diff --git a/docs/compiling/output-and-diagnostics.md b/docs/compiling/output-and-diagnostics.md
index e09bcdb5c2..8edaeaa743 100644
--- a/docs/compiling/output-and-diagnostics.md
+++ b/docs/compiling/output-and-diagnostics.md
@@ -118,6 +118,10 @@ elephc --gc-stats heavy.php
 ./heavy
 ```
 
+Combined with `--web`, the server never reaches the process-exit report, so the
+counters are printed to stderr after every handled request instead — a growing
+`allocs - frees` gap across requests indicates a per-request leak.
+
 ### `--heap-debug`
 
 Enables runtime heap verification in the compiled program: double-free
diff --git a/src/codegen/frame.rs b/src/codegen/frame.rs
index cb9b2cc2cd..9fb0aec814 100644
--- a/src/codegen/frame.rs
+++ b/src/codegen/frame.rs
@@ -356,12 +356,19 @@ pub(super) fn emit_web_handler_prologue(ctx: &mut FunctionContext<'_>) {
 ///
 /// Like `emit_main_epilogue` it runs the per-request main local cleanup (so
 /// owned refcounted top-level locals are released each request) and restores the
-/// frame, but it `ret`s instead of exiting and skips the process-end gc-stats and
-/// heap-debug diagnostics, which are wrong to report per request.
+/// frame, but it `ret`s instead of exiting. Requested gc-stats are emitted after
+/// cleanup for every request; process-end heap-debug diagnostics remain skipped.
 pub(super) fn emit_web_handler_epilogue(ctx: &mut FunctionContext<'_>) {
     ctx.emitter.blank();
     ctx.emitter.comment("web handler epilogue + ret");
     emit_main_local_epilogue_cleanup(ctx);
+    // Under `--web` the handler returns to the bridge server loop instead of
+    // exiting, so the exit-based main epilogue (where `--gc-stats` normally
+    // prints) is never reached. Emitting the counters here, once per request,
+    // is the only way to observe them in server mode.
+    if ctx.gc_stats {
+        emit_gc_stats(ctx);
+    }
     emit_callee_saved_restores(ctx);
     abi::emit_frame_restore(ctx.emitter, ctx.frame_size);
     abi::emit_return(ctx.emitter);
diff --git a/src/ir_lower/context.rs b/src/ir_lower/context.rs
index c85894163d..d51a18deaa 100644
--- a/src/ir_lower/context.rs
+++ b/src/ir_lower/context.rs
@@ -1543,6 +1543,36 @@ impl<'m, 'f> LoweringContext<'m, 'f> {
             && matches!(op, Some(Op::ArrayGet | Op::HashGet))
     }
 
+    /// Returns whether an index-read receiver is itself an owned intermediate
+    /// produced by an index read, i.e. the inner step of a chained subscript
+    /// read such as `$a[$i][$j]`.
+    ///
+    /// Container reads of refcounted or boxed-Mixed elements return a +1 caller
+    /// reference (the `array_get`/`hash_get` emitters incref pointer payloads and
+    /// box Mixed cells), so when that result is consumed directly as the receiver
+    /// of another index read there is no local slot whose release machinery would
+    /// ever drop the reference — the consuming read must release it explicitly.
+    /// String results are excluded: they are borrowed pointers into the container
+    /// payload and carry no reference of their own.
+    pub(crate) fn value_is_owned_index_read_temp(&self, value: LoweredValue) -> bool {
+        let php_type = self.builder.value_php_type(value.value).codegen_repr();
+        if !(matches!(php_type, PhpType::Mixed | PhpType::Union(_))
+            || (php_type.is_refcounted() && php_type != PhpType::Str))
+        {
+            return false;
+        }
+        matches!(
+            self.builder.value_defining_op(value.value),
+            Some(
+                Op::ArrayGet
+                    | Op::ArrayGetSilent
+                    | Op::HashGet
+                    | Op::ArrayGetMixedKey
+                    | Op::ArrayGetMixedKeySilent
+            )
+        )
+    }
+
     /// Returns true for builtin calls whose return value is newly allocated for the caller.
     fn value_is_owning_builtin_temporary(&self, value: ValueId) -> bool {
         let Some(inst) = self.builder.value_defining_instruction(value) else {
diff --git a/src/ir_lower/expr/mod.rs b/src/ir_lower/expr/mod.rs
index a4cf283cf5..0d7403d15b 100644
--- a/src/ir_lower/expr/mod.rs
+++ b/src/ir_lower/expr/mod.rs
@@ -8593,14 +8593,38 @@ fn lower_array_access_from_value(
         _ => Op::RuntimeCall,
     };
     let result_type = array_access_result_type(ctx, array_value.value, op, expr);
-    ctx.emit_value(
+    let release_receiver = ctx.value_is_owned_index_read_temp(array_value);
+    let mut result = ctx.emit_value(
         op,
         vec![array_value.value, index_value.value],
         None,
         result_type,
         op.default_effects(),
         Some(expr.span),
-    )
+    );
+    // A chained subscript read (`$a[$i][$j]`) consumes the inner read's result
+    // directly as its receiver. That intermediate carries a +1 reference (the
+    // get emitters incref refcounted payloads and box Mixed cells), and unlike
+    // the hoisted form `$inner = $a[$i]; $inner[$j]` no local-slot release
+    // machinery ever drops it. Typed string reads borrow their bytes from that
+    // receiver, so stabilize the leaf before releasing the receiver: a later
+    // expression can otherwise drop the parent's last reference and leave the
+    // extracted string dangling. Mixed reads already return independent owned
+    // cells and do not need this copy.
+    if release_receiver && result.ir_type == IrType::Str {
+        result = ctx.emit_value(
+            Op::StrPersist,
+            vec![result.value],
+            None,
+            PhpType::Str,
+            Op::StrPersist.default_effects(),
+            Some(expr.span),
+        );
+    }
+    if release_receiver {
+        crate::ir_lower::ownership::release_if_owned(ctx, array_value, Some(expr.span));
+    }
+    result
 }
 
 /// Lowers nullable receiver indexing without evaluating the index on a null receiver.
@@ -8929,6 +8953,12 @@ fn lower_ternary(
 /// Lowers a cast expression.
 fn lower_cast(ctx: &mut LoweringContext<'_, '_>, target: &CastType, inner: &Expr, expr: &Expr) -> LoweredValue {
     let value = lower_expr(ctx, inner);
+    // Keep the original producer visible for a no-op string cast. Wrapping an
+    // owned string temporary in `Cast(Str)` would hide its ownership from the
+    // retaining store/call cleanup and leak the detached string allocation.
+    if matches!(target, CastType::String) && value.ir_type == IrType::Str {
+        return value;
+    }
     let php_type = cast_php_type(target);
     let result = ctx.emit_value(
         Op::Cast,
diff --git a/tests/codegen/eval.rs b/tests/codegen/eval.rs
index c9fc08152a..8009e26b26 100644
--- a/tests/codegen/eval.rs
+++ b/tests/codegen/eval.rs
@@ -19832,32 +19832,63 @@ eval('enum bool { case Ready; }');
     );
 }
 
-/// Verifies eval rejects PHP-reserved bare class-like reference names.
+/// Asserts one eval fragment rejects a PHP-reserved bare class-like reference name.
+fn assert_eval_reserved_class_like_reference_name_fails(source: &str) {
+    let err = compile_and_run_expect_failure(source);
+    assert!(
+        err.contains("Fatal error: eval() fragment uses an unsupported construct"),
+        "stderr did not contain eval unsupported-construct diagnostic: {err}"
+    );
+}
+
+/// Verifies eval rejects a reserved class name in an `extends` reference.
 #[test]
-fn test_eval_reserved_class_like_reference_name_fails() {
-    for source in [
+fn test_eval_reserved_extends_class_reference_name_fails() {
+    assert_eval_reserved_class_like_reference_name_fails(
         r#"<?php
 eval('class EvalBadExtends extends match {}');
 "#,
+    );
+}
+
+/// Verifies eval rejects a reserved class name in an `implements` reference.
+#[test]
+fn test_eval_reserved_implements_class_reference_name_fails() {
+    assert_eval_reserved_class_like_reference_name_fails(
         r#"<?php
 eval('class EvalBadImplements implements match {}');
 "#,
+    );
+}
+
+/// Verifies eval rejects a reserved trait name in a `use` reference.
+#[test]
+fn test_eval_reserved_trait_use_reference_name_fails() {
+    assert_eval_reserved_class_like_reference_name_fails(
         r#"<?php
 eval('class EvalBadTraitUse { use match; }');
 "#,
+    );
+}
+
+/// Verifies eval rejects a reserved class name in a `new` expression.
+#[test]
+fn test_eval_reserved_new_class_reference_name_fails() {
+    assert_eval_reserved_class_like_reference_name_fails(
         r#"<?php
 eval('$box = new match();');
 "#,
+    );
+}
+
+/// Verifies eval rejects a reserved class name in an `instanceof` expression.
+#[test]
+fn test_eval_reserved_instanceof_class_reference_name_fails() {
+    assert_eval_reserved_class_like_reference_name_fails(
         r#"<?php
 eval('$ok = $box instanceof match;');
 "#,
-    ] {
-        let err = compile_and_run_expect_failure(source);
-        assert!(
-            err.contains("Fatal error: eval() fragment uses an unsupported construct"),
-            "stderr did not contain eval unsupported-construct diagnostic: {err}"
-        );
-    }
+    );
 }
 
 /// Verifies eval-declared final class constants cannot be redeclared.
diff --git a/tests/codegen/runtime_gc/regressions.rs b/tests/codegen/runtime_gc/regressions.rs
index bdf32578f7..e95cee2fa7 100644
--- a/tests/codegen/runtime_gc/regressions.rs
+++ b/tests/codegen/runtime_gc/regressions.rs
@@ -1230,3 +1230,134 @@ echo "done";
         "promoting an indexed array literal to hash storage must free the source array (issue #408)"
     );
 }
+
+/// Regression test for issue #516: a chained subscript read (`$a[$t][1]`) on a
+/// nested indexed array materializes the inner array as an owned +1 temporary
+/// (the inner `array_get` increfs refcounted elements), and nothing ever
+/// released it, leaking the inner array's blocks on every evaluation. The
+/// consuming (outer) index read must release the intermediate once its result
+/// is extracted. Regression: heap must be clean at exit and output unchanged.
+#[test]
+fn test_regression_516_chained_subscript_read_does_not_leak() {
+    let out = compile_and_run_with_heap_debug(
+        r#"<?php
+function make(int $n): array {
+    $a = [];
+    for ($i = 0; $i < $n; $i++) { $a[] = ['kw', 'word' . $i]; }
+    return $a;
+}
+$a = make(50);
+$n = count($a);
+$out = 0;
+for ($t = 0; $t < $n; $t++) { $x = (string) $a[$t][1]; $out = $out + strlen($x); }
+echo 'out=' . $out;
+"#,
+    );
+    assert!(out.success, "program failed: {}", out.stderr);
+    // 10 five-char values (word0..word9) + 40 six-char values (word10..word49).
+    assert_eq!(out.stdout, "out=290");
+    assert!(
+        out.stderr.contains("HEAP DEBUG: leak summary: clean"),
+        "expected a clean heap, got: {}",
+        out.stderr
+    );
+}
+
+/// Regression test for issue #516 (three-level chain): every intermediate of a
+/// deeper chained subscript read (`$a[$i][$j][$k]`) is an owned container
+/// temporary and each must be released by its consuming read. Also guards
+/// against over-eager releases: each intermediate stays alive through its
+/// parent container's reference, so the extracted leaf string must stay valid.
+/// Building the triple-nested structure has a small pre-existing constant leak
+/// (2 blocks, unrelated to reads), so this asserts via GC counters that the
+/// alloc/free gap stays constant instead of growing with read iterations.
+#[test]
+fn test_regression_516_three_level_chained_read_does_not_leak() {
+    let out = compile_and_run_with_gc_stats(
+        r#"<?php
+$a = [];
+for ($i = 0; $i < 3; $i++) {
+    $mid = [];
+    for ($j = 0; $j < 3; $j++) { $mid[] = ['leaf', 'val' . $i . $j]; }
+    $a[] = $mid;
+}
+$out = 0;
+for ($r = 0; $r < 40; $r++) {
+    for ($i = 0; $i < 3; $i++) {
+        for ($j = 0; $j < 3; $j++) {
+            $x = (string) $a[$i][$j][1];
+            $out = $out + strlen($x);
+        }
+    }
+}
+echo 'out=' . $out;
+"#,
+    );
+    assert!(out.success, "program failed: {}", out.stderr);
+    assert_eq!(out.stdout, "out=1800");
+    let (allocs, frees) = parse_gc_stats(&out.stderr);
+    // Before the fix the leaked +1 references pinned every distinct mid/leaf
+    // container past process cleanup (gap of 32 blocks on this fixture); after
+    // the fix only the 2-block build residue may remain.
+    assert!(
+        allocs >= frees && allocs - frees < 10,
+        "chained three-level reads must release their intermediates: allocs={} frees={}",
+        allocs,
+        frees
+    );
+}
+
+/// Regression test for issue #516 (string-keyed nesting): a chained
+/// associative read (`$m['x']['y']`) goes through `hash_get`, whose refcounted
+/// results also carry a +1 caller reference. The chained consumer must release
+/// the intermediate hash exactly like the indexed-array path. Regression: heap
+/// must be clean at exit after repeated evaluation.
+#[test]
+fn test_regression_516_chained_string_keyed_read_does_not_leak() {
+    let out = compile_and_run_with_heap_debug(
+        r#"<?php
+$m = ['x' => ['y' => 'deep', 'z' => 'other'], 'w' => ['y' => 'second']];
+for ($i = 0; $i < 200; $i++) {
+    $v = (string) $m['x']['y'];
+}
+echo $m['x']['y'];
+"#,
+    );
+    assert!(out.success, "program failed: {}", out.stderr);
+    assert_eq!(out.stdout, "deep");
+    assert!(
+        out.stderr.contains("HEAP DEBUG: leak summary: clean"),
+        "expected a clean heap, got: {}",
+        out.stderr
+    );
+}
+
+/// Regression test for issue #516: a typed string extracted from a chained
+/// read must remain valid when a later call argument releases the parent array.
+#[test]
+fn test_regression_516_chained_string_survives_parent_release() {
+    let out = compile_and_run_with_heap_debug(
+        r#"<?php
+function replace_parent(array &$value): string {
+    $value = [];
+    return str_repeat('Z', 128);
+}
+function emit_pair(string $left, string $right): void {
+    echo $left;
+    echo $right;
+}
+$a = [[str_repeat('L', 128)]];
+emit_pair($a[0][0], replace_parent($a));
+"#,
+    );
+    assert!(out.success, "program failed: {}", out.stderr);
+    assert_eq!(
+        out.stdout,
+        format!("{}{}", "L".repeat(128), "Z".repeat(128))
+    );
+    assert!(
+        out.stderr.contains("HEAP DEBUG: leak summary: clean"),
+        "expected a clean heap, got: {}",
+        out.stderr
+    );
+}
diff --git a/tests/web_tests.rs b/tests/web_tests.rs
index 89488116b8..1dc1f1328a 100644
--- a/tests/web_tests.rs
+++ b/tests/web_tests.rs
@@ -17,7 +17,7 @@ use std::fs;
 use std::io::{Read, Write};
 use std::net::TcpStream;
 use std::path::{Path, PathBuf};
-use std::process::Command;
+use std::process::{Command, Stdio};
 use std::sync::atomic::{AtomicUsize, Ordering};
 use std::time::{Duration, Instant};
 
@@ -45,14 +45,14 @@ fn elephc_bin() -> String {
     })
 }
 
-/// Compiles `source` with the given extra elephc flags; returns the binary path.
-fn compile_web(dir: &Path, source: &str, stem: &str) -> PathBuf {
+/// Compiles `source` in web mode with extra compiler flags and returns the binary path.
+fn compile_web_with_flags(dir: &Path, source: &str, stem: &str, flags: &[&str]) -> PathBuf {
     let php = dir.join(format!("{}.php", stem));
     fs::write(&php, source).unwrap();
     let mut cmd = Command::new(elephc_bin());
     cmd.env("XDG_CACHE_HOME", dir.join("cache-root"));
     cmd.current_dir(dir);
-    cmd.arg("--web").arg(&php);
+    cmd.arg("--web").args(flags).arg(&php);
     let output = cmd.output().expect("failed to spawn elephc");
     assert!(
         output.status.success(),
@@ -62,6 +62,11 @@ fn compile_web(dir: &Path, source: &str, stem: &str) -> PathBuf {
     dir.join(stem)
 }
 
+/// Compiles `source` in web mode without extra compiler flags.
+fn compile_web(dir: &Path, source: &str, stem: &str) -> PathBuf {
+    compile_web_with_flags(dir, source, stem, &[])
+}
+
 /// Picks an ephemeral localhost port by binding :0 and releasing it.
 fn free_port() -> u16 {
     let l = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
@@ -578,6 +583,60 @@ fn web_conditional_early_return_halts() {
     assert!(good.ends_with("good"), "ok body must be 'good': {:?}", good);
 }
 
+/// Verifies `--gc-stats` emits one counter line after every web request,
+/// including a request that leaves the top-level handler through early return.
+#[test]
+fn web_gc_stats_are_emitted_per_request() {
+    let dir = make_test_dir("web_gc_stats");
+    let src = "<?php if (!isset($_GET['ok'])) { echo 'early'; return; } echo 'normal';";
+    let bin = compile_web_with_flags(&dir, src, "app", &["--gc-stats"]);
+    let port = free_port();
+    let addr = format!("127.0.0.1:{}", port);
+    let stderr_path = dir.join("server.stderr");
+    let stderr_file = fs::File::create(&stderr_path).expect("create server stderr capture");
+    let mut child = Command::new(&bin)
+        .args(["--listen", &addr, "--workers", "1"])
+        .stderr(Stdio::from(stderr_file))
+        .spawn()
+        .expect("spawn web server with gc stats");
+    wait_until_ready(&addr);
+
+    let early = http_request(&addr, "GET", "/", &[], "");
+    let normal = http_request(&addr, "GET", "/?ok=1", &[], "");
+    let pid = child.id();
+    let signal = Command::new("kill")
+        .args(["-TERM", &pid.to_string()])
+        .status()
+        .expect("send SIGTERM to web server");
+    assert!(signal.success(), "failed to stop web server");
+    let status = child.wait().expect("wait for web server shutdown");
+    assert_eq!(status.code(), Some(0), "web server must stop cleanly");
+
+    assert!(early.ends_with("early"), "early-return response: {:?}", early);
+    assert!(normal.ends_with("normal"), "normal response: {:?}", normal);
+    let stderr = fs::read_to_string(&stderr_path).expect("read captured server stderr");
+    let stats: Vec<&str> = stderr
+        .lines()
+        .filter(|line| line.starts_with("GC: allocs="))
+        .collect();
+    assert_eq!(
+        stats.len(),
+        2,
+        "expected one gc-stats line per handled request, stderr: {}",
+        stderr
+    );
+    for line in stats {
+        let Some((allocs, frees)) = line
+            .strip_prefix("GC: allocs=")
+            .and_then(|rest| rest.split_once(" frees="))
+        else {
+            panic!("malformed gc-stats line: {}", line);
+        };
+        assert!(allocs.parse::<u64>().is_ok(), "invalid allocation count: {}", line);
+        assert!(frees.parse::<u64>().is_ok(), "invalid free count: {}", line);
+    }
+}
+
 /// Verifies a request body over --max-body-size is rejected with 413, and a body
 /// under the limit is served normally.
 #[test]