId rhs)
 {
+    if (!lhs && !rhs)
+        return nullptr;
+
     return NotNull{allocator.allocate(Disjunction{lhs, rhs})};
 }
 
 RefinementId RefinementArena::equivalence(RefinementId lhs, RefinementId rhs)
 {
+    if (!lhs && !rhs)
+        return nullptr;
+
     return NotNull{allocator.allocate(Equivalence{lhs, rhs})};
 }
 
-RefinementId RefinementArena::proposition(BreadcrumbId breadcrumb, TypeId discriminantTy)
+RefinementId RefinementArena::proposition(const RefinementKey* key, TypeId discriminantTy)
 {
-    return NotNull{allocator.allocate(Proposition{breadcrumb, discriminantTy})};
+    if (!key)
+        return nullptr;
+
+    return NotNull{allocator.allocate(Proposition{key, discriminantTy})};
 }
 
 } // namespace Luau
diff --git a/Analysis/src/Scope.cpp b/Analysis/src/Scope.cpp
index 929125305..2ca40bdd9 100644
--- a/Analysis/src/Scope.cpp
+++ b/Analysis/src/Scope.cpp
@@ -38,6 +38,23 @@ std::optional<TypeId> Scope::lookup(Symbol sym) const
         return std::nullopt;
 }
 
+std::optional<std::pair<TypeId, Scope*>> Scope::lookupEx(DefId def)
+{
+    Scope* s = this;
+
+    while (true)
+    {
+        TypeId* it = s->lvalueTypes.find(def);
+        if (it)
+            return std::pair{*it, s};
+
+        if (s->parent)
+            s = s->parent.get();
+        else
+            return std::nullopt;
+    }
+}
+
 std::optional<std::pair<Binding*, Scope*>> Scope::lookupEx(Symbol sym)
 {
     Scope* s = this;
diff --git a/Analysis/src/Substitution.cpp b/Analysis/src/Substitution.cpp
index a34a45c8e..176f15069 100644
--- a/Analysis/src/Substitution.cpp
+++ b/Analysis/src/Substitution.cpp
@@ -75,6 +75,7 @@ static TypeId shallowClone(TypeId ty, TypeArena& dest, const TxnLog* log, bool a
             clone.dcrMagicRefinement = a.dcrMagicRefinement;
             clone.tags = a.tags;
             clone.argNames = a.argNames;
+            clone.isCheckedFunction = a.isCheckedFunction;
             return dest.addType(std::move(clone));
         }
         else if constexpr (std::is_same_v<T, TableType>)
diff --git a/Analysis/src/Subtyping.cpp b/Analysis/src/Subtyping.cpp
index 79bedec20..e386bf7b9 100644
--- a/Analysis/src/Subtyping.cpp
+++ b/Analysis/src/Subtyping.cpp
@@ -11,6 +11,7 @@
 #include "Luau/Type.h"
 #include "Luau/TypeArena.h"
 #include "Luau/TypePack.h"
+#include "Luau/TypePath.h"
 #include "Luau/TypeUtils.h"
 
 #include <algorithm>
@@ -44,8 +45,19 @@ struct VarianceFlipper
     }
 };
 
+bool SubtypingReasoning::operator==(const SubtypingReasoning& other) const
+{
+    return subPath == other.subPath && superPath == other.superPath;
+}
+
 SubtypingResult& SubtypingResult::andAlso(const SubtypingResult& other)
 {
+    // If this result is a subtype, we take the other result's reasoning. If
+    // this result is not a subtype, we keep the current reasoning, even if the
+    // other isn't a subtype.
+    if (isSubtype)
+        reasoning = other.reasoning;
+
     isSubtype &= other.isSubtype;
     // `|=` is intentional here, we want to preserve error related flags.
     isErrorSuppressing |= other.isErrorSuppressing;
@@ -57,6 +69,11 @@ SubtypingResult& SubtypingResult::andAlso(const SubtypingResult& other)
 
 SubtypingResult& SubtypingResult::orElse(const SubtypingResult& other)
 {
+    // If the other result is not a subtype, we take the other result's
+    // reasoning.
+    if (!other.isSubtype)
+        reasoning = other.reasoning;
+
     isSubtype |= other.isSubtype;
     isErrorSuppressing |= other.isErrorSuppressing;
     normalizationTooComplex |= other.normalizationTooComplex;
@@ -65,6 +82,56 @@ SubtypingResult& SubtypingResult::orElse(const SubtypingResult& other)
     return *this;
 }
 
+SubtypingResult& SubtypingResult::withBothComponent(TypePath::Component component)
+{
+    return withSubComponent(component).withSuperComponent(component);
+}
+
+SubtypingResult& SubtypingResult::withSubComponent(TypePath::Component component)
+{
+    if (!reasoning)
+        reasoning = SubtypingReasoning{Path(), Path()};
+
+    reasoning->subPath = reasoning->subPath.push_front(component);
+
+    return *this;
+}
+
+SubtypingResult& SubtypingResult::withSuperComponent(TypePath::Component component)
+{
+    if (!reasoning)
+        reasoning = SubtypingReasoning{Path(), Path()};
+
+    reasoning->superPath = reasoning->superPath.push_front(component);
+
+    return *this;
+}
+
+SubtypingResult& SubtypingResult::withBothPath(TypePath::Path path)
+{
+    return withSubPath(path).withSuperPath(path);
+}
+
+SubtypingResult& SubtypingResult::withSubPath(TypePath::Path path)
+{
+    if (!reasoning)
+        reasoning = SubtypingReasoning{Path(), Path()};
+
+    reasoning->subPath = path.append(reasoning->subPath);
+
+    return *this;
+}
+
+SubtypingResult& SubtypingResult::withSuperPath(TypePath::Path path)
+{
+    if (!reasoning)
+        reasoning = SubtypingReasoning{Path(), Path()};
+
+    reasoning->superPath = path.append(reasoning->superPath);
+
+    return *this;
+}
+
 SubtypingResult SubtypingResult::negate(const SubtypingResult& result)
 {
     return SubtypingResult{
@@ -287,7 +354,7 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, TypeId sub
     else if (get<ErrorType>(subTy))
         result = {false, true};
     else if (auto p = get2<NegationType, NegationType>(subTy, superTy))
-        result = isCovariantWith(env, p.first->ty, p.second->ty);
+        result = isCovariantWith(env, p.first->ty, p.second->ty).withBothComponent(TypePath::TypeField::Negated);
     else if (auto subNegation = get<NegationType>(subTy))
         result = isCovariantWith(env, subNegation, superTy);
     else if (auto superNegation = get<NegationType>(superTy))
@@ -350,9 +417,9 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, TypePackId
 
     for (size_t i = 0; i < headSize; ++i)
     {
-        results.push_back(isCovariantWith(env, subHead[i], superHead[i]));
+        results.push_back(isCovariantWith(env, subHead[i], superHead[i]).withBothComponent(TypePath::Index{i}));
         if (!results.back().isSubtype)
-            return {false};
+            return results.back();
     }
 
     // Handle mismatched head sizes
@@ -364,7 +431,9 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, TypePackId
             if (auto vt = get<VariadicTypePack>(*subTail))
             {
                 for (size_t i = headSize; i < superHead.size(); ++i)
-                    results.push_back(isCovariantWith(env, vt->ty, superHead[i]));
+                    results.push_back(isCovariantWith(env, vt->ty, superHead[i])
+                                          .withSubComponent(TypePath::TypeField::Variadic)
+                                          .withSuperComponent(TypePath::Index{i}));
             }
             else if (auto gt = get<GenericTypePack>(*subTail))
             {
@@ -379,7 +448,8 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, TypePackId
                     TypePackId superTailPack = arena->addTypePack(std::move(headSlice), superTail);
 
                     if (TypePackId* other = env.mappedGenericPacks.find(*subTail))
-                        results.push_back(isCovariantWith(env, *other, superTailPack));
+                        // TODO: TypePath can't express "slice of a pack + its tail".
+                        results.push_back(isCovariantWith(env, *other, superTailPack).withSubComponent(TypePath::PackField::Tail));
                     else
                         env.mappedGenericPacks.try_insert(*subTail, superTailPack);
 
@@ -393,7 +463,7 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, TypePackId
                     //
                     // (T) -> () </: <X>(X) -> ()
                     //
-                    return {false};
+                    return SubtypingResult{false}.withSubComponent(TypePath::PackField::Tail);
                 }
             }
             else
@@ -409,7 +479,9 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, TypePackId
             if (auto vt = get<VariadicTypePack>(*superTail))
             {
                 for (size_t i = headSize; i < subHead.size(); ++i)
-                    results.push_back(isCovariantWith(env, subHead[i], vt->ty));
+                    results.push_back(isCovariantWith(env, subHead[i], vt->ty)
+                                          .withSubComponent(TypePath::Index{i})
+                                          .withSuperComponent(TypePath::TypeField::Variadic));
             }
             else if (auto gt = get<GenericTypePack>(*superTail))
             {
@@ -424,7 +496,8 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, TypePackId
                     TypePackId subTailPack = arena->addTypePack(std::move(headSlice), subTail);
 
                     if (TypePackId* other = env.mappedGenericPacks.find(*superTail))
-                        results.push_back(isCovariantWith(env, *other, subTailPack));
+                        // TODO: TypePath can't express "slice of a pack + its tail".
+                        results.push_back(isCovariantWith(env, *other, subTailPack).withSuperComponent(TypePath::PackField::Tail));
                     else
                         env.mappedGenericPacks.try_insert(*superTail, subTailPack);
 
@@ -437,7 +510,7 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, TypePackId
                     // For any non-generic type T:
                     //
                     // () -> T </: <X...>() -> X...
-                    return {false};
+                    return SubtypingResult{false}.withSuperComponent(TypePath::PackField::Tail);
                 }
             }
             else
@@ -453,12 +526,14 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, TypePackId
     {
         if (auto p = get2<VariadicTypePack, VariadicTypePack>(*subTail, *superTail))
         {
-            results.push_back(isCovariantWith(env, p));
+            // Variadic component is added by the isCovariantWith
+            // implementation; no need to add it here.
+            results.push_back(isCovariantWith(env, p).withBothComponent(TypePath::PackField::Tail));
         }
         else if (auto p = get2<GenericTypePack, GenericTypePack>(*subTail, *superTail))
         {
             bool ok = bindGeneric(env, *subTail, *superTail);
-            results.push_back({ok});
+            results.push_back(SubtypingResult{ok}.withBothComponent(TypePath::PackField::Tail));
         }
         else if (get2<VariadicTypePack, GenericTypePack>(*subTail, *superTail))
         {
@@ -466,12 +541,12 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, TypePackId
             {
                 // <A...>(A...) -> number <: (...number) -> number
                 bool ok = bindGeneric(env, *subTail, *superTail);
-                results.push_back({ok});
+                results.push_back(SubtypingResult{ok}.withBothComponent(TypePath::PackField::Tail));
             }
             else
             {
                 // (number) -> ...number </: <A...>(number) -> A...
-                results.push_back({false});
+                results.push_back(SubtypingResult{false}.withBothComponent(TypePath::PackField::Tail));
             }
         }
         else if (get2<GenericTypePack, VariadicTypePack>(*subTail, *superTail))
@@ -479,13 +554,13 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, TypePackId
             if (variance == Variance::Contravariant)
             {
                 // (...number) -> number </: <A...>(A...) -> number
-                results.push_back({false});
+                results.push_back(SubtypingResult{false}.withBothComponent(TypePath::PackField::Tail));
             }
             else
             {
                 // <A...>() -> A... <: () -> ...number
                 bool ok = bindGeneric(env, *subTail, *superTail);
-                results.push_back({ok});
+                results.push_back(SubtypingResult{ok}.withBothComponent(TypePath::PackField::Tail));
             }
         }
         else
@@ -496,12 +571,12 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, TypePackId
     {
         if (get<VariadicTypePack>(*subTail))
         {
-            return {false};
+            return SubtypingResult{false}.withSubComponent(TypePath::PackField::Tail);
         }
         else if (get<GenericTypePack>(*subTail))
         {
             bool ok = bindGeneric(env, *subTail, builtinTypes->emptyTypePack);
-            return {ok};
+            return SubtypingResult{ok}.withSubComponent(TypePath::PackField::Tail);
         }
         else
             unexpected(*subTail);
@@ -525,10 +600,10 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, TypePackId
             if (variance == Variance::Contravariant)
             {
                 bool ok = bindGeneric(env, builtinTypes->emptyTypePack, *superTail);
-                results.push_back({ok});
+                results.push_back(SubtypingResult{ok}.withSuperComponent(TypePath::PackField::Tail));
             }
             else
-                results.push_back({false});
+                results.push_back(SubtypingResult{false}.withSuperComponent(TypePath::PackField::Tail));
         }
         else
             iceReporter->ice("Subtyping test encountered the unexpected type pack: " + toString(*superTail));
@@ -540,7 +615,15 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, TypePackId
 template<typename SubTy, typename SuperTy>
 SubtypingResult Subtyping::isContravariantWith(SubtypingEnvironment& env, SubTy&& subTy, SuperTy&& superTy)
 {
-    return isCovariantWith(env, superTy, subTy);
+    SubtypingResult result = isCovariantWith(env, superTy, subTy);
+    // If we don't swap the paths here, we will end up producing an invalid path
+    // whenever we involve contravariance. We'll end up appending path
+    // components that should belong to the supertype to the subtype, and vice
+    // versa.
+    if (result.reasoning)
+        std::swap(result.reasoning->subPath, result.reasoning->superPath);
+
+    return result;
 }
 
 template<typename SubTy, typename SuperTy>
@@ -602,8 +685,9 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, TypeId sub
 {
     // As per TAPL: T <: A | B iff T <: A || T <: B
     std::vector<SubtypingResult> subtypings;
+    size_t i = 0;
     for (TypeId ty : superUnion)
-        subtypings.push_back(isCovariantWith(env, subTy, ty));
+        subtypings.push_back(isCovariantWith(env, subTy, ty).withSuperComponent(TypePath::Index{i++}));
     return SubtypingResult::any(subtypings);
 }
 
@@ -611,8 +695,9 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const Unio
 {
     // As per TAPL: A | B <: T iff A <: T && B <: T
     std::vector<SubtypingResult> subtypings;
+    size_t i = 0;
     for (TypeId ty : subUnion)
-        subtypings.push_back(isCovariantWith(env, ty, superTy));
+        subtypings.push_back(isCovariantWith(env, ty, superTy).withSubComponent(TypePath::Index{i++}));
     return SubtypingResult::all(subtypings);
 }
 
@@ -620,8 +705,9 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, TypeId sub
 {
     // As per TAPL: T <: A & B iff T <: A && T <: B
     std::vector<SubtypingResult> subtypings;
+    size_t i = 0;
     for (TypeId ty : superIntersection)
-        subtypings.push_back(isCovariantWith(env, subTy, ty));
+        subtypings.push_back(isCovariantWith(env, subTy, ty).withSuperComponent(TypePath::Index{i++}));
     return SubtypingResult::all(subtypings);
 }
 
@@ -629,8 +715,9 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const Inte
 {
     // As per TAPL: A & B <: T iff A <: T || B <: T
     std::vector<SubtypingResult> subtypings;
+    size_t i = 0;
     for (TypeId ty : subIntersection)
-        subtypings.push_back(isCovariantWith(env, ty, superTy));
+        subtypings.push_back(isCovariantWith(env, ty, superTy).withSubComponent(TypePath::Index{i++}));
     return SubtypingResult::any(subtypings);
 }
 
@@ -638,23 +725,25 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const Nega
 {
     TypeId negatedTy = follow(subNegation->ty);
 
+    SubtypingResult result;
+
     // In order to follow a consistent codepath, rather than folding the
     // isCovariantWith test down to its conclusion here, we test the subtyping test
     // of the result of negating the type for never, unknown, any, and error.
     if (is<NeverType>(negatedTy))
     {
         // ¬never ~ unknown
-        return isCovariantWith(env, builtinTypes->unknownType, superTy);
+        result = isCovariantWith(env, builtinTypes->unknownType, superTy);
     }
     else if (is<UnknownType>(negatedTy))
     {
         // ¬unknown ~ never
-        return isCovariantWith(env, builtinTypes->neverType, superTy);
+        result = isCovariantWith(env, builtinTypes->neverType, superTy);
     }
     else if (is<AnyType>(negatedTy))
     {
         // ¬any ~ any
-        return isCovariantWith(env, negatedTy, superTy);
+        result = isCovariantWith(env, negatedTy, superTy);
     }
     else if (auto u = get<UnionType>(negatedTy))
     {
@@ -668,7 +757,7 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const Nega
             subtypings.push_back(isCovariantWith(env, &negatedTmp, superTy));
         }
 
-        return SubtypingResult::all(subtypings);
+        result = SubtypingResult::all(subtypings);
     }
     else if (auto i = get<IntersectionType>(negatedTy))
     {
@@ -687,7 +776,7 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const Nega
             }
         }
 
-        return SubtypingResult::any(subtypings);
+        result = SubtypingResult::any(subtypings);
     }
     else if (is<ErrorType, FunctionType, TableType, MetatableType>(negatedTy))
     {
@@ -697,28 +786,32 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const Nega
     // subtype of other stuff.
     else
     {
-        return {false};
+        result = {false};
     }
+
+    return result.withSubComponent(TypePath::TypeField::Negated);
 }
 
 SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const TypeId subTy, const NegationType* superNegation)
 {
     TypeId negatedTy = follow(superNegation->ty);
 
+    SubtypingResult result;
+
     if (is<NeverType>(negatedTy))
     {
         // ¬never ~ unknown
-        return isCovariantWith(env, subTy, builtinTypes->unknownType);
+        result = isCovariantWith(env, subTy, builtinTypes->unknownType);
     }
     else if (is<UnknownType>(negatedTy))
     {
         // ¬unknown ~ never
-        return isCovariantWith(env, subTy, builtinTypes->neverType);
+        result = isCovariantWith(env, subTy, builtinTypes->neverType);
     }
     else if (is<AnyType>(negatedTy))
     {
         // ¬any ~ any
-        return isSubtype(subTy, negatedTy);
+        result = isSubtype(subTy, negatedTy);
     }
     else if (auto u = get<UnionType>(negatedTy))
     {
@@ -737,7 +830,7 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const Type
             }
         }
 
-        return SubtypingResult::all(subtypings);
+        result = SubtypingResult::all(subtypings);
     }
     else if (auto i = get<IntersectionType>(negatedTy))
     {
@@ -756,53 +849,55 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const Type
             }
         }
 
-        return SubtypingResult::any(subtypings);
+        result = SubtypingResult::any(subtypings);
     }
     else if (auto p = get2<PrimitiveType, PrimitiveType>(subTy, negatedTy))
     {
         // number <: ¬boolean
         // number </: ¬number
-        return {p.first->type != p.second->type};
+        result = {p.first->type != p.second->type};
     }
     else if (auto p = get2<SingletonType, PrimitiveType>(subTy, negatedTy))
     {
         // "foo" </: ¬string
         if (get<StringSingleton>(p.first) && p.second->type == PrimitiveType::String)
-            return {false};
+            result = {false};
         // false </: ¬boolean
         else if (get<BooleanSingleton>(p.first) && p.second->type == PrimitiveType::Boolean)
-            return {false};
+            result = {false};
         // other cases are true
         else
-            return {true};
+            result = {true};
     }
     else if (auto p = get2<PrimitiveType, SingletonType>(subTy, negatedTy))
     {
         if (p.first->type == PrimitiveType::String && get<StringSingleton>(p.second))
-            return {false};
+            result = {false};
         else if (p.first->type == PrimitiveType::Boolean && get<BooleanSingleton>(p.second))
-            return {false};
+            result = {false};
         else
-            return {true};
+            result = {true};
     }
     // the top class type is not actually a primitive type, so the negation of
     // any one of them includes the top class type.
     else if (auto p = get2<ClassType, PrimitiveType>(subTy, negatedTy))
-        return {true};
+        result = {true};
     else if (auto p = get<PrimitiveType>(negatedTy); p && is<TableType, MetatableType>(subTy))
-        return {p->type != PrimitiveType::Table};
+        result = {p->type != PrimitiveType::Table};
     else if (auto p = get2<FunctionType, PrimitiveType>(subTy, negatedTy))
-        return {p.second->type != PrimitiveType::Function};
+        result = {p.second->type != PrimitiveType::Function};
     else if (auto p = get2<SingletonType, SingletonType>(subTy, negatedTy))
-        return {*p.first != *p.second};
+        result = {*p.first != *p.second};
     else if (auto p = get2<ClassType, ClassType>(subTy, negatedTy))
-        return SubtypingResult::negate(isCovariantWith(env, p.first, p.second));
+        result = SubtypingResult::negate(isCovariantWith(env, p.first, p.second));
     else if (get2<FunctionType, ClassType>(subTy, negatedTy))
-        return {true};
+        result = {true};
     else if (is<ErrorType, FunctionType, TableType, MetatableType>(negatedTy))
         iceReporter->ice("attempting to negate a non-testable type");
+    else
+        result = {false};
 
-    return {false};
+    return result.withSuperComponent(TypePath::TypeField::Negated);
 }
 
 SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const PrimitiveType* subPrim, const PrimitiveType* superPrim)
@@ -836,16 +931,19 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const Tabl
     {
         std::vector<SubtypingResult> results;
         if (auto it = subTable->props.find(name); it != subTable->props.end())
-            results.push_back(isInvariantWith(env, it->second.type(), prop.type()));
+            results.push_back(isInvariantWith(env, it->second.type(), prop.type())
+                                  .withBothComponent(TypePath::Property(name)));
 
         if (subTable->indexer)
         {
             if (isInvariantWith(env, subTable->indexer->indexType, builtinTypes->stringType).isSubtype)
-                results.push_back(isInvariantWith(env, subTable->indexer->indexResultType, prop.type()));
+                results.push_back(isInvariantWith(env, subTable->indexer->indexResultType, prop.type())
+                                      .withSubComponent(TypePath::TypeField::IndexResult)
+                                      .withSuperComponent(TypePath::Property(name)));
         }
 
         if (results.empty())
-            return {false};
+            return SubtypingResult{false};
 
         result.andAlso(SubtypingResult::all(results));
     }
@@ -863,7 +961,8 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const Tabl
 
 SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const MetatableType* subMt, const MetatableType* superMt)
 {
-    return isCovariantWith(env, subMt->table, superMt->table).andAlso(isCovariantWith(env, subMt->metatable, superMt->metatable));
+    return isCovariantWith(env, subMt->table, superMt->table)
+        .andAlso(isCovariantWith(env, subMt->metatable, superMt->metatable).withBothComponent(TypePath::TypeField::Metatable));
 }
 
 SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const MetatableType* subMt, const TableType* superTable)
@@ -900,7 +999,7 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const Clas
     for (const auto& [name, prop] : superTable->props)
     {
         if (auto classProp = lookupClassProp(subClass, name))
-            result.andAlso(isInvariantWith(env, prop.type(), classProp->type()));
+            result.andAlso(isInvariantWith(env, prop.type(), classProp->type()).withBothComponent(TypePath::Property(name)));
         else
             return SubtypingResult{false};
     }
@@ -913,10 +1012,10 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const Func
     SubtypingResult result;
     {
         VarianceFlipper vf{&variance};
-        result.orElse(isContravariantWith(env, subFunction->argTypes, superFunction->argTypes));
+        result.orElse(isContravariantWith(env, subFunction->argTypes, superFunction->argTypes).withBothComponent(TypePath::PackField::Arguments));
     }
 
-    result.andAlso(isCovariantWith(env, subFunction->retTypes, superFunction->retTypes));
+    result.andAlso(isCovariantWith(env, subFunction->retTypes, superFunction->retTypes).withBothComponent(TypePath::PackField::Returns));
 
     return result;
 }
@@ -933,7 +1032,8 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const Prim
                 if (auto it = mttv->props.find("__index"); it != mttv->props.end())
                 {
                     if (auto stringTable = get<TableType>(it->second.type()))
-                        result.orElse(isCovariantWith(env, stringTable, superTable));
+                        result.orElse(
+                            isCovariantWith(env, stringTable, superTable).withSubPath(TypePath::PathBuilder().mt().prop("__index").build()));
                 }
             }
         }
@@ -954,7 +1054,8 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const Sing
                 if (auto it = mttv->props.find("__index"); it != mttv->props.end())
                 {
                     if (auto stringTable = get<TableType>(it->second.type()))
-                        result.orElse(isCovariantWith(env, stringTable, superTable));
+                        result.orElse(
+                            isCovariantWith(env, stringTable, superTable).withSubPath(TypePath::PathBuilder().mt().prop("__index").build()));
                 }
             }
         }
@@ -965,7 +1066,8 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const Sing
 SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const TableIndexer& subIndexer, const TableIndexer& superIndexer)
 {
     return isInvariantWith(env, subIndexer.indexType, superIndexer.indexType)
-        .andAlso(isInvariantWith(env, superIndexer.indexResultType, subIndexer.indexResultType));
+        .withBothComponent(TypePath::TypeField::IndexLookup)
+        .andAlso(isInvariantWith(env, superIndexer.indexResultType, subIndexer.indexResultType).withBothComponent(TypePath::TypeField::IndexResult));
 }
 
 SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const NormalizedType* subNorm, const NormalizedType* superNorm)
@@ -1092,11 +1194,12 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const Type
 {
     std::vector<SubtypingResult> results;
 
+    size_t i = 0;
     for (TypeId subTy : subTypes)
     {
         results.emplace_back();
         for (TypeId superTy : superTypes)
-            results.back().orElse(isCovariantWith(env, subTy, superTy));
+            results.back().orElse(isCovariantWith(env, subTy, superTy).withBothComponent(TypePath::Index{i++}));
     }
 
     return SubtypingResult::all(results);
@@ -1104,7 +1207,7 @@ SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const Type
 
 SubtypingResult Subtyping::isCovariantWith(SubtypingEnvironment& env, const VariadicTypePack* subVariadic, const VariadicTypePack* superVariadic)
 {
-    return isCovariantWith(env, subVariadic->ty, superVariadic->ty);
+    return isCovariantWith(env, subVariadic->ty, superVariadic->ty).withBothComponent(TypePath::TypeField::Variadic);
 }
 
 bool Subtyping::bindGeneric(SubtypingEnvironment& env, TypeId subTy, TypeId superTy)
diff --git a/Analysis/src/ToString.cpp b/Analysis/src/ToString.cpp
index 8123e09f9..58c03db43 100644
--- a/Analysis/src/ToString.cpp
+++ b/Analysis/src/ToString.cpp
@@ -1,6 +1,7 @@
 // This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
 #include "Luau/ToString.h"
 
+#include "Luau/Common.h"
 #include "Luau/Constraint.h"
 #include "Luau/Location.h"
 #include "Luau/Scope.h"
@@ -10,6 +11,7 @@
 #include "Luau/Type.h"
 #include "Luau/TypeFamily.h"
 #include "Luau/VisitType.h"
+#include "Luau/TypeOrPack.h"
 
 #include <algorithm>
 #include <stdexcept>
@@ -620,6 +622,12 @@ struct TypeStringifier
             state.emit(">");
         }
 
+        if (FFlag::DebugLuauDeferredConstraintResolution)
+        {
+            if (ftv.isCheckedFunction)
+                state.emit("@checked ");
+        }
+
         state.emit("(");
 
         if (state.opts.functionTypeArguments)
@@ -1686,21 +1694,6 @@ std::string toString(const Constraint& constraint, ToStringOptions& opts)
             std::string superStr = tos(c.superType);
             return subStr + " ~ inst " + superStr;
         }
-        else if constexpr (std::is_same_v<T, UnaryConstraint>)
-        {
-            std::string resultStr = tos(c.resultType);
-            std::string operandStr = tos(c.operandType);
-
-            return resultStr + " ~ Unary<" + toString(c.op) + ", " + operandStr + ">";
-        }
-        else if constexpr (std::is_same_v<T, BinaryConstraint>)
-        {
-            std::string resultStr = tos(c.resultType);
-            std::string leftStr = tos(c.leftType);
-            std::string rightStr = tos(c.rightType);
-
-            return resultStr + " ~ Binary<" + toString(c.op) + ", " + leftStr + ", " + rightStr + ">";
-        }
         else if constexpr (std::is_same_v<T, IterableConstraint>)
         {
             std::string iteratorStr = tos(c.iterator);
@@ -1756,6 +1749,23 @@ std::string toString(const Constraint& constraint, ToStringOptions& opts)
             const char* op = c.mode == RefineConstraint::Union ? "union" : "intersect";
             return tos(c.resultType) + " ~ refine " + tos(c.type) + " " + op + " " + tos(c.discriminant);
         }
+        else if constexpr (std::is_same_v<T, SetOpConstraint>)
+        {
+            const char* op = c.mode == SetOpConstraint::Union ? " | " : " & ";
+            std::string res = tos(c.resultType) + " ~ ";
+            bool first = true;
+            for (TypeId t : c.types)
+            {
+                if (first)
+                    first = false;
+                else
+                    res += op;
+
+                res += tos(t);
+            }
+
+            return res;
+        }
         else if constexpr (std::is_same_v<T, ReduceConstraint>)
             return "reduce " + tos(c.ty);
         else if constexpr (std::is_same_v<T, ReducePackConstraint>)
@@ -1834,4 +1844,24 @@ std::string toString(const Location& location, int offset, bool useBegin)
     }
 }
 
+std::string toString(const TypeOrPack& tyOrTp, ToStringOptions& opts)
+{
+    if (const TypeId* ty = get<TypeId>(tyOrTp))
+        return toString(*ty, opts);
+    else if (const TypePackId* tp = get<TypePackId>(tyOrTp))
+        return toString(*tp, opts);
+    else
+        LUAU_UNREACHABLE();
+}
+
+std::string dump(const TypeOrPack& tyOrTp)
+{
+    ToStringOptions opts;
+    opts.exhaustive = true;
+    opts.functionTypeArguments = true;
+    std::string s = toString(tyOrTp, opts);
+    printf("%s\n", s.c_str());
+    return s;
+}
+
 } // namespace Luau
diff --git a/Analysis/src/TypeChecker2.cpp b/Analysis/src/TypeChecker2.cpp
index 24925a1a8..166b7525f 100644
--- a/Analysis/src/TypeChecker2.cpp
+++ b/Analysis/src/TypeChecker2.cpp
@@ -15,9 +15,11 @@
 #include "Luau/ToString.h"
 #include "Luau/TxnLog.h"
 #include "Luau/Type.h"
+#include "Luau/TypeFamily.h"
+#include "Luau/TypeFwd.h"
 #include "Luau/TypePack.h"
+#include "Luau/TypePath.h"
 #include "Luau/TypeUtils.h"
-#include "Luau/TypeFamily.h"
 #include "Luau/VisitType.h"
 
 #include <algorithm>
@@ -2395,7 +2397,27 @@ struct TypeChecker2
             reportError(NormalizationTooComplex{}, location);
 
         if (!r.isSubtype && !r.isErrorSuppressing)
-            reportError(TypeMismatch{superTy, subTy}, location);
+        {
+            if (r.reasoning)
+            {
+                std::optional<TypeOrPack> subLeaf = traverse(subTy, r.reasoning->subPath, builtinTypes);
+                std::optional<TypeOrPack> superLeaf = traverse(superTy, r.reasoning->superPath, builtinTypes);
+
+                if (!subLeaf || !superLeaf)
+                    ice->ice("Subtyping test returned a reasoning with an invalid path", location);
+
+                if (!get2<TypeId, TypeId>(*subLeaf, *superLeaf) && !get2<TypePackId, TypePackId>(*subLeaf, *superLeaf))
+                    ice->ice("Subtyping test returned a reasoning where one path ends at a type and the other ends at a pack.", location);
+
+                std::string reason = "type " + toString(subTy) + toString(r.reasoning->subPath) + " (" + toString(*subLeaf) +
+                                     ") is not a subtype of " + toString(superTy) + toString(r.reasoning->superPath) + " (" + toString(*superLeaf) +
+                                     ")";
+
+                reportError(TypeMismatch{superTy, subTy, reason}, location);
+            }
+            else
+                reportError(TypeMismatch{superTy, subTy}, location);
+        }
 
         return r.isSubtype;
     }
diff --git a/Analysis/src/TypeFamily.cpp b/Analysis/src/TypeFamily.cpp
index f631d795f..7e4a591d2 100644
--- a/Analysis/src/TypeFamily.cpp
+++ b/Analysis/src/TypeFamily.cpp
@@ -338,6 +338,150 @@ TypeFamilyReductionResult<TypeId> notFamilyFn(const std::vector<TypeId>& typePar
     return {ctx->builtins->booleanType, false, {}, {}};
 }
 
+TypeFamilyReductionResult<TypeId> lenFamilyFn(const std::vector<TypeId>& typeParams, const std::vector<TypePackId>& packParams, NotNull<TypeFamilyContext> ctx)
+{
+    if (typeParams.size() != 1 || !packParams.empty())
+    {
+        ctx->ice->ice("len type family: encountered a type family instance without the required argument structure");
+        LUAU_ASSERT(false);
+    }
+
+    TypeId operandTy = follow(typeParams.at(0));
+    const NormalizedType* normTy = ctx->normalizer->normalize(operandTy);
+
+    // if the type failed to normalize, we can't reduce, but know nothing about inhabitance.
+    if (!normTy)
+        return {std::nullopt, false, {}, {}};
+
+    // if the operand type is error suppressing, we can immediately reduce to `number`.
+    if (normTy->shouldSuppressErrors())
+        return {ctx->builtins->numberType, false, {}, {}};
+
+    // if we have a `never`, we can never observe that the operator didn't work.
+    if (is<NeverType>(operandTy))
+        return {ctx->builtins->neverType, false, {}, {}};
+
+    // if we're checking the length of a string, that works!
+    if (normTy->isSubtypeOfString())
+        return {ctx->builtins->numberType, false, {}, {}};
+
+    // we use the normalized operand here in case there was an intersection or union.
+    TypeId normalizedOperand = ctx->normalizer->typeFromNormal(*normTy);
+    if (normTy->hasTopTable() || get<TableType>(normalizedOperand))
+        return {ctx->builtins->numberType, false, {}, {}};
+
+    // otherwise, we wait to see if the operand type is resolved
+    if (isPending(operandTy, ctx->solver))
+        return {std::nullopt, false, {operandTy}, {}};
+
+    // findMetatableEntry demands the ability to emit errors, so we must give it
+    // the necessary state to do that, even if we intend to just eat the errors.
+    ErrorVec dummy;
+
+    std::optional<TypeId> mmType = findMetatableEntry(ctx->builtins, dummy, operandTy, "__len", Location{});
+    if (!mmType)
+        return {std::nullopt, true, {}, {}};
+
+    mmType = follow(*mmType);
+    if (isPending(*mmType, ctx->solver))
+        return {std::nullopt, false, {*mmType}, {}};
+
+    const FunctionType* mmFtv = get<FunctionType>(*mmType);
+    if (!mmFtv)
+        return {std::nullopt, true, {}, {}};
+
+    std::optional<TypeId> instantiatedMmType = instantiate(ctx->builtins, ctx->arena, ctx->limits, ctx->scope, *mmType);
+    if (!instantiatedMmType)
+        return {std::nullopt, true, {}, {}};
+
+    const FunctionType* instantiatedMmFtv = get<FunctionType>(*instantiatedMmType);
+    if (!instantiatedMmFtv)
+        return {ctx->builtins->errorRecoveryType(), false, {}, {}};
+
+    TypePackId inferredArgPack = ctx->arena->addTypePack({operandTy});
+    Unifier2 u2{ctx->arena, ctx->builtins, ctx->scope, ctx->ice};
+    if (!u2.unify(inferredArgPack, instantiatedMmFtv->argTypes))
+        return {std::nullopt, true, {}, {}}; // occurs check failed
+
+    Subtyping subtyping{ctx->builtins, ctx->arena, ctx->normalizer, ctx->ice, ctx->scope};
+    if (!subtyping.isSubtype(inferredArgPack, instantiatedMmFtv->argTypes).isSubtype) // TODO: is this the right variance?
+        return {std::nullopt, true, {}, {}};
+
+    // `len` must return a `number`.
+    return {ctx->builtins->numberType, false, {}, {}};
+}
+
+TypeFamilyReductionResult<TypeId> unmFamilyFn(
+    const std::vector<TypeId>& typeParams, const std::vector<TypePackId>& packParams, NotNull<TypeFamilyContext> ctx)
+{
+    if (typeParams.size() != 1 || !packParams.empty())
+    {
+        ctx->ice->ice("unm type family: encountered a type family instance without the required argument structure");
+        LUAU_ASSERT(false);
+    }
+
+    TypeId operandTy = follow(typeParams.at(0));
+    const NormalizedType* normTy = ctx->normalizer->normalize(operandTy);
+
+    // if the operand failed to normalize, we can't reduce, but know nothing about inhabitance.
+    if (!normTy)
+        return {std::nullopt, false, {}, {}};
+
+    // if the operand is error suppressing, we can just go ahead and reduce.
+    if (normTy->shouldSuppressErrors())
+        return {operandTy, false, {}, {}};
+
+    // if we have a `never`, we can never observe that the operation didn't work.
+    if (is<NeverType>(operandTy))
+        return {ctx->builtins->neverType, false, {}, {}};
+
+    // If the type is exactly `number`, we can reduce now.
+    if (normTy->isExactlyNumber())
+        return {ctx->builtins->numberType, false, {}, {}};
+
+    // otherwise, check if we need to wait on the type to be further resolved
+    if (isPending(operandTy, ctx->solver))
+        return {std::nullopt, false, {operandTy}, {}};
+
+    // findMetatableEntry demands the ability to emit errors, so we must give it
+    // the necessary state to do that, even if we intend to just eat the errors.
+    ErrorVec dummy;
+
+    std::optional<TypeId> mmType = findMetatableEntry(ctx->builtins, dummy, operandTy, "__unm", Location{});
+    if (!mmType)
+        return {std::nullopt, true, {}, {}};
+
+    mmType = follow(*mmType);
+    if (isPending(*mmType, ctx->solver))
+        return {std::nullopt, false, {*mmType}, {}};
+
+    const FunctionType* mmFtv = get<FunctionType>(*mmType);
+    if (!mmFtv)
+        return {std::nullopt, true, {}, {}};
+
+    std::optional<TypeId> instantiatedMmType = instantiate(ctx->builtins, ctx->arena, ctx->limits, ctx->scope, *mmType);
+    if (!instantiatedMmType)
+        return {std::nullopt, true, {}, {}};
+
+    const FunctionType* instantiatedMmFtv = get<FunctionType>(*instantiatedMmType);
+    if (!instantiatedMmFtv)
+        return {ctx->builtins->errorRecoveryType(), false, {}, {}};
+
+    TypePackId inferredArgPack = ctx->arena->addTypePack({operandTy});
+    Unifier2 u2{ctx->arena, ctx->builtins, ctx->scope, ctx->ice};
+    if (!u2.unify(inferredArgPack, instantiatedMmFtv->argTypes))
+        return {std::nullopt, true, {}, {}}; // occurs check failed
+
+    Subtyping subtyping{ctx->builtins, ctx->arena, ctx->normalizer, ctx->ice, ctx->scope};
+    if (!subtyping.isSubtype(inferredArgPack, instantiatedMmFtv->argTypes).isSubtype) // TODO: is this the right variance?
+        return {std::nullopt, true, {}, {}};
+
+    if (std::optional<TypeId> ret = first(instantiatedMmFtv->retTypes))
+        return {*ret, false, {}, {}};
+    else
+        return {std::nullopt, true, {}, {}};
+}
+
 TypeFamilyReductionResult<TypeId> numericBinopFamilyFn(
     const std::vector<TypeId>& typeParams, const std::vector<TypePackId>& packParams, NotNull<TypeFamilyContext> ctx, const std::string metamethod)
 {
@@ -816,6 +960,8 @@ TypeFamilyReductionResult<TypeId> eqFamilyFn(const std::vector<TypeId>& typePara
 
 BuiltinTypeFamilies::BuiltinTypeFamilies()
     : notFamily{"not", notFamilyFn}
+    , lenFamily{"len", lenFamilyFn}
+    , unmFamily{"unm", unmFamilyFn}
     , addFamily{"add", addFamilyFn}
     , subFamily{"sub", subFamilyFn}
     , mulFamily{"mul", mulFamilyFn}
@@ -834,6 +980,14 @@ BuiltinTypeFamilies::BuiltinTypeFamilies()
 
 void BuiltinTypeFamilies::addToScope(NotNull<TypeArena> arena, NotNull<Scope> scope) const
 {
+    // make a type function for a one-argument type family
+    auto mkUnaryTypeFamily = [&](const TypeFamily* family) {
+        TypeId t = arena->addType(GenericType{"T"});
+        GenericTypeDefinition genericT{t};
+
+        return TypeFun{{genericT}, arena->addType(TypeFamilyInstanceType{NotNull{family}, {t}, {}})};
+    };
+
     // make a type function for a two-argument type family
     auto mkBinaryTypeFamily = [&](const TypeFamily* family) {
         TypeId t = arena->addType(GenericType{"T"});
@@ -844,6 +998,9 @@ void BuiltinTypeFamilies::addToScope(NotNull<TypeArena> arena, NotNull<Scope> sc
         return TypeFun{{genericT, genericU}, arena->addType(TypeFamilyInstanceType{NotNull{family}, {t, u}, {}})};
     };
 
+    scope->exportedTypeBindings[lenFamily.name] = mkUnaryTypeFamily(&lenFamily);
+    scope->exportedTypeBindings[unmFamily.name] = mkUnaryTypeFamily(&unmFamily);
+
     scope->exportedTypeBindings[addFamily.name] = mkBinaryTypeFamily(&addFamily);
     scope->exportedTypeBindings[subFamily.name] = mkBinaryTypeFamily(&subFamily);
     scope->exportedTypeBindings[mulFamily.name] = mkBinaryTypeFamily(&mulFamily);
diff --git a/Analysis/src/TypeOrPack.cpp b/Analysis/src/TypeOrPack.cpp
new file mode 100644
index 000000000..86652141d
--- /dev/null
+++ b/Analysis/src/TypeOrPack.cpp
@@ -0,0 +1,29 @@
+// This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
+
+#include "Luau/TypeOrPack.h"
+#include "Luau/Common.h"
+
+namespace Luau
+{
+
+const void* ptr(TypeOrPack tyOrTp)
+{
+    if (auto ty = get<TypeId>(tyOrTp))
+        return static_cast<const void*>(*ty);
+    else if (auto tp = get<TypePackId>(tyOrTp))
+        return static_cast<const void*>(*tp);
+    else
+        LUAU_UNREACHABLE();
+}
+
+TypeOrPack follow(TypeOrPack tyOrTp)
+{
+    if (auto ty = get<TypeId>(tyOrTp))
+        return follow(*ty);
+    else if (auto tp = get<TypePackId>(tyOrTp))
+        return follow(*tp);
+    else
+        LUAU_UNREACHABLE();
+}
+
+} // namespace Luau
diff --git a/Analysis/src/TypePath.cpp b/Analysis/src/TypePath.cpp
new file mode 100644
index 000000000..ff515bed1
--- /dev/null
+++ b/Analysis/src/TypePath.cpp
@@ -0,0 +1,633 @@
+// This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
+
+#include "Luau/TypePath.h"
+#include "Luau/Common.h"
+#include "Luau/DenseHash.h"
+#include "Luau/Type.h"
+#include "Luau/TypeFwd.h"
+#include "Luau/TypePack.h"
+#include "Luau/TypeUtils.h"
+
+#include <optional>
+#include <sstream>
+#include <type_traits>
+#include <unordered_set>
+
+LUAU_FASTFLAG(DebugLuauReadWriteProperties);
+
+// Maximum number of steps to follow when traversing a path. May not always
+// equate to the number of components in a path, depending on the traversal
+// logic.
+LUAU_DYNAMIC_FASTINTVARIABLE(LuauTypePathMaximumTraverseSteps, 100);
+
+namespace Luau
+{
+
+namespace TypePath
+{
+
+Property::Property(std::string name)
+    : name(std::move(name))
+{
+    LUAU_ASSERT(!FFlag::DebugLuauReadWriteProperties);
+}
+
+Property Property::read(std::string name)
+{
+    return Property(std::move(name), true);
+}
+
+Property Property::write(std::string name)
+{
+    return Property(std::move(name), false);
+}
+
+bool Property::operator==(const Property& other) const
+{
+    return name == other.name && isRead == other.isRead;
+}
+
+bool Index::operator==(const Index& other) const
+{
+    return index == other.index;
+}
+
+Path Path::append(const Path& suffix) const
+{
+    std::vector<Component> joined(components);
+    joined.reserve(suffix.components.size());
+    joined.insert(joined.end(), suffix.components.begin(), suffix.components.end());
+    return Path(std::move(joined));
+}
+
+Path Path::push(Component component) const
+{
+    std::vector<Component> joined(components);
+    joined.push_back(component);
+    return Path(std::move(joined));
+}
+
+Path Path::push_front(Component component) const
+{
+    std::vector<Component> joined{};
+    joined.reserve(components.size() + 1);
+    joined.push_back(std::move(component));
+    joined.insert(joined.end(), components.begin(), components.end());
+    return Path(std::move(joined));
+}
+
+Path Path::pop() const
+{
+    if (empty())
+        return kEmpty;
+
+    std::vector<Component> popped(components);
+    popped.pop_back();
+    return Path(std::move(popped));
+}
+
+std::optional<Component> Path::last() const
+{
+    if (empty())
+        return std::nullopt;
+
+    return components.back();
+}
+
+bool Path::empty() const
+{
+    return components.empty();
+}
+
+bool Path::operator==(const Path& other) const
+{
+    return components == other.components;
+}
+
+Path PathBuilder::build()
+{
+    return Path(std::move(components));
+}
+
+PathBuilder& PathBuilder::readProp(std::string name)
+{
+    LUAU_ASSERT(FFlag::DebugLuauReadWriteProperties);
+    components.push_back(Property{std::move(name), true});
+    return *this;
+}
+
+PathBuilder& PathBuilder::writeProp(std::string name)
+{
+    LUAU_ASSERT(FFlag::DebugLuauReadWriteProperties);
+    components.push_back(Property{std::move(name), false});
+    return *this;
+}
+
+PathBuilder& PathBuilder::prop(std::string name)
+{
+    LUAU_ASSERT(!FFlag::DebugLuauReadWriteProperties);
+    components.push_back(Property{std::move(name)});
+    return *this;
+}
+
+PathBuilder& PathBuilder::index(size_t i)
+{
+    components.push_back(Index{i});
+    return *this;
+}
+
+PathBuilder& PathBuilder::mt()
+{
+    components.push_back(TypeField::Metatable);
+    return *this;
+}
+
+PathBuilder& PathBuilder::lb()
+{
+    components.push_back(TypeField::LowerBound);
+    return *this;
+}
+
+PathBuilder& PathBuilder::ub()
+{
+    components.push_back(TypeField::UpperBound);
+    return *this;
+}
+
+PathBuilder& PathBuilder::indexKey()
+{
+    components.push_back(TypeField::IndexLookup);
+    return *this;
+}
+
+PathBuilder& PathBuilder::indexValue()
+{
+    components.push_back(TypeField::IndexResult);
+    return *this;
+}
+
+PathBuilder& PathBuilder::negated()
+{
+    components.push_back(TypeField::Negated);
+    return *this;
+}
+
+PathBuilder& PathBuilder::variadic()
+{
+    components.push_back(TypeField::Variadic);
+    return *this;
+}
+
+PathBuilder& PathBuilder::args()
+{
+    components.push_back(PackField::Arguments);
+    return *this;
+}
+
+PathBuilder& PathBuilder::rets()
+{
+    components.push_back(PackField::Returns);
+    return *this;
+}
+
+PathBuilder& PathBuilder::tail()
+{
+    components.push_back(PackField::Tail);
+    return *this;
+}
+
+} // namespace TypePath
+
+namespace
+{
+
+struct TraversalState
+{
+    TraversalState(TypeId root, NotNull<BuiltinTypes> builtinTypes)
+        : current(root)
+        , builtinTypes(builtinTypes)
+    {
+    }
+    TraversalState(TypePackId root, NotNull<BuiltinTypes> builtinTypes)
+        : current(root)
+        , builtinTypes(builtinTypes)
+    {
+    }
+
+    TypeOrPack current;
+    NotNull<BuiltinTypes> builtinTypes;
+
+    DenseHashSet<const void*> seen{nullptr};
+    int steps = 0;
+
+    void updateCurrent(TypeId ty)
+    {
+        LUAU_ASSERT(ty);
+        current = follow(ty);
+    }
+
+    void updateCurrent(TypePackId tp)
+    {
+        LUAU_ASSERT(tp);
+        current = follow(tp);
+    }
+
+    bool haveCycle()
+    {
+        const void* currentPtr = ptr(current);
+
+        if (seen.contains(currentPtr))
+            return true;
+        else
+            seen.insert(currentPtr);
+
+        return false;
+    }
+
+    bool tooLong()
+    {
+        return ++steps > DFInt::LuauTypePathMaximumTraverseSteps;
+    }
+
+    bool checkInvariants()
+    {
+        return haveCycle() || tooLong();
+    }
+
+    bool traverse(const TypePath::Property& property)
+    {
+        auto currentType = get<TypeId>(current);
+        if (!currentType)
+            return false;
+
+        if (checkInvariants())
+            return false;
+
+        const Property* prop = nullptr;
+
+        if (auto t = get<TableType>(*currentType))
+        {
+            auto it = t->props.find(property.name);
+            if (it != t->props.end())
+            {
+                prop = &it->second;
+            }
+        }
+        else if (auto c = get<ClassType>(*currentType))
+        {
+            prop = lookupClassProp(c, property.name);
+        }
+        else if (auto m = getMetatable(*currentType, builtinTypes))
+        {
+            // Weird: rather than use findMetatableEntry, which requires a lot
+            // of stuff that we don't have and don't want to pull in, we use the
+            // path traversal logic to grab __index and then re-enter the lookup
+            // logic there.
+            updateCurrent(*m);
+
+            if (!traverse(TypePath::Property{"__index"}))
+                return false;
+
+            return traverse(property);
+        }
+
+        if (prop)
+        {
+            std::optional<TypeId> maybeType;
+            if (FFlag::DebugLuauReadWriteProperties)
+                maybeType = property.isRead ? prop->readType() : prop->writeType();
+            else
+                maybeType = prop->type();
+
+            if (maybeType)
+            {
+                updateCurrent(*maybeType);
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    bool traverse(const TypePath::Index& index)
+    {
+        if (checkInvariants())
+            return false;
+
+        if (auto currentType = get<TypeId>(current))
+        {
+            if (auto u = get<UnionType>(*currentType))
+            {
+                auto it = begin(u);
+                std::advance(it, index.index);
+                if (it != end(u))
+                {
+                    updateCurrent(*it);
+                    return true;
+                }
+            }
+            else if (auto i = get<IntersectionType>(*currentType))
+            {
+                auto it = begin(i);
+                std::advance(it, index.index);
+                if (it != end(i))
+                {
+                    updateCurrent(*it);
+                    return true;
+                }
+            }
+        }
+        else
+        {
+            auto currentPack = get<TypePackId>(current);
+            LUAU_ASSERT(currentPack);
+            if (get<TypePack>(*currentPack))
+            {
+                auto it = begin(*currentPack);
+
+                for (size_t i = 0; i < index.index && it != end(*currentPack); ++i)
+                    ++it;
+
+                if (it != end(*currentPack))
+                {
+                    updateCurrent(*it);
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
+    bool traverse(TypePath::TypeField field)
+    {
+        if (checkInvariants())
+            return false;
+
+        switch (field)
+        {
+        case TypePath::TypeField::Metatable:
+            if (auto currentType = get<TypeId>(current))
+            {
+                if (std::optional<TypeId> mt = getMetatable(*currentType, builtinTypes))
+                {
+                    updateCurrent(*mt);
+                    return true;
+                }
+            }
+
+            return false;
+        case TypePath::TypeField::LowerBound:
+        case TypePath::TypeField::UpperBound:
+            if (auto ft = get<FreeType>(current))
+            {
+                updateCurrent(field == TypePath::TypeField::LowerBound ? ft->lowerBound : ft->upperBound);
+                return true;
+            }
+
+            return false;
+        case TypePath::TypeField::IndexLookup:
+        case TypePath::TypeField::IndexResult:
+        {
+            const TableIndexer* indexer = nullptr;
+
+            if (auto tt = get<TableType>(current); tt && tt->indexer)
+                indexer = &(*tt->indexer);
+            // Note: we don't appear to walk the class hierarchy for indexers
+            else if (auto ct = get<ClassType>(current); ct && ct->indexer)
+                indexer = &(*ct->indexer);
+
+            if (indexer)
+            {
+                updateCurrent(field == TypePath::TypeField::IndexLookup ? indexer->indexType : indexer->indexResultType);
+                return true;
+            }
+
+            return false;
+        }
+        case TypePath::TypeField::Negated:
+            if (auto nt = get<NegationType>(current))
+            {
+                updateCurrent(nt->ty);
+                return true;
+            }
+
+            return false;
+        case TypePath::TypeField::Variadic:
+            if (auto vtp = get<VariadicTypePack>(current))
+            {
+                updateCurrent(vtp->ty);
+                return true;
+            }
+
+            return false;
+        }
+
+        return false;
+    }
+
+    bool traverse(TypePath::PackField field)
+    {
+        if (checkInvariants())
+            return false;
+
+        switch (field)
+        {
+        case TypePath::PackField::Arguments:
+        case TypePath::PackField::Returns:
+            if (auto ft = get<FunctionType>(current))
+            {
+                updateCurrent(field == TypePath::PackField::Arguments ? ft->argTypes : ft->retTypes);
+                return true;
+            }
+
+            return false;
+        case TypePath::PackField::Tail:
+            if (auto currentPack = get<TypePackId>(current))
+            {
+                auto it = begin(*currentPack);
+                while (it != end(*currentPack))
+                    ++it;
+
+                if (auto tail = it.tail())
+                {
+                    updateCurrent(*tail);
+                    return true;
+                }
+            }
+
+            return false;
+        }
+
+        return false;
+    }
+};
+
+} // namespace
+
+std::string toString(const TypePath::Path& path)
+{
+    std::stringstream result;
+    bool first = true;
+
+    auto strComponent = [&](auto&& c) {
+        using T = std::decay_t<decltype(c)>;
+        if constexpr (std::is_same_v<T, TypePath::Property>)
+        {
+            result << '[';
+            if (FFlag::DebugLuauReadWriteProperties)
+            {
+                if (c.isRead)
+                    result << "read ";
+                else
+                    result << "write ";
+            }
+
+            result << '"' << c.name << '"' << ']';
+        }
+        else if constexpr (std::is_same_v<T, TypePath::Index>)
+        {
+            result << '[' << std::to_string(c.index) << ']';
+        }
+        else if constexpr (std::is_same_v<T, TypePath::TypeField>)
+        {
+            if (!first)
+                result << '.';
+
+            switch (c)
+            {
+            case TypePath::TypeField::Metatable:
+                result << "metatable";
+                break;
+            case TypePath::TypeField::LowerBound:
+                result << "lowerBound";
+                break;
+            case TypePath::TypeField::UpperBound:
+                result << "upperBound";
+                break;
+            case TypePath::TypeField::IndexLookup:
+                result << "indexer";
+                break;
+            case TypePath::TypeField::IndexResult:
+                result << "indexResult";
+                break;
+            case TypePath::TypeField::Negated:
+                result << "negated";
+                break;
+            case TypePath::TypeField::Variadic:
+                result << "variadic";
+                break;
+            }
+
+            result << "()";
+        }
+        else if constexpr (std::is_same_v<T, TypePath::PackField>)
+        {
+            if (!first)
+                result << '.';
+
+            switch (c)
+            {
+            case TypePath::PackField::Arguments:
+                result << "arguments";
+                break;
+            case TypePath::PackField::Returns:
+                result << "returns";
+                break;
+            case TypePath::PackField::Tail:
+                result << "tail";
+                break;
+            }
+
+            result << "()";
+        }
+        else
+        {
+            static_assert(always_false_v<T>, "Unhandled Component variant");
+        }
+
+        first = false;
+    };
+
+    for (const TypePath::Component& component : path.components)
+        Luau::visit(strComponent, component);
+
+    return result.str();
+}
+
+static bool traverse(TraversalState& state, const Path& path)
+{
+    auto step = [&state](auto&& c) {
+        return state.traverse(c);
+    };
+
+    for (const TypePath::Component& component : path.components)
+    {
+        bool stepSuccess = visit(step, component);
+        if (!stepSuccess)
+            return false;
+    }
+
+    return true;
+}
+
+std::optional<TypeOrPack> traverse(TypeId root, const Path& path, NotNull<BuiltinTypes> builtinTypes)
+{
+    TraversalState state(follow(root), builtinTypes);
+    if (traverse(state, path))
+        return state.current;
+    else
+        return std::nullopt;
+}
+
+std::optional<TypeOrPack> traverse(TypePackId root, const Path& path, NotNull<BuiltinTypes> builtinTypes);
+
+std::optional<TypeId> traverseForType(TypeId root, const Path& path, NotNull<BuiltinTypes> builtinTypes)
+{
+    TraversalState state(follow(root), builtinTypes);
+    if (traverse(state, path))
+    {
+        auto ty = get<TypeId>(state.current);
+        return ty ? std::make_optional(*ty) : std::nullopt;
+    }
+    else
+        return std::nullopt;
+}
+
+std::optional<TypeId> traverseForType(TypePackId root, const Path& path, NotNull<BuiltinTypes> builtinTypes)
+{
+    TraversalState state(follow(root), builtinTypes);
+    if (traverse(state, path))
+    {
+        auto ty = get<TypeId>(state.current);
+        return ty ? std::make_optional(*ty) : std::nullopt;
+    }
+    else
+        return std::nullopt;
+}
+
+std::optional<TypePackId> traverseForPack(TypeId root, const Path& path, NotNull<BuiltinTypes> builtinTypes)
+{
+    TraversalState state(follow(root), builtinTypes);
+    if (traverse(state, path))
+    {
+        auto ty = get<TypePackId>(state.current);
+        return ty ? std::make_optional(*ty) : std::nullopt;
+    }
+    else
+        return std::nullopt;
+}
+
+std::optional<TypePackId> traverseForPack(TypePackId root, const Path& path, NotNull<BuiltinTypes> builtinTypes)
+{
+    TraversalState state(follow(root), builtinTypes);
+    if (traverse(state, path))
+    {
+        auto ty = get<TypePackId>(state.current);
+        return ty ? std::make_optional(*ty) : std::nullopt;
+    }
+    else
+        return std::nullopt;
+}
+
+} // namespace Luau
diff --git a/Analysis/src/TypeUtils.cpp b/Analysis/src/TypeUtils.cpp
index 0b878180c..f746f6209 100644
--- a/Analysis/src/TypeUtils.cpp
+++ b/Analysis/src/TypeUtils.cpp
@@ -1,6 +1,7 @@
 // This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
 #include "Luau/TypeUtils.h"
 
+#include "Luau/Common.h"
 #include "Luau/Normalize.h"
 #include "Luau/Scope.h"
 #include "Luau/ToString.h"
diff --git a/CLI/Compile.cpp b/CLI/Compile.cpp
index 2059deaff..4f6b54b65 100644
--- a/CLI/Compile.cpp
+++ b/CLI/Compile.cpp
@@ -33,6 +33,13 @@ enum class CompileFormat
     Null
 };
 
+enum class RecordStats
+{
+    None,
+    Total,
+    Split
+};
+
 struct GlobalOptions
 {
     int optimizationLevel = 1;
@@ -122,6 +129,57 @@ struct CompileStats
     double codegenTime;
 
     Luau::CodeGen::LoweringStats lowerStats;
+
+    void serializeToJson(FILE* fp)
+    {
+        // use compact one-line formatting to reduce file length
+        fprintf(fp, "{\
+\"lines\": %zu, \
+\"bytecode\": %zu, \
+\"codegen\": %zu, \
+\"readTime\": %f, \
+\"miscTime\": %f, \
+\"parseTime\": %f, \
+\"compileTime\": %f, \
+\"codegenTime\": %f, \
+\"lowerStats\": {\
+\"totalFunctions\": %u, \
+\"skippedFunctions\": %u, \
+\"spillsToSlot\": %d, \
+\"spillsToRestore\": %d, \
+\"maxSpillSlotsUsed\": %u, \
+\"blocksPreOpt\": %u, \
+\"blocksPostOpt\": %u, \
+\"maxBlockInstructions\": %u, \
+\"regAllocErrors\": %d, \
+\"loweringErrors\": %d\
+}}",
+            lines, bytecode, codegen, readTime, miscTime, parseTime, compileTime, codegenTime, lowerStats.totalFunctions, lowerStats.skippedFunctions,
+            lowerStats.spillsToSlot, lowerStats.spillsToRestore, lowerStats.maxSpillSlotsUsed, lowerStats.blocksPreOpt, lowerStats.blocksPostOpt,
+            lowerStats.maxBlockInstructions, lowerStats.regAllocErrors, lowerStats.loweringErrors);
+    }
+
+    CompileStats& operator+=(const CompileStats& that)
+    {
+        this->lines += that.lines;
+        this->bytecode += that.bytecode;
+        this->codegen += that.codegen;
+        this->readTime += that.readTime;
+        this->miscTime += that.miscTime;
+        this->parseTime += that.parseTime;
+        this->compileTime += that.compileTime;
+        this->codegenTime += that.codegenTime;
+        this->lowerStats += that.lowerStats;
+
+        return *this;
+    }
+
+    CompileStats operator+(const CompileStats& other) const
+    {
+        CompileStats result(*this);
+        result += other;
+        return result;
+    }
 };
 
 static double recordDeltaTime(double& timer)
@@ -254,6 +312,7 @@ static void displayHelp(const char* argv0)
     printf("  -g<n>: compile with debug level n (default 1, n should be between 0 and 2).\n");
     printf("  --target=<target>: compile code for specific architecture (a64, x64, a64_nf, x64_ms).\n");
     printf("  --timetrace: record compiler time tracing information into trace.json\n");
+    printf("  --record-stats=<style>: records compilation stats in stats.json (total, split).\n");
 }
 
 static int assertionHandler(const char* expr, const char* file, int line, const char* function)
@@ -270,6 +329,7 @@ int main(int argc, char** argv)
 
     CompileFormat compileFormat = CompileFormat::Text;
     Luau::CodeGen::AssemblyOptions::Target assemblyTarget = Luau::CodeGen::AssemblyOptions::Host;
+    RecordStats recordStats = RecordStats::None;
 
     for (int i = 1; i < argc; i++)
     {
@@ -320,6 +380,20 @@ int main(int argc, char** argv)
         {
             FFlag::DebugLuauTimeTracing.value = true;
         }
+        else if (strncmp(argv[i], "--record-stats=", 15) == 0)
+        {
+            const char* value = argv[i] + 15;
+
+            if (strcmp(value, "total") == 0)
+                recordStats = RecordStats::Total;
+            else if (strcmp(value, "split") == 0)
+                recordStats = RecordStats::Split;
+            else
+            {
+                fprintf(stderr, "Error: unknown 'style' for '--record-stats'\n");
+                return 1;
+            }
+        }
         else if (strncmp(argv[i], "--fflags=", 9) == 0)
         {
             setLuauFlags(argv[i] + 9);
@@ -351,11 +425,23 @@ int main(int argc, char** argv)
         _setmode(_fileno(stdout), _O_BINARY);
 #endif
 
+    const size_t fileCount = files.size();
     CompileStats stats = {};
+
+    std::vector<CompileStats> fileStats;
+    if (recordStats == RecordStats::Split)
+        fileStats.reserve(fileCount);
+
     int failed = 0;
 
     for (const std::string& path : files)
-        failed += !compileFile(path.c_str(), compileFormat, assemblyTarget, stats);
+    {
+        CompileStats fileStat = {};
+        failed += !compileFile(path.c_str(), compileFormat, assemblyTarget, fileStat);
+        stats += fileStat;
+        if (recordStats == RecordStats::Split)
+            fileStats.push_back(fileStat);
+    }
 
     if (compileFormat == CompileFormat::Null)
     {
@@ -374,5 +460,35 @@ int main(int argc, char** argv)
             stats.lowerStats.maxSpillSlotsUsed);
     }
 
+    if (recordStats != RecordStats::None)
+    {
+
+        FILE* fp = fopen("stats.json", "w");
+
+        if (!fp)
+        {
+            fprintf(stderr, "Unable to open 'stats.json'\n");
+            return 1;
+        }
+
+        if (recordStats == RecordStats::Total)
+        {
+            stats.serializeToJson(fp);
+        }
+        else if (recordStats == RecordStats::Split)
+        {
+            fprintf(fp, "{\n");
+            for (size_t i = 0; i < fileCount; ++i)
+            {
+                fprintf(fp, "\"%s\": ", files[i].c_str());
+                fileStats[i].serializeToJson(fp);
+                fprintf(fp, i == (fileCount - 1) ? "\n" : ",\n");
+            }
+            fprintf(fp, "}");
+        }
+
+        fclose(fp);
+    }
+
     return failed ? 1 : 0;
 }
diff --git a/CodeGen/include/Luau/AssemblyBuilderA64.h b/CodeGen/include/Luau/AssemblyBuilderA64.h
index 931003b32..32bf56db6 100644
--- a/CodeGen/include/Luau/AssemblyBuilderA64.h
+++ b/CodeGen/include/Luau/AssemblyBuilderA64.h
@@ -72,6 +72,7 @@ class AssemblyBuilderA64
     void ror(RegisterA64 dst, RegisterA64 src1, RegisterA64 src2);
     void clz(RegisterA64 dst, RegisterA64 src);
     void rbit(RegisterA64 dst, RegisterA64 src);
+    void rev(RegisterA64 dst, RegisterA64 src);
 
     // Shifts with immediates
     // Note: immediate value must be in [0, 31] or [0, 63] range based on register type
diff --git a/CodeGen/include/Luau/AssemblyBuilderX64.h b/CodeGen/include/Luau/AssemblyBuilderX64.h
index 6bf5ad3dd..8a31e6808 100644
--- a/CodeGen/include/Luau/AssemblyBuilderX64.h
+++ b/CodeGen/include/Luau/AssemblyBuilderX64.h
@@ -106,6 +106,7 @@ class AssemblyBuilderX64
 
     void bsr(RegisterX64 dst, OperandX64 src);
     void bsf(RegisterX64 dst, OperandX64 src);
+    void bswap(RegisterX64 dst);
 
     // Code alignment
     void nop(uint32_t length = 1);
diff --git a/CodeGen/include/Luau/CodeGen.h b/CodeGen/include/Luau/CodeGen.h
index 04a65e36a..409bc22aa 100644
--- a/CodeGen/include/Luau/CodeGen.h
+++ b/CodeGen/include/Luau/CodeGen.h
@@ -1,6 +1,7 @@
 // This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
 #pragma once
 
+#include <algorithm>
 #include <string>
 
 #include <stddef.h>
@@ -66,6 +67,8 @@ struct AssemblyOptions
 
     Target target = Host;
 
+    unsigned int flags = 0;
+
     bool outputBinary = false;
 
     bool includeAssembly = false;
@@ -79,12 +82,39 @@ struct AssemblyOptions
 
 struct LoweringStats
 {
+    unsigned totalFunctions = 0;
+    unsigned skippedFunctions = 0;
     int spillsToSlot = 0;
     int spillsToRestore = 0;
     unsigned maxSpillSlotsUsed = 0;
+    unsigned blocksPreOpt = 0;
+    unsigned blocksPostOpt = 0;
+    unsigned maxBlockInstructions = 0;
 
     int regAllocErrors = 0;
     int loweringErrors = 0;
+
+    LoweringStats operator+(const LoweringStats& other) const
+    {
+        LoweringStats result(*this);
+        result += other;
+        return result;
+    }
+
+    LoweringStats& operator+=(const LoweringStats& that)
+    {
+        this->totalFunctions += that.totalFunctions;
+        this->skippedFunctions += that.skippedFunctions;
+        this->spillsToSlot += that.spillsToSlot;
+        this->spillsToRestore += that.spillsToRestore;
+        this->maxSpillSlotsUsed = std::max(this->maxSpillSlotsUsed, that.maxSpillSlotsUsed);
+        this->blocksPreOpt += that.blocksPreOpt;
+        this->blocksPostOpt += that.blocksPostOpt;
+        this->maxBlockInstructions = std::max(this->maxBlockInstructions, that.maxBlockInstructions);
+        this->regAllocErrors += that.regAllocErrors;
+        this->loweringErrors += that.loweringErrors;
+        return *this;
+    }
 };
 
 // Generates assembly for target function and all inner functions
diff --git a/CodeGen/include/Luau/IrData.h b/CodeGen/include/Luau/IrData.h
index 298258c13..19e082b5b 100644
--- a/CodeGen/include/Luau/IrData.h
+++ b/CodeGen/include/Luau/IrData.h
@@ -219,6 +219,14 @@ enum class IrCmd : uint8_t
     // E: block (if false)
     JUMP_CMP_NUM,
 
+    // Perform jump based on a numerical loop condition (step > 0 ? idx <= limit : limit <= idx)
+    // A: double (index)
+    // B: double (limit)
+    // C: double (step)
+    // D: block (if true)
+    // E: block (if false)
+    JUMP_FORN_LOOP_COND,
+
     // Perform a conditional jump based on cached table node slot matching the actual table node slot for a key
     // A: pointer (LuaNode)
     // B: Kn
diff --git a/CodeGen/include/Luau/IrUtils.h b/CodeGen/include/Luau/IrUtils.h
index d513f1b4d..3fe1800b6 100644
--- a/CodeGen/include/Luau/IrUtils.h
+++ b/CodeGen/include/Luau/IrUtils.h
@@ -97,6 +97,7 @@ inline bool isBlockTerminator(IrCmd cmd)
     case IrCmd::JUMP_CMP_INT:
     case IrCmd::JUMP_EQ_POINTER:
     case IrCmd::JUMP_CMP_NUM:
+    case IrCmd::JUMP_FORN_LOOP_COND:
     case IrCmd::JUMP_SLOT_MATCH:
     case IrCmd::RETURN:
     case IrCmd::FORGLOOP:
diff --git a/CodeGen/src/AssemblyBuilderA64.cpp b/CodeGen/src/AssemblyBuilderA64.cpp
index 15be6b88b..16d9bfd4b 100644
--- a/CodeGen/src/AssemblyBuilderA64.cpp
+++ b/CodeGen/src/AssemblyBuilderA64.cpp
@@ -254,6 +254,14 @@ void AssemblyBuilderA64::rbit(RegisterA64 dst, RegisterA64 src)
     placeR1("rbit", dst, src, 0b10'11010110'00000'0000'00);
 }
 
+void AssemblyBuilderA64::rev(RegisterA64 dst, RegisterA64 src)
+{
+    LUAU_ASSERT(dst.kind == KindA64::w || dst.kind == KindA64::x);
+    LUAU_ASSERT(dst.kind == src.kind);
+
+    placeR1("rev", dst, src, 0b10'11010110'00000'0000'10 | int(dst.kind == KindA64::x));
+}
+
 void AssemblyBuilderA64::lsl(RegisterA64 dst, RegisterA64 src1, uint8_t src2)
 {
     int size = dst.kind == KindA64::x ? 64 : 32;
diff --git a/CodeGen/src/AssemblyBuilderX64.cpp b/CodeGen/src/AssemblyBuilderX64.cpp
index 8abccac70..fa615c13a 100644
--- a/CodeGen/src/AssemblyBuilderX64.cpp
+++ b/CodeGen/src/AssemblyBuilderX64.cpp
@@ -541,6 +541,19 @@ void AssemblyBuilderX64::bsf(RegisterX64 dst, OperandX64 src)
     commit();
 }
 
+void AssemblyBuilderX64::bswap(RegisterX64 dst)
+{
+    if (logText)
+        log("bswap", dst);
+
+    LUAU_ASSERT(dst.size == SizeX64::dword || dst.size == SizeX64::qword);
+
+    placeRex(dst);
+    place(0x0f);
+    place(OP_PLUS_REG(0xc8, dst.index));
+    commit();
+}
+
 void AssemblyBuilderX64::nop(uint32_t length)
 {
     while (length != 0)
diff --git a/CodeGen/src/CodeGen.cpp b/CodeGen/src/CodeGen.cpp
index 274b583d1..3e6f5e8bf 100644
--- a/CodeGen/src/CodeGen.cpp
+++ b/CodeGen/src/CodeGen.cpp
@@ -42,6 +42,9 @@
 LUAU_FASTFLAGVARIABLE(DebugCodegenNoOpt, false)
 LUAU_FASTFLAGVARIABLE(DebugCodegenOptSize, false)
 LUAU_FASTFLAGVARIABLE(DebugCodegenSkipNumbering, false)
+LUAU_FASTINTVARIABLE(CodegenHeuristicsInstructionLimit, 1'048'576)   // 1 M
+LUAU_FASTINTVARIABLE(CodegenHeuristicsBlockLimit, 65'536)            // 64 K
+LUAU_FASTINTVARIABLE(CodegenHeuristicsBlockInstructionLimit, 65'536) // 64 K
 
 namespace Luau
 {
diff --git a/CodeGen/src/CodeGenAssembly.cpp b/CodeGen/src/CodeGenAssembly.cpp
index d55713f0b..7d1189d4f 100644
--- a/CodeGen/src/CodeGenAssembly.cpp
+++ b/CodeGen/src/CodeGenAssembly.cpp
@@ -45,11 +45,19 @@ static void logFunctionHeader(AssemblyBuilder& build, Proto* proto)
 template<typename AssemblyBuilder>
 static std::string getAssemblyImpl(AssemblyBuilder& build, const TValue* func, AssemblyOptions options, LoweringStats* stats)
 {
+    Proto* root = clvalue(func)->l.p;
+
+    if ((options.flags & CodeGen_OnlyNativeModules) != 0 && (root->flags & LPF_NATIVE_MODULE) == 0)
+        return std::string();
+
     std::vector<Proto*> protos;
-    gatherFunctions(protos, clvalue(func)->l.p, /* flags= */ 0);
+    gatherFunctions(protos, root, options.flags);
 
     protos.erase(std::remove_if(protos.begin(), protos.end(), [](Proto* p) { return p == nullptr; }), protos.end());
 
+    if (stats)
+        stats->totalFunctions += unsigned(protos.size());
+
     if (protos.empty())
     {
         build.finalize(); // to avoid assertion in AssemblyBuilder dtor
@@ -77,6 +85,9 @@ static std::string getAssemblyImpl(AssemblyBuilder& build, const TValue* func, A
         {
             if (build.logText)
                 build.logAppend("; skipping (can't lower)\n");
+
+            if (stats)
+                stats->skippedFunctions += 1;
         }
 
         if (build.logText)
diff --git a/CodeGen/src/CodeGenLower.h b/CodeGen/src/CodeGenLower.h
index fb10799b8..8fcd832fb 100644
--- a/CodeGen/src/CodeGenLower.h
+++ b/CodeGen/src/CodeGenLower.h
@@ -23,6 +23,9 @@
 LUAU_FASTFLAG(DebugCodegenNoOpt)
 LUAU_FASTFLAG(DebugCodegenOptSize)
 LUAU_FASTFLAG(DebugCodegenSkipNumbering)
+LUAU_FASTINT(CodegenHeuristicsInstructionLimit)
+LUAU_FASTINT(CodegenHeuristicsBlockLimit)
+LUAU_FASTINT(CodegenHeuristicsBlockInstructionLimit)
 
 namespace Luau
 {
@@ -222,8 +225,41 @@ inline bool lowerIr(A64::AssemblyBuilderA64& build, IrBuilder& ir, const std::ve
 template<typename AssemblyBuilder>
 inline bool lowerFunction(IrBuilder& ir, AssemblyBuilder& build, ModuleHelpers& helpers, Proto* proto, AssemblyOptions options, LoweringStats* stats)
 {
+    helpers.bytecodeInstructionCount += unsigned(ir.function.instructions.size());
+
+    if (helpers.bytecodeInstructionCount >= unsigned(FInt::CodegenHeuristicsInstructionLimit.value))
+        return false;
+
     killUnusedBlocks(ir.function);
 
+    unsigned preOptBlockCount = 0;
+    unsigned maxBlockInstructions = 0;
+
+    for (const IrBlock& block : ir.function.blocks)
+    {
+        preOptBlockCount += (block.kind != IrBlockKind::Dead);
+        unsigned blockInstructions = block.finish - block.start;
+        maxBlockInstructions = std::max(maxBlockInstructions, blockInstructions);
+    };
+
+    helpers.preOptBlockCount += preOptBlockCount;
+
+    // we update stats before checking the heuristic so that even if we bail out
+    // our stats include information about the limit that was exceeded.
+    if (stats)
+    {
+        stats->blocksPreOpt += preOptBlockCount;
+        stats->maxBlockInstructions = maxBlockInstructions;
+    }
+
+    // we use helpers.blocksPreOpt instead of stats.blocksPreOpt since
+    // stats can be null across some code paths.
+    if (helpers.preOptBlockCount >= unsigned(FInt::CodegenHeuristicsBlockLimit.value))
+        return false;
+
+    if (maxBlockInstructions >= unsigned(FInt::CodegenHeuristicsBlockInstructionLimit.value))
+        return false;
+
     computeCfgInfo(ir.function);
 
     if (!FFlag::DebugCodegenNoOpt)
@@ -241,6 +277,15 @@ inline bool lowerFunction(IrBuilder& ir, AssemblyBuilder& build, ModuleHelpers&
     // In order to allocate registers during lowering, we need to know where instruction results are last used
     updateLastUseLocations(ir.function, sortedBlocks);
 
+    if (stats)
+    {
+        for (const IrBlock& block : ir.function.blocks)
+        {
+            if (block.kind != IrBlockKind::Dead)
+                ++stats->blocksPostOpt;
+        }
+    }
+
     return lowerIr(build, ir, sortedBlocks, helpers, proto, options, stats);
 }
 
diff --git a/CodeGen/src/EmitCommon.h b/CodeGen/src/EmitCommon.h
index 013ba88f8..f0e14103f 100644
--- a/CodeGen/src/EmitCommon.h
+++ b/CodeGen/src/EmitCommon.h
@@ -31,6 +31,9 @@ struct ModuleHelpers
 
     // A64
     Label continueCall; // x0: closure
+
+    unsigned bytecodeInstructionCount = 0;
+    unsigned preOptBlockCount = 0;
 };
 
 } // namespace CodeGen
diff --git a/CodeGen/src/IrDump.cpp b/CodeGen/src/IrDump.cpp
index 21b2f702a..1d156af6b 100644
--- a/CodeGen/src/IrDump.cpp
+++ b/CodeGen/src/IrDump.cpp
@@ -163,6 +163,8 @@ const char* getCmdName(IrCmd cmd)
         return "JUMP_EQ_POINTER";
     case IrCmd::JUMP_CMP_NUM:
         return "JUMP_CMP_NUM";
+    case IrCmd::JUMP_FORN_LOOP_COND:
+        return "JUMP_FORN_LOOP_COND";
     case IrCmd::JUMP_SLOT_MATCH:
         return "JUMP_SLOT_MATCH";
     case IrCmd::TABLE_LEN:
diff --git a/CodeGen/src/IrLoweringA64.cpp b/CodeGen/src/IrLoweringA64.cpp
index 76f326cf2..26a3b887a 100644
--- a/CodeGen/src/IrLoweringA64.cpp
+++ b/CodeGen/src/IrLoweringA64.cpp
@@ -812,6 +812,30 @@ void IrLoweringA64::lowerInst(IrInst& inst, uint32_t index, const IrBlock& next)
         jumpOrFallthrough(blockOp(inst.e), next);
         break;
     }
+    case IrCmd::JUMP_FORN_LOOP_COND:
+    {
+        RegisterA64 index = tempDouble(inst.a);
+        RegisterA64 limit = tempDouble(inst.b);
+
+        Label direct;
+
+        // step > 0
+        build.fcmpz(tempDouble(inst.c));
+        build.b(getConditionFP(IrCondition::Greater), direct);
+
+        // !(limit <= index)
+        build.fcmp(limit, index);
+        build.b(getConditionFP(IrCondition::NotLessEqual), labelOp(inst.e));
+        build.b(labelOp(inst.d));
+
+        // !(index <= limit)
+        build.setLabel(direct);
+
+        build.fcmp(index, limit);
+        build.b(getConditionFP(IrCondition::NotLessEqual), labelOp(inst.e));
+        jumpOrFallthrough(blockOp(inst.d), next);
+        break;
+    }
     // IrCmd::JUMP_SLOT_MATCH implemented below
     case IrCmd::TABLE_LEN:
     {
diff --git a/CodeGen/src/IrLoweringX64.cpp b/CodeGen/src/IrLoweringX64.cpp
index 393475721..b9ff4f1fa 100644
--- a/CodeGen/src/IrLoweringX64.cpp
+++ b/CodeGen/src/IrLoweringX64.cpp
@@ -699,6 +699,36 @@ void IrLoweringX64::lowerInst(IrInst& inst, uint32_t index, const IrBlock& next)
         jumpOrFallthrough(blockOp(inst.e), next);
         break;
     }
+    case IrCmd::JUMP_FORN_LOOP_COND:
+    {
+        ScopedRegX64 tmp1{regs, SizeX64::xmmword};
+        ScopedRegX64 tmp2{regs, SizeX64::xmmword};
+        ScopedRegX64 tmp3{regs, SizeX64::xmmword};
+
+        RegisterX64 index = inst.a.kind == IrOpKind::Inst ? regOp(inst.a) : tmp1.reg;
+        RegisterX64 limit = inst.b.kind == IrOpKind::Inst ? regOp(inst.b) : tmp2.reg;
+
+        if (inst.a.kind != IrOpKind::Inst)
+            build.vmovsd(tmp1.reg, memRegDoubleOp(inst.a));
+
+        if (inst.b.kind != IrOpKind::Inst)
+            build.vmovsd(tmp2.reg, memRegDoubleOp(inst.b));
+
+        Label direct;
+
+        // step > 0
+        jumpOnNumberCmp(build, tmp3.reg, memRegDoubleOp(inst.c), build.f64(0.0), IrCondition::Greater, direct);
+
+        // !(limit <= index)
+        jumpOnNumberCmp(build, noreg, limit, index, IrCondition::NotLessEqual, labelOp(inst.e));
+        build.jmp(labelOp(inst.d));
+
+        // !(index <= limit)
+        build.setLabel(direct);
+        jumpOnNumberCmp(build, noreg, index, limit, IrCondition::NotLessEqual, labelOp(inst.e));
+        jumpOrFallthrough(blockOp(inst.d), next);
+        break;
+    }
     case IrCmd::TABLE_LEN:
     {
         IrCallWrapperX64 callWrap(regs, build, index);
diff --git a/CodeGen/src/IrTranslation.cpp b/CodeGen/src/IrTranslation.cpp
index d0c2ad54c..8d9ebc8ab 100644
--- a/CodeGen/src/IrTranslation.cpp
+++ b/CodeGen/src/IrTranslation.cpp
@@ -15,6 +15,7 @@
 LUAU_FASTFLAGVARIABLE(LuauImproveForN2, false)
 LUAU_FASTFLAG(LuauReduceStackSpills)
 LUAU_FASTFLAGVARIABLE(LuauInlineArrConstOffset, false)
+LUAU_FASTFLAGVARIABLE(LuauLowerAltLoopForn, false)
 
 namespace Luau
 {
@@ -680,26 +681,35 @@ void translateInstForNPrep(IrBuilder& build, const Instruction* pc, int pcpos)
             IrOp tagStep = build.inst(IrCmd::LOAD_TAG, build.vmReg(ra + 1));
             build.inst(IrCmd::CHECK_TAG, tagStep, build.constTag(LUA_TNUMBER), build.vmExit(pcpos));
 
-            IrOp direct = build.block(IrBlockKind::Internal);
-            IrOp reverse = build.block(IrBlockKind::Internal);
+            if (FFlag::LuauLowerAltLoopForn)
+            {
+                IrOp step = build.inst(IrCmd::LOAD_DOUBLE, build.vmReg(ra + 1));
 
-            IrOp zero = build.constDouble(0.0);
-            IrOp step = build.inst(IrCmd::LOAD_DOUBLE, build.vmReg(ra + 1));
+                build.inst(IrCmd::JUMP_FORN_LOOP_COND, idx, limit, step, loopStart, loopExit);
+            }
+            else
+            {
+                IrOp direct = build.block(IrBlockKind::Internal);
+                IrOp reverse = build.block(IrBlockKind::Internal);
 
-            // step > 0
-            // note: equivalent to 0 < step, but lowers into one instruction on both X64 and A64
-            build.inst(IrCmd::JUMP_CMP_NUM, step, zero, build.cond(IrCondition::Greater), direct, reverse);
+                IrOp zero = build.constDouble(0.0);
+                IrOp step = build.inst(IrCmd::LOAD_DOUBLE, build.vmReg(ra + 1));
 
-            // Condition to start the loop: step > 0 ? idx <= limit : limit <= idx
-            // We invert the condition so that loopStart is the fallthrough (false) label
+                // step > 0
+                // note: equivalent to 0 < step, but lowers into one instruction on both X64 and A64
+                build.inst(IrCmd::JUMP_CMP_NUM, step, zero, build.cond(IrCondition::Greater), direct, reverse);
 
-            // step > 0 is false, check limit <= idx
-            build.beginBlock(reverse);
-            build.inst(IrCmd::JUMP_CMP_NUM, limit, idx, build.cond(IrCondition::NotLessEqual), loopExit, loopStart);
+                // Condition to start the loop: step > 0 ? idx <= limit : limit <= idx
+                // We invert the condition so that loopStart is the fallthrough (false) label
 
-            // step > 0 is true, check idx <= limit
-            build.beginBlock(direct);
-            build.inst(IrCmd::JUMP_CMP_NUM, idx, limit, build.cond(IrCondition::NotLessEqual), loopExit, loopStart);
+                // step > 0 is false, check limit <= idx
+                build.beginBlock(reverse);
+                build.inst(IrCmd::JUMP_CMP_NUM, limit, idx, build.cond(IrCondition::NotLessEqual), loopExit, loopStart);
+
+                // step > 0 is true, check idx <= limit
+                build.beginBlock(direct);
+                build.inst(IrCmd::JUMP_CMP_NUM, idx, limit, build.cond(IrCondition::NotLessEqual), loopExit, loopStart);
+            }
         }
         else
         {
@@ -713,6 +723,24 @@ void translateInstForNPrep(IrBuilder& build, const Instruction* pc, int pcpos)
                 build.inst(IrCmd::JUMP_CMP_NUM, limit, idx, build.cond(IrCondition::NotLessEqual), loopExit, loopStart);
         }
     }
+    else if (FFlag::LuauLowerAltLoopForn)
+    {
+        // When loop parameters are not numbers, VM tries to perform type coercion from string and raises an exception if that fails
+        // Performing that fallback in native code increases code size and complicates CFG, obscuring the values when they are constant
+        // To avoid that overhead for an extreemely rare case (that doesn't even typecheck), we exit to VM to handle it
+        IrOp tagLimit = build.inst(IrCmd::LOAD_TAG, build.vmReg(ra + 0));
+        build.inst(IrCmd::CHECK_TAG, tagLimit, build.constTag(LUA_TNUMBER), build.vmExit(pcpos));
+        IrOp tagStep = build.inst(IrCmd::LOAD_TAG, build.vmReg(ra + 1));
+        build.inst(IrCmd::CHECK_TAG, tagStep, build.constTag(LUA_TNUMBER), build.vmExit(pcpos));
+        IrOp tagIdx = build.inst(IrCmd::LOAD_TAG, build.vmReg(ra + 2));
+        build.inst(IrCmd::CHECK_TAG, tagIdx, build.constTag(LUA_TNUMBER), build.vmExit(pcpos));
+
+        IrOp limit = build.inst(IrCmd::LOAD_DOUBLE, build.vmReg(ra + 0));
+        IrOp step = build.inst(IrCmd::LOAD_DOUBLE, build.vmReg(ra + 1));
+        IrOp idx = build.inst(IrCmd::LOAD_DOUBLE, build.vmReg(ra + 2));
+
+        build.inst(IrCmd::JUMP_FORN_LOOP_COND, idx, limit, step, loopStart, loopExit);
+    }
     else
     {
         IrOp direct = build.block(IrBlockKind::Internal);
@@ -770,7 +798,6 @@ void translateInstForNLoop(IrBuilder& build, const Instruction* pc, int pcpos)
         LUAU_ASSERT(!build.loopStepStack.empty());
         IrOp stepK = build.loopStepStack.back();
 
-        IrOp zero = build.constDouble(0.0);
         IrOp limit = build.inst(IrCmd::LOAD_DOUBLE, build.vmReg(ra + 0));
         IrOp step = stepK.kind == IrOpKind::Undef ? build.inst(IrCmd::LOAD_DOUBLE, build.vmReg(ra + 1)) : stepK;
 
@@ -780,22 +807,31 @@ void translateInstForNLoop(IrBuilder& build, const Instruction* pc, int pcpos)
 
         if (stepK.kind == IrOpKind::Undef)
         {
-            IrOp direct = build.block(IrBlockKind::Internal);
-            IrOp reverse = build.block(IrBlockKind::Internal);
+            if (FFlag::LuauLowerAltLoopForn)
+            {
+                build.inst(IrCmd::JUMP_FORN_LOOP_COND, idx, limit, step, loopRepeat, loopExit);
+            }
+            else
+            {
+                IrOp direct = build.block(IrBlockKind::Internal);
+                IrOp reverse = build.block(IrBlockKind::Internal);
 
-            // step > 0
-            // note: equivalent to 0 < step, but lowers into one instruction on both X64 and A64
-            build.inst(IrCmd::JUMP_CMP_NUM, step, zero, build.cond(IrCondition::Greater), direct, reverse);
+                IrOp zero = build.constDouble(0.0);
 
-            // Condition to continue the loop: step > 0 ? idx <= limit : limit <= idx
+                // step > 0
+                // note: equivalent to 0 < step, but lowers into one instruction on both X64 and A64
+                build.inst(IrCmd::JUMP_CMP_NUM, step, zero, build.cond(IrCondition::Greater), direct, reverse);
+
+                // Condition to continue the loop: step > 0 ? idx <= limit : limit <= idx
 
-            // step > 0 is false, check limit <= idx
-            build.beginBlock(reverse);
-            build.inst(IrCmd::JUMP_CMP_NUM, limit, idx, build.cond(IrCondition::LessEqual), loopRepeat, loopExit);
+                // step > 0 is false, check limit <= idx
+                build.beginBlock(reverse);
+                build.inst(IrCmd::JUMP_CMP_NUM, limit, idx, build.cond(IrCondition::LessEqual), loopRepeat, loopExit);
 
-            // step > 0 is true, check idx <= limit
-            build.beginBlock(direct);
-            build.inst(IrCmd::JUMP_CMP_NUM, idx, limit, build.cond(IrCondition::LessEqual), loopRepeat, loopExit);
+                // step > 0 is true, check idx <= limit
+                build.beginBlock(direct);
+                build.inst(IrCmd::JUMP_CMP_NUM, idx, limit, build.cond(IrCondition::LessEqual), loopRepeat, loopExit);
+            }
         }
         else
         {
@@ -808,6 +844,19 @@ void translateInstForNLoop(IrBuilder& build, const Instruction* pc, int pcpos)
                 build.inst(IrCmd::JUMP_CMP_NUM, limit, idx, build.cond(IrCondition::LessEqual), loopRepeat, loopExit);
         }
     }
+    else if (FFlag::LuauLowerAltLoopForn)
+    {
+        build.inst(IrCmd::INTERRUPT, build.constUint(pcpos));
+
+        IrOp limit = build.inst(IrCmd::LOAD_DOUBLE, build.vmReg(ra + 0));
+        IrOp step = build.inst(IrCmd::LOAD_DOUBLE, build.vmReg(ra + 1));
+
+        IrOp idx = build.inst(IrCmd::LOAD_DOUBLE, build.vmReg(ra + 2));
+        idx = build.inst(IrCmd::ADD_NUM, idx, step);
+        build.inst(IrCmd::STORE_DOUBLE, build.vmReg(ra + 2), idx);
+
+        build.inst(IrCmd::JUMP_FORN_LOOP_COND, idx, limit, step, loopRepeat, loopExit);
+    }
     else
     {
         build.inst(IrCmd::INTERRUPT, build.constUint(pcpos));
diff --git a/CodeGen/src/IrUtils.cpp b/CodeGen/src/IrUtils.cpp
index 7041c6a67..ba46dbc98 100644
--- a/CodeGen/src/IrUtils.cpp
+++ b/CodeGen/src/IrUtils.cpp
@@ -75,6 +75,7 @@ IrValueKind getCmdValueKind(IrCmd cmd)
     case IrCmd::JUMP_CMP_INT:
     case IrCmd::JUMP_EQ_POINTER:
     case IrCmd::JUMP_CMP_NUM:
+    case IrCmd::JUMP_FORN_LOOP_COND:
     case IrCmd::JUMP_SLOT_MATCH:
         return IrValueKind::None;
     case IrCmd::TABLE_LEN:
diff --git a/CodeGen/src/OptimizeConstProp.cpp b/CodeGen/src/OptimizeConstProp.cpp
index 9e55eb360..c9b2dae6d 100644
--- a/CodeGen/src/OptimizeConstProp.cpp
+++ b/CodeGen/src/OptimizeConstProp.cpp
@@ -19,6 +19,7 @@ LUAU_FASTFLAGVARIABLE(LuauReuseHashSlots2, false)
 LUAU_FASTFLAGVARIABLE(LuauKeepVmapLinear, false)
 LUAU_FASTFLAGVARIABLE(LuauMergeTagLoads, false)
 LUAU_FASTFLAGVARIABLE(LuauReuseArrSlots, false)
+LUAU_FASTFLAG(LuauLowerAltLoopForn)
 
 namespace Luau
 {
@@ -782,6 +783,46 @@ static void constPropInInst(ConstPropState& state, IrBuilder& build, IrFunction&
         }
         break;
     }
+    case IrCmd::JUMP_FORN_LOOP_COND:
+    {
+        std::optional<double> step = function.asDoubleOp(inst.c.kind == IrOpKind::Constant ? inst.c : state.tryGetValue(inst.c));
+
+        if (!step)
+            break;
+
+        std::optional<double> idx = function.asDoubleOp(inst.a.kind == IrOpKind::Constant ? inst.a : state.tryGetValue(inst.a));
+        std::optional<double> limit = function.asDoubleOp(inst.b.kind == IrOpKind::Constant ? inst.b : state.tryGetValue(inst.b));
+
+        if (*step > 0)
+        {
+            if (idx && limit)
+            {
+                if (compare(*idx, *limit, IrCondition::NotLessEqual))
+                    replace(function, block, index, {IrCmd::JUMP, inst.e});
+                else
+                    replace(function, block, index, {IrCmd::JUMP, inst.d});
+            }
+            else
+            {
+                replace(function, block, index, IrInst{IrCmd::JUMP_CMP_NUM, inst.a, inst.b, build.cond(IrCondition::NotLessEqual), inst.e, inst.d});
+            }
+        }
+        else
+        {
+            if (idx && limit)
+            {
+                if (compare(*limit, *idx, IrCondition::NotLessEqual))
+                    replace(function, block, index, {IrCmd::JUMP, inst.e});
+                else
+                    replace(function, block, index, {IrCmd::JUMP, inst.d});
+            }
+            else
+            {
+                replace(function, block, index, IrInst{IrCmd::JUMP_CMP_NUM, inst.b, inst.a, build.cond(IrCondition::NotLessEqual), inst.e, inst.d});
+            }
+        }
+        break;
+    }
     case IrCmd::GET_UPVALUE:
         state.invalidate(inst.a);
         break;
@@ -1282,6 +1323,9 @@ static void constPropInBlockChain(IrBuilder& build, std::vector<uint8_t>& visite
 
             if (target.useCount == 1 && !visited[targetIdx] && target.kind != IrBlockKind::Fallback)
             {
+                if (FFlag::LuauLowerAltLoopForn && getLiveOutValueCount(function, target) != 0)
+                    break;
+
                 // Make sure block ordering guarantee is checked at lowering time
                 block->expectedNextBlock = function.getBlockIndex(target);
 
diff --git a/Compiler/src/Compiler.cpp b/Compiler/src/Compiler.cpp
index abf61a497..411a99209 100644
--- a/Compiler/src/Compiler.cpp
+++ b/Compiler/src/Compiler.cpp
@@ -33,6 +33,7 @@ LUAU_FASTFLAG(LuauFloorDivision)
 LUAU_FASTFLAGVARIABLE(LuauCompileFixContinueValidation2, false)
 
 LUAU_FASTFLAGVARIABLE(LuauCompileContinueCloseUpvals, false)
+LUAU_FASTFLAGVARIABLE(LuauCompileIfElseAndOr, false)
 
 namespace Luau
 {
@@ -1569,6 +1570,23 @@ struct Compiler
         }
     }
 
+    void compileExprIfElseAndOr(bool and_, uint8_t creg, AstExpr* other, uint8_t target)
+    {
+        int32_t cid = getConstantIndex(other);
+
+        if (cid >= 0 && cid <= 255)
+        {
+            bytecode.emitABC(and_ ? LOP_ANDK : LOP_ORK, target, creg, uint8_t(cid));
+        }
+        else
+        {
+            RegScope rs(this);
+            uint8_t oreg = compileExprAuto(other, rs);
+
+            bytecode.emitABC(and_ ? LOP_AND : LOP_OR, target, creg, oreg);
+        }
+    }
+
     void compileExprIfElse(AstExprIfElse* expr, uint8_t target, bool targetTemp)
     {
         if (isConstant(expr->condition))
@@ -1584,6 +1602,20 @@ struct Compiler
         }
         else
         {
+            if (FFlag::LuauCompileIfElseAndOr)
+            {
+                // Optimization: convert some if..then..else expressions into and/or when the other side has no side effects and is very cheap to compute
+                // if v then v else e => v or e
+                // if v then e else v => v and e
+                if (int creg = getExprLocalReg(expr->condition); creg >= 0)
+                {
+                    if (creg == getExprLocalReg(expr->trueExpr) && (getExprLocalReg(expr->falseExpr) >= 0 || isConstant(expr->falseExpr)))
+                        return compileExprIfElseAndOr(/* and_= */ false, uint8_t(creg), expr->falseExpr, target);
+                    else if (creg == getExprLocalReg(expr->falseExpr) && (getExprLocalReg(expr->trueExpr) >= 0 || isConstant(expr->trueExpr)))
+                        return compileExprIfElseAndOr(/* and_= */ true, uint8_t(creg), expr->trueExpr, target);
+                }
+            }
+
             std::vector<size_t> elseJump;
             compileConditionValue(expr->condition, nullptr, elseJump, false);
             compileExpr(expr->trueExpr, target, targetTemp);
diff --git a/Sources.cmake b/Sources.cmake
index e4f0ef323..267e5826a 100644
--- a/Sources.cmake
+++ b/Sources.cmake
@@ -152,7 +152,6 @@ target_sources(Luau.Analysis PRIVATE
     Analysis/include/Luau/AstJsonEncoder.h
     Analysis/include/Luau/AstQuery.h
     Analysis/include/Luau/Autocomplete.h
-    Analysis/include/Luau/Breadcrumb.h
     Analysis/include/Luau/BuiltinDefinitions.h
     Analysis/include/Luau/Cancellation.h
     Analysis/include/Luau/Clone.h
@@ -196,15 +195,18 @@ target_sources(Luau.Analysis PRIVATE
     Analysis/include/Luau/Transpiler.h
     Analysis/include/Luau/TxnLog.h
     Analysis/include/Luau/Type.h
-    Analysis/include/Luau/TypePairHash.h
     Analysis/include/Luau/TypeArena.h
     Analysis/include/Luau/TypeAttach.h
     Analysis/include/Luau/TypeChecker2.h
     Analysis/include/Luau/TypeCheckLimits.h
     Analysis/include/Luau/TypedAllocator.h
     Analysis/include/Luau/TypeFamily.h
+    Analysis/include/Luau/TypeFwd.h
     Analysis/include/Luau/TypeInfer.h
+    Analysis/include/Luau/TypeOrPack.h
     Analysis/include/Luau/TypePack.h
+    Analysis/include/Luau/TypePairHash.h
+    Analysis/include/Luau/TypePath.h
     Analysis/include/Luau/TypeUtils.h
     Analysis/include/Luau/Unifiable.h
     Analysis/include/Luau/Unifier.h
@@ -259,7 +261,9 @@ target_sources(Luau.Analysis PRIVATE
     Analysis/src/TypedAllocator.cpp
     Analysis/src/TypeFamily.cpp
     Analysis/src/TypeInfer.cpp
+    Analysis/src/TypeOrPack.cpp
     Analysis/src/TypePack.cpp
+    Analysis/src/TypePath.cpp
     Analysis/src/TypeUtils.cpp
     Analysis/src/Unifiable.cpp
     Analysis/src/Unifier.cpp
@@ -276,6 +280,7 @@ target_sources(Luau.VM PRIVATE
     VM/src/laux.cpp
     VM/src/lbaselib.cpp
     VM/src/lbitlib.cpp
+    VM/src/lbuffer.cpp
     VM/src/lbuiltins.cpp
     VM/src/lcorolib.cpp
     VM/src/ldblib.cpp
@@ -304,6 +309,7 @@ target_sources(Luau.VM PRIVATE
     VM/src/lvmutils.cpp
 
     VM/src/lapi.h
+    VM/src/lbuffer.h
     VM/src/lbuiltins.h
     VM/src/lbytecode.h
     VM/src/lcommon.h
@@ -371,8 +377,6 @@ if(TARGET Luau.UnitTest)
         tests/AstQueryDsl.cpp
         tests/AstQueryDsl.h
         tests/AstVisitor.test.cpp
-        tests/RegisterCallbacks.h
-        tests/RegisterCallbacks.cpp
         tests/Autocomplete.test.cpp
         tests/BuiltinDefinitions.test.cpp
         tests/ClassFixture.cpp
@@ -386,11 +390,14 @@ if(TARGET Luau.UnitTest)
         tests/CostModel.test.cpp
         tests/DataFlowGraph.test.cpp
         tests/DenseHash.test.cpp
+        tests/DiffAsserts.cpp
+        tests/DiffAsserts.h
         tests/Differ.test.cpp
         tests/Error.test.cpp
         tests/Fixture.cpp
         tests/Fixture.h
         tests/Frontend.test.cpp
+        tests/InsertionOrderedMap.test.cpp
         tests/IostreamOptional.h
         tests/IrBuilder.test.cpp
         tests/IrCallWrapperX64.test.cpp
@@ -405,6 +412,8 @@ if(TARGET Luau.UnitTest)
         tests/Normalize.test.cpp
         tests/NotNull.test.cpp
         tests/Parser.test.cpp
+        tests/RegisterCallbacks.cpp
+        tests/RegisterCallbacks.h
         tests/RequireTracer.test.cpp
         tests/RuntimeLimits.test.cpp
         tests/ScopedFlags.h
@@ -446,11 +455,11 @@ if(TARGET Luau.UnitTest)
         tests/TypeInfer.unionTypes.test.cpp
         tests/TypeInfer.unknownnever.test.cpp
         tests/TypePack.test.cpp
+        tests/TypePath.test.cpp
         tests/TypeVar.test.cpp
         tests/Unifier2.test.cpp
         tests/Variant.test.cpp
         tests/VisitType.test.cpp
-        tests/InsertionOrderedMap.test.cpp
         tests/main.cpp)
 endif()
 
diff --git a/VM/include/lua.h b/VM/include/lua.h
index 1e8c30ba9..dbf19cb4c 100644
--- a/VM/include/lua.h
+++ b/VM/include/lua.h
@@ -85,6 +85,7 @@ enum lua_Type
     LUA_TFUNCTION,
     LUA_TUSERDATA,
     LUA_TTHREAD,
+    LUA_TBUFFER,
 
     // values below this line are used in GCObject tags but may never show up in TValue type tags
     LUA_TPROTO,
@@ -162,6 +163,7 @@ LUA_API void* lua_touserdata(lua_State* L, int idx);
 LUA_API void* lua_touserdatatagged(lua_State* L, int idx, int tag);
 LUA_API int lua_userdatatag(lua_State* L, int idx);
 LUA_API lua_State* lua_tothread(lua_State* L, int idx);
+LUA_API void* lua_tobuffer(lua_State* L, int idx, size_t* len);
 LUA_API const void* lua_topointer(lua_State* L, int idx);
 
 /*
@@ -188,6 +190,8 @@ LUA_API void lua_pushlightuserdata(lua_State* L, void* p);
 LUA_API void* lua_newuserdatatagged(lua_State* L, size_t sz, int tag);
 LUA_API void* lua_newuserdatadtor(lua_State* L, size_t sz, void (*dtor)(void*));
 
+LUA_API void* lua_newbuffer(lua_State* L, size_t sz);
+
 /*
 ** get functions (Lua -> stack)
 */
@@ -359,6 +363,7 @@ LUA_API void lua_unref(lua_State* L, int ref);
 #define lua_isboolean(L, n) (lua_type(L, (n)) == LUA_TBOOLEAN)
 #define lua_isvector(L, n) (lua_type(L, (n)) == LUA_TVECTOR)
 #define lua_isthread(L, n) (lua_type(L, (n)) == LUA_TTHREAD)
+#define lua_isbuffer(L, n) (lua_type(L, (n)) == LUA_TBUFFER)
 #define lua_isnone(L, n) (lua_type(L, (n)) == LUA_TNONE)
 #define lua_isnoneornil(L, n) (lua_type(L, (n)) <= LUA_TNIL)
 
diff --git a/VM/include/lualib.h b/VM/include/lualib.h
index 327bfefdf..dc8a01c75 100644
--- a/VM/include/lualib.h
+++ b/VM/include/lualib.h
@@ -43,6 +43,8 @@ LUALIB_API void luaL_checkany(lua_State* L, int narg);
 LUALIB_API int luaL_newmetatable(lua_State* L, const char* tname);
 LUALIB_API void* luaL_checkudata(lua_State* L, int ud, const char* tname);
 
+LUALIB_API void* luaL_checkbuffer(lua_State* L, int narg, size_t* len);
+
 LUALIB_API void luaL_where(lua_State* L, int lvl);
 LUALIB_API LUA_PRINTF_ATTR(2, 3) l_noret luaL_errorL(lua_State* L, const char* fmt, ...);
 
@@ -74,7 +76,7 @@ LUALIB_API const char* luaL_typename(lua_State* L, int idx);
 
 // generic buffer manipulation
 
-struct luaL_Buffer
+struct luaL_Strbuf
 {
     char* p;   // current position in buffer
     char* end; // end of the current buffer
@@ -82,26 +84,27 @@ struct luaL_Buffer
     struct TString* storage;
     char buffer[LUA_BUFFERSIZE];
 };
-typedef struct luaL_Buffer luaL_Buffer;
+typedef struct luaL_Strbuf luaL_Strbuf;
+
+// compatibility typedef: this type is called luaL_Buffer in Lua headers
+// renamed to luaL_Strbuf to reduce confusion with internal VM buffer type
+typedef struct luaL_Strbuf luaL_Buffer;
 
 // when internal buffer storage is exhausted, a mutable string value 'storage' will be placed on the stack
 // in general, functions expect the mutable string buffer to be placed on top of the stack (top-1)
 // with the exception of luaL_addvalue that expects the value at the top and string buffer further away (top-2)
-// functions that accept a 'boxloc' support string buffer placement at any location in the stack
-// all the buffer users we have in Luau match this pattern, but it's something to keep in mind for new uses of buffers
-
-#define luaL_addchar(B, c) ((void)((B)->p < (B)->end || luaL_extendbuffer(B, 1, -1)), (*(B)->p++ = (char)(c)))
-#define luaL_addstring(B, s) luaL_addlstring(B, s, strlen(s), -1)
-
-LUALIB_API void luaL_buffinit(lua_State* L, luaL_Buffer* B);
-LUALIB_API char* luaL_buffinitsize(lua_State* L, luaL_Buffer* B, size_t size);
-LUALIB_API char* luaL_extendbuffer(luaL_Buffer* B, size_t additionalsize, int boxloc);
-LUALIB_API void luaL_reservebuffer(luaL_Buffer* B, size_t size, int boxloc);
-LUALIB_API void luaL_addlstring(luaL_Buffer* B, const char* s, size_t l, int boxloc);
-LUALIB_API void luaL_addvalue(luaL_Buffer* B);
-LUALIB_API void luaL_addvalueany(luaL_Buffer* B, int idx);
-LUALIB_API void luaL_pushresult(luaL_Buffer* B);
-LUALIB_API void luaL_pushresultsize(luaL_Buffer* B, size_t size);
+
+#define luaL_addchar(B, c) ((void)((B)->p < (B)->end || luaL_prepbuffsize(B, 1)), (*(B)->p++ = (char)(c)))
+#define luaL_addstring(B, s) luaL_addlstring(B, s, strlen(s))
+
+LUALIB_API void luaL_buffinit(lua_State* L, luaL_Strbuf* B);
+LUALIB_API char* luaL_buffinitsize(lua_State* L, luaL_Strbuf* B, size_t size);
+LUALIB_API char* luaL_prepbuffsize(luaL_Buffer* B, size_t size);
+LUALIB_API void luaL_addlstring(luaL_Strbuf* B, const char* s, size_t l);
+LUALIB_API void luaL_addvalue(luaL_Strbuf* B);
+LUALIB_API void luaL_addvalueany(luaL_Strbuf* B, int idx);
+LUALIB_API void luaL_pushresult(luaL_Strbuf* B);
+LUALIB_API void luaL_pushresultsize(luaL_Strbuf* B, size_t size);
 
 // builtin libraries
 LUALIB_API int luaopen_base(lua_State* L);
diff --git a/VM/src/lapi.cpp b/VM/src/lapi.cpp
index 2d7145668..355e4e21c 100644
--- a/VM/src/lapi.cpp
+++ b/VM/src/lapi.cpp
@@ -11,6 +11,7 @@
 #include "ludata.h"
 #include "lvm.h"
 #include "lnumutils.h"
+#include "lbuffer.h"
 
 #include <string.h>
 
@@ -483,6 +484,8 @@ int lua_objlen(lua_State* L, int idx)
         return tsvalue(o)->len;
     case LUA_TUSERDATA:
         return uvalue(o)->len;
+    case LUA_TBUFFER:
+        return bufvalue(o)->len;
     case LUA_TTABLE:
         return luaH_getn(hvalue(o));
     default:
@@ -533,25 +536,32 @@ lua_State* lua_tothread(lua_State* L, int idx)
     return (!ttisthread(o)) ? NULL : thvalue(o);
 }
 
+void* lua_tobuffer(lua_State* L, int idx, size_t* len)
+{
+    StkId o = index2addr(L, idx);
+
+    if (!ttisbuffer(o))
+        return NULL;
+
+    Buffer* b = bufvalue(o);
+
+    if (len)
+        *len = b->len;
+
+    return b->data;
+}
+
 const void* lua_topointer(lua_State* L, int idx)
 {
     StkId o = index2addr(L, idx);
     switch (ttype(o))
     {
-    case LUA_TSTRING:
-        return tsvalue(o);
-    case LUA_TTABLE:
-        return hvalue(o);
-    case LUA_TFUNCTION:
-        return clvalue(o);
-    case LUA_TTHREAD:
-        return thvalue(o);
     case LUA_TUSERDATA:
         return uvalue(o)->data;
     case LUA_TLIGHTUSERDATA:
         return pvalue(o);
     default:
-        return NULL;
+        return iscollectable(o) ? gcvalue(o) : NULL;
     }
 }
 
@@ -1271,6 +1281,16 @@ void* lua_newuserdatadtor(lua_State* L, size_t sz, void (*dtor)(void*))
     return u->data;
 }
 
+void* lua_newbuffer(lua_State* L, size_t sz)
+{
+    luaC_checkGC(L);
+    luaC_threadbarrier(L);
+    Buffer* b = luaB_newbuffer(L, sz);
+    setbufvalue(L, L->top, b);
+    api_incr_top(L);
+    return b->data;
+}
+
 static const char* aux_upvalue(StkId fi, int n, TValue** val)
 {
     Closure* f;
diff --git a/VM/src/laux.cpp b/VM/src/laux.cpp
index 63da1810a..4262eb497 100644
--- a/VM/src/laux.cpp
+++ b/VM/src/laux.cpp
@@ -132,6 +132,14 @@ void* luaL_checkudata(lua_State* L, int ud, const char* tname)
     luaL_typeerrorL(L, ud, tname); // else error
 }
 
+void* luaL_checkbuffer(lua_State* L, int narg, size_t* len)
+{
+    void* b = lua_tobuffer(L, narg, len);
+    if (!b)
+        tag_error(L, narg, LUA_TBUFFER);
+    return b;
+}
+
 void luaL_checkstack(lua_State* L, int space, const char* mes)
 {
     if (!lua_checkstack(L, space))
@@ -360,24 +368,7 @@ static size_t getnextbuffersize(lua_State* L, size_t currentsize, size_t desired
     return newsize;
 }
 
-void luaL_buffinit(lua_State* L, luaL_Buffer* B)
-{
-    // start with an internal buffer
-    B->p = B->buffer;
-    B->end = B->p + LUA_BUFFERSIZE;
-
-    B->L = L;
-    B->storage = nullptr;
-}
-
-char* luaL_buffinitsize(lua_State* L, luaL_Buffer* B, size_t size)
-{
-    luaL_buffinit(L, B);
-    luaL_reservebuffer(B, size, -1);
-    return B->p;
-}
-
-char* luaL_extendbuffer(luaL_Buffer* B, size_t additionalsize, int boxloc)
+static char* extendstrbuf(luaL_Strbuf* B, size_t additionalsize, int boxloc)
 {
     lua_State* L = B->L;
 
@@ -408,22 +399,39 @@ char* luaL_extendbuffer(luaL_Buffer* B, size_t additionalsize, int boxloc)
     return B->p;
 }
 
-void luaL_reservebuffer(luaL_Buffer* B, size_t size, int boxloc)
+void luaL_buffinit(lua_State* L, luaL_Strbuf* B)
+{
+    // start with an internal buffer
+    B->p = B->buffer;
+    B->end = B->p + LUA_BUFFERSIZE;
+
+    B->L = L;
+    B->storage = nullptr;
+}
+
+char* luaL_buffinitsize(lua_State* L, luaL_Strbuf* B, size_t size)
+{
+    luaL_buffinit(L, B);
+    return luaL_prepbuffsize(B, size);
+}
+
+char* luaL_prepbuffsize(luaL_Strbuf* B, size_t size)
 {
     if (size_t(B->end - B->p) < size)
-        luaL_extendbuffer(B, size - (B->end - B->p), boxloc);
+        return extendstrbuf(B, size - (B->end - B->p), -1);
+    return B->p;
 }
 
-void luaL_addlstring(luaL_Buffer* B, const char* s, size_t len, int boxloc)
+void luaL_addlstring(luaL_Strbuf* B, const char* s, size_t len)
 {
     if (size_t(B->end - B->p) < len)
-        luaL_extendbuffer(B, len - (B->end - B->p), boxloc);
+        extendstrbuf(B, len - (B->end - B->p), -1);
 
     memcpy(B->p, s, len);
     B->p += len;
 }
 
-void luaL_addvalue(luaL_Buffer* B)
+void luaL_addvalue(luaL_Strbuf* B)
 {
     lua_State* L = B->L;
 
@@ -431,7 +439,7 @@ void luaL_addvalue(luaL_Buffer* B)
     if (const char* s = lua_tolstring(L, -1, &vl))
     {
         if (size_t(B->end - B->p) < vl)
-            luaL_extendbuffer(B, vl - (B->end - B->p), -2);
+            extendstrbuf(B, vl - (B->end - B->p), -2);
 
         memcpy(B->p, s, vl);
         B->p += vl;
@@ -440,7 +448,7 @@ void luaL_addvalue(luaL_Buffer* B)
     }
 }
 
-void luaL_addvalueany(luaL_Buffer* B, int idx)
+void luaL_addvalueany(luaL_Strbuf* B, int idx)
 {
     lua_State* L = B->L;
 
@@ -465,28 +473,29 @@ void luaL_addvalueany(luaL_Buffer* B, int idx)
         double n = lua_tonumber(L, idx);
         char s[LUAI_MAXNUM2STR];
         char* e = luai_num2str(s, n);
-        luaL_addlstring(B, s, e - s, -1);
+        luaL_addlstring(B, s, e - s);
         break;
     }
     case LUA_TSTRING:
     {
         size_t len;
         const char* s = lua_tolstring(L, idx, &len);
-        luaL_addlstring(B, s, len, -1);
+        luaL_addlstring(B, s, len);
         break;
     }
     default:
     {
         size_t len;
-        const char* s = luaL_tolstring(L, idx, &len);
+        luaL_tolstring(L, idx, &len);
 
-        luaL_addlstring(B, s, len, -2);
-        lua_pop(L, 1);
+        // note: luaL_addlstring assumes box is stored at top of stack, so we can't call it here
+        // instead we use luaL_addvalue which will take the string from the top of the stack and add that
+        luaL_addvalue(B);
     }
     }
 }
 
-void luaL_pushresult(luaL_Buffer* B)
+void luaL_pushresult(luaL_Strbuf* B)
 {
     lua_State* L = B->L;
 
@@ -510,7 +519,7 @@ void luaL_pushresult(luaL_Buffer* B)
     }
 }
 
-void luaL_pushresultsize(luaL_Buffer* B, size_t size)
+void luaL_pushresultsize(luaL_Strbuf* B, size_t size)
 {
     B->p += size;
     luaL_pushresult(B);
diff --git a/VM/src/lbuffer.cpp b/VM/src/lbuffer.cpp
new file mode 100644
index 000000000..04e5eecc2
--- /dev/null
+++ b/VM/src/lbuffer.cpp
@@ -0,0 +1,24 @@
+// This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
+#include "lbuffer.h"
+
+#include "lgc.h"
+#include "lmem.h"
+
+#include <string.h>
+
+Buffer* luaB_newbuffer(lua_State* L, size_t s)
+{
+    if (s > MAX_BUFFER_SIZE)
+        luaM_toobig(L);
+
+    Buffer* b = luaM_newgco(L, Buffer, sizebuffer(s), L->activememcat);
+    luaC_init(L, b, LUA_TBUFFER);
+    b->len = unsigned(s);
+    memset(b->data, 0, b->len);
+    return b;
+}
+
+void luaB_freebuffer(lua_State* L, Buffer* b, lua_Page* page)
+{
+    luaM_freegco(L, b, sizebuffer(b->len), b->memcat, page);
+}
diff --git a/VM/src/lbuffer.h b/VM/src/lbuffer.h
new file mode 100644
index 000000000..728e89bac
--- /dev/null
+++ b/VM/src/lbuffer.h
@@ -0,0 +1,13 @@
+// This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
+#pragma once
+
+#include "lobject.h"
+
+// buffer size limit
+#define MAX_BUFFER_SIZE (1 << 30)
+
+// GCObject size has to be at least 16 bytes, so a minimum of 8 bytes is always reserved
+#define sizebuffer(len) (offsetof(Buffer, data) + ((len) < 8 ? 8 : (len)))
+
+LUAI_FUNC Buffer* luaB_newbuffer(lua_State* L, size_t s);
+LUAI_FUNC void luaB_freebuffer(lua_State* L, Buffer* u, struct lua_Page* page);
diff --git a/VM/src/ldblib.cpp b/VM/src/ldblib.cpp
index 97ddfa2ce..cf564e98e 100644
--- a/VM/src/ldblib.cpp
+++ b/VM/src/ldblib.cpp
@@ -110,7 +110,7 @@ static int db_traceback(lua_State* L)
     int level = luaL_optinteger(L, arg + 2, (L == L1) ? 1 : 0);
     luaL_argcheck(L, level >= 0, arg + 2, "level can't be negative");
 
-    luaL_Buffer buf;
+    luaL_Strbuf buf;
     luaL_buffinit(L, &buf);
 
     if (msg)
@@ -137,7 +137,7 @@ static int db_traceback(lua_State* L)
                 *--lineptr = '0' + (r % 10);
 
             luaL_addchar(&buf, ':');
-            luaL_addlstring(&buf, lineptr, lineend - lineptr, -1);
+            luaL_addlstring(&buf, lineptr, lineend - lineptr);
         }
 
         if (ar.name)
diff --git a/VM/src/ldo.cpp b/VM/src/ldo.cpp
index f96e5f16e..6729f155b 100644
--- a/VM/src/ldo.cpp
+++ b/VM/src/ldo.cpp
@@ -17,6 +17,8 @@
 
 #include <string.h>
 
+LUAU_DYNAMIC_FASTFLAGVARIABLE(LuauHandlerClose, false)
+
 /*
 ** {======================================================
 ** Error-recovery functions
@@ -407,7 +409,7 @@ static void resume_handle(lua_State* L, void* ud)
     L->ci = restoreci(L, old_ci);
 
     // close eventual pending closures; this means it's now safe to restore stack
-    luaF_close(L, L->base);
+    luaF_close(L, DFFlag::LuauHandlerClose ? L->ci->base : L->base);
 
     // finish cont call and restore stack to previous ci top
     luau_poscall(L, L->top - n);
diff --git a/VM/src/lgc.cpp b/VM/src/lgc.cpp
index f50b33d18..4b31580a8 100644
--- a/VM/src/lgc.cpp
+++ b/VM/src/lgc.cpp
@@ -10,6 +10,7 @@
 #include "ldo.h"
 #include "lmem.h"
 #include "ludata.h"
+#include "lbuffer.h"
 
 #include <string.h>
 
@@ -275,6 +276,11 @@ static void reallymarkobject(global_State* g, GCObject* o)
         g->gray = o;
         break;
     }
+    case LUA_TBUFFER:
+    {
+        gray2black(o); // buffers are never gray
+        return;
+    }
     case LUA_TPROTO:
     {
         gco2p(o)->gclist = g->gray;
@@ -618,6 +624,9 @@ static void freeobj(lua_State* L, GCObject* o, lua_Page* page)
     case LUA_TUSERDATA:
         luaU_freeudata(L, gco2u(o), page);
         break;
+    case LUA_TBUFFER:
+        luaB_freebuffer(L, gco2buf(o), page);
+        break;
     default:
         LUAU_ASSERT(0);
     }
diff --git a/VM/src/lgc.h b/VM/src/lgc.h
index 1ebb01d28..ba433c674 100644
--- a/VM/src/lgc.h
+++ b/VM/src/lgc.h
@@ -136,7 +136,8 @@ LUAI_FUNC void luaC_barriertable(lua_State* L, Table* t, GCObject* v);
 LUAI_FUNC void luaC_barrierback(lua_State* L, GCObject* o, GCObject** gclist);
 LUAI_FUNC void luaC_validate(lua_State* L);
 LUAI_FUNC void luaC_dump(lua_State* L, void* file, const char* (*categoryName)(lua_State* L, uint8_t memcat));
-LUAI_FUNC void luaC_enumheap(lua_State* L, void* context, void (*node)(void* context, void* ptr, uint8_t tt, uint8_t memcat, const char* name),
+LUAI_FUNC void luaC_enumheap(lua_State* L, void* context,
+    void (*node)(void* context, void* ptr, uint8_t tt, uint8_t memcat, size_t size, const char* name),
     void (*edge)(void* context, void* from, void* to, const char* name));
 LUAI_FUNC int64_t luaC_allocationrate(lua_State* L);
 LUAI_FUNC const char* luaC_statename(int state);
diff --git a/VM/src/lgcdebug.cpp b/VM/src/lgcdebug.cpp
index 5b18c26f3..48a6d2e2f 100644
--- a/VM/src/lgcdebug.cpp
+++ b/VM/src/lgcdebug.cpp
@@ -9,6 +9,7 @@
 #include "lstring.h"
 #include "ltable.h"
 #include "ludata.h"
+#include "lbuffer.h"
 
 #include <string.h>
 #include <stdio.h>
@@ -166,6 +167,9 @@ static void validateobj(global_State* g, GCObject* o)
         validatestack(g, gco2th(o));
         break;
 
+    case LUA_TBUFFER:
+        break;
+
     case LUA_TPROTO:
         validateproto(g, gco2p(o));
         break;
@@ -473,6 +477,11 @@ static void dumpthread(FILE* f, lua_State* th)
     fprintf(f, "}");
 }
 
+static void dumpbuffer(FILE* f, Buffer* b)
+{
+    fprintf(f, "{\"type\":\"buffer\",\"cat\":%d,\"size\":%d}", b->memcat, int(sizebuffer(b->len)));
+}
+
 static void dumpproto(FILE* f, Proto* p)
 {
     size_t size = sizeof(Proto) + sizeof(Instruction) * p->sizecode + sizeof(Proto*) * p->sizep + sizeof(TValue) * p->sizek + p->sizelineinfo +
@@ -541,6 +550,9 @@ static void dumpobj(FILE* f, GCObject* o)
     case LUA_TTHREAD:
         return dumpthread(f, gco2th(o));
 
+    case LUA_TBUFFER:
+        return dumpbuffer(f, gco2buf(o));
+
     case LUA_TPROTO:
         return dumpproto(f, gco2p(o));
 
@@ -607,7 +619,7 @@ struct EnumContext
 {
     lua_State* L;
     void* context;
-    void (*node)(void* context, void* ptr, uint8_t tt, uint8_t memcat, const char* name);
+    void (*node)(void* context, void* ptr, uint8_t tt, uint8_t memcat, size_t size, const char* name);
     void (*edge)(void* context, void* from, void* to, const char* name);
 };
 
@@ -617,9 +629,9 @@ static void* enumtopointer(GCObject* gco)
     return gco->gch.tt == LUA_TUSERDATA ? (void*)gco2u(gco)->data : (void*)gco;
 }
 
-static void enumnode(EnumContext* ctx, GCObject* gco, const char* objname)
+static void enumnode(EnumContext* ctx, GCObject* gco, size_t size, const char* objname)
 {
-    ctx->node(ctx->context, enumtopointer(gco), gco->gch.tt, gco->gch.memcat, objname);
+    ctx->node(ctx->context, enumtopointer(gco), gco->gch.tt, gco->gch.memcat, size, objname);
 }
 
 static void enumedge(EnumContext* ctx, GCObject* from, GCObject* to, const char* edgename)
@@ -638,13 +650,15 @@ static void enumedges(EnumContext* ctx, GCObject* from, TValue* data, size_t siz
 
 static void enumstring(EnumContext* ctx, TString* ts)
 {
-    enumnode(ctx, obj2gco(ts), NULL);
+    enumnode(ctx, obj2gco(ts), ts->len, NULL);
 }
 
 static void enumtable(EnumContext* ctx, Table* h)
 {
+    size_t size = sizeof(Table) + (h->node == &luaH_dummynode ? 0 : sizenode(h) * sizeof(LuaNode)) + h->sizearray * sizeof(TValue);
+
     // Provide a name for a special registry table
-    enumnode(ctx, obj2gco(h), h == hvalue(registry(ctx->L)) ? "registry" : NULL);
+    enumnode(ctx, obj2gco(h), size, h == hvalue(registry(ctx->L)) ? "registry" : NULL);
 
     if (h->node != &luaH_dummynode)
     {
@@ -703,7 +717,7 @@ static void enumclosure(EnumContext* ctx, Closure* cl)
 {
     if (cl->isC)
     {
-        enumnode(ctx, obj2gco(cl), cl->c.debugname);
+        enumnode(ctx, obj2gco(cl), sizeCclosure(cl->nupvalues), cl->c.debugname);
     }
     else
     {
@@ -716,7 +730,7 @@ static void enumclosure(EnumContext* ctx, Closure* cl)
         else
             snprintf(buf, sizeof(buf), "%s:%d", p->debugname ? getstr(p->debugname) : "", p->linedefined);
 
-        enumnode(ctx, obj2gco(cl), buf);
+        enumnode(ctx, obj2gco(cl), sizeLclosure(cl->nupvalues), buf);
     }
 
     enumedge(ctx, obj2gco(cl), obj2gco(cl->env), "env");
@@ -737,7 +751,26 @@ static void enumclosure(EnumContext* ctx, Closure* cl)
 
 static void enumudata(EnumContext* ctx, Udata* u)
 {
-    enumnode(ctx, obj2gco(u), NULL);
+    const char* name = NULL;
+
+    if (Table* h = u->metatable)
+    {
+        if (h->node != &luaH_dummynode)
+        {
+            for (int i = 0; i < sizenode(h); ++i)
+            {
+                const LuaNode& n = h->node[i];
+
+                if (ttisstring(&n.key) && ttisstring(&n.val) && strcmp(svalue(&n.key), "__type") == 0)
+                {
+                    name = svalue(&n.val);
+                    break;
+                }
+            }
+        }
+    }
+
+    enumnode(ctx, obj2gco(u), sizeudata(u->len), name);
 
     if (u->metatable)
         enumedge(ctx, obj2gco(u), obj2gco(u->metatable), "metatable");
@@ -745,6 +778,8 @@ static void enumudata(EnumContext* ctx, Udata* u)
 
 static void enumthread(EnumContext* ctx, lua_State* th)
 {
+    size_t size = sizeof(lua_State) + sizeof(TValue) * th->stacksize + sizeof(CallInfo) * th->size_ci;
+
     Closure* tcl = NULL;
     for (CallInfo* ci = th->base_ci; ci <= th->ci; ++ci)
     {
@@ -766,11 +801,11 @@ static void enumthread(EnumContext* ctx, lua_State* th)
         else
             snprintf(buf, sizeof(buf), "%s:%d", p->debugname ? getstr(p->debugname) : "", p->linedefined);
 
-        enumnode(ctx, obj2gco(th), buf);
+        enumnode(ctx, obj2gco(th), size, buf);
     }
     else
     {
-        enumnode(ctx, obj2gco(th), NULL);
+        enumnode(ctx, obj2gco(th), size, NULL);
     }
 
     enumedge(ctx, obj2gco(th), obj2gco(th->gt), "globals");
@@ -779,9 +814,17 @@ static void enumthread(EnumContext* ctx, lua_State* th)
         enumedges(ctx, obj2gco(th), th->stack, th->top - th->stack, "stack");
 }
 
+static void enumbuffer(EnumContext* ctx, Buffer* b)
+{
+    enumnode(ctx, obj2gco(b), sizebuffer(b->len), NULL);
+}
+
 static void enumproto(EnumContext* ctx, Proto* p)
 {
-    enumnode(ctx, obj2gco(p), p->source ? getstr(p->source) : NULL);
+    size_t size = sizeof(Proto) + sizeof(Instruction) * p->sizecode + sizeof(Proto*) * p->sizep + sizeof(TValue) * p->sizek + p->sizelineinfo +
+                  sizeof(LocVar) * p->sizelocvars + sizeof(TString*) * p->sizeupvalues;
+
+    enumnode(ctx, obj2gco(p), size, p->source ? getstr(p->source) : NULL);
 
     if (p->sizek)
         enumedges(ctx, obj2gco(p), p->k, p->sizek, "constants");
@@ -792,7 +835,7 @@ static void enumproto(EnumContext* ctx, Proto* p)
 
 static void enumupval(EnumContext* ctx, UpVal* uv)
 {
-    enumnode(ctx, obj2gco(uv), NULL);
+    enumnode(ctx, obj2gco(uv), sizeof(UpVal), NULL);
 
     if (iscollectable(uv->v))
         enumedge(ctx, obj2gco(uv), gcvalue(uv->v), "value");
@@ -817,6 +860,9 @@ static void enumobj(EnumContext* ctx, GCObject* o)
     case LUA_TTHREAD:
         return enumthread(ctx, gco2th(o));
 
+    case LUA_TBUFFER:
+        return enumbuffer(ctx, gco2buf(o));
+
     case LUA_TPROTO:
         return enumproto(ctx, gco2p(o));
 
@@ -834,7 +880,7 @@ static bool enumgco(void* context, lua_Page* page, GCObject* gco)
     return false;
 }
 
-void luaC_enumheap(lua_State* L, void* context, void (*node)(void* context, void* ptr, uint8_t tt, uint8_t memcat, const char* name),
+void luaC_enumheap(lua_State* L, void* context, void (*node)(void* context, void* ptr, uint8_t tt, uint8_t memcat, size_t size, const char* name),
     void (*edge)(void* context, void* from, void* to, const char* name))
 {
     global_State* g = L->global;
diff --git a/VM/src/lmem.cpp b/VM/src/lmem.cpp
index 25ca999d3..8b264ef4f 100644
--- a/VM/src/lmem.cpp
+++ b/VM/src/lmem.cpp
@@ -118,6 +118,7 @@ static_assert(sizeof(LuaNode) == ABISWITCH(32, 32, 32), "size mismatch for table
 static_assert(offsetof(TString, data) == ABISWITCH(24, 20, 20), "size mismatch for string header");
 static_assert(offsetof(Udata, data) == ABISWITCH(16, 16, 12), "size mismatch for userdata header");
 static_assert(sizeof(Table) == ABISWITCH(48, 32, 32), "size mismatch for table header");
+static_assert(offsetof(Buffer, data) == ABISWITCH(8, 8, 8), "size mismatch for buffer header");
 
 const size_t kSizeClasses = LUA_SIZECLASSES;
 const size_t kMaxSmallSize = 512;
diff --git a/VM/src/lobject.h b/VM/src/lobject.h
index 18ff75460..716401402 100644
--- a/VM/src/lobject.h
+++ b/VM/src/lobject.h
@@ -58,6 +58,7 @@ typedef struct lua_TValue
 #define ttisboolean(o) (ttype(o) == LUA_TBOOLEAN)
 #define ttisuserdata(o) (ttype(o) == LUA_TUSERDATA)
 #define ttisthread(o) (ttype(o) == LUA_TTHREAD)
+#define ttisbuffer(o) (ttype(o) == LUA_TBUFFER)
 #define ttislightuserdata(o) (ttype(o) == LUA_TLIGHTUSERDATA)
 #define ttisvector(o) (ttype(o) == LUA_TVECTOR)
 #define ttisupval(o) (ttype(o) == LUA_TUPVAL)
@@ -74,6 +75,7 @@ typedef struct lua_TValue
 #define hvalue(o) check_exp(ttistable(o), &(o)->value.gc->h)
 #define bvalue(o) check_exp(ttisboolean(o), (o)->value.b)
 #define thvalue(o) check_exp(ttisthread(o), &(o)->value.gc->th)
+#define bufvalue(o) check_exp(ttisbuffer(o), &(o)->value.gc->buf)
 #define upvalue(o) check_exp(ttisupval(o), &(o)->value.gc->uv)
 
 #define l_isfalse(o) (ttisnil(o) || (ttisboolean(o) && bvalue(o) == 0))
@@ -156,6 +158,14 @@ typedef struct lua_TValue
         checkliveness(L->global, i_o); \
     }
 
+#define setbufvalue(L, obj, x) \
+    { \
+        TValue* i_o = (obj); \
+        i_o->value.gc = cast_to(GCObject*, (x)); \
+        i_o->tt = LUA_TBUFFER; \
+        checkliveness(L->global, i_o); \
+    }
+
 #define setclvalue(L, obj, x) \
     { \
         TValue* i_o = (obj); \
@@ -254,6 +264,19 @@ typedef struct Udata
     };
 } Udata;
 
+typedef struct Buffer
+{
+    CommonHeader;
+
+    unsigned int len;
+
+    union
+    {
+        char data[1];      // buffer is allocated right after the header
+        L_Umaxalign dummy; // ensures maximum alignment for data
+    };
+} Buffer;
+
 /*
 ** Function Prototypes
 */
diff --git a/VM/src/loslib.cpp b/VM/src/loslib.cpp
index a4da00ccf..1dbd34c62 100644
--- a/VM/src/loslib.cpp
+++ b/VM/src/loslib.cpp
@@ -161,7 +161,7 @@ static int os_date(lua_State* L)
         cc[0] = '%';
         cc[2] = '\0';
 
-        luaL_Buffer b;
+        luaL_Strbuf b;
         luaL_buffinit(L, &b);
         for (; *s; s++)
         {
@@ -179,7 +179,7 @@ static int os_date(lua_State* L)
                 char buff[200]; // should be big enough for any conversion result
                 cc[1] = *(++s);
                 reslen = strftime(buff, sizeof(buff), cc, stm);
-                luaL_addlstring(&b, buff, reslen, -1);
+                luaL_addlstring(&b, buff, reslen);
             }
         }
         luaL_pushresult(&b);
diff --git a/VM/src/lstate.h b/VM/src/lstate.h
index a7346ccb2..ed73d3d8e 100644
--- a/VM/src/lstate.h
+++ b/VM/src/lstate.h
@@ -282,6 +282,7 @@ union GCObject
     struct Proto p;
     struct UpVal uv;
     struct lua_State th; // thread
+    struct Buffer buf;
 };
 
 // macros to convert a GCObject into a specific value
@@ -292,6 +293,7 @@ union GCObject
 #define gco2p(o) check_exp((o)->gch.tt == LUA_TPROTO, &((o)->p))
 #define gco2uv(o) check_exp((o)->gch.tt == LUA_TUPVAL, &((o)->uv))
 #define gco2th(o) check_exp((o)->gch.tt == LUA_TTHREAD, &((o)->th))
+#define gco2buf(o) check_exp((o)->gch.tt == LUA_TBUFFER, &((o)->buf))
 
 // macro to convert any Lua object into a GCObject
 #define obj2gco(v) check_exp(iscollectable(v), cast_to(GCObject*, (v) + 0))
diff --git a/VM/src/lstrlib.cpp b/VM/src/lstrlib.cpp
index ca57786e6..6fa0f53c4 100644
--- a/VM/src/lstrlib.cpp
+++ b/VM/src/lstrlib.cpp
@@ -48,7 +48,7 @@ static int str_reverse(lua_State* L)
 {
     size_t l;
     const char* s = luaL_checklstring(L, 1, &l);
-    luaL_Buffer b;
+    luaL_Strbuf b;
     char* ptr = luaL_buffinitsize(L, &b, l);
     while (l--)
         *ptr++ = s[l];
@@ -60,7 +60,7 @@ static int str_lower(lua_State* L)
 {
     size_t l;
     const char* s = luaL_checklstring(L, 1, &l);
-    luaL_Buffer b;
+    luaL_Strbuf b;
     char* ptr = luaL_buffinitsize(L, &b, l);
     for (size_t i = 0; i < l; i++)
         *ptr++ = tolower(uchar(s[i]));
@@ -72,7 +72,7 @@ static int str_upper(lua_State* L)
 {
     size_t l;
     const char* s = luaL_checklstring(L, 1, &l);
-    luaL_Buffer b;
+    luaL_Strbuf b;
     char* ptr = luaL_buffinitsize(L, &b, l);
     for (size_t i = 0; i < l; i++)
         *ptr++ = toupper(uchar(s[i]));
@@ -95,7 +95,7 @@ static int str_rep(lua_State* L)
     if (l > MAXSSIZE / (size_t)n) // may overflow?
         luaL_error(L, "resulting string too large");
 
-    luaL_Buffer b;
+    luaL_Strbuf b;
     char* ptr = luaL_buffinitsize(L, &b, l * n);
 
     const char* start = ptr;
@@ -151,7 +151,7 @@ static int str_char(lua_State* L)
 {
     int n = lua_gettop(L); // number of arguments
 
-    luaL_Buffer b;
+    luaL_Strbuf b;
     char* ptr = luaL_buffinitsize(L, &b, n);
 
     for (int i = 1; i <= n; i++)
@@ -750,12 +750,12 @@ static int gmatch(lua_State* L)
     return 1;
 }
 
-static void add_s(MatchState* ms, luaL_Buffer* b, const char* s, const char* e)
+static void add_s(MatchState* ms, luaL_Strbuf* b, const char* s, const char* e)
 {
     size_t l, i;
     const char* news = lua_tolstring(ms->L, 3, &l);
 
-    luaL_reservebuffer(b, l, -1);
+    luaL_prepbuffsize(b, l);
 
     for (i = 0; i < l; i++)
     {
@@ -771,7 +771,7 @@ static void add_s(MatchState* ms, luaL_Buffer* b, const char* s, const char* e)
                 luaL_addchar(b, news[i]);
             }
             else if (news[i] == '0')
-                luaL_addlstring(b, s, e - s, -1);
+                luaL_addlstring(b, s, e - s);
             else
             {
                 push_onecapture(ms, news[i] - '1', s, e);
@@ -781,7 +781,7 @@ static void add_s(MatchState* ms, luaL_Buffer* b, const char* s, const char* e)
     }
 }
 
-static void add_value(MatchState* ms, luaL_Buffer* b, const char* s, const char* e, int tr)
+static void add_value(MatchState* ms, luaL_Strbuf* b, const char* s, const char* e, int tr)
 {
     lua_State* L = ms->L;
     switch (tr)
@@ -826,7 +826,7 @@ static int str_gsub(lua_State* L)
     int anchor = (*p == '^');
     int n = 0;
     MatchState ms;
-    luaL_Buffer b;
+    luaL_Strbuf b;
     luaL_argexpected(L, tr == LUA_TNUMBER || tr == LUA_TSTRING || tr == LUA_TFUNCTION || tr == LUA_TTABLE, 3, "string/function/table");
     luaL_buffinit(L, &b);
     if (anchor)
@@ -854,7 +854,7 @@ static int str_gsub(lua_State* L)
         if (anchor)
             break;
     }
-    luaL_addlstring(&b, src, ms.src_end - src, -1);
+    luaL_addlstring(&b, src, ms.src_end - src);
     luaL_pushresult(&b);
     lua_pushinteger(L, n); // number of substitutions
     return 2;
@@ -869,12 +869,12 @@ static int str_gsub(lua_State* L)
 // maximum size of each format specification (such as '%-099.99d')
 #define MAX_FORMAT 32
 
-static void addquoted(lua_State* L, luaL_Buffer* b, int arg)
+static void addquoted(lua_State* L, luaL_Strbuf* b, int arg)
 {
     size_t l;
     const char* s = luaL_checklstring(L, arg, &l);
 
-    luaL_reservebuffer(b, l + 2, -1);
+    luaL_prepbuffsize(b, l + 2);
 
     luaL_addchar(b, '"');
     while (l--)
@@ -891,12 +891,12 @@ static void addquoted(lua_State* L, luaL_Buffer* b, int arg)
         }
         case '\r':
         {
-            luaL_addlstring(b, "\\r", 2, -1);
+            luaL_addlstring(b, "\\r", 2);
             break;
         }
         case '\0':
         {
-            luaL_addlstring(b, "\\000", 4, -1);
+            luaL_addlstring(b, "\\000", 4);
             break;
         }
         default:
@@ -958,7 +958,7 @@ static int str_format(lua_State* L)
     size_t sfl;
     const char* strfrmt = luaL_checklstring(L, arg, &sfl);
     const char* strfrmt_end = strfrmt + sfl;
-    luaL_Buffer b;
+    luaL_Strbuf b;
     luaL_buffinit(L, &b);
     while (strfrmt < strfrmt_end)
     {
@@ -1029,7 +1029,7 @@ static int str_format(lua_State* L)
                 // no precision and string is too long to be formatted, or no format necessary to begin with
                 if (form[2] == '\0' || (!strchr(form, '.') && l >= 100))
                 {
-                    luaL_addlstring(&b, s, l, -1);
+                    luaL_addlstring(&b, s, l);
                     continue; // skip the `luaL_addlstring' at the end
                 }
                 else
@@ -1048,7 +1048,7 @@ static int str_format(lua_State* L)
                 luaL_error(L, "invalid option '%%%c' to 'format'", *(strfrmt - 1));
             }
             }
-            luaL_addlstring(&b, buff, strlen(buff), -1);
+            luaL_addlstring(&b, buff, strlen(buff));
         }
     }
     luaL_pushresult(&b);
@@ -1344,7 +1344,7 @@ static KOption getdetails(Header* h, size_t totalsize, const char** fmt, int* ps
 ** the size of a Lua integer, correcting the extra sign-extension
 ** bytes if necessary (by default they would be zeros).
 */
-static void packint(luaL_Buffer* b, unsigned long long n, int islittle, int size, int neg)
+static void packint(luaL_Strbuf* b, unsigned long long n, int islittle, int size, int neg)
 {
     LUAU_ASSERT(size <= MAXINTSIZE);
     char buff[MAXINTSIZE];
@@ -1360,7 +1360,7 @@ static void packint(luaL_Buffer* b, unsigned long long n, int islittle, int size
         for (i = SZINT; i < size; i++) // correct extra bytes
             buff[islittle ? i : size - 1 - i] = (char)MC;
     }
-    luaL_addlstring(b, buff, size, -1); // add result to buffer
+    luaL_addlstring(b, buff, size); // add result to buffer
 }
 
 /*
@@ -1384,7 +1384,7 @@ static void copywithendian(volatile char* dest, volatile const char* src, int si
 
 static int str_pack(lua_State* L)
 {
-    luaL_Buffer b;
+    luaL_Strbuf b;
     Header h;
     const char* fmt = luaL_checkstring(L, 1); // format string
     int arg = 1;                              // current argument to pack
@@ -1434,7 +1434,7 @@ static int str_pack(lua_State* L)
                 u.n = n;
             // move 'u' to final result, correcting endianness if needed
             copywithendian(buff, u.buff, size, h.islittle);
-            luaL_addlstring(&b, buff, size, -1);
+            luaL_addlstring(&b, buff, size);
             break;
         }
         case Kchar:
@@ -1442,8 +1442,8 @@ static int str_pack(lua_State* L)
             size_t len;
             const char* s = luaL_checklstring(L, arg, &len);
             luaL_argcheck(L, len <= (size_t)size, arg, "string longer than given size");
-            luaL_addlstring(&b, s, len, -1); // add string
-            while (len++ < (size_t)size)     // pad extra space
+            luaL_addlstring(&b, s, len); // add string
+            while (len++ < (size_t)size) // pad extra space
                 luaL_addchar(&b, LUAL_PACKPADBYTE);
             break;
         }
@@ -1453,7 +1453,7 @@ static int str_pack(lua_State* L)
             const char* s = luaL_checklstring(L, arg, &len);
             luaL_argcheck(L, size >= (int)sizeof(size_t) || len < ((size_t)1 << (size * NB)), arg, "string length does not fit in given size");
             packint(&b, len, h.islittle, size, 0); // pack length
-            luaL_addlstring(&b, s, len, -1);
+            luaL_addlstring(&b, s, len);
             totalsize += len;
             break;
         }
@@ -1462,7 +1462,7 @@ static int str_pack(lua_State* L)
             size_t len;
             const char* s = luaL_checklstring(L, arg, &len);
             luaL_argcheck(L, strlen(s) == len, arg, "string contains zeros");
-            luaL_addlstring(&b, s, len, -1);
+            luaL_addlstring(&b, s, len);
             luaL_addchar(&b, '\0'); // add zero at the end
             totalsize += len + 1;
             break;
diff --git a/VM/src/ltablib.cpp b/VM/src/ltablib.cpp
index cc44ee19f..0b4a68555 100644
--- a/VM/src/ltablib.cpp
+++ b/VM/src/ltablib.cpp
@@ -217,7 +217,7 @@ static int tmove(lua_State* L)
     return 1;
 }
 
-static void addfield(lua_State* L, luaL_Buffer* b, int i)
+static void addfield(lua_State* L, luaL_Strbuf* b, int i)
 {
     int tt = lua_rawgeti(L, 1, i);
     if (tt != LUA_TSTRING && tt != LUA_TNUMBER)
@@ -227,7 +227,7 @@ static void addfield(lua_State* L, luaL_Buffer* b, int i)
 
 static int tconcat(lua_State* L)
 {
-    luaL_Buffer b;
+    luaL_Strbuf b;
     size_t lsep;
     int i, last;
     const char* sep = luaL_optlstring(L, 2, "", &lsep);
@@ -238,7 +238,7 @@ static int tconcat(lua_State* L)
     for (; i < last; i++)
     {
         addfield(L, &b, i);
-        luaL_addlstring(&b, sep, lsep, -1);
+        luaL_addlstring(&b, sep, lsep);
     }
     if (i == last) // add last value (if interval was not empty)
         addfield(L, &b, i);
diff --git a/VM/src/ltm.cpp b/VM/src/ltm.cpp
index d8c69a704..927a535be 100644
--- a/VM/src/ltm.cpp
+++ b/VM/src/ltm.cpp
@@ -28,6 +28,7 @@ const char* const luaT_typenames[] = {
     "function",
     "userdata",
     "thread",
+    "buffer",
 };
 
 const char* const luaT_eventname[] = {
diff --git a/VM/src/lutf8lib.cpp b/VM/src/lutf8lib.cpp
index 0bbce01f0..4887b5e80 100644
--- a/VM/src/lutf8lib.cpp
+++ b/VM/src/lutf8lib.cpp
@@ -170,12 +170,12 @@ static int utfchar(lua_State* L)
     }
     else
     {
-        luaL_Buffer b;
+        luaL_Strbuf b;
         luaL_buffinit(L, &b);
         for (int i = 1; i <= n; i++)
         {
             int l = buffutfchar(L, i, buff, &charstr);
-            luaL_addlstring(&b, charstr, l, -1);
+            luaL_addlstring(&b, charstr, l);
         }
         luaL_pushresult(&b);
     }
diff --git a/VM/src/lvmexecute.cpp b/VM/src/lvmexecute.cpp
index 086ed649c..5eecc2acb 100644
--- a/VM/src/lvmexecute.cpp
+++ b/VM/src/lvmexecute.cpp
@@ -1129,6 +1129,7 @@ static void luau_execute(lua_State* L)
                     case LUA_TSTRING:
                     case LUA_TFUNCTION:
                     case LUA_TTHREAD:
+                    case LUA_TBUFFER:
                         pc += gcvalue(ra) == gcvalue(rb) ? LUAU_INSN_D(insn) : 1;
                         LUAU_ASSERT(unsigned(pc - cl->l.p->code) < unsigned(cl->l.p->sizecode));
                         VM_NEXT();
@@ -1243,6 +1244,7 @@ static void luau_execute(lua_State* L)
                     case LUA_TSTRING:
                     case LUA_TFUNCTION:
                     case LUA_TTHREAD:
+                    case LUA_TBUFFER:
                         pc += gcvalue(ra) != gcvalue(rb) ? LUAU_INSN_D(insn) : 1;
                         LUAU_ASSERT(unsigned(pc - cl->l.p->code) < unsigned(cl->l.p->sizecode));
                         VM_NEXT();
diff --git a/fuzz/proto.cpp b/fuzz/proto.cpp
index 1ad7852db..63c7618f2 100644
--- a/fuzz/proto.cpp
+++ b/fuzz/proto.cpp
@@ -363,6 +363,7 @@ DEFINE_PROTO_FUZZER(const luau::ModuleSet& message)
         if (luau_load(globalState, "=fuzz", bytecode.data(), bytecode.size(), 0) == 0)
         {
             Luau::CodeGen::AssemblyOptions options;
+            options.flags = Luau::CodeGen::CodeGen_ColdFunctions;
             options.outputBinary = true;
             options.target = kFuzzCodegenTarget;
             Luau::CodeGen::getAssembly(globalState, -1, options);
@@ -384,7 +385,7 @@ DEFINE_PROTO_FUZZER(const luau::ModuleSet& message)
             if (luau_load(L, "=fuzz", bytecode.data(), bytecode.size(), 0) == 0)
             {
                 if (useCodegen)
-                    Luau::CodeGen::compile(L, -1);
+                    Luau::CodeGen::compile(L, -1, Luau::CodeGen::CodeGen_ColdFunctions);
 
                 interruptDeadline = std::chrono::system_clock::now() + kInterruptTimeout;
 
diff --git a/stats/compiler-stats.py b/stats/compiler-stats.py
new file mode 100644
index 000000000..efd9f8c87
--- /dev/null
+++ b/stats/compiler-stats.py
@@ -0,0 +1,167 @@
+#!/usr/bin/python3
+# This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
+
+import argparse
+import json
+from collections import Counter
+import pandas as pd
+## needed for 'to_markdown' method for pandas data frame
+import tabulate
+
+
+def getArgs():
+    parser = argparse.ArgumentParser(description='Analyze compiler statistics')
+    parser.add_argument('--bytecode-bin-factor', dest='bytecodeBinFactor',default=10,help='Bytecode bin size as a multiple of 1000 (10 by default)')
+    parser.add_argument('--block-bin-factor', dest='blockBinFactor',default=1,help='Block bin size as a multiple of 1000 (1 by default)')
+    parser.add_argument('--block-instruction-bin-factor', dest='blockInstructionBinFactor',default=1,help='Block bin size as a multiple of 1000 (1 by default)')
+    parser.add_argument('statsFile', help='stats.json file generated by running luau-compile')
+    args = parser.parse_args()
+    return args
+
+def readStats(statsFile):
+    with open(statsFile) as f:
+        stats = json.load(f)
+
+        scripts = []
+        functionCounts = []
+        bytecodeLengths = []
+        blockPreOptCounts = []
+        blockPostOptCounts = []
+        maxBlockInstructionCounts = []
+
+        for path, fileStat in stats.items():
+            scripts.append(path)
+            functionCounts.append(fileStat['lowerStats']['totalFunctions'] - fileStat['lowerStats']['skippedFunctions'])
+            bytecodeLengths.append(fileStat['bytecode'])
+            blockPreOptCounts.append(fileStat['lowerStats']['blocksPreOpt'])
+            blockPostOptCounts.append(fileStat['lowerStats']['blocksPostOpt'])
+            maxBlockInstructionCounts.append(fileStat['lowerStats']['maxBlockInstructions'])
+
+        stats_df = pd.DataFrame({
+            'Script': scripts,
+            'FunctionCount': functionCounts,
+            'BytecodeLength': bytecodeLengths,
+            'BlockPreOptCount': blockPreOptCounts,
+            'BlockPostOptCount': blockPostOptCounts,
+            'MaxBlockInstructionCount': maxBlockInstructionCounts
+        })
+
+        return stats_df
+
+
+def analyzeBytecodeStats(stats_df, config):
+    binFactor = config.bytecodeBinFactor
+    divisor = binFactor * 1000
+    totalScriptCount = len(stats_df.index)
+
+    lengthLabels = []
+    scriptCounts = []
+    scriptPercs = []
+
+    counter = Counter()
+
+    for index, row in stats_df.iterrows():
+        value = row['BytecodeLength']
+        factor = int(value / divisor)
+        counter[factor] += 1
+
+    for factor, scriptCount in sorted(counter.items()):
+        left = factor * binFactor
+        right = left + binFactor
+        lengthLabel = '{left}K-{right}K'.format(left=left, right=right)
+        lengthLabels.append(lengthLabel)
+        scriptCounts.append(scriptCount)
+        scriptPerc = round(scriptCount * 100 / totalScriptCount, 1)
+        scriptPercs.append(scriptPerc)
+
+    bcode_df = pd.DataFrame({
+        'BytecodeLength': lengthLabels,
+        'ScriptCount': scriptCounts,
+        'ScriptPerc': scriptPercs
+    })
+
+    return bcode_df
+
+
+def analyzeBlockStats(stats_df, config, field):
+    binFactor = config.blockBinFactor
+    divisor = binFactor * 1000
+    totalScriptCount = len(stats_df.index)
+
+    blockLabels = []
+    scriptCounts = []
+    scriptPercs = []
+
+    counter = Counter()
+
+    for index, row in stats_df.iterrows():
+        value = row[field]
+        factor = int(value / divisor)
+        counter[factor] += 1
+
+    for factor, scriptCount in sorted(counter.items()):
+        left = factor * binFactor
+        right = left + binFactor
+        blockLabel = '{left}K-{right}K'.format(left=left, right=right)
+        blockLabels.append(blockLabel)
+        scriptCounts.append(scriptCount)
+        scriptPerc = round((scriptCount * 100) / totalScriptCount, 1)
+        scriptPercs.append(scriptPerc)
+
+    block_df = pd.DataFrame({
+        field: blockLabels,
+        'ScriptCount': scriptCounts,
+        'ScriptPerc': scriptPercs
+    })
+
+    return block_df
+
+def analyzeMaxBlockInstructionStats(stats_df, config):
+    binFactor = config.blockInstructionBinFactor
+    divisor = binFactor * 1000
+    totalScriptCount = len(stats_df.index)
+
+    blockLabels = []
+    scriptCounts = []
+    scriptPercs = []
+
+    counter = Counter()
+
+    for index, row in stats_df.iterrows():
+        value = row['MaxBlockInstructionCount']
+        factor = int(value / divisor)
+        counter[factor] += 1
+
+    for factor, scriptCount in sorted(counter.items()):
+        left = factor * binFactor
+        right = left + binFactor
+        blockLabel = '{left}K-{right}K'.format(left=left, right=right)
+        blockLabels.append(blockLabel)
+        scriptCounts.append(scriptCount)
+        scriptPerc = round((scriptCount * 100) / totalScriptCount, 1)
+        scriptPercs.append(scriptPerc)
+
+    block_df = pd.DataFrame({
+        'MaxBlockInstructionCount': blockLabels,
+        'ScriptCount': scriptCounts,
+        'ScriptPerc': scriptPercs
+    })
+
+    return block_df
+
+if __name__ == '__main__':
+    config = getArgs()
+
+    stats_df = readStats(config.statsFile)
+
+    bcode_df = analyzeBytecodeStats(stats_df, config)
+    print(bcode_df.to_markdown())
+
+    block_df = analyzeBlockStats(stats_df, config, 'BlockPreOptCount')
+    print(block_df.to_markdown())
+
+    block_df = analyzeBlockStats(stats_df, config, 'BlockPostOptCount')
+    print(block_df.to_markdown())
+
+    block_df = analyzeMaxBlockInstructionStats(stats_df, config)
+    print(block_df.to_markdown())
diff --git a/tests/AssemblyBuilderA64.test.cpp b/tests/AssemblyBuilderA64.test.cpp
index 56722c00b..b9df78a3c 100644
--- a/tests/AssemblyBuilderA64.test.cpp
+++ b/tests/AssemblyBuilderA64.test.cpp
@@ -76,6 +76,8 @@ TEST_CASE_FIXTURE(AssemblyBuilderA64Fixture, "Unary")
     SINGLE_COMPARE(clz(w0, w1), 0x5AC01020);
     SINGLE_COMPARE(rbit(x0, x1), 0xDAC00020);
     SINGLE_COMPARE(rbit(w0, w1), 0x5AC00020);
+    SINGLE_COMPARE(rev(w0, w1), 0x5AC00820);
+    SINGLE_COMPARE(rev(x0, x1), 0xDAC00C20);
 }
 
 TEST_CASE_FIXTURE(AssemblyBuilderA64Fixture, "Binary")
diff --git a/tests/AssemblyBuilderX64.test.cpp b/tests/AssemblyBuilderX64.test.cpp
index 06d381244..63e65dd4d 100644
--- a/tests/AssemblyBuilderX64.test.cpp
+++ b/tests/AssemblyBuilderX64.test.cpp
@@ -548,6 +548,10 @@ TEST_CASE_FIXTURE(AssemblyBuilderX64Fixture, "MiscInstructions")
     SINGLE_COMPARE(ud2(), 0x0f, 0x0b);
     SINGLE_COMPARE(bsr(eax, edx), 0x0f, 0xbd, 0xc2);
     SINGLE_COMPARE(bsf(eax, edx), 0x0f, 0xbc, 0xc2);
+    SINGLE_COMPARE(bswap(eax), 0x0f, 0xc8);
+    SINGLE_COMPARE(bswap(r12d), 0x41, 0x0f, 0xcc);
+    SINGLE_COMPARE(bswap(rax), 0x48, 0x0f, 0xc8);
+    SINGLE_COMPARE(bswap(r12), 0x49, 0x0f, 0xcc);
 }
 
 TEST_CASE_FIXTURE(AssemblyBuilderX64Fixture, "LabelLea")
diff --git a/tests/ClassFixture.cpp b/tests/ClassFixture.cpp
index 784069335..78adfeed3 100644
--- a/tests/ClassFixture.cpp
+++ b/tests/ClassFixture.cpp
@@ -83,13 +83,13 @@ ClassFixture::ClassFixture()
 
     TypeId vector2MetaType = arena.addType(TableType{});
 
-    TypeId vector2InstanceType = arena.addType(ClassType{"Vector2", {}, nullopt, vector2MetaType, {}, {}, "Test"});
+    vector2InstanceType = arena.addType(ClassType{"Vector2", {}, nullopt, vector2MetaType, {}, {}, "Test"});
     getMutable<ClassType>(vector2InstanceType)->props = {
         {"X", {numberType}},
         {"Y", {numberType}},
     };
 
-    TypeId vector2Type = arena.addType(ClassType{"Vector2", {}, nullopt, nullopt, {}, {}, "Test"});
+    vector2Type = arena.addType(ClassType{"Vector2", {}, nullopt, nullopt, {}, {}, "Test"});
     getMutable<ClassType>(vector2Type)->props = {
         {"New", {makeFunction(arena, nullopt, {numberType, numberType}, {vector2InstanceType})}},
     };
diff --git a/tests/ClassFixture.h b/tests/ClassFixture.h
index c46697a26..4d8275c10 100644
--- a/tests/ClassFixture.h
+++ b/tests/ClassFixture.h
@@ -9,6 +9,9 @@ namespace Luau
 struct ClassFixture : BuiltinsFixture
 {
     ClassFixture();
+
+    TypeId vector2Type;
+    TypeId vector2InstanceType;
 };
 
 } // namespace Luau
diff --git a/tests/Compiler.test.cpp b/tests/Compiler.test.cpp
index ecd4847bd..e2c779e92 100644
--- a/tests/Compiler.test.cpp
+++ b/tests/Compiler.test.cpp
@@ -7607,4 +7607,103 @@ L0: RETURN R0 2
 )");
 }
 
+TEST_CASE("IfThenElseAndOr")
+{
+    ScopedFastFlag sff("LuauCompileIfElseAndOr", true);
+
+    // if v then v else k can be optimized to ORK
+    CHECK_EQ("\n" + compileFunction0(R"(
+local x = ...
+return if x then x else 0
+)"),
+        R"(
+GETVARARGS R0 1
+ORK R1 R0 K0 [0]
+RETURN R1 1
+)");
+
+    // if v then v else l can be optimized to OR
+    CHECK_EQ("\n" + compileFunction0(R"(
+local x, y = ...
+return if x then x else y
+)"),
+        R"(
+GETVARARGS R0 2
+OR R2 R0 R1
+RETURN R2 1
+)");
+
+    // this also works in presence of type casts
+    CHECK_EQ("\n" + compileFunction0(R"(
+local x, y = ...
+return if x then x :: number else 0
+)"),
+        R"(
+GETVARARGS R0 2
+ORK R2 R0 K0 [0]
+RETURN R2 1
+)");
+
+    // if v then k else v can be optimized to ANDK
+    CHECK_EQ("\n" + compileFunction0(R"(
+local x = ...
+return if x then 0 else x
+)"),
+        R"(
+GETVARARGS R0 1
+ANDK R1 R0 K0 [0]
+RETURN R1 1
+)");
+
+    // if v then l else v can be optimized to AND
+    CHECK_EQ("\n" + compileFunction0(R"(
+local x, y = ...
+return if x then y else x
+)"),
+        R"(
+GETVARARGS R0 2
+AND R2 R0 R1
+RETURN R2 1
+)");
+
+    // this also works in presence of type casts
+    CHECK_EQ("\n" + compileFunction0(R"(
+local x, y = ...
+return if x then y else x :: number
+)"),
+        R"(
+GETVARARGS R0 2
+AND R2 R0 R1
+RETURN R2 1
+)");
+
+    // all of the above work when the target is a temporary register, which is safe because the value is only mutated once
+    CHECK_EQ("\n" + compileFunction0(R"(
+local x, y = ...
+x = if x then x else y
+x = if x then y else x
+)"),
+        R"(
+GETVARARGS R0 2
+OR R0 R0 R1
+AND R0 R0 R1
+RETURN R0 0
+)");
+
+    // note that we can't do this transformation if the expression has possible side effects
+    CHECK_EQ("\n" + compileFunction0(R"(
+local x = ...
+return if x.data then x.data else 0
+)"),
+        R"(
+GETVARARGS R0 1
+GETTABLEKS R2 R0 K0 ['data']
+JUMPIFNOT R2 L0
+GETTABLEKS R1 R0 K0 ['data']
+RETURN R1 1
+L0: LOADN R1 0
+RETURN R1 1
+)");
+}
+
 TEST_SUITE_END();
diff --git a/tests/Conformance.test.cpp b/tests/Conformance.test.cpp
index a023840bc..61ea2416d 100644
--- a/tests/Conformance.test.cpp
+++ b/tests/Conformance.test.cpp
@@ -313,6 +313,7 @@ TEST_CASE("Tables")
                 else
                 {
                     const void* p = lua_topointer(L, 1);
+                    LUAU_ASSERT(p); // we expect the test call to only pass GC values here
                     lua_pushlightuserdata(L, const_cast<void*>(p));
                 }
                 return 1;
@@ -431,6 +432,8 @@ static int cxxthrow(lua_State* L)
 
 TEST_CASE("PCall")
 {
+    ScopedFastFlag sff("LuauHandlerClose", true);
+
     runConformance(
         "pcall.lua",
         [](lua_State* L) {
@@ -1163,6 +1166,51 @@ TEST_CASE("ApiType")
     CHECK(lua_type(L, -1) == LUA_TUSERDATA);
 }
 
+TEST_CASE("ApiBuffer")
+{
+    StateRef globalState(luaL_newstate(), lua_close);
+    lua_State* L = globalState.get();
+
+    lua_newbuffer(L, 1000);
+
+    REQUIRE(lua_type(L, -1) == LUA_TBUFFER);
+
+    CHECK(lua_isbuffer(L, -1));
+    CHECK(lua_objlen(L, -1) == 1000);
+
+    CHECK(strcmp(lua_typename(L, LUA_TBUFFER), "buffer") == 0);
+
+    CHECK(strcmp(luaL_typename(L, -1), "buffer") == 0);
+
+    void* p1 = lua_tobuffer(L, -1, nullptr);
+
+    size_t len = 0;
+    void* p2 = lua_tobuffer(L, -1, &len);
+    CHECK(len == 1000);
+    CHECK(p1 == p2);
+
+    void* p3 = luaL_checkbuffer(L, -1, nullptr);
+    CHECK(p1 == p3);
+
+    len = 0;
+    void* p4 = luaL_checkbuffer(L, -1, &len);
+    CHECK(len == 1000);
+    CHECK(p1 == p4);
+
+    memset(p1, 0xab, 1000);
+
+    CHECK(lua_topointer(L, -1) != nullptr);
+
+    lua_newbuffer(L, 0);
+
+    lua_pushvalue(L, -2);
+
+    CHECK(lua_equal(L, -3, -1));
+    CHECK(!lua_equal(L, -2, -1));
+
+    lua_pop(L, 1);
+}
+
 TEST_CASE("AllocApi")
 {
     int ud = 0;
@@ -1361,7 +1409,8 @@ TEST_CASE("GCDump")
 {
     // internal function, declared in lgc.h - not exposed via lua.h
     extern void luaC_dump(lua_State * L, void* file, const char* (*categoryName)(lua_State * L, uint8_t memcat));
-    extern void luaC_enumheap(lua_State * L, void* context, void (*node)(void* context, void* ptr, uint8_t tt, uint8_t memcat, const char* name),
+    extern void luaC_enumheap(lua_State * L, void* context,
+        void (*node)(void* context, void* ptr, uint8_t tt, uint8_t memcat, size_t size, const char* name),
         void (*edge)(void* context, void* from, void* to, const char* name));
 
     StateRef globalState(luaL_newstate(), lua_close);
@@ -1372,6 +1421,9 @@ TEST_CASE("GCDump")
     lua_pushstring(L, "value");
     lua_setfield(L, -2, "key");
 
+    lua_pushstring(L, "u42");
+    lua_setfield(L, -2, "__type");
+
     lua_pushinteger(L, 42);
     lua_rawseti(L, -2, 1000);
 
@@ -1388,6 +1440,8 @@ TEST_CASE("GCDump")
     lua_pushinteger(L, 1);
     lua_pushcclosure(L, lua_silence, "test", 1);
 
+    lua_newbuffer(L, 100);
+
     lua_State* CL = lua_newthread(L);
 
     lua_pushstring(CL, "local x x = {} local function f() x[1] = math.abs(42) end function foo() coroutine.yield() end foo() return f");
@@ -1412,6 +1466,7 @@ TEST_CASE("GCDump")
         void* ptr;
         uint8_t tag;
         uint8_t memcat;
+        size_t size;
         std::string name;
     };
 
@@ -1429,9 +1484,13 @@ TEST_CASE("GCDump")
 
     luaC_enumheap(
         L, &ctx,
-        [](void* ctx, void* gco, uint8_t tt, uint8_t memcat, const char* name) {
+        [](void* ctx, void* gco, uint8_t tt, uint8_t memcat, size_t size, const char* name) {
             EnumContext& context = *(EnumContext*)ctx;
-            context.nodes[gco] = {gco, tt, memcat, name ? name : ""};
+
+            if (tt == LUA_TUSERDATA)
+                CHECK(strcmp(name, "u42") == 0);
+
+            context.nodes[gco] = {gco, tt, memcat, size, name ? name : ""};
         },
         [](void* ctx, void* s, void* t, const char*) {
             EnumContext& context = *(EnumContext*)ctx;
@@ -1819,6 +1878,8 @@ TEST_CASE("SafeEnv")
 
 TEST_CASE("Native")
 {
+    ScopedFastFlag luauLowerAltLoopForn{"LuauLowerAltLoopForn", true};
+
     runConformance("native.lua");
 }
 
diff --git a/tests/DataFlowGraph.test.cpp b/tests/DataFlowGraph.test.cpp
index bd5fe5628..cd91039b9 100644
--- a/tests/DataFlowGraph.test.cpp
+++ b/tests/DataFlowGraph.test.cpp
@@ -33,19 +33,11 @@ struct DataFlowGraphFixture
     }
 
     template<typename T, int N>
-    NullableBreadcrumbId getBreadcrumb(const std::vector<Nth>& nths = {nth<T>(N)})
+    DefId getDef(const std::vector<Nth>& nths = {nth<T>(N)})
     {
         T* node = query<T, N>(module, nths);
         REQUIRE(node);
-        return graph->getBreadcrumb(node);
-    }
-
-    template<typename T, int N>
-    BreadcrumbId requireBreadcrumb(const std::vector<Nth>& nths = {nth<T>(N)})
-    {
-        auto bc = getBreadcrumb<T, N>(nths);
-        REQUIRE(bc);
-        return NotNull{bc};
+        return graph->getDef(node);
     }
 };
 
@@ -58,7 +50,7 @@ TEST_CASE_FIXTURE(DataFlowGraphFixture, "define_locals_in_local_stat")
         local y = x
     )");
 
-    REQUIRE(getBreadcrumb<AstExprLocal, 1>());
+    (void)getDef<AstExprLocal, 1>();
 }
 
 TEST_CASE_FIXTURE(DataFlowGraphFixture, "define_parameters_in_functions")
@@ -69,7 +61,7 @@ TEST_CASE_FIXTURE(DataFlowGraphFixture, "define_parameters_in_functions")
         end
     )");
 
-    REQUIRE(getBreadcrumb<AstExprLocal, 1>());
+    (void)getDef<AstExprLocal, 1>();
 }
 
 TEST_CASE_FIXTURE(DataFlowGraphFixture, "find_aliases")
@@ -80,8 +72,8 @@ TEST_CASE_FIXTURE(DataFlowGraphFixture, "find_aliases")
         local z = y
     )");
 
-    BreadcrumbId x = requireBreadcrumb<AstExprLocal, 1>();
-    BreadcrumbId y = requireBreadcrumb<AstExprLocal, 2>();
+    DefId x = getDef<AstExprLocal, 1>();
+    DefId y = getDef<AstExprLocal, 2>();
     REQUIRE(x != y);
 }
 
@@ -95,8 +87,8 @@ TEST_CASE_FIXTURE(DataFlowGraphFixture, "independent_locals")
         local b = y
     )");
 
-    BreadcrumbId x = requireBreadcrumb<AstExprLocal, 1>();
-    BreadcrumbId y = requireBreadcrumb<AstExprLocal, 2>();
+    DefId x = getDef<AstExprLocal, 1>();
+    DefId y = getDef<AstExprLocal, 2>();
     REQUIRE(x != y);
 }
 
diff --git a/tests/DiffAsserts.cpp b/tests/DiffAsserts.cpp
new file mode 100644
index 000000000..f343367f9
--- /dev/null
+++ b/tests/DiffAsserts.cpp
@@ -0,0 +1,31 @@
+// This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
+
+#include "DiffAsserts.h"
+
+#include <string>
+
+namespace Luau
+{
+
+
+std::string toString(const DifferResult& result)
+{
+    if (result.diffError)
+        return result.diffError->toString();
+    else
+        return "<no diff>";
+}
+
+template<>
+std::string diff<TypeId, TypeId>(TypeId l, TypeId r)
+{
+    return toString(diff(l, r));
+}
+
+template<>
+std::string diff<const Type&, const Type&>(const Type& l, const Type& r)
+{
+    return toString(diff(&l, &r));
+}
+
+} // namespace Luau
diff --git a/tests/DiffAsserts.h b/tests/DiffAsserts.h
new file mode 100644
index 000000000..2c919c2ac
--- /dev/null
+++ b/tests/DiffAsserts.h
@@ -0,0 +1,46 @@
+// This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
+#pragma once
+
+#include "Luau/Differ.h"
+#include "Luau/TypeFwd.h"
+
+#include "doctest.h"
+
+#include <string>
+#include <type_traits>
+
+namespace Luau
+{
+
+std::string toString(const DifferResult& result);
+
+template<typename L, typename R>
+std::string diff(L, R)
+{
+    return "<undiffable>";
+}
+
+template<>
+std::string diff<TypeId, TypeId>(TypeId l, TypeId r);
+
+template<>
+std::string diff<const Type&, const Type&>(const Type& l, const Type& r);
+
+}
+
+// Note: the do-while blocks in the macros below is to scope the INFO block to
+// only that assertion.
+
+#define CHECK_EQ_DIFF(l, r) \
+    do \
+    { \
+        INFO("Left and right values were not equal: ", diff(l, r)); \
+        CHECK_EQ(l, r); \
+    } while(false);
+
+#define REQUIRE_EQ_DIFF(l, r) \
+    do \
+    { \
+        INFO("Left and right values were not equal: ", diff(l, r)); \
+        REQUIRE_EQ(l, r); \
+    } while(false);
diff --git a/tests/Differ.test.cpp b/tests/Differ.test.cpp
index 7335e9440..fded0715c 100644
--- a/tests/Differ.test.cpp
+++ b/tests/Differ.test.cpp
@@ -1329,6 +1329,8 @@ TEST_CASE_FIXTURE(DifferFixtureWithBuiltins, "equal_metatable")
 
 TEST_CASE_FIXTURE(DifferFixtureWithBuiltins, "metatable_normal")
 {
+    ScopedFastFlag sff{"DebugLuauDeferredConstraintResolution", false};
+
     CheckResult result = check(R"(
     local metaFoo = {
         metaBar = 5
diff --git a/tests/NonStrictTypeChecker.test.cpp b/tests/NonStrictTypeChecker.test.cpp
index eecb55bf5..8eb778c84 100644
--- a/tests/NonStrictTypeChecker.test.cpp
+++ b/tests/NonStrictTypeChecker.test.cpp
@@ -19,14 +19,15 @@ struct NonStrictTypeCheckerFixture : Fixture
     {
         ScopedFastFlag flags[] = {
             {"LuauCheckedFunctionSyntax", true},
+            {"DebugLuauDeferredConstraintResolution", true},
         };
-
+        LoadDefinitionFileResult res = loadDefinition(definitions);
+        LUAU_ASSERT(res.success);
         return check(Mode::Nonstrict, code);
     }
 
     std::string definitions = R"BUILTIN_SRC(
 declare function @checked abs(n: number): number
-abs("hi")
 )BUILTIN_SRC";
 };
 
@@ -36,11 +37,13 @@ TEST_SUITE_BEGIN("NonStrictTypeCheckerTest");
 TEST_CASE_FIXTURE(NonStrictTypeCheckerFixture, "simple_non_strict")
 {
     auto res = checkNonStrict(R"BUILTIN_SRC(
-declare function @checked abs(n: number): number
 abs("hi")
 )BUILTIN_SRC");
-
-    // LUAU_REQUIRE_ERRORS(res);
+    LUAU_REQUIRE_ERRORS(res);
+    REQUIRE(res.errors.size() == 1);
+    auto err = get<CheckedFunctionCallError>(res.errors[0]);
+    REQUIRE(err != nullptr);
+    REQUIRE(err->checkedFunctionName == "abs");
 }
 
 TEST_SUITE_END();
diff --git a/tests/Subtyping.test.cpp b/tests/Subtyping.test.cpp
index ae6cd1293..9dc193d88 100644
--- a/tests/Subtyping.test.cpp
+++ b/tests/Subtyping.test.cpp
@@ -1,5 +1,6 @@
 // This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
 
+#include "Luau/TypePath.h"
 #include "doctest.h"
 #include "Fixture.h"
 #include "RegisterCallbacks.h"
@@ -11,6 +12,16 @@
 
 using namespace Luau;
 
+namespace Luau
+{
+
+std::ostream& operator<<(std::ostream& lhs, const SubtypingReasoning& reasoning)
+{
+    return lhs << toString(reasoning.subPath) << " </: " << toString(reasoning.superPath);
+}
+
+}; // namespace Luau
+
 struct SubtypeFixture : Fixture
 {
     TypeArena arena;
@@ -1080,3 +1091,136 @@ TEST_CASE_FIXTURE(SubtypeFixture, "dont_cache_tests_involving_cycles")
 }
 
 TEST_SUITE_END();
+
+TEST_SUITE_BEGIN("Subtyping.Subpaths");
+
+TEST_CASE_FIXTURE(SubtypeFixture, "table_property")
+{
+    TypeId subTy = tbl({{"X", builtinTypes->numberType}});
+    TypeId superTy = tbl({{"X", builtinTypes->booleanType}});
+
+    SubtypingResult result = isSubtype(subTy, superTy);
+    CHECK(!result.isSubtype);
+    CHECK(result.reasoning == SubtypingReasoning{
+                                  /* subPath */ Path(TypePath::Property("X")),
+                                  /* superPath */ Path(TypePath::Property("X")),
+                              });
+}
+
+TEST_CASE_FIXTURE(SubtypeFixture, "table_indexers")
+{
+    TypeId subTy = idx(builtinTypes->numberType, builtinTypes->stringType);
+    TypeId superTy = idx(builtinTypes->stringType, builtinTypes->numberType);
+
+    SubtypingResult result = isSubtype(subTy, superTy);
+    CHECK(!result.isSubtype);
+    CHECK(result.reasoning == SubtypingReasoning{
+                                  /* subPath */ Path(TypePath::TypeField::IndexLookup),
+                                  /* superPath */ Path(TypePath::TypeField::IndexLookup),
+                              });
+
+    subTy = idx(builtinTypes->stringType, builtinTypes->stringType);
+    result = isSubtype(subTy, superTy);
+    CHECK(!result.isSubtype);
+    CHECK(result.reasoning == SubtypingReasoning{
+                                  /* subPath */ Path(TypePath::TypeField::IndexResult),
+                                  /* superPath */ Path(TypePath::TypeField::IndexResult),
+                              });
+}
+
+TEST_CASE_FIXTURE(SubtypeFixture, "fn_arguments")
+{
+    TypeId subTy = fn({builtinTypes->numberType}, {});
+    TypeId superTy = fn({builtinTypes->stringType}, {});
+
+    SubtypingResult result = isSubtype(subTy, superTy);
+    CHECK(!result.isSubtype);
+    CHECK(result.reasoning == SubtypingReasoning{
+                                  /* subPath */ TypePath::PathBuilder().args().index(0).build(),
+                                  /* superPath */ TypePath::PathBuilder().args().index(0).build(),
+                              });
+}
+
+TEST_CASE_FIXTURE(SubtypeFixture, "fn_arguments_tail")
+{
+    TypeId subTy = fn({}, VariadicTypePack{builtinTypes->numberType}, {});
+    TypeId superTy = fn({}, VariadicTypePack{builtinTypes->stringType}, {});
+
+    SubtypingResult result = isSubtype(subTy, superTy);
+    CHECK(!result.isSubtype);
+    CHECK(result.reasoning == SubtypingReasoning{
+                                  /* subPath */ TypePath::PathBuilder().args().tail().variadic().build(),
+                                  /* superPath */ TypePath::PathBuilder().args().tail().variadic().build(),
+                              });
+}
+
+TEST_CASE_FIXTURE(SubtypeFixture, "fn_rets")
+{
+    TypeId subTy = fn({}, {builtinTypes->numberType});
+    TypeId superTy = fn({}, {builtinTypes->stringType});
+
+    SubtypingResult result = isSubtype(subTy, superTy);
+    CHECK(!result.isSubtype);
+    CHECK(result.reasoning == SubtypingReasoning{
+                                  /* subPath */ TypePath::PathBuilder().rets().index(0).build(),
+                                  /* superPath */ TypePath::PathBuilder().rets().index(0).build(),
+                              });
+}
+
+TEST_CASE_FIXTURE(SubtypeFixture, "fn_rets_tail")
+{
+    TypeId subTy = fn({}, {}, VariadicTypePack{builtinTypes->numberType});
+    TypeId superTy = fn({}, {}, VariadicTypePack{builtinTypes->stringType});
+
+    SubtypingResult result = isSubtype(subTy, superTy);
+    CHECK(!result.isSubtype);
+    CHECK(result.reasoning == SubtypingReasoning{
+                                  /* subPath */ TypePath::PathBuilder().rets().tail().variadic().build(),
+                                  /* superPath */ TypePath::PathBuilder().rets().tail().variadic().build(),
+                              });
+}
+
+TEST_CASE_FIXTURE(SubtypeFixture, "nested_table_properties")
+{
+    TypeId subTy = tbl({{"X", tbl({{"Y", tbl({{"Z", builtinTypes->numberType}})}})}});
+    TypeId superTy = tbl({{"X", tbl({{"Y", tbl({{"Z", builtinTypes->stringType}})}})}});
+
+    SubtypingResult result = isSubtype(subTy, superTy);
+    CHECK(!result.isSubtype);
+    CHECK(result.reasoning == SubtypingReasoning{
+                                  /* subPath */ TypePath::PathBuilder().prop("X").prop("Y").prop("Z").build(),
+                                  /* superPath */ TypePath::PathBuilder().prop("X").prop("Y").prop("Z").build(),
+                              });
+}
+
+TEST_CASE_FIXTURE(SubtypeFixture, "string_table_mt")
+{
+    TypeId subTy = builtinTypes->stringType;
+    TypeId superTy = tbl({{"X", builtinTypes->numberType}});
+
+    SubtypingResult result = isSubtype(subTy, superTy);
+    CHECK(!result.isSubtype);
+    // This check is weird. Because we don't have built-in types, we don't have
+    // the string metatable. That means subtyping will see that the entire
+    // metatable is empty, and abort there, without looking at the metatable
+    // properties (because there aren't any).
+    CHECK(result.reasoning == SubtypingReasoning{
+                                  /* subPath */ TypePath::PathBuilder().mt().prop("__index").build(),
+                                  /* superPath */ TypePath::kEmpty,
+                              });
+}
+
+TEST_CASE_FIXTURE(SubtypeFixture, "negation")
+{
+    TypeId subTy = builtinTypes->numberType;
+    TypeId superTy = negate(builtinTypes->numberType);
+
+    SubtypingResult result = isSubtype(subTy, superTy);
+    CHECK(!result.isSubtype);
+    CHECK(result.reasoning == SubtypingReasoning{
+                                  /* subPath */ TypePath::kEmpty,
+                                  /* superPath */ Path(TypePath::TypeField::Negated),
+                              });
+}
+
+TEST_SUITE_END();
diff --git a/tests/ToString.test.cpp b/tests/ToString.test.cpp
index 932b5b280..6c667ee62 100644
--- a/tests/ToString.test.cpp
+++ b/tests/ToString.test.cpp
@@ -973,4 +973,25 @@ Type 'string' could not be converted into 'number' in an invariant context)";
 
     CHECK(expected == actual);
 }
+
+TEST_CASE_FIXTURE(Fixture, "checked_fn_toString")
+{
+    ScopedFastFlag flags[] = {
+        {"LuauCheckedFunctionSyntax", true},
+        {"DebugLuauDeferredConstraintResolution", true},
+    };
+
+    auto _result = loadDefinition(R"(
+declare function @checked abs(n: number) : number
+)");
+
+    auto result = check(Mode::Nonstrict, R"(
+local f = abs
+)");
+
+    LUAU_REQUIRE_NO_ERRORS(result);
+
+    TypeId fn = requireType("f");
+    CHECK("@checked (number) -> number" == toString(fn));
+}
 TEST_SUITE_END();
diff --git a/tests/TypeInfer.aliases.test.cpp b/tests/TypeInfer.aliases.test.cpp
index 8f09acafd..3f6d90fa9 100644
--- a/tests/TypeInfer.aliases.test.cpp
+++ b/tests/TypeInfer.aliases.test.cpp
@@ -185,6 +185,7 @@ TEST_CASE_FIXTURE(Fixture, "mutually_recursive_aliases")
     LUAU_REQUIRE_NO_ERRORS(result);
 }
 
+#if 0
 TEST_CASE_FIXTURE(Fixture, "generic_aliases")
 {
     ScopedFastFlag sff[] = {
@@ -198,7 +199,8 @@ TEST_CASE_FIXTURE(Fixture, "generic_aliases")
     )");
 
     LUAU_REQUIRE_ERROR_COUNT(1, result);
-    const std::string expected = "Type 'bad' could not be converted into 'T<number>'";
+    const std::string expected =
+        R"(Type 'bad' could not be converted into 'T<number>'; type bad["v"] (string) is not a subtype of T<number>["v"] (number))";
     CHECK(result.errors[0].location == Location{{4, 31}, {4, 44}});
     CHECK_EQ(expected, toString(result.errors[0]));
 }
@@ -217,11 +219,13 @@ TEST_CASE_FIXTURE(Fixture, "dependent_generic_aliases")
     )");
 
     LUAU_REQUIRE_ERROR_COUNT(1, result);
-    const std::string expected = "Type 'bad' could not be converted into 'U<number>'";
+    const std::string expected =
+        R"(Type 'bad' could not be converted into 'U<number>'; type bad["t"]["v"] (string) is not a subtype of U<number>["t"]["v"] (number))";
 
     CHECK(result.errors[0].location == Location{{4, 31}, {4, 52}});
     CHECK_EQ(expected, toString(result.errors[0]));
 }
+#endif
 
 TEST_CASE_FIXTURE(Fixture, "mutually_recursive_generic_aliases")
 {
diff --git a/tests/TypeInfer.annotations.test.cpp b/tests/TypeInfer.annotations.test.cpp
index 4feb3a6d0..f71b1bf0c 100644
--- a/tests/TypeInfer.annotations.test.cpp
+++ b/tests/TypeInfer.annotations.test.cpp
@@ -7,6 +7,8 @@
 
 #include "doctest.h"
 
+LUAU_FASTFLAG(DebugLuauDeferredConstraintResolution);
+
 using namespace Luau;
 
 TEST_SUITE_BEGIN("AnnotationTests");
@@ -166,12 +168,24 @@ TEST_CASE_FIXTURE(Fixture, "infer_type_of_value_a_via_typeof_with_assignment")
         a = "foo"
     )");
 
-    CHECK_EQ(*builtinTypes->numberType, *requireType("a"));
-    CHECK_EQ(*builtinTypes->numberType, *requireType("b"));
+    if (FFlag::DebugLuauDeferredConstraintResolution)
+    {
+        CHECK("string?" == toString(requireType("a")));
+        CHECK("nil" == toString(requireType("b")));
 
-    LUAU_REQUIRE_ERROR_COUNT(1, result);
-    CHECK_EQ(
-        result.errors[0], (TypeError{Location{Position{4, 12}, Position{4, 17}}, TypeMismatch{builtinTypes->numberType, builtinTypes->stringType}}));
+        LUAU_REQUIRE_ERROR_COUNT(1, result);
+        CHECK(
+            result.errors[0] == (TypeError{Location{Position{2, 29}, Position{2, 30}}, TypeMismatch{builtinTypes->nilType, builtinTypes->numberType}}));
+    }
+    else
+    {
+        CHECK_EQ(*builtinTypes->numberType, *requireType("a"));
+        CHECK_EQ(*builtinTypes->numberType, *requireType("b"));
+
+        LUAU_REQUIRE_ERROR_COUNT(1, result);
+        CHECK_EQ(
+            result.errors[0], (TypeError{Location{Position{4, 12}, Position{4, 17}}, TypeMismatch{builtinTypes->numberType, builtinTypes->stringType}}));
+    }
 }
 
 TEST_CASE_FIXTURE(Fixture, "table_annotation")
diff --git a/tests/TypeInfer.anyerror.test.cpp b/tests/TypeInfer.anyerror.test.cpp
index 5601b8af8..1e3db8204 100644
--- a/tests/TypeInfer.anyerror.test.cpp
+++ b/tests/TypeInfer.anyerror.test.cpp
@@ -171,7 +171,7 @@ TEST_CASE_FIXTURE(Fixture, "can_subscript_any")
 TEST_CASE_FIXTURE(Fixture, "can_get_length_of_any")
 {
     CheckResult result = check(R"(
-        local foo: any = {}
+        local foo = ({} :: any)
         local bar = #foo
     )");
 
diff --git a/tests/TypeInfer.intersectionTypes.test.cpp b/tests/TypeInfer.intersectionTypes.test.cpp
index 6892c78f7..18b8ab8ae 100644
--- a/tests/TypeInfer.intersectionTypes.test.cpp
+++ b/tests/TypeInfer.intersectionTypes.test.cpp
@@ -976,6 +976,7 @@ local y = x["Bar"]
     LUAU_REQUIRE_NO_ERRORS(result);
 }
 
+#if 0
 TEST_CASE_FIXTURE(Fixture, "cli_80596_simplify_degenerate_intersections")
 {
     ScopedFastFlag dcr{"DebugLuauDeferredConstraintResolution", true};
@@ -1025,5 +1026,6 @@ TEST_CASE_FIXTURE(Fixture, "cli_80596_simplify_more_realistic_intersections")
 
     LUAU_REQUIRE_ERRORS(result);
 }
+#endif
 
 TEST_SUITE_END();
diff --git a/tests/TypeInfer.operators.test.cpp b/tests/TypeInfer.operators.test.cpp
index 02a46d9e9..75f1ce035 100644
--- a/tests/TypeInfer.operators.test.cpp
+++ b/tests/TypeInfer.operators.test.cpp
@@ -516,17 +516,26 @@ TEST_CASE_FIXTURE(BuiltinsFixture, "typecheck_unary_minus")
         local c = -bar -- disallowed
     )");
 
-    LUAU_REQUIRE_ERROR_COUNT(1, result);
-
     CHECK_EQ("string", toString(requireType("a")));
     CHECK_EQ("number", toString(requireType("b")));
 
     if (FFlag::DebugLuauDeferredConstraintResolution)
     {
-        CHECK(toString(result.errors[0]) == "Type 'bar' could not be converted into 'number'");
+        LUAU_REQUIRE_ERROR_COUNT(2, result);
+
+        UninhabitedTypeFamily* utf = get<UninhabitedTypeFamily>(result.errors[0]);
+        REQUIRE(utf);
+        CHECK_EQ(toString(utf->ty), "unm<bar>");
+
+        TypeMismatch* tm = get<TypeMismatch>(result.errors[1]);
+        REQUIRE(tm);
+        CHECK_EQ(toString(tm->givenType), "bar");
+        CHECK_EQ(*tm->wantedType, *builtinTypes->numberType);
     }
     else
     {
+        LUAU_REQUIRE_ERROR_COUNT(1, result);
+
         GenericError* gen = get<GenericError>(result.errors[0]);
         REQUIRE(gen);
         REQUIRE_EQ(gen->message, "Unary operator '-' not supported by type 'bar'");
diff --git a/tests/TypeInfer.primitives.test.cpp b/tests/TypeInfer.primitives.test.cpp
index 949e64a57..640e693b9 100644
--- a/tests/TypeInfer.primitives.test.cpp
+++ b/tests/TypeInfer.primitives.test.cpp
@@ -8,6 +8,7 @@
 #include "Luau/VisitType.h"
 
 #include "Fixture.h"
+#include "DiffAsserts.h"
 
 #include "doctest.h"
 
@@ -31,7 +32,7 @@ TEST_CASE_FIXTURE(Fixture, "string_length")
     )");
 
     LUAU_REQUIRE_NO_ERRORS(result);
-    CHECK_EQ("number", toString(requireType("t")));
+    CHECK_EQ_DIFF(builtinTypes->numberType, requireType("t"));
 }
 
 TEST_CASE_FIXTURE(Fixture, "string_index")
diff --git a/tests/TypeInfer.refinements.test.cpp b/tests/TypeInfer.refinements.test.cpp
index a1aa38c5e..55bec5af3 100644
--- a/tests/TypeInfer.refinements.test.cpp
+++ b/tests/TypeInfer.refinements.test.cpp
@@ -289,7 +289,7 @@ TEST_CASE_FIXTURE(Fixture, "type_assertion_expr_carry_its_constraints")
 
 TEST_CASE_FIXTURE(BuiltinsFixture, "typeguard_in_if_condition_position")
 {
-    CheckResult result1 = check(R"(
+    CheckResult result = check(R"(
         function f(s: any, t: unknown)
             if type(s) == "number" then
                 local n = s
@@ -300,7 +300,7 @@ TEST_CASE_FIXTURE(BuiltinsFixture, "typeguard_in_if_condition_position")
         end
     )");
 
-    LUAU_REQUIRE_NO_ERRORS(result1);
+    LUAU_REQUIRE_NO_ERRORS(result);
 
     // DCR changes refinements to preserve error suppression.
     if (FFlag::DebugLuauDeferredConstraintResolution)
@@ -1922,9 +1922,8 @@ TEST_CASE_FIXTURE(BuiltinsFixture, "refine_unknown_to_table")
 
     LUAU_REQUIRE_NO_ERRORS(result);
 
-    // TODO: they should be `unknown`, not `nil`.
-    CHECK_EQ("nil", toString(requireType("idx")));
-    CHECK_EQ("nil", toString(requireType("val")));
+    CHECK_EQ("unknown", toString(requireType("idx")));
+    CHECK_EQ("unknown", toString(requireType("val")));
 }
 
 TEST_CASE_FIXTURE(BuiltinsFixture, "conditional_refinement_should_stay_error_suppressing")
@@ -1993,4 +1992,17 @@ TEST_CASE_FIXTURE(BuiltinsFixture, "globals_can_be_narrowed_too")
     CHECK("never" == toString(requireTypeAtPosition(Position{2, 24})));
 }
 
+TEST_CASE_FIXTURE(BuiltinsFixture, "ex")
+{
+    CheckResult result = check(R"(
+local function f(x: string | number)
+    if typeof((x)) == "string" then
+        local y = x
+    end
+end
+)");
+    TypeId t = requireTypeAtPosition({3, 18});
+    CHECK("string" == toString(t));
+}
+
 TEST_SUITE_END();
diff --git a/tests/TypeInfer.singletons.test.cpp b/tests/TypeInfer.singletons.test.cpp
index 16d421f82..97ee15e1a 100644
--- a/tests/TypeInfer.singletons.test.cpp
+++ b/tests/TypeInfer.singletons.test.cpp
@@ -350,6 +350,7 @@ Table type 'a' not compatible with type 'Bad' because the former is missing fiel
     CHECK_EQ(expected, toString(result.errors[0]));
 }
 
+#if 0
 TEST_CASE_FIXTURE(Fixture, "parametric_tagged_union_alias")
 {
     ScopedFastFlag sff[] = {
@@ -366,10 +367,12 @@ TEST_CASE_FIXTURE(Fixture, "parametric_tagged_union_alias")
 
     LUAU_REQUIRE_ERROR_COUNT(1, result);
 
-    const std::string expectedError = "Type 'a' could not be converted into 'Err<number> | Ok<string>'";
+    const std::string expectedError =
+        "Type 'a' could not be converted into 'Err<number> | Ok<string>'; type a (a) is not a subtype of Err<number> | Ok<string>[1] (Err<number>)";
 
     CHECK(toString(result.errors[0]) == expectedError);
 }
+#endif
 
 TEST_CASE_FIXTURE(Fixture, "if_then_else_expression_singleton_options")
 {
diff --git a/tests/TypeInfer.tables.test.cpp b/tests/TypeInfer.tables.test.cpp
index 15104ab2b..d5ae004cf 100644
--- a/tests/TypeInfer.tables.test.cpp
+++ b/tests/TypeInfer.tables.test.cpp
@@ -756,8 +756,9 @@ TEST_CASE_FIXTURE(Fixture, "infer_indexer_from_its_variable_type_and_unifiable")
     TypeMismatch* tm = get<TypeMismatch>(result.errors[0]);
     REQUIRE(tm != nullptr);
 
-    const TableType* tTy = get<TableType>(requireType("t2"));
-    REQUIRE(tTy != nullptr);
+    TypeId t2Ty = requireType("t2");
+    const TableType* tTy = get<TableType>(t2Ty);
+    REQUIRE_MESSAGE(tTy != nullptr, "Expected a table but got " << toString(t2Ty));
 
     REQUIRE(tTy->indexer);
     CHECK_EQ(*builtinTypes->numberType, *tTy->indexer->indexType);
@@ -954,8 +955,9 @@ TEST_CASE_FIXTURE(Fixture, "assigning_to_an_unsealed_table_with_string_literal_s
 
     CHECK("string" == toString(*builtinTypes->stringType));
 
-    TableType* tableType = getMutable<TableType>(requireType("t"));
-    REQUIRE(tableType != nullptr);
+    TypeId tType = requireType("t");
+    TableType* tableType = getMutable<TableType>(tType);
+    REQUIRE_MESSAGE(tableType != nullptr, "Expected a table but got " << toString(tType, {true}));
     REQUIRE(tableType->indexer == std::nullopt);
     REQUIRE(0 != tableType->props.count("a"));
 
@@ -1966,7 +1968,7 @@ TEST_CASE_FIXTURE(BuiltinsFixture, "quantifying_a_bound_var_works")
     LUAU_REQUIRE_NO_ERRORS(result);
     TypeId ty = requireType("clazz");
     TableType* ttv = getMutable<TableType>(ty);
-    REQUIRE(ttv);
+    REQUIRE_MESSAGE(ttv, "Expected a table but got " << toString(ty, {true}));
     REQUIRE(ttv->props.count("new"));
     Property& prop = ttv->props["new"];
     REQUIRE(prop.type());
@@ -2389,7 +2391,10 @@ local x: {number} | number | string
 local y = #x
     )");
 
-    LUAU_REQUIRE_ERROR_COUNT(1, result);
+    if (FFlag::DebugLuauDeferredConstraintResolution)
+        LUAU_REQUIRE_ERROR_COUNT(2, result);
+    else
+        LUAU_REQUIRE_ERROR_COUNT(1, result);
 }
 
 TEST_CASE_FIXTURE(BuiltinsFixture, "dont_hang_when_trying_to_look_up_in_cyclic_metatable_index")
diff --git a/tests/TypeInfer.typestates.test.cpp b/tests/TypeInfer.typestates.test.cpp
index 9a938f901..c15d5c0f1 100644
--- a/tests/TypeInfer.typestates.test.cpp
+++ b/tests/TypeInfer.typestates.test.cpp
@@ -119,4 +119,82 @@ TEST_CASE_FIXTURE(TypeStateFixture, "assign_a_local_and_then_refine_it")
     CHECK("Type 'string' could not be converted into 'never'" == toString(result.errors[0]));
 }
 
+TEST_CASE_FIXTURE(TypeStateFixture, "recursive_local_function")
+{
+    CheckResult result = check(R"(
+        local function f(x)
+            f(5)
+        end
+    )");
+
+    LUAU_REQUIRE_NO_ERRORS(result);
+}
+
+TEST_CASE_FIXTURE(TypeStateFixture, "recursive_function")
+{
+    CheckResult result = check(R"(
+        function f(x)
+            f(5)
+        end
+    )");
+
+    LUAU_REQUIRE_NO_ERRORS(result);
+}
+
+TEST_CASE_FIXTURE(TypeStateFixture, "compound_assignment")
+{
+    CheckResult result = check(R"(
+        local x = 5
+        x += 7
+
+        local a = x
+    )");
+
+    LUAU_REQUIRE_NO_ERRORS(result);
+}
+
+TEST_CASE_FIXTURE(TypeStateFixture, "assignment_identity")
+{
+    CheckResult result = check(R"(
+        local x = 5
+        x = x
+
+        local a = x
+    )");
+
+    LUAU_REQUIRE_NO_ERRORS(result);
+    CHECK("number" == toString(requireType("a")));
+}
+
+TEST_CASE_FIXTURE(TypeStateFixture, "assignment_swap")
+{
+    CheckResult result = check(R"(
+        local x, y = 5, "hello"
+        x, y = y, x
+
+        local a, b = x, y
+    )");
+
+    LUAU_REQUIRE_NO_ERRORS(result);
+    CHECK("string" == toString(requireType("a")));
+    CHECK("number" == toString(requireType("b")));
+}
+
+TEST_CASE_FIXTURE(TypeStateFixture, "parameter_x_was_constrained_by_two_types")
+{
+    CheckResult result = check(R"(
+        local function f(x): number?
+            local y: string? = nil  -- 'y <: string?
+            y = x                   -- 'y ~ 'x
+            return y                -- 'y <: number?
+
+                                    -- We therefore infer 'y <: (string | nil) & (number | nil)
+                                    -- or 'y <: nil
+        end
+    )");
+
+    LUAU_REQUIRE_NO_ERRORS(result);
+    CHECK("(nil) -> number?" == toString(requireType("f")));
+}
+
 TEST_SUITE_END();
diff --git a/tests/TypePath.test.cpp b/tests/TypePath.test.cpp
new file mode 100644
index 000000000..53127c3de
--- /dev/null
+++ b/tests/TypePath.test.cpp
@@ -0,0 +1,541 @@
+// This file is part of the Luau programming language and is licensed under MIT License; see LICENSE.txt for details
+#include "Luau/TypePath.h"
+
+#include "Luau/Type.h"
+#include "Luau/TypeArena.h"
+#include "Luau/TypePack.h"
+
+#include "ClassFixture.h"
+#include "doctest.h"
+#include "Fixture.h"
+#include "ScopedFlags.h"
+
+#include <optional>
+
+using namespace Luau;
+using namespace Luau::TypePath;
+
+TEST_SUITE_BEGIN("TypePathManipulation");
+
+TEST_CASE("append")
+{
+    SUBCASE("empty_paths")
+    {
+        Path p;
+        CHECK(p.append(Path{}).empty());
+    }
+
+    SUBCASE("empty_path_with_path")
+    {
+        Path p1;
+        Path p2(TypeField::Metatable);
+
+        Path result = p1.append(p2);
+        CHECK(result == Path(TypeField::Metatable));
+    }
+
+    SUBCASE("two_paths")
+    {
+        Path p1(TypeField::IndexLookup);
+        Path p2(TypeField::Metatable);
+
+        Path result = p1.append(p2);
+        CHECK(result == Path({TypeField::IndexLookup, TypeField::Metatable}));
+    }
+
+    SUBCASE("all_components")
+    {
+        Path p1({TypeField::IndexLookup, TypeField::Metatable});
+        Path p2({TypeField::Metatable, PackField::Arguments});
+
+        Path result = p1.append(p2);
+        CHECK(result == Path({TypeField::IndexLookup, TypeField::Metatable, TypeField::Metatable, PackField::Arguments}));
+    }
+
+    SUBCASE("does_not_mutate")
+    {
+        Path p1(TypeField::IndexLookup);
+        Path p2(TypeField::Metatable);
+
+        p1.append(p2);
+        CHECK(p1 == Path(TypeField::IndexLookup));
+        CHECK(p2 == Path(TypeField::Metatable));
+    }
+}
+
+TEST_CASE("push")
+{
+    Path p;
+    Path result = p.push(TypeField::Metatable);
+
+    CHECK(p.empty());
+    CHECK(result == Path(TypeField::Metatable));
+}
+
+TEST_CASE("pop")
+{
+    SUBCASE("empty_path")
+    {
+        Path p;
+        CHECK(p.empty());
+        CHECK(p.pop().empty());
+    }
+}
+
+TEST_SUITE_END(); // TypePathManipulation
+
+TEST_SUITE_BEGIN("TypePathTraversal");
+
+#define TYPESOLVE_CODE(code) \
+    do \
+    { \
+        CheckResult result = check(code); \
+        LUAU_REQUIRE_NO_ERRORS(result); \
+    } while (false);
+
+#if 0
+TEST_CASE_FIXTURE(Fixture, "empty_traversal")
+{
+    CHECK(traverseForType(builtinTypes->numberType, kEmpty, builtinTypes) == builtinTypes->numberType);
+}
+
+TEST_CASE_FIXTURE(Fixture, "table_property")
+{
+    TYPESOLVE_CODE(R"(
+        local x = { y = 123 }
+    )");
+
+    CHECK(traverseForType(requireType("x"), Path(TypePath::Property{"y", true}), builtinTypes) == builtinTypes->numberType);
+}
+
+TEST_CASE_FIXTURE(ClassFixture, "class_property")
+{
+    CHECK(traverseForType(vector2InstanceType, Path(TypePath::Property{"X", true}), builtinTypes) == builtinTypes->numberType);
+}
+
+TEST_CASE_FIXTURE(Fixture, "index")
+{
+    SUBCASE("unions")
+    {
+        TYPESOLVE_CODE(R"(
+            type T = number | string | boolean
+        )");
+
+        SUBCASE("in_bounds")
+        {
+            CHECK(traverseForType(requireTypeAlias("T"), Path(TypePath::Index{1}), builtinTypes) == builtinTypes->stringType);
+        }
+
+        SUBCASE("out_of_bounds")
+        {
+            CHECK(traverseForType(requireTypeAlias("T"), Path(TypePath::Index{97}), builtinTypes) == std::nullopt);
+        }
+    }
+
+    SUBCASE("intersections")
+    {
+        // use functions to avoid the intersection being normalized away
+        TYPESOLVE_CODE(R"(
+            type T = (() -> ()) & ((true) -> false) & ((false) -> true)
+        )");
+
+        SUBCASE("in_bounds")
+        {
+            auto result = traverseForType(requireTypeAlias("T"), Path(TypePath::Index{1}), builtinTypes);
+            CHECK(result);
+
+            if (result)
+                CHECK(toString(*result) == "(true) -> false");
+        }
+
+        SUBCASE("out_of_bounds")
+        {
+            CHECK(traverseForType(requireTypeAlias("T"), Path(TypePath::Index{97}), builtinTypes) == std::nullopt);
+        }
+    }
+
+    SUBCASE("type_packs")
+    {
+        // use functions to avoid the intersection being normalized away
+        TYPESOLVE_CODE(R"(
+            type T = (number, string, true, false) -> ()
+        )");
+
+        SUBCASE("in_bounds")
+        {
+            Path path = Path({TypePath::PackField::Arguments, TypePath::Index{1}});
+            auto result = traverseForType(requireTypeAlias("T"), path, builtinTypes);
+            CHECK(result == builtinTypes->stringType);
+        }
+
+        SUBCASE("out_of_bounds")
+        {
+            Path path = Path({TypePath::PackField::Arguments, TypePath::Index{72}});
+            auto result = traverseForType(requireTypeAlias("T"), path, builtinTypes);
+            CHECK(result == std::nullopt);
+        }
+    }
+}
+
+TEST_CASE_FIXTURE(ClassFixture, "metatables")
+{
+    SUBCASE("string")
+    {
+        auto result = traverseForType(builtinTypes->stringType, Path(TypeField::Metatable), builtinTypes);
+        CHECK(result == getMetatable(builtinTypes->stringType, builtinTypes));
+    }
+
+    SUBCASE("string_singleton")
+    {
+        TYPESOLVE_CODE(R"(
+            type T = "foo"
+        )");
+
+        auto result = traverseForType(requireTypeAlias("T"), Path(TypeField::Metatable), builtinTypes);
+        CHECK(result == getMetatable(builtinTypes->stringType, builtinTypes));
+    }
+
+    SUBCASE("table")
+    {
+        TYPESOLVE_CODE(R"(
+            local mt = { foo = 123 }
+            local tbl = setmetatable({}, mt)
+        )");
+
+        auto result = traverseForType(requireType("tbl"), Path(TypeField::Metatable), builtinTypes);
+        CHECK(result == requireType("mt"));
+    }
+
+    SUBCASE("class")
+    {
+        auto result = traverseForType(vector2InstanceType, Path(TypeField::Metatable), builtinTypes);
+        // ClassFixture's Vector2 metatable is just an empty table, but it's there.
+        CHECK(result);
+    }
+}
+
+TEST_CASE_FIXTURE(Fixture, "bounds")
+{
+    SUBCASE("free_type")
+    {
+        TypeArena& arena = frontend.globals.globalTypes;
+        unfreeze(arena);
+
+        TypeId ty = arena.freshType(frontend.globals.globalScope.get());
+        FreeType* ft = getMutable<FreeType>(ty);
+
+        SUBCASE("upper")
+        {
+            ft->upperBound = builtinTypes->numberType;
+            auto result = traverseForType(ty, Path(TypeField::UpperBound), builtinTypes);
+            CHECK(result == builtinTypes->numberType);
+        }
+
+        SUBCASE("lower")
+        {
+            ft->lowerBound = builtinTypes->booleanType;
+            auto result = traverseForType(ty, Path(TypeField::LowerBound), builtinTypes);
+            CHECK(result == builtinTypes->booleanType);
+        }
+    }
+
+    SUBCASE("unbounded_type")
+    {
+        CHECK(traverseForType(builtinTypes->numberType, Path(TypeField::UpperBound), builtinTypes) == std::nullopt);
+        CHECK(traverseForType(builtinTypes->numberType, Path(TypeField::LowerBound), builtinTypes) == std::nullopt);
+    }
+}
+
+TEST_CASE_FIXTURE(Fixture, "indexers")
+{
+    SUBCASE("table")
+    {
+        SUBCASE("lookup_indexer")
+        {
+            TYPESOLVE_CODE(R"(
+                type T = { [string]: boolean }
+            )");
+
+            auto lookupResult = traverseForType(requireTypeAlias("T"), Path(TypeField::IndexLookup), builtinTypes);
+            auto resultResult = traverseForType(requireTypeAlias("T"), Path(TypeField::IndexResult), builtinTypes);
+
+            CHECK(lookupResult == builtinTypes->stringType);
+            CHECK(resultResult == builtinTypes->booleanType);
+        }
+
+        SUBCASE("no_indexer")
+        {
+            TYPESOLVE_CODE(R"(
+                type T = { y: number }
+            )");
+
+            auto lookupResult = traverseForType(requireTypeAlias("T"), Path(TypeField::IndexLookup), builtinTypes);
+            auto resultResult = traverseForType(requireTypeAlias("T"), Path(TypeField::IndexResult), builtinTypes);
+
+            CHECK(lookupResult == std::nullopt);
+            CHECK(resultResult == std::nullopt);
+        }
+    }
+
+    // TODO: Class types
+}
+
+TEST_CASE_FIXTURE(Fixture, "negated")
+{
+    SUBCASE("valid")
+    {
+        TypeArena& arena = frontend.globals.globalTypes;
+        unfreeze(arena);
+
+        TypeId ty = arena.addType(NegationType{builtinTypes->numberType});
+        auto result = traverseForType(ty, Path(TypeField::Negated), builtinTypes);
+        CHECK(result == builtinTypes->numberType);
+    }
+
+    SUBCASE("not_negation")
+    {
+        auto result = traverseForType(builtinTypes->numberType, Path(TypeField::Negated), builtinTypes);
+        CHECK(result == std::nullopt);
+    }
+}
+
+TEST_CASE_FIXTURE(Fixture, "variadic")
+{
+    SUBCASE("valid")
+    {
+        TypeArena& arena = frontend.globals.globalTypes;
+        unfreeze(arena);
+
+        TypePackId tp = arena.addTypePack(VariadicTypePack{builtinTypes->numberType});
+        auto result = traverseForType(tp, Path(TypeField::Variadic), builtinTypes);
+        CHECK(result == builtinTypes->numberType);
+    }
+
+    SUBCASE("not_variadic")
+    {
+        auto result = traverseForType(builtinTypes->numberType, Path(TypeField::Variadic), builtinTypes);
+        CHECK(result == std::nullopt);
+    }
+}
+
+TEST_CASE_FIXTURE(Fixture, "arguments")
+{
+    SUBCASE("function")
+    {
+        TYPESOLVE_CODE(R"(
+            function f(x: number, y: string)
+            end
+        )");
+
+        auto result = traverseForPack(requireType("f"), Path(PackField::Arguments), builtinTypes);
+        CHECK(result);
+        if (result)
+            CHECK(toString(*result) == "number, string");
+    }
+
+    SUBCASE("not_function")
+    {
+        auto result = traverseForPack(builtinTypes->booleanType, Path(PackField::Arguments), builtinTypes);
+        CHECK(result == std::nullopt);
+    }
+}
+
+TEST_CASE_FIXTURE(Fixture, "returns")
+{
+    SUBCASE("function")
+    {
+        TYPESOLVE_CODE(R"(
+            function f(): (number, string)
+                return 123, "foo"
+            end
+        )");
+
+        auto result = traverseForPack(requireType("f"), Path(PackField::Returns), builtinTypes);
+        CHECK(result);
+        if (result)
+            CHECK(toString(*result) == "number, string");
+    }
+
+    SUBCASE("not_function")
+    {
+        auto result = traverseForPack(builtinTypes->booleanType, Path(PackField::Returns), builtinTypes);
+        CHECK(result == std::nullopt);
+    }
+}
+
+TEST_CASE_FIXTURE(Fixture, "tail")
+{
+    SUBCASE("has_tail")
+    {
+        TYPESOLVE_CODE(R"(
+            type T = (number, string, ...boolean) -> ()
+        )");
+
+        auto result = traverseForPack(requireTypeAlias("T"), Path({PackField::Arguments, PackField::Tail}), builtinTypes);
+        CHECK(result);
+        if (result)
+            CHECK(toString(*result) == "...boolean");
+    }
+
+    SUBCASE("finite_pack")
+    {
+        TYPESOLVE_CODE(R"(
+            type T = (number, string) -> ()
+        )");
+
+        auto result = traverseForPack(requireTypeAlias("T"), Path({PackField::Arguments, PackField::Tail}), builtinTypes);
+        CHECK(result == std::nullopt);
+    }
+
+    SUBCASE("type")
+    {
+        auto result = traverseForPack(builtinTypes->stringType, Path({PackField::Arguments, PackField::Tail}), builtinTypes);
+        CHECK(result == std::nullopt);
+    }
+}
+
+TEST_CASE_FIXTURE(Fixture, "cycles" * doctest::timeout(0.5))
+{
+    // This will fail an occurs check, but it's a quick example of a cyclic type
+    // where there _is_ no traversal.
+    SUBCASE("bound_cycle")
+    {
+        TypeArena& arena = frontend.globals.globalTypes;
+        unfreeze(arena);
+
+        TypeId a = arena.addType(BlockedType{});
+        TypeId b = arena.addType(BoundType{a});
+        asMutable(a)->ty.emplace<BoundType>(b);
+
+        CHECK_THROWS(traverseForType(a, Path(TypeField::IndexResult), builtinTypes));
+    }
+
+    SUBCASE("table_contains_itself")
+    {
+        TypeArena& arena = frontend.globals.globalTypes;
+        unfreeze(arena);
+
+        TypeId tbl = arena.addType(TableType{});
+        getMutable<TableType>(tbl)->props["a"] = Luau::Property(tbl);
+
+        auto result = traverseForType(tbl, Path(TypePath::Property{"a", true}), builtinTypes);
+        CHECK(result == tbl);
+    }
+}
+
+TEST_CASE_FIXTURE(Fixture, "step_limit")
+{
+    ScopedFastInt sfi("LuauTypePathMaximumTraverseSteps", 2);
+
+    TYPESOLVE_CODE(R"(
+        type T = {
+            x: {
+                y: {
+                    z: number
+                }
+            }
+        }
+    )");
+
+    TypeId root = requireTypeAlias("T");
+    Path path = PathBuilder().prop("x").prop("y").prop("z").build();
+    auto result = traverseForType(root, path, builtinTypes);
+    CHECK(!result);
+}
+
+TEST_CASE_FIXTURE(BuiltinsFixture, "complex_chains")
+{
+    SUBCASE("add_metamethod_return_type")
+    {
+        TYPESOLVE_CODE(R"(
+            type Meta = {
+                __add: (Tab, Tab) -> number,
+            }
+            
+            type Tab = typeof(setmetatable({}, {} :: Meta))
+        )");
+
+        TypeId root = requireTypeAlias("Tab");
+        Path path = PathBuilder().mt().prop("__add").rets().index(0).build();
+        auto result = traverseForType(root, path, builtinTypes);
+        CHECK(result == builtinTypes->numberType);
+    }
+
+    SUBCASE("overloaded_fn_overload_one_argument_two")
+    {
+        TYPESOLVE_CODE(R"(
+            type Obj = {
+                method: ((true, false) -> string) & ((string) -> number)
+            }
+        )");
+
+        TypeId root = requireTypeAlias("Obj");
+        Path path = PathBuilder().prop("method").index(0).args().index(1).build();
+        auto result = traverseForType(root, path, builtinTypes);
+        CHECK(*result == builtinTypes->falseType);
+    }
+}
+#endif
+
+TEST_SUITE_END(); // TypePathTraversal
+
+TEST_SUITE_BEGIN("TypePathToString");
+
+TEST_CASE("field")
+{
+    CHECK(toString(PathBuilder().prop("foo").build()) == R"(["foo"])");
+}
+
+TEST_CASE("index")
+{
+    CHECK(toString(PathBuilder().index(0).build()) == "[0]");
+}
+
+TEST_CASE("chain")
+{
+    CHECK(toString(PathBuilder().index(0).mt().build()) == "[0].metatable()");
+}
+
+TEST_SUITE_END(); // TypePathToString
+
+TEST_SUITE_BEGIN("TypePathBuilder");
+
+TEST_CASE("empty_path")
+{
+    Path p = PathBuilder().build();
+    CHECK(p.empty());
+}
+
+TEST_CASE("prop")
+{
+    Path p = PathBuilder().prop("foo").build();
+    CHECK(p == Path(TypePath::Property{"foo"}));
+}
+
+TEST_CASE("index")
+{
+    Path p = PathBuilder().index(0).build();
+    CHECK(p == Path(TypePath::Index{0}));
+}
+
+TEST_CASE("fields")
+{
+    CHECK(PathBuilder().mt().build() == Path(TypeField::Metatable));
+    CHECK(PathBuilder().lb().build() == Path(TypeField::LowerBound));
+    CHECK(PathBuilder().ub().build() == Path(TypeField::UpperBound));
+    CHECK(PathBuilder().indexKey().build() == Path(TypeField::IndexLookup));
+    CHECK(PathBuilder().indexValue().build() == Path(TypeField::IndexResult));
+    CHECK(PathBuilder().negated().build() == Path(TypeField::Negated));
+    CHECK(PathBuilder().variadic().build() == Path(TypeField::Variadic));
+    CHECK(PathBuilder().args().build() == Path(PackField::Arguments));
+    CHECK(PathBuilder().rets().build() == Path(PackField::Returns));
+    CHECK(PathBuilder().tail().build() == Path(PackField::Tail));
+}
+
+TEST_CASE("chained")
+{
+    CHECK(PathBuilder().index(0).prop("foo").mt().prop("bar").args().index(1).build() ==
+          Path({Index{0}, TypePath::Property{"foo"}, TypeField::Metatable, TypePath::Property{"bar"}, PackField::Arguments, Index{1}}));
+}
+
+TEST_SUITE_END(); // TypePathBuilder
diff --git a/tests/conformance/closure.lua b/tests/conformance/closure.lua
index 7b0573546..10dc322fb 100644
--- a/tests/conformance/closure.lua
+++ b/tests/conformance/closure.lua
@@ -363,46 +363,12 @@ local x = coroutine.create (function ()
           end)
 
 assert(not coroutine.resume(x))
+
 -- overwrite previous position of local `a'
 assert(not coroutine.resume(x, 1, 1, 1, 1, 1, 1, 1))
 assert(_G.f() == 11)
 assert(_G.f() == 12)
 
-
-if not T then
-  (Message or print)('\a\n >>> testC not active: skipping yield/hook tests <<<\n\a')
-else
-
-  local turn
-  
-  function fact (t, x)
-    assert(turn == t)
-    if x == 0 then return 1
-    else return x*fact(t, x-1)
-    end
-  end
-
-  local A,B,a,b = 0,0,0,0
-
-  local x = coroutine.create(function ()
-    T.setyhook("", 2)
-    A = fact("A", 10)
-  end)
-
-  local y = coroutine.create(function ()
-    T.setyhook("", 3)
-    B = fact("B", 11)
-  end)
-
-  while A==0 or B==0 do
-    if A==0 then turn = "A"; T.resume(x) end
-    if B==0 then turn = "B"; T.resume(y) end
-  end
-
-  assert(B/A == 11)
-end
-
-
 -- leaving a pending coroutine open
 _X = coroutine.wrap(function ()
       local a = 10
diff --git a/tests/conformance/native.lua b/tests/conformance/native.lua
index e89e772a6..d94e4a495 100644
--- a/tests/conformance/native.lua
+++ b/tests/conformance/native.lua
@@ -130,6 +130,29 @@ end
 
 assert(pcall(fuzzfail13) == true)
 
+local function fuzzfail14()
+  for l0=771751936,_ do
+    for l0=771751936,0 do
+      while 538970624 do
+      end
+    end
+  end
+end
+
+assert(pcall(fuzzfail14) == false)
+
+local function fuzzfail15()
+  local a
+  if a then
+    repeat until a
+  else
+    local b = `{a}`
+    a = nil
+  end
+end
+
+assert(pcall(fuzzfail15) == true)
+
 local function arraySizeInv1()
   local t = {1, 2, nil, nil, nil, nil, nil, nil, nil, true}
 
diff --git a/tests/conformance/pcall.lua b/tests/conformance/pcall.lua
index b94f7972e..c2be2708a 100644
--- a/tests/conformance/pcall.lua
+++ b/tests/conformance/pcall.lua
@@ -63,7 +63,7 @@ if not limitedstack then
 
 	function stackover() return pcall(stackover) end
 	local res = {pcall(stackover)}
-	assert(#res == 200)
+	assert(#res == 200) -- stack limit (MAXCCALLS) is 200
 end
 
 -- yield tests
@@ -168,4 +168,100 @@ checkresults({ false, "oops" }, xpcall(function() table.create(1e6) end, functio
 checkresults({ false, "error in error handling" }, xpcall(function() error("oops") end, function(e) table.create(1e6) end))
 checkresults({ false, "not enough memory" }, xpcall(function() table.create(1e6) end, function(e) table.create(1e6) end))
 
+-- ensure that pcall and xpcall close upvalues when handling error
+local upclo
+local function uptest(y)
+	local a, b, c, d = 1, 2, 3, 4
+	upclo = function()
+		local t = table.pack("a", "b", "d", "e", "f", "g", "h", "i")
+		assert(a == 1)
+		assert(b == 2)
+		assert(c == 3)
+		assert(d == 4)
+		a, b, c, d = table.unpack(t)
+		return "ok"
+	end
+	if y then
+		y()
+	end
+	error("oops")
+end
+
+-- ensure that pcall and xpcall close upvalues when handling error (immediate)
+do
+	upclo = nil
+	pcall(uptest, nil)
+	assert(upclo() == "ok")
+end
+
+do
+	upclo = nil
+	xpcall(uptest, function(err) end, nil)
+	assert(upclo() == "ok")
+end
+
+do
+	upclo = nil
+	xpcall(uptest, function(err) return "e", "e", "e", "e", "e", "e", "e", "e" end, nil)
+	assert(upclo() == "ok")
+end
+
+-- ensure that pcall and xpcall close upvalues when handling error (deferred)
+do
+	upclo = nil
+	checkresults({"yield", "return", "ok"}, colog(function()
+		pcall(uptest, coroutine.yield)
+		return upclo()
+	end))
+end
+
+do
+	upclo = nil
+	checkresults({"yield", "return", "ok"}, colog(function()
+		xpcall(uptest, function(err) end, coroutine.yield)
+		return upclo()
+	end))
+end
+
+do
+	upclo = nil
+	checkresults({"yield", "return", "ok"}, colog(function()
+		xpcall(uptest, function(err) return "e", "e", "e", "e", "e", "e", "e", "e" end, coroutine.yield)
+		return upclo()
+	end))
+end
+
+-- also cover an edge case where xpcall's error handler may want access to the upvalues (immediate + deferred)
+do
+	local ur
+	upclo = nil
+	xpcall(uptest, function(err)
+		ur = upclo()
+	end, nil)
+	assert(ur == "ok")
+end
+
+do
+	local ur
+	upclo = nil
+	checkresults({"yield", "return"}, colog(function()
+		xpcall(uptest, function(err)
+			ur = upclo()
+		end, coroutine.yield)
+	end))
+	assert(ur == "ok")
+end
+
+-- test stack overflow from a thread that had an error, recovered, and subsequently called coroutine.resume again
+if not limitedstack then
+	local count = 0
+	local function foo()
+		count += 1
+		pcall(1)   -- create an error
+		coroutine.wrap(foo)()   -- call another coroutine
+	end
+	checkerror(pcall(foo)) -- triggers C stack overflow
+	assert(count + 1 == 200) -- stack limit (MAXCCALLS) is 200, -1 for first pcall
+end
+
 return 'OK'
diff --git a/tools/faillist.txt b/tools/faillist.txt
index 8bb028142..3707c457d 100644
--- a/tools/faillist.txt
+++ b/tools/faillist.txt
@@ -1,5 +1,4 @@
 AnnotationTests.cloned_interface_maintains_pointers_between_definitions
-AnnotationTests.infer_type_of_value_a_via_typeof_with_assignment
 AnnotationTests.table_annotation
 AnnotationTests.two_type_params
 AnnotationTests.typeof_expr
@@ -57,6 +56,7 @@ BuiltinTests.see_thru_select_count
 BuiltinTests.select_slightly_out_of_range
 BuiltinTests.select_way_out_of_range
 BuiltinTests.select_with_decimal_argument_is_rounded_down
+BuiltinTests.select_with_variadic_typepack_tail_and_string_head
 BuiltinTests.set_metatable_needs_arguments
 BuiltinTests.setmetatable_should_not_mutate_persisted_types
 BuiltinTests.sort
@@ -73,9 +73,14 @@ BuiltinTests.table_dot_remove_optionally_returns_generic
 BuiltinTests.table_freeze_is_generic
 BuiltinTests.table_insert_correctly_infers_type_of_array_2_args_overload
 BuiltinTests.table_insert_correctly_infers_type_of_array_3_args_overload
+BuiltinTests.table_pack
+BuiltinTests.table_pack_reduce
 BuiltinTests.table_pack_variadic
+BuiltinTests.tonumber_returns_optional_number_type
+BuiltinTests.tonumber_returns_optional_number_type2
 BuiltinTests.trivial_select
 BuiltinTests.xpcall
+ControlFlowAnalysis.do_assert_x
 ControlFlowAnalysis.for_record_do_if_not_x_break
 ControlFlowAnalysis.for_record_do_if_not_x_continue
 ControlFlowAnalysis.if_not_x_break
@@ -96,6 +101,8 @@ ControlFlowAnalysis.if_not_x_continue_if_not_y_continue
 ControlFlowAnalysis.if_not_x_continue_if_not_y_throw
 ControlFlowAnalysis.if_not_x_return_elif_not_y_break
 ControlFlowAnalysis.if_not_x_return_elif_not_y_fallthrough_elif_not_z_break
+ControlFlowAnalysis.if_not_x_then_assert_false
+ControlFlowAnalysis.if_not_x_then_error
 ControlFlowAnalysis.prototyping_and_visiting_alias_has_the_same_scope_breaking
 ControlFlowAnalysis.prototyping_and_visiting_alias_has_the_same_scope_continuing
 ControlFlowAnalysis.tagged_unions_breaking
@@ -123,12 +130,19 @@ Differ.generictp_normal
 Differ.generictp_normal_2
 Differ.left_cyclic_table_right_table_missing_property
 Differ.left_cyclic_table_right_table_property_wrong
+Differ.metatable_metamissing_left
+Differ.metatable_metamissing_right
+Differ.metatable_metanormal
 Differ.negation
 Differ.right_cyclic_table_left_table_missing_property
 Differ.right_cyclic_table_left_table_property_wrong
 Differ.table_left_circle_right_measuring_tape
 FrontendTest.accumulate_cached_errors_in_consistent_order
+FrontendTest.environments
+FrontendTest.imported_table_modification_2
 FrontendTest.it_should_be_safe_to_stringify_errors_when_full_type_graph_is_discarded
+FrontendTest.nocheck_cycle_used_by_checked
+FrontendTest.trace_requires_in_nonstrict_mode
 GenericsTests.apply_type_function_nested_generics1
 GenericsTests.apply_type_function_nested_generics2
 GenericsTests.better_mismatch_error_messages
@@ -159,7 +173,6 @@ GenericsTests.generic_type_pack_unification1
 GenericsTests.generic_type_pack_unification2
 GenericsTests.generic_type_pack_unification3
 GenericsTests.higher_rank_polymorphism_should_not_accept_instantiated_arguments
-GenericsTests.hof_subtype_instantiation_regression
 GenericsTests.infer_generic_function
 GenericsTests.infer_generic_function_function_argument
 GenericsTests.infer_generic_function_function_argument_2
@@ -171,7 +184,6 @@ GenericsTests.infer_generic_property
 GenericsTests.infer_nested_generic_function
 GenericsTests.inferred_local_vars_can_be_polytypes
 GenericsTests.instantiated_function_argument_names
-GenericsTests.instantiation_sharing_types
 GenericsTests.local_vars_can_be_polytypes
 GenericsTests.no_stack_overflow_from_quantifying
 GenericsTests.properties_can_be_instantiated_polytypes
@@ -182,6 +194,7 @@ GenericsTests.self_recursive_instantiated_param
 GenericsTests.type_parameters_can_be_polytypes
 GenericsTests.typefuns_sharing_types
 IntersectionTypes.argument_is_intersection
+IntersectionTypes.cli_80596_simplify_degenerate_intersections
 IntersectionTypes.error_detailed_intersection_all
 IntersectionTypes.error_detailed_intersection_part
 IntersectionTypes.fx_intersection_as_argument
@@ -222,8 +235,17 @@ IntersectionTypes.union_saturate_overloaded_functions
 Linter.DeprecatedApiFenv
 Linter.FormatStringTyped
 Linter.TableOperationsIndexer
+ModuleTests.clone_self_property
 Negations.cofinite_strings_can_be_compared_for_equality
 Negations.negated_string_is_a_subtype_of_string
+NonstrictModeTests.inconsistent_module_return_types_are_ok
+NonstrictModeTests.infer_nullary_function
+NonstrictModeTests.infer_the_maximum_number_of_values_the_function_could_return
+NonstrictModeTests.inline_table_props_are_also_any
+NonstrictModeTests.local_tables_are_not_any
+NonstrictModeTests.locals_are_any_by_default
+NonstrictModeTests.offer_a_hint_if_you_use_a_dot_instead_of_a_colon
+NonstrictModeTests.table_props_are_any
 Normalize.higher_order_function_with_annotation
 Normalize.negations_of_tables
 Normalize.specific_functions_cannot_be_negated
@@ -242,7 +264,6 @@ ProvisionalTests.generic_type_leak_to_module_interface_variadic
 ProvisionalTests.greedy_inference_with_shared_self_triggers_function_with_no_returns
 ProvisionalTests.it_should_be_agnostic_of_actual_size
 ProvisionalTests.luau-polyfill.Array.filter
-ProvisionalTests.luau-polyfill.Map.entries
 ProvisionalTests.luau_roact_useState_minimization
 ProvisionalTests.optional_class_instances_are_invariant
 ProvisionalTests.pcall_returns_at_least_two_value_but_function_returns_nothing
@@ -251,21 +272,25 @@ ProvisionalTests.specialization_binds_with_prototypes_too_early
 ProvisionalTests.table_insert_with_a_singleton_argument
 ProvisionalTests.table_unification_infinite_recursion
 ProvisionalTests.typeguard_inference_incomplete
-ProvisionalTests.weirditer_should_not_loop_forever
 ProvisionalTests.while_body_are_also_refined
 ProvisionalTests.xpcall_returns_what_f_returns
 RefinementTest.apply_refinements_on_astexprindexexpr_whose_subscript_expr_is_constant_string
 RefinementTest.assert_a_to_be_truthy_then_assert_a_to_be_number
+RefinementTest.assert_non_binary_expressions_actually_resolve_constraints
+RefinementTest.correctly_lookup_a_shadowed_local_that_which_was_previously_refined
 RefinementTest.correctly_lookup_property_whose_base_was_previously_refined
 RefinementTest.dataflow_analysis_can_tell_refinements_when_its_appropriate_to_refine_into_nil_or_never
 RefinementTest.discriminate_from_truthiness_of_x
+RefinementTest.either_number_or_string
 RefinementTest.fail_to_refine_a_property_of_subscript_expression
 RefinementTest.falsiness_of_TruthyPredicate_narrows_into_nil
+RefinementTest.function_call_with_colon_after_refining_not_to_be_nil
 RefinementTest.impossible_type_narrow_is_not_an_error
 RefinementTest.index_on_a_refined_property
 RefinementTest.isa_type_refinement_must_be_known_ahead_of_time
 RefinementTest.luau_polyfill_isindexkey_refine_conjunction
 RefinementTest.luau_polyfill_isindexkey_refine_conjunction_variant
+RefinementTest.merge_should_be_fully_agnostic_of_hashmap_ordering
 RefinementTest.narrow_property_of_a_bounded_variable
 RefinementTest.nonoptional_type_can_narrow_to_nil_if_sense_is_true
 RefinementTest.not_t_or_some_prop_of_t
@@ -275,14 +300,18 @@ RefinementTest.refinements_should_preserve_error_suppression
 RefinementTest.string_not_equal_to_string_or_nil
 RefinementTest.truthy_constraint_on_properties
 RefinementTest.type_annotations_arent_relevant_when_doing_dataflow_analysis
+RefinementTest.type_comparison_ifelse_expression
+RefinementTest.type_guard_narrowed_into_nothingness
 RefinementTest.type_narrow_to_vector
 RefinementTest.typeguard_cast_free_table_to_vector
 RefinementTest.typeguard_in_assert_position
+RefinementTest.typeguard_in_if_condition_position
 RefinementTest.x_as_any_if_x_is_instance_elseif_x_is_table
 TableTests.a_free_shape_can_turn_into_a_scalar_directly
 TableTests.a_free_shape_can_turn_into_a_scalar_if_it_is_compatible
 TableTests.a_free_shape_cannot_turn_into_a_scalar_if_it_is_not_compatible
 TableTests.accidentally_checked_prop_in_opposite_branch
+TableTests.any_when_indexing_into_an_unsealed_table_with_no_indexer_in_nonstrict_mode
 TableTests.array_factory_function
 TableTests.call_method
 TableTests.cannot_change_type_of_unsealed_table_prop
@@ -322,7 +351,6 @@ TableTests.expected_indexer_value_type_extra_2
 TableTests.explicitly_typed_table
 TableTests.explicitly_typed_table_error
 TableTests.explicitly_typed_table_with_indexer
-TableTests.extend_unsealed_table_with_metatable
 TableTests.generalize_table_argument
 TableTests.generic_table_instantiation_potential_regression
 TableTests.indexer_mismatch
@@ -334,11 +362,9 @@ TableTests.infer_array_2
 TableTests.infer_indexer_for_left_unsealed_table_from_right_hand_table_with_indexer
 TableTests.infer_indexer_from_its_function_return_type
 TableTests.infer_indexer_from_its_variable_type_and_unifiable
-TableTests.infer_indexer_from_value_property_in_literal
 TableTests.infer_type_when_indexing_from_a_table_indexer
 TableTests.inferred_return_type_of_free_table
 TableTests.instantiate_table_cloning_3
-TableTests.instantiate_tables_at_scope_level
 TableTests.invariant_table_properties_means_instantiating_tables_in_assignment_is_unsound
 TableTests.invariant_table_properties_means_instantiating_tables_in_call_is_unsound
 TableTests.length_operator_intersection
@@ -346,6 +372,7 @@ TableTests.length_operator_non_table_union
 TableTests.length_operator_union
 TableTests.less_exponential_blowup_please
 TableTests.meta_add_both_ways
+TableTests.meta_add_inferred
 TableTests.metatable_mismatch_should_fail
 TableTests.missing_metatable_for_sealed_tables_do_not_get_inferred
 TableTests.mixed_tables_with_implicit_numbered_keys
@@ -360,6 +387,7 @@ TableTests.open_table_unification_2
 TableTests.pass_a_union_of_tables_to_a_function_that_requires_a_table
 TableTests.pass_a_union_of_tables_to_a_function_that_requires_a_table_2
 TableTests.passing_compatible_unions_to_a_generic_table_without_crashing
+TableTests.persistent_sealed_table_is_immutable
 TableTests.prop_access_on_key_whose_types_mismatches
 TableTests.prop_access_on_unions_of_indexers_where_key_whose_types_mismatches
 TableTests.quantify_even_that_table_was_never_exported_at_all
@@ -373,6 +401,7 @@ TableTests.scalar_is_a_subtype_of_a_compatible_polymorphic_shape_type
 TableTests.scalar_is_not_a_subtype_of_a_compatible_polymorphic_shape_type
 TableTests.sealed_table_indexers_must_unify
 TableTests.sealed_table_value_can_infer_an_indexer
+TableTests.setmetatable_has_a_side_effect
 TableTests.shared_selfs
 TableTests.shared_selfs_from_free_param
 TableTests.shared_selfs_through_metatables
@@ -402,7 +431,6 @@ ToDot.function
 ToString.exhaustive_toString_of_cyclic_table
 ToString.free_types
 ToString.named_metatable_toStringNamedFunction
-ToString.no_parentheses_around_cyclic_function_type_in_union
 ToString.pick_distinct_names_for_mixed_explicit_and_implicit_generics
 ToString.primitive
 ToString.tostring_error_mismatch
@@ -418,12 +446,12 @@ TryUnifyTests.typepack_unification_should_trim_free_tails
 TryUnifyTests.uninhabited_table_sub_anything
 TryUnifyTests.uninhabited_table_sub_never
 TryUnifyTests.variadics_should_use_reversed_properly
-TypeAliases.alias_expands_to_bare_reference_to_imported_type
 TypeAliases.corecursive_types_generic
-TypeAliases.cyclic_function_type_in_type_alias
 TypeAliases.cyclic_types_of_named_table_fields_do_not_expand_when_stringified
+TypeAliases.dependent_generic_aliases
 TypeAliases.dont_lose_track_of_PendingExpansionTypes_after_substitution
 TypeAliases.free_variables_from_typeof_in_aliases
+TypeAliases.generic_aliases
 TypeAliases.generic_param_remap
 TypeAliases.mismatched_generic_type_param
 TypeAliases.mutually_recursive_aliases
@@ -451,12 +479,15 @@ TypeFamilyTests.unsolvable_family
 TypeInfer.bidirectional_checking_of_callback_property
 TypeInfer.check_expr_recursion_limit
 TypeInfer.check_type_infer_recursion_count
+TypeInfer.checking_should_not_ice
 TypeInfer.cli_39932_use_unifier_in_ensure_methods
 TypeInfer.cli_50041_committing_txnlog_in_apollo_client_error
 TypeInfer.dont_ice_when_failing_the_occurs_check
 TypeInfer.dont_report_type_errors_within_an_AstExprError
 TypeInfer.dont_report_type_errors_within_an_AstStatError
 TypeInfer.follow_on_new_types_in_substitution
+TypeInfer.globals
+TypeInfer.globals2
 TypeInfer.globals_are_banned_in_strict_mode
 TypeInfer.if_statement
 TypeInfer.infer_locals_via_assignment_from_its_call_site
@@ -464,6 +495,7 @@ TypeInfer.infer_locals_with_nil_value
 TypeInfer.infer_through_group_expr
 TypeInfer.infer_type_assertion_value_type
 TypeInfer.interesting_local_type_inference_case
+TypeInfer.no_infinite_loop_when_trying_to_unify_uh_this
 TypeInfer.no_stack_overflow_from_isoptional
 TypeInfer.promote_tail_type_packs
 TypeInfer.recursive_function_that_invokes_itself_with_a_refinement_of_its_parameter
@@ -485,7 +517,6 @@ TypeInferAnyError.for_in_loop_iterator_is_any2
 TypeInferAnyError.for_in_loop_iterator_is_error
 TypeInferAnyError.for_in_loop_iterator_is_error2
 TypeInferAnyError.for_in_loop_iterator_returns_any
-TypeInferAnyError.for_in_loop_iterator_returns_any2
 TypeInferAnyError.intersection_of_any_can_have_props
 TypeInferAnyError.quantify_any_does_not_bind_to_itself
 TypeInferAnyError.replace_every_free_type_when_unifying_a_complex_function_with_any
@@ -503,16 +534,16 @@ TypeInferClasses.table_class_unification_reports_sane_errors_for_missing_propert
 TypeInferClasses.table_indexers_are_invariant
 TypeInferClasses.type_mismatch_invariance_required_for_error
 TypeInferClasses.we_can_report_when_someone_is_trying_to_use_a_table_rather_than_a_class
-TypeInferFunctions.another_higher_order_function
 TypeInferFunctions.another_other_higher_order_function
-TypeInferFunctions.another_recursive_local_function
 TypeInferFunctions.apply_of_lambda_with_inferred_and_explicit_types
+TypeInferFunctions.calling_function_with_anytypepack_doesnt_leak_free_types
 TypeInferFunctions.cannot_hoist_interior_defns_into_signature
 TypeInferFunctions.check_function_bodies
 TypeInferFunctions.concrete_functions_are_not_supertypes_of_function
 TypeInferFunctions.dont_assert_when_the_tarjan_limit_is_exceeded_during_generalization
 TypeInferFunctions.dont_give_other_overloads_message_if_only_one_argument_matching_overload_exists
 TypeInferFunctions.dont_infer_parameter_types_for_functions_from_their_call_site
+TypeInferFunctions.duplicate_functions_with_different_signatures_not_allowed_in_nonstrict
 TypeInferFunctions.error_detailed_function_mismatch_arg
 TypeInferFunctions.error_detailed_function_mismatch_arg_count
 TypeInferFunctions.error_detailed_function_mismatch_ret
@@ -529,6 +560,7 @@ TypeInferFunctions.generic_packs_are_not_variadic
 TypeInferFunctions.higher_order_function_2
 TypeInferFunctions.higher_order_function_3
 TypeInferFunctions.higher_order_function_4
+TypeInferFunctions.improved_function_arg_mismatch_error_nonstrict
 TypeInferFunctions.improved_function_arg_mismatch_errors
 TypeInferFunctions.infer_anonymous_function_arguments
 TypeInferFunctions.infer_anonymous_function_arguments_outside_call
@@ -538,6 +570,7 @@ TypeInferFunctions.infer_generic_lib_function_function_argument
 TypeInferFunctions.infer_return_type_from_selected_overload
 TypeInferFunctions.infer_return_value_type
 TypeInferFunctions.infer_that_function_does_not_return_a_table
+TypeInferFunctions.inferred_higher_order_functions_are_quantified_at_the_right_time3
 TypeInferFunctions.instantiated_type_packs_must_have_a_non_null_scope
 TypeInferFunctions.it_is_ok_to_oversaturate_a_higher_order_function_argument
 TypeInferFunctions.list_all_overloads_if_no_overload_takes_given_argument_count
@@ -551,12 +584,13 @@ TypeInferFunctions.other_things_are_not_related_to_function
 TypeInferFunctions.param_1_and_2_both_takes_the_same_generic_but_their_arguments_are_incompatible
 TypeInferFunctions.param_1_and_2_both_takes_the_same_generic_but_their_arguments_are_incompatible_2
 TypeInferFunctions.record_matching_overload
-TypeInferFunctions.recursive_local_function
+TypeInferFunctions.report_exiting_without_return_nonstrict
 TypeInferFunctions.report_exiting_without_return_strict
 TypeInferFunctions.return_type_by_overload
 TypeInferFunctions.too_few_arguments_variadic
 TypeInferFunctions.too_few_arguments_variadic_generic
 TypeInferFunctions.too_few_arguments_variadic_generic2
+TypeInferFunctions.too_many_arguments
 TypeInferFunctions.too_many_arguments_error_location
 TypeInferFunctions.too_many_return_values_in_parentheses
 TypeInferFunctions.too_many_return_values_no_function
@@ -620,17 +654,18 @@ TypeInferOperators.add_type_family_works
 TypeInferOperators.and_binexps_dont_unify
 TypeInferOperators.cli_38355_recursive_union
 TypeInferOperators.compound_assign_mismatch_metatable
-TypeInferOperators.compound_assign_mismatch_op
-TypeInferOperators.compound_assign_mismatch_result
 TypeInferOperators.compound_assign_result_must_be_compatible_with_var
 TypeInferOperators.concat_op_on_free_lhs_and_string_rhs
 TypeInferOperators.concat_op_on_string_lhs_and_free_rhs
 TypeInferOperators.disallow_string_and_types_without_metatables_from_arithmetic_binary_ops
 TypeInferOperators.equality_operations_succeed_if_any_union_branch_succeeds
 TypeInferOperators.error_on_invalid_operand_types_to_relational_operators2
+TypeInferOperators.luau-polyfill.String.slice
 TypeInferOperators.luau_polyfill_is_array
 TypeInferOperators.mm_comparisons_must_return_a_boolean
+TypeInferOperators.normalize_strings_comparison
 TypeInferOperators.operator_eq_verifies_types_do_intersect
+TypeInferOperators.primitive_arith_no_metatable
 TypeInferOperators.reducing_and
 TypeInferOperators.refine_and_or
 TypeInferOperators.reworked_and
@@ -641,6 +676,7 @@ TypeInferOperators.typecheck_overloaded_multiply_that_is_an_intersection_on_rhs
 TypeInferOperators.typecheck_unary_len_error
 TypeInferOperators.typecheck_unary_minus
 TypeInferOperators.typecheck_unary_minus_error
+TypeInferOperators.UnknownGlobalCompoundAssign
 TypeInferPrimitives.CheckMethodsOfNumber
 TypeInferPrimitives.string_function_indirect
 TypeInferPrimitives.string_index
@@ -653,7 +689,6 @@ TypeInferUnknownNever.math_operators_and_never
 TypeInferUnknownNever.type_packs_containing_never_is_itself_uninhabitable
 TypePackTests.fuzz_typepack_iter_follow_2
 TypePackTests.pack_tail_unification_check
-TypePackTests.parenthesized_varargs_returns_any
 TypePackTests.type_alias_backwards_compatible
 TypePackTests.type_alias_default_type_errors
 TypePackTests.type_alias_type_packs_import
@@ -661,6 +696,7 @@ TypePackTests.type_packs_with_tails_in_vararg_adjustment
 TypePackTests.unify_variadic_tails_in_arguments
 TypePackTests.unify_variadic_tails_in_arguments_free
 TypePackTests.variadic_argument_tail
+TypePathToStringForError.basic
 TypeSingletons.enums_using_singletons_mismatch
 TypeSingletons.error_detailed_tagged_union_mismatch_bool
 TypeSingletons.error_detailed_tagged_union_mismatch_string
@@ -668,6 +704,7 @@ TypeSingletons.function_args_infer_singletons
 TypeSingletons.function_call_with_singletons
 TypeSingletons.function_call_with_singletons_mismatch
 TypeSingletons.overloaded_function_call_with_singletons_mismatch
+TypeSingletons.parametric_tagged_union_alias
 TypeSingletons.return_type_of_f_is_not_widened
 TypeSingletons.table_properties_singleton_strings
 TypeSingletons.table_properties_type_error_escapes
@@ -678,6 +715,7 @@ UnionTypes.disallow_less_specific_assign2
 UnionTypes.error_detailed_optional
 UnionTypes.error_detailed_union_all
 UnionTypes.error_detailed_union_part
+UnionTypes.error_takes_optional_arguments
 UnionTypes.generic_function_with_optional_arg
 UnionTypes.index_on_a_union_type_with_missing_property
 UnionTypes.index_on_a_union_type_with_mixed_types
diff --git a/tools/lldb_formatters.lldb b/tools/lldb_formatters.lldb
index f10faa94e..d8e659e95 100644
--- a/tools/lldb_formatters.lldb
+++ b/tools/lldb_formatters.lldb
@@ -1,4 +1,10 @@
 type synthetic add -x "^Luau::detail::DenseHashTable<.*>$" -l lldb_formatters.DenseHashTableSyntheticChildrenProvider
+type synthetic add -x "^Luau::DenseHashMap<.*>$" -l lldb_formatters.DenseHashMapSyntheticChildrenProvider
+type synthetic add -x "^Luau::DenseHashSet<.*>$" -l lldb_formatters.DenseHashSetSyntheticChildrenProvider
+
+type summary add -x "^Luau::DenseHashMap<.*>$" --summary-string "count = ${var.impl.count}"
+type summary add -x "^Luau::DenseHashSet<.*>$" --summary-string "count = ${var.impl.count}"
+
 type summary add "Luau::Symbol" -F lldb_formatters.luau_symbol_summary
 
 type synthetic add -x "^Luau::Variant<.+>$" -l lldb_formatters.LuauVariantSyntheticChildrenProvider
@@ -6,5 +12,14 @@ type summary add -x "^Luau::Variant<.+>$" -F lldb_formatters.luau_variant_summar
 
 type synthetic add -x "^Luau::AstArray<.+>$" -l lldb_formatters.AstArraySyntheticChildrenProvider
 
+type summary add -x "^Luau::NotNull<.+>$" --summary-string "${*var.ptr}"
+
 type summary add --summary-string "${var.line}:${var.column}" Luau::Position
 type summary add --summary-string "${var.begin}-${var.end}" Luau::Location
+
+type summary add --summary-string "${var.ty} (${var%S})" Luau::TypeId Luau::TypePackId
+
+type summary add Luau::TypePath::Property -F lldb_formatters.luau_typepath_property_summary
+type summary add --summary-string "[${var.index}]" Luau::TypePath::Index
+
+type summary add -x "^Luau::TryPair<.+>$" --summary-string "(${var.first%T}, ${var.second%T})"
diff --git a/tools/lldb_formatters.py b/tools/lldb_formatters.py
index 19fc0f54c..661b20fc1 100644
--- a/tools/lldb_formatters.py
+++ b/tools/lldb_formatters.py
@@ -170,9 +170,165 @@ def has_children(self):
         return True
 
 
+class DenseHashMapSyntheticChildrenProvider:
+    fixed_names = ["count", "capacity"]
+
+    def __init__(self, valobj, internal_dict):
+        self.valobj = valobj
+        self.values = []
+        self.count = 0
+
+    def num_children(self):
+        return self.count + len(self.fixed_names)
+
+    def get_child_index(self, name):
+        try:
+            if name in self.fixed_names:
+                return self.fixed_names.index(name)
+
+            for index, (key, _) in enumerate(self.values):
+                if key == name:
+                    return index + len(self.fixed_names)
+
+            return -1
+        except Exception as e:
+            print("get_child_index exception", e, name)
+            return -1
+
+    def get_child_at_index(self, index):
+        try:
+            if index < len(self.fixed_names):
+                fixed_name = self.fixed_names[index]
+                impl_child = self.valobj.GetValueForExpressionPath(
+                    f".impl.{fixed_name}")
+
+                return self.valobj.CreateValueFromData(fixed_name, impl_child.GetData(), impl_child.GetType())
+            else:
+                index -= len(self.fixed_names)
+
+            pair = self.items[index]
+            key = pair["key"]
+            value = pair["value"]
+
+            return self.valobj.CreateValueFromData(
+                f"[{key}]",
+                value.data,
+                value.GetType(),
+            )
+
+        except Exception as e:
+            print("get_child_at_index error", e, index)
+
+    def update(self):
+        try:
+            capacity = self.valobj.GetChildMemberWithName("impl").GetChildMemberWithName(
+                "capacity"
+            ).GetValueAsUnsigned()
+
+            self.items = []
+            for index in range(0, capacity):
+                child_pair = self.valobj.GetValueForExpressionPath(
+                    f".impl.data[{index}]")
+                child_key_valobj = child_pair.GetChildMemberWithName("first")
+
+                if child_key_valobj.TypeIsPointerType() and child_key_valobj.GetValueAsUnsigned() == 0:
+                    continue
+
+                child_key = child_key_valobj.GetValue()
+
+                if child_key is None:
+                    child_key = child_key_valobj.GetSummary()
+
+                if child_key is None:
+                    child_key = f"<{index} ({child_key_valobj.GetTypeName()})>"
+
+                child_value = child_pair.GetChildMemberWithName("second")
+                self.items.append({"key": child_key, "value": child_value})
+
+            self.count = len(self.items)
+
+        except Exception as e:
+            print("update error", e)
+
+    def has_children(self):
+        return True
+
+
+class DenseHashSetSyntheticChildrenProvider:
+    fixed_names = ["count", "capacity"]
+
+    def __init__(self, valobj, internal_dict):
+        self.valobj = valobj
+        self.values = []
+        self.count = 0
+
+    def num_children(self):
+        return self.count + len(self.fixed_names)
+
+    def get_child_index(self, name):
+        try:
+            if name in self.fixed_names:
+                return self.fixed_names.index(name)
+
+            if name.startswith("[") and name.endswith("]"):
+                return int(name[1:-1]) + len(self.fixed_names)
+
+            return -1
+        except Exception as e:
+            print("get_child_index exception", e, name)
+            return -1
+
+    def get_child_at_index(self, index):
+        try:
+            if index < len(self.fixed_names):
+                fixed_name = self.fixed_names[index]
+                impl_child = self.valobj.GetValueForExpressionPath(
+                    f".impl.{fixed_name}")
+
+                return self.valobj.CreateValueFromData(fixed_name, impl_child.GetData(), impl_child.GetType())
+            else:
+                index -= len(self.fixed_names)
+
+            value = self.items[index]
+
+            return self.valobj.CreateValueFromData(
+                f"[{index}]",
+                value.data,
+                value.GetType(),
+            )
+
+        except Exception as e:
+            print("get_child_at_index error", e, index)
+
+    def update(self):
+        try:
+            capacity = self.valobj.GetChildMemberWithName("impl").GetChildMemberWithName(
+                "capacity"
+            ).GetValueAsUnsigned()
+
+            self.items = []
+            for index in range(0, capacity):
+                child_value = self.valobj.GetValueForExpressionPath(
+                    f".impl.data[{index}]")
+
+                if child_value.TypeIsPointerType() and child_value.GetValueAsUnsigned() == 0:
+                    continue
+
+                self.items.append(child_value)
+
+            self.count = len(self.items)
+
+        except Exception as e:
+            print("update error", e)
+
+    def has_children(self):
+        return True
+
+
 def luau_symbol_summary(valobj, internal_dict, options):
     local = valobj.GetChildMemberWithName("local")
-    global_ = valobj.GetChildMemberWithName("global").GetChildMemberWithName("value")
+    global_ = valobj.GetChildMemberWithName(
+        "global").GetChildMemberWithName("value")
 
     if local.GetValueAsUnsigned() != 0:
         return f'local {local.GetChildMemberWithName("name").GetChildMemberWithName("value").GetSummary()}'
@@ -209,7 +365,33 @@ def get_child_at_index(self, index):
             print("get_child_index error:", e)
 
     def update(self):
-        self.size = self.valobj.GetChildMemberWithName("size").GetValueAsUnsigned()
+        self.size = self.valobj.GetChildMemberWithName(
+            "size").GetValueAsUnsigned()
 
     def has_children(self):
         return True
+
+
+def luau_typepath_property_summary(valobj, internal_dict, options):
+    name = valobj.GetChildMemberWithName("name").GetSummary()
+    result = "["
+
+    read_write = False
+    try:
+        fflag_valobj = valobj.GetFrame().GetValueForVariablePath(
+            "FFlag::DebugLuauReadWriteProperties::value")
+
+        read_write = fflag_valobj.GetValue() == "true"
+    except Exception as e:
+        print("luau_typepath_property_summary error:", e)
+
+    if read_write:
+        is_read = valobj.GetChildMemberWithName("isRead").GetValue() == "true"
+        if is_read:
+            result += "read "
+        else:
+            result += "write "
+
+    result += name
+    result += "]"
+    return result
diff --git a/tools/natvis/VM.natvis b/tools/natvis/VM.natvis
index e45e4e283..2dc508154 100644
--- a/tools/natvis/VM.natvis
+++ b/tools/natvis/VM.natvis
@@ -12,6 +12,7 @@
     <DisplayString Condition="tt == lua_Type::LUA_TFUNCTION">function {value.gc->cl,view(short)}</DisplayString>
     <DisplayString Condition="tt == lua_Type::LUA_TUSERDATA">userdata {value.gc->u}</DisplayString>
     <DisplayString Condition="tt == lua_Type::LUA_TTHREAD">thread {value.gc->th}</DisplayString>
+    <DisplayString Condition="tt == lua_Type::LUA_TBUFFER">buffer {value.gc->buf} size={value.gc->buf.len}</DisplayString>
     <DisplayString Condition="tt == lua_Type::LUA_TPROTO">proto {value.gc->p}</DisplayString>
     <DisplayString Condition="tt == lua_Type::LUA_TUPVAL">upvalue {value.gc->uv}</DisplayString>
     <DisplayString Condition="tt == lua_Type::LUA_TDEADKEY">deadkey</DisplayString>
@@ -24,6 +25,7 @@
       <Item Name="[Lua function]" Condition="tt == lua_Type::LUA_TFUNCTION &amp;&amp; !value.gc-&gt;cl.isC">value.gc->cl</Item>
       <Item Name="[userdata]" Condition="tt == lua_Type::LUA_TUSERDATA">value.gc->u</Item>
       <Item Name="[thread]" Condition="tt == lua_Type::LUA_TTHREAD">value.gc->th</Item>
+      <Item Name="[buffer]" Condition="tt == lua_Type::LUA_TBUFFER">value.gc->buf</Item>
       <Item Name="[proto]" Condition="tt == lua_Type::LUA_TPROTO">value.gc->p</Item>
       <Item Name="[upvalue]" Condition="tt == lua_Type::LUA_TUPVAL">value.gc->uv</Item>
       <Synthetic Name="[gc]" Condition="tt >= lua_Type::LUA_TSTRING">
@@ -47,6 +49,7 @@
     <DisplayString Condition="tt == lua_Type::LUA_TFUNCTION">function {value.gc->cl,view(short)}</DisplayString>
     <DisplayString Condition="tt == lua_Type::LUA_TUSERDATA">userdata {value.gc->u}</DisplayString>
     <DisplayString Condition="tt == lua_Type::LUA_TTHREAD">thread {value.gc->th}</DisplayString>
+    <DisplayString Condition="tt == lua_Type::LUA_TBUFFER">buffer {value.gc->buf} size={value.gc->buf.len}</DisplayString>
     <DisplayString Condition="tt == lua_Type::LUA_TPROTO">proto {value.gc->p}</DisplayString>
     <DisplayString Condition="tt == lua_Type::LUA_TUPVAL">upvalue {value.gc->uv}</DisplayString>
     <DisplayString Condition="tt == lua_Type::LUA_TDEADKEY">deadkey</DisplayString>
@@ -59,6 +62,7 @@
       <Item Name="[Lua function]" Condition="tt == lua_Type::LUA_TFUNCTION &amp;&amp; !value.gc-&gt;cl.isC">value.gc->cl</Item>
       <Item Name="[userdata]" Condition="tt == lua_Type::LUA_TUSERDATA">value.gc->u</Item>
       <Item Name="[thread]" Condition="tt == lua_Type::LUA_TTHREAD">value.gc->th</Item>
+      <Item Name="[buffer]" Condition="tt == lua_Type::LUA_TBUFFER">value.gc->buf</Item>
       <Item Name="[proto]" Condition="tt == lua_Type::LUA_TPROTO">value.gc->p</Item>
       <Item Name="[upvalue]" Condition="tt == lua_Type::LUA_TUPVAL">value.gc->uv</Item>