@scriptc/compiler 0.0.8 → 0.0.10

package/dist/frontend/lowering/lower-calls.js

@@ -7,14 +7,14 @@ import { lowerGenMethodCall } from "./lower-generators.js";
 import { BOOL, CAUGHT, DYN, F64, JSVAL, STRING, SYMBOL_T, UNDEFINED_T, VOID, arrayOf, canBoxFuncIntoDyn, canConvertToDyn, canDynCheckTo, canMarshalTypedFuncIntoIsland, funcOf, isUnitType, shapeHasAccessorSlots, typeEquals } from "../../ir/nodes.js";
 import { isJsSourceFile, locOf } from "../program.js";
 import { isGenericCallableMemberType, typeKey } from "../types.js";
-import { PoisonError, dynFallbackType, dynUndefinedExpr, importCallHandleType, jsFuncNameOf, newFnCtx } from "./lowerer.js";
+import { PoisonError, dynFallbackType, dynUndefinedExpr, importCallHandleType, jsFuncNameOf, newFnCtx, nodeThrowExpr } from "./lowerer.js";
 import { enforceLibBoundary } from "./lib-boundary.js";
-import { builtinFenceHintOf, builtinModuleFnOf } from "./surfaces.js";
+import { NARROW_FIRST, builtinFenceHintOf, builtinModuleFnOf } from "./surfaces.js";
 import { requiresDynamicDiag } from "../../diagnostics/diagnostic.js";
 import { mixinFnShapeOf } from "./lower-mixins.js";
 import { bufEncoding, dynStringReceiver, lowerArrayFromCall, lowerDynArrayFilterCall, lowerDynArrayFlatMapCall, lowerGroupByStaticCall, lowerIteratorHelperCall, lowerObjectAssignIndexShape, lowerObjectFromEntriesCall, lowerObjectIterOverIndexShape, lowerRegexMethodCall, lowerStringMethodCall, lowerTupleReadMethodCall } from "./lower-containers.js";
 import { lowerChildStreamMethodCall, lowerDirentMethodCall, lowerPerfHooksCall, lowerProcStreamMethodCall, lowerReflectApplyCall, lowerWatcherMethodCall } from "./lower-builtins.js";
-import { lowerPromiseAllTupleCall, lowerPromiseRejectCall, probeLower, templateRawTextOf } from "./lower-exprs.js";
+import { droppableStatic, lowerPromiseAllTupleCall, lowerPromiseRejectCall, probeLower, templateRawTextOf } from "./lower-exprs.js";
 import { httpClientFnBindingOf, isStreamUndefCallExpr, lowerHttpClientFnCall } from "./lower-server.js";
 import { EMITTER_API_MEMBERS, exactInstanceClassOf, findGenericMethodOn, lowerClassGenericMethodCall, lowerStaticMethodCall } from "./lower-classes.js";
 import { emitterRooted, lowerEmitterMethodCall } from "./lower-emitter.js";
@@ -2273,6 +2273,49 @@ export function lowerTimersMemberCall(L, expr, member, loc) {
 }
 export function lowerCall(L, expr) {
     const loc = locOf(expr);
+    // A call whose chain ROOTS at an ambient-undefined name (`declare
+    // const value: Y | undefined; value?.foo("a")`, `declare function
+    // chain...; chain(o).mapValues(f).value()`, a trap binding's read):
+    // Node evaluates the root FIRST and throws the catchable
+    // ReferenceError before any member, type argument, or argument runs —
+    // the whole call IS that throw, typed by the use site (arguments
+    // never lower; Node never evaluates them). Claimed before every
+    // intrinsic and dispatch path: no lowering can answer differently
+    // when the root read itself is the crash.
+    {
+        const root = ambientUndefVarRootOf(L, expr);
+        if (root !== null) {
+            const mapped = L.mapTypeOf(L.typeOf(expr));
+            const t = mapped && mapped.kind !== "void" && !L.typeNamesUnregisteredClass(mapped)
+                ? mapped
+                : (contextualUndefReadType(L, expr) ?? F64);
+            return nsUndefRead(L, root.text, expr, t);
+        }
+    }
+    // A method call through a NULLISH binding (`const i: I<A & B> = null
+    // as any; i.fn(...)` — the receiver provably holds null/undefined
+    // forever): the member READ throws Node's exact TypeError before any
+    // argument evaluates — the whole call lowers to that throw. Claimed
+    // when the receiver's type has no mapping (no other story exists) or
+    // the member is a generic signature (the alternative is the
+    // interface-dispatch fence — the runtime truth is this throw).
+    if (ts.isPropertyAccessExpression(expr.expression) &&
+        ts.isIdentifier(expr.expression.expression) &&
+        expr.expression.questionDotToken === undefined) {
+        const recvSym = L.resolveValueSymbol(expr.expression.expression);
+        const unit = nullishValueUnitOf(L, recvSym);
+        if (unit !== null) {
+            const recvUnmappable = recvSym !== null && L.mapTypeOf(L.checker.getTypeOfSymbol(recvSym)) === null;
+            const propSym = L.checker.getPropertyOfType(L.typeOf(expr.expression.expression), expr.expression.name.text);
+            const genericMember = propSym !== undefined && propSym !== null &&
+                isGenericCallableMemberType(L.checker.getTypeOfSymbol(propSym), L.checker);
+            if (recvUnmappable || genericMember) {
+                const mapped = L.mapTypeOf(L.typeOf(expr));
+                const t = mapped && mapped.kind !== "void" && !L.typeNamesUnregisteredClass(mapped) ? mapped : F64;
+                return nodeThrowExpr(1, "", `Cannot read properties of ${unit} (reading '${expr.expression.name.text}')`, t, loc);
+            }
+        }
+    }
     // `process.getuid?.()` — intercepted BEFORE the optional-chain
     // machinery (the member always exists on a POSIX target, so the
     // optional call IS the call; `process.getuid` itself has no value
@@ -2685,12 +2728,37 @@ export function lowerCall(L, expr) {
         return islandPrimitiveExit(L, expr, result);
     }
     if (L.isIslandExpr(expr.expression)) {
+        // `o.m(...)` where o LOWERS checked-dynamic and the checker types
+        // `o.m` 'any' (a member read behind an 'object'/'unknown'-typed
+        // bag): METHOD-CALL semantics — receiver-kind dispatch (dynInvoke),
+        // so `this` binds and a WRAPPED island receiver runs the ENGINE's
+        // own method (the routed-ops lane). A stored-member dynCall would
+        // call engine prototype methods receiverless — the this-less
+        // `list.slice()` ToObject TypeError. Spread arguments keep the
+        // stored-member path below (the runtime-arity lane owns them).
+        if (ts.isPropertyAccessExpression(expr.expression) &&
+            !expr.expression.questionDotToken &&
+            !expr.questionDotToken &&
+            !expr.arguments.some((a) => ts.isSpreadElement(a))) {
+            const recvProbe = probeLower(L, expr.expression.expression);
+            if (recvProbe?.type.kind === "dyn") {
+                const args = expr.arguments.map((a) => L.lowerExprExpecting(a, DYN));
+                return {
+                    kind: "dynInvoke",
+                    recv: recvProbe,
+                    method: expr.expression.name.text,
+                    calleeName: expr.expression.getText(),
+                    args,
+                    type: DYN,
+                    loc,
+                };
+            }
+        }
         const callee = L.lowerExpr(expr.expression);
         // A checker-`any` callee that LOWERED checked-dynamic (a dyn member
         // chain's stored function): the DOM's own call — dynCall reads and
         // calls the stored member with Node's is-not-a-function TypeError
-        // on refusal. Island-typed arguments meet the boundary pass's
-        // dynCall rule (no jsval→DOM bridge exists — the named fence).
+        // on refusal.
         if (callee.type.kind === "dyn") {
             const args = expr.arguments.map((a) => L.lowerExprExpecting(a, DYN));
             const calleeName = ts.isPropertyAccessExpression(expr.expression)
@@ -2804,6 +2872,15 @@ export function lowerCall(L, expr) {
             const streamServed = lowerStreamModuleCall(L, expr, bi, loc);
             if (streamServed)
                 return streamServed;
+            const fsTs = L.lowerFsToUnixTimestampCall(expr, bi, loc);
+            if (fsTs)
+                return fsTs;
+            // The fs validation-ladder spoke (checked-dynamic lane): misuse
+            // of implemented-namespace members throws Node's typed errors
+            // instead of meeting the table fence.
+            const fsLadder = L.lowerFsLadderCall(expr, bi, loc);
+            if (fsLadder)
+                return fsLadder;
             const builtinFn = builtinModuleFnOf(L, bi.module, bi.member);
             if (!builtinFn) {
                 // Typed by @types/node (the fallback declarations only declare
@@ -3033,15 +3110,24 @@ export function lowerCall(L, expr) {
     // closure object, plain C call). Generic functions route through
     // monomorphization (the call targets a per-instantiation instance).
     if (ts.isIdentifier(expr.expression) && !L.isSelfReference(expr.expression)) {
+        // A JS spread argument the compile-time completion cannot take (a
+        // fixed position, a dynamic rest slot) sends the call down the
+        // VALUE path — the runtime-arity lane (lowerSpreadArgsCall) boxes
+        // the declaration's value and applies through a runtime-built
+        // argument list. Typed .ts spreads keep completeArgs' rest packing.
+        const jsSpreadArgs = expr.arguments.some((a) => ts.isSpreadElement(a)) && isJsSourceFile(expr.getSourceFile());
         if (L.isTopLevelFnSymbol(expr.expression) && !L.peekLocal(expr.expression)) {
             // `import g = N.f; g()` — the alias's own source-order guards
             // (a no-op for every non-import= binding).
             fenceEarlyAliasUse(L, expr.expression, expr);
             const generic = L.genericFnOf(expr.expression);
-            if (generic)
+            // An implicit-any JS function spread-forwarded into: per-site
+            // monomorphization has no slot for a runtime-length argument
+            // list — the value path's boxed thunk delivers JS arity instead.
+            if (generic && !(jsSpreadArgs && generic.implicitParams))
                 return L.lowerGenericCall(expr, generic);
-            const sig = L.fnSigOf(expr.expression);
-            if (sig) {
+            const sig = generic ? null : L.fnSigOf(expr.expression);
+            if (sig && !(jsSpreadArgs && spreadNeedsRuntimeArity(sig.params, expr.arguments))) {
                 L.noteEdge(sig.name);
                 const args = L.completeArgs(expr.arguments, sig.params, loc, expr);
                 return reconcileOverloadReturn(L, expr, { kind: "call", callee: sig.name, args, type: sig.returnType, loc });
@@ -3065,10 +3151,12 @@ export function lowerCall(L, expr) {
         // the call monomorphizes against it exactly like a generic function
         // declaration and the binding is never read. Symbol identity does
         // the discrimination — a shadowing local has its own symbol, and
-        // registered bindings never declare locals or globals.
+        // registered bindings never declare locals or globals. Implicit-any
+        // JS bindings spread-forwarded into skip to the value path (the
+        // runtime-arity lane), like the declaration form above.
         {
             const generic = L.genericFnOf(expr.expression);
-            if (generic)
+            if (generic && !(jsSpreadArgs && generic.implicitParams))
                 return L.lowerGenericCall(expr, generic);
         }
     }
@@ -3277,6 +3365,9 @@ export function lowerCall(L, expr) {
             // island path (bytes never cross the boundary).
             L.lowerBytesMethodCall(expr, expr.expression) ??
             L.lowerBufferStaticCall(expr, expr.expression) ??
+            // URL.revokeObjectURL's zero-argument contract (the one-argument
+            // form keeps the fence — createObjectURL does too).
+            lowerUrlStaticCall(L, expr, expr.expression) ??
             // Readable.from — the stream classes' one static (before the
             // stdlib chokepoint claims the member).
             lowerStreamStaticCall(L, expr, expr.expression) ??
@@ -3312,6 +3403,9 @@ export function lowerCall(L, expr) {
             lowerSymbolStaticCall(L, expr, expr.expression) ??
             lowerSymbolMethodCall(L, expr, expr.expression) ??
             lowerRegExpStaticCall(L, expr, expr.expression) ??
+            // The composed en-US Intl.NumberFormat form — before the member
+            // fences (the receiver's Intl.NumberFormat type has no mapping).
+            lowerIntlNumberFormatCall(L, expr, expr.expression) ??
             lowerGroupByStaticCall(L, expr, expr.expression) ??
             // Iterator-helper chains rooted at arr.values() — before the
             // array method paths (the terminal names collide with array
@@ -3420,6 +3514,12 @@ export function lowerCall(L, expr) {
     // any-origin value). Spread arguments keep their fence.
     if (callee.type.kind === "dyn") {
         if (expr.arguments.some((a) => ts.isSpreadElement(a))) {
+            // The runtime-arity lane: a dyn callee is already boxed — the
+            // spread-marked dynCall applies through a fresh DOM argument
+            // array (lowerSpreadArgsCall). Sources outside it keep the fence.
+            const spreadServed = lowerSpreadArgsCall(L, expr, callee, loc);
+            if (spreadServed)
+                return spreadServed;
             L.unsupported("SC1090", expr, "spread arguments in calls through 'unknown' values");
         }
         const args = expr.arguments.map((a) => L.lowerExprExpecting(a, DYN));
@@ -3433,6 +3533,42 @@ export function lowerCall(L, expr) {
     if (callee.type.kind !== "func") {
         L.badType(expr.expression, L.typeOf(expr.expression));
     }
+    // A SPREAD argument on a func-typed callee — the rest-forwarding
+    // idiom (`(...args) => from(...args)`): the runtime-arity lane boxes
+    // or marshals the callee and applies through a runtime-built argument
+    // list (lowerSpreadArgsCall). Shapes outside its lanes fall through
+    // to the historical fences.
+    if (expr.arguments.some((a) => ts.isSpreadElement(a))) {
+        const spreadServed = lowerSpreadArgsCall(L, expr, callee, loc);
+        if (spreadServed)
+            return spreadServed;
+    }
+    // An ISLAND-REST func value called directly (`f(1, 2)` where f is the
+    // --dynamic `(...args) =>` lambda): the type SPELLS its trailing
+    // engine-array param — complete the call exactly like completeArgs'
+    // island pack (fixed slots positionally, missing ones with the
+    // engine's undefined, the surplus marshaled into one fresh engine
+    // array). JS arity, no runtime machinery.
+    if (callee.type.rest === true &&
+        callee.type.restAbi === "jsval" &&
+        callee.type.params.length >= 1 &&
+        callee.type.params[callee.type.params.length - 1].kind === "jsval" &&
+        !expr.arguments.some((a) => ts.isSpreadElement(a))) {
+        const fixed = callee.type.params.slice(0, -1);
+        const args = fixed.map((p, i) => {
+            const a = expr.arguments[i];
+            if (a)
+                return L.lowerExprExpecting(a, p);
+            const absent = omittedArgFor(L, p, loc);
+            if (!absent) {
+                L.unsupported("SC1090", expr, "calls omitting a non-optional parameter of the callee's type");
+            }
+            return absent;
+        });
+        const restArgs = expr.arguments.slice(fixed.length).map((a) => L.lowerExprExpecting(a, JSVAL));
+        args.push({ kind: "jsOp", op: "arrLit", args: restArgs, type: JSVAL, loc });
+        return { kind: "callValue", callee, args, type: callee.type.ret, loc };
+    }
     // A JS call with MORE arguments than the callee's lowered signature
     // (`cb(1, 'x')` where the mustCall wrapper's inferred type declared
     // fewer params — tsc's JS world doesn't police arity): ride the
@@ -3470,6 +3606,101 @@ export function lowerCall(L, expr) {
     }
     return { kind: "callValue", callee, args, type: callee.type.ret, loc };
 }
+/** The RUNTIME-ARITY spread call — `f(...args)`, the rest-forwarding idiom
+   * (`const f = (...args) => from(...args)`): a spread whose length is a
+   * runtime fact has no home in the compile-time completion, so the call
+   * rides a dynamic boundary instead. Two lanes, picked by the spread
+   * source's tier:
+   *
+   * - CHECKED-DYNAMIC (dyn spread sources — a JS rest binding, a dyn
+   *   value): box the callee (dynFrom; a dyn callee is already boxed),
+   *   convert every argument into dyn, and emit the spread-marked dynCall
+   *   — the emitters build one fresh DOM argument array (spreads flatten
+   *   left-to-right, non-iterables throw V8's TypeError) and apply through
+   *   it; the boxed thunk delivers JS arity exactly. Result dyn, checked
+   *   per use like every any-origin value.
+   * - ISLAND (a jsval spread source — the --dynamic rest binding is the
+   *   engine's own arguments array): marshal the callee in and emit jsOp
+   *   callSpread — the prelude helper's REAL `f(...pre, ...s)`, so
+   *   iterator protocols and the not-iterable TypeError are the engine's
+   *   own. One trailing spread after the fixed arguments is the modeled
+   *   shape (exactly the forwarding idiom).
+   *
+   * Answers null when neither lane fits (typed .ts spreads keep
+   * completeArgs' rest packing and its fences). JS sources only — the
+   * same guard as the over-arity dynCall precedent. */
+export function lowerSpreadArgsCall(L, expr, callee, loc) {
+    if (!isJsSourceFile(expr.getSourceFile()))
+        return null;
+    if (!expr.arguments.some((a) => ts.isSpreadElement(a)))
+        return null;
+    if (callee.type.kind !== "dyn" && callee.type.kind !== "func" && callee.type.kind !== "jsval")
+        return null;
+    const calleeName = ts.isPropertyAccessExpression(expr.expression) || ts.isElementAccessExpression(expr.expression)
+        ? expr.expression.getText()
+        : ts.isIdentifier(expr.expression)
+            ? expr.expression.text
+            : "value";
+    // Lower every argument ONCE, in source order (the IR nests them in
+    // exactly this order, so runtime evaluation order is JS's).
+    const parts = expr.arguments.map((a) => ts.isSpreadElement(a)
+        ? { spreadOf: a.expression, node: null, v: L.lowerExpr(a.expression) }
+        : { spreadOf: null, node: a, v: L.lowerExpr(a) });
+    const spreadParts = parts.filter((p) => p.spreadOf !== null);
+    const getR = (id) => L.shapes.get(id);
+    const getU = (id) => L.unions.get(id);
+    const anyJsvalSpread = spreadParts.some((p) => p.v.type.kind === "jsval");
+    if (!anyJsvalSpread &&
+        (callee.type.kind === "dyn" || (callee.type.kind === "func" && canBoxFuncIntoDyn(callee.type, getR, getU))) &&
+        spreadParts.every((p) => p.v.type.kind === "dyn" || canConvertToDyn(p.v.type, getR, getU))) {
+        const args = [];
+        const spreads = [];
+        for (const p of parts) {
+            if (p.spreadOf !== null) {
+                // The spelling rides along for V8's nullish spread-call
+                // TypeError ("v is not iterable (cannot read property ...)").
+                spreads.push({ arg: args.length, what: p.spreadOf.getText() });
+                args.push(L.coerceInto(p.spreadOf, p.v, DYN));
+            }
+            else {
+                args.push(L.coerceInto(p.node, p.v, DYN));
+            }
+        }
+        const boxed = callee.type.kind === "dyn" ? callee : L.coerceInto(expr.expression, callee, DYN);
+        return { kind: "dynCall", callee: boxed, calleeName, args, spreads, type: DYN, loc };
+    }
+    if (spreadParts.length > 0 &&
+        spreadParts.every((p) => p.v.type.kind === "jsval") &&
+        (callee.type.kind === "jsval" || callee.type.kind === "func")) {
+        if (spreadParts.length !== 1 || parts[parts.length - 1].spreadOf === null) {
+            L.unsupported("SC1090", expr, "spread arguments before positional arguments in island calls (one trailing spread after the fixed arguments is the supported form)");
+        }
+        const f = L.coerceInto(expr.expression, callee, JSVAL);
+        const pre = parts
+            .slice(0, -1)
+            .map((p) => L.coerceInto(p.node, p.v, JSVAL));
+        const preArr = { kind: "jsOp", op: "arrLit", args: pre, type: JSVAL, loc };
+        const last = parts[parts.length - 1];
+        // The spelling rides in `name` for V8's nullish spread-call
+        // TypeError ("v is not iterable (cannot read property ...)").
+        return { kind: "jsOp", op: "callSpread", name: last.spreadOf.getText(), args: [f, preArr, last.v], type: JSVAL, loc };
+    }
+    // No lane fits (a spread source outside both tiers, a callee neither
+    // boxable nor marshalable, mixed dyn/jsval spreads): fence HERE — the
+    // arguments are already lowered, and falling back to the historical
+    // per-site fences would lower them a second time (duplicate lambda
+    // lifts, duplicated diagnostics).
+    L.unsupported("SC1090", expr, "spread arguments");
+}
+/** True when a spread argument lands where the compile-time completion
+   * cannot take it — a FIXED parameter position, or a dynamic rest slot
+   * (dynRest/islandRest, whose packs are built per-argument): the shapes
+   * the runtime-arity lane (lowerSpreadArgsCall) serves. Typed `rest`
+   * slots keep completeArgs' same-element spread packing. */
+export function spreadNeedsRuntimeArity(shapes, argNodes) {
+    const restAt = shapes.findIndex((s) => s.mode === "rest" || s.mode === "dynRest" || s.mode === "islandRest");
+    return argNodes.some((a, i) => ts.isSpreadElement(a) && (restAt < 0 || i < restAt || shapes[restAt].mode !== "rest"));
+}
 /** METHOD calls on dyn receivers (`pkg.name.replace(...)`, `rawName.split`,
  * `ws.packages.filter(...)` — JSON.parse-derived values): validate the
  * receiver's DOM kind, extract, and ride the STATIC method machinery — the
@@ -3547,10 +3778,17 @@ function lowerDynReceiverMethodCall(L, call, access) {
         const enc = call.arguments[0]
             ? bufEncoding(L, "toString", call.arguments[0])
             : "utf8";
+        // The source spelling rides along for the ONE receiver whose
+        // prototype lacks toString: a null-prototype dictionary throws
+        // Node's "<spelling> is not a function" at runtime.
         return {
             kind: "libCall",
             fn: "dyn.toString",
-            args: [recv, { kind: "strLit", value: enc, type: STRING, loc: locOf(call) }],
+            args: [
+                recv,
+                { kind: "strLit", value: enc, type: STRING, loc: locOf(call) },
+                { kind: "strLit", value: access.getText(), type: STRING, loc: locOf(call) },
+            ],
             type: STRING,
             loc: locOf(call),
         };
@@ -4008,6 +4246,32 @@ export function lowerPrimitiveProtoCall(L, call, recv, name, memberSym) {
         const fn = name === "toExponential" ? "num.toExponential" : "num.toFixed0";
         return { kind: "libCall", fn, args: [operand], type: STRING, loc };
     }
+    // Number.prototype.toLocaleString("en-US") — the spec makes it
+    // NumberFormat(locale).format(this), so the en-US embedded formatter
+    // answers exactly. The unlowered forms fence by NAME: no locale (the
+    // host environment's default, which a compiled binary cannot carry),
+    // other locales (ICU data the binary does not embed), options bags.
+    if (name === "toLocaleString" && recvKind === "f64") {
+        if (call.arguments.length === 0) {
+            L.noLowering("Number.prototype.toLocaleString without a locale", call, "the default locale is the host environment's, which a compiled binary cannot carry — " +
+                'pass it explicitly: x.toLocaleString("en-US")');
+        }
+        if (call.arguments.length > 1) {
+            L.noLowering("Number.prototype.toLocaleString with an options bag", call, "the embedded data covers DEFAULT options only (decimal notation, up to 3 fraction " +
+                'digits, grouping) — x.toLocaleString("en-US")');
+        }
+        const locNode = call.arguments[0];
+        if (ts.isSpreadElement(locNode) || !ts.isStringLiteralLike(locNode) || locNode.text !== "en-US") {
+            L.noLowering(!ts.isSpreadElement(locNode) && ts.isStringLiteralLike(locNode)
+                ? `Number.prototype.toLocaleString at locale "${locNode.text}"`
+                : "Number.prototype.toLocaleString with a non-literal locale", locNode, '"en-US" (Node\'s default-build locale) is the one locale whose data the runtime embeds — ' +
+                "everything else is ICU data the binary does not carry");
+        }
+        const operand = L.lowerExpr(recv);
+        if (operand.type.kind !== "f64")
+            return null;
+        return { kind: "libCall", fn: "intl.numFormatEnUs", args: [operand], type: STRING, loc };
+    }
     if (name === "charAt" && recvKind === "string" && call.arguments.length === 1 &&
         !ts.isSpreadElement(call.arguments[0])) {
         const receiver = L.lowerExpr(recv);
@@ -4602,6 +4866,15 @@ export function lowerLambda(L, node) {
         const first = captured[0];
         const pos = ts.getLineAndCharacterOfPosition(L.program.getSourceFile(first.loc.file) ?? node.getSourceFile(), first.loc.start);
         const params = funcType.params.map((t, i) => ({ localId: `%pf${i}`, name: `%pf${i}`, type: t }));
+        // A REST-MARKED value type hides one synthetic trailing DOM-array
+        // param in the lifted function (the boxed call thunk fills it) —
+        // the fence lambda must spell that slot too or the validator's
+        // closure-signature check trips (SC9001). Island rest types SPELL
+        // their trailing engine-array param, so funcType.params already
+        // covers those.
+        if (funcType.rest === true && funcType.restAbi !== "jsval") {
+            params.push({ localId: "%pfrest", name: "%pfrest", type: DYN });
+        }
         const lifted = {
             name: fnName,
             params,
@@ -5782,12 +6055,235 @@ function lowerRegExpStaticCall(L, call, access) {
         L.badType(call.arguments[0], L.typeOf(call.arguments[0]));
     return { kind: "libCall", fn: "regexp.escape", args: [arg], type: STRING, loc: locOf(call) };
 }
+/** The composed en-US Intl.NumberFormat form: `new Intl.NumberFormat(
+ * "en-US").format(x)` (and the callable spelling without `new` — the
+ * spec makes them the same formatter). Only the COMPOSED form lowers —
+ * formatter values have no representation — and only the one locale
+ * whose data the runtime embeds, with default options: decimal
+ * notation, 0–3 fraction digits rounded half-up on the shortest
+ * round-tripping decimal (ICU's rounding input — format(1.0005) is
+ * "1.001" though toFixed(3) answers "1.000"), "," grouping. The
+ * unlowered forms fence by NAME (no locale — the host environment's
+ * default, which a compiled binary cannot carry; other locales — ICU
+ * data the binary does not embed; options bags; non-number arguments).
+ * Null when the callee isn't a NumberFormat-construction .format. */
+function lowerIntlNumberFormatCall(L, call, access) {
+    if (call.questionDotToken || access.questionDotToken)
+        return null;
+    if (access.name.text !== "format")
+        return null;
+    let recv = access.expression;
+    while (ts.isParenthesizedExpression(recv))
+        recv = recv.expression;
+    let ctorArgs;
+    if (ts.isNewExpression(recv) || (ts.isCallExpression(recv) && !recv.questionDotToken)) {
+        const ctor = recv.expression;
+        if (!ts.isPropertyAccessExpression(ctor) || ctor.questionDotToken ||
+            ctor.name.text !== "NumberFormat" || !L.isStdlibGlobal(ctor.expression, "Intl")) {
+            return null;
+        }
+        ctorArgs = recv.arguments ?? [];
+    }
+    else {
+        return null;
+    }
+    const loc = locOf(call);
+    if (ctorArgs.length === 0) {
+        L.noLowering("Intl.NumberFormat without a locale", recv, "the default locale is the host environment's, which a compiled binary cannot carry — " +
+            'pass it explicitly: new Intl.NumberFormat("en-US").format(x)');
+    }
+    if (ctorArgs.length > 1) {
+        L.noLowering("Intl.NumberFormat with an options bag", ctorArgs[1], "the embedded data covers DEFAULT options only (decimal notation, up to 3 fraction digits, " +
+            'grouping) — new Intl.NumberFormat("en-US").format(x)');
+    }
+    const locArg = ctorArgs[0];
+    if (ts.isSpreadElement(locArg) || !ts.isStringLiteralLike(locArg) || locArg.text !== "en-US") {
+        L.noLowering(!ts.isSpreadElement(locArg) && ts.isStringLiteralLike(locArg)
+            ? `Intl.NumberFormat at locale "${locArg.text}"`
+            : "Intl.NumberFormat with a non-literal locale", locArg, '"en-US" (Node\'s default-build locale) is the one locale whose data the runtime embeds — ' +
+            "everything else is ICU data the binary does not carry");
+    }
+    if (call.arguments.length !== 1 || ts.isSpreadElement(call.arguments[0])) {
+        L.noLowering(`Intl.NumberFormat("en-US").format with ${call.arguments.length} arguments`, call);
+    }
+    const argNode = call.arguments[0];
+    if (L.mapTypeOf(L.typeOf(argNode))?.kind !== "f64") {
+        L.noLowering(`Intl.NumberFormat("en-US").format over a '${L.checker.typeToString(L.typeOf(argNode))}'`, argNode, "a number argument is the lowered form (bigint and numeric-string inputs have no representation)");
+    }
+    const arg = L.lowerExprExpecting(argNode, F64);
+    if (arg.type.kind !== "f64")
+        L.badType(argNode, L.typeOf(argNode));
+    return { kind: "libCall", fn: "intl.numFormatEnUs", args: [arg], type: STRING, loc };
+}
+/** Object.is over statically disjoint kinds: the constant false, with
+ * both operands still evaluated for their effects (droppable statics
+ * fold away — JS evaluates arguments, but nothing observes a pure one). */
+function objectIsDisjointFalse(left, right, loc) {
+    const stmts = [];
+    for (const e of [left, right]) {
+        if (!droppableStatic(e))
+            stmts.push({ kind: "exprStmt", expr: e, loc });
+    }
+    const answer = { kind: "boolLit", value: false, type: BOOL, loc };
+    if (stmts.length === 0)
+        return answer;
+    return { kind: "seqExpr", stmts, result: answer, type: BOOL, loc };
+}
 function lowerObjectStaticCall(L, call, access) {
     if (call.questionDotToken || access.questionDotToken)
         return null;
     if (!L.isStdlibGlobal(access.expression, "Object"))
         return null;
     const member = access.name.text;
+    // Object.is — the spec's SameValue over the static kinds. Number
+    // pairs take the runtime SameValue (NaN equals NaN, +0 differs from
+    // -0 — the two divergences from ===); every other supported pair
+    // rides exactly the strict-equality machinery, whose answers
+    // SameValue shares: strings by bytes, bools by value, unit literals
+    // by tag, unions per arm (a number arm's payload compare upgrades to
+    // SameValue via unionEq's flag), and the reference kinds by pointer
+    // identity. Statically DISJOINT kind pairs answer the constant false
+    // with the operands still evaluated (tsc admits any pair — Object.is
+    // is (any, any) — and JS evaluates the arguments either way).
+    // dyn/jsval operands keep strict equality's stance: validate first.
+    if (member === "is") {
+        if (call.arguments.length !== 2 || call.arguments.some((a) => ts.isSpreadElement(a))) {
+            L.noLowering(`Object.is with ${call.arguments.length} arguments`, call, "exactly two arguments are the lowered form (JS treats a missing one as undefined — pass it explicitly)");
+        }
+        const loc = locOf(call);
+        const leftNode = call.arguments[0];
+        const rightNode = call.arguments[1];
+        const left = L.lowerExpr(leftNode);
+        const right = L.lowerExpr(rightNode);
+        const lk = left.type.kind;
+        const rk = right.type.kind;
+        if (lk === "f64" && rk === "f64") {
+            return { kind: "libCall", fn: "num.sameValue", args: [left, right], type: BOOL, loc };
+        }
+        if (left.type.kind === "string" && right.type.kind === "string") {
+            return { kind: "strEq", negated: false, left, right, type: BOOL, loc };
+        }
+        if (lk === "bool" && rk === "bool") {
+            return { kind: "bin", op: "===", left, right, type: BOOL, loc };
+        }
+        const unitTest = L.lowerUnitComparison(left, right, false, loc);
+        if (unitTest)
+            return unitTest;
+        if (lk === "dyn" || rk === "dyn" || lk === "jsval" || rk === "jsval") {
+            L.noLowering("Object.is over a dynamic operand", call, "validate/narrow the value first (strict equality's rule) — SameValue only differs from === on numbers (NaN, ±0)");
+        }
+        if (left.type.kind === "union" || right.type.kind === "union") {
+            const ut = left.type.kind === "union" ? left.type : right.type;
+            const bothUnion = left.type.kind === "union" && right.type.kind === "union";
+            const sameUnion = bothUnion && typeEquals(left.type, right.type);
+            if ((sameUnion || !bothUnion) && L.eqComparableUnion(ut.unionId)) {
+                const plain = left.type.kind === "union" ? right : left;
+                const arms = L.unions.get(ut.unionId)?.arms ?? [];
+                // The plain side wraps into the union exactly like === when the
+                // union holds its type; a plain PRIMITIVE the union has no arm
+                // for is the disjoint constant false (coercing it would strand).
+                if (bothUnion || arms.some((a) => typeEquals(a, plain.type))) {
+                    const sameValue = arms.some((a) => a.kind === "f64");
+                    return {
+                        kind: "unionEq",
+                        unionId: ut.unionId,
+                        negated: false,
+                        sameValue,
+                        left: L.coerceInto(leftNode, left, ut),
+                        right: L.coerceInto(rightNode, right, ut),
+                        type: BOOL,
+                        loc,
+                    };
+                }
+                if (plain.type.kind === "f64" || plain.type.kind === "string" ||
+                    plain.type.kind === "bool" || isUnitType(plain.type)) {
+                    return objectIsDisjointFalse(left, right, loc);
+                }
+            }
+            L.noLowering("Object.is over these union operands", call, `union-typed comparisons need one comparable shape (${NARROW_FIRST})`);
+        }
+        // Reference kinds: pointer identity — exactly strict equality
+        // (hierarchy-related classes widen the derived side first).
+        let idLeft = left;
+        let idRight = right;
+        if (left.type.kind === "object" && right.type.kind === "object") {
+            if (L.isSubclassOf(left.type.className, right.type.className)) {
+                idLeft = L.upcastTo(left, right.type.className);
+            }
+            else if (L.isSubclassOf(right.type.className, left.type.className)) {
+                idRight = L.upcastTo(right, left.type.className);
+            }
+        }
+        if ((idLeft.type.kind === "func" && idRight.type.kind === "func") ||
+            (idLeft.type.kind === "classval" && idRight.type.kind === "classval")) {
+            return { kind: "bin", op: "===", left: idLeft, right: idRight, type: BOOL, loc };
+        }
+        if ((idLeft.type.kind === "array" || idLeft.type.kind === "map" ||
+            idLeft.type.kind === "set" || idLeft.type.kind === "object" ||
+            idLeft.type.kind === "record" || idLeft.type.kind === "symbol" ||
+            idLeft.type.kind === "bytes" || idLeft.type.kind === "promise") &&
+            typeEquals(idLeft.type, idRight.type)) {
+            return { kind: "bin", op: "===", left: idLeft, right: idRight, type: BOOL, loc };
+        }
+        // Statically disjoint pairs with a primitive/unit side: SameValue
+        // never crosses kinds, so the answer is the constant false.
+        const disjoint = new Set(["f64", "string", "bool", "undefinedT", "nullT"]);
+        if (lk !== rk && (disjoint.has(lk) || disjoint.has(rk))) {
+            return objectIsDisjointFalse(left, right, loc);
+        }
+        L.noLowering(`Object.is over '${L.fmt(left.type)}' and '${L.fmt(right.type)}' operands`, call, "the operands must share one comparable kind (numbers, strings, booleans, units, one union shape, or one reference type)");
+    }
+    // Object.create — the null-prototype DICTIONARY (`Object.create(null)`
+    // then keyed assignment, the memo-table idiom prettier's index/
+    // group-mode maps spell) and, under --dynamic, the engine's own
+    // Object.create for engine-held prototypes. Everything else is a
+    // NAMED fence: the compiled representations have no prototype chain,
+    // and the own-copy stand-in would answer WRONG observably — Node's
+    // Object.keys/inspect/JSON of the created object list NO own keys,
+    // and mutating the prototype afterwards is visible through the
+    // created object (live delegation), which no copy can honor.
+    if (member === "create") {
+        if (call.arguments.some((a) => ts.isSpreadElement(a))) {
+            L.noLowering("Object.create with spread arguments", call);
+        }
+        if (call.arguments.length >= 2) {
+            L.noLowering("Object.create with a properties-descriptor argument", call, "create first, then assign: const o = Object.create(null); o.k = v");
+        }
+        if (call.arguments.length !== 1) {
+            L.noLowering(`Object.create with ${call.arguments.length} arguments`, call);
+        }
+        const loc = locOf(call);
+        let protoNode = call.arguments[0];
+        while (ts.isParenthesizedExpression(protoNode))
+            protoNode = protoNode.expression;
+        const nullProto = protoNode.kind === ts.SyntaxKind.NullKeyword;
+        if (L.dynamic) {
+            // The checker types the result `any` — an ENGINE value under
+            // --dynamic — and the engine's own Object.create answers with
+            // REAL prototype semantics: reads delegate LIVE, writes shadow,
+            // and inspect renders Node's exact shapes ("[Object: null
+            // prototype]" included). null and engine-held (jsval) prototypes
+            // route; checked-dynamic (DOM) prototypes keep the named fence —
+            // their marshal into the engine is a DEEP COPY, so a later
+            // prototype mutation would be invisible through the created
+            // object where Node delegates live.
+            const objectGlobal = () => ({ kind: "jsOp", op: "globalGet", name: "Object", args: [], type: JSVAL, loc });
+            if (nullProto) {
+                const nullIn = { kind: "jsOp", op: "nullLit", args: [], type: JSVAL, loc };
+                return { kind: "jsOp", op: "callMethod", name: "create", args: [objectGlobal(), nullIn], type: JSVAL, loc };
+            }
+            const proto = L.lowerExpr(protoNode);
+            if (proto.type.kind === "jsval") {
+                return { kind: "jsOp", op: "callMethod", name: "create", args: [objectGlobal(), proto], type: JSVAL, loc };
+            }
+            L.noLowering(`Object.create over '${L.fmt(proto.type)}' prototypes`, call, "prototype reads delegate LIVE in Node (mutating the prototype shows through the created object), which the boundary's deep copy cannot honor — only null and engine-held ('any') prototypes lower");
+        }
+        if (nullProto) {
+            return { kind: "libCall", fn: "dyn.objCreateNullProto", args: [], type: DYN, loc };
+        }
+        const proto = L.lowerExpr(protoNode);
+        L.noLowering(`Object.create over '${L.fmt(proto.type)}' prototypes`, call, "the compiled representations have no prototype chain, and an own-copy would answer wrong observably (Node lists NO own keys on the created object, and prototype mutations show through it live) — only Object.create(null) lowers");
+    }
     // `Object.assign(fn, { props })` whose RESULT type maps to the hybrid
     // (function-with-properties) record: the chalk-shape CONSTRUCTOR.
     if (member === "assign") {
@@ -5864,6 +6360,91 @@ function lowerObjectStaticCall(L, call, access) {
                 }
             }
         }
+        // `Object.assign(target, ...sources)` over a CHECKED-DYNAMIC target
+        // — the n-ary/spread form (`Object.assign({}, ...plugins.map(p =>
+        // p.options), coreOptions)`, support.js's option-table merge). The
+        // sources pack into one fresh DOM array FIRST — plain sources
+        // retain in, spread sources flatten through the spread-call walk
+        // (V8's exact TypeError texts, the source spelling carried for the
+        // nullish form) — so every source evaluates and flattens before any
+        // copying (JS's ArgumentListEvaluation: a throwing spread leaves
+        // the target untouched), then one runtime walk copies each source's
+        // own enumerable keys left to right and answers the TARGET
+        // (identity, like JS). Each source must enter the dyn world (dyn
+        // already, or dynFrom's JSON-safe conversion — a STATIC array
+        // spread copies in at the boundary, the documented aliasing
+        // stance); anything else keeps the fence. Targets: dyn values, a
+        // FRESH object-literal target (`Object.assign({}, ...)` — no alias
+        // exists, so building it as a DOM object instead of a record is
+        // unobservable), or a nullish unit (Node's ToObject TypeError
+        // throws at the call, catchably); aliased record targets keep the
+        // fence — their identity could not survive the conversion.
+        if (call.arguments.length >= 1 && !ts.isSpreadElement(call.arguments[0])) {
+            let targetNode = call.arguments[0];
+            while (ts.isParenthesizedExpression(targetNode))
+                targetNode = targetNode.expression;
+            const freshLiteralTarget = ts.isObjectLiteralExpression(targetNode);
+            const tProbe = freshLiteralTarget ? null : probeLower(L, call.arguments[0]);
+            const tKind = tProbe?.type.kind;
+            if (freshLiteralTarget || tKind === "dyn" || tKind === "nullT" || tKind === "undefinedT") {
+                const loc = locOf(call);
+                const target = L.lowerExprExpecting(call.arguments[0], DYN);
+                if (target.type.kind === "dyn") {
+                    const t = L.declareHiddenLocal("%oat", DYN);
+                    const p = L.declareHiddenLocal("%oap", DYN);
+                    const tRef = () => ({ kind: "varRef", localId: t.id, type: DYN, loc });
+                    const pRef = () => ({ kind: "varRef", localId: p.id, type: DYN, loc });
+                    const stmts = [
+                        { kind: "varDecl", localId: t.id, init: target, loc },
+                        { kind: "varDecl", localId: p.id, init: { kind: "dynArrLit", elems: [], type: DYN, loc }, loc },
+                    ];
+                    // V8 spells the optimized apply-path texts (the expression
+                    // named for a nullish source) only when the spread is the
+                    // SINGLE LAST argument; every other spread position drives
+                    // the real iterator protocol, whose failure describes the
+                    // value — the two runtime variants, picked here by position.
+                    const sources = call.arguments.slice(1);
+                    const spreadCount = sources.filter((a) => ts.isSpreadElement(a)).length;
+                    let ok = true;
+                    for (let i = 0; i < sources.length; i++) {
+                        const argNode = sources[i];
+                        const spread = ts.isSpreadElement(argNode);
+                        const srcNode = spread ? argNode.expression : argNode;
+                        const src = L.coerceToExpected(L.lowerExpr(srcNode), DYN);
+                        if (src.type.kind !== "dyn") {
+                            ok = false;
+                            break;
+                        }
+                        const argLoc = locOf(argNode);
+                        const optimized = spreadCount === 1 && i === sources.length - 1;
+                        stmts.push({
+                            kind: "exprStmt",
+                            expr: spread
+                                ? optimized
+                                    ? {
+                                        kind: "libCall",
+                                        fn: "dyn.packPushSpread",
+                                        args: [pRef(), src, { kind: "strLit", value: srcNode.getText(), type: STRING, loc: argLoc }],
+                                        type: VOID,
+                                        loc: argLoc,
+                                    }
+                                    : { kind: "libCall", fn: "dyn.packPushSpreadIter", args: [pRef(), src], type: VOID, loc: argLoc }
+                                : { kind: "libCall", fn: "dyn.packPush", args: [pRef(), src], type: VOID, loc: argLoc },
+                            loc: argLoc,
+                        });
+                    }
+                    if (ok) {
+                        return {
+                            kind: "seqExpr",
+                            stmts,
+                            result: { kind: "libCall", fn: "dyn.assignAll", args: [tRef(), pRef()], type: DYN, loc },
+                            type: DYN,
+                            loc,
+                        };
+                    }
+                }
+            }
+        }
         return null;
     }
     // Object.defineProperties over a CHECKED-DYNAMIC target (test/common's
@@ -6500,6 +7081,280 @@ export function bindingNeverReassigned(L, sym, decl) {
     L.neverReassignedCache.set(sym, !written);
     return !written;
 }
+/** Strips the value-preserving wrappers off an expression: parens,
+   * non-null assertions, `as`/`satisfies`/angle-bracket casts. What
+   * remains is the expression that actually evaluates. */
+export function stripValueWrappers(e) {
+    let v = e;
+    for (;;) {
+        if (ts.isParenthesizedExpression(v) || ts.isNonNullExpression(v) ||
+            ts.isAsExpression(v) || ts.isSatisfiesExpression(v) || ts.isTypeAssertion(v)) {
+            v = v.expression;
+            continue;
+        }
+        return v;
+    }
+}
+/** The nullish unit `e` provably evaluates to: a bare null/undefined
+   * literal (assertion-wrapped — `null as any`, `null!`), or a read of a
+   * registered NULLISH binding (nullishGenericBindingUnitOf). Null when
+   * the value could be anything else. */
+export function nullishExprUnitOf(L, e) {
+    const v = stripValueWrappers(e);
+    if (v.kind === ts.SyntaxKind.NullKeyword)
+        return "null";
+    if (ts.isIdentifier(v)) {
+        if (v.text === "undefined" && (L.typeOf(v).flags & ts.TypeFlags.Undefined) !== 0) {
+            return "undefined";
+        }
+        return nullishValueUnitOf(L, L.resolveValueSymbol(v));
+    }
+    return null;
+}
+/** The nullish unit a binding provably holds FOREVER, by VALUE alone: its
+   * initializer is nullish (`const i: I<A & B> = null as any`) and every
+   * write in its declaring file is nullish too (`a = b` where b is
+   * another nullish binding). No type condition — callers add their own
+   * (nullishGenericBindingUnitOf gates the no-storage family on
+   * unmappable types; the generic-method call path rescues its fence with
+   * the value fact alone). Cached per symbol; the pre-seeded null entry
+   * guards probe cycles (mutually-assigned bindings resolve link by link,
+   * declaration order). */
+export function nullishValueUnitOf(L, sym) {
+    if (!sym)
+        return null;
+    const cached = L.nullishBindings.get(sym);
+    if (cached !== undefined)
+        return cached;
+    L.nullishBindings.set(sym, null); // cycle guard: self-referential probes answer non-qualifying
+    const decl = L.checker.valueDeclarationOf(sym);
+    if (!decl || !ts.isVariableDeclaration(decl) || !ts.isIdentifier(decl.name) ||
+        decl.getSourceFile().isDeclarationFile || decl.initializer === undefined) {
+        return null;
+    }
+    const unit = nullishExprUnitOf(L, decl.initializer);
+    if (unit === null)
+        return null;
+    // Bindings with a CHECKED-DYNAMIC fallback (`const maybe: any =
+    // undefined`, JS inference residue) keep that story: the dyn world
+    // already holds null/undefined correctly and serves every read form
+    // (optional chains included) — this family exists for types with NO
+    // other home.
+    if (dynFallbackType(L, decl.name, L.checker.getTypeOfSymbol(sym)) !== null)
+        return null;
+    if (!allWritesNullish(L, sym, decl))
+        return null;
+    // A use inside a class HERITAGE clause (`class X extends Mixin(...)`)
+    // declines the whole family: heritage resolution is structural (the
+    // mixin machinery can pin the instantiation from the ARGUMENT class
+    // expression without ever reading the callee binding), so a claimed
+    // nullish callee would compile a working class where Node throws
+    // "Mixin is not a function" evaluating the extends expression. The
+    // declaration keeps its type fence instead.
+    if (usedInHeritageClause(L, sym))
+        return null;
+    L.nullishBindings.set(sym, unit);
+    return unit;
+}
+/** True when any identifier resolving to `sym` sits inside a class
+   * heritage clause anywhere in the program. */
+function usedInHeritageClause(L, sym) {
+    const symText = sym.name;
+    let found = false;
+    const visit = (n) => {
+        if (found)
+            return;
+        if (ts.isIdentifier(n) && n.text === symText &&
+            L.resolveValueSymbol(n) === sym) {
+            for (let p = n.parent; p !== undefined && !ts.isSourceFile(p); p = p.parent) {
+                if (ts.isHeritageClause(p)) {
+                    found = true;
+                    return;
+                }
+            }
+            return;
+        }
+        n.forEachChild(visit);
+    };
+    for (const file of L.program.getSourceFiles()) {
+        if (found)
+            break;
+        if (file.isDeclarationFile)
+            continue;
+        file.forEachChild(visit);
+    }
+    return found;
+}
+/** nullishValueUnitOf gated on a declared type that CANNOT hold the
+   * value — the NO-STORAGE family: an unmappable type has no other story,
+   * and a RECORD-mapped one (`const i: I<A & B> = null as any` — an
+   * interface whose members are all generic signatures interns an empty
+   * shape) has a slot null can never inhabit, so storing would throw the
+   * representation error where Node stores null silently. Either way the
+   * declaration emits nothing and reads know the value. Null-tolerant
+   * mappings (unions with a null/undefined arm, dyn) keep their real
+   * storage and every ordinary lowering. */
+export function nullishGenericBindingUnitOf(L, sym) {
+    if (!sym)
+        return null;
+    // The VALUE probe first — it is purely syntactic, so no checker type
+    // query runs for the overwhelmingly common non-nullish declarations
+    // (a query can even panic upstream — the 1e999 checker bug).
+    const unit = nullishValueUnitOf(L, sym);
+    if (unit === null)
+        return null;
+    const mapped = L.mapTypeOf(L.checker.getTypeOfSymbol(sym));
+    if (mapped !== null && mapped.kind !== "record")
+        return null;
+    return unit;
+}
+/** True when every write of `sym` in its declaring file is a plain `x =
+   * <nullish>` assignment — the discipline that keeps a nullish binding's
+   * value knowable. Compound assignments, ++/--, for-in/of cursors, and
+   * destructuring targets all disqualify. */
+function allWritesNullish(L, sym, decl) {
+    const symText = sym.name;
+    const namesSym = (e) => ts.isIdentifier(e) && e.text === symText && L.resolveValueSymbol(e) === sym;
+    let ok = true;
+    const visit = (n) => {
+        if (!ok)
+            return;
+        if (ts.isBinaryExpression(n)) {
+            const k = n.operatorToken.kind;
+            if (k >= ts.SyntaxKind.FirstAssignment && k <= ts.SyntaxKind.LastAssignment) {
+                let lhs = n.left;
+                while (ts.isParenthesizedExpression(lhs))
+                    lhs = lhs.expression;
+                if (namesSym(lhs)) {
+                    if (k !== ts.SyntaxKind.EqualsToken || nullishExprUnitOf(L, n.right) === null)
+                        ok = false;
+                }
+                else if (ts.isArrayLiteralExpression(lhs) || ts.isObjectLiteralExpression(lhs)) {
+                    const walk = (m) => {
+                        if (namesSym(m))
+                            ok = false;
+                        else
+                            m.forEachChild(walk);
+                    };
+                    walk(lhs);
+                }
+            }
+        }
+        else if ((ts.isPrefixUnaryExpression(n) || ts.isPostfixUnaryExpression(n)) &&
+            (n.operator === ts.SyntaxKind.PlusPlusToken || n.operator === ts.SyntaxKind.MinusMinusToken)) {
+            let op = n.operand;
+            while (ts.isParenthesizedExpression(op))
+                op = op.expression;
+            if (namesSym(op))
+                ok = false;
+        }
+        else if ((ts.isForOfStatement(n) || ts.isForInStatement(n)) && !ts.isVariableDeclarationList(n.initializer)) {
+            let t = n.initializer;
+            while (ts.isParenthesizedExpression(t))
+                t = t.expression;
+            if (namesSym(t))
+                ok = false;
+        }
+        n.forEachChild(visit);
+    };
+    decl.getSourceFile().forEachChild(visit);
+    return ok;
+}
+/** A VALUE-ONLY expression: materializing it has no observable effect
+   * beyond the value itself — function/arrow literals, class-free
+   * literals, nullish units. The dead-binding rule's purity test: Node
+   * builds the value and drops it, so skipping the build entirely is
+   * unobservable. Bare identifier reads stay OUT (a read above a `let`
+   * declaration is a TDZ throw Node WOULD serve). */
+function sideEffectFreeValueExpr(L, e) {
+    const v = stripValueWrappers(e);
+    if (ts.isArrowFunction(v) || ts.isFunctionExpression(v))
+        return true;
+    if (ts.isLiteralExpression(v) || v.kind === ts.SyntaxKind.NullKeyword ||
+        v.kind === ts.SyntaxKind.TrueKeyword || v.kind === ts.SyntaxKind.FalseKeyword) {
+        return true;
+    }
+    if (ts.isIdentifier(v) && v.text === "undefined" && (L.typeOf(v).flags & ts.TypeFlags.Undefined) !== 0) {
+        return true;
+    }
+    return false;
+}
+/** True when `sym` — a binding whose type has NO static mapping — is DEAD:
+   * never read anywhere in the program, not exported through a specifier,
+   * declared with no initializer or a side-effect-free one, and written
+   * (if at all) only by plain assignments of side-effect-free values. Node
+   * materializes those values and drops them — zero observable effect —
+   * so the declaration and its writes lower to NOTHING instead of fencing
+   * on a type the program never consumes (`var xs2: typeof Array;`, the
+   * write-only `var f2: { <T, U>(x: T, y: U): T }`). TS program files
+   * only: JS bindings keep their checked-dynamic fallbacks. Positive
+   * answers register in L.deadBindings (the assignment lowering skips
+   * writes by the same set). */
+export function deadUnmappableBinding(L, sym, decl) {
+    if (!sym)
+        return false;
+    if (L.deadBindings.has(sym))
+        return true;
+    if (!ts.isIdentifier(decl.name))
+        return false;
+    const sf = decl.getSourceFile();
+    if (sf.isDeclarationFile || isJsSourceFile(sf))
+        return false;
+    if (decl.initializer !== undefined && !sideEffectFreeValueExpr(L, decl.initializer))
+        return false;
+    // Exported bindings stay out: a library build's exports are consumed
+    // from outside the graph, and export specifiers double as reads.
+    if (ts.getCombinedModifierFlags(decl) & ts.ModifierFlags.Export)
+        return false;
+    // The type gate LAST among the cheap checks: querying the checker for
+    // a type is the expensive step (and can panic upstream — the 1e999
+    // bug), so only survivors of the syntactic filters pay it. Mappable
+    // types keep their real storage.
+    if (L.mapTypeOf(L.checker.getTypeOfSymbol(sym)) !== null)
+        return false;
+    const symText = sym.name;
+    const namesSym = (e) => ts.isIdentifier(e) && e.text === symText && L.resolveValueSymbol(e) === sym;
+    let dead = true;
+    const visit = (n) => {
+        if (!dead)
+            return;
+        if (ts.isIdentifier(n) && n.text === symText) {
+            // Declaration-name occurrences are not reads.
+            if (n.parent !== undefined && ts.isVariableDeclaration(n.parent) && n.parent.name === n) {
+                n.forEachChild(visit);
+                return;
+            }
+            // A plain-assignment LHS is a WRITE — dead only when the RHS
+            // builds no observable effect (the value is dropped with the
+            // binding).
+            const p = n.parent;
+            if (p !== undefined && ts.isBinaryExpression(p) &&
+                p.operatorToken.kind === ts.SyntaxKind.EqualsToken && p.left === n) {
+                if (!namesSym(n))
+                    return;
+                if (!sideEffectFreeValueExpr(L, p.right))
+                    dead = false;
+                return;
+            }
+            // Import/export specifiers, and every other occurrence, count as
+            // reads.
+            if (namesSym(n))
+                dead = false;
+            return;
+        }
+        n.forEachChild(visit);
+    };
+    for (const file of L.program.getSourceFiles()) {
+        if (!dead)
+            break;
+        if (file.isDeclarationFile)
+            continue;
+        file.forEachChild(visit);
+    }
+    if (dead)
+        L.deadBindings.add(sym);
+    return dead;
+}
 /** The generic function-like INITIALIZER behind a binding declaration —
    * `const f = <T>(x: T) => x` or `const f = function g<T>(x: T) {...}`
    * (parens stripped). Null when the declaration isn't that shape; the
@@ -6508,9 +7363,9 @@ export function bindingNeverReassigned(L, sym, decl) {
 export function bindingGenericFnNodeOf(decl) {
     if (!ts.isIdentifier(decl.name) || decl.initializer === undefined)
         return null;
-    let init = decl.initializer;
-    while (ts.isParenthesizedExpression(init))
-        init = init.expression;
+    // Assertion wrappers strip like parens: `const r = (<T>(x: T) => x) as
+    // Mapper` evaluates the arrow — the cast only renames its type.
+    const init = stripValueWrappers(decl.initializer);
     if ((ts.isArrowFunction(init) || ts.isFunctionExpression(init)) &&
         init.typeParameters !== undefined && init.body !== undefined) {
         return init;
@@ -6526,11 +7381,16 @@ export function bindingGenericFnNodeOf(decl) {
    * signature. Null when the shape doesn't match (a concrete annotation, a
    * generic arrow — the syntactic probe's case, an overloaded alias). */
 export function bindingContextualGenericFnNodeOf(L, decl) {
-    if (!ts.isIdentifier(decl.name) || decl.initializer === undefined || decl.type === undefined)
+    if (!ts.isIdentifier(decl.name) || decl.initializer === undefined)
         return null;
-    let init = decl.initializer;
-    while (ts.isParenthesizedExpression(init))
-        init = init.expression;
+    // The generic signature can arrive as an ANNOTATION or as a type
+    // ASSERTION on the initializer (`var r = < <T>(x: T) => T >((x) => x)`
+    // — the checker contextually types the operand's parameters by the
+    // asserted signature exactly like an annotation would).
+    const asserted = ts.isAsExpression(decl.initializer) || ts.isTypeAssertion(decl.initializer);
+    if (decl.type === undefined && !asserted)
+        return null;
+    const init = stripValueWrappers(decl.initializer);
     if (!(ts.isArrowFunction(init) || ts.isFunctionExpression(init)) ||
         init.typeParameters !== undefined || init.body === undefined) {
         return null;
@@ -6721,10 +7581,56 @@ export function requireObjLitGenericReceiver(L, blame, recvExpr, literal, name)
    * direct `call` of the instance with the receiver unevaluated. Claims
    * every call whose member is generic-callable — lowering it or fencing
    * with a named message. */
+/** URL.revokeObjectURL() with NO argument: Node's ERR_MISSING_ARGS
+ * throws before the registry lookup, so the zero-argument contract is
+ * exact without any blob machinery. The one-argument form (Node's
+ * silent no-op for unregistered ids) and createObjectURL keep their
+ * fences — a compiled program has no blob registry to consult. */
+function lowerUrlStaticCall(L, call, callee) {
+    if (!ts.isPropertyAccessExpression(callee) || callee.questionDotToken !== undefined)
+        return null;
+    if (!ts.isIdentifier(callee.expression) || callee.expression.text !== "URL")
+        return null;
+    if (callee.name.text !== "revokeObjectURL" || call.arguments.length !== 0)
+        return null;
+    const sym = L.resolveValueSymbol(callee.expression);
+    if (!sym || !L.isStdlibSymbol(sym))
+        return null;
+    return nodeThrowExpr(1, "ERR_MISSING_ARGS", 'The "url" argument must be specified', VOID, locOf(call));
+}
+const SP_BRAND_METHODS = new Set([
+    "append", "delete", "get", "getAll", "has", "set", "sort",
+    "forEach", "keys", "values", "entries", "toString",
+]);
 export function lowerObjLitGenericMethodCall(L, call, access) {
     if (L.chainBlocked(access, call))
         return null;
     const name = access.name.text;
+    // URLSearchParams method values through Function.prototype.call/apply
+    // with a receiver that is provably NOT a URLSearchParams (the suite's
+    // `params.append.call(undefined)` probes): the WHATWG brand check
+    // throws ERR_INVALID_THIS before any argument conversion — the whole
+    // call IS that throw. A receiver that IS searchParams-typed, or one
+    // whose runtime kind is unknowable (dyn/'any'), keeps the fence.
+    if ((name === "call" || name === "apply") &&
+        ts.isPropertyAccessExpression(access.expression) &&
+        L.mapTypeOf(L.typeOf(access.expression.expression))?.kind === "searchParams" &&
+        SP_BRAND_METHODS.has(access.expression.name.text) &&
+        L.isStdlibMember(access.expression)) {
+        const thisArg = call.arguments[0];
+        const thisT = thisArg ? L.mapTypeOf(L.typeOf(thisArg)) : { kind: "undefinedT" };
+        const provablyNot = thisT !== null &&
+            thisT.kind !== "searchParams" &&
+            thisT.kind !== "dyn" &&
+            thisT.kind !== "jsval" &&
+            (!thisArg || ts.isIdentifier(thisArg) || ts.isLiteralExpression(thisArg) ||
+                thisArg.kind === ts.SyntaxKind.UndefinedKeyword ||
+                thisArg.kind === ts.SyntaxKind.NullKeyword ||
+                isUnitType(thisT));
+        if (provablyNot) {
+            return nodeThrowExpr(1, "ERR_INVALID_THIS", 'Value of "this" must be of type URLSearchParams', L.mapTypeOf(L.typeOf(call)) ?? VOID, locOf(call));
+        }
+    }
     const recvT = L.typeOf(access.expression);
     const propSym = L.checker.getPropertyOfType(recvT, name);
     if (!propSym)
@@ -6757,6 +7663,24 @@ export function lowerObjLitGenericMethodCall(L, call, access) {
     }
     const found = objLitGenericFnNodeOf(L, propSym);
     if (!found) {
+        // Function.prototype.apply/call/bind spelled through a FUNCTION
+        // receiver: compiled functions are direct calls with no runtime
+        // `this`/arguments object to re-route — name the working spelling
+        // instead of a class-receiver hint (or an SC2020 recitation) no
+        // function value can follow. Before the stdlib decline: these ARE
+        // stdlib members (CallableFunction), but the pointed message is
+        // the honest one.
+        if ((name === "apply" || name === "call" || name === "bind") &&
+            L.checker.getCallSignatures(recvT).length > 0) {
+            L.unsupported("SC1090", call, `Function.prototype.${name} on a compiled function value (compiled calls are direct — no runtime 'this' or arguments object exists to re-route; spell the call directly: '${access.expression.getText()}(...)')`);
+        }
+        // STANDARD-LIBRARY generic members (Promise.then, Object.
+        // defineProperty, Array-augmentation methods) are the lib fence's
+        // story (SC2020, naming the member) — decline so the stdlib
+        // chokepoint downstream reports, instead of an interface-dispatch
+        // recitation about a receiver no user constructed.
+        if (L.isStdlibMember(access))
+            return null;
         // Interface-declared generic methods dispatch statically, so the
         // receiver's runtime class must be provable — name that discipline
         // instead of the object-literal wording when the method lives on an