@@ -131,7 +131,7 @@ ultimate source of truth. Upstream test262 files run verbatim from `test/test262
 - [x] Built-in method references as callbacks, such as `values.map(Math.abs)`, `records.map(JSON.stringify)`,
       `items.forEach(console.log)`, and `Promise.resolve(-1).then(Math.abs)`. Extra callback arguments a built-in
       does not consume are ignored, like JS, and consumed arguments coerce, like JS (`"3.7".replace(/\d\.\d/,
-    Math.floor)` is `"3"`). A detached method loses its receiver, as in JS: `values.filter("abc".includes)` is a `TypeError`
+Math.floor)` is `"3"`). A detached method loses its receiver, as in JS: `values.filter("abc".includes)` is a `TypeError`
       because `includes` is called without a string `this`.
 - [x] Constructors work as callbacks with JS call semantics: `Error` types construct (`messages.map(Error)`),
       and new-requiring constructors (`Map`, `Set`, `URL`, `URLSearchParams`, `Headers`, `Promise`) throw a `TypeError`,
@@ -155,8 +155,9 @@ ultimate source of truth. Upstream test262 files run verbatim from `test/test262
       array, an array-like object (its `length` clamped and capped like `Array.from`), or `null`/`undefined`. A
       bound function is named `bound f`, has its remaining `length`, and is not constructible.
 - [x] `JSON.parse` revivers and `JSON.stringify` function replacers see the holder object as `this`.
-- [ ] The optional `thisArg` of iteration methods (`map`, `forEach`, `Map.prototype.forEach`, `Array.from`, …) is
-      accepted but not yet passed as `this`; callbacks run with `this` undefined.
+- [x] The optional `thisArg` of the Array, Uint8Array, and `Array.from` callback methods and of Map, Set,
+      URLSearchParams, and Headers `forEach` is the callback's `this`: `[1, 2].forEach(function () { this.n++ }, c)`
+      increments `c.n` twice. Arrows ignore it, as in JS; `reduce`/`reduceRight` take an initial value instead.
 - [ ] User-defined constructor calls.
 - [ ] Classes and private fields.
 - [x] Functions are objects: they hold own properties (`fn.count = 1`), enumerate them, and expose read-only `name`
@@ -241,11 +242,19 @@ ultimate source of truth. Upstream test262 files run verbatim from `test/test262
       throws: `{ valueOf() { return 7 } } * 2` is `14`, `` `${{ toString() { return "x" } }}` `` is `"x"`, and
       `[1, 2]` with `arr.toString = () => "x"` makes `arr + ""` `"x"`. Dates keep their `Symbol.toPrimitive`
       behavior (`date + 1` concatenates, `date - date` subtracts).
-- [ ] ToPrimitive elsewhere: `Error.prototype.toString` on an object `message` and numeric built-in arguments outside
-      `Math` and `Date` (`at`, `indexOf` start, `toFixed` digits) still use the built-in form (`NaN`,
-      `"[object Object]"`) and ignore own methods.
-- [x] Property keys follow ToPropertyKey: `x[null]`, `x[true]`, and objects (via their built-in string form) become
-      string keys.
+- [x] String and Number method arguments convert through ToPrimitive in spec order, receiver first: search strings,
+      separators, fills, and replacements with the string hint, indexes, counts, digits, and radixes with the number
+      hint (`"abc".indexOf({ toString() { return "b" } })` is `1`, `(255).toString({ valueOf() { return 16 } })` is
+      `"ff"`, `String.prototype.trim.call({ toString() { return " a " } })` is `"a"`). Only consumed positions
+      convert; a RegExp pattern is used as is, and `includes`/`startsWith`/`endsWith` reject one before converting.
+- [ ] ToPrimitive elsewhere: `Error.prototype.toString` on an object `message` and numeric arguments of the Array and
+      Uint8Array methods (`at`, `indexOf` start, `slice`) still use the built-in form (`NaN`, `"[object Object]"`) and
+      ignore own methods.
+- [x] Property keys follow ToPropertyKey: `x[null]` and `x[true]` become string keys, and a data object key
+      converts through its own `toString`/`valueOf` (string hint) exactly once per access, in reads, writes,
+      compound assignment, `++`, `delete`, `in`, object literals, and destructuring:
+      `o[{ toString() { return "id" } }] += 1` updates `o.id`. A nullish base throws before the key converts, as
+      in JS. Opaque values (functions, promises, tool references) keep their built-in string form.
 
 ## Promises and tools
 
@@ -306,8 +315,9 @@ reject }` object.
 - [x] `Object()` and `new Object()` return `{}` for nullish arguments and pass objects through unchanged;
       primitive wrapper objects (`Object(1)`) are rejected explicitly.
 - [x] Computed property names and object spread. Any value works as a key (ToPropertyKey): strings, numbers, and the
-      two confined symbols as themselves, everything else as its string form (`o[null]` is `o["null"]`, `o[{}]` is
-      `o["[object Object]"]`), in reads, writes, literals, `in`, and destructuring.
+      two confined symbols as themselves, data objects through their own `toString` (`o[[1, 2]]` is `o["1,2"]`), and
+      everything else as its string form (`o[null]` is `o["null"]`), in reads, writes, literals, `in`, and
+      destructuring.
 - [x] `Object.keys`, `Object.values`, `Object.entries`, `Object.hasOwn`, `Object.assign`, and `Object.fromEntries`, with
       synchronous iterator support for `fromEntries`. Sources follow ToObject: strings enumerate by index, other
       primitives and wrappers contribute nothing, and `null`/`undefined` throw. `Object.assign` accepts array
@@ -368,7 +378,6 @@ reject }` object.
       shares one prototype, where JavaScript gives each collection its own; `Object.getPrototypeOf` shows the
       difference.
 - [x] `length`, numeric indexing, index assignment, spread, and `for...of`.
-- [x] The `thisArg` argument of `Array.from` is accepted and ignored, like JS arrows.
 - [x] `Array.prototype.toSpliced`.
 - [x] Canonical array/string index parsing: keys such as `"01"` are ordinary properties rather than aliases of index
       `1`.
@@ -381,9 +390,9 @@ reject }` object.
       `flat(1.9)`, `with(1.5, v)`, `Math.max("3", "2")`, `parseInt("11", "2")`, `(1.5).toFixed("2")`,
       `String.fromCharCode("65")`, and the Uint8Array equivalents. `join(sep)` and `JSON.parse(text)` apply ToString
       (`join(null)` is `"1null2"`, `JSON.parse(123)` is `123`). `Array.from({ length: "2" })` applies ToLength; a
-      promise source still throws with an `await` hint rather than JS's silent `[]`. `join`, `Math.*`, and
-      `parseInt` consult a program object's own `valueOf`/`toString`; the array and number methods do not yet (see
-      ToPrimitive above).
+      promise source still throws with an `await` hint rather than JS's silent `[]`. `join`, `Math.*`, `parseInt`,
+      and the String and Number methods consult a program object's own `valueOf`/`toString`; the array methods do not
+      yet (see ToPrimitive above).
 
 ## Strings
 
@@ -400,14 +409,15 @@ reject }` object.
 - [x] Static `String.fromCharCode` and `String.fromCodePoint`.
 - [x] Native argument coercion for supported String methods; for example, `includes(1)` and `slice("1")` coerce like
       native JS, `split(undefined)` returns the whole string, and `includes`/`startsWith`/`endsWith` reject regular
-      expressions with a native-style `TypeError`. Opaque runtime references still reject as data errors, and
-      `repeat` still requires a finite non-negative count.
+      expressions with a native-style `TypeError`. Data objects convert through their own `toString`/`valueOf` (see
+      ToPrimitive above). Opaque runtime references still reject as data errors, and `repeat` still requires a finite
+      non-negative count.
 - [x] Native no-argument parity for `match()`, `matchAll()`, and `search()`; all behave as an empty pattern.
 - [x] `String.raw`, on a template object or any `{ raw }` object; raw strings and substitutions coerce through their own
       `toString`.
 - [x] `match`, `matchAll`, `search`, and `split` read any non-RegExp argument as a pattern string, as `new RegExp(arg)`
-      would: `"a1b".match(1)` matches `/1/`, `search(null)` looks for `"null"`, and `undefined` is the empty pattern.
-      Objects use their built-in string form until ToPrimitive lands.
+      would: `"a1b".match(1)` matches `/1/`, `search(null)` looks for `"null"`, `undefined` is the empty pattern, and
+      an object supplies its own `toString`.
 
 ## Numbers and Math
 
 
@@ -67,21 +67,24 @@ export const toPrimitiveNumber = <R>(ctx: Interpreter<R>, value: Value) =>
   Effect.map(toPrimitive(ctx, value, "number"), coerceToNumber)
 
 /**
- * Runs a synchronous native body on its arguments after ToPrimitive, in order, with one hint for all positions or
- * one per position. Primitive arguments skip the Effect entirely.
+ * Runs a native body on its arguments after ToPrimitive, in order, with one hint for all positions or one per
+ * position. Primitive arguments skip the Effect entirely.
  */
 export const withPrimitives = <R>(
   ctx: Interpreter<R>,
   hints: Hint | ReadonlyArray<Hint>,
   values: Array<Value>,
-  body: (primitives: Array<Value>) => Value,
+  body: (primitives: Array<Value>) => Value | Effect.Effect<Value, unknown, R>,
 ): Value | Effect.Effect<Value, unknown, R> => {
   if (!values.some((value) => value instanceof Obj)) return body(values)
-  return Effect.map(
+  return Effect.flatMap(
     Effect.forEach(values, (value, index) =>
       toPrimitive(ctx, value, typeof hints === "string" ? hints : hints[index]!),
     ),
-    body,
+    (primitives) => {
+      const result = body(primitives)
+      return Effect.isEffect(result) ? result : Effect.succeed(result)
+    },
   )
 }
 
 
@@ -123,6 +123,10 @@ const primitiveOperators = new Set([
   ">>>",
 ])
 
+/** ToPropertyKey on a primitive (or an opaque value, which keeps its built-in string form). */
+const propertyKey = (value: Value): PropertyKey =>
+  typeof value === "string" || typeof value === "number" || typeof value === "symbol" ? value : coerceToString(value)
+
 // What a loop does with its body's result: exit with a StatementResult, or undefined to keep iterating.
 // Unlabelled break ends this loop; a label the loop does not carry propagates outward.
 const loopExit = (result: StatementResult, labels: ReadonlySet<string> | undefined): StatementResult | undefined => {
@@ -1277,7 +1281,7 @@ class Frame<R> {
     }
     const keyNode = property.key
     if (property.computed) {
-      return Effect.map(this.evaluateExpression(keyNode), (value) => this.toPropertyKey(value))
+      return Effect.flatMap(this.evaluateExpression(keyNode), (value) => this.toPropertyKey(value, keyNode))
     }
     if (keyNode.type === "Identifier") return Effect.succeed(keyNode.name)
     if (keyNode.type === "Literal") return Effect.succeed(String(keyNode.value))
@@ -1400,6 +1404,10 @@ class Frame<R> {
     // IsLooselyEqual converts only an object facing a non-nullish primitive; two objects (including tool
     // references, which are not Obj) compare by identity.
     const equality = operator === "==" || operator === "!="
+    // `in` checks the right operand before ToPropertyKey on the left, so a bad right side wins over a bad key.
+    if (operator === "in" && lhs instanceof Obj && !isOpaque(lhs) && rhs instanceof Obj) {
+      return Effect.map(this.toPropertyKey(lhs, node), (key) => has(rhs, key))
+    }
     const other = lhs instanceof Obj ? rhs : lhs
     const converts =
       primitiveOperators.has(operator) ||
@@ -1419,9 +1427,7 @@ class Frame<R> {
     if (operator === "!==") return lhs !== rhs
     if (operator === "==") return this.looselyEqual(lhs, rhs, node)
     if (operator === "!=") return !this.looselyEqual(lhs, rhs, node)
-    if (operator === "in" && rhs instanceof Obj && !isOpaque(lhs)) {
-      return has(rhs, lhs !== null && typeof lhs === "object" ? coerceToString(lhs) : (lhs as PropertyKey))
-    }
+    if (operator === "in" && rhs instanceof Obj && !isOpaque(lhs)) return has(rhs, propertyKey(lhs))
     if (isOpaque(lhs) || isOpaque(rhs)) {
       throw invalidData("Binary operators require data values.", node)
     }
@@ -2046,11 +2052,11 @@ class Frame<R> {
         let key: PropertyKey
 
         if (property.computed) {
-          key = self.toPropertyKey(yield* self.evaluateExpression(keyNode))
+          key = yield* self.toPropertyKey(yield* self.evaluateExpression(keyNode), keyNode)
         } else if (keyNode.type === "Identifier") {
           key = keyNode.name
         } else if (keyNode.type === "Literal") {
-          key = self.toPropertyKey(literal(keyNode))
+          key = propertyKey(literal(keyNode))
         } else {
           throw typeError("Unsupported object property key shape.", keyNode)
         }
@@ -2178,11 +2184,16 @@ class Frame<R> {
       if (objectValue === OptionalShortCircuit) return OptionalShortCircuit
       if ((objectValue === null || objectValue === undefined) && node.optional) return OptionalShortCircuit
 
-      const key = node.computed
-        ? self.toPropertyKey(yield* self.evaluateExpression(propertyNode))
-        : propertyNode.type === "Identifier"
+      const keyValue =
+        !node.computed && propertyNode.type === "Identifier"
           ? propertyNode.name
-          : self.toPropertyKey(yield* self.evaluateExpression(propertyNode))
+          : yield* self.evaluateExpression(propertyNode)
+      // GetValue applies ToObject to the base before ToPropertyKey, so a nullish base throws before the key's own
+      // toString runs.
+      if (objectValue === null || objectValue === undefined) {
+        throw typeError(`Cannot read properties of ${objectValue} (reading '${coerceToString(keyValue)}').`, objectNode)
+      }
+      const key = yield* self.toPropertyKey(keyValue, propertyNode)
       return self.resolveProperty(objectValue, key, objectNode, propertyNode)
     })
   }
@@ -2314,9 +2325,10 @@ class Frame<R> {
     throw typeError(`Cannot assign to read only property '${String(key)}'.`, node)
   }
 
-  // ToPropertyKey: anything else becomes its string form, so `counts[row.category]` works when the field is null.
-  private toPropertyKey(value: Value): PropertyKey {
-    if (typeof value === "string" || typeof value === "number" || typeof value === "symbol") return value
-    return coerceToString(value)
+  // ToPropertyKey: a data object converts through its own `toString`/`valueOf` first; anything else becomes its
+  // string form synchronously, so `counts[row.category]` works when the field is null.
+  private toPropertyKey(value: Value, node: AstNode): Effect.Effect<PropertyKey, unknown, R> {
+    if (!(value instanceof Obj)) return Effect.succeed(propertyKey(value))
+    return Effect.map(this.toPrimitive(value, "string", node), propertyKey)
   }
 }
@@ -49,7 +49,7 @@ const arrayFrom = <R>(ctx: Interpreter<R>, args: Array<Value>): Effect.Effect<Va
       const values: Array<Value> = []
       for (let index = 0; index < arrayLike.length; index += 1) {
         const item = get(arrayLike.source, index)
-        values.push(apply === undefined ? item : yield* apply([item, index]))
+        values.push(apply === undefined ? item : yield* apply([item, index], args[2]))
       }
       return new Arr(proto, values)
     }
@@ -59,7 +59,9 @@ const arrayFrom = <R>(ctx: Interpreter<R>, args: Array<Value>): Effect.Effect<Va
       const step = yield* cursor.next
       if (step.done) return new Arr(proto, values)
       values.push(
-        apply === undefined ? step.value : yield* preserveConsumerError(cursor.close, apply([step.value, index])),
+        apply === undefined
+          ? step.value
+          : yield* preserveConsumerError(cursor.close, apply([step.value, index], args[2])),
       )
       index += 1
     }
@@ -372,7 +374,7 @@ export const arrayGlobal = <R>(ctx: Interpreter<R>) => {
           const values: Array<Value> = []
           for (let index = 0; index < length; index += 1) {
             if (!(index in target.items)) continue
-            const mapped = yield* apply([target.items[index], index, target])
+            const mapped = yield* apply([target.items[index], index, target], args[1])
             if (mapped instanceof Arr) values.push(...mapped.items)
             else values.push(mapped)
           }
@@ -411,7 +413,10 @@ export const callbackMethods = <R, T extends Obj>(
     length,
     (thisValue, args) => {
       const target = self(thisValue, name)
-      return body(elements(target), target, applyCollectionCallback(ctx, args[0], `${label}.${name}`), args)
+      const call = applyCollectionCallback(ctx, args[0], `${label}.${name}`)
+      // reduce and reduceRight take an initial value where the others take a thisArg.
+      const thisArg = name.startsWith("reduce") ? undefined : args[1]
+      return body(elements(target), target, (callbackArgs) => call(callbackArgs, thisArg), args)
     },
   ]
   return [
 
@@ -188,7 +188,7 @@ export const mapGlobal = <R>(ctx: Interpreter<R>) => {
         const target = self(thisValue, "forEach")
         const apply = applyCollectionCallback(ctx, args[0], "Map.forEach")
         return Effect.gen(function* () {
-          for (const [key, item] of target.map.entries()) yield* apply([item, key, target])
+          for (const [key, item] of target.map.entries()) yield* apply([item, key, target], args[1])
           return undefined
         })
       },
@@ -386,7 +386,7 @@ export const setGlobal = <R>(ctx: Interpreter<R>) => {
         const target = self(thisValue, "forEach")
         const apply = applyCollectionCallback(ctx, args[0], "Set.forEach")
         return Effect.gen(function* () {
-          for (const item of target.set.values()) yield* apply([item, item, target])
+          for (const item of target.set.values()) yield* apply([item, item, target], args[1])
           return undefined
         })
       },
 
@@ -117,7 +117,7 @@ export const headersGlobal = <R>(ctx: Interpreter<R>) => {
         const target = self(thisValue, "forEach")
         const apply = applyCollectionCallback(ctx, args[0], "Headers.forEach")
         return Effect.gen(function* () {
-          for (const [key, value] of Array.from(target.headers.entries())) yield* apply([value, key, target])
+          for (const [key, value] of Array.from(target.headers.entries())) yield* apply([value, key, target], args[1])
           return undefined
         })
       },