@scriptc/compiler 0.0.7 → 0.0.9

package/dist/frontend/lowering/lower-calls.js

@@ -7,16 +7,16 @@ import { lowerGenMethodCall } from "./lower-generators.js";
 import { BOOL, CAUGHT, DYN, F64, JSVAL, STRING, SYMBOL_T, UNDEFINED_T, VOID, arrayOf, canBoxFuncIntoDyn, canConvertToDyn, canDynCheckTo, canMarshalTypedFuncIntoIsland, funcOf, isUnitType, shapeHasAccessorSlots, typeEquals } from "../../ir/nodes.js";
 import { isJsSourceFile, locOf } from "../program.js";
 import { isGenericCallableMemberType, typeKey } from "../types.js";
-import { PoisonError, dynFallbackType, dynUndefinedExpr, importCallHandleType, jsFuncNameOf, newFnCtx } from "./lowerer.js";
+import { PoisonError, dynFallbackType, dynUndefinedExpr, importCallHandleType, jsFuncNameOf, newFnCtx, nodeThrowExpr } from "./lowerer.js";
 import { enforceLibBoundary } from "./lib-boundary.js";
-import { builtinFenceHintOf, builtinModuleFnOf } from "./surfaces.js";
+import { NARROW_FIRST, builtinFenceHintOf, builtinModuleFnOf } from "./surfaces.js";
 import { requiresDynamicDiag } from "../../diagnostics/diagnostic.js";
 import { mixinFnShapeOf } from "./lower-mixins.js";
 import { bufEncoding, dynStringReceiver, lowerArrayFromCall, lowerDynArrayFilterCall, lowerDynArrayFlatMapCall, lowerGroupByStaticCall, lowerIteratorHelperCall, lowerObjectAssignIndexShape, lowerObjectFromEntriesCall, lowerObjectIterOverIndexShape, lowerRegexMethodCall, lowerStringMethodCall, lowerTupleReadMethodCall } from "./lower-containers.js";
 import { lowerChildStreamMethodCall, lowerDirentMethodCall, lowerPerfHooksCall, lowerProcStreamMethodCall, lowerReflectApplyCall, lowerWatcherMethodCall } from "./lower-builtins.js";
-import { lowerPromiseAllTupleCall, lowerPromiseRejectCall, probeLower, templateRawTextOf } from "./lower-exprs.js";
+import { droppableStatic, lowerPromiseAllTupleCall, lowerPromiseRejectCall, probeLower, templateRawTextOf } from "./lower-exprs.js";
 import { httpClientFnBindingOf, isStreamUndefCallExpr, lowerHttpClientFnCall } from "./lower-server.js";
-import { EMITTER_API_MEMBERS, findGenericMethodOn, lowerClassGenericMethodCall, lowerStaticMethodCall } from "./lower-classes.js";
+import { EMITTER_API_MEMBERS, exactInstanceClassOf, findGenericMethodOn, lowerClassGenericMethodCall, lowerStaticMethodCall } from "./lower-classes.js";
 import { emitterRooted, lowerEmitterMethodCall } from "./lower-emitter.js";
 import { lowerConsoleInspectArg, lowerFormatCall } from "./lower-inspect.js";
 import { STREAM_API_MEMBERS, lowerStreamMethodCall, lowerStreamModuleCall, lowerStreamStaticCall, streamSidesOf } from "./lower-stream.js";
@@ -107,9 +107,20 @@ export function paramShape(L, param) {
         // ARRAY param the dyn call thunk fills with the call's surplus
         // arguments; the binding is that array (dynRest — funcType marks
         // `rest`, and the value only ever calls through the boxed thunk).
-        if (isJsSourceFile(param.getSourceFile()) &&
-            L.mapTypeOf(L.typeOf(param.name))?.kind !== "array") {
-            return { type: DYN, mode: "dynRest" };
+        if (isJsSourceFile(param.getSourceFile())) {
+            const restMapped = L.mapTypeOf(L.typeOf(param.name));
+            // `any[]` under --dynamic maps to an island-element array — that
+            // is inference residue, not element information; the binding is
+            // the ENGINE's own arguments array (an island handle) and the
+            // value crosses as a REST host function (the withPlugins
+            // `async (...args) =>` shape). Static builds keep the variadic
+            // dyn form for every unmappable JS rest.
+            if (restMapped?.kind === "array" && restMapped.elem.kind === "jsval" && L.dynamic) {
+                return { type: JSVAL, mode: "islandRest" };
+            }
+            if (restMapped?.kind !== "array") {
+                return { type: DYN, mode: "dynRest" };
+            }
         }
         const type = L.irTypeOf(param.name);
         // Tuple-typed rest params don't map to an array; generic rest is the
@@ -213,7 +224,7 @@ export function completeArgs(L, argNodes, shapes, loc, blame,
 leading) {
     const isIr = (s) => s !== undefined && !("kind" in s);
     const sources = leading && leading.length > 0 ? [...leading.map((ir) => ({ ir })), ...argNodes] : argNodes;
-    const restAt = shapes.findIndex((s) => s.mode === "rest" || s.mode === "dynRest");
+    const restAt = shapes.findIndex((s) => s.mode === "rest" || s.mode === "dynRest" || s.mode === "islandRest");
     const positional = restAt >= 0 ? shapes.slice(0, restAt) : [...shapes];
     const out = positional.map((shape, i) => {
         const src = sources[i];
@@ -243,7 +254,21 @@ leading) {
         }
         return L.undefinedArgFor(shape.type, loc, blame);
     });
-    if (restAt >= 0 && shapes[restAt].mode === "dynRest") {
+    if (restAt >= 0 && shapes[restAt].mode === "islandRest") {
+        // The ISLAND variadic pack: surplus arguments marshal into one
+        // fresh ENGINE array — exactly what the REST host-call adapter
+        // hands the closure for indirect calls.
+        const elems = sources.slice(restAt).map((a) => {
+            if (isIr(a))
+                return L.coerceInto(blame, a.ir, JSVAL);
+            if (ts.isSpreadElement(a)) {
+                L.unsupported("SC1090", a, "spread arguments into an island rest parameter");
+            }
+            return L.lowerExprExpecting(a, JSVAL);
+        });
+        out.push({ kind: "jsOp", op: "arrLit", args: elems, type: JSVAL, loc });
+    }
+    else if (restAt >= 0 && shapes[restAt].mode === "dynRest") {
         // The VARIADIC dyn pack (a JS `...args` with no static element
         // type, or the synthetic `arguments` slot): surplus arguments
         // convert through the dyn boundary into one fresh DOM array —
@@ -405,6 +430,7 @@ export function requireExactArityValue(L, blame, contextual, shapes, funcType) {
     // tier's undefined (omittedArgFor).
     if (shapes.every((s) => s.mode === "required" ||
         s.mode === "dynRest" ||
+        s.mode === "islandRest" ||
         (s.mode === "omittable" && (s.type.kind === "dyn" || s.type.kind === "jsval")))) {
         return;
     }
@@ -831,24 +857,61 @@ export function genericCallInstance(L, expr, info) {
         fenceGenericSignatureResult(L, expr, retTs);
         L.badType(expr, retTs);
     }
-    return internGenericInstance(L, expr, info, params, returnType, () => L.inferTypeParamBindings(expr, info, rsig));
+    // keyof-constrained type parameters (`K extends keyof T`): the bound
+    // LITERAL is semantic — the instance body reads the named field — so
+    // the bindings compute EAGERLY (the key needs them) and each literal
+    // keys its own instance (`pick(o, "a")` and `pick(o, "b")` map to the
+    // same IR signature when the fields agree, but their bodies read
+    // different fields). Non-literal bindings (a key union, plain string)
+    // share one runtime-keyed instance per IR signature, exactly the
+    // widened discipline.
+    const keyofTps = keyofConstrainedTypeParams(info);
+    if (keyofTps.size > 0) {
+        const tsBindings = new Map();
+        const bindings = L.inferTypeParamBindings(expr, info, rsig, tsBindings);
+        const litKey = info.typeParams
+            .filter((tp) => keyofTps.has(tp))
+            .map((tp) => {
+            const bound = tsBindings.get(tp);
+            return bound?.isStringLiteralType() ? JSON.stringify(bound.value)
+                : bound?.isNumberLiteralType() ? String(bound.value)
+                    : "*";
+        })
+            .join(",");
+        return internGenericInstance(L, expr, info, params, returnType, () => bindings, {
+            extraKey: `@${litKey}`,
+            tsBindings,
+        });
+    }
+    return internGenericInstance(L, expr, info, params, returnType, (tsBindings) => L.inferTypeParamBindings(expr, info, rsig, tsBindings));
 }
 /** The one instance table both instantiation routes share: key identity IS
    * signature identity, so a call (`identity(1)`) and a pinned VALUE
    * (`const f: (x: number) => number = identity`) reuse one compiled
    * instance. `makeBindings` runs only for a NEW key (binding inference
    * costs checker walks). */
-export function internGenericInstance(L, blame, info, params, returnType, makeBindings) {
-    const key = `${params.map((s) => typeKey(s.type)).join(",")}=>${typeKey(returnType)}`;
+export function internGenericInstance(L, blame, info, params, returnType, makeBindings, opts) {
+    // keyof-constrained instantiations append their literal keys
+    // (extraKey): the IR signature alone under-discriminates there — two
+    // literals can map to one IR signature while their bodies read
+    // different fields.
+    const key = `${params.map((s) => typeKey(s.type)).join(",")}=>${typeKey(returnType)}${opts?.extraKey ?? ""}`;
     let inst = info.instances.get(key);
     if (!inst) {
         if (info.instances.size >= MAX_GENERIC_INSTANCES) {
             L.unsupported("SC1090", blame, `unbounded generic instantiation ('${info.baseName}' exceeded ` +
                 `${MAX_GENERIC_INSTANCES} instances — polymorphic recursion?)`);
         }
-        const bindings = makeBindings();
+        const tsBindings = opts?.tsBindings ?? new Map();
+        const bindings = makeBindings(tsBindings);
         const rendered = info.typeParams
             .map((tp) => {
+            // A literal-bound keyof parameter renders its literal — the
+            // instance is per-literal, and '<…, string>' would misname it.
+            const tsBound = tsBindings.get(tp);
+            if (info.keyofTps?.has(tp) && tsBound?.isStringLiteralType()) {
+                return JSON.stringify(tsBound.value);
+            }
             const bound = bindings.get(tp);
             return bound ? L.fmt(bound) : tp.name;
         })
@@ -861,6 +924,7 @@ export function internGenericInstance(L, blame, info, params, returnType, makeBi
             params,
             returnType,
             bindings,
+            tsBindings,
             typeArgsText,
         };
         info.instances.set(key, inst);
@@ -868,40 +932,65 @@ export function internGenericInstance(L, blame, info, params, returnType, makeBi
     }
     return inst;
 }
+/** The type parameters of `info` declared with a `keyof` CONSTRAINT
+   * (`K extends keyof T`) — the parameters whose bound literal is semantic
+   * (the body's `o[k]` reads the named field), computed once per info from
+   * the declaration's syntax. */
+export function keyofConstrainedTypeParams(info) {
+    if (info.keyofTps)
+        return info.keyofTps;
+    const out = new Set();
+    info.decl.typeParameters?.forEach((tpDecl, i) => {
+        const sym = info.typeParams[i];
+        if (!sym || tpDecl.constraint === undefined)
+            return;
+        if (ts.isTypeOperatorNode(tpDecl.constraint) && tpDecl.constraint.operator === ts.SyntaxKind.KeyOfKeyword) {
+            out.add(sym);
+        }
+    });
+    info.keyofTps = out;
+    return out;
+}
 /** Type-parameter symbol → concrete IR type for one instantiation.
    * Explicit type arguments bind directly; the rest come from structurally
    * matching each DECLARED param/return type (which mentions the type
    * parameters) against the checker's INSTANTIATED one — the latter is the
    * former with the substitution applied, so the shapes are parallel by
    * construction. A type parameter left unbound only matters if the body
-   * mentions it, where mapType fails with SC2001 (carrying the
-   * instantiation context). */
-export function inferTypeParamBindings(L, expr, info, rsig) {
+   * mentions it, where mapType fails and badType names the shape
+   * (carrying the instantiation context). */
+export function inferTypeParamBindings(L, expr, info, rsig, tsBindings) {
     const bindings = new Map();
     expr.typeArguments?.forEach((ta, i) => {
         const tp = info.typeParams[i];
         if (!tp)
             return;
-        const mapped = L.mapTypeOf(L.checker.getTypeFromTypeNode(ta));
-        if (mapped && mapped.kind !== "void")
+        const taT = L.checker.getTypeFromTypeNode(ta);
+        const mapped = L.mapTypeOf(taT);
+        if (mapped && mapped.kind !== "void") {
             bindings.set(tp, mapped);
+            tsBindings?.set(tp, taT);
+        }
     });
-    unifySignatureBindings(L, info, rsig, bindings);
-    bindDefaultTypeParams(L, info.typeParams, info.decl.typeParameters, bindings);
+    unifySignatureBindings(L, info, rsig, bindings, tsBindings);
+    bindDefaultTypeParams(L, info.typeParams, info.decl.typeParameters, bindings, tsBindings);
     return bindings;
 }
 /** Type parameters still unbound after unification take their declared
    * DEFAULT (`<T = number>`), mapped — the checker already substituted the
    * default into every resolved signature, so this only fills the bindings
    * an instance body's mapType consults. */
-export function bindDefaultTypeParams(L, typeParams, typeParamDecls, bindings) {
+export function bindDefaultTypeParams(L, typeParams, typeParamDecls, bindings, tsBindings) {
     typeParamDecls?.forEach((tpDecl, i) => {
         const tp = typeParams[i];
         if (!tp || bindings.has(tp) || !tpDecl.defaultType)
             return;
-        const mapped = L.mapTypeOf(L.checker.getTypeFromTypeNode(tpDecl.defaultType));
-        if (mapped && mapped.kind !== "void")
+        const defT = L.checker.getTypeFromTypeNode(tpDecl.defaultType);
+        const mapped = L.mapTypeOf(defT);
+        if (mapped && mapped.kind !== "void") {
             bindings.set(tp, mapped);
+            tsBindings?.set(tp, defT);
+        }
     });
 }
 /** The structural half of binding inference: unify the DECLARED signature
@@ -910,7 +999,7 @@ export function bindDefaultTypeParams(L, typeParams, typeParamDecls, bindings) {
    * completed signature a VALUE reference is pinned to (the contextual
    * type's one call signature). Mutates `bindings`; already-bound
    * parameters (explicit type arguments) win. */
-export function unifySignatureBindings(L, info, rsig, bindings) {
+export function unifySignatureBindings(L, info, rsig, bindings, tsBindings) {
     const tpSet = new Set(info.typeParams);
     const seen = new Set(); // recursive declared types must not loop
     // The identity-keyed set cannot catch LAZILY INFINITE anonymous types
@@ -927,10 +1016,22 @@ export function unifySignatureBindings(L, info, rsig, bindings) {
             return;
         if (declared.flags & ts.TypeFlags.TypeParameter) {
             const sym = declared.getSymbol();
-            if (sym && tpSet.has(sym) && !bindings.has(sym)) {
-                const mapped = L.mapTypeOf(inst);
-                if (mapped && mapped.kind !== "void")
-                    bindings.set(sym, mapped);
+            if (sym && tpSet.has(sym)) {
+                // The checker type records even when an explicit type argument
+                // already bound the IrType: the raw type is the SAME binding
+                // pre-widening, and first-hit-wins keeps the two maps parallel.
+                // A generic body FORWARDING its own parameter (`pluck`'s
+                // `pick(it, key)` binds pick's K to pluck's K) resolves through
+                // the enclosing instantiation's ts bindings first — the literal
+                // carries through the chain.
+                if (tsBindings && !tsBindings.has(sym)) {
+                    tsBindings.set(sym, L.typeParamTsResolver(inst) ?? inst);
+                }
+                if (!bindings.has(sym)) {
+                    const mapped = L.mapTypeOf(inst);
+                    if (mapped && mapped.kind !== "void")
+                        bindings.set(sym, mapped);
+                }
             }
             return;
         }
@@ -1049,6 +1150,13 @@ export function lowerGenericInstance(L, info, inst) {
     L.typeParamBindings = clsBindings
         ? new Map([...clsBindings, ...inst.bindings])
         : inst.bindings;
+    // The ts-level bindings ride along: `T[K]` and literal-keyed `o[k]`
+    // reads inside the body resolve through the bound CHECKER types
+    // (typeParamTsResolver). Generic-class instantiations carry no
+    // ts-level bindings (their type arguments widened at the reference),
+    // so only the method instantiation's own map installs.
+    const prevTsBindings = L.typeParamTsBindings;
+    L.typeParamTsBindings = inst.tsBindings ?? null;
     // Implicit-any instances thread their param bindings through typeOf
     // (the checker reports `any` inside the body — there is no T for
     // mapType to substitute); see the implicit-monomorphization section.
@@ -1186,6 +1294,7 @@ export function lowerGenericInstance(L, info, inst) {
         L.fnStack.pop();
         L.currentClass = prevClass;
         L.typeParamBindings = prevBindings;
+        L.typeParamTsBindings = prevTsBindings;
         L.implicitParamTypes = prevImplicit;
         L.instantiationContext = prevContext;
         L.suppressStats = prevSuppress;
@@ -2591,6 +2700,37 @@ export function lowerCall(L, expr) {
                     : "value";
             return { kind: "dynCall", callee, calleeName, args, type: DYN, loc };
         }
+        // `fn(...args)` — a TRAILING spread into an island call: the
+        // engine's own apply (`fn.apply(undefined, argsArray)`); leading
+        // plain arguments prepend through `[l1, l2].concat(argsArray)`
+        // (concat flattens the array argument one level — exactly the
+        // spread). Other spread shapes keep the syntax fence.
+        if (expr.arguments.length > 0 &&
+            ts.isSpreadElement(expr.arguments[expr.arguments.length - 1]) &&
+            expr.arguments.slice(0, -1).every((a) => !ts.isSpreadElement(a))) {
+            const spread = expr.arguments[expr.arguments.length - 1];
+            const spreadV = L.jsvalIn(L.lowerExpr(spread.expression), spread.expression);
+            const leading = expr.arguments.slice(0, -1).map((a) => L.jsvalIn(L.lowerExpr(a), a));
+            const argsArr = leading.length === 0
+                ? spreadV
+                : {
+                    kind: "jsOp",
+                    op: "callMethod",
+                    name: "concat",
+                    args: [{ kind: "jsOp", op: "arrLit", args: leading, type: JSVAL, loc }, spreadV],
+                    type: JSVAL,
+                    loc,
+                };
+            const result = {
+                kind: "jsOp",
+                op: "callMethod",
+                name: "apply",
+                args: [callee, { kind: "jsOp", op: "undefLit", args: [], type: JSVAL, loc }, argsArr],
+                type: JSVAL,
+                loc,
+            };
+            return islandPrimitiveExit(L, expr, result);
+        }
         const args = expr.arguments.map((a) => L.jsvalIn(L.lowerExpr(a), a));
         const result = { kind: "jsOp", op: "callFn", args: [callee, ...args], type: JSVAL, loc };
         return islandPrimitiveExit(L, expr, result);
@@ -2664,6 +2804,9 @@ export function lowerCall(L, expr) {
             const streamServed = lowerStreamModuleCall(L, expr, bi, loc);
             if (streamServed)
                 return streamServed;
+            const fsTs = L.lowerFsToUnixTimestampCall(expr, bi, loc);
+            if (fsTs)
+                return fsTs;
             const builtinFn = builtinModuleFnOf(L, bi.module, bi.member);
             if (!builtinFn) {
                 // Typed by @types/node (the fallback declarations only declare
@@ -2893,15 +3036,24 @@ export function lowerCall(L, expr) {
     // closure object, plain C call). Generic functions route through
     // monomorphization (the call targets a per-instantiation instance).
     if (ts.isIdentifier(expr.expression) && !L.isSelfReference(expr.expression)) {
+        // A JS spread argument the compile-time completion cannot take (a
+        // fixed position, a dynamic rest slot) sends the call down the
+        // VALUE path — the runtime-arity lane (lowerSpreadArgsCall) boxes
+        // the declaration's value and applies through a runtime-built
+        // argument list. Typed .ts spreads keep completeArgs' rest packing.
+        const jsSpreadArgs = expr.arguments.some((a) => ts.isSpreadElement(a)) && isJsSourceFile(expr.getSourceFile());
         if (L.isTopLevelFnSymbol(expr.expression) && !L.peekLocal(expr.expression)) {
             // `import g = N.f; g()` — the alias's own source-order guards
             // (a no-op for every non-import= binding).
             fenceEarlyAliasUse(L, expr.expression, expr);
             const generic = L.genericFnOf(expr.expression);
-            if (generic)
+            // An implicit-any JS function spread-forwarded into: per-site
+            // monomorphization has no slot for a runtime-length argument
+            // list — the value path's boxed thunk delivers JS arity instead.
+            if (generic && !(jsSpreadArgs && generic.implicitParams))
                 return L.lowerGenericCall(expr, generic);
-            const sig = L.fnSigOf(expr.expression);
-            if (sig) {
+            const sig = generic ? null : L.fnSigOf(expr.expression);
+            if (sig && !(jsSpreadArgs && spreadNeedsRuntimeArity(sig.params, expr.arguments))) {
                 L.noteEdge(sig.name);
                 const args = L.completeArgs(expr.arguments, sig.params, loc, expr);
                 return reconcileOverloadReturn(L, expr, { kind: "call", callee: sig.name, args, type: sig.returnType, loc });
@@ -2925,10 +3077,12 @@ export function lowerCall(L, expr) {
         // the call monomorphizes against it exactly like a generic function
         // declaration and the binding is never read. Symbol identity does
         // the discrimination — a shadowing local has its own symbol, and
-        // registered bindings never declare locals or globals.
+        // registered bindings never declare locals or globals. Implicit-any
+        // JS bindings spread-forwarded into skip to the value path (the
+        // runtime-arity lane), like the declaration form above.
         {
             const generic = L.genericFnOf(expr.expression);
-            if (generic)
+            if (generic && !(jsSpreadArgs && generic.implicitParams))
                 return L.lowerGenericCall(expr, generic);
         }
     }
@@ -3137,6 +3291,9 @@ export function lowerCall(L, expr) {
             // island path (bytes never cross the boundary).
             L.lowerBytesMethodCall(expr, expr.expression) ??
             L.lowerBufferStaticCall(expr, expr.expression) ??
+            // URL.revokeObjectURL's zero-argument contract (the one-argument
+            // form keeps the fence — createObjectURL does too).
+            lowerUrlStaticCall(L, expr, expr.expression) ??
             // Readable.from — the stream classes' one static (before the
             // stdlib chokepoint claims the member).
             lowerStreamStaticCall(L, expr, expr.expression) ??
@@ -3172,6 +3329,9 @@ export function lowerCall(L, expr) {
             lowerSymbolStaticCall(L, expr, expr.expression) ??
             lowerSymbolMethodCall(L, expr, expr.expression) ??
             lowerRegExpStaticCall(L, expr, expr.expression) ??
+            // The composed en-US Intl.NumberFormat form — before the member
+            // fences (the receiver's Intl.NumberFormat type has no mapping).
+            lowerIntlNumberFormatCall(L, expr, expr.expression) ??
             lowerGroupByStaticCall(L, expr, expr.expression) ??
             // Iterator-helper chains rooted at arr.values() — before the
             // array method paths (the terminal names collide with array
@@ -3280,6 +3440,12 @@ export function lowerCall(L, expr) {
     // any-origin value). Spread arguments keep their fence.
     if (callee.type.kind === "dyn") {
         if (expr.arguments.some((a) => ts.isSpreadElement(a))) {
+            // The runtime-arity lane: a dyn callee is already boxed — the
+            // spread-marked dynCall applies through a fresh DOM argument
+            // array (lowerSpreadArgsCall). Sources outside it keep the fence.
+            const spreadServed = lowerSpreadArgsCall(L, expr, callee, loc);
+            if (spreadServed)
+                return spreadServed;
             L.unsupported("SC1090", expr, "spread arguments in calls through 'unknown' values");
         }
         const args = expr.arguments.map((a) => L.lowerExprExpecting(a, DYN));
@@ -3293,6 +3459,42 @@ export function lowerCall(L, expr) {
     if (callee.type.kind !== "func") {
         L.badType(expr.expression, L.typeOf(expr.expression));
     }
+    // A SPREAD argument on a func-typed callee — the rest-forwarding
+    // idiom (`(...args) => from(...args)`): the runtime-arity lane boxes
+    // or marshals the callee and applies through a runtime-built argument
+    // list (lowerSpreadArgsCall). Shapes outside its lanes fall through
+    // to the historical fences.
+    if (expr.arguments.some((a) => ts.isSpreadElement(a))) {
+        const spreadServed = lowerSpreadArgsCall(L, expr, callee, loc);
+        if (spreadServed)
+            return spreadServed;
+    }
+    // An ISLAND-REST func value called directly (`f(1, 2)` where f is the
+    // --dynamic `(...args) =>` lambda): the type SPELLS its trailing
+    // engine-array param — complete the call exactly like completeArgs'
+    // island pack (fixed slots positionally, missing ones with the
+    // engine's undefined, the surplus marshaled into one fresh engine
+    // array). JS arity, no runtime machinery.
+    if (callee.type.rest === true &&
+        callee.type.restAbi === "jsval" &&
+        callee.type.params.length >= 1 &&
+        callee.type.params[callee.type.params.length - 1].kind === "jsval" &&
+        !expr.arguments.some((a) => ts.isSpreadElement(a))) {
+        const fixed = callee.type.params.slice(0, -1);
+        const args = fixed.map((p, i) => {
+            const a = expr.arguments[i];
+            if (a)
+                return L.lowerExprExpecting(a, p);
+            const absent = omittedArgFor(L, p, loc);
+            if (!absent) {
+                L.unsupported("SC1090", expr, "calls omitting a non-optional parameter of the callee's type");
+            }
+            return absent;
+        });
+        const restArgs = expr.arguments.slice(fixed.length).map((a) => L.lowerExprExpecting(a, JSVAL));
+        args.push({ kind: "jsOp", op: "arrLit", args: restArgs, type: JSVAL, loc });
+        return { kind: "callValue", callee, args, type: callee.type.ret, loc };
+    }
     // A JS call with MORE arguments than the callee's lowered signature
     // (`cb(1, 'x')` where the mustCall wrapper's inferred type declared
     // fewer params — tsc's JS world doesn't police arity): ride the
@@ -3330,6 +3532,101 @@ export function lowerCall(L, expr) {
     }
     return { kind: "callValue", callee, args, type: callee.type.ret, loc };
 }
+/** The RUNTIME-ARITY spread call — `f(...args)`, the rest-forwarding idiom
+   * (`const f = (...args) => from(...args)`): a spread whose length is a
+   * runtime fact has no home in the compile-time completion, so the call
+   * rides a dynamic boundary instead. Two lanes, picked by the spread
+   * source's tier:
+   *
+   * - CHECKED-DYNAMIC (dyn spread sources — a JS rest binding, a dyn
+   *   value): box the callee (dynFrom; a dyn callee is already boxed),
+   *   convert every argument into dyn, and emit the spread-marked dynCall
+   *   — the emitters build one fresh DOM argument array (spreads flatten
+   *   left-to-right, non-iterables throw V8's TypeError) and apply through
+   *   it; the boxed thunk delivers JS arity exactly. Result dyn, checked
+   *   per use like every any-origin value.
+   * - ISLAND (a jsval spread source — the --dynamic rest binding is the
+   *   engine's own arguments array): marshal the callee in and emit jsOp
+   *   callSpread — the prelude helper's REAL `f(...pre, ...s)`, so
+   *   iterator protocols and the not-iterable TypeError are the engine's
+   *   own. One trailing spread after the fixed arguments is the modeled
+   *   shape (exactly the forwarding idiom).
+   *
+   * Answers null when neither lane fits (typed .ts spreads keep
+   * completeArgs' rest packing and its fences). JS sources only — the
+   * same guard as the over-arity dynCall precedent. */
+export function lowerSpreadArgsCall(L, expr, callee, loc) {
+    if (!isJsSourceFile(expr.getSourceFile()))
+        return null;
+    if (!expr.arguments.some((a) => ts.isSpreadElement(a)))
+        return null;
+    if (callee.type.kind !== "dyn" && callee.type.kind !== "func" && callee.type.kind !== "jsval")
+        return null;
+    const calleeName = ts.isPropertyAccessExpression(expr.expression) || ts.isElementAccessExpression(expr.expression)
+        ? expr.expression.getText()
+        : ts.isIdentifier(expr.expression)
+            ? expr.expression.text
+            : "value";
+    // Lower every argument ONCE, in source order (the IR nests them in
+    // exactly this order, so runtime evaluation order is JS's).
+    const parts = expr.arguments.map((a) => ts.isSpreadElement(a)
+        ? { spreadOf: a.expression, node: null, v: L.lowerExpr(a.expression) }
+        : { spreadOf: null, node: a, v: L.lowerExpr(a) });
+    const spreadParts = parts.filter((p) => p.spreadOf !== null);
+    const getR = (id) => L.shapes.get(id);
+    const getU = (id) => L.unions.get(id);
+    const anyJsvalSpread = spreadParts.some((p) => p.v.type.kind === "jsval");
+    if (!anyJsvalSpread &&
+        (callee.type.kind === "dyn" || (callee.type.kind === "func" && canBoxFuncIntoDyn(callee.type, getR, getU))) &&
+        spreadParts.every((p) => p.v.type.kind === "dyn" || canConvertToDyn(p.v.type, getR, getU))) {
+        const args = [];
+        const spreads = [];
+        for (const p of parts) {
+            if (p.spreadOf !== null) {
+                // The spelling rides along for V8's nullish spread-call
+                // TypeError ("v is not iterable (cannot read property ...)").
+                spreads.push({ arg: args.length, what: p.spreadOf.getText() });
+                args.push(L.coerceInto(p.spreadOf, p.v, DYN));
+            }
+            else {
+                args.push(L.coerceInto(p.node, p.v, DYN));
+            }
+        }
+        const boxed = callee.type.kind === "dyn" ? callee : L.coerceInto(expr.expression, callee, DYN);
+        return { kind: "dynCall", callee: boxed, calleeName, args, spreads, type: DYN, loc };
+    }
+    if (spreadParts.length > 0 &&
+        spreadParts.every((p) => p.v.type.kind === "jsval") &&
+        (callee.type.kind === "jsval" || callee.type.kind === "func")) {
+        if (spreadParts.length !== 1 || parts[parts.length - 1].spreadOf === null) {
+            L.unsupported("SC1090", expr, "spread arguments before positional arguments in island calls (one trailing spread after the fixed arguments is the supported form)");
+        }
+        const f = L.coerceInto(expr.expression, callee, JSVAL);
+        const pre = parts
+            .slice(0, -1)
+            .map((p) => L.coerceInto(p.node, p.v, JSVAL));
+        const preArr = { kind: "jsOp", op: "arrLit", args: pre, type: JSVAL, loc };
+        const last = parts[parts.length - 1];
+        // The spelling rides in `name` for V8's nullish spread-call
+        // TypeError ("v is not iterable (cannot read property ...)").
+        return { kind: "jsOp", op: "callSpread", name: last.spreadOf.getText(), args: [f, preArr, last.v], type: JSVAL, loc };
+    }
+    // No lane fits (a spread source outside both tiers, a callee neither
+    // boxable nor marshalable, mixed dyn/jsval spreads): fence HERE — the
+    // arguments are already lowered, and falling back to the historical
+    // per-site fences would lower them a second time (duplicate lambda
+    // lifts, duplicated diagnostics).
+    L.unsupported("SC1090", expr, "spread arguments");
+}
+/** True when a spread argument lands where the compile-time completion
+   * cannot take it — a FIXED parameter position, or a dynamic rest slot
+   * (dynRest/islandRest, whose packs are built per-argument): the shapes
+   * the runtime-arity lane (lowerSpreadArgsCall) serves. Typed `rest`
+   * slots keep completeArgs' same-element spread packing. */
+export function spreadNeedsRuntimeArity(shapes, argNodes) {
+    const restAt = shapes.findIndex((s) => s.mode === "rest" || s.mode === "dynRest" || s.mode === "islandRest");
+    return argNodes.some((a, i) => ts.isSpreadElement(a) && (restAt < 0 || i < restAt || shapes[restAt].mode !== "rest"));
+}
 /** METHOD calls on dyn receivers (`pkg.name.replace(...)`, `rawName.split`,
  * `ws.packages.filter(...)` — JSON.parse-derived values): validate the
  * receiver's DOM kind, extract, and ride the STATIC method machinery — the
@@ -3868,6 +4165,32 @@ export function lowerPrimitiveProtoCall(L, call, recv, name, memberSym) {
         const fn = name === "toExponential" ? "num.toExponential" : "num.toFixed0";
         return { kind: "libCall", fn, args: [operand], type: STRING, loc };
     }
+    // Number.prototype.toLocaleString("en-US") — the spec makes it
+    // NumberFormat(locale).format(this), so the en-US embedded formatter
+    // answers exactly. The unlowered forms fence by NAME: no locale (the
+    // host environment's default, which a compiled binary cannot carry),
+    // other locales (ICU data the binary does not embed), options bags.
+    if (name === "toLocaleString" && recvKind === "f64") {
+        if (call.arguments.length === 0) {
+            L.noLowering("Number.prototype.toLocaleString without a locale", call, "the default locale is the host environment's, which a compiled binary cannot carry — " +
+                'pass it explicitly: x.toLocaleString("en-US")');
+        }
+        if (call.arguments.length > 1) {
+            L.noLowering("Number.prototype.toLocaleString with an options bag", call, "the embedded data covers DEFAULT options only (decimal notation, up to 3 fraction " +
+                'digits, grouping) — x.toLocaleString("en-US")');
+        }
+        const locNode = call.arguments[0];
+        if (ts.isSpreadElement(locNode) || !ts.isStringLiteralLike(locNode) || locNode.text !== "en-US") {
+            L.noLowering(!ts.isSpreadElement(locNode) && ts.isStringLiteralLike(locNode)
+                ? `Number.prototype.toLocaleString at locale "${locNode.text}"`
+                : "Number.prototype.toLocaleString with a non-literal locale", locNode, '"en-US" (Node\'s default-build locale) is the one locale whose data the runtime embeds — ' +
+                "everything else is ICU data the binary does not carry");
+        }
+        const operand = L.lowerExpr(recv);
+        if (operand.type.kind !== "f64")
+            return null;
+        return { kind: "libCall", fn: "intl.numFormatEnUs", args: [operand], type: STRING, loc };
+    }
     if (name === "charAt" && recvKind === "string" && call.arguments.length === 1 &&
         !ts.isSpreadElement(call.arguments[0])) {
         const receiver = L.lowerExpr(recv);
@@ -4044,11 +4367,26 @@ export function lowerTaggedTemplate(L, expr) {
         : expr.template.templateSpans.map((s) => s.expression);
     // Island tags (--dynamic): the engine call forms, mirroring lowerCall's
     // island paths — a property-access tag is a method call (this = the
-    // receiver, JS-exact), any other island tag a function call.
+    // receiver, JS-exact), any other island tag a function call. The
+    // strings argument builds ENGINE-NATIVE with its `.raw` property (the
+    // tplStrings op): a JSON marshal would drop `.raw`, and tags dispatch
+    // on it (the outdent idiom treats a raw-less argument as its OPTIONS
+    // form and answers a function). A fresh array per evaluation — tags
+    // caching by strings identity re-compute per call (SEMANTICS.md).
+    const islandStrings = () => ({
+        kind: "jsOp",
+        op: "tplStrings",
+        args: [
+            ...pieces.map((p) => ({ kind: "jsMarshal", value: { kind: "strLit", value: p.text, type: STRING, loc }, type: JSVAL, loc })),
+            ...pieces.map((p) => ({ kind: "jsMarshal", value: { kind: "strLit", value: templateRawTextOf(p), type: STRING, loc }, type: JSVAL, loc })),
+        ],
+        type: JSVAL,
+        loc,
+    });
     if (ts.isPropertyAccessExpression(expr.tag) && L.isIslandExpr(expr.tag.expression)) {
         const receiver = L.lowerExpr(expr.tag.expression);
         const args = [
-            L.jsvalIn(strings, expr.template),
+            islandStrings(),
             ...values.map((a) => L.jsvalIn(L.lowerExpr(a), a)),
         ];
         return {
@@ -4059,7 +4397,7 @@ export function lowerTaggedTemplate(L, expr) {
     if (L.isIslandExpr(expr.tag)) {
         const callee = L.lowerExpr(expr.tag);
         const args = [
-            L.jsvalIn(strings, expr.template),
+            islandStrings(),
             ...values.map((a) => L.jsvalIn(L.lowerExpr(a), a)),
         ];
         return { kind: "jsOp", op: "callFn", args: [callee, ...args], type: JSVAL, loc };
@@ -4247,6 +4585,7 @@ export function lambdaSignature(L, node) {
     // use a rest parameter. Arrows never claim it (JS: an arrow's
     // `arguments` is the enclosing function's).
     const hasDynRest = shapes.some((s) => s.mode === "dynRest");
+    const hasIslandRest = shapes.some((s) => s.mode === "islandRest");
     const usesArguments = !hasDynRest &&
         !ts.isArrowFunction(node) &&
         isJsSourceFile(node.getSourceFile()) &&
@@ -4258,9 +4597,14 @@ export function lambdaSignature(L, node) {
         shapes,
         funcType: {
             kind: "func",
+            // dynRest is EXCLUDED (the boxed thunk fills the trailing DOM
+            // array — no spelled slot); islandRest is INCLUDED (the trailing
+            // jsval param IS the engine arguments array, the REST host-call
+            // adapter's one uniform shape).
             params: shapes.filter((s) => s.mode !== "dynRest").map((s) => s.type),
             ret,
-            ...(hasDynRest || usesArguments ? { rest: true } : {}),
+            ...(hasDynRest || usesArguments || hasIslandRest ? { rest: true } : {}),
+            ...(hasIslandRest ? { restAbi: "jsval" } : {}),
         },
     };
 }
@@ -4331,13 +4675,14 @@ export function lowerLambda(L, node) {
     if (isGenerator && funcType.ret.kind === "generator") {
         fnCtx.generator = { yieldT: funcType.ret.yieldT, nextT: funcType.ret.nextT };
     }
+    const diagsBefore = L.diags.length;
     L.fnStack.push(fnCtx);
     try {
         const { params, prologue } = L.declareParams(node.parameters, shapes);
         // The VARIADIC `arguments` form (rest-marked with no declared rest
         // param): a synthetic trailing DOM-array param carries the call's
         // arguments; `arguments` reads resolve to it (identifier lowering).
-        if (funcType.rest && !shapes.some((s) => s.mode === "dynRest")) {
+        if (funcType.rest && !shapes.some((s) => s.mode === "dynRest" || s.mode === "islandRest")) {
             const argsLocal = L.declareHiddenLocal("%arguments", DYN);
             params.push({ localId: argsLocal.id, name: "%arguments", type: DYN });
             fnCtx.argumentsLocal = argsLocal;
@@ -4416,6 +4761,62 @@ export function lowerLambda(L, node) {
         L.liftedFns.push(lifted);
         return { kind: "closure", fnName, captures: ctx.captureSources, type: funcType, loc };
     }
+    catch (e) {
+        // JS sources defer LAMBDA poisons like function declarations
+        // (lowerFunction's catch, lambda form — entry the function-level
+        // deferral): a fenced concise body (`(list) => new Intl.ListFormat
+        // (...).format(list)` — the error-message list-join idiom) would
+        // otherwise poison the ENCLOSING statement, stopping module init
+        // where Node only stops when the lambda is CALLED. The value
+        // compiles as a capture-free closure over a runtimeFence body —
+        // calling throws the first captured diagnostic at its source
+        // position. ICEs (SC9001) stay compile errors, exactly like
+        // lowerStmts; probe mode (diagSink) keeps the poison.
+        if (!(e instanceof PoisonError))
+            throw e;
+        if (!isJsSourceFile(node.getSourceFile()) ||
+            L.diagSink !== null ||
+            L.diags.length <= diagsBefore ||
+            L.diags.slice(diagsBefore).some((d) => d.code === "SC9001")) {
+            throw e;
+        }
+        const captured = L.diags.splice(diagsBefore);
+        L.runtimeFences.push(...captured);
+        const first = captured[0];
+        const pos = ts.getLineAndCharacterOfPosition(L.program.getSourceFile(first.loc.file) ?? node.getSourceFile(), first.loc.start);
+        const params = funcType.params.map((t, i) => ({ localId: `%pf${i}`, name: `%pf${i}`, type: t }));
+        // A REST-MARKED value type hides one synthetic trailing DOM-array
+        // param in the lifted function (the boxed call thunk fills it) —
+        // the fence lambda must spell that slot too or the validator's
+        // closure-signature check trips (SC9001). Island rest types SPELL
+        // their trailing engine-array param, so funcType.params already
+        // covers those.
+        if (funcType.rest === true && funcType.restAbi !== "jsval") {
+            params.push({ localId: "%pfrest", name: "%pfrest", type: DYN });
+        }
+        const lifted = {
+            name: fnName,
+            params,
+            returnType: bodyReturn,
+            locals: params.map((p) => ({ id: p.localId, name: p.name, type: p.type, mutable: false })),
+            captures: [],
+            body: [
+                {
+                    kind: "runtimeFence",
+                    code: first.code,
+                    message: `${first.message} [${first.code} at ${first.loc.file}:${pos.line + 1}]`,
+                    loc,
+                },
+            ],
+            loc,
+        };
+        if (isAsync)
+            lifted.async = true;
+        if (fnCtx.generator)
+            lifted.generator = fnCtx.generator;
+        L.liftedFns.push(lifted);
+        return { kind: "closure", fnName, captures: [], type: funcType, loc };
+    }
     finally {
         L.fnStack.pop();
     }
@@ -5304,8 +5705,8 @@ function filterNarrowHelper(L, test, elem, outElem, tag, loc) {
  * (Symbol.iterator, Symbol.asyncIterator, Symbol.toStringTag, ...) —
  * language-level protocol uses (for-of, template literals) already
  * compile through their constructs without reifying the symbol, so the
- * VALUE forms fence with a named message rather than the generic
- * SymbolConstructor SC2001. */
+ * VALUE forms fence with a named message rather than a blanket
+ * SymbolConstructor type fence. */
 function lowerSymbolStaticCall(L, call, access) {
     if (call.questionDotToken || access.questionDotToken)
         return null;
@@ -5435,6 +5836,110 @@ export function recordKeysArrayCall(L, receiver, argIr, shape, loc) {
     }
     return { kind: "call", callee: helper, args: [receiver], type: resultT, loc };
 }
+/** Interned `%obj.hasOwn.<n>(r, k)` — Object.hasOwn's membership walk
+ * over a signature-free record shape: the key compares against each
+ * declared field name, undefined-armed fields answering by their tag
+ * (a key is own exactly when Object.keys would list it — the two share
+ * the guard), everything else true, no match false. */
+function recordHasOwnHelper(L, shapeId, loc) {
+    const key = `obj.hasOwn:${shapeId}`;
+    const existing = L.arrHofHelpers.get(key);
+    if (existing)
+        return existing;
+    const helper = `%obj.hasOwn.${L.arrHofHelpers.size}`;
+    L.arrHofHelpers.set(key, helper);
+    const shape = L.shapes.get(shapeId);
+    const recT = { kind: "record", shapeId };
+    const rRef = { kind: "varRef", localId: "r.0", type: recT, loc };
+    const kRef = { kind: "varRef", localId: "k.0", type: STRING, loc };
+    const body = [];
+    for (const f of shape.fields) {
+        const utag = f.type.kind === "union" ? L.armTag(f.type.unionId, UNDEFINED_T) : -1;
+        const answer = utag >= 0 && f.type.kind === "union"
+            ? {
+                kind: "unionIsTag",
+                unionId: f.type.unionId,
+                tag: utag,
+                negated: true,
+                value: { kind: "recordGet", obj: rRef, shapeId, field: f.name, type: f.type, loc },
+                type: BOOL,
+                loc,
+            }
+            : { kind: "boolLit", value: true, type: BOOL, loc };
+        body.push({
+            kind: "if",
+            cond: { kind: "strEq", negated: false, left: kRef, right: { kind: "strLit", value: f.name, type: STRING, loc }, type: BOOL, loc },
+            then: [{ kind: "return", value: answer, loc }],
+            else_: null,
+            loc,
+        });
+    }
+    body.push({ kind: "return", value: { kind: "boolLit", value: false, type: BOOL, loc }, loc });
+    L.liftedFns.push({
+        name: helper,
+        params: [
+            { localId: "r.0", name: "r", type: recT },
+            { localId: "k.0", name: "k", type: STRING },
+        ],
+        returnType: BOOL,
+        locals: [
+            { id: "r.0", name: "r", type: recT, mutable: true },
+            { id: "k.0", name: "k", type: STRING, mutable: false },
+        ],
+        body,
+        loc,
+    });
+    return helper;
+}
+/** Interned `%obj.assign.<n>(t, s)` — Object.assign's per-field copy
+ * over signature-free records (every source field lands on a same-named,
+ * same-typed target field — the caller's gate): undefined-armed source
+ * fields copy behind the not-undefined guard, everything else straight,
+ * and the TARGET returns (JS's aliasing). */
+function recordAssignHelper(L, targetShapeId, srcShapeId, loc) {
+    const key = `obj.assign:${targetShapeId}:${srcShapeId}`;
+    const existing = L.arrHofHelpers.get(key);
+    if (existing)
+        return existing;
+    const helper = `%obj.assign.${L.arrHofHelpers.size}`;
+    L.arrHofHelpers.set(key, helper);
+    const sShape = L.shapes.get(srcShapeId);
+    const tT = { kind: "record", shapeId: targetShapeId };
+    const sT = { kind: "record", shapeId: srcShapeId };
+    const tRef = { kind: "varRef", localId: "t.0", type: tT, loc };
+    const sRef = { kind: "varRef", localId: "s.0", type: sT, loc };
+    const body = [];
+    for (const f of sShape.fields) {
+        const get = { kind: "recordGet", obj: sRef, shapeId: srcShapeId, field: f.name, type: f.type, loc };
+        const set = { kind: "recordSet", obj: tRef, shapeId: targetShapeId, field: f.name, value: get, loc };
+        const utag = f.type.kind === "union" ? L.armTag(f.type.unionId, UNDEFINED_T) : -1;
+        body.push(utag >= 0 && f.type.kind === "union"
+            ? {
+                kind: "if",
+                cond: { kind: "unionIsTag", unionId: f.type.unionId, tag: utag, negated: true, value: get, type: BOOL, loc },
+                then: [set],
+                else_: null,
+                loc,
+            }
+            : set);
+    }
+    body.push({ kind: "return", value: tRef, loc });
+    L.liftedFns.push({
+        name: helper,
+        params: [
+            { localId: "t.0", name: "t", type: tT },
+            { localId: "s.0", name: "s", type: sT },
+        ],
+        returnType: tT,
+        locals: [
+            { id: "t.0", name: "t", type: tT, mutable: true },
+            { id: "s.0", name: "s", type: sT, mutable: true },
+        ],
+        body,
+        loc,
+    });
+    return helper;
+}
 /** The `Iterator` global's statics (ES2025 — Iterator.from, and the
  * abstract constructor as a value): no first-class iterator objects
  * exist here, so every member fences with the working spelling named
@@ -5469,12 +5974,184 @@ function lowerRegExpStaticCall(L, call, access) {
         L.badType(call.arguments[0], L.typeOf(call.arguments[0]));
     return { kind: "libCall", fn: "regexp.escape", args: [arg], type: STRING, loc: locOf(call) };
 }
+/** The composed en-US Intl.NumberFormat form: `new Intl.NumberFormat(
+ * "en-US").format(x)` (and the callable spelling without `new` — the
+ * spec makes them the same formatter). Only the COMPOSED form lowers —
+ * formatter values have no representation — and only the one locale
+ * whose data the runtime embeds, with default options: decimal
+ * notation, 0–3 fraction digits rounded half-up on the shortest
+ * round-tripping decimal (ICU's rounding input — format(1.0005) is
+ * "1.001" though toFixed(3) answers "1.000"), "," grouping. The
+ * unlowered forms fence by NAME (no locale — the host environment's
+ * default, which a compiled binary cannot carry; other locales — ICU
+ * data the binary does not embed; options bags; non-number arguments).
+ * Null when the callee isn't a NumberFormat-construction .format. */
+function lowerIntlNumberFormatCall(L, call, access) {
+    if (call.questionDotToken || access.questionDotToken)
+        return null;
+    if (access.name.text !== "format")
+        return null;
+    let recv = access.expression;
+    while (ts.isParenthesizedExpression(recv))
+        recv = recv.expression;
+    let ctorArgs;
+    if (ts.isNewExpression(recv) || (ts.isCallExpression(recv) && !recv.questionDotToken)) {
+        const ctor = recv.expression;
+        if (!ts.isPropertyAccessExpression(ctor) || ctor.questionDotToken ||
+            ctor.name.text !== "NumberFormat" || !L.isStdlibGlobal(ctor.expression, "Intl")) {
+            return null;
+        }
+        ctorArgs = recv.arguments ?? [];
+    }
+    else {
+        return null;
+    }
+    const loc = locOf(call);
+    if (ctorArgs.length === 0) {
+        L.noLowering("Intl.NumberFormat without a locale", recv, "the default locale is the host environment's, which a compiled binary cannot carry — " +
+            'pass it explicitly: new Intl.NumberFormat("en-US").format(x)');
+    }
+    if (ctorArgs.length > 1) {
+        L.noLowering("Intl.NumberFormat with an options bag", ctorArgs[1], "the embedded data covers DEFAULT options only (decimal notation, up to 3 fraction digits, " +
+            'grouping) — new Intl.NumberFormat("en-US").format(x)');
+    }
+    const locArg = ctorArgs[0];
+    if (ts.isSpreadElement(locArg) || !ts.isStringLiteralLike(locArg) || locArg.text !== "en-US") {
+        L.noLowering(!ts.isSpreadElement(locArg) && ts.isStringLiteralLike(locArg)
+            ? `Intl.NumberFormat at locale "${locArg.text}"`
+            : "Intl.NumberFormat with a non-literal locale", locArg, '"en-US" (Node\'s default-build locale) is the one locale whose data the runtime embeds — ' +
+            "everything else is ICU data the binary does not carry");
+    }
+    if (call.arguments.length !== 1 || ts.isSpreadElement(call.arguments[0])) {
+        L.noLowering(`Intl.NumberFormat("en-US").format with ${call.arguments.length} arguments`, call);
+    }
+    const argNode = call.arguments[0];
+    if (L.mapTypeOf(L.typeOf(argNode))?.kind !== "f64") {
+        L.noLowering(`Intl.NumberFormat("en-US").format over a '${L.checker.typeToString(L.typeOf(argNode))}'`, argNode, "a number argument is the lowered form (bigint and numeric-string inputs have no representation)");
+    }
+    const arg = L.lowerExprExpecting(argNode, F64);
+    if (arg.type.kind !== "f64")
+        L.badType(argNode, L.typeOf(argNode));
+    return { kind: "libCall", fn: "intl.numFormatEnUs", args: [arg], type: STRING, loc };
+}
+/** Object.is over statically disjoint kinds: the constant false, with
+ * both operands still evaluated for their effects (droppable statics
+ * fold away — JS evaluates arguments, but nothing observes a pure one). */
+function objectIsDisjointFalse(left, right, loc) {
+    const stmts = [];
+    for (const e of [left, right]) {
+        if (!droppableStatic(e))
+            stmts.push({ kind: "exprStmt", expr: e, loc });
+    }
+    const answer = { kind: "boolLit", value: false, type: BOOL, loc };
+    if (stmts.length === 0)
+        return answer;
+    return { kind: "seqExpr", stmts, result: answer, type: BOOL, loc };
+}
 function lowerObjectStaticCall(L, call, access) {
     if (call.questionDotToken || access.questionDotToken)
         return null;
     if (!L.isStdlibGlobal(access.expression, "Object"))
         return null;
     const member = access.name.text;
+    // Object.is — the spec's SameValue over the static kinds. Number
+    // pairs take the runtime SameValue (NaN equals NaN, +0 differs from
+    // -0 — the two divergences from ===); every other supported pair
+    // rides exactly the strict-equality machinery, whose answers
+    // SameValue shares: strings by bytes, bools by value, unit literals
+    // by tag, unions per arm (a number arm's payload compare upgrades to
+    // SameValue via unionEq's flag), and the reference kinds by pointer
+    // identity. Statically DISJOINT kind pairs answer the constant false
+    // with the operands still evaluated (tsc admits any pair — Object.is
+    // is (any, any) — and JS evaluates the arguments either way).
+    // dyn/jsval operands keep strict equality's stance: validate first.
+    if (member === "is") {
+        if (call.arguments.length !== 2 || call.arguments.some((a) => ts.isSpreadElement(a))) {
+            L.noLowering(`Object.is with ${call.arguments.length} arguments`, call, "exactly two arguments are the lowered form (JS treats a missing one as undefined — pass it explicitly)");
+        }
+        const loc = locOf(call);
+        const leftNode = call.arguments[0];
+        const rightNode = call.arguments[1];
+        const left = L.lowerExpr(leftNode);
+        const right = L.lowerExpr(rightNode);
+        const lk = left.type.kind;
+        const rk = right.type.kind;
+        if (lk === "f64" && rk === "f64") {
+            return { kind: "libCall", fn: "num.sameValue", args: [left, right], type: BOOL, loc };
+        }
+        if (left.type.kind === "string" && right.type.kind === "string") {
+            return { kind: "strEq", negated: false, left, right, type: BOOL, loc };
+        }
+        if (lk === "bool" && rk === "bool") {
+            return { kind: "bin", op: "===", left, right, type: BOOL, loc };
+        }
+        const unitTest = L.lowerUnitComparison(left, right, false, loc);
+        if (unitTest)
+            return unitTest;
+        if (lk === "dyn" || rk === "dyn" || lk === "jsval" || rk === "jsval") {
+            L.noLowering("Object.is over a dynamic operand", call, "validate/narrow the value first (strict equality's rule) — SameValue only differs from === on numbers (NaN, ±0)");
+        }
+        if (left.type.kind === "union" || right.type.kind === "union") {
+            const ut = left.type.kind === "union" ? left.type : right.type;
+            const bothUnion = left.type.kind === "union" && right.type.kind === "union";
+            const sameUnion = bothUnion && typeEquals(left.type, right.type);
+            if ((sameUnion || !bothUnion) && L.eqComparableUnion(ut.unionId)) {
+                const plain = left.type.kind === "union" ? right : left;
+                const arms = L.unions.get(ut.unionId)?.arms ?? [];
+                // The plain side wraps into the union exactly like === when the
+                // union holds its type; a plain PRIMITIVE the union has no arm
+                // for is the disjoint constant false (coercing it would strand).
+                if (bothUnion || arms.some((a) => typeEquals(a, plain.type))) {
+                    const sameValue = arms.some((a) => a.kind === "f64");
+                    return {
+                        kind: "unionEq",
+                        unionId: ut.unionId,
+                        negated: false,
+                        sameValue,
+                        left: L.coerceInto(leftNode, left, ut),
+                        right: L.coerceInto(rightNode, right, ut),
+                        type: BOOL,
+                        loc,
+                    };
+                }
+                if (plain.type.kind === "f64" || plain.type.kind === "string" ||
+                    plain.type.kind === "bool" || isUnitType(plain.type)) {
+                    return objectIsDisjointFalse(left, right, loc);
+                }
+            }
+            L.noLowering("Object.is over these union operands", call, `union-typed comparisons need one comparable shape (${NARROW_FIRST})`);
+        }
+        // Reference kinds: pointer identity — exactly strict equality
+        // (hierarchy-related classes widen the derived side first).
+        let idLeft = left;
+        let idRight = right;
+        if (left.type.kind === "object" && right.type.kind === "object") {
+            if (L.isSubclassOf(left.type.className, right.type.className)) {
+                idLeft = L.upcastTo(left, right.type.className);
+            }
+            else if (L.isSubclassOf(right.type.className, left.type.className)) {
+                idRight = L.upcastTo(right, left.type.className);
+            }
+        }
+        if ((idLeft.type.kind === "func" && idRight.type.kind === "func") ||
+            (idLeft.type.kind === "classval" && idRight.type.kind === "classval")) {
+            return { kind: "bin", op: "===", left: idLeft, right: idRight, type: BOOL, loc };
+        }
+        if ((idLeft.type.kind === "array" || idLeft.type.kind === "map" ||
+            idLeft.type.kind === "set" || idLeft.type.kind === "object" ||
+            idLeft.type.kind === "record" || idLeft.type.kind === "symbol" ||
+            idLeft.type.kind === "bytes" || idLeft.type.kind === "promise") &&
+            typeEquals(idLeft.type, idRight.type)) {
+            return { kind: "bin", op: "===", left: idLeft, right: idRight, type: BOOL, loc };
+        }
+        // Statically disjoint pairs with a primitive/unit side: SameValue
+        // never crosses kinds, so the answer is the constant false.
+        const disjoint = new Set(["f64", "string", "bool", "undefinedT", "nullT"]);
+        if (lk !== rk && (disjoint.has(lk) || disjoint.has(rk))) {
+            return objectIsDisjointFalse(left, right, loc);
+        }
+        L.noLowering(`Object.is over '${L.fmt(left.type)}' and '${L.fmt(right.type)}' operands`, call, "the operands must share one comparable kind (numbers, strings, booleans, units, one union shape, or one reference type)");
+    }
     // `Object.assign(fn, { props })` whose RESULT type maps to the hybrid
     // (function-with-properties) record: the chalk-shape CONSTRUCTOR.
     if (member === "assign") {
@@ -5504,6 +6181,53 @@ function lowerObjectStaticCall(L, call, access) {
         const merged = lowerObjectAssignIndexShape(L, call);
         if (merged)
             return merged;
+        // `Object.assign(target, source)` over signature-free RECORDS whose
+        // source fields all land on same-named, same-typed target fields
+        // (the mockable-clock restore: `Object.assign(mocked,
+        // implementations)` over one shape): the per-field copy helper,
+        // returning the TARGET — JS's aliasing, the target mutates in
+        // place. Undefined-armed source fields copy behind the
+        // not-undefined guard (an omitted optional field holds the
+        // undefined arm and must not erase the target's value — Node
+        // copies own keys only; an EXPLICIT `k: undefined` source diverges,
+        // the explicit-undefined-is-absent stance). Everything else keeps
+        // the spread hint.
+        if (call.arguments.length === 2 && !call.arguments.some((a) => ts.isSpreadElement(a))) {
+            const tProbe = probeLower(L, call.arguments[0]);
+            const sProbe = probeLower(L, call.arguments[1]);
+            // CHECKED-DYNAMIC target and source (the JS file-scope
+            // object-literal identity story): the runtime DOM copy — own
+            // members of the source land on the target, which returns.
+            if (tProbe?.type.kind === "dyn") {
+                const loc = locOf(call);
+                const target = L.lowerExpr(call.arguments[0]);
+                const source = L.coerceToExpected(L.lowerExpr(call.arguments[1]), DYN);
+                if (target.type.kind === "dyn" && source.type.kind === "dyn") {
+                    return { kind: "libCall", fn: "dyn.assign", args: [target, source], type: DYN, loc };
+                }
+            }
+            if (tProbe?.type.kind === "record" && sProbe?.type.kind === "record") {
+                const tShape = L.shapes.get(tProbe.type.shapeId);
+                const sShape = L.shapes.get(sProbe.type.shapeId);
+                const ok = tShape && sShape &&
+                    !tShape.tuple && !sShape.tuple &&
+                    !tShape.indexValue && !sShape.indexValue &&
+                    !shapeHasAccessorSlots(tShape) && !shapeHasAccessorSlots(sShape) &&
+                    sShape.fields.every((sf) => {
+                        const tf = tShape.fields.find((x) => x.name === sf.name);
+                        return tf !== undefined && typeEquals(tf.type, sf.type);
+                    });
+                if (ok) {
+                    const loc = locOf(call);
+                    const target = L.lowerExpr(call.arguments[0]);
+                    const source = L.lowerExpr(call.arguments[1]);
+                    if (target.type.kind === "record" && source.type.kind === "record") {
+                        const helper = recordAssignHelper(L, target.type.shapeId, source.type.shapeId, loc);
+                        return { kind: "call", callee: helper, args: [target, source], type: target.type, loc };
+                    }
+                }
+            }
+        }
         return null;
     }
     // Object.defineProperties over a CHECKED-DYNAMIC target (test/common's
@@ -5557,6 +6281,54 @@ function lowerObjectStaticCall(L, call, access) {
         }
         L.noLowering("Object.freeze of a possibly-aliased value", call, "freeze of a FRESH object/array literal (and of primitives) compiles — frozen-ness is unobservable there; an aliased target's later writes would need the runtime frozen bit");
     }
+    // `Object.hasOwn(r, k)` over a RECORD receiver: a record's own-key set
+    // is its declared field list, so membership is a compare chain against
+    // the field names (interned per shape). Undefined-armed (optional)
+    // fields answer by their runtime tag — the explicit-undefined-is-absent
+    // stance: an omitted optional field holds the undefined arm and reads
+    // as NOT own, exactly Node's absent key (an EXPLICIT `k: undefined`
+    // diverges — documented next to the child-env/JSON rule). Tuple,
+    // index-signature (overflow membership lives in the runtime map), and
+    // accessor-carrying shapes keep the SC2020 fence; non-record receivers
+    // do too.
+    if (member === "hasOwn" && call.arguments.length === 2 && !call.arguments.some((a) => ts.isSpreadElement(a))) {
+        const recvNode = call.arguments[0];
+        const keyNode = call.arguments[1];
+        const probed = probeLower(L, recvNode);
+        // A CHECKED-DYNAMIC receiver (the JS file-scope object-literal
+        // identity story): the runtime DOM probe — OBJ member presence, ARR
+        // index bounds, Node's ToObject TypeError on nullish.
+        if (probed?.type.kind === "dyn") {
+            const loc = locOf(call);
+            const receiver = L.lowerExpr(recvNode);
+            let key = L.lowerExpr(keyNode);
+            if (key.type.kind === "f64" || key.type.kind === "bool" || key.type.kind === "dyn") {
+                key = { kind: "toString", operand: key, type: STRING, loc: locOf(keyNode) };
+            }
+            if (key.type.kind !== "string")
+                return null;
+            return { kind: "libCall", fn: "dyn.hasOwn", args: [receiver, key], type: BOOL, loc };
+        }
+        if (probed?.type.kind !== "record")
+            return null;
+        const shape = L.shapes.get(probed.type.shapeId);
+        if (!shape || shape.tuple || shape.indexValue || shapeHasAccessorSlots(shape))
+            return null;
+        const loc = locOf(call);
+        const receiver = L.lowerExpr(recvNode);
+        if (receiver.type.kind !== "record")
+            return null; // probe/lower drift: keep the fence
+        let key = L.lowerExpr(keyNode);
+        // Number/boolean/dyn keys stringify — ToPropertyKey, the keyed-write
+        // path's rule; symbol and composite keys keep the fence.
+        if (key.type.kind === "f64" || key.type.kind === "bool" || key.type.kind === "dyn") {
+            key = { kind: "toString", operand: key, type: STRING, loc: locOf(keyNode) };
+        }
+        if (key.type.kind !== "string")
+            return null;
+        const helper = recordHasOwnHelper(L, receiver.type.shapeId, loc);
+        return { kind: "call", callee: helper, args: [receiver, key], type: BOOL, loc };
+    }
     if (member !== "keys" && member !== "values" && member !== "entries")
         return null;
     if (call.arguments.length !== 1 || ts.isSpreadElement(call.arguments[0]))
@@ -6109,6 +6881,29 @@ export function bindingGenericFnNodeOf(decl) {
     }
     return null;
 }
+/** The CONTEXTUAL twin of bindingGenericFnNodeOf: `const g: Mapper = (x)
+   * => x` where `type Mapper = <T>(x: T) => T` — the initializer declares
+   * no type parameters of its own, but the ANNOTATION's one call signature
+   * does, and the checker types the arrow's parameters by those (`x: T`).
+   * Such a binding monomorphizes exactly like `const g = <T>(x: T) => x`;
+   * bindingGenericFnInfoOf reads the type parameters off the annotation's
+   * signature. Null when the shape doesn't match (a concrete annotation, a
+   * generic arrow — the syntactic probe's case, an overloaded alias). */
+export function bindingContextualGenericFnNodeOf(L, decl) {
+    if (!ts.isIdentifier(decl.name) || decl.initializer === undefined || decl.type === undefined)
+        return null;
+    let init = decl.initializer;
+    while (ts.isParenthesizedExpression(init))
+        init = init.expression;
+    if (!(ts.isArrowFunction(init) || ts.isFunctionExpression(init)) ||
+        init.typeParameters !== undefined || init.body === undefined) {
+        return null;
+    }
+    const sigs = L.checker.getCallSignatures(L.typeOf(decl.name));
+    if (sigs.length !== 1 || sigs[0].getTypeParameters().length === 0)
+        return null;
+    return init;
+}
 /** The interned GenericFnInfo for one generic arrow/function-expression
    * binding initializer, with the supportability fences applied ONCE per
    * declaration: the binding must sit at module scope (the compiled
@@ -6150,11 +6945,29 @@ export function bindingGenericFnInfoOf(L, decl, fnNode) {
         L.unsupported("SC1090", decl.name, `generic function values in reassigned bindings (calls of '${name}' resolve statically against this initializer, so the binding must provably hold it — a const, or a let/var nothing in its declaring file writes)`);
     }
     const typeParams = [];
-    for (const tp of fnNode.typeParameters) {
-        const tpSym = L.checker.getSymbolAtLocation(tp.name);
-        if (!tpSym)
+    if (fnNode.typeParameters !== undefined) {
+        for (const tp of fnNode.typeParameters) {
+            const tpSym = L.checker.getSymbolAtLocation(tp.name);
+            if (!tpSym)
+                L.unsupported("SC1090", fnNode, "this function form");
+            typeParams.push(tpSym);
+        }
+    }
+    else {
+        // The CONTEXTUAL shape (bindingContextualGenericFnNodeOf): the type
+        // parameters live on the annotation's one call signature, and the
+        // checker types the initializer's parameters by them — the same
+        // symbols the instance bodies resolve through.
+        const sigs = L.checker.getCallSignatures(L.typeOf(decl.name));
+        const tps = sigs.length === 1 ? sigs[0].getTypeParameters() : [];
+        if (tps.length === 0)
             L.unsupported("SC1090", fnNode, "this function form");
-        typeParams.push(tpSym);
+        for (const tp of tps) {
+            const tpSym = tp.getSymbol();
+            if (!tpSym)
+                L.unsupported("SC1090", fnNode, "this function form");
+            typeParams.push(tpSym);
+        }
     }
     // Only NAME syntax is checkable here; optional/default/rest shapes are
     // computed per instantiation from the resolved signature — exactly
@@ -6181,6 +6994,53 @@ export function bindingGenericFnInfoOf(L, decl, fnNode) {
     }
     return info;
 }
+/** `const h = id` — a binding ALIASING a generic function (a top-level
+   * declaration, a registered generic binding, or another alias — resolved
+   * left to right in declaration order). The alias registers the SAME info
+   * under its own symbol, so calls (`h(3)`) and pinned values (`take(h)`)
+   * resolve exactly like the target's own name, and the binding itself has
+   * no runtime value (a generic function value cannot materialize). Claims
+   * only bindings whose OWN type still keeps type parameters — a
+   * concrete-annotated alias (`const h: (x: number) => number = id`) is a
+   * pinned VALUE, the existing lowerGenericFnValue story. Null when the
+   * shape doesn't match or the target isn't a registered generic; fences
+   * (reassignment, var redeclaration) report by name inside. */
+export function bindingGenericFnAliasInfoOf(L, decl) {
+    if (!ts.isIdentifier(decl.name) || decl.initializer === undefined)
+        return null;
+    let init = decl.initializer;
+    while (ts.isParenthesizedExpression(init))
+        init = init.expression;
+    if (!ts.isIdentifier(init))
+        return null;
+    const target = genericFnOf(L, init);
+    if (!target)
+        return null;
+    // A concrete annotation pins one signature — that value story
+    // (lowerGenericFnValue at the reference) stays untouched.
+    const ownSigs = L.checker.getCallSignatures(L.typeOf(decl.name));
+    if (ownSigs.length === 0 || !ownSigs.every((s) => s.getTypeParameters().length > 0))
+        return null;
+    const sym = L.checker.getSymbolAtLocation(decl.name);
+    if (!sym)
+        return null;
+    const existing = L.genericFnsBySymbol.get(sym);
+    if (existing)
+        return existing;
+    const name = decl.name.text;
+    const isConst = (ts.getCombinedNodeFlags(decl) & ts.NodeFlags.Const) !== 0;
+    // The same holds-it-forever discipline as generic arrow bindings:
+    // calls through the alias resolve statically against the target, so
+    // nothing may ever rebind it (merged `var` redeclarations included).
+    const redeclared = L.checker
+        .declarationsOf(sym)
+        .some((d) => d !== decl && ts.isVariableDeclaration(d) && d.initializer !== undefined);
+    if (!isConst && (redeclared || !bindingNeverReassigned(L, sym, decl))) {
+        L.unsupported("SC1090", decl.name, `generic function values in reassigned bindings (calls of '${name}' resolve statically against this initializer, so the binding must provably hold it — a const, or a let/var nothing in its declaring file writes)`);
+    }
+    L.genericFnsBySymbol.set(sym, target);
+    return target;
+}
 /** Static resolution stands in for the receiver's runtime value, so an
    * object-literal generic-method receiver must provably HOLD the defining
    * literal: a direct read of a binding whose initializer IS that literal
@@ -6225,10 +7085,56 @@ export function requireObjLitGenericReceiver(L, blame, recvExpr, literal, name)
    * direct `call` of the instance with the receiver unevaluated. Claims
    * every call whose member is generic-callable — lowering it or fencing
    * with a named message. */
+/** URL.revokeObjectURL() with NO argument: Node's ERR_MISSING_ARGS
+ * throws before the registry lookup, so the zero-argument contract is
+ * exact without any blob machinery. The one-argument form (Node's
+ * silent no-op for unregistered ids) and createObjectURL keep their
+ * fences — a compiled program has no blob registry to consult. */
+function lowerUrlStaticCall(L, call, callee) {
+    if (!ts.isPropertyAccessExpression(callee) || callee.questionDotToken !== undefined)
+        return null;
+    if (!ts.isIdentifier(callee.expression) || callee.expression.text !== "URL")
+        return null;
+    if (callee.name.text !== "revokeObjectURL" || call.arguments.length !== 0)
+        return null;
+    const sym = L.resolveValueSymbol(callee.expression);
+    if (!sym || !L.isStdlibSymbol(sym))
+        return null;
+    return nodeThrowExpr(1, "ERR_MISSING_ARGS", 'The "url" argument must be specified', VOID, locOf(call));
+}
+const SP_BRAND_METHODS = new Set([
+    "append", "delete", "get", "getAll", "has", "set", "sort",
+    "forEach", "keys", "values", "entries", "toString",
+]);
 export function lowerObjLitGenericMethodCall(L, call, access) {
     if (L.chainBlocked(access, call))
         return null;
     const name = access.name.text;
+    // URLSearchParams method values through Function.prototype.call/apply
+    // with a receiver that is provably NOT a URLSearchParams (the suite's
+    // `params.append.call(undefined)` probes): the WHATWG brand check
+    // throws ERR_INVALID_THIS before any argument conversion — the whole
+    // call IS that throw. A receiver that IS searchParams-typed, or one
+    // whose runtime kind is unknowable (dyn/'any'), keeps the fence.
+    if ((name === "call" || name === "apply") &&
+        ts.isPropertyAccessExpression(access.expression) &&
+        L.mapTypeOf(L.typeOf(access.expression.expression))?.kind === "searchParams" &&
+        SP_BRAND_METHODS.has(access.expression.name.text) &&
+        L.isStdlibMember(access.expression)) {
+        const thisArg = call.arguments[0];
+        const thisT = thisArg ? L.mapTypeOf(L.typeOf(thisArg)) : { kind: "undefinedT" };
+        const provablyNot = thisT !== null &&
+            thisT.kind !== "searchParams" &&
+            thisT.kind !== "dyn" &&
+            thisT.kind !== "jsval" &&
+            (!thisArg || ts.isIdentifier(thisArg) || ts.isLiteralExpression(thisArg) ||
+                thisArg.kind === ts.SyntaxKind.UndefinedKeyword ||
+                thisArg.kind === ts.SyntaxKind.NullKeyword ||
+                isUnitType(thisT));
+        if (provablyNot) {
+            return nodeThrowExpr(1, "ERR_INVALID_THIS", 'Value of "this" must be of type URLSearchParams', L.mapTypeOf(L.typeOf(call)) ?? VOID, locOf(call));
+        }
+    }
     const recvT = L.typeOf(access.expression);
     const propSym = L.checker.getPropertyOfType(recvT, name);
     if (!propSym)
@@ -6241,8 +7147,36 @@ export function lowerObjLitGenericMethodCall(L, call, access) {
     if (L.checker.declarationsOf(propSym).some((d) => d.parent !== undefined && (ts.isClassDeclaration(d.parent) || ts.isClassExpression(d.parent)))) {
         return null;
     }
+    // An INTERFACE-typed receiver over a class instance (`const r: Repo =
+    // new MemRepo(); r.get(...)` — the declaration is signature-only, but
+    // the receiver's exact class is statically proven and the binding
+    // kept the class representation, genericIfaceBindingKeepsClass): the
+    // call is a class generic-method call on that exact class. The
+    // receiver must LOWER as the class — a record-held value (a `let`, a
+    // produced value, a parameter) has already dropped it, and keeps the
+    // named fence below.
+    {
+        const exact = exactInstanceClassOf(L, access.expression);
+        const gfound = exact ? findGenericMethodOn(L, exact, name) : null;
+        if (gfound && ts.isIdentifier(access.expression)) {
+            const recv = L.lowerExpr(access.expression); // identifier reads are pure — no double evaluation
+            if (recv.type.kind === "object") {
+                return lowerClassGenericMethodCall(L, call, access, exact, gfound, recv);
+            }
+        }
+    }
     const found = objLitGenericFnNodeOf(L, propSym);
     if (!found) {
+        // Interface-declared generic methods dispatch statically, so the
+        // receiver's runtime class must be provable — name that discipline
+        // instead of the object-literal wording when the method lives on an
+        // interface.
+        const onInterface = L.checker
+            .declarationsOf(propSym)
+            .some((d) => d.parent !== undefined && ts.isInterfaceDeclaration(d.parent));
+        if (onInterface) {
+            L.unsupported("SC1090", call, `calls of the generic method '${name}' through this receiver (the interface declaration is signature-only and generic methods dispatch statically, so the receiver's runtime class must be provable — bind the receiver to a const initialized with its 'new' expression, e.g. 'const r: ${L.checker.typeToString(recvT)} = new C(...)')`);
+        }
         L.unsupported("SC1090", call, `calls of the generic method '${name}' with no defining object literal (the declaration is signature-only — only methods declared with a body in an object literal monomorphize)`);
     }
     requireObjLitGenericReceiver(L, call, access.expression, found.literal, name);