diff --git a/crates/oxide_emit/src/stmt/iteration/for_in.rs b/crates/oxide_emit/src/stmt/iteration/for_in.rs
index dee29822..b5e46ee1 100644
--- a/crates/oxide_emit/src/stmt/iteration/for_in.rs
+++ b/crates/oxide_emit/src/stmt/iteration/for_in.rs
@@ -89,7 +89,7 @@ impl Emitter {
                         self.emit_throw_error("TypeError", "cannot assign to read-only property", ctx)?;
                     }
                 } else {
-                    let is_implicit = ctx.implicit_global_writes.contains(&var_reg);
+                    let is_implicit = ctx.is_implicit_global_reg(var_reg);
                     if is_implicit && ctx.is_strict {
                         // 严格模式未声明写：抛 ReferenceError，跳过寄存器写（值无关）。
                         self.emit_strict_undeclared_write(name, ctx)?;
diff --git a/crates/oxide_emit/src/stmt/iteration/for_of.rs b/crates/oxide_emit/src/stmt/iteration/for_of.rs
index 1028b628..941b95b3 100644
--- a/crates/oxide_emit/src/stmt/iteration/for_of.rs
+++ b/crates/oxide_emit/src/stmt/iteration/for_of.rs
@@ -116,7 +116,7 @@ impl Emitter {
                         self.emit_throw_error("TypeError", "cannot assign to read-only property", ctx)?;
                     }
                 } else {
-                    let is_implicit = ctx.implicit_global_writes.contains(&var_reg);
+                    let is_implicit = ctx.is_implicit_global_reg(var_reg);
                     if is_implicit && ctx.is_strict {
                         // 严格模式未声明写：抛 ReferenceError，跳过寄存器写（值无关）。
                         self.emit_strict_undeclared_write(name, ctx)?;
diff --git a/crates/oxide_vm/tests/implicit_global_write_tests.rs b/crates/oxide_vm/tests/implicit_global_write_tests.rs
index d3dc524b..11831b2b 100644
--- a/crates/oxide_vm/tests/implicit_global_write_tests.rs
+++ b/crates/oxide_vm/tests/implicit_global_write_tests.rs
@@ -188,9 +188,28 @@ fn undeclared_read_then_destructuring_write_reaches_global() {
     assert!(r.is_bool() && r.as_bool(), "先读后解构写应穿透全局对象，实际 {:?}", r);
 }
 
+// ── for-in/for-of 左侧先读后写：全局槽由读侧登记，LHS 写同样须穿透全局对象 ──
+#[test]
+fn undeclared_read_then_for_in_write_reaches_global() {
+    let r = eval_many(&["globalThis.k = 0", "var seen = k", "for (k in { a: 1 }) {}", "globalThis.k === 'a'"]).unwrap();
+    assert!(r.is_bool() && r.as_bool(), "先读后 for-in 左侧写应穿透全局对象，实际 {:?}", r);
+}
+
+#[test]
+fn undeclared_read_then_for_of_write_reaches_global() {
+    let r = eval_many(&["globalThis.v = 0", "var seen = v", "for (v of [1, 2]) {}", "globalThis.v === 2"]).unwrap();
+    assert!(r.is_bool() && r.as_bool(), "先读后 for-of 左侧写应穿透全局对象，实际 {:?}", r);
+}
+
 // ── 严格模式：读侧已登记的全局槽同属未解析引用，后写抛 ReferenceError ──
 #[test]
 fn strict_undeclared_read_then_write_throws_reference() {
     let result = eval("'use strict'; globalThis.s = 0; var seen = s; s = 5");
     assert_err_contains(result, "s is not defined");
 }
+
+#[test]
+fn strict_undeclared_read_then_for_in_write_throws_reference() {
+    let result = eval("'use strict'; globalThis.k = 0; var seen = k; for (k in { a: 1 }) {}");
+    assert_err_contains(result, "k is not defined");
+}